KM-16629: storekit2

LocalPackages/PIAAccount/Package.swift

@@ -16,11 +16,16 @@ let package = Package(
             targets: ["PIAAccount"]
         )
     ],
+    dependencies: [
+        .package(path: "../PIABase")
+    ],
     targets: [
         // Main library target (merged for simplicity)
         .target(
             name: "PIAAccount",
-            dependencies: [],
+            dependencies: [
+                .product(name: "PIABase", package: "PIABase")
+            ],
             path: "Sources"
         ),
         // Test target using Swift Testing

LocalPackages/PIAAccount/Sources/PIAAccount/Models/RequestModels.swift

@@ -1,17 +1,19 @@
 import Foundation
+import PIABase
 
 // MARK: - iOS Sign Up Information
 
 /// Information required for iOS account sign up with App Store receipt
-public struct IOSSignupInformation: Codable, Sendable {
+public struct IOSSignupInformation: Encodable, Sendable {
     private let store: String = "apple_app_store"
-    public let receipt: String
+    public let receipt: JWS
+    private let receipt_version: Int = 2
     public let email: String
     public let marketing: String?
     public let debug: String?
 
     public init(
-        receipt: String,
+        receipt: JWS,
         email: String,
         marketing: String? = nil,
         debug: String? = nil
@@ -23,17 +25,30 @@ public struct IOSSignupInformation: Codable, Sendable {
     }
 }
 
+// MARK: - Restore purchase information
+
+public struct LoginRestorePurchasePayload: Encodable {
+    private let store: String = "apple_app_store"
+    private let receipt: JWS
+    private let receipt_version: Int = 2
+
+    public init(receipt: JWS) {
+        self.receipt = receipt
+    }
+}
+
 // MARK: - iOS Payment Information
 
 /// Information required for iOS payment updates
-public struct IOSPaymentInformation: Codable, Sendable {
+public struct IOSPaymentInformation: Encodable, Sendable {
     private let store: String = "apple_app_store"
-    public let receipt: String
+    public let receipt: JWS
+    private let receipt_version: Int = 2
     public let marketing: String
     public let debug: String
 
     public init(
-        receipt: String,
+        receipt: JWS,
         marketing: String,
         debug: String
     ) {

LocalPackages/PIAAccount/Sources/PIAAccount/Networking/APIPath.swift

@@ -5,7 +5,7 @@ enum APIPath: String, Sendable {
     case login = "/api/client/v5/api_token"
     case vpnToken = "/api/client/v5/vpn_token"
     case refreshAPIToken = "/api/client/v5/refresh"
-    case signup = "/api/client/signup"
+    case signup = "/api/client/v5/signup"
     case setEmail = "/api/client/account"
     case loginLink = "/api/client/v2/login_link"
     case logout = "/api/client/v2/expire_token"
@@ -28,15 +28,15 @@ enum APIPath: String, Sendable {
     /// Returns the subdomain for this API path
     var subdomain: String {
         switch self {
-        case .login, .vpnToken, .refreshAPIToken, .validateQR, .supportedDedicatedIPCountries, .getDedicatedIP:
+        case .login, .vpnToken, .refreshAPIToken, .validateQR, .supportedDedicatedIPCountries, .getDedicatedIP, .signup:
             return "apiv5"
         case .loginLink, .logout, .accountDetails, .messages, .dedicatedIP, .renewDedicatedIP:
             return "apiv2"
         case .deleteAccount:
             return "apiv5"
         case .refreshToken:
             return "apiv4"
-        case .signup, .setEmail, .clientStatus, .invites, .redeem, .iosPayment, .iosSubscriptions, .iosFeatureFlag:
+        case .setEmail, .clientStatus, .invites, .redeem, .iosPayment, .iosSubscriptions, .iosFeatureFlag:
             return "api"
         }
     }

LocalPackages/PIAAccount/Sources/PIAAccount/PIAAccountAPI.swift

@@ -1,4 +1,5 @@
 import Foundation
+import PIABase
 
 /// Main API protocol for PIA Account operations.
 ///
@@ -79,16 +80,16 @@ public protocol PIAAccountAPI {
     ///           or network/server errors for other failures
     func loginWithCredentials(username: String, password: String) async throws
 
-    /// Authenticates with an App Store receipt (iOS-specific).
+    /// Authenticates with a StoreKit 2 signed transaction (iOS-specific).
     ///
     /// Use this method to authenticate users who have purchased a subscription
-    /// through the iOS App Store. The receipt is validated server-side.
+    /// through the iOS App Store. The transaction is validated server-side.
     ///
-    /// - Parameter receiptBase64: Base64-encoded App Store receipt obtained from
-    ///                            `Bundle.main.appStoreReceiptURL`
-    /// - Throws: `PIAAccountError` with code 400 if receipt is invalid,
+    /// - Parameter receipt: The JWS representation of the StoreKit 2 transaction
+    ///                      (`VerificationResult.jwsRepresentation`).
+    /// - Throws: `PIAAccountError` with code 400 if the transaction is invalid,
     ///           401 if subscription is not active, or network/server errors
-    func loginWithReceipt(receiptBase64: String) async throws
+    func loginWithReceipt(receipt: JWS) async throws
 
