react-native-iap 14.7.12 → 14.7.14

package/android/src/main/java/com/margelo/nitro/iap/HybridRnIap.kt

@@ -42,6 +42,7 @@ import dev.hyo.openiap.ExternalLinkLaunchModeAndroid as OpenIapExternalLinkLaunc
 import dev.hyo.openiap.ExternalLinkTypeAndroid as OpenIapExternalLinkType
 import dev.hyo.openiap.listener.OpenIapDeveloperProvidedBillingListener
 import dev.hyo.openiap.store.OpenIapStore
+import kotlin.coroutines.cancellation.CancellationException
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import kotlinx.coroutines.CompletableDeferred
@@ -100,19 +101,34 @@ class HybridRnIap : HybridRnIapSpec() {
             // CRITICAL: Set Activity BEFORE calling initConnection
             // Horizon SDK needs Activity to initialize OVRPlatform with proper returnComponent
             // https://github.com/meta-quest/Meta-Spatial-SDK-Samples/issues/82#issuecomment-3452577530
-            withContext(Dispatchers.Main) {
-                runCatching { context.currentActivity }
-                    .onSuccess { activity ->
-                        if (activity != null) {
-                            RnIapLog.debug("Activity available: ${activity.javaClass.name}")
-                            openIap.setActivity(activity)
-                        } else {
-                            RnIapLog.warn("Activity is null during initConnection")
+            try {
+                withContext(Dispatchers.Main) {
+                    runCatching { context.currentActivity }
+                        .onSuccess { activity ->
+                            if (activity != null) {
+                                RnIapLog.debug("Activity available: ${activity.javaClass.name}")
+                                openIap.setActivity(activity)
+                            } else {
+                                RnIapLog.warn("Activity is null during initConnection")
+                            }
                         }
-                    }
-                    .onFailure {
-                        RnIapLog.warn("Activity not available during initConnection - OpenIAP will use Context")
-                    }
+                        .onFailure {
+                            RnIapLog.warn("Activity not available during initConnection - OpenIAP will use Context")
+                        }
+                }
+            } catch (err: CancellationException) {
+                throw err
+            } catch (err: Throwable) {
+                val error = OpenIAPError.InitConnection
+                val errorMessage = err.message ?: err.javaClass.name
+                RnIapLog.failure("initConnection.setActivity", err)
+                throw OpenIapException(
+                    toErrorJson(
+                        error = error,
+                        debugMessage = errorMessage,
+                        messageOverride = "Failed to set activity: $errorMessage"
+                    )
+                )
             }
 
             // Single-flight: capture or create the shared Deferred atomically
@@ -128,64 +144,88 @@ class HybridRnIap : HybridRnIapSpec() {
                 return@async result
             }
 
