Add Apple/Google IAP validation and subscription webhooks

- Add Apple App Store Server API integration for receipt/transaction validation - Add Google Play Developer API integration for purchase token validation - Add webhook endpoints for server-to-server subscription notifications - POST /api/subscription/webhook/apple/ (App Store Server Notifications v2) - POST /api/subscription/webhook/google/ (Real-time Developer Notifications) - Support both StoreKit 1 (receipt_data) and StoreKit 2 (transaction_id) - Add repository methods to find users by transaction ID or purchase token - Add configuration for IAP credentials (APPLE_IAP_*, GOOGLE_IAP_*) - Add setup documentation for configuring webhooks 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-14 13:58:37 -06:00
parent 81885c4ea3
commit c58aaa5d5f
10 changed files with 1909 additions and 52 deletions
--- a/internal/services/iap_validation.go
+++ b/internal/services/iap_validation.go
@@ -0,0 +1,554 @@
+package services
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/oauth2/google"
+	"google.golang.org/api/androidpublisher/v3"
+	"google.golang.org/api/option"
+
+	"github.com/treytartt/casera-api/internal/config"
+)
+
+// IAP validation errors
+var (
+	ErrIAPNotConfigured       = errors.New("IAP validation not configured")
+	ErrInvalidReceipt         = errors.New("invalid receipt data")
+	ErrInvalidPurchaseToken   = errors.New("invalid purchase token")
+	ErrSubscriptionExpired    = errors.New("subscription has expired")
+	ErrSubscriptionCancelled  = errors.New("subscription was cancelled")
+	ErrInvalidProductID       = errors.New("invalid product ID")
+	ErrReceiptValidationFailed = errors.New("receipt validation failed")
+)
+
+// AppleIAPClient handles Apple App Store Server API validation
+type AppleIAPClient struct {
+	keyID     string
+	issuerID  string
+	bundleID  string
+	privateKey *ecdsa.PrivateKey
+	sandbox   bool
+}
+
+// GoogleIAPClient handles Google Play Developer API validation
+type GoogleIAPClient struct {
+	service     *androidpublisher.Service
+	packageName string
+}
+
+// AppleTransactionInfo represents decoded transaction info from Apple
+type AppleTransactionInfo struct {
+	TransactionID               string `json:"transactionId"`
+	OriginalTransactionID       string `json:"originalTransactionId"`
+	ProductID                   string `json:"productId"`
+	PurchaseDate                int64  `json:"purchaseDate"`
+	ExpiresDate                 int64  `json:"expiresDate"`
+	Type                        string `json:"type"` // "Auto-Renewable Subscription"
+	InAppOwnershipType          string `json:"inAppOwnershipType"`
+	SignedDate                  int64  `json:"signedDate"`
+	Environment                 string `json:"environment"` // "Sandbox" or "Production"
+	BundleID                    string `json:"bundleId"`
+	RevocationDate              *int64 `json:"revocationDate,omitempty"`
+	RevocationReason            *int   `json:"revocationReason,omitempty"`
+}
+
+// AppleValidationResult contains the result of Apple receipt validation
+type AppleValidationResult struct {
+	Valid            bool
+	TransactionID    string
+	ProductID        string
+	ExpiresAt        time.Time
+	IsTrialPeriod    bool
+	AutoRenewEnabled bool
+	Environment      string
+}
+
+// GoogleValidationResult contains the result of Google token validation
+type GoogleValidationResult struct {
+	Valid             bool
+	OrderID           string
+	ProductID         string
+	ExpiresAt         time.Time
+	AutoRenewing      bool
+	PaymentState      int64
+	CancelReason      int64
+	AcknowledgedState bool
+}
+
+// NewAppleIAPClient creates a new Apple IAP validation client
+func NewAppleIAPClient(cfg config.AppleIAPConfig) (*AppleIAPClient, error) {
