Trusted entitlements: New trusted entitlements signature format #1117
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## main #1117 +/- ##
==========================================
- Coverage 85.60% 85.33% -0.28%
==========================================
Files 175 175
Lines 6038 6096 +58
Branches 875 892 +17
==========================================
+ Hits 5169 5202 +33
- Misses 528 549 +21
- Partials 341 345 +4
|
tonidero
force-pushed
the
new-trusted-entitlements-signature-format
branch
from
467003f
to
10a1baf
Compare
|
This has the changes from previously reviewed PRs only. Will hold until the backend is deployed. |
… and verification enabled (#1114) ### Description Added additional checks to not use cached etags when cached result is NOT_REQUESTED and verification is enabled. This will be used for other signed requests aside from the customer info/post receipt/login endpoints.
### Description This will support the newer form of signature that includes the API key and url
tonidero
force-pushed
the
new-trusted-entitlements-signature-format
branch
from
10a1baf
to
a859392
Compare
aboedo
approved these changes
Jul 7, 2023
| ): SignatureVerificationMode { | ||
| return when (verificationMode) { | ||
| EntitlementVerificationMode.DISABLED -> Disabled | ||
| EntitlementVerificationMode.INFORMATIONAL -> | ||
| Informational(signatureVerifier ?: DefaultSignatureVerifier()) | ||
| Informational(IntermediateSignatureHelper(rootVerifier ?: DefaultSignatureVerifier())) |
There was a problem hiding this comment.
we could update the "during feature beta" comment below since we're not calling this beta now
There was a problem hiding this comment.
Ahh good catch! Will update that
tonidero
added a commit
that referenced
this pull request
Jul 12, 2023
**This is an automatic release.** ### New Features * `Trusted Entitlements`: made API stable (#1105) via NachoSoto (@NachoSoto) This new feature prevents MitM attacks between the SDK and the RevenueCat server. With verification enabled, the SDK ensures that the response created by the server was not modified by a third-party, and the entitlements received are exactly what was sent. This is 100% opt-in. `EntitlementInfos` have a new `VerificationResult` property, which will indicate the validity of the responses when this feature is enabled. ```kotlin fun configureRevenueCat() { val configuration = PurchasesConfiguration.Builder(context, apiKey) .entitlementVerificationMode(EntitlementVerificationMode.INFORMATIONAL) .build() Purchases.configure(configuration) } ``` ### Experimental features * Add await offerings (#1096) via Cesar de la Vega (@vegaro) ### Bugfixes * Fix issue updating customer info on app open (#1128) via Toni Rico (@tonidero) ### Dependency Updates * Bump fastlane-plugin-revenuecat_internal from `13773d2` to `b2108fb` (#1095) via dependabot[bot] (@dependabot[bot]) ### Other Changes * [PurchaseTester] Add option to purchase an arbitrary product id (#1099) via Mark Villacampa (@MarkVillacampa) * Fix release path after module refactor (#1129) via Toni Rico (@tonidero) * Fix load shedder integration tests (#1125) via Toni Rico (@tonidero) * Trusted entitlements: New trusted entitlements signature format (#1117) via Toni Rico (@tonidero) * Fix integration tests and change to a different project (#1123) via Toni Rico (@tonidero) * Move files into src/main/kotlin (#1122) via Cesar de la Vega (@vegaro) * Remove public module (#1113) via Cesar de la Vega (@vegaro) * Remove common module (#1106) via Cesar de la Vega (@vegaro) * Fix flaky integration tests: Wait for coroutines to finish before continuing (#1120) via Toni Rico (@tonidero) * Move amazon module into purchases (#1112) via Cesar de la Vega (@vegaro) * Trusted entitlements: Add IntermediateSignatureHelper to handle intermediate signature verification process (#1110) via Toni Rico (@tonidero) * Trusted entitlements: Add Signature type to process new signature response format (#1109) via Toni Rico (@tonidero) * [EXTERNAL] Add `awaitCustomerInfo` / coroutines tests to `TrustedEntitlementsInformationalModeIntegrationTest` (#1077) via @pablo-guardiola (#1107) via Toni Rico (@tonidero) * Remove feature:google module (#1104) via Cesar de la Vega (@vegaro) * Remove identity module (#1103) via Cesar de la Vega (@vegaro) * Remove subscriber attributes module (#1102) via Cesar de la Vega (@vegaro) * Delete utils module (#1098) via Cesar de la Vega (@vegaro) * Remove strings module (#1097) via Cesar de la Vega (@vegaro) * Update CHANGELOG.md to include external contribution (#1100) via Cesar de la Vega (@vegaro) * [EXTERNAL] Add missing `fetchPolicy` parameter to `awaitCustomerInfo` API (#1086) via @pablo-guardiola (#1090) via Toni Rico (@tonidero) --------- Co-authored-by: revenuecat-ops <[email protected]> Co-authored-by: Toni Rico <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Integration branch for the changes in trusted entitlements. Includes changes from: