disco_app 0.14.4 → 0.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 201255aa9e92f2967fb8583ad43e2d13b4aea475d0222337d8956bf14df70841
-  data.tar.gz: ab97fc9e8f149f70baaaa35addb08ea96f3dea8f203789fd04bd585b0f4f8557
+  metadata.gz: 3670b5ea98be3f2a8e647127ed8e626c662f73be43ee8ad4b9bd9568aa66e692
+  data.tar.gz: 671d21dacbe00712492025c7e00bb93ec155e467ad42cec53af52a95844471ea
 SHA512:
-  metadata.gz: 6d7ccecfce96e4bac63df8153c9ef0931c34a8d6387fa77bc3a734669a44639ef76634527f0d74d8f0ae2ffd516aeb7b6a84e59fdf98c14eaaae1a86145baaa8
-  data.tar.gz: 98a2e1d47d2fc19bb798a5579eac1f98b75ecdfcf645039dafe8cc5bb3dd39ee1845b780215fca0855d66fc9dbf429dede6f87ad962d3006c293941f3fec3562
+  metadata.gz: c2afb706e6acc5fc7db22d19820da1e7f2776f8e73e77a647583666be0628796018632c7d733b6e74dd7758823f940f5d4a773ad7992f1536dd632f2dbc9a910
+  data.tar.gz: 24cc7017987d849d378acaae7720bbd8c3efdb4a442d5a4a29cdf604ab0278e396978a44dbabe36bc4d0e953c28f5e5881f63dab9da9f8f5cf3ad6c20b7bbae1

data/Rakefile

@@ -14,14 +14,11 @@ RDoc::Task.new(:rdoc) do |rdoc|
   rdoc.rdoc_files.include('lib/**/*.rb')
 end
 
-APP_RAKEFILE = File.expand_path("../test/dummy/Rakefile", __FILE__)
+APP_RAKEFILE = File.expand_path('test/dummy/Rakefile', __dir__)
 load 'rails/tasks/engine.rake'
 
-
 load 'rails/tasks/statistics.rake'
 
-
-
 Bundler::GemHelper.install_tasks
 
 require 'rake/testtask'
@@ -33,5 +30,4 @@ Rake::TestTask.new(:test) do |t|
   t.verbose = false
 end
 
-
 task default: :test

data/app/clients/disco_app/api_client.rb

@@ -2,7 +2,7 @@ require 'rest-client'
 
 class DiscoApp::ApiClient
 
-  SUBSCRIPTION_ENDPOINT = 'app_subscriptions.json'
+  SUBSCRIPTION_ENDPOINT = 'app_subscriptions.json'.freeze
 
   def initialize(shop, url)
     @shop = shop
@@ -10,17 +10,18 @@ class DiscoApp::ApiClient
   end
 
   def create_app_subscription
-    return unless @url.present?
+    return if @url.blank?
+
     url = @url + SUBSCRIPTION_ENDPOINT
     begin
-      response = RestClient::Request.execute(
+      RestClient::Request.execute(
         method: :post,
         headers: { content_type: :json },
         url: url,
         payload: { shop: @shop, subscription: @shop.current_subscription }.to_json
       )
     rescue RestClient::BadRequest, RestClient::ResourceNotFound => e
-      raise DiscoApiError.new(e.message)
+      raise DiscoApiError, e.message
     end
   end
 