+	if cfg.KeyPath == "" || cfg.KeyID == "" || cfg.IssuerID == "" || cfg.BundleID == "" {
+		return nil, ErrIAPNotConfigured
+	}
+
+	// Read the private key
+	keyData, err := os.ReadFile(cfg.KeyPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read Apple IAP key: %w", err)
+	}
+
+	// Parse the PEM-encoded private key
+	block, _ := pem.Decode(keyData)
+	if block == nil {
+		return nil, fmt.Errorf("failed to decode PEM block")
+	}
+
+	privateKey, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse private key: %w", err)
+	}
+
+	ecdsaKey, ok := privateKey.(*ecdsa.PrivateKey)
+	if !ok {
+		return nil, fmt.Errorf("private key is not ECDSA")
+	}
+
+	return &AppleIAPClient{
+		keyID:      cfg.KeyID,
+		issuerID:   cfg.IssuerID,
+		bundleID:   cfg.BundleID,
+		privateKey: ecdsaKey,
+		sandbox:    cfg.Sandbox,
+	}, nil
+}
+
+// generateJWT creates a signed JWT for App Store Server API authentication
+func (c *AppleIAPClient) generateJWT() (string, error) {
+	now := time.Now()
+	claims := jwt.MapClaims{
+		"iss": c.issuerID,
+		"iat": now.Unix(),
+		"exp": now.Add(60 * time.Minute).Unix(),
+		"aud": "appstoreconnect-v1",
+		"bid": c.bundleID,
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
+	token.Header["kid"] = c.keyID
+
+	return token.SignedString(c.privateKey)
+}
+
+// getBaseURL returns the appropriate App Store Server API URL
+func (c *AppleIAPClient) getBaseURL() string {
+	if c.sandbox {
+		return "https://api.storekit-sandbox.itunes.apple.com"
+	}
+	return "https://api.storekit.itunes.apple.com"
+}
+
+// ValidateTransaction validates a transaction ID with Apple's servers
+func (c *AppleIAPClient) ValidateTransaction(ctx context.Context, transactionID string) (*AppleValidationResult, error) {
+	token, err := c.generateJWT()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate JWT: %w", err)
+	}
+
+	// Get transaction info
+	url := fmt.Sprintf("%s/inApps/v1/transactions/%s", c.getBaseURL(), transactionID)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to call Apple API: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("Apple API returned status %d: %s", resp.StatusCode, string(body))
+	}
+
+	// Parse the response
+	var response struct {
+		SignedTransactionInfo string `json:"signedTransactionInfo"`
+	}
+	if err := json.Unmarshal(body, &response); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	// Decode the signed transaction info (it's a JWS)
+	transactionInfo, err := c.decodeSignedTransaction(response.SignedTransactionInfo)
+	if err != nil {
+		return nil, err
+	}
+
+	// Validate bundle ID
+	if transactionInfo.BundleID != c.bundleID {
+		return nil, ErrInvalidReceipt
+	}
+
+	// Check if revoked
+	if transactionInfo.RevocationDate != nil {
+		return &AppleValidationResult{
+			Valid: false,
+		}, ErrSubscriptionCancelled
+	}
+
+	expiresAt := time.Unix(transactionInfo.ExpiresDate/1000, 0)
+
+	return &AppleValidationResult{
+		Valid:         true,
+		TransactionID: transactionInfo.TransactionID,
+		ProductID:     transactionInfo.ProductID,
+		ExpiresAt:     expiresAt,
+		Environment:   transactionInfo.Environment,
+	}, nil
+}
+
+// ValidateReceipt validates an App Store receipt (base64-encoded)
+// This is the modern approach using the /verifyReceipt endpoint compatibility
+// For new integrations, prefer ValidateTransaction with transaction IDs
+func (c *AppleIAPClient) ValidateReceipt(ctx context.Context, receiptData string) (*AppleValidationResult, error) {
+	token, err := c.generateJWT()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate JWT: %w", err)
+	}
+
+	// Decode the receipt to get transaction history
+	// The receiptData from StoreKit 2 is typically a signed transaction
