knowmetools / km-api

The API behind our Know Me app
Apache License 2.0
4 stars 0 forks source link

Return user's primary email address when querying for an Apple receipt #477

Closed cdriehuys closed 5 years ago

cdriehuys commented 5 years ago

What problem does your proposed feature solve? When determining if the current user has an Apple receipt in use, it would be useful to be able to tell them the email address of the Know Me account who uses this receipt.

Describe the solution you'd like The Apple receipt query endpoint at /know-me/subscription/apple/<hash>/ should return the receipt owner's primary email address if the receipt exists.

Additional context The primary attack surface this would open up is email addresses being harvested by guessing or stealing receipt data hashes.