data/app/clients/disco_app/graphql_client.rb

@@ -0,0 +1,85 @@
+require 'rest-client'
+
+##
+# This file defines a very simple GraphQL API client to support a single type
+# of GraphQL API call for a Shopify store - sending a Shopify Flow trigger.
+#
+# We use this simple approach rather than using an existing GraphQL client
+# library such as https://github.com/github/graphql-client (either standalone
+# or as bundled with the Shopify API gem) for a couple of reasons:
+#
+#   - These libraries tend to presume that a single client instance is
+#     instantiated once and then reused across the application, which isn't the
+#     case when we're making API calls once per trigger for each background
+#     job.
+#   - These libraries make an API call to fetch the Shopify GraphQL schema on
+#     initialisation. The schema is very large, so the API call takes a number
+#     of seconds to complete and when parsed consumes a large amount of memory.
+#   - These libraries do not natively work well with the idea of a dynamic API
+#     endpoint (ie, changing the request URL frequently), which is required
+#     when making many requests to different Shopify stores.
+#
+module DiscoApp
+  class GraphqlClient
+
+    def initialize(shop)
+      @shop = shop
+    end
+
+    ##
+    # Fire a Shopify Flow Trigger.
+    # Returns a tuple {Boolean, Array} representing {success, errors}.
+    def create_flow_trigger(title, resource_name, resource_url, properties)
+      body = {
+        trigger_title: title,
+        resources: [
+          {
+            name: resource_name,
+            url: resource_url
+          }
+        ],
+        properties: properties
+      }
+
+      # The double .to_json.to_json below looks odd but is required to properly escape the JSON hash
+      # when inserting it into the GraphQL mutation call.
+      response = execute(%(
+        mutation {
+          flowTriggerReceive(body: #{body.to_json.to_json}) {
+            userErrors {
+              field,
+              message
+            }
+          }
+        }
+      ))
+
+      errors = response.dig(:data, :flowTriggerReceive, :userErrors)
+      [errors.empty?, errors]
+    end
+
+    private
+
+      def execute(query)
+        response = RestClient::Request.execute(
+          method: :post,
+          headers: headers,
+          url: url,
+          payload: { query: query }.to_json
+        )
+        JSON.parse(response.body).with_indifferent_access
+      end
+
+      def headers
+        {
+          'Content-Type' => 'application/json',
+          'X-Shopify-Access-Token' => @shop.shopify_token
+        }
+      end
+
+      def url
+        "https://#{@shop.shopify_domain}/admin/api/graphql.json"
+      end
+
+  end
+end

data/app/controllers/disco_app/admin/app_settings_controller.rb

@@ -1,3 +1,5 @@
 class DiscoApp::Admin::AppSettingsController < DiscoApp::Admin::ApplicationController
+
   include DiscoApp::Admin::Concerns::AppSettingsController
+
 end

data/app/controllers/disco_app/admin/application_controller.rb

@@ -1,4 +1,5 @@
 class DiscoApp::Admin::ApplicationController < ActionController::Base
+
   include DiscoApp::Admin::Concerns::AuthenticatedController
 
   private

data/app/controllers/disco_app/admin/concerns/app_settings_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Admin::Concerns::AppSettingsController
+
   extend ActiveSupport::Concern
 
   def edit
@@ -7,7 +8,7 @@ module DiscoApp::Admin::Concerns::AppSettingsController
 
   def update
     @app_settings = DiscoApp::AppSettings.instance
-    if @app_settings.update_attributes(app_settings_params)
+    if @app_settings.update(app_settings_params)
       flash[:success] = 'Settings updated.'
       redirect_to edit_admin_app_settings_path
     else

data/app/controllers/disco_app/admin/concerns/authenticated_controller.rb

@@ -1,19 +1,21 @@
 module DiscoApp::Admin::Concerns::AuthenticatedController
+
   extend ActiveSupport::Concern
 
   included do
-
     protect_from_forgery with: :exception
     before_action :authenticate_administrator
     layout 'admin'
-
   end
 
   private
 
     def authenticate_administrator
       authenticate_or_request_with_http_basic do |username, password|
-        (not username.blank?) && (not password.blank?) && username == ENV['ADMIN_APP_USERNAME'] && password == ENV['ADMIN_APP_PASSWORD']
+        username.present? &&
+          password.present? &&
+          username == ENV['ADMIN_APP_USERNAME'] &&
+          password == ENV['ADMIN_APP_PASSWORD']
       end
     end
 

data/app/controllers/disco_app/admin/concerns/plans_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Admin::Concerns::PlansController
+
   extend ActiveSupport::Concern
 
   included do
@@ -26,7 +27,7 @@ module DiscoApp::Admin::Concerns::PlansController
   end
 
   def update
-    if @plan.update_attributes(plan_params)
+    if @plan.update(plan_params)
       redirect_to edit_admin_plan_path(@plan)
     else
       render 'edit'
@@ -47,7 +48,7 @@ module DiscoApp::Admin::Concerns::PlansController
     def plan_params
       params.require(:plan).permit(
         :name, :status, :plan_type, :trial_period_days, :amount,
-        :plan_codes_attributes => [:id, :_destroy, :code, :trial_period_days, :amount]
+        plan_codes_attributes: %i[id _destroy code trial_period_days amount]
       )
     end
 

data/app/controllers/disco_app/admin/concerns/shops_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Admin::Concerns::ShopsController
+
   extend ActiveSupport::Concern
 