+	// For StoreKit 1, we need to use the legacy verifyReceipt endpoint
+
+	// Try to decode as a signed transaction first (StoreKit 2)
+	if strings.Contains(receiptData, ".") {
+		// This looks like a JWS - try to decode it directly
+		transactionInfo, err := c.decodeSignedTransaction(receiptData)
+		if err == nil {
+			expiresAt := time.Unix(transactionInfo.ExpiresDate/1000, 0)
+			return &AppleValidationResult{
+				Valid:         true,
+				TransactionID: transactionInfo.TransactionID,
+				ProductID:     transactionInfo.ProductID,
+				ExpiresAt:     expiresAt,
+				Environment:   transactionInfo.Environment,
+			}, nil
+		}
+	}
+
+	// For legacy receipts, use the subscription status endpoint
+	// First, we need to find the original transaction ID from the receipt
+	// This requires using the App Store Server API's history endpoint
+
+	url := fmt.Sprintf("%s/inApps/v1/history/%s", c.getBaseURL(), c.bundleID)
+
+	// Create request body
+	requestBody := struct {
+		ReceiptData string `json:"receipt-data"`
+	}{
+		ReceiptData: receiptData,
+	}
+
+	jsonBody, err := json.Marshal(requestBody)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "POST", url, strings.NewReader(string(jsonBody)))
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to call Apple API: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		// If history endpoint fails, try legacy validation
+		return c.validateLegacyReceipt(ctx, receiptData)
+	}
+
+	var historyResponse struct {
+		SignedTransactions []string `json:"signedTransactions"`
+		HasMore            bool     `json:"hasMore"`
+	}
+	if err := json.Unmarshal(body, &historyResponse); err != nil {
+		return nil, fmt.Errorf("failed to parse history response: %w", err)
+	}
+
+	if len(historyResponse.SignedTransactions) == 0 {
+		return nil, ErrInvalidReceipt
+	}
+
+	// Get the most recent transaction
+	latestTransaction := historyResponse.SignedTransactions[len(historyResponse.SignedTransactions)-1]
+	transactionInfo, err := c.decodeSignedTransaction(latestTransaction)
+	if err != nil {
+		return nil, err
+	}
+
+	expiresAt := time.Unix(transactionInfo.ExpiresDate/1000, 0)
+
+	return &AppleValidationResult{
+		Valid:         true,
+		TransactionID: transactionInfo.TransactionID,
+		ProductID:     transactionInfo.ProductID,
+		ExpiresAt:     expiresAt,
+		Environment:   transactionInfo.Environment,
+	}, nil
+}
+
+// validateLegacyReceipt uses Apple's legacy verifyReceipt endpoint
+func (c *AppleIAPClient) validateLegacyReceipt(ctx context.Context, receiptData string) (*AppleValidationResult, error) {
+	url := "https://buy.itunes.apple.com/verifyReceipt"
+	if c.sandbox {
+		url = "https://sandbox.itunes.apple.com/verifyReceipt"
+	}
+
+	requestBody := map[string]string{
+		"receipt-data": receiptData,
+	}
+
+	jsonBody, err := json.Marshal(requestBody)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "POST", url, strings.NewReader(string(jsonBody)))
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to call Apple verifyReceipt: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var legacyResponse struct {
+		Status             int `json:"status"`
+		LatestReceiptInfo  []struct {
+			TransactionID         string `json:"transaction_id"`
+			OriginalTransactionID string `json:"original_transaction_id"`
+			ProductID             string `json:"product_id"`
+			ExpiresDateMs         string `json:"expires_date_ms"`
+			IsTrialPeriod         string `json:"is_trial_period"`
+		} `json:"latest_receipt_info"`
+		PendingRenewalInfo []struct {
+			AutoRenewStatus string `json:"auto_renew_status"`
+		} `json:"pending_renewal_info"`
+		Environment string `json:"environment"`
+	}
+
+	if err := json.Unmarshal(body, &legacyResponse); err != nil {
