699486 - Change verify to get the receipt

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect, P1)

Description

[Andy McKay]

Verify used to send a GET, but its changing to a POST.

"If the verify URL is present, the receiving party may verify it by issuing a POST request to it, where the message body contains the complete receipt"

We'll need to verify the state of the receipt when we get it as well and discuss what else we should be doing on the server.

Comment 1

[Andy McKay]

As per meeting yesterday:

- Crack open the receipt, which will verify the crypto.
- Check the user has purchased and not refunded.

If it works:

- We'll return a 200 status code, {"status": "ok", "receipt": {... the JSON in the receipt }}

If it fails because of refund:

- We'll return a 200 status code, {"status": "refund"}

If it fails because the receipt is tampered with, false, or just plain wrong:

- We'll return a 200 status code, {"status": "invalid"}

If there's some other error:

- We'll return a 500 status code

Comment 2

[Wil Clouser [:clouserw]]

If anything connections take longer than 1 second:
- Send a 503.  Think about if we can send a useful retry-after header

Comment 3

[Andy McKay]

https://github.com/mozilla/zamboni/commit/80fe70

We'll need bug 702775 done before we can test.