disco_app 0.10.4

data/lib/generators/disco_app/templates/assets/javascripts/application.js

@@ -0,0 +1,17 @@
+// This is a manifest file that'll be compiled into application.js, which will include all the files
+// listed below.
+//
+// Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts,
+// or any plugin's vendor/assets/javascripts directory can be referenced here using a relative path.
+//
+// It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
+// compiled file.
+//
+// Read Sprockets README (https://github.com/rails/sprockets#sprockets-directives) for details
+// about supported directives.
+//
+//= require jquery
+//= require jquery_ujs
+//= require turbolinks
+//= require disco_app/disco_app
+//= require_tree .

data/lib/generators/disco_app/templates/assets/javascripts/components.js

@@ -0,0 +1,3 @@
+//= require react-server
+//= require disco_app/components
+//= require_tree ./components

data/lib/generators/disco_app/templates/assets/stylesheets/application.scss

@@ -0,0 +1,5 @@
+/*
+ * This is a manifest file that'll be compiled into application.css, which will include all the files
+ * listed below.
+ */
+@import "disco_app/disco_app";

data/lib/generators/disco_app/templates/config/database.yml.tt

@@ -0,0 +1,20 @@
+default: &default
+  adapter: postgresql
+  encoding: unicode
+  pool: 5
+  timeout: 5000
+ 
+development:
+  <<: *default
+  host: localhost
+  port: 5432
+  database: <%= Rails.application.class.parent_name.downcase %>
+ 
+test:
+  <<: *default
+  host: localhost
+  port: 5432
+  database: <%= Rails.application.class.parent_name.downcase %>_test
+ 
+production:
+  <<: *default

data/lib/generators/disco_app/templates/config/newrelic.yml

@@ -0,0 +1,26 @@
+# This file configures the New Relic Agent.
+#
+# For full documentation of agent configuration options, please refer to
+# https://docs.newrelic.com/docs/agents/ruby-agent/installation-configuration/ruby-agent-configuration
+
+common: &default_settings
+  license_key: <%= ENV['NEW_RELIC_LICENSE_KEY'] %>
+  app_name: <%= ENV['SHOPIFY_APP_NAME'] || 'Unknown App' %>
+
+  # To disable the agent regardless of other settings, uncomment the following:
+  # agent_enabled: false
+
+  # Logging level for log/newrelic_agent.log
+  log_level: info
+
+development:
+  <<: *default_settings
+  app_name: <%= ENV['SHOPIFY_APP_NAME'] || 'Unknown App' %> (Development)
+  developer_mode: true
+
+test:
+  <<: *default_settings
+  monitor_mode: false
+
+production:
+  <<: *default_settings

data/lib/generators/disco_app/templates/config/puma.rb

@@ -0,0 +1,15 @@
+workers Integer(ENV['WEB_CONCURRENCY'] || 2)
+threads_count = Integer(ENV['MAX_THREADS'] || 5)
+threads threads_count, threads_count
+
+preload_app!
+
+rackup      DefaultRackup
+port        ENV['PORT']     || 3000
+environment ENV['RACK_ENV'] || 'development'
+
+on_worker_boot do
+  # Worker specific setup for Rails 4.1+
+  # See: https://devcenter.heroku.com/articles/deploying-rails-applications-with-the-puma-web-server#on-worker-boot
+  ActiveRecord::Base.establish_connection
+end

data/lib/generators/disco_app/templates/controllers/home_controller.rb

@@ -0,0 +1,7 @@
+class HomeController < ApplicationController
+  include DiscoApp::Concerns::AuthenticatedController
+
+  def index
+  end
+
+end