+		return nil, fmt.Errorf("failed to parse legacy response: %w", err)
+	}
+
+	// Status codes: 0 = valid, 21007 = sandbox receipt on production, 21008 = production receipt on sandbox
+	if legacyResponse.Status == 21007 && !c.sandbox {
+		// Retry with sandbox
+		c.sandbox = true
+		result, err := c.validateLegacyReceipt(ctx, receiptData)
+		c.sandbox = false
+		return result, err
+	}
+
+	if legacyResponse.Status != 0 {
+		return nil, fmt.Errorf("%w: status code %d", ErrReceiptValidationFailed, legacyResponse.Status)
+	}
+
+	if len(legacyResponse.LatestReceiptInfo) == 0 {
+		return nil, ErrInvalidReceipt
+	}
+
+	// Find the latest non-expired subscription
+	var latestReceipt = legacyResponse.LatestReceiptInfo[len(legacyResponse.LatestReceiptInfo)-1]
+
+	var expiresMs int64
+	fmt.Sscanf(latestReceipt.ExpiresDateMs, "%d", &expiresMs)
+	expiresAt := time.Unix(expiresMs/1000, 0)
+
+	autoRenew := false
+	if len(legacyResponse.PendingRenewalInfo) > 0 {
+		autoRenew = legacyResponse.PendingRenewalInfo[0].AutoRenewStatus == "1"
+	}
+
+	return &AppleValidationResult{
+		Valid:            true,
+		TransactionID:    latestReceipt.TransactionID,
+		ProductID:        latestReceipt.ProductID,
+		ExpiresAt:        expiresAt,
+		IsTrialPeriod:    latestReceipt.IsTrialPeriod == "true",
+		AutoRenewEnabled: autoRenew,
+		Environment:      legacyResponse.Environment,
+	}, nil
+}
+
+// decodeSignedTransaction decodes a JWS signed transaction from Apple
+func (c *AppleIAPClient) decodeSignedTransaction(signedTransaction string) (*AppleTransactionInfo, error) {
+	// The signed transaction is a JWS (JSON Web Signature)
+	// Format: header.payload.signature
+	parts := strings.Split(signedTransaction, ".")
+	if len(parts) != 3 {
+		return nil, fmt.Errorf("invalid JWS format")
+	}
+
+	// Decode the payload (base64url encoded)
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode payload: %w", err)
+	}
+
+	var transactionInfo AppleTransactionInfo
+	if err := json.Unmarshal(payload, &transactionInfo); err != nil {
+		return nil, fmt.Errorf("failed to parse transaction info: %w", err)
+	}
+
+	return &transactionInfo, nil
+}
+
+// NewGoogleIAPClient creates a new Google IAP validation client
+func NewGoogleIAPClient(ctx context.Context, cfg config.GoogleIAPConfig) (*GoogleIAPClient, error) {
+	if cfg.ServiceAccountPath == "" || cfg.PackageName == "" {
+		return nil, ErrIAPNotConfigured
+	}
+
+	// Read the service account JSON
+	serviceAccountJSON, err := os.ReadFile(cfg.ServiceAccountPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read service account file: %w", err)
+	}
+
+	// Create credentials
+	creds, err := google.CredentialsFromJSON(ctx, serviceAccountJSON, androidpublisher.AndroidpublisherScope)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create credentials: %w", err)
+	}
+
+	// Create the Android Publisher service
+	service, err := androidpublisher.NewService(ctx, option.WithCredentials(creds))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create Android Publisher service: %w", err)
+	}
+
+	return &GoogleIAPClient{
+		service:     service,
+		packageName: cfg.PackageName,
+	}, nil
+}
+
+// ValidateSubscription validates a Google Play subscription purchase token
+func (c *GoogleIAPClient) ValidateSubscription(ctx context.Context, subscriptionID, purchaseToken string) (*GoogleValidationResult, error) {
+	// Call Google Play Developer API to verify the subscription
+	subscription, err := c.service.Purchases.Subscriptions.Get(
+		c.packageName,
+		subscriptionID,
+		purchaseToken,
+	).Context(ctx).Do()
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to validate subscription: %w", err)
+	}
+
+	// ExpiryTimeMillis is in milliseconds
