As a Roblox developer, it is currently too hard to check if a player can be prompted a MarketplaceService purchase. Something like MarketplaceService:CanPrompt(plr) or even MarketplaceService.PromptGamePassPurchaseStarted would be very helpful.
If Roblox is able to address this issue, it would improve my development experience because:
Technically, I can store a variable when I initially prompt the player a purchase and then clear it when the PromptGamePassPurchaseFinished event is fired.
However, this doesn’t take into account that the player can simply prompt themselves a purchase via exploits and avoid this completely. I understand this is a niche use-case, but I have indeed come across a scenario where this could be extremely useful.
Per chance, is there a reason why this is problematic? I’d be under the assumption that an exploiter could also disable the firing of an event or spoof a function return to maintain behaviour; so it unfortunately doesn’t seem like it would truly solve that specific issue you’re having.
Perhaps there are also other, more common cases where a game-pass can’t be purchased, but if so, a specific event just for when game-passes are blocking the action doesn’t seem ideal; a more generalised event for when a player can/can’t prompt a purchase seems more ideal (alike your CanPrompt idea albeit with an event for when the return of the function would end up being changed). Also, if running these checks directly on the server isn’t needed; it could also just be a read-only property on MarketplaceService
To put it simply:
I’m working on a system a little similar to Pls Donate’s GamePass/Asset selling feature. However, there is an in-game incentive, and I need to “lock” the specific product from being purchased by two different players at once. This issue arises when the player prompts themselves an actual product from my game and then fires the remote to prompt themselves a GamePass distributed by a player in their server. The code to prompt and lock the player GamePass will still run, since Roblox has no way of checking if a player can be prompted something. The solution I’ve come up with is to create my own :CanPrompt() function inside of a module that caches everything being prompted to the player, but it is still completely bypassed if the player just fires the Marketplace prompt themselves via exploits.
I’m sorry to say this, but there are other vulnerabilities to be aware of in your use case, too. PromptGamePassPurchaseFinished can be fired at any point by an exploiter, even if the prompt is still visible on their screen, iirc. Even if we had a 100% safe function to detect when a game pass can be prompted, an exploiter could simply spoof dismissing your prompt to the server and then wait for another user to prompt it; making the purchase before or after the other user does; causing a double-sale. In this specific case, you could detect the exploiter vs. the real player, however, not for the alternative.
Alternatively, the exploiter could decide not to fire the finished event after cancelling the sale, essentially holding that specific purchaseable item away from being prompted elsewhere. This is not to mention the fact that a new event to detect when a prompt can be displayed would likely also have the same type of spoofing vulnerability, given that it would have to originate from the client. I’m honestly not personally sure of how this problem could be solved securely. This isn’t to say we shouldn’t have this feature but rather that this feature alone, unfortunately, probably wouldn’t entirely solve this particular use case.
