feat(kilo-pass): handle Play real-time notifications - #5598
Open
iscekic wants to merge 12 commits into
Open
Conversation
This was referenced Aug 27, 2026
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryPlay RTDN OIDC auth now verifies the configured service-account email claim; incremental review found no remaining issues. Files Reviewed (3 files)
Previous Review Summaries (2 snapshots, latest commit 280d7cc)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 280d7cc)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (6 files)
Fix these issues in Kilo Cloud Previous review (commit b909b8c)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (6 files)
Reviewed by grok-4.6 · Input: 78.7K · Output: 8K · Cached: 289.3K Review guidance: REVIEW.md from base branch |
pandemicsyn
approved these changes
Aug 27, 2026
Three defects in the Play notification path: - A failed credit clawback wrote a success audit and marked the revoke event processed, so refunded credits stayed with the buyer and Pub/Sub never redelivered. The clawback error now rolls the transaction back. - A delayed expiry or cancellation ended a subscription that had already renewed or recovered. Both now reconcile against the Play state the handler already fetched, which is the source of truth. - A request body that is not JSON returned 500, so Pub/Sub redelivered a message that can never succeed. It now returns 400.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Kilo Pass subscriptions bought on Google Play for Android now follow the store's subscription events.
A new processor turns Google Play Real-time Developer Notifications into Kilo Pass lifecycle actions. It decodes the base64 Pub/Sub payload, rejects a package-name mismatch, and routes each notification type: purchase, renewal, recovery, and restart complete the store purchase; canceled marks end-of-period cancellation; expired ends the subscription; revoked reverses the granted credits and ends it; unknown types are claimed and ignored. Each event claims a
kilo_pass_store_eventsrow before it acts, so a delayed or redelivered message cannot apply a purchase or a reversal twice, and the stored payload token is redacted.Files
apps/web/src/lib/kilo-pass/google-play-notifications.ts— new processor. It base64-decodes the Pub/Sub payload, checks the package name, fetches and decodes the Play subscription purchase, and claims thekilo_pass_store_eventsrow with a five-minute stale reclaim. It routes each notification type to its lifecycle action, reverses base, bonus, and promo credits on revocation, skips purchase completion when a processed revoked event already settled, and marks the event processed.The notification endpoint authenticates each Pub/Sub push before it reaches the processor. It verifies the OIDC bearer token against the
GOOGLE_PLAY_RTDN_PUSH_AUDIENCEaudience and now also requires the token's verifiedemailclaim to equalGOOGLE_PLAY_RTDN_PUSH_SERVICE_ACCOUNT_EMAIL, so an arbitrary GCP service account cannot invoke the billing webhook. A missing, invalid, or mismatched token returns 401, a malformed body returns 400, a fresh in-flight duplicate returns 503 for Pub/Sub to retry, and a processing error returns 500 without leaking details.Files
apps/web/src/app/api/kilo-pass/play/notifications/route.ts— new POST route. It parses the body shape, reads both environment values, verifies the bearer withOAuth2Client, checks the email andemail_verifiedclaims against the configured service account, delegates to the processor, and reports failures to Sentry.ENVIRONMENT.md— catalogs the newGOOGLE_PLAY_RTDN_PUSH_SERVICE_ACCOUNT_EMAILvalue.trackKiloPassPurchaseCompletednow accepts agoogle_playchannel next toapp_store, and the property branch now splits onstripe. A Google Play completion therefore emits the samekilo_pass_purchase_completedevent with the provider transaction, product, and environment properties.Files
apps/web/src/lib/kilo-pass/posthog-tracking.ts— addsgoogle_playto the store channel union and changes the property branch condition to compare againststripe.Tests: 3 files changed —
route.test.tsandgoogle-play-notifications.test.tsadded,posthog-tracking.test.tsupdated.Generated: none.
Verification
No manual test paths were run. No E2E report is attached for this level — a lower PR names its own change alone, and the tip PR carries the E2E report.
Visual Changes
Visual Changes: N/A
Reviewer Notes
GOOGLE_PLAY_RTDN_PUSH_AUDIENCEto the public HTTPS URL of the notifications endpoint. Runpnpm web:env set GOOGLE_PLAY_RTDN_PUSH_AUDIENCE.GOOGLE_PLAY_RTDN_PUSH_SERVICE_ACCOUNT_EMAILto the email of the Play service account that the Pub/Sub push uses. The route returns 401 for every notification until both values are set.Stacked PRs — merge bottom to top. Each level shows only its own diff.
Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.
android-iap-e895— feat(commerce): add Play Kilo Pass presentation flag #5581android-iap-e895-s2— feat(kilo-pass): add Google Play publisher SDK #5582android-iap-e895-s3— feat(kilo-pass): add Google Play purchase verifier #5586android-iap-e895-s4— feat(kilo-pass): handle Play real-time notifications #5598 ← this PRandroid-iap-e895-s5— feat(kilo-pass): add completePlayPurchase mutation #5608android-iap-e895-s6— feat(mobile): offer Google Play Kilo Pass purchase #5618 (tip)