     /// Sends a login link via email.
     ///
@@ -220,10 +221,10 @@ public protocol PIAAccountAPI {
     // MARK: - Subscriptions (iOS)
 
     /// Retrieves iOS subscription information
-    /// - Parameter receipt: Optional App Store receipt data
+    /// - Parameter receipt: Optional JWS StoreKit 2 transaction
     /// - Returns: Subscription information
     /// - Throws: PIAAccountError if the request fails
-    func subscriptions(receipt: Data?) async throws -> IOSSubscriptionInformation
+    func subscriptions(receipt: JWS?) async throws -> IOSSubscriptionInformation
 
     // MARK: - Payment (iOS)
 

LocalPackages/PIAAccount/Sources/PIAAccount/PIAAccountClient.swift

@@ -1,4 +1,5 @@
 import Foundation
+import PIABase
 
 /// Main implementation of PIAAccountAPI
 public actor PIAAccountClient: PIAAccountAPI {
@@ -90,11 +91,9 @@ public actor PIAAccountClient: PIAAccountAPI {
         try await refreshVPNToken()
     }
 
-    public func loginWithReceipt(receiptBase64: String) async throws {
-        let bodyData = try JSONEncoder.piaCodable.encode([
-            "store": "apple_app_store",
-            "receipt": receiptBase64
-        ])
+    public func loginWithReceipt(receipt: JWS) async throws {
+        let payload = LoginRestorePurchasePayload(receipt: receipt)
+        let bodyData = try JSONEncoder.piaCodable.encode(payload)
 
         // Request API token
         let apiTokenResponse: APITokenResponse = try await endpointManager.executeWithFailover(
@@ -348,7 +347,7 @@ public actor PIAAccountClient: PIAAccountAPI {
 
     // MARK: - Subscriptions (iOS)
 
-    public func subscriptions(receipt: Data?) async throws -> IOSSubscriptionInformation {
+    public func subscriptions(receipt: JWS?) async throws -> IOSSubscriptionInformation {
         try await refreshTokensIfNeeded()
 
         var headers: [String: String] = [:]
@@ -359,12 +358,11 @@ public actor PIAAccountClient: PIAAccountAPI {
         if let apiToken = try await tokenManager.getAPITokenString() {
             headers = ["Authorization": "Token \(apiToken)"]
             method = .post
-            var bodyDict: [String: String] = ["store": "apple_app_store"]
             if let receipt = receipt {
-                bodyDict["receipt"] = receipt.base64EncodedString()
+                let payload = LoginRestorePurchasePayload(receipt: receipt)
+                let data = try JSONEncoder.piaCodable.encode(payload)
+                bodyType = .json(data)
             }
-            let bodyData = try JSONEncoder.piaCodable.encode(bodyDict)
-            bodyType = .json(bodyData)
         }
 
         return try await endpointManager.executeWithFailover(

LocalPackages/PIABase/.gitignore

@@ -0,0 +1,8 @@
+.DS_Store
+/.build
+/Packages
+xcuserdata/
+DerivedData/
+.swiftpm/configuration/registries.json
+.swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata
+.netrc

LocalPackages/PIABase/Package.swift

@@ -0,0 +1,24 @@
+// swift-tools-version: 6.3
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+
+import PackageDescription
+
+let package = Package(
+    name: "PIABase",
+    products: [
+        // Products define the executables and libraries a package produces, making them visible to other packages.
+        .library(
+            name: "PIABase",
+            targets: ["PIABase"]
+        )
+    ],
+    targets: [
+        // Targets are the basic building blocks of a package, defining a module or a test suite.
+        // Targets can depend on other targets in this package and products from dependencies.
+        .target(
+            name: "PIABase"
+        )
+
+    ],
+    swiftLanguageModes: [.v6]
+)

LocalPackages/PIABase/Sources/PIABase/JWS.swift

@@ -0,0 +1,47 @@
+//
+//  JWS.swift
+//  PIAAccount
+//
+//  Created by Mario on 30/06/26.
+//  Copyright © 2020 Private Internet Access, Inc.
+//
+//  This file is part of the Private Internet Access iOS Client.
+//
+//  The Private Internet Access iOS Client is free software: you can redistribute it and/or
+//  modify it under the terms of the GNU General Public License as published by the Free
+//  Software Foundation, either version 3 of the License, or (at your option) any later version.
+//
+//  The Private Internet Access iOS Client is distributed in the hope that it will be useful,
+//  but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+//  or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+//  details.
+//
+//  You should have received a copy of the GNU General Public License along with the Private
+//  Internet Access iOS Client.  If not, see <https://www.gnu.org/licenses/>.
+//
+
+import Foundation
+
+public struct JWS: Sendable {
+    public let value: String
+
+    public init?(_ value: String) {
+        if value.isEmpty { return nil }
+        self.value = value
+    }
+
+    @inlinable
+    public var isEmpty: Bool { value.isEmpty }
+}
+
+extension JWS: Codable {
+    public init(from decoder: any Decoder) throws {
+        let container = try decoder.singleValueContainer()
+        self.value = try container.decode(String.self)
+    }
+
+    public func encode(to encoder: any Encoder) throws {
+        var container = encoder.singleValueContainer()
+        try container.encode(self.value)
+    }
+}

