RevenueCat の固定費が気になり始めた人のための、App Store Server Notifications V2 自前運用ガイド

// hooks/useSubscriptionPurchase.ts
import {
  initConnection,
  endConnection,
  requestSubscription,
  getSubscriptions,
  finishTransaction,
  type SubscriptionPurchase,
} from "react-native-iap";
 
const PRODUCT_IDS = ["com.example.app.pro_monthly"];
 
export async function purchasePro(userId: string): Promise<{ ok: boolean; error?: string }> {
  try {
    await initConnection();
    const products = await getSubscriptions({ skus: PRODUCT_IDS });
    if (products.length === 0) {
      return { ok: false, error: "PRODUCT_NOT_FOUND" };
    }
    // appAccountToken に userId を埋め込む（ASSN V2 で受け取れる）
    const purchase = (await requestSubscription({
      sku: PRODUCT_IDS[0],
      appAccountToken: userId,
    })) as SubscriptionPurchase | null;
 
    if (!purchase) {
      return { ok: false, error: "PURCHASE_CANCELLED" };
    }
    // クライアント側ではあえて entitlement を即時付与しない
    // 真実は ASSN V2 がサーバーに届いた後に決まる
    await finishTransaction({ purchase, isConsumable: false });
    return { ok: true };
  } catch (err) {
    return { ok: false, error: (err as Error).message };
  } finally {
    await endConnection();
  }
}

// src/notifications/verify.ts
import { decodeProtectedHeader, importX509, jwtVerify } from "jose";
 
const APPLE_ROOT_CA_G3 = `-----BEGIN CERTIFICATE-----
MIIBgDCCASagAwIBAgIQ.... (Apple Root CA - G3 を貼り付け)
-----END CERTIFICATE-----`;
 
export async function verifyAppleJws(signedPayload: string): Promise<{
  notificationType: string;
  notificationUUID: string;
  data: { signedTransactionInfo?: string; signedRenewalInfo?: string; appAppleId?: number };
}> {
  // 1. ヘッダーから x5c チェーンを取得
  const header = decodeProtectedHeader(signedPayload) as { x5c?: string[] };
  if (!header.x5c || header.x5c.length === 0) {
    throw new Error("INVALID_X5C_CHAIN");
  }
 
  // 2. リーフ証明書から公開鍵を取り出す
  const leafPem = `-----BEGIN CERTIFICATE-----\n${header.x5c[0]}\n-----END CERTIFICATE-----`;
  const publicKey = await importX509(leafPem, "ES256");
 
  // 3. ルート証明書まで遡れることを検証する（簡略化のため省略可・実装は #6 参照）
  //    本番では x5c のリーフ→中間→ルートのチェーンを検証し、
  //    末端が Apple Root CA G3 と一致することを確認する
 
  // 4. ペイロード本体を検証
  const { payload } = await jwtVerify(signedPayload, publicKey, {
    algorithms: ["ES256"],
  });
 
  return payload as {
    notificationType: string;
    notificationUUID: string;
    data: { signedTransactionInfo?: string; signedRenewalInfo?: string; appAppleId?: number };
  };
}

{
  "notificationType": "DID_RENEW",
  "subtype": "BILLING_RECOVERY",
  "notificationUUID": "5e2cdf42-1e43-4ab7-b6d3-1e3d4c0a9c80",
  "data": {
    "appAppleId": 1234567890,
    "bundleId": "com.example.app",
    "environment": "Production",
    "signedTransactionInfo": "eyJhbGciOiJFUzI1NiIsIng1Yy...",
    "signedRenewalInfo": "eyJhbGciOiJFUzI1NiIsIng1Yy..."
  }
}

// src/notifications/handler.ts
import { verifyAppleJws } from "./verify";
 
export async function handleAppleNotification(
  signedPayload: string,
  env: { SUBS_KV: KVNamespace }
): Promise<{ ok: boolean; reason?: string }> {
  const verified = await verifyAppleJws(signedPayload);
  const dedupeKey = `notif:${verified.notificationUUID}`;
 
  // 1. 既に処理済みの通知は黙ってスキップ
  const seen = await env.SUBS_KV.get(dedupeKey);
  if (seen) {
    return { ok: true, reason: "ALREADY_PROCESSED" };
  }
 
  // 2. transaction info を取り出して購読状態を更新
  const txInfo = verified.data.signedTransactionInfo;
  if (txInfo) {
    const tx = await verifyAppleJws(txInfo); // 二段目の JWS 検証
    const txData = tx as unknown as {
      originalTransactionId: string;
      productId: string;
      expiresDate: number;
      appAccountToken?: string;
    };
    const userKey = `user:${txData.appAccountToken ?? "unknown"}`;
    await env.SUBS_KV.put(
      userKey,
      JSON.stringify({
        productId: txData.productId,
        expiresAt: txData.expiresDate,
        originalTransactionId: txData.originalTransactionId,
        lastNotificationType: verified.notificationType,
        updatedAt: Date.now(),
      })
    );
  }
 
  // 3. 重複排除フラグを残す（24 時間で十分）
  await env.SUBS_KV.put(dedupeKey, "1", { expirationTtl: 60 * 60 * 24 });
  return { ok: true };
}

import { v5 as uuidv5 } from "uuid";
 
const NAMESPACE = "f47ac10b-58cc-4372-a567-0e02b2c3d479"; // 任意の UUID
export function userIdToAppAccountToken(userId: string): string {
  return uuidv5(userId, NAMESPACE);
}

// src/notifications/fallback.ts
import { SignJWT, importPKCS8 } from "jose";
 
interface AppStoreApiKey {
  issuerId: string;
  keyId: string;
  privateKeyPem: string; // p8 を PKCS#8 に変換したもの
  bundleId: string;
}
 
export async function fetchSubscriptionStatuses(
  originalTransactionId: string,
  key: AppStoreApiKey,
  env: "Sandbox" | "Production"
): Promise<unknown> {
  const pkcs8 = await importPKCS8(key.privateKeyPem, "ES256");
  const token = await new SignJWT({ bid: key.bundleId })
    .setProtectedHeader({ alg: "ES256", kid: key.keyId, typ: "JWT" })
    .setIssuer(key.issuerId)
    .setIssuedAt()
    .setExpirationTime("20m")
    .setAudience("appstoreconnect-v1")
    .sign(pkcs8);
 
  const host = env === "Production"
    ? "https://api.storekit.itunes.apple.com"
    : "https://api.storekit-sandbox.itunes.apple.com";
 
  const res = await fetch(
    `${host}/inApps/v1/subscriptions/${originalTransactionId}`,
    { headers: { Authorization: `Bearer ${token}` } }
  );
  if (!res.ok) throw new Error(`APPLE_API_${res.status}`);
  return await res.json();
}