+	expiresAt := time.Unix(subscription.ExpiryTimeMillis/1000, 0)
+
+	// Dereference pointer values safely
+	var paymentState int64
+	if subscription.PaymentState != nil {
+		paymentState = *subscription.PaymentState
+	}
+
+	result := &GoogleValidationResult{
+		Valid:             true,
+		OrderID:           subscription.OrderId,
+		ProductID:         subscriptionID,
+		ExpiresAt:         expiresAt,
+		AutoRenewing:      subscription.AutoRenewing,
+		PaymentState:      paymentState,
+		CancelReason:      subscription.CancelReason,
+		AcknowledgedState: subscription.AcknowledgementState == 1,
+	}
+
+	// Check if subscription is valid
+	now := time.Now()
+	if expiresAt.Before(now) {
+		return result, ErrSubscriptionExpired
+	}
+
+	// Cancel reason: 0 = user cancelled, 1 = system cancelled
+	if subscription.CancelReason > 0 {
+		result.Valid = false
+		return result, ErrSubscriptionCancelled
+	}
+
+	return result, nil
+}
+
+// ValidatePurchaseToken validates a purchase token, attempting to determine the subscription ID
+// This is a convenience method when the client only sends the token
+func (c *GoogleIAPClient) ValidatePurchaseToken(ctx context.Context, purchaseToken string, knownSubscriptionIDs []string) (*GoogleValidationResult, error) {
+	// Try each known subscription ID until one works
+	for _, subID := range knownSubscriptionIDs {
+		result, err := c.ValidateSubscription(ctx, subID, purchaseToken)
+		if err == nil {
+			return result, nil
+		}
+		// If it's not a "not found" error, return the error
+		if !strings.Contains(err.Error(), "notFound") && !strings.Contains(err.Error(), "404") {
+			continue
+		}
+	}
+
+	return nil, ErrInvalidPurchaseToken
+}
+
+// AcknowledgeSubscription acknowledges a subscription purchase
+// This must be called within 3 days of purchase or the subscription is refunded
+func (c *GoogleIAPClient) AcknowledgeSubscription(ctx context.Context, subscriptionID, purchaseToken string) error {
+	err := c.service.Purchases.Subscriptions.Acknowledge(
+		c.packageName,
+		subscriptionID,
+		purchaseToken,
+		&androidpublisher.SubscriptionPurchasesAcknowledgeRequest{},
+	).Context(ctx).Do()
+
+	if err != nil {
+		return fmt.Errorf("failed to acknowledge subscription: %w", err)
+	}
+
+	return nil
+}
--- a/internal/services/subscription_service.go
+++ b/internal/services/subscription_service.go
@@ -1,11 +1,14 @@
 package services

 import (
+	"context"
 	"errors"
+	"log"
 	"time"

 	"gorm.io/gorm"

+	"github.com/treytartt/casera-api/internal/config"
 	"github.com/treytartt/casera-api/internal/models"
 	"github.com/treytartt/casera-api/internal/repositories"
 )
@@ -21,6 +24,15 @@ var (
 	ErrPromotionNotFound        = errors.New("promotion not found")
 )

+// KnownSubscriptionIDs are the product IDs for Pro subscriptions
+// Update these to match your actual App Store Connect / Google Play Console product IDs
+var KnownSubscriptionIDs = []string{
+	"com.tt.casera.pro.monthly",
+	"com.tt.casera.pro.yearly",
+	"casera_pro_monthly",
+	"casera_pro_yearly",
+}
+
 // SubscriptionService handles subscription business logic
 type SubscriptionService struct {
 	subscriptionRepo *repositories.SubscriptionRepository
@@ -28,6 +40,8 @@ type SubscriptionService struct {
 	taskRepo         *repositories.TaskRepository
 	contractorRepo   *repositories.ContractorRepository
 	documentRepo     *repositories.DocumentRepository
+	appleClient      *AppleIAPClient
+	googleClient     *GoogleIAPClient
 }

 // NewSubscriptionService creates a new subscription service
@@ -38,13 +52,41 @@ func NewSubscriptionService(
 	contractorRepo *repositories.ContractorRepository,
 	documentRepo *repositories.DocumentRepository,
 ) *SubscriptionService {
-	return &SubscriptionService{
