- Problem
- client-reported entitlements can be spoofed, exposing paid features for free.
- Approach
- moved entitlement state server-side - iOS receipts are verified in a Cloud Function using Apple's official @apple/app-store-server-library, decoding and signature-verifying transactions across PRODUCTION and SANDBOX, then persisting to iap_events / iap_claims. Clients only ever read their entitlement.
- Result
- entitlements are provable from server state, with a one-subscription-per-account claim model rather than a value the client asserts.