-            if (!listenersAttached) {
-                listenersAttached = true
-                RnIapLog.payload("listeners.attach", null)
-                openIap.addPurchaseUpdateListener(OpenIapPurchaseUpdateListener { p ->
-                    runCatching {
-                        RnIapLog.result(
-                            "purchaseUpdatedListener",
-                            mapOf("id" to p.id, "sku" to p.productId)
-                        )
-                        sendPurchaseUpdate(convertToNitroPurchase(p))
-                    }.onFailure { RnIapLog.failure("purchaseUpdatedListener", it) }
-                })
-                openIap.addPurchaseErrorListener(OpenIapPurchaseErrorListener { e ->
-                    val code = OpenIAPError.toCode(e)
-                    val message = e.message ?: OpenIAPError.defaultMessage(code)
-                    runCatching {
-                        RnIapLog.result(
-                            "purchaseErrorListener",
-                            mapOf("code" to code, "message" to message)
-                        )
-                        sendPurchaseError(
-                            NitroPurchaseResult(
-                                responseCode = -1.0,
-                                debugMessage = null,
-                                code = code,
-                                message = message,
-                                purchaseToken = null
+            try {
+                if (!listenersAttached) {
+                    listenersAttached = true
+                    RnIapLog.payload("listeners.attach", null)
+                    openIap.addPurchaseUpdateListener(OpenIapPurchaseUpdateListener { p ->
+                        runCatching {
+                            RnIapLog.result(
+                                "purchaseUpdatedListener",
+                                mapOf("id" to p.id, "sku" to p.productId)
                             )
-                        )
-                    }.onFailure { RnIapLog.failure("purchaseErrorListener", it) }
-                })
-                openIap.addUserChoiceBillingListener(OpenIapUserChoiceBillingListener { details ->
-                    runCatching {
-                        RnIapLog.result(
-                            "userChoiceBillingListener",
-                            mapOf("products" to details.products, "token" to details.externalTransactionToken)
-                        )
-                        val nitroDetails = UserChoiceBillingDetails(
-                            externalTransactionToken = details.externalTransactionToken,
-                            products = details.products.toTypedArray()
-                        )
-                        sendUserChoiceBilling(nitroDetails)
-                    }.onFailure { RnIapLog.failure("userChoiceBillingListener", it) }
-                })
-                // Developer Provided Billing listener (External Payments - 8.3.0+)
-                openIap.addDeveloperProvidedBillingListener(OpenIapDeveloperProvidedBillingListener { details ->
-                    runCatching {
-                        RnIapLog.result(
-                            "developerProvidedBillingListener",
-                            mapOf("token" to details.externalTransactionToken)
-                        )
-                        val nitroDetails = DeveloperProvidedBillingDetailsAndroid(
-                            externalTransactionToken = details.externalTransactionToken
-                        )
-                        sendDeveloperProvidedBilling(nitroDetails)
-                    }.onFailure { RnIapLog.failure("developerProvidedBillingListener", it) }
-                })
-                RnIapLog.result("listeners.attach", "attached")
+                            sendPurchaseUpdate(convertToNitroPurchase(p))
+                        }.onFailure { RnIapLog.failure("purchaseUpdatedListener", it) }
+                    })
+                    openIap.addPurchaseErrorListener(OpenIapPurchaseErrorListener { e ->
+                        val code = OpenIAPError.toCode(e)
+                        val message = e.message ?: OpenIAPError.defaultMessage(code)
+                        runCatching {
+                            RnIapLog.result(
+                                "purchaseErrorListener",
+                                mapOf("code" to code, "message" to message)
+                            )
+                            sendPurchaseError(
+                                NitroPurchaseResult(
+                                    responseCode = -1.0,
+                                    debugMessage = null,
+                                    code = code,
+                                    message = message,
+                                    purchaseToken = null
+                                )
+                            )
+                        }.onFailure { RnIapLog.failure("purchaseErrorListener", it) }
+                    })
+                    openIap.addUserChoiceBillingListener(OpenIapUserChoiceBillingListener { details ->
+                        runCatching {
+                            RnIapLog.result(
+                                "userChoiceBillingListener",
+                                mapOf("products" to details.products, "token" to details.externalTransactionToken)
+                            )
+                            val nitroDetails = UserChoiceBillingDetails(
+                                externalTransactionToken = details.externalTransactionToken,
+                                products = details.products.toTypedArray()
+                            )
+                            sendUserChoiceBilling(nitroDetails)
+                        }.onFailure { RnIapLog.failure("userChoiceBillingListener", it) }
+                    })
+                    // Developer Provided Billing listener (External Payments - 8.3.0+)
+                    openIap.addDeveloperProvidedBillingListener(OpenIapDeveloperProvidedBillingListener { details ->
+                        runCatching {
+                            RnIapLog.result(
+                                "developerProvidedBillingListener",
+                                mapOf("token" to details.externalTransactionToken)
+                            )
+                            val nitroDetails = DeveloperProvidedBillingDetailsAndroid(
+                                externalTransactionToken = details.externalTransactionToken
+                            )
+                            sendDeveloperProvidedBilling(nitroDetails)
+                        }.onFailure { RnIapLog.failure("developerProvidedBillingListener", it) }
+                    })
+                    RnIapLog.result("listeners.attach", "attached")
+                }
+            } catch (err: CancellationException) {
+                throw err
+            } catch (err: Throwable) {
+                listenersAttached = false
+                val error = OpenIAPError.InitConnection
+                val errorMessage = err.message ?: err.javaClass.name
+                RnIapLog.failure("initConnection.listeners", err)
+                val wrapped = OpenIapException(
+                    toErrorJson(
+                        error = error,
+                        debugMessage = errorMessage,
+                        messageOverride = "Failed to register billing listeners: $errorMessage"
+                    )
+                )
+                synchronized(initLock) {
+                    initDeferred?.let { deferred ->
+                        if (!deferred.isCompleted) deferred.completeExceptionally(wrapped)
+                    }
+                    initDeferred = null
+                }
+                isInitialized = false
+                throw wrapped
             }
 