data/lib/generators/disco_app/templates/initializers/disco_app.rb

@@ -0,0 +1,28 @@
+DiscoApp::Engine.routes.default_url_options[:host] = ENV['DEFAULT_HOST']
+
+DiscoApp.configure do |config|
+  # Required configuration.
+  config.app_name = ENV['SHOPIFY_APP_NAME']
+
+  # Set a list of webhook topics to listen for.
+  # See https://help.shopify.com/api/reference/webhook.
+  config.webhook_topics = []
+
+  # Set the below if using an application proxy.
+  config.app_proxy_prefix = ENV['SHOPIFY_APP_PROXY_PREFIX']
+
+  # Set the below if providing a carrier service endpoint.
+  # Note that if using a URL helper to set the endpoint, we use a lambda
+  # function to ensure that the URL helper is only evaluated when we need it.
+  # config.carrier_service_callback_url = -> { Rails.application.routes.url_helpers.carrier_service_callback_url }
+
+  # Set the below to create real Shopify charges.
+  config.real_charges = ENV['SHOPIFY_REAL_CHARGES'] === 'true'
+
+  # Optional configuration. These flags are only respected in the development
+  # environment and will have no effect in production.
+  config.skip_proxy_verification = ENV['SKIP_PROXY_VERIFICATION'] == 'true'
+  config.skip_webhook_verification = ENV['SKIP_WEBHOOK_VERIFICATION'] == 'true'
+  config.skip_carrier_request_verification = ENV['SKIP_CARRIER_REQUEST_VERIFICATION'] == 'true'
+  config.skip_oauth = ENV['SKIP_OAUTH'] == 'true'
+end

data/lib/generators/disco_app/templates/initializers/rollbar.rb

@@ -0,0 +1,19 @@
+Rollbar.configure do |config|
+  # Fetch the access token from the environment.
+  config.access_token = ENV['ROLLBAR_ACCESS_TOKEN']
+
+  # Only use Rollbar in production when there's a token configured.
+  unless config.access_token and Rails.env.production?
+    config.enabled = false
+  end
+
+  # Enable delayed reporting (using Sidekiq)
+  config.use_sidekiq
+
+  # Add custom handlers.
+  config.before_process << proc do |options|
+    if options[:exception].is_a?(ActiveResource::ClientError) and options[:exception].message.include?('Too Many Requests')
+      raise Rollbar::Ignore
+    end
+  end
+end

data/lib/generators/disco_app/templates/initializers/session_store.rb

@@ -0,0 +1,2 @@
+# Use an ActiveRecord-based session store.
+Rails.application.config.session_store :active_record_store, :key => '_disco_app_session'

data/lib/generators/disco_app/templates/initializers/shopify_app.rb

@@ -0,0 +1,7 @@
+ShopifyApp.configure do |config|
+  config.api_key = ENV['SHOPIFY_APP_API_KEY']
+  config.secret = ENV['SHOPIFY_APP_SECRET']
+  config.redirect_uri = ENV['SHOPIFY_APP_REDIRECT_URI']
+  config.scope = ENV['SHOPIFY_APP_SCOPE']
+  config.embedded_app = true
+end

data/lib/generators/disco_app/templates/initializers/shopify_session_repository.rb

@@ -0,0 +1,7 @@
+if Rails.configuration.cache_classes
+  ShopifyApp::SessionRepository.storage = DiscoApp::SessionStorage
+else
+  ActionDispatch::Reloader.to_prepare do
+    ShopifyApp::SessionRepository.storage = DiscoApp::SessionStorage
+  end
+end

data/lib/generators/disco_app/templates/root/CHECKS

@@ -0,0 +1,4 @@
+WAIT=5
+ATTEMPTS=6
+/login
+

data/lib/generators/disco_app/templates/root/Procfile

@@ -0,0 +1,2 @@
+web: bundle exec puma -C ./config/puma.rb
+worker: bundle exec sidekiq -c 5 -v -q default -q mailers -q rollbar

data/lib/generators/disco_app/templates/views/home/index.html.erb

@@ -0,0 +1,2 @@
+<% provide(:title, 'Welcome') %>
+<h1>Welcome</h1>

data/lib/tasks/carrier_service.rake

@@ -0,0 +1,10 @@
+namespace :carrier_service do
+
+  desc 'Synchronise carrier service across all installed shops.'
+  task sync: :environment do
+    DiscoApp::Shop.installed.has_active_shopify_plan.each do |shop|
+      DiscoApp::SynchroniseCarrierServiceJob.perform_later(shop)
+    end
+  end
+
+end

