リワード広告の報酬を、端末からの合図だけで配らない — Rork(Expo)アプリのSSV検証をWorkerで組む

const KEY_SERVER = 'https://www.gstatic.com/admob/reward/verifier-keys.json';
 
interface VerifierKey { keyId: number; pem: string; base64: string; }
 
async function fetchVerifierKeys(): Promise<Map<number, string>> {
  const cache = caches.default;
  const cacheKey = new Request(KEY_SERVER);
  let res = await cache.match(cacheKey);
 
  if (!res) {
    res = await fetch(KEY_SERVER);
    // 鍵サーバーのレスポンスを最大23時間だけ保持(24h上限に余裕を持たせる)
    const cached = new Response(res.body, res);
    cached.headers.set('Cache-Control', 'max-age=82800');
    await cache.put(cacheKey, cached.clone());
    res = cached;
  }
 
  const data = await res.json<{ keys: VerifierKey[] }>();
  const map = new Map<number, string>();
  for (const k of data.keys) map.set(k.keyId, k.pem);
  return map;
}

compatibility_flags = ["nodejs_compat"]

import { verify as nodeVerify } from 'node:crypto';
 
function extractSignedContent(rawQuery: string) {
  // rawQuery は "?" を除いた生のクエリ文字列
  const sigMarker = '&signature=';
  const idx = rawQuery.indexOf(sigMarker);
  if (idx === -1) return null;
 
  const signedContent = rawQuery.slice(0, idx); // 署名対象(デコード禁止)
  const params = new URLSearchParams(rawQuery.slice(idx + 1));
  const signatureB64url = rawQuery.slice(idx + sigMarker.length).split('&')[0];
  const keyId = Number(params.get('key_id'));
  return { signedContent, signatureB64url, keyId };
}
 
function b64urlToBuffer(s: string): Buffer {
  const b64 = s.replace(/-/g, '+').replace(/_/g, '/');
  return Buffer.from(b64, 'base64');
}
 
async function verifyCallback(rawQuery: string): Promise<boolean> {
  const parsed = extractSignedContent(rawQuery);
  if (!parsed) return false;
 
  const keys = await fetchVerifierKeys();
  const pem = keys.get(parsed.keyId);
  if (!pem) return false; // 未知のkey_id。取り直し経路へ回してもよい
 
  const signature = b64urlToBuffer(parsed.signatureB64url);
  return nodeVerify(
    'sha256',
    Buffer.from(parsed.signedContent, 'utf8'),
    pem,
    signature,
  );
}

export default {
  async fetch(req: Request, env: Env): Promise<Response> {
    const url = new URL(req.url);
    const rawQuery = url.search.startsWith('?') ? url.search.slice(1) : url.search;
    const params = new URLSearchParams(rawQuery);
 
    // 1) 署名検証
    if (!(await verifyCallback(rawQuery))) {
      return new Response('invalid signature', { status: 403 });
    }
 
    // 2) 鮮度チェック(5分より古いコールバックは拒否)
    const ts = Number(params.get('timestamp'));
    if (!ts || Math.abs(Date.now() - ts) > 5 * 60 * 1000) {
      return new Response('stale', { status: 400 });
    }
 
    // 3) transaction_id で冪等化
    const txId = params.get('transaction_id') ?? '';
    const dedupeKey = `ssv:tx:${txId}`;
    if (await env.REWARDS.get(dedupeKey)) {
      return new Response('OK', { status: 200 }); // 既処理。200で再送を止める
    }
 
    // 4) 報酬確定(端末ではなくここで残高を増やす)
    const customData = JSON.parse(params.get('custom_data') ?? '{}');
    const userId = customData.userId ?? params.get('user_id');
    const amount = Number(params.get('reward_amount') ?? '0');
    await grantReward(env, userId, amount, txId);
 
    // 5) 90日間ぶんの冪等キーを残す
    await env.REWARDS.put(dedupeKey, '1', { expirationTtl: 60 * 60 * 24 * 90 });
 
    // Googleは200を期待する。それ以外だと再送が続く
    return new Response('OK', { status: 200 });
  },
};