StoreKit 2 affiliate tracking for iOS subscriptions

import Foundation
import StoreKit

struct AttribloomBindResponse: Decodable {
    let appAccountToken: UUID
    let offerCode: String?
}

enum AttribloomAPIError: Error {
    case invalidResponse
    case rejected(status: Int, body: String)
}

struct AttribloomAPI {
    let baseURL = URL(string: "https://api.attribloom.com")!

    func bind(signedClickId: String? = nil, refCode: String? = nil) async throws
        -> AttribloomBindResponse {
        struct Body: Encodable { let signedClickId: String?; let refCode: String? }
        return try await post("/v1/app-store/bind", Body(
            signedClickId: signedClickId, refCode: refCode
        ))
    }

    func bindDeferred(surfaceId: String) async throws -> AttribloomBindResponse {
        struct Body: Encodable { let surfaceId: String }
        return try await post("/v1/app-store/bind/deferred", Body(surfaceId: surfaceId))
    }

    private func post<Body: Encodable, Output: Decodable>(
        _ path: String, _ body: Body
    ) async throws -> Output {
        let endpoint = baseURL.appendingPathComponent(String(path.dropFirst()))
        var request = URLRequest(url: endpoint)
        request.httpMethod = "POST"
        request.setValue("application/json", forHTTPHeaderField: "content-type")
        request.httpBody = try JSONEncoder().encode(body)
        let (data, response) = try await URLSession.shared.data(for: request)
        guard let http = response as? HTTPURLResponse else {
            throw AttribloomAPIError.invalidResponse
        }
        guard (200..<300).contains(http.statusCode) else {
            throw AttribloomAPIError.rejected(
                status: http.statusCode,
                body: String(decoding: data, as: UTF8.self)
            )
        }
        return try JSONDecoder().decode(Output.self, from: data)
    }
}

func purchaseWithAttribution(
    product: Product,
    clipboardSignedClickId: String?,
    attribloomSurfaceId: String
) async throws {
    let api = AttribloomAPI()
    let binding: AttribloomBindResponse
    if let signedClickId = clipboardSignedClickId {
        binding = try await api.bind(signedClickId: signedClickId)
    } else {
        binding = try await api.bindDeferred(surfaceId: attribloomSurfaceId)
    }

    // Persist and reuse this UUID for the app install. Replace UserDefaults with
    // your existing secure app storage if your data policy requires it.
    UserDefaults.standard.set(
        binding.appAccountToken.uuidString,
        forKey: "attribloom.appAccountToken"
    )

    let result = try await product.purchase(options: [
        .appAccountToken(binding.appAccountToken),
    ])
    if case .success(.verified(let transaction)) = result {
        await transaction.finish()
    }
}

import crypto from "node:crypto";

// Forward EVERY App Store Server Notification v2 your server receives to Attribloom,
// off the critical path (a delivery failure must never affect your own unlock logic).
const SURFACE_ID = "<your-surface-id>";          // last path segment of your Forwarding URL
const SECRET     = process.env.ATTRIBLOOM_FORWARDING_SECRET; // same value as Attribloom

async function forwardToAttribloom(signedPayload) {
  const ts   = Math.floor(Date.now() / 1000).toString();    // unix SECONDS, not ms
  const body = JSON.stringify({ signedPayload });            // Apple's JWS, verbatim
  const sig  = "sha256=" + crypto
    .createHmac("sha256", SECRET)
    .update(`${ts}.`)      // timestamp + "."
    .update(body)           // then the exact bytes you POST
    .digest("hex");

  await fetch(`https://api.attribloom.com/v1/app-store/assn/${SURFACE_ID}`, {
    method:  "POST",
    headers: {
      "content-type":   "application/json",
      "x-ea-timestamp": ts,   // unix seconds string
      "x-ea-signature": sig,  // "sha256=" + hex
    },
    body,
  });
}