Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update StoreKit integration to StoreKit 2 #57

Open
PickleJesus123 opened this issue Nov 3, 2023 · 8 comments
Open

Update StoreKit integration to StoreKit 2 #57

PickleJesus123 opened this issue Nov 3, 2023 · 8 comments

Comments

@PickleJesus123
Copy link

PickleJesus123 commented Nov 3, 2023

There is a vulnerability with the way most Godot users are currently using this "inappstore" plugin.

Unlike the Android Billing plugin, there is no way to query_purchases() and find out what the user has purchased/subscribed to when the app starts up. This is due to the plugin using StoreKit 1. From what I've seen, it seems like most Godot game developers using this plugin have the following logic:

func check_events():
	while in_app_store.get_pending_event_count() > 0:
		var event = in_app_store.pop_pending_event()
		if event.type == "purchase":
			if event.result == "ok":
				// save a local variable somewhere that "purchased = true"

Some notes about this:

  • For consumable purchases, this is no problem
  • For "permanent" purchases, this should mostly work. But if a malicious player buys and then quickly refunds your item, you would have no way of telling. There is no "event fired" in StoreKit 1. To detect refunds, you would need to maintain your own server infrastructure that is constantly in contact with Apple's servers, and your app would have to contact your server to revoke the premium features. I guarantee this is out of scope for most Godot game developers.
  • For "auto-renewing subscriptions", being able to read essential information like expiry_date involves maintaining your own server that can decrypt the receipt data. If you want it to detect refunds, renewals, or cancellations, you need to implement the whole App Store Server Api on your server infrastructure. It's a mess.

There is a solution to this however: upgrading the plugin to Apple's new StoreKit 2, which is designed to simplify this whole process. You would be able to simply query active purchases through the Transaction History methods - that's it! Here's a breakdown:

Transactions retrieved through StoreKit 2 include detailed information such as product identifiers, purchase dates, and expiration dates for subscriptions, all in a decoded and easy-to-use format. This information was previously only obtainable by decoding the opaque receipt file.

Developers can access the complete transaction history, which provides the context necessary for supporting features like restoring purchases or verifying the entitlements of a user at any point in time.

StoreKit 2 requires iOS 15+, but it is installed on 99%+ of iOS devices, so there are no compatibility concerns there. Creating a StoreKit 2 branch would make it a lot easier for your average solo developer or small studio to monetize their Godot games.

@Calinou
Copy link
Contributor

Calinou commented Nov 3, 2023

The iOS plugins need to be updated for Godot 4 first before this can be tackled. We currently lack contributors available to do so.

@Calinou Calinou changed the title "inappstore" vulnerability. Please upgrade it from Store Kit 1 to Store Kit 2 Update StoreKit integration to StoreKit 2 Nov 3, 2023
@dinopanagos
Copy link

This has been lacking contributors and is pushing people away from Godot. Is there any way we can all chip in an just pay someone to take care of it. Been over 6 months with no updates or timeline. Godot is amazing and its just going to fade if independent devs cant monetize.

@Calinou
Copy link
Contributor

Calinou commented Nov 5, 2023

Is there any way we can all chip in an just pay someone to take care of it.

While you are free to contact a developer and pay them to work on this (or organize your own crowdfunding campaign), we don't use a bounty system. This is something you will have to organize on your own, including finding that developer (likely the hardest part) and ensuring they do their work correctly. There's a lot of risk involved in this process by design.

@djordjije
Copy link

I am more than willing to work on the iOS plugins if I can successfully find some information on how to code them. Just give me some time.

@dinopanagos
Copy link

almost finished with it ! no worries :)

@djrain
Copy link

djrain commented Jul 6, 2024

@dinopanagos hey, did you make any progress on this? If so, would you mind sharing the files?

@RocketRonz
Copy link

Almost a year since the OP and the InAppStore plugin is still using StoreKit 1, which Apple deprecated a few months back:

StoreKit 1 deprecation

Are there any plans in the dev pipeline to upgrade this plugin to StoreKit 2? The freemium model is the only realistic revenue stream on the App Store so in-app purchase support is vital for mobile developers.

@hayderkharrufa
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

7 participants