+	svc := &SubscriptionService{
 		subscriptionRepo: subscriptionRepo,
 		residenceRepo:    residenceRepo,
 		taskRepo:         taskRepo,
 		contractorRepo:   contractorRepo,
 		documentRepo:     documentRepo,
 	}
+
+	// Initialize Apple IAP client
+	cfg := config.Get()
+	if cfg != nil {
+		appleClient, err := NewAppleIAPClient(cfg.AppleIAP)
+		if err != nil {
+			if !errors.Is(err, ErrIAPNotConfigured) {
+				log.Printf("Warning: Failed to initialize Apple IAP client: %v", err)
+			}
+		} else {
+			svc.appleClient = appleClient
+			log.Println("Apple IAP validation client initialized")
+		}
+
+		// Initialize Google IAP client
+		ctx := context.Background()
+		googleClient, err := NewGoogleIAPClient(ctx, cfg.GoogleIAP)
+		if err != nil {
+			if !errors.Is(err, ErrIAPNotConfigured) {
+				log.Printf("Warning: Failed to initialize Google IAP client: %v", err)
+			}
+		} else {
+			svc.googleClient = googleClient
+			log.Println("Google IAP validation client initialized")
+		}
+	}
+
+	return svc
 }

 // GetSubscription gets the subscription for a user
@@ -281,17 +323,57 @@ func (s *SubscriptionService) GetActivePromotions(userID uint) ([]PromotionRespo
 }

 // ProcessApplePurchase processes an Apple IAP purchase
-func (s *SubscriptionService) ProcessApplePurchase(userID uint, receiptData string) (*SubscriptionResponse, error) {
-	// TODO: Implement receipt validation with Apple's servers
-	// For now, just upgrade the user
-
-	// Store receipt data
-	if err := s.subscriptionRepo.UpdateReceiptData(userID, receiptData); err != nil {
+// Supports both StoreKit 1 (receiptData) and StoreKit 2 (transactionID)
+func (s *SubscriptionService) ProcessApplePurchase(userID uint, receiptData string, transactionID string) (*SubscriptionResponse, error) {
+	// Store receipt/transaction data
+	dataToStore := receiptData
+	if dataToStore == "" {
+		dataToStore = transactionID
+	}
+	if err := s.subscriptionRepo.UpdateReceiptData(userID, dataToStore); err != nil {
 		return nil, err
 	}

-	// Upgrade to Pro (1 year from now - adjust based on actual subscription)
-	expiresAt := time.Now().UTC().AddDate(1, 0, 0)
+	// Validate with Apple if client is configured
+	var expiresAt time.Time
+	if s.appleClient != nil {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+
+		var result *AppleValidationResult
+		var err error
+
+		// Prefer transaction ID (StoreKit 2), fall back to receipt data (StoreKit 1)
+		if transactionID != "" {
+			result, err = s.appleClient.ValidateTransaction(ctx, transactionID)
+		} else if receiptData != "" {
+			result, err = s.appleClient.ValidateReceipt(ctx, receiptData)
+		}
+
+		if err != nil {
+			// Log the validation error
+			log.Printf("Apple validation warning for user %d: %v", userID, err)
+
+			// Check if it's a fatal error
+			if errors.Is(err, ErrInvalidReceipt) || errors.Is(err, ErrSubscriptionCancelled) {
+				return nil, err
+			}
+
+			// For other errors (network, etc.), fall back with shorter expiry
+			expiresAt = time.Now().UTC().AddDate(0, 1, 0) // 1 month fallback
+		} else if result != nil {
+			// Use the expiration date from Apple
+			expiresAt = result.ExpiresAt
+			log.Printf("Apple purchase validated for user %d: product=%s, expires=%v, env=%s",
+				userID, result.ProductID, result.ExpiresAt, result.Environment)
+		}
+	} else {
+		// Apple validation not configured - trust client but log warning
+		log.Printf("Warning: Apple IAP validation not configured, trusting client for user %d", userID)
+		expiresAt = time.Now().UTC().AddDate(1, 0, 0) // 1 year default
+	}
+
+	// Upgrade to Pro with the determined expiration
 	if err := s.subscriptionRepo.UpgradeToPro(userID, expiresAt, "ios"); err != nil {
 		return nil, err
 	}
