README

A Laravel package for validating in-app purchase receipts, managing subscriptions, and handling server notifications from Apple, iTunes, and Amazon App Stores.

✨ Features

• Dispatches Laravel events for all App Store Server Notification types
• Built-in receipt validators for Apple and Amazon
• Simple configuration via Laravel’s container and config files
• Supports Apple App Store Server API (AppTransaction, Get Transaction Info, etc.)
• Optional PSR-3 request/response logging via any Laravel log channel

🛠 Installation

composer require aporat/laravel-appstore-purchases

⚙️ Configuration

Publish the config file:

php artisan vendor:publish --tag=config --provider="Aporat\AppStorePurchases\AppStorePurchasesServiceProvider"

Then update config/appstore-purchases.php with your store credentials:

use ReceiptValidator\Environment;

return [
    'validators' => [
        'apple' => [
            'validator' => 'apple-app-store',
            'key_path' => app_path('../resources/keys/authkey_ABC123XYZ.p8'),
            'key_id' => 'ABC123XYZ',
            'issuer_id' => 'DEF456UVW',
            'bundle_id' => 'com.example',
            'environment' => Environment::SANDBOX,
        ],
        'itunes' => [
            'validator' => 'itunes',
            'shared_secret' => 'SHARED_SECRET',
            'environment' => Environment::SANDBOX,
        ],
        'amazon' => [
            'validator' => 'amazon',
            'developer_secret' => 'DEVELOPER_SECRET',
            'environment' => Environment::SANDBOX,
        ],
    ],
];

🪵 Logging

Logging is disabled by default. To enable it, set the APPSTORE_LOG_CHANNEL environment variable to any Laravel log channel name:

APPSTORE_LOG_CHANNEL=stack

This applies to all validators. When enabled, the underlying HTTP client emits structured log entries at the following levels:

Per-validator channel

You can also set a different log channel for an individual validator by adding a log_channel key to its config. This takes precedence over the global setting:

'validators' => [
    'apple' => [
        'validator'   => 'apple-app-store',
        'log_channel' => 'daily',   // overrides APPSTORE_LOG_CHANNEL for this validator
        // ...
    ],
],

📬 Receiving Notifications

Add a route to handle server notifications from Apple:

use Aporat\AppStorePurchases\Http\Controllers\AppleAppStoreServerNotificationController;

Route::prefix('server-notifications')->middleware([])->group(function () {
    Route::post('apple-appstore-callback', AppleAppStoreServerNotificationController::class);
});

Security Recommendation: Add rate limiting middleware to the notification endpoint to prevent abuse:

Route::prefix('server-notifications')->middleware(['throttle:60,1'])->group(function () {
    Route::post('apple-appstore-callback', AppleAppStoreServerNotificationController::class);
});

This controller automatically dispatches Laravel events for all Apple App Store Server Notification types, including:

• ConsumptionRequest
• GracePeriodExpired
• OfferRedeemed
• PurchaseRefundDeclined
• PurchaseRefunded
• PurchaseRefundReversed
• PurchaseRevoked
• SubscriptionCreated
• SubscriptionExpired
• SubscriptionFailedToRenew
• SubscriptionPriceIncrease
• SubscriptionRenewalChanged
• SubscriptionRenewalChangedPref
• SubscriptionRenewalExtended
• SubscriptionRenewalExtension
• SubscriptionRenewed
• ExternalPurchaseToken
• OneTimeCharge
• Test

📦 Events

All App Store notification types are dispatched as Laravel events and extend a base PurchaseEvent class.

Example: Handling a Subscription Renewal

use Aporat\AppStorePurchases\Events\SubscriptionRenewed;

Event::listen(SubscriptionRenewed::class, function ($event) {
    $transaction = $event->notification->getTransaction();

    $receipts = SubscriptionReceipt::getByTransaction($transaction->getOriginalTransactionId());

    foreach ($receipts as $receipt) {
        $account = Account::find($receipt->account_id);
        $account->processSubscription($transaction);
    }
});

✅ Manual Receipt Validation

You can validate a transaction ID manually:

$validator = AppStorePurchases::get('apple');
$response = $validator->validate($transactionId);

If you have a raw app receipt, extract the transaction ID first:

use Aporat\AppStorePurchases\Facades\AppStorePurchases;
use ReceiptValidator\AppleAppStore\Validators\AppleAppStoreValidator;
use ReceiptValidator\AppleAppStore\ReceiptUtility;

$validator = AppStorePurchases::get('apple');

if ($validator instanceof AppleAppStoreValidator) {
    $transactionId = ReceiptUtility::extractTransactionIdFromAppReceipt($rawAppReceipt);
    $response = $validator->validate($transactionId);
}