             // We created it above; reuse the shared instance
@@ -258,8 +298,8 @@ class HybridRnIap : HybridRnIapSpec() {
             synchronized(purchaseUpdatedListeners) { purchaseUpdatedListeners.clear() }
             synchronized(purchaseErrorListeners) { purchaseErrorListeners.clear() }
             promotedProductListenersIOS.clear()
-            userChoiceBillingListenersAndroid.clear()
-            developerProvidedBillingListenersAndroid.clear()
+            synchronized(userChoiceBillingListenersAndroid) { userChoiceBillingListenersAndroid.clear() }
+            synchronized(developerProvidedBillingListenersAndroid) { developerProvidedBillingListenersAndroid.clear() }
             initDeferred = null
             RnIapLog.result("endConnection", true)
             true
@@ -1592,9 +1632,8 @@ class HybridRnIap : HybridRnIapSpec() {
     }
 
     private fun sendUserChoiceBilling(details: UserChoiceBillingDetails) {
-        synchronized(userChoiceBillingListenersAndroid) {
-            userChoiceBillingListenersAndroid.forEach { it(details) }
-        }
+        val snapshot = synchronized(userChoiceBillingListenersAndroid) { ArrayList(userChoiceBillingListenersAndroid) }
+        snapshot.forEach { it(details) }
     }
 
     // Developer Provided Billing listener (External Payments - 8.3.0+)
@@ -1611,9 +1650,8 @@ class HybridRnIap : HybridRnIapSpec() {
     }
 
     private fun sendDeveloperProvidedBilling(details: DeveloperProvidedBillingDetailsAndroid) {
-        synchronized(developerProvidedBillingListenersAndroid) {
-            developerProvidedBillingListenersAndroid.forEach { it(details) }
-        }
+        val snapshot = synchronized(developerProvidedBillingListenersAndroid) { ArrayList(developerProvidedBillingListenersAndroid) }
+        snapshot.forEach { it(details) }
     }
 
