feat: sync with openiap v1.3.17#33
Conversation
- Update openiap-versions.json (gql: 1.3.17, apple: 1.3.14, google: 1.3.28) - Add InstallmentPlanDetailsAndroid data class (Billing Library 7.0+) - Add PendingPurchaseUpdateAndroid data class (Billing Library 5.0+) - Add purchaseOptionIdAndroid field to DiscountOffer (Billing Library 7.0+) - Update llms.txt with new type documentation - Add release blog post Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @hyochan, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request updates the project to align with OpenIAP v1.3.17, primarily focusing on enhancing Android billing capabilities. It introduces support for advanced Google Play Billing Library features, such as subscription installment plans and pending purchase updates, by adding new data structures and fields. This ensures compatibility with newer billing library versions and provides developers with more granular control and information regarding in-app purchases and subscriptions on the Android platform. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request syncs the project with OpenIAP v1.3.17, introducing new data classes for recent Google Play Billing Library features. However, a medium-severity vulnerability was identified where the PendingPurchaseUpdateAndroid data class insecurely deserializes the purchaseToken, defaulting to an empty string for invalid input, which could lead to logic errors or security bypasses. Additionally, there's a minor correction needed for the date in the new release blog post and a suggestion to improve the robustness of JSON parsing for the new PendingPurchaseUpdateAndroid type to prevent potential issues with invalid data.
| public data class PendingPurchaseUpdateAndroid( | ||
| /** | ||
| * Product IDs for the pending purchase update. | ||
| * These are the new products the user is switching to. | ||
| */ | ||
| val products: List<String>, | ||
| /** | ||
| * Purchase token for the pending transaction. | ||
| * Use this token to track or manage the pending purchase update. | ||
| */ | ||
| val purchaseToken: String | ||
| ) { | ||
|
|
||
| companion object { | ||
| fun fromJson(json: Map<String, Any?>): PendingPurchaseUpdateAndroid { | ||
| return PendingPurchaseUpdateAndroid( | ||
| products = (json["products"] as? List<*>)?.mapNotNull { it as? String } ?: emptyList(), | ||
| purchaseToken = json["purchaseToken"] as? String ?: "", | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| fun toJson(): Map<String, Any?> = mapOf( | ||
| "__typename" to "PendingPurchaseUpdateAndroid", | ||
| "products" to products, | ||
| "purchaseToken" to purchaseToken, | ||
| ) | ||
| } |
There was a problem hiding this comment.
The purchaseToken field in PendingPurchaseUpdateAndroid.fromJson is a critical security identifier. Defaulting it to an empty string ("") upon invalid input creates a medium-severity vulnerability, potentially leading to authentication bypasses or incorrect resource access. It's crucial to handle invalid or missing tokens securely, ideally by making the field nullable (String?) and assigning null to ensure downstream logic correctly handles its absence, rather than masking issues with an empty string.
public data class PendingPurchaseUpdateAndroid(
/**
* Product IDs for the pending purchase update.
* These are the new products the user is switching to.
*/
val products: List<String>,
/**
* Purchase token for the pending transaction.
* Use this token to track or manage the pending purchase update.
*/
val purchaseToken: String?
) {
companion object {
fun fromJson(json: Map<String, Any?>): PendingPurchaseUpdateAndroid {
return PendingPurchaseUpdateAndroid(
products = (json["products"] as? List<*>)?.mapNotNull { it as? String } ?: emptyList(),
purchaseToken = json["purchaseToken"] as? String,
)
}
}
fun toJson(): Map<String, Any?> = mapOf(
"__typename" to "PendingPurchaseUpdateAndroid",
"products" to products,
"purchaseToken" to purchaseToken,
)
}There was a problem hiding this comment.
This type is auto-generated from the OpenIAP GraphQL specification, where purchaseToken is defined as String! (non-nullable).
The OpenIAP spec follows Google Play Billing Library's contract where PendingPurchaseUpdate.getPurchaseToken() never returns null - it always returns a valid token when a pending update exists. The parent field pendingPurchaseUpdateAndroid is already nullable, so if there's no pending update, the entire object is null rather than having a null token.
Changes to this type should be proposed upstream at the OpenIAP specification: https://github.com/hyodotdev/openiap.dev/discussions
1 participant
Summary
Related
OpenIAP Versions
🤖 Generated with Claude Code