data/lib/tasks/database.rake

@@ -0,0 +1,8 @@
+namespace :database do
+  desc "update postgres sequence numbers in case database has been migrated"
+  task update_sequences: :environment do
+    ActiveRecord::Base.connection.tables.each do |t|
+      ActiveRecord::Base.connection.reset_pk_sequence!(t)
+    end
+  end
+end

data/lib/tasks/sessions.rake

@@ -0,0 +1,9 @@
+namespace :sessions do
+
+  desc 'Clean out any stale sessions.'
+  task clean: [:environment, 'db:load_config'] do
+    threshold = (ENV['SESSIONS_CLEAN_THRESHOLD_DAYS'] || 30).to_i.days.ago
+    ActiveRecord::Base.connection.execute("DELETE FROM #{ActiveRecord::SessionStore::Session.table_name} WHERE updated_at < '#{threshold}'")
+  end
+
+end

data/lib/tasks/shops.rake

@@ -0,0 +1,10 @@
+namespace :shops do
+
+  desc 'Synchronise shop data across all installed shops.'
+  task sync: :environment do
+    DiscoApp::Shop.installed.has_active_shopify_plan.each do |shop|
+      DiscoApp::ShopUpdateJob.perform_later(shop)
+    end
+  end
+
+end

data/lib/tasks/start.rake

@@ -0,0 +1,3 @@
+task start: :environment do
+  system 'bundle exec rails server -b 127.0.0.1 -p 3000'
+end

data/lib/tasks/webhooks.rake

@@ -0,0 +1,10 @@
+namespace :webhooks do
+
+  desc 'Synchronise webhooks across all installed shops.'
+  task sync: :environment do
+    DiscoApp::Shop.installed.has_active_shopify_plan.each do |shop|
+      DiscoApp::SynchroniseWebhooksJob.perform_later(shop)
+    end
+  end
+
+end

data/test/controllers/disco_app/admin/shops_controller_test.rb

@@ -0,0 +1,54 @@
+require 'test_helper'
+
+class DiscoApp::Admin::ShopsControllerTest < ActionController::TestCase
+  include ActiveJob::TestHelper
+
+  def setup
+    ENV['ADMIN_APP_USERNAME'] = 'admin_app_username'
+    ENV['ADMIN_APP_PASSWORD'] = 'admin_app_password'
+    @routes = DiscoApp::Engine.routes
+  end
+
+  def teardown
+    ENV['ADMIN_APP_USERNAME'] = nil
+    ENV['ADMIN_APP_PASSWORD'] = nil
+  end
+
+  test 'can not access shops list without authorization' do
+    get(:index)
+    assert_response :unauthorized
+  end
+
+  test 'can not access shops list with incorrect username/password' do
+    authenticate('fakeuser', 'blah blah')
+    get(:index)
+    assert_response :unauthorized
+  end
+
+  test 'can not access shops list with blank username/password' do
+    authenticate('', '')
+    get(:index)
+    assert_response :unauthorized
+  end
+
+  test 'can not access shops list with blank username/password when env variables are blank' do
+    ENV['ADMIN_APP_USERNAME'] = ''
+    ENV['ADMIN_APP_PASSWORD'] = ''
+    authenticate('', '')
+    get(:index)
+    assert_response :unauthorized
+  end
+
+  test 'can access shops list with correct username/password' do
+    authenticate('admin_app_username', 'admin_app_password')
+    get(:index)
+    assert_response :ok
+  end
+
+  private
+
+    def authenticate(username, password)
+      request.env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials(username, password)
+    end
+
+end