     // -------------------------------------------------------------------------

package/android/src/test/java/com/margelo/nitro/iap/ListenerThreadSafetyTest.kt

@@ -0,0 +1,154 @@
+package com.margelo.nitro.iap
+
+import org.junit.Test
+import org.junit.Assert.*
+import java.util.concurrent.CyclicBarrier
+import java.util.concurrent.atomic.AtomicInteger
+import java.util.concurrent.atomic.AtomicReference
+import kotlin.concurrent.thread
+
+/**
+ * Thread safety tests for the synchronized + snapshot listener pattern
+ * used in HybridRnIap to prevent ConcurrentModificationException.
+ *
+ * Addresses Issue #3150 where purchase events were silently lost
+ * due to concurrent listener access.
+ */
+class ListenerThreadSafetyTest {
+
+    @Test
+    fun `concurrent add and snapshot iterate does not throw`() {
+        val listeners = mutableListOf<(String) -> Unit>()
+        val callCount = AtomicInteger(0)
+        val errorRef = AtomicReference<Throwable?>(null)
+        val iterations = 500
+        val barrier = CyclicBarrier(2)
+
+        val adder = thread {
+            barrier.await()
+            repeat(iterations) {
+                synchronized(listeners) { listeners.add { callCount.incrementAndGet() } }
+            }
+        }
+
+        val sender = thread {
+            barrier.await()
+            repeat(iterations) {
+                val snapshot = synchronized(listeners) { ArrayList(listeners) }
+                snapshot.forEach {
+                    try {
+                        it("event")
+                    } catch (e: Throwable) {
+                        errorRef.compareAndSet(null, e)
+                    }
+                }
+            }
+        }
+
+        adder.join(5000)
+        sender.join(5000)
+        assertFalse("Adder thread did not finish", adder.isAlive)
+        assertFalse("Sender thread did not finish", sender.isAlive)
+        assertNull("Should not throw ConcurrentModificationException", errorRef.get())
+    }
+
+    @Test
+    fun `concurrent add, remove, and iterate is safe`() {
+        val listeners = mutableListOf<(String) -> Unit>()
+        val errorRef = AtomicReference<Throwable?>(null)
+        val barrier = CyclicBarrier(3)
+
+        val adder = thread {
+            barrier.await()
+            repeat(200) {
+                synchronized(listeners) { listeners.add { _ -> } }
+            }
+        }
+
+        val remover = thread {
+            barrier.await()
+            repeat(200) {
+                synchronized(listeners) {
+                    if (listeners.isNotEmpty()) listeners.removeAt(0)
+                }
+            }
+        }
+
+        val sender = thread {
+            barrier.await()
+            repeat(200) {
+                val snapshot = synchronized(listeners) { ArrayList(listeners) }
+                snapshot.forEach {
+                    try {
+                        it("event")
+                    } catch (e: Throwable) {
+                        errorRef.compareAndSet(null, e)
+                    }
+                }
+            }
+        }
+
+        adder.join(5000)
+        remover.join(5000)
+        sender.join(5000)
+        assertFalse("Adder thread did not finish", adder.isAlive)
+        assertFalse("Remover thread did not finish", remover.isAlive)
+        assertFalse("Sender thread did not finish", sender.isAlive)
+        assertNull("Concurrent access should be safe with snapshot pattern", errorRef.get())
+    }
+
+    @Test
+    fun `snapshot delivers to all registered listeners`() {
+        val listeners = mutableListOf<(String) -> Unit>()
+        val results = mutableListOf<String>()
+
+        synchronized(listeners) {
+            listeners.add { results.add("listener1:$it") }
+            listeners.add { results.add("listener2:$it") }
+        }
+
+        val snapshot = synchronized(listeners) { ArrayList(listeners) }
+        snapshot.forEach { it("event") }
+
+        assertEquals(2, results.size)
+        assertTrue(results.contains("listener1:event"))
+        assertTrue(results.contains("listener2:event"))
+    }
+
+    @Test
+    fun `synchronized clear removes all listeners`() {
+        val listeners = mutableListOf<(String) -> Unit>()
+        synchronized(listeners) {
+            listeners.add { _ -> }
+            listeners.add { _ -> }
+        }
+
+        synchronized(listeners) { listeners.clear() }
+
+        val snapshot = synchronized(listeners) { ArrayList(listeners) }
+        assertTrue("Listeners should be empty after clear", snapshot.isEmpty())
+    }
+
+    @Test
+    fun `snapshot is isolated from subsequent modifications`() {
+        val listeners = mutableListOf<(String) -> Unit>()
+        val results = mutableListOf<String>()
+
+        synchronized(listeners) {
+            listeners.add { results.add("original:$it") }
+        }
+
+        // Take snapshot before adding more listeners
+        val snapshot = synchronized(listeners) { ArrayList(listeners) }
+
+        // Add another listener after snapshot
+        synchronized(listeners) {
+            listeners.add { results.add("added-after:$it") }
+        }
+
+        // Only the original listener should be in the snapshot
+        snapshot.forEach { it("event") }
+        assertEquals(1, results.size)
+        assertEquals("original:event", results[0])
+    }
+}

package/ios/HybridRnIap.swift

@@ -23,7 +23,9 @@ class HybridRnIap: HybridRnIapSpec {
     private var deliveredPurchaseEventOrder: [String] = []
     private let purchaseEventDedupLimit = 128
     private var purchasePayloadById: [String: [String: Any]] = [:]
-    
+    // Thread safety lock for listener arrays and error dedup state
+    private let listenerLock = NSLock()
+
     // MARK: - Initialization
     
     override init() {
@@ -851,8 +853,8 @@ class HybridRnIap: HybridRnIapSpec {
     }
     
