- How do I install szohan/appstore-server-notifications in a Laravel app?
- The package is installed via Composer with composer require szohan/appstore-server-notifications, then you publish its config and register the notification route in your Laravel app. You point App Store Connect's server notification URL at that route and set the required shared secret or signing configuration. Because the assessment notes no Packagist signal, confirm the package is actually resolvable from your configured repository before relying on it.
- Does this package support App Store Server Notifications V2?
- The provided context does not confirm V2 support. The technical evaluation explicitly lists V2's signedTransactionInfo and signedRenewalInfo nesting as something to verify in source before adoption. Treat V2 support as unproven until you inspect the notification parsing and decoding code.
- Does it perform full JWS signature verification or just decode the payload?
- The blurb only promises decoding of signed payloads, and the assessment flags full JWS verification as unverified. You need to inspect the source to confirm it validates the JWS signature rather than merely base64-decoding the payload. It must also validate the x5c certificate chain to Apple's root CA before you trust any notification.
- How does it handle sandbox versus production App Store notifications?
- The context does not document separate sandbox and production handling. The evaluation lists how the package distinguishes sandbox from production as a key question to answer in code review. In practice you need both environments to work in one deployment, or you risk missing test and production events.
- How are decoded notifications exposed to application code?
- The context does not specify the public API for delivering notifications to your app. The assessment asks whether it exposes typed events, a single generic event, or a raw array, so check the service provider and handler contracts. Prefer a design that lets you route notification types like DID_RENEW, REFUND, and EXPIRED without parsing untyped arrays everywhere.
- Does it provide idempotency handling for notificationUUID?
- There is no documented idempotency hook in the provided context. The evaluation specifically asks whether idempotency is keyed on notificationUUID. Since Apple may retry notifications, you should add your own deduplication store keyed on notificationUUID before mutating entitlements.
- What HTTP status does it return when processing fails, and does that match Apple retry semantics?
- The context does not state the failure response behavior. The assessment flags the HTTP status returned on internal processing failure as an open question because Apple uses retries and expects appropriate non-2xx responses for transient failures. You should verify the controller returns an error status on failure and a success status only after durable processing.
- Is this package production-ready for subscription entitlement handling?
- The assessment rates technical risk high and maturity low: zero stars, zero dependents, no Packagist signal, and a single maintainer. It recommends treating the package as a reference implementation to read, not a dependency to trust directly. For billing integrity, fork or vendor it under a pinned commit and put it behind your own verifier and handler interfaces.
- What PHP and Laravel versions does it support?
- The provided context does not list PHP or Laravel version constraints. The evaluation asks for the declared constraints and whether JWT and OpenSSL dependencies are current and free of known CVEs. Check composer.json before adopting, especially if you are on a newer Laravel release.
- Does it include tests, CI, or certificate-rotation fixtures?
- No test suite or CI is visible in the assessment. The evaluation explicitly asks whether tests include fixtures for certificate rotation and malformed payloads. Absent that, you should write your own contract tests against captured sandbox and production notification payloads.