What do you want to achieve? Keep it simple and clear!
I want to comply with the Policy Service paid random items rules.
What is the issue? Include screenshots / videos if possible!
In my game, “crate tickets” will be used to purchase crates that can be rolled for items. There are plenty of free ways to get crate tickets, but you can also purchase them with robux.
Currently, I haven’t added the purchasing crate tickets option yet. However, I plan to. When I do, I will make the UI to buy them not ever clone into the player if they have the restriction.
I know the concern is specific and a niche scenario, but couldn’t someone who is hacking try to inject a local script to prompt the purchase of the devproduct themselves? If so, how should I handle it on the server? If the user already spent robux, I can of course not give them the item, but then it still let the payment go through. Is there a way to actually turn off the ability to buy it for these users?
What solutions have you tried so far? Did you look for solutions on the Creator Hub?
I’ve read the article on paid random items to try and find a solution, but to no avail. I’m not really sure if this is even something to worry about or if it would instead be the players fault, but I can’t really be sure.
The important part here is that hiding the purchase UI is not a security measure. A client can potentially call MarketplaceService:PromptProductPurchase() themselves, so I would not rely on the UI restriction.
The server should always validate the player’s eligibility when processing the Developer Product receipt, and if the player is not allowed to receive paid random items, simply not grant the crate tickets/items.
However, that does not solve the main issue you mentioned: the purchase may already have been completed and the Robux spent before the server gets the receipt. As far as I know, there isn’t an API that lets developers disable a specific Developer Product purchase prompt for an individual player based on the Paid Random Items restriction.
So if the restriction needs to be enforced before the Robux transaction can happen, I think this is something Roblox would need to handle at the platform/Marketplace level rather than something that can be securely implemented with LocalScripts.
I would also avoid relying on a client-side if restricted then don't show the button check as the actual enforcement. It is fine for UX, but the server should still treat the player as restricted independently.
If Roblox does provide a server-side API specifically for preventing restricted users from purchasing a Developer Product, I’d be interested to know what the intended implementation is
Thanks for the response. So, if I prevent the ui from being cloned from a server script and make sure that, once purchased, the server side checks for policy restrictions on that player, granting it based on those restrictions?
I suppose simply blocking the purchase on the server would mean that I don’t have paid random items for that user, since they can’t actually pay to get a random item, but they could still hack to pay and get nothing which seems a bit strange.
One potential solution I thought of is making crate tickets not purchasable through robux at all, and instead only through converting tickets (another currency which I might rename to avoid confusion) to crate tickets. Then, it’s still possible to buy crate tickets with robux but not directly. This would also mean that I do have the power to block conversion of tickets to crate tickets for users who have this restriction.
I’d still like some feedback on this though. Would this be considered compliant?
A client-side restriction should be fine. If people are hacking or using VPNs to bypass the restriction, that puts their account (not your game) in the wrong.
That being said, roblox doesn’t moderate games or accounts which don’t respect the rule.
All roblox suggests is to “hide the UI as if it never existed”, they don’t go talking about how you should also go secure the server, too.
Any money spent to buy RNG elements in any way (ie robux > coins > tickets > crates or robux > tickets > crates) isn’t allowed.
For restricted areas, RNG elements must be completely free with zero options to buy them with robux.
Fair enough. Just to clarify, I meant the ticket route would be blocked for those with the restriction, just that it would allow my scripts to moderate whether or not they can even make the exchange in the first place.
Thanks for the response, by the way. I’ll spend some time to think on it for now.