data/test/controllers/disco_app/charges_controller_test.rb

@@ -0,0 +1,99 @@
+require 'test_helper'
+
+class DiscoApp::ChargesControllerTest < ActionController::TestCase
+  include ActiveJob::TestHelper
+  include DiscoApp::Test::ShopifyAPI
+
+  def setup
+    @shop = disco_app_shops(:widget_store)
+    @current_subscription = disco_app_subscriptions(:current_widget_store_subscription)
+    @new_charge = disco_app_recurring_application_charges(:new_widget_store_subscription_recurring_charge)
+    @routes = DiscoApp::Engine.routes
+    log_in_as(@shop)
+    @shop.installed!
+  end
+
+  def teardown
+    @shop = nil
+    @current_subscription = nil
+    WebMock.reset!
+  end
+
+  test 'non-logged in user is redirected to the login page' do
+    log_out
+    get(:new, subscription_id: @current_subscription)
+    assert_redirected_to ShopifyApp::Engine.routes.url_helpers.login_path
+  end
+
+  test 'logged-in, never installed user is redirected to the install page' do
+    @shop.never_installed!
+    get(:new, subscription_id: @current_subscription)
+    assert_redirected_to DiscoApp::Engine.routes.url_helpers.install_path
+  end
+
+  test 'user with paid-for current subscription can not access page' do
+    get(:new, subscription_id: @current_subscription)
+    assert_redirected_to Rails.application.routes.url_helpers.root_path
+  end
+
+  test 'user with unpaid current subscription can access page' do
+    @current_subscription.active_charge.destroy
+    get(:new, subscription_id: @current_subscription)
+    assert_response :ok
+  end
+
+  test 'user with unpaid current subscription can create new charge and is redirected to confirmation url' do
+    res = { "recurring_application_charge": { "name": "Basic",
+                    "price": "9.99",
+                    "trial_days": 14,
+                    "return_url": /^https:\/\/test\.example\.com\/subscriptions\/304261385\/charges\/53297050(1|2)\/activate$/,
+                    "test": true 
+      } }
+    stub_request(:post, "#{@shop.admin_url}/recurring_application_charges.json")
+      .with(body: res
+    ).to_return(status: 201, body:api_fixture("widget_store/charges/create_second_recurring_application_charge_response").to_json)
+
+    @current_subscription.active_charge.destroy
+    post(:create, subscription_id: @current_subscription)
+    assert_redirected_to 'https://apple.myshopify.com/admin/charges/654381179/confirm_recurring_application_charge?signature=BAhpBHsQASc%3D--b2e90c6e4e94fbae15a464c566a31a1c23e6bffa'
+  end
+
+  test 'user trying to activate charge for invalid gets not found and hence 404' do
+    assert_raises ActiveRecord::RecordNotFound do
+      get(:activate, subscription_id: '123', id: '456', charge_id: '789')
+    end
+  end
+
+  test 'user trying to activate invalid charge for valid subscription gets redirected to new charge page for that subscription' do
+    @current_subscription.active_charge.destroy
+    get(:activate, subscription_id: @current_subscription, id: '456', charge_id: '789')
+    assert_redirected_to DiscoApp::Engine.routes.url_helpers.new_subscription_charge_path(@current_subscription)
+  end
+
+  test 'user trying to activate pending charge is redirected back to new charge page' do
+    stub_api_request(:get, "#{@shop.admin_url}/recurring_application_charges/654381179.json", 'widget_store/charges/get_pending_recurring_application_charge')
+
+    @current_subscription.active_charge.destroy
+    get(:activate, subscription_id: @current_subscription, id: @new_charge.id, charge_id: @new_charge.shopify_id)
+    assert_redirected_to DiscoApp::Engine.routes.url_helpers.new_subscription_charge_path(@current_subscription)
+  end
+
+  test 'user trying to activate declined charge is redirected back to new charge page' do
+    stub_api_request(:get, "#{@shop.admin_url}/recurring_application_charges/654381179.json", 'widget_store/charges/get_declined_recurring_application_charge')
+
+    @current_subscription.active_charge.destroy
+    get(:activate, subscription_id: @current_subscription, id: @new_charge.id, charge_id: @new_charge.shopify_id)
+    assert_redirected_to DiscoApp::Engine.routes.url_helpers.new_subscription_charge_path(@current_subscription)
+  end
+
+  test 'user trying to activate accepted charge succeeds and is redirected to the root page' do
+    stub_api_request(:get, "#{@shop.admin_url}/recurring_application_charges/654381179.json", 'widget_store/charges/get_accepted_recurring_application_charge')
+    stub_api_request(:post, "#{@shop.admin_url}/recurring_application_charges/654381179/activate.json", 'widget_store/charges/activate_recurring_application_charge')
+
+    @current_subscription.active_charge.destroy
+    get(:activate, subscription_id: @current_subscription, id: @new_charge.id, charge_id: @new_charge.shopify_id)
+    assert_equal @new_charge, @current_subscription.active_charge
+    assert_redirected_to Rails.application.routes.url_helpers.root_path
+  end
+
+end

