File Coverage

blib/lib/Plack/Middleware/AppStoreReceipt.pm

Criterion	Covered	Total	%
statement	22	24	91.6
branch			n/a
condition			n/a
subroutine	8	8	100.0
pod			n/a
total	30	32	93.7

package Plack::Middleware::AppStoreReceipt;
# ABSTRACT: The Plack::Middleware that verifies Apple App Store Receipts for In-App Purchases

our $VERSION = '0.03';

use warnings;
use strict;
use parent qw(Plack::Middleware);
use Plack::Request;
use Plack::Util::Accessor qw(route method path receipt_data allow_sandbox shared_secret);
use JSON;
use Try::Tiny;
use Furl;

sub prepare_app {
    my $self = shift;

    $self->allow_sandbox( $self->allow_sandbox || 0 );

    if ( !$self->route ) {
        $self->method( 'POST' ) if !$self->method;
        $self->path( '/receipts/validate' ) if !$self->path;
    } else {
        while (my ($key, $value) = each %{$self->route}) {
            $self->method( uc $key );
            $self->path( $value );
        }
    }
}

sub call {
    my ( $self, $env ) = @_;

    my $vpath = ($env->{'PATH_INFO'} eq $self->path);
    return [
            405,
            [
                'Allow'        => $self->method,
                'Content-Type' => 'text/plain',
            ],
            ['Method not allowed'],
        ] if $vpath && $env->{'REQUEST_METHOD'} ne $self->method;

    my $res = try { $self->app->($env) };

    $res = $self->_verify_receipt($env) if $vpath;

    return $res;
};

sub _verify_receipt {
    my ( $self, $env ) = @_;

    my $plack_req = Plack::Request->new($env);
    my $receipt_data_param = $plack_req->param('receipt_data') || $plack_req->param($self->receipt_data);
    my %params = ("receipt-data" => $receipt_data_param);
    $params{password} = $self->shared_secret if $self->shared_secret;
    my $receipt_data = encode_json (\%params);

    my $res;
    $res = $self->_post_receipt_to_itunes( 'production', $receipt_data, $env );
    if ( $res->[0] == 200 && $self->_is_sandboxed( $self->_parse_success_response( $res ) ) ) {
        #should request to sandbox url since it's sandbox receipt!!
        print "Retrying to post to sandbox environment...\n";
        $res = $self->_post_receipt_to_itunes( 'sandbox', $receipt_data, $env );
    }
    return $res;
}

sub _post_receipt_to_itunes {
    my ( $self, $itunes_env, $receipt_data, $env ) = @_;

    die "sandbox request is not allowed" if $itunes_env eq 'sandbox' && !$self->allow_sandbox;

    my $endpoint = {
        'production' => 'https://buy.itunes.apple.com/verifyReceipt',
        'sandbox'    => 'https://sandbox.itunes.apple.com/verifyReceipt',
    };

    my $furl = Furl->new(
        agent   => 'Furl/2.15',
        timeout => 10,
    );

     my $res = $furl->post(
        $endpoint->{$itunes_env}, # URL
        ['Content-Type' => 'application/json'],                 # headers
        $receipt_data,      # form data (HashRef/FileHandle are also okay)
    );

    return [200, ['Content-Type' => 'application/json'], [$res->content]] if $res->is_success;
    return [500, ['Content-Type' => 'text/plain' ], ["error: ".$res->status_line."\n"]];
}

sub _parse_success_response {
    my ( $self, $res ) = @_;
    return decode_json $res->[2]->[0];
}

sub _is_sandboxed {
    my ( $self, $json ) = @_;
    return ( $json->{'status'} == 21007 ); #should be sandboxed!
}

1;


__END__