@@ -300,17 +382,66 @@ func (s *SubscriptionService) ProcessApplePurchase(userID uint, receiptData stri
 }

 // ProcessGooglePurchase processes a Google Play purchase
-func (s *SubscriptionService) ProcessGooglePurchase(userID uint, purchaseToken string) (*SubscriptionResponse, error) {
-	// TODO: Implement token validation with Google's servers
-	// For now, just upgrade the user
-
-	// Store purchase token
+// productID is optional but helps validate the specific subscription
+func (s *SubscriptionService) ProcessGooglePurchase(userID uint, purchaseToken string, productID string) (*SubscriptionResponse, error) {
+	// Store purchase token first
 	if err := s.subscriptionRepo.UpdatePurchaseToken(userID, purchaseToken); err != nil {
 		return nil, err
 	}

-	// Upgrade to Pro (1 year from now - adjust based on actual subscription)
-	expiresAt := time.Now().UTC().AddDate(1, 0, 0)
+	// Validate the purchase with Google if client is configured
+	var expiresAt time.Time
+	if s.googleClient != nil {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+
+		var result *GoogleValidationResult
+		var err error
+
+		// If productID is provided, use it directly; otherwise try known IDs
+		if productID != "" {
+			result, err = s.googleClient.ValidateSubscription(ctx, productID, purchaseToken)
+		} else {
+			result, err = s.googleClient.ValidatePurchaseToken(ctx, purchaseToken, KnownSubscriptionIDs)
+		}
+
+		if err != nil {
+			// Log the validation error
+			log.Printf("Google purchase validation warning for user %d: %v", userID, err)
+
+			// Check if it's a fatal error
+			if errors.Is(err, ErrInvalidPurchaseToken) || errors.Is(err, ErrSubscriptionCancelled) {
+				return nil, err
+			}
+
+			if errors.Is(err, ErrSubscriptionExpired) {
+				// Subscription expired - still allow but set past expiry
+				expiresAt = time.Now().UTC().Add(-1 * time.Hour)
+			} else {
+				// For other errors, fall back with shorter expiry
+				expiresAt = time.Now().UTC().AddDate(0, 1, 0) // 1 month fallback
+			}
+		} else if result != nil {
+			// Use the expiration date from Google
+			expiresAt = result.ExpiresAt
+			log.Printf("Google purchase validated for user %d: product=%s, expires=%v, autoRenew=%v",
+				userID, result.ProductID, result.ExpiresAt, result.AutoRenewing)
+
+			// Acknowledge the subscription if not already acknowledged
+			if !result.AcknowledgedState {
+				if err := s.googleClient.AcknowledgeSubscription(ctx, result.ProductID, purchaseToken); err != nil {
+					log.Printf("Warning: Failed to acknowledge subscription for user %d: %v", userID, err)
+					// Don't fail the purchase, just log the warning
+				}
+			}
+		}
+	} else {
+		// Google validation not configured - trust client but log warning
+		log.Printf("Warning: Google IAP validation not configured, trusting client for user %d", userID)
+		expiresAt = time.Now().UTC().AddDate(1, 0, 0) // 1 year default
+	}
+
+	// Upgrade to Pro with the determined expiration
 	if err := s.subscriptionRepo.UpgradeToPro(userID, expiresAt, "android"); err != nil {
 		return nil, err
 	}
@@ -511,7 +642,9 @@ func NewPromotionResponse(p *models.Promotion) *PromotionResponse {

 // ProcessPurchaseRequest represents an IAP purchase request
 type ProcessPurchaseRequest struct {
-	ReceiptData   string `json:"receipt_data"`   // iOS
+	ReceiptData   string `json:"receipt_data"`   // iOS (StoreKit 1 receipt or StoreKit 2 JWS)
+	TransactionID string `json:"transaction_id"` // iOS StoreKit 2 transaction ID
 	PurchaseToken string `json:"purchase_token"` // Android
+	ProductID     string `json:"product_id"`     // Android (optional, helps identify subscription)
 	Platform      string `json:"platform" binding:"required,oneof=ios android"`
 }