Verifying StoreKit 2 Signed Transactions in a Cloudflare Worker

import StoreKit
 
/// Pull the "signed string" for a product's latest transaction.
/// What we return is the raw JWS, not a verified Transaction — that matters.
func latestSignedTransaction(for productID: String) async -> String? {
    // Transaction.latest returns VerificationResult<Transaction>
    guard let result = await Transaction.latest(for: productID) else {
        return nil
    }
    // The raw JWS is available whether the result is .verified or .unverified.
    // Treat the on-device verdict as a hint; let the server be the source of truth.
    return result.jwsRepresentation
}
 
/// Send the pulled JWS to the Cloudflare Worker verification endpoint
func syncEntitlement(productID: String) async throws -> Bool {
    guard let jws = await latestSignedTransaction(for: productID) else {
        return false
    }
    var request = URLRequest(url: URL(string: "https://api.example.com/verify")!)
    request.httpMethod = "POST"
    request.setValue("application/json", forHTTPHeaderField: "Content-Type")
    request.httpBody = try JSONEncoder().encode(["signedTransaction": jws])
 
    let (data, response) = try await URLSession.shared.data(for: request)
    guard let http = response as? HTTPURLResponse, http.statusCode == 200 else {
        return false
    }
    struct VerifyResponse: Decodable { let entitled: Bool }
    // Trust only the result the server verified.
    return try JSONDecoder().decode(VerifyResponse.self, from: data).entitled
}

import { compactVerify, importX509 } from "jose";
 
// Wrap a standard-base64 DER cert into PEM (note: not base64url)
function derToPem(derBase64: string): string {
  const lines = derBase64.match(/.{1,64}/g)?.join("\n") ?? derBase64;
  return `-----BEGIN CERTIFICATE-----\n${lines}\n-----END CERTIFICATE-----`;
}
 
function decodeJwsHeader(jws: string): { alg: string; x5c: string[] } {
  const headerSegment = jws.split(".")[0];
  const json = atob(headerSegment.replace(/-/g, "+").replace(/_/g, "/"));
  return JSON.parse(json);
}
 
/// Verify the JWS signature under the leaf certificate's public key and return the payload
async function verifySignature(jws: string): Promise<Record<string, unknown>> {
  const header = decodeJwsHeader(jws);
  if (header.alg !== "ES256") {
    throw new Error(`unexpected alg: ${header.alg}`);
  }
  // x5c[0] is the leaf certificate that actually signed
  const leafPem = derToPem(header.x5c[0]);
  const leafKey = await importX509(leafPem, "ES256");
 
  // compactVerify throws if the signature does not match
  const { payload } = await compactVerify(jws, leafKey);
  return JSON.parse(new TextDecoder().decode(payload));
}

// Embed Apple's officially distributed Apple Root CA - G3 as DER(base64) ahead of time.
// Source: https://www.apple.com/certificateauthority/
const APPLE_ROOT_CA_G3_DER =
  "MIICQzCCAcmgAwIBAgIILc..."; // pin the full certificate here
 
function assertAppleRoot(x5c: string[]): void {
  const presentedRoot = x5c[x5c.length - 1];
  if (presentedRoot !== APPLE_ROOT_CA_G3_DER) {
    // The root of the presented chain differs from the Apple root we trust
    throw new Error("root certificate is not the pinned Apple Root CA - G3");
  }
}
 
// Confirm the payload points at the right product and the right environment
interface TransactionPayload {
  bundleId: string;
  productId: string;
  transactionId: string;
  environment: "Production" | "Sandbox";
}
 
function assertPayload(
  payload: TransactionPayload,
  expected: { bundleId: string; env: "Production" | "Sandbox" },
): void {
  if (payload.bundleId !== expected.bundleId) {
    throw new Error("bundleId mismatch");
  }
  if (payload.environment !== expected.env) {
    // Don't let a Sandbox transaction grant production entitlements
    throw new Error(`environment mismatch: ${payload.environment}`);
  }
}

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    try {
      const { signedTransaction } = await request.json<{ signedTransaction: string }>();
 
      // 1. Signature check (verify the JWS with the leaf key)
      const payload = (await verifySignature(signedTransaction)) as unknown as TransactionPayload;
 
      // 2. Root certificate pin comparison
      assertAppleRoot(decodeJwsHeader(signedTransaction).x5c);
 
      // 3. Content check (bundleId / environment)
      assertPayload(payload, { bundleId: "net.example.app", env: "Production" });
 
      // 4. Replay prevention: accept only on first sight of a transactionId
      const seenKey = `txn:${payload.transactionId}`;
      const already = await env.ENTITLEMENTS.get(seenKey);
      if (already) {
        // Known transaction. Idempotently return "already granted".
        return Response.json({ entitled: true, replay: true });
      }
      await env.ENTITLEMENTS.put(seenKey, "1", { expirationTtl: 60 * 60 * 24 * 400 });
 
      return Response.json({ entitled: true, productId: payload.productId });
    } catch (err) {
      // Anything that fails verification is treated as no entitlement (deny by default)
      return Response.json({ entitled: false, reason: String(err) }, { status: 400 });
    }
  },
};
 
interface Env {
  ENTITLEMENTS: KVNamespace;
}