     func addPromotedProductListenerIOS(listener: @escaping (NitroProduct) -> Void) throws {
-        promotedProductListeners.append(listener)
-        
+        listenerLock.withLock { promotedProductListeners.append(listener) }
+
         // If a promoted product is already available from OpenIAP, notify immediately
         Task {
             RnIapLog.payload("promotedProductListenerIOS.fetch", nil)
@@ -864,33 +866,27 @@ class HybridRnIap: HybridRnIapSpec {
             }
         }
     }
-    
+
     func removePromotedProductListenerIOS(listener: @escaping (NitroProduct) -> Void) throws {
-        // Note: In Swift, comparing closures is not straightforward, so we'll clear all listeners
-        // In a real implementation, you might want to use a unique identifier for each listener
-        promotedProductListeners.removeAll()
+        listenerLock.withLock { promotedProductListeners.removeAll() }
     }
-    
+
     // MARK: - Event Listener Methods
-    
+
     func addPurchaseUpdatedListener(listener: @escaping (NitroPurchase) -> Void) throws {
-        purchaseUpdatedListeners.append(listener)
+        listenerLock.withLock { purchaseUpdatedListeners.append(listener) }
     }
-    
+
     func addPurchaseErrorListener(listener: @escaping (NitroPurchaseResult) -> Void) throws {
-        purchaseErrorListeners.append(listener)
+        listenerLock.withLock { purchaseErrorListeners.append(listener) }
     }
-    
+
     func removePurchaseUpdatedListener(listener: @escaping (NitroPurchase) -> Void) throws {
-        // Note: This is a limitation of Swift closures - we can't easily remove by reference
-        // For now, we'll just clear all listeners when requested
-        purchaseUpdatedListeners.removeAll()
+        listenerLock.withLock { purchaseUpdatedListeners.removeAll() }
     }
-    
+
     func removePurchaseErrorListener(listener: @escaping (NitroPurchaseResult) -> Void) throws {
-        // Note: This is a limitation of Swift closures - we can't easily remove by reference
-        // For now, we'll just clear all listeners when requested
-        purchaseErrorListeners.removeAll()
+        listenerLock.withLock { purchaseErrorListeners.removeAll() }
     }
     
     // MARK: - Private Helper Methods
@@ -954,20 +950,22 @@ class HybridRnIap: HybridRnIapSpec {
                         RnIapLog.result("fetchProducts", payloads)
                         if let payload = payloads.first {
                             let nitro = RnIapHelper.convertProductDictionary(payload)
+                            let snapshot = self.listenerLock.withLock { Array(self.promotedProductListeners) }
                             await MainActor.run {
-                                for listener in self.promotedProductListeners { listener(nitro) }
+                                for listener in snapshot { listener(nitro) }
                             }
                         }
                     } catch {
                         RnIapLog.failure("promotedProductListenerIOS", error: error)
                         let id = productId
+                        let snapshot = self.listenerLock.withLock { Array(self.promotedProductListeners) }
                         await MainActor.run {
                             var minimal = NitroProduct()
                             minimal.id = id
                             minimal.title = id
                             minimal.type = "inapp"
                             minimal.platform = .ios
-                            for listener in self.promotedProductListeners { listener(minimal) }
+                            for listener in snapshot { listener(minimal) }
                         }
                     }
                 }
@@ -992,44 +990,59 @@ class HybridRnIap: HybridRnIapSpec {
         ]
         let eventKey = keyComponents.joined(separator: "#")
 
-        if deliveredPurchaseEventKeys.contains(eventKey) {
-            RnIapLog.warn("Duplicate purchase update skipped for \(purchase.productId)")
-            return
+        var isDuplicate = false
+        let snapshot: [(NitroPurchase) -> Void] = listenerLock.withLock {
+            if deliveredPurchaseEventKeys.contains(eventKey) {
+                isDuplicate = true
+                return []
+            }
+
+            deliveredPurchaseEventKeys.insert(eventKey)
+            deliveredPurchaseEventOrder.append(eventKey)
+            if deliveredPurchaseEventOrder.count > purchaseEventDedupLimit, let removed = deliveredPurchaseEventOrder.first {
+                deliveredPurchaseEventOrder.removeFirst()
+                deliveredPurchaseEventKeys.remove(removed)
+            }
+
+            return Array(purchaseUpdatedListeners)
         }
 
