From b84d031bad4360cd7a5c0b2e640699fb0bd71fe5 Mon Sep 17 00:00:00 2001
From: spacedandy-agents-simplex
 <342056592+spacedandy-agents-simplex@users.noreply.github.com>
Date: Thu, 15 Oct 2026 10:13:25 +0000
Subject: [PATCH] badge-service: say what hashing the Play order id protects

The hash is unkeyed, so a holder of the buyer's receipt can still find the row (R2-1). Run: 004-badge-subscriptions-review, review round 2
---
 .../src/BadgeService/StoreReceipts/Google.hs                    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/simplex-badge-service/src/BadgeService/StoreReceipts/Google.hs b/apps/simplex-badge-service/src/BadgeService/StoreReceipts/Google.hs
index 002a45805f..987265cdd7 100644
--- a/apps/simplex-badge-service/src/BadgeService/StoreReceipts/Google.hs
+++ b/apps/simplex-badge-service/src/BadgeService/StoreReceipts/Google.hs
@@ -163,7 +163,7 @@ subscriptionVerdict SubscriptionPurchase {subscriptionStateName, testSubscriptio
       latestCharge <- forM latestSuccessfulOrderId $ \orderId -> case (expiryTime, basePlanId) of
         (Just periodEnd, Just planId) ->
           let periodStart = maybe periodEnd (\(_, months) -> addMonths (negate $ toInteger months) periodEnd) (storePlan PPGoogle planId)
-           -- hashed: the order id is on the buyer's Play receipt email
+           -- hashed so the row does not show the order id; unkeyed, so a holder of the buyer's receipt can still find it
            in Right StoreCharge {chargeRef = googlePurchaseRef orderId, planId, periodStart, periodEnd, chargePaid = Nothing, revoked = False, offer = inOffer}
         _ -> Left $ SRVerifierFailed "Play answered a charge without its expiryTime or base plan"
       pure SubscriptionCheck {subscriptionState, testSubscription, latestCharge}