   def index

data/app/controllers/disco_app/admin/concerns/sources_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Admin::Concerns::SourcesController
+
   extend ActiveSupport::Concern
 
   included do
@@ -26,7 +27,7 @@ module DiscoApp::Admin::Concerns::SourcesController
   end
 
   def update
-    if @source.update_attributes(source_params)
+    if @source.update(source_params)
       redirect_to edit_admin_plan_path(@source)
     else
       render 'edit'

data/app/controllers/disco_app/admin/concerns/subscriptions_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Admin::Concerns::SubscriptionsController
+
   extend ActiveSupport::Concern
 
   included do
@@ -9,7 +10,7 @@ module DiscoApp::Admin::Concerns::SubscriptionsController
   end
 
   def update
-    if @subscription.update_attributes(subscription_params)
+    if @subscription.update(subscription_params)
       redirect_to edit_admin_shop_subscription_path(@subscription.shop, @subscription)
     else
       render 'edit'
@@ -19,7 +20,7 @@ module DiscoApp::Admin::Concerns::SubscriptionsController
   private
 
     def find_subscription
-      @subscription = DiscoApp::Subscription.find_by_id(params[:id])
+      @subscription = DiscoApp::Subscription.find_by(id: params[:id])
     end
 
     def subscription_params

data/app/controllers/disco_app/admin/plans_controller.rb

@@ -1,3 +1,5 @@
 class DiscoApp::Admin::PlansController < DiscoApp::Admin::ApplicationController
+
   include DiscoApp::Admin::Concerns::PlansController
+
 end

data/app/controllers/disco_app/admin/resources/shops_controller.rb

@@ -1,3 +1,5 @@
 class DiscoApp::Admin::Resources::ShopsController < JSONAPI::ResourceController
+
   include DiscoApp::Admin::Concerns::AuthenticatedController
+
 end

data/app/controllers/disco_app/admin/shops_controller.rb

@@ -1,3 +1,5 @@
 class DiscoApp::Admin::ShopsController < DiscoApp::Admin::ApplicationController
+
   include DiscoApp::Admin::Concerns::ShopsController
+
 end

data/app/controllers/disco_app/admin/sources_controller.rb

@@ -1,3 +1,5 @@
 class DiscoApp::Admin::SourcesController < DiscoApp::Admin::ApplicationController
+
   include DiscoApp::Admin::Concerns::SourcesController
+
 end

data/app/controllers/disco_app/admin/subscriptions_controller.rb

@@ -1,3 +1,5 @@
 class DiscoApp::Admin::SubscriptionsController < DiscoApp::Admin::ApplicationController
+
   include DiscoApp::Admin::Concerns::SubscriptionsController
+
 end

data/app/controllers/disco_app/charges_controller.rb

@@ -1,4 +1,5 @@
 class DiscoApp::ChargesController < ApplicationController
+
   include DiscoApp::Concerns::AuthenticatedController
 
   skip_before_action :check_active_charge
@@ -13,7 +14,7 @@ class DiscoApp::ChargesController < ApplicationController
   # subscription. If successful, redirect to the (external) charge confirmation
   # URL. If it fails, redirect back to the new charge page.
   def create
-    if(charge = DiscoApp::ChargesService.create(@shop, @subscription)).nil?
+    if (charge = DiscoApp::ChargesService.create(@shop, @subscription)).nil?
       redirect_to action: :new
     else
       redirect_to charge.confirmation_url
@@ -25,8 +26,8 @@ class DiscoApp::ChargesController < ApplicationController
   # charge wasn't accepted, the flow will start again.
   def activate
     # First attempt to find a matching charge.
-    if(charge = @subscription.charges.find_by(id: params[:id], shopify_id: params[:charge_id])).nil?
-      redirect_to action: :new and return
+    if (charge = @subscription.charges.find_by(id: params[:id], shopify_id: params[:charge_id])).nil?
+      redirect_to(action: :new) && return
     end
     if DiscoApp::ChargesService.activate(@shop, charge)
       redirect_to main_app.root_url
@@ -38,10 +39,8 @@ class DiscoApp::ChargesController < ApplicationController
   private
 
     def find_subscription
-      @subscription = @shop.subscriptions.find_by_id!(params[:subscription_id])
-      unless @subscription.requires_active_charge? and not @subscription.active_charge?
-        redirect_to main_app.root_url
-      end
+      @subscription = @shop.subscriptions.find_by!(id: params[:subscription_id])
+      redirect_to main_app.root_url unless @subscription.requires_active_charge? && !@subscription.active_charge?
     end
 
 end

data/app/controllers/disco_app/concerns/app_proxy_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Concerns::AppProxyController
+
   extend ActiveSupport::Concern
 
   included do
@@ -6,7 +7,7 @@ module DiscoApp::Concerns::AppProxyController
     before_action :shopify_shop
     after_action :add_liquid_header
 
