Merge pull request #23 from KLVTZ/feature/use-shared-secret-for-apple

Use shared secret for apple receipts

README.md

@@ -27,6 +27,7 @@ var payment = {
 	receipt: 'receipt data',   // always required
 	productId: 'abc',
 	packageName: 'my.app',
+	secret: 'password',
 	subscription: true	// optional, if google play subscription
 };
 
@@ -52,6 +53,9 @@ receipt as returned by the iOS SDK (in which case it will be automatically base6
 Both productId and packageName (bundle ID) are optional, but when provided will be tested against.
 If the receipt does not match the provided values, an error will be returned.
 
+To verify auto-renewable subscriptions you need to provide `secret` field that
+contains your In-App Purchase Shared Secret
+
 **The response**
 
 The response passed back to your callback will also be Apple specific. The entire parsed receipt

bin/verify-apple.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-var argv = require('minimist')(process.argv.slice(2), { string: ['productId', 'packageName', 'receipt'] });
+var argv = require('minimist')(process.argv.slice(2), { string: ['productId', 'packageName', 'receipt', 'secret'] });
 
 if (argv.help) {
-	console.log('Usage: ./verfiy.js --productId=abc --packageName=my.app --receipt=\'receipt-data\'');
+	console.log('Usage: ./verfiy.js --productId=abc --packageName=my.app --receipt=\'receipt-data\' --secret=\'shared secret\'');
 	process.exit(1);
 }
 

lib/apple/index.js

@@ -89,6 +89,10 @@ exports.verifyPayment = function (payment, cb) {
 		});
 	}
 
+	if (payment.secret !== undefined) {
+		assert.equal(typeof payment.secret, 'string', 'Shared secret must be a string');
+		jsonData.password = payment.secret;
+	}
 
 	function checkReceipt(error, result, environment) {
 		if (error) {
@@ -107,7 +111,7 @@ exports.verifyPayment = function (payment, cb) {
 			return cb(new Error('Wrong bundle ID: ' + payment.packageName + ' (expected: ' + receipt.bid + ')'));
 		}
 
-        	result.environment = environment;
+        result.environment = environment;
 
 		return cb(null, result);
 	}