-        deliveredPurchaseEventKeys.insert(eventKey)
-        deliveredPurchaseEventOrder.append(eventKey)
-        if deliveredPurchaseEventOrder.count > purchaseEventDedupLimit, let removed = deliveredPurchaseEventOrder.first {
-            deliveredPurchaseEventOrder.removeFirst()
-            deliveredPurchaseEventKeys.remove(removed)
+        if isDuplicate {
+            RnIapLog.warn("Duplicate purchase update skipped for \(purchase.productId)")
+            return
         }
 
-        for listener in purchaseUpdatedListeners {
+        for listener in snapshot {
             listener(purchase)
         }
     }
-    
+
     private func sendPurchaseError(_ error: NitroPurchaseResult, productId: String? = nil) {
-        let now = Date().timeIntervalSince1970
         let dedupIdentifier = productId
             ?? (error.purchaseToken?.isEmpty == false ? error.purchaseToken : nil)
             ?? (error.message.isEmpty ? nil : error.message)
         let currentKey = RnIapHelper.makeErrorDedupKey(code: error.code, productId: dedupIdentifier)
-        // Dedup only when the exact same error is emitted almost simultaneously.
-        let withinWindow = (now - lastPurchaseErrorTimestamp) < 0.15
-        if currentKey == lastPurchaseErrorKey && withinWindow {
-            return
-        }
 
-        lastPurchaseErrorKey = currentKey
-        lastPurchaseErrorTimestamp = now
+        // Protect error dedup state since sendPurchaseError is called from multiple threads
+        let shouldSkip: Bool = listenerLock.withLock {
+            let now = Date().timeIntervalSince1970
+            let withinWindow = (now - lastPurchaseErrorTimestamp) < 0.15
+            if currentKey == lastPurchaseErrorKey && withinWindow {
+                return true
+            }
+            lastPurchaseErrorKey = currentKey
+            lastPurchaseErrorTimestamp = now
+            return false
+        }
+        if shouldSkip { return }
 
         // Ensure we never leak SKU via purchaseToken
         var sanitized = error
         if let pid = productId, sanitized.purchaseToken == pid {
             sanitized.purchaseToken = nil
         }
-        for listener in purchaseErrorListeners {
+        let snapshot = listenerLock.withLock { Array(purchaseErrorListeners) }
+        for listener in snapshot {
             listener(sanitized)
         }
     }
@@ -1067,15 +1080,20 @@ class HybridRnIap: HybridRnIapSpec {
             RnIapLog.result("endConnection", result as Any)
         }
 
-        // Clear event listeners
-        purchaseUpdatedListeners.removeAll()
-        purchaseErrorListeners.removeAll()
-        promotedProductListeners.removeAll()
-        deliveredPurchaseEventKeys.removeAll()
-        deliveredPurchaseEventOrder.removeAll()
-        purchasePayloadById.removeAll()
-        lastPurchaseErrorKey = nil
-        lastPurchaseErrorTimestamp = 0
+        // Clear event listeners, error dedup state, and delivery state (thread-safe)
+        listenerLock.withLock {
+            purchaseUpdatedListeners.removeAll()
+            purchaseErrorListeners.removeAll()
+            promotedProductListeners.removeAll()
+            lastPurchaseErrorKey = nil
+            lastPurchaseErrorTimestamp = 0
+            deliveredPurchaseEventKeys.removeAll()
+            deliveredPurchaseEventOrder.removeAll()
+        }
+        // Clear purchasePayloadById on MainActor to match its access pattern
+        Task { @MainActor in
+            self.purchasePayloadById.removeAll()
+        }
     }
 
     func deepLinkToSubscriptionsAndroid(options: NitroDeepLinkOptionsAndroid) throws -> Promise<Void> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-iap",
-  "version": "14.7.12",
+  "version": "14.7.14",
   "description": "React Native In-App Purchases module for iOS and Android using Nitro",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",