[Programcode]

Server-side entitlements that combine Stripe, App Store, promo and trial into one plan, plus the App Store purchase and notification endpoints. Backend only: the StoreKit UI waits for the development build and App Store Connect. Nothing is deployed.

Deploy order (read before this reaches main)

1. The migration deploys first.
2. Then the ai, ai-stream, voice and account functions.
3. Then the frontend.

Without the migration, the AI functions fail closed and every signed-in user loses AI. The staging sync from main counts as a deploy.

What's in it

• Migration 20261014123154_app_store_entitlements.sql.
  • app_store_products: product id to basic or pro. The ids are placeholders until App Store Connect has the real ones.
  • app_store_subscriptions: one row per original transaction. Users read their own rows; only the service role writes.
  • app_store_notifications: idempotency on notificationUUID.
  • effective_entitlement(user_id): the highest active tier across Stripe, App Store, promo, trial and legacy. A missing settings row still fails closed. It runs with the caller's privileges, so it reveals nothing about other users.
• Every tier read now goes through the RPC: _shared/entitlements.ts (ai, ai-stream, voice), the website's use-subscription and settings store, and the app's subscription, feature-config and settings. packages/core/src/ai/pro-access.ts is removed.
• JWS verification (_shared). This follows Apple's App Store Server Library offline checks: ES256, a three-certificate chain to the pinned Apple Root CA - G3, Apple's certificate markers, validity at signedDate, then bundle id, environment and app id. The root is passed as an argument; production code always passes Apple's root.
• app-store-notifications. It handles V2 notifications and applies the signed transaction only when it was charged later than the stored one. An exact replay and a refund of an older period change nothing.
• app-store-purchase. It's authenticated, and the signed appAccountToken must equal the caller's user id, otherwise it returns 403.
• Account deletion. account_deletion_plan and the account function report appStoreSubscriptionActive, so the app can send the user to Apple's subscription settings.

Checks (local; GitHub Actions is out of minutes)

At this head (after merging feat), each run under the shared lock:

• npm run verify: exit 0. Vitest 311/311, collaboration 30/30, edge green, build OK, smoke 30/30.
• ./.superset/db-gate.sh --db-only: exit 0, pgTAP 20 files and 498 tests. The effective-tier cases cover:
  • each source alone and both at once
  • expiry, grace period, revocation and family sharing
  • purchase-date ordering and replay
  • isolation between users
• The author's run before the merge also passed the full-stack browser suite: 71 passed, 1 skipped.
• npm run typecheck, the mobile typecheck and npx knip: exit 0.
• Both functions boot in the local edge runtime: purchase OPTIONS 200 and POST without a token 401; notifications POST 503 not_configured and GET 405.

Needs Adam

• App Store Connect. Real product ids, set by a new migration or admin SQL, and the notification URL for each environment.
• Function settings (not secrets). APP_STORE_BUNDLE_ID (com.adam.debatelab), APP_STORE_ENVIRONMENTS and APP_STORE_APP_APPLE_ID.
• Sandbox in production. Whether production accepts Sandbox purchases. App Review and TestFlight buy in Sandbox against the production server.
• Basic's limit. 20 requests a day is a placeholder.

Known limits

• Family-shared transactions carry no appAccountToken, so they can't be linked to an account.
• Deleting an account and signing up again can't restore a purchase, because the token is the old user id.
• An unknown product id uses up the notification's UUID, so a replay won't apply it after the product is added.
• There's no OCSP revocation check.

Codex review rounds (xhigh, billing is release-critical) follow as comments.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Oct 14, 2026 4:56pm UTC
debatelab-staging	Ready	Preview	Oct 14, 2026 4:56pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Free
• Run ID: 259d0d93-d4c0-4209-8dba-c2d9d14fb82f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

Codex review r1 at c524ed2 (gpt-6.1-sol, xhigh): 3 findings, accepted; fixes in progress.

1. High: settings-store hydration awaits the new entitlement RPC without an account guard; if the account changes meanwhile, A's settings can overwrite B's prompt and be saved to B's account.
2. Medium: the verifier drops Apple's isUpgraded flag, so a superseded transaction with a future expiry can still grant access.
3. Low: a malformed signature segment escapes the verifier's error handling, giving a 500 instead of the documented 400.
   Codex found no change to existing Stripe, promo, trial or legacy limits, and grants, RLS, ordering, deletion and auth/CORS sound.

[Programcode]

Round-1 fixes pushed: 71ee8dd (finding 1: settings hydration drops a run an account switch overtook), 04e9abf (finding 2: a transaction Apple marks isUpgraded grants nothing; new upgraded column, effective_entitlement skips it, deletion flag still counts it), 6f58fc2 (finding 3: undecodable signature or date returns 400, not 500). Local at 04e9abf: npm run verify exit 0 (vitest 312, collaboration 30, edge 371 passed, smoke 30), database gate 502 pgTAP PASS, knip and eslint apps/mobile exit 0. Codex r2 next.

[Programcode]

Codex review r2 at 04e9abf (gpt-6.1-sol, xhigh): no findings. Checked the three r1 fixes, auth, RLS, idempotency, transaction and renewal ordering, fail-closed reads, and migration/function/pgTAP consistency; 46 focused Deno tests passed.

Ready, but held from merging into feat/native-ios on purpose. Every tier read (website and app) moves to the effective_entitlement RPC, which staging doesn't have yet (staging syncs from main). The Expo Go app runs against staging, so merging first would fail closed and turn off AI there. Order needed: the migration on staging, then ai, ai-stream, voice and account functions, then merge; production follows the same order with Adam's authorization. Open items: real App Store product ids and notification URLs, APP_STORE_* function settings, whether production accepts Sandbox purchases, and Basic's 20/day placeholder.

[Programcode]

Round-1 fixes pushed at 04e9abf: 71ee8dd drops a settings hydration an account switch overtook, 6f58fc2 reports undecodable App Store data as malformed (400), 04e9abf grants nothing for a transaction Apple marks upgraded. The 8a agent's final local checks at 04e9abf passed (report in .verify/native-ios-research/pr8a-report-final.md). Codex r2 (xhigh) running.

[Programcode]

Codex review r2 at 04e9abf (gpt-6.1-sol, xhigh): no findings. All three r1 fixes checked (account-switch guard and captured-user writes; isUpgraded propagation, storage and exclusion; malformed-signature and invalid-date handling); 38 focused Deno tests and 7 settings probes passed. Merging into feat/native-ios. Nothing is deployed: production needs Adam's authorization, and the App Store product ids and secrets are placeholders until App Store Connect exists (see the PR description and .verify/native-ios-research/pr8a-report-final.md for the open items: family-shared transactions without appAccountToken, restore after delete and re-signup, unknown products consuming the notification UUID).