Can not pass verifyNotification because bundleId and environment not be set from new notification version

[nicolasopt]

Hi @alexanderjordanbaker,

Thanks for your team hard working on this library !

I have a problem when I upgrade in-app purchase to newest version with new jwt purchaseToken. I need verify it to see purchase information by verifyAndDecodeNotification method.

But it always can not pass verifyNotification step because the decodedJWT object is not ResponseBodyV2DecodedPayload object interface.

the decodedJWT look like ResponseBodyV2DecodedPayload.data

This is the output of decodedJWT :

So, the bundleId, appAppleId, environment can not be set from decodedJWT. Then they goto verifyNotification method to compare always throw error.

async verifyAndDecodeNotification(signedPayload) {
        const decodedJWT = await this.verifyJWT(signedPayload, this.responseBodyV2DecodedPayloadValidator, this.extractSignedDate);
        let appAppleId;
        let bundleId;
        let environment;
        if (decodedJWT.data) {
            appAppleId = decodedJWT.data.appAppleId;
            bundleId = decodedJWT.data.bundleId;
            environment = decodedJWT.data.environment;
        }
        else if (decodedJWT.summary) {
            appAppleId = decodedJWT.summary.appAppleId;
            bundleId = decodedJWT.summary.bundleId;
            environment = decodedJWT.summary.environment;
        }
        else if (decodedJWT.externalPurchaseToken) {
            appAppleId = decodedJWT.externalPurchaseToken.appAppleId;
            bundleId = decodedJWT.externalPurchaseToken.bundleId;
            if (decodedJWT.externalPurchaseToken.externalPurchaseId && decodedJWT.externalPurchaseToken.externalPurchaseId.startsWith("SANDBOX")) {
                environment = Environment_1.Environment.SANDBOX;
            }
            else {
                environment = Environment_1.Environment.PRODUCTION;
            }
        }
        this.verifyNotification(bundleId, appAppleId, environment);
        return decodedJWT;
    }
    verifyNotification(bundleId, appAppleId, environment) {
        if (this.bundleId !== bundleId || (this.environment === Environment_1.Environment.PRODUCTION && this.appAppleId !== appAppleId)) {
            throw new VerificationException(VerificationStatus.INVALID_APP_IDENTIFIER);
        }
        if (this.environment !== environment) {
            throw new VerificationException(VerificationStatus.INVALID_ENVIRONMENT);
        }
    }

So, please update the output decodedJWT to support token data at the top object not only in decodedJWT.data .

Also, when I test with sandbox token no appAppleId return in decodedJWT, so please update the comparation appAppleId and environment only when appAppleId exist in decodedJWT.

Thank in advance !

[alexanderjordanbaker]

That’s an in-app transaction, not a notification

[nicolasopt]

@alexanderjordanbaker ,

Ok, I can use the method verifyAndDecodeAppTransaction , but it is not support for dynamic environment verification.

We can not to know which token is sandbox or production to put in the SignedDataVerifier options.
From your condition about environment, we always must to see the token send to server is sandbox or production then put in verifier options, and with sandbox it is no need app ID.

So I think it is hard to use with that method. What do you think ?

Even I put correct environment in the new verifier class but when I debug log for sandbox token, enviroment should not be get by receiptType field because it does not exist.

async verifyAndDecodeAppTransaction(signedAppTransaction) {
        const decodedAppTransaction = await this.verifyJWT(signedAppTransaction, this.appTransactionValidator, t => t.receiptCreationDate === undefined ? new Date() : new Date(t.receiptCreationDate));
        console.log('decodedAppTransaction', decodedAppTransaction);
        const environment = decodedAppTransaction.receiptType;
        if (this.bundleId !== decodedAppTransaction.bundleId || (this.environment === Environment_1.Environment.PRODUCTION && this.appAppleId !== decodedAppTransaction.appAppleId)) {
            throw new VerificationException(VerificationStatus.INVALID_APP_IDENTIFIER);
        }
        console.log('environment', environment, this.environment);
        if (this.environment !== environment) {
            throw new VerificationException(VerificationStatus.INVALID_ENVIRONMENT);
        }
        return decodedAppTransaction;
    }

input environment ( Sandbox ) not equal undefined environment get from decodedAppTransaction.receiptType
and then it throw error code = 4.