-    rescue_from ActiveRecord::RecordNotFound do |exception|
+    rescue_from ActiveRecord::RecordNotFound do |_exception|
       render_error 404
     end
   end
@@ -14,18 +15,17 @@ module DiscoApp::Concerns::AppProxyController
   private
 
     def verify_proxy_signature
-      unless proxy_signature_is_valid?
-        head :unauthorized
-      end
+      head :unauthorized unless proxy_signature_is_valid?
     end
 
     def proxy_signature_is_valid?
-      return true if (Rails.env.development? || Rails.env.test?) and DiscoApp.configuration.skip_proxy_verification?
+      return true if (Rails.env.development? || Rails.env.test?) && DiscoApp.configuration.skip_proxy_verification?
+
       DiscoApp::ProxyService.proxy_signature_is_valid?(request.query_string, ShopifyApp.configuration.secret)
     end
 
     def shopify_shop
-      @shop = DiscoApp::Shop.find_by_shopify_domain!(params[:shop])
+      @shop = DiscoApp::Shop.find_by!(shopify_domain: params[:shop])
     end
 
     def add_liquid_header

data/app/controllers/disco_app/concerns/authenticated_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Concerns::AuthenticatedController
+
   extend ActiveSupport::Concern
   include ShopifyApp::LoginProtection
 
@@ -17,12 +18,13 @@ module DiscoApp::Concerns::AuthenticatedController
   private
 
     def auto_login
-      if shop_session.nil? and request_hmac_valid?
-        if(shop =  DiscoApp::Shop.find_by_shopify_domain(sanitized_shop_name)).present?
-          session[:shopify] = shop.id
-          session[:shopify_domain] = sanitized_shop_name
-        end
-      end
+      return unless shop_session.nil? && request_hmac_valid?
+
+      shop = DiscoApp::Shop.find_by(shopify_domain: sanitized_shop_name)
+      return if shop.blank?
+
+      session[:shopify] = shop.id
+      session[:shopify_domain] = sanitized_shop_name
     end
 
     def shopify_shop
@@ -34,35 +36,32 @@ module DiscoApp::Concerns::AuthenticatedController
     end
 
     def check_installed
-      if @shop.awaiting_install? or @shop.installing?
+      if @shop.awaiting_install? || @shop.installing?
         redirect_if_not_current_path disco_app.installing_path
         return
       end
-      if @shop.awaiting_uninstall? or @shop.uninstalling?
+      if @shop.awaiting_uninstall? || @shop.uninstalling?
         redirect_if_not_current_path disco_app.uninstalling_path
         return
       end
-      unless @shop.installed?
-        redirect_if_not_current_path disco_app.install_path
-      end
+      redirect_if_not_current_path disco_app.install_path unless @shop.installed?
     end
 
     def check_current_subscription
-      unless @shop.current_subscription?
-        redirect_if_not_current_path disco_app.new_subscription_path
-      end
+      redirect_if_not_current_path disco_app.new_subscription_path unless @shop.current_subscription?
     end
 
     def check_active_charge
-      if @shop.current_subscription? and @shop.current_subscription.requires_active_charge? and not @shop.development? and not @shop.current_subscription.active_charge?
-        redirect_if_not_current_path disco_app.new_subscription_charge_path(@shop.current_subscription)
-      end
+      return unless @shop.current_subscription?
+      return unless @shop.current_subscription.requires_active_charge?
+      return if @shop.development?
+      return if @shop.current_subscription.active_charge?
+
+      redirect_if_not_current_path disco_app.new_subscription_charge_path(@shop.current_subscription)
     end
 
     def redirect_if_not_current_path(target)
-      if request.path != target
-        redirect_to target
-      end
+      redirect_to target if request.path != target
     end
 
     def request_hmac_valid?
@@ -70,11 +69,11 @@ module DiscoApp::Concerns::AuthenticatedController
     end
 
