I'd like to clarify your finding. You stated in the steps to reproduce
1 - Purchase Auto Renewable Subscription without secret
I think you mean - purchase an Auto Renewable Subscription item, then on successful purchase validate the applicationReceipt without passing in the shared secret. This should result in status 21004 - which is expected.
The next step -
2 Purchase non Auto Renewable Subscription like Consumable
Which I think you mean - purchase a consumable (or any other item, but not an Auto Renewable Subscription item). Then attempt to validate the applicationReceipt without passing in the shared secret.
For the second case, I would expect status result 21004 - keep in mind, the applicationReceipt should now include in the in_app array, the Auto Renewable Subscription item, as well as the second item (which is not an Auto Renewable Subscription item). Anytime the applicationReceipt has even one Auto Renewable Subscription item in the in_app array, the shared-secret must be included for the receipt to be validated. Status 21004 correctly indicates that there is an Auto Renewable Subscription item in the applicationReceipt and the shared-secret is either incorrect or missing.
If however, the in_app array does not contain an Auto Renewable Subscription item, and status 21004 is returned - that would be a bug report issue. What happens if you inciude the shared-secret in the validation attempt?
rich kubota - rkubota@apple.com
developer technical support CoreOS/Hardware/MFI