pal-e-docs

Review: App Store StoreKit integration (re-review)

review-1610-2026-06-27-r2 Review

review approved
Project

Verdict: READY

Re-review of board item #1610 after refinement. All three [BODY] issues from review-1610-2026-06-27 have been resolved. Two [SCOPE] items (story note, arch note) remain outstanding but are acknowledged as non-blocking per the review request.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- Standalone, Sprint 6 planning
  • [x] Repo -- ldraney/westside-basketball
  • [x] User Story -- well-formed (As an admin, I want...)
  • [x] Context -- thorough explanation of Apple billing behavior
  • [x] File Targets -- 4 targets listed (Gemfile, routes.rb, webhooks_controller.rb, credentials.yml.enc) plus exclusion list
  • [x] Feature Flag -- none, justified as infrastructure
  • [x] Acceptance Criteria -- separated into Manual (3) and Code (3) sections
  • [x] Test Expectations -- 2 integration tests with run command
  • [x] Constraints -- 3 constraints listed
  • [x] Checklist -- standard 3 items
  • [x] Related -- project reference and previous review note present

Traceability

  • [ ] story:WS-AUTH label -- NOT registered on project-westside-basketball user-stories section. Stories range WS-S1 through WS-S33; no WS-AUTH entry exists. Deferred -- acknowledged from prior review, not blocking.
  • [ ] arch:app-store label -- No arch-app-store note found in pal-e-docs. Deferred -- acknowledged from prior review, not blocking.
  • [x] Forgejo issue -- ldraney/westside-basketball#65, state: open

File Targets

  • [x] Gemfile -- verified exists. app_store_server_library gem is NOT yet present (correct -- ticket adds it). Fixed from R1: was missing from file targets, now listed.
  • [x] config/routes.rb -- verified exists. Contains Stripe webhook route at line 50: post "webhooks/stripe" => "webhooks#stripe". New App Store route will follow same pattern.
  • [x] app/controllers/webhooks_controller.rb -- verified exists (119 lines). Single-file controller inheriting from ActionController::Base with skip_forgery_protection. No webhooks/ subdirectory exists. Fixed from R1: was incorrectly listed as webhooks/app_store_controller.rb, now correctly references the flat controller file.
  • [x] config/credentials.yml.enc -- verified exists.

Repo Placement

OK. Issue filed on ldraney/westside-basketball. All code changes (webhook endpoint, gem, routes, credentials) live in this Rails app. Manual Apple portal steps are clearly labeled as non-code tasks.

Dependencies

  • depends:58 (Admin player detail page) -- issue #58 is still OPEN. Dependency is documented via board label. The dependency is logical: #58 provides the admin page where subscription status will eventually display. However, #65 (webhook infrastructure) can be built independently -- it receives and processes notifications without any UI. The dependency chain #58 -> #65 -> #66 is correctly modeled on the board. Item #1611 (issue #66, 5pts) in backlog depends on #65 via depends:65 label.

Acceptance Criteria

Fixed from R1: ACs are now cleanly separated into Manual and Code sections.
  • [x] Manual ACs (3) -- clearly labeled as "Apple portal -- human task, not agent-verifiable". Agent will skip these.
  • [x] Code AC: app_store_server_library gem added to Gemfile -- agent-verifiable (check Gemfile)
  • [x] Code AC: App Store Server Notifications v2 endpoint receives and acknowledges test notifications -- agent-verifiable via integration test
  • [x] Code AC: JWS signature verification -- agent-verifiable via integration test
Test command is accurate: bundle exec rails test test/controllers/webhooks_controller_test.rb. Test file verified to exist (320 lines of Stripe webhook tests; App Store tests will be appended).

Blast Radius

Low. The webhook endpoint is additive -- new route, new controller method, new gem. No existing code is modified except adding a route to routes.rb and a new action method to webhooks_controller.rb. The existing Stripe webhook functionality is untouched. No sibling services affected. No existing App Store code in the codebase (grep confirmed: zero matches for app_store, apple, storekit, or jws in .rb files).

Decomposition Assessment

4 file targets in 1 repo, 3 code acceptance criteria, estimated agent work well under 5 minutes. No decomposition needed.

Refinement Resolution

R1 Finding Tag Status
Wrong controller path (webhooks/app_store_controller.rb) [BODY] RESOLVED -- now webhooks_controller.rb
Missing Gemfile from file targets [BODY] RESOLVED -- Gemfile now listed
Manual/code ACs not separated [BODY] RESOLVED -- clear Manual/Code headers
story:WS-AUTH not registered [SCOPE] DEFERRED -- acknowledged, not blocking
arch-app-store note missing [SCOPE] DEFERRED -- acknowledged, not blocking

Recommendation

No blocking action needed. All [BODY] issues resolved. Ticket is ready for agent execution.
Deferred items for future cleanup:
  • [SCOPE] Register story:WS-AUTH (or assign a new WS-S## code) on project-westside-basketball user-stories section.
  • [SCOPE] Create architecture note arch-app-store for the App Store subscription component.