     def check_shop_whitelist
-      if shop_session
-        if ENV['WHITELISTED_DOMAINS'].present? && !ENV['WHITELISTED_DOMAINS'].include?(shop_session.url)
-          redirect_to_login
-        end
-      end
+      return unless shop_session
+      return if ENV['WHITELISTED_DOMAINS'].blank?
+      return if ENV['WHITELISTED_DOMAINS'].include?(shop_session.url)
+
+      redirect_to_login
     end
 
 end

data/app/controllers/disco_app/concerns/carrier_request_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Concerns::CarrierRequestController
+
   extend ActiveSupport::Concern
 
   included do
@@ -10,26 +11,36 @@ module DiscoApp::Concerns::CarrierRequestController
   private
 
     def verify_carrier_request
-      unless carrier_request_signature_is_valid?
-        head :unauthorized
-      end
+      head :unauthorized unless carrier_request_signature_is_valid?
     end
 
     def carrier_request_signature_is_valid?
-      return true if Rails.env.development? and DiscoApp.configuration.skip_carrier_request_verification?
-      DiscoApp::CarrierRequestService.is_valid_hmac?(request.body.read.to_s, ShopifyApp.configuration.secret, request.headers['HTTP_X_SHOPIFY_HMAC_SHA256'])
+      return true if Rails.env.development? && DiscoApp.configuration.skip_carrier_request_verification?
+
+      DiscoApp::CarrierRequestService.valid_hmac?(
+        request.body.read.to_s,
+        ShopifyApp.configuration.secret,
+        request.headers['HTTP_X_SHOPIFY_HMAC_SHA256']
+      )
     end
 
     def find_shop
-      unless (@shop = DiscoApp::Shop.find_by_shopify_domain(request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN']))
-        head :unauthorized
-      end
+      @shop = DiscoApp::Shop.find_by(shopify_domain: request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN'])
+
+      head :unauthorized unless @shop
     end
 
     def validate_rate_params
-      unless params[:rate].present? and params[:rate][:origin].present? and params[:rate][:destination].present? and params[:rate][:items].present?
-        head :bad_request
-      end
+      head :bad_request unless request_is_valid?
+    end
+
+    def request_is_valid?
+      return false if params[:rate].blank?
+      return false if params[:rate][:origin].blank?
+      return false if params[:rate][:destination].blank?
+      return false if params[:rate][:items].blank?
+
+      true
     end
 
 end

data/app/controllers/disco_app/concerns/user_authenticated_controller.rb

@@ -1,4 +1,5 @@
 module DiscoApp::Concerns::UserAuthenticatedController
+
   extend ActiveSupport::Concern
   include ShopifyApp::LoginProtection
 

data/app/controllers/disco_app/concerns/webhooks_controller.rb

@@ -0,0 +1,49 @@
+module DiscoApp::Concerns::WebhooksController
+
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :verify_webhook
+    protect_from_forgery with: :null_session
+  end
+
+  def process_webhook
+    # Get the topic and domain for this webhook.
+    topic = request.headers['HTTP_X_SHOPIFY_TOPIC']
+    shopify_domain = request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN']
+
+    # Ensure a domain was provided in the headers.
+    return head :bad_request unless shopify_domain
+
+    # Try to find a matching background job task for the given topic using class name.
+    job_class = DiscoApp::WebhookService.find_job_class(topic)
+
+    # Return bad request if we couldn't match a job class.
+    return head :bad_request if job_class.blank?
+
+    # Decode the body data and enqueue the appropriate job.
+    data = JSON.parse(request.body.read).with_indifferent_access
+    job_class.perform_later(shopify_domain, data)
+
+    render body: nil
+  end
+
+  private
+
+    def verify_webhook
+      return head :unauthorized unless webhook_is_valid?
+
+      request.body.rewind
+    end
+
+    def webhook_is_valid?
+      return true if Rails.env.development? && DiscoApp.configuration.skip_webhook_verification?
+
+      DiscoApp::WebhookService.valid_hmac?(
+        request.body.read.to_s,
+        ShopifyApp.configuration.secret,
+        request.headers['HTTP_X_SHOPIFY_HMAC_SHA256']
+      )
+    end
+
+end

data/app/controllers/disco_app/flow/actions_controller.rb

@@ -0,0 +1,9 @@
+module DiscoApp
+  module Flow
+    class ