Rork × StoreKit 2 × App Store Server API — 個人開発アプリのサブスク基盤を3層で守る実装設計

// server/billing/verifyJws.ts
import {
  SignedDataVerifier,
  Environment,
  JWSTransactionDecodedPayload,
} from '@apple/app-store-server-library';
import fs from 'node:fs';
 
// Apple Root CA を事前にダウンロードして配置
// https://www.apple.com/certificateauthority/
const appleRootCAs: Buffer[] = [
  fs.readFileSync('./certs/AppleRootCA-G3.cer'),
  fs.readFileSync('./certs/AppleIncRootCertificate.cer'),
];
 
const verifier = new SignedDataVerifier(
  appleRootCAs,
  /* enableOnlineChecks */ true, // OCSP もチェック
  process.env.APP_STORE_ENV === 'production' ? Environment.PRODUCTION : Environment.SANDBOX,
  process.env.APP_BUNDLE_ID!,
  Number(process.env.APP_APPLE_ID!), // ASC の App Apple ID（数値）
);
 
export async function verifySignedTransaction(jws: string): Promise<JWSTransactionDecodedPayload> {
  try {
    const payload = await verifier.verifyAndDecodeTransaction(jws);
 
    // 追加の整合性チェック（公式ライブラリではやらない部分）
    if (payload.bundleId !== process.env.APP_BUNDLE_ID) {
      throw new Error(`bundleId mismatch: ${payload.bundleId}`);
    }
    if (!payload.transactionId || !payload.originalTransactionId) {
      throw new Error('missing transaction ids');
    }
    // revocationDate が入っている = 返金済み
    if (payload.revocationDate) {
      throw new RefundedError(payload);
    }
    return payload;
  } catch (err) {
    // 検証失敗ログは詳細を残す。後で false positive を分析する材料になる
    log.warn('jws verification failed', { err: err?.message });
    throw err;
  }
}

// server/billing/notifications.ts (Express handler)
app.post('/webhooks/appstore/v2', express.json(), async (req, res) => {
  const { signedPayload } = req.body as { signedPayload: string };
 
  // 認証は Apple 側の署名のみ。Bearer token 等は使わない
  let payload;
  try {
    payload = await verifier.verifyAndDecodeNotification(signedPayload);
  } catch (err) {
    log.warn('invalid notification signature', { err });
    return res.status(400).send('invalid signature');
  }
 
  // ⚠️ 200 を返してから処理してはいけない。エラー時に Apple のリトライを止めてしまう
  // ⚠️ ただし処理に5秒以上かかると Apple はタイムアウトしてリトライしてくる
  // → イベントを永続キューに積んでから 200 を返す方式が安全
  await enqueueAsapJob({
    type: 'appstore.notification',
    payload, // verifier が decode 済みのオブジェクト
    receivedAt: new Date().toISOString(),
    notificationUUID: payload.notificationUUID, // 冪等性キー
  });
 
  res.status(200).send('ok');
});

CREATE TABLE user_entitlements (
  user_id            TEXT PRIMARY KEY,
  original_tx_id     TEXT NOT NULL,
  product_id         TEXT NOT NULL,
  status             TEXT NOT NULL CHECK (status IN
                       ('active', 'grace', 'billing_retry', 'expired', 'refunded', 'revoked')),
  current_period_end TIMESTAMPTZ NOT NULL,
  auto_renew         BOOLEAN NOT NULL DEFAULT TRUE,
  environment        TEXT NOT NULL CHECK (environment IN ('SANDBOX', 'PRODUCTION')),
  app_account_token  UUID,
  last_event_id      TEXT, -- 直近通知の notificationUUID
  last_event_at      TIMESTAMPTZ,
  updated_at         TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
 
CREATE INDEX idx_user_entitlements_original_tx
  ON user_entitlements(original_tx_id);
CREATE INDEX idx_user_entitlements_period_end
  ON user_entitlements(current_period_end) WHERE status IN ('active', 'grace');

async function applyNotification(payload: ResponseBodyV2DecodedPayload) {
  const tx = decodeJws(payload.data.signedTransactionInfo);
  const renewal = decodeJws(payload.data.signedRenewalInfo);
 
  await db.transaction(async (trx) => {
    const current = await trx.oneOrNone(
      `SELECT last_event_at FROM user_entitlements WHERE original_tx_id = $1 FOR UPDATE`,
      [tx.originalTransactionId]
    );
 
    // 古いイベントは捨てる
    const eventTime = new Date(payload.data.environment === 'Sandbox' ? Date.now() : payload.signedDate ?? Date.now());
    if (current?.last_event_at && current.last_event_at > eventTime) {
      log.info('stale event ignored', { type: payload.notificationType });
      return;
    }
 
    const next = resolveStatus(payload.notificationType, tx, renewal);
    await trx.none(
      `INSERT INTO user_entitlements (user_id, original_tx_id, product_id, status,
         current_period_end, auto_renew, environment, app_account_token, last_event_id, last_event_at)
       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
       ON CONFLICT (user_id) DO UPDATE SET
         status = EXCLUDED.status,
         current_period_end = EXCLUDED.current_period_end,
         auto_renew = EXCLUDED.auto_renew,
         last_event_id = EXCLUDED.last_event_id,
         last_event_at = EXCLUDED.last_event_at,
         updated_at = NOW()`,
      [
        resolveUserId(tx.appAccountToken, tx.originalTransactionId),
        tx.originalTransactionId,
        tx.productId,
        next.status,
        new Date(tx.expiresDate ?? 0),
        renewal.autoRenewStatus === 1,
        payload.data.environment.toUpperCase(),
        tx.appAccountToken,
        payload.notificationUUID,
        eventTime,
      ]
    );
  });
}

// server/billing/dailyReconcile.ts
import { AppStoreServerAPIClient, GetTransactionHistoryVersion } from '@apple/app-store-server-library';
 
const apiClient = new AppStoreServerAPIClient(
  fs.readFileSync('./certs/SubscriptionKey.p8', 'utf8'),
  process.env.APP_STORE_KEY_ID!,
  process.env.APP_STORE_ISSUER_ID!,
  process.env.APP_BUNDLE_ID!,
  process.env.APP_STORE_ENV === 'production' ? Environment.PRODUCTION : Environment.SANDBOX,
);
 
export async function reconcileUser(originalTxId: string) {
  const statuses = await apiClient.getAllSubscriptionStatuses(originalTxId);
  for (const group of statuses.data ?? []) {
    for (const item of group.lastTransactions ?? []) {
      const tx = await verifier.verifyAndDecodeTransaction(item.signedTransactionInfo);
      const renewal = await verifier.verifyAndDecodeRenewalInfo(item.signedRenewalInfo);
      await upsertEntitlement(tx, renewal, /* source */ 'reconcile');
    }
  }
}