data/test/controllers/disco_app/install_controller_test.rb

@@ -0,0 +1,50 @@
+require 'test_helper'
+
+class DiscoApp::InstallControllerTest < ActionController::TestCase
+  include ActiveJob::TestHelper
+
+  def setup
+    @shop = disco_app_shops(:widget_store)
+    @routes = DiscoApp::Engine.routes
+    log_in_as(@shop)
+  end
+
+  def teardown
+    @shop = nil
+  end
+
+  test 'logged-in but uninstalled user triggers installation from install page' do
+    get(:install)
+    assert_redirected_to :installing
+    assert_enqueued_jobs 1
+    @shop.reload
+    assert @shop.awaiting_install?
+  end
+
+  test 'logged-in and installed user is redirected to installing url for install/uninstalling actions' do
+    @shop.installed!
+    [:install, :uninstalling].each do |action|
+      get(:install)
+      assert_redirected_to :installing
+    end
+  end
+
+  test 'logged-in and installed user is redirected to root url for installing' do
+    @shop.installed!
+    get(:installing)
+    assert_redirected_to Rails.application.routes.url_helpers.root_path
+  end
+
+  test 'logged-in and uninstalling user sees uninstalling page' do
+    @shop.uninstalling!
+    get(:uninstalling)
+    assert_response :success
+  end
+
+  test 'logged-in and uninstalled user starts install process again' do
+    @shop.uninstalled!
+    get(:uninstalling)
+    assert_redirected_to :install
+  end
+
+end

data/test/controllers/disco_app/subscriptions_controller_test.rb

@@ -0,0 +1,68 @@
+require 'test_helper'
+
+class DiscoApp::SubscriptionsControllerTest < ActionController::TestCase
+  include ActiveJob::TestHelper
+
+  def setup
+    @shop = disco_app_shops(:widget_store)
+    @current_subscription = disco_app_subscriptions(:current_widget_store_subscription)
+    @routes = DiscoApp::Engine.routes
+    log_in_as(@shop)
+    @shop.installed!
+  end
+
+  def teardown
+    @shop = nil
+  end
+
+  test 'non-logged in user is redirected to the login page' do
+    log_out
+    get(:new)
+    assert_redirected_to ShopifyApp::Engine.routes.url_helpers.login_path
+  end
+
+  test 'logged-in, never installed user is redirected to the install page' do
+    @shop.never_installed!
+    get(:new)
+    assert_redirected_to DiscoApp::Engine.routes.url_helpers.install_path
+  end
+
+  test 'logged-in, installed user with no current subscription can access page' do
+    @current_subscription.destroy
+    get(:new)
+    assert_response :ok
+  end
+
+  test 'logged-in, installed user with current subscription can access page' do
+    get(:new)
+    assert_response :ok
+  end
+
+  test 'logged-in, installed user with current subscription can create new subscription' do
+    post(:create, subscription: { plan: disco_app_plans(:premium) })
+    assert_redirected_to Rails.application.routes.url_helpers.root_path
+    assert_equal disco_app_plans(:premium), @shop.current_plan
+  end
+
+  test 'logged-in, installed user with no subscription can create new subscription for available plan' do
+    @current_subscription.destroy
+    post(:create, subscription: { plan: disco_app_plans(:premium) })
+    assert_redirected_to Rails.application.routes.url_helpers.root_path
+    assert_equal disco_app_plans(:premium), @shop.current_plan
+  end
+
+  test 'logged-in, installed user with current subscription can not create new subscription for unavailable plan' do
+    post(:create, subscription: { plan: disco_app_plans(:cheapo) })
+    assert_redirected_to DiscoApp::Engine.routes.url_helpers.new_subscription_path
+    assert_equal @current_subscription, @shop.current_subscription
+  end
+
+  test 'logged-in, installed user with current subscription can create new subscription with valid cookied plan code' do
+    @request.cookies[DiscoApp::CODE_COOKIE_KEY] = 'PODCAST'
+    post(:create, subscription: { plan: disco_app_plans(:premium) })
+    assert_redirected_to Rails.application.routes.url_helpers.root_path
+    assert_equal disco_app_plans(:premium), @shop.current_plan
+    assert_equal 8999, @shop.current_subscription.amount
+  end
+
+end

data/test/controllers/disco_app/webhooks_controller_test.rb

@@ -0,0 +1,58 @@
+require 'test_helper'
+
+class DiscoApp::WebhooksControllerTest < ActionController::TestCase
+  include ActiveJob::TestHelper
+
+  def setup
+    @shop = disco_app_shops(:widget_store)
+    @routes = DiscoApp::Engine.routes
+  end
+
+  def teardown
+    @shop = nil
+  end
+
+  test 'webhook request without authentication information returns unauthorized' do
+    body = webhook_fixture('app_uninstalled')
+    post(:process_webhook, body)
+    assert_response :unauthorized
+  end
+
+  test 'webhook request with no HMAC returns unauthorized' do
+    body = webhook_fixture('app_uninstalled')
+    @request.headers['HTTP_X_SHOPIFY_TOPIC'] = :'app/uninstalled'
+    @request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN'] = @shop.shopify_domain
+    post(:process_webhook, body)
+    assert_response :unauthorized
+  end
+
+  test 'webhook request with invalid HMAC returns unauthorized' do
+    body = webhook_fixture('app_uninstalled')
+    @request.headers['HTTP_X_SHOPIFY_TOPIC'] = :'app/uninstalled'
+    @request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN'] = @shop.shopify_domain
+    @request.headers['HTTP_X_SHOPIFY_HMAC_SHA256'] = '0000'
+    post(:process_webhook, body)
+    assert_response :unauthorized
+  end
+
+  test 'webhook request with valid HMAC returns OK' do
+    body = webhook_fixture('app_uninstalled')
+    @request.headers['HTTP_X_SHOPIFY_TOPIC'] = :'app/uninstalled'
+    @request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN'] = @shop.shopify_domain
+    @request.headers['HTTP_X_SHOPIFY_HMAC_SHA256'] = DiscoApp::WebhookService.calculated_hmac(body, ShopifyApp.configuration.secret)
+    post(:process_webhook, body)
+    assert_response :ok
+  end
+
+  test 'app uninstalled job queued when app/uninstalled webhook arrives' do
+    body = webhook_fixture('app_uninstalled')
+    @request.headers['HTTP_X_SHOPIFY_TOPIC'] = :'app/uninstalled'
+    @request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN'] = @shop.shopify_domain
+    @request.headers['HTTP_X_SHOPIFY_HMAC_SHA256'] = DiscoApp::WebhookService.calculated_hmac(body, ShopifyApp.configuration.secret)
+
+    assert_enqueued_with(job: DiscoApp::AppUninstalledJob) do
+      post(:process_webhook, body)
+    end
+  end
+
+end