LocalPackages/PIADebugMenu/Sources/PIADebugMenu/DebugMenuView.swift

@@ -2,6 +2,8 @@
 import StoreKit
 import SwiftUI
 
+import struct PIABase.JWS
+
 // MARK: - DebugMenuView
 
 struct ReportResult: Identifiable {
@@ -21,6 +23,7 @@ public struct DebugMenuView: View {
     @State private var isRefundSheetPresented = false
     @State private var availableTransactions: [StoreKit.Transaction] = []
     @State private var isTransactionPickerPresented = false
+    @State var entitlementJWS: JWS? = nil
 
     public var body: some View {
         mainContent
@@ -66,6 +69,9 @@ public struct DebugMenuView: View {
             .onAppear {
                 logSnapshot = logs
             }
+            .task {
+                entitlementJWS = await Client.store.currentEntitlementJWS()
+            }
             .onReceive(Timer.publish(every: 2, on: .main, in: .common).autoconnect()) { _ in
                 logSnapshot = logs
             }
@@ -157,11 +163,11 @@ public struct DebugMenuView: View {
     }
 
     private var receiptSection: some View {
-        DebugSection("Payment Receipt") {
-            if let base64 = receiptBase64 {
-                let preview = String(base64.prefix(300)) + "..."
+        DebugSection("Transaction (JWS)") {
+            if let transactionJWS {
+                let preview = String(transactionJWS.value.prefix(300)) + "..."
                 VStack(alignment: .leading, spacing: 2) {
-                    Text("Receipt (preview)")
+                    Text("Transaction JWS (preview)")
                         .font(.caption)
                         .foregroundStyle(.secondary)
                     Text(preview)
@@ -179,16 +185,16 @@ public struct DebugMenuView: View {
                 #if os(iOS)
                     ShareLink(
                         item: DebugExportFile(
-                            content: base64,
-                            filename: "receipt_\(Int(Date().timeIntervalSince1970)).txt"
+                            content: transactionJWS.value,
+                            filename: "transaction_\(Int(Date().timeIntervalSince1970)).txt"
                         ),
-                        preview: SharePreview("Receipt")
+                        preview: SharePreview("Transaction JWS")
                     ) {
                         Label("Export", systemImage: "square.and.arrow.up")
                     }
                 #endif
             } else {
-                DebugInfoRow(label: "Receipt", value: "Not available")
+                DebugInfoRow(label: "Transaction", value: "Not available")
             }
         }
     }

LocalPackages/PIADebugMenu/Sources/PIADebugMenu/Extensions/DebugMenuView+Values.swift

@@ -1,6 +1,8 @@
 import Foundation
 @preconcurrency import PIALibrary
 
+import struct PIABase.JWS
+
 @available(iOS 16, *)
 extension DebugMenuView {
     var appVersion: String {
@@ -51,8 +53,8 @@ extension DebugMenuView {
         return formatter.string(from: date)
     }
 
-    var receiptBase64: String? {
-        Client.store.paymentReceipt?.base64EncodedString()
+    var transactionJWS: JWS? {
+        entitlementJWS
     }
 
     var logs: String {
@@ -74,8 +76,8 @@ extension DebugMenuView {
         lines.append("Is Renewable: \(isRenewable)")
         lines.append("Is Recurring: \(isRecurring)")
         lines.append("")
-        lines.append("=== Payment Receipt ===")
-        lines.append(receiptBase64 ?? "Not available")
+        lines.append("=== Transaction (JWS) ===")
+        lines.append(transactionJWS?.value ?? "Not available")
         lines.append("")
         lines.append("=== Logs ===")
         lines.append(logs)

LocalPackages/PIALibrary/Package.swift

@@ -20,6 +20,7 @@ let package = Package(
         .package(path: "../PIAKPI"),
         .package(path: "../PIACSI"),
         .package(path: "../PIAAccount"),
+        .package(path: "../PIABase"),
         .package(path: "../PIARegions"),
         .package(url: "git@github.com:pia-foss/mobile-ios-networking.git", exact: "1.3.2"),
         .package(url: "git@github.com:pia-foss/mobile-ios-openvpn.git", exact: "2.2.6"),
@@ -37,6 +38,7 @@ let package = Package(
                 .product(name: "PIACSI", package: "PIACSI"),
                 .product(name: "PIARegions", package: "PIARegions"),
                 .product(name: "PIAAccount", package: "PIAAccount"),
+                .product(name: "PIABase", package: "PIABase"),
                 .product(
                     name: "PIAWireguard",
                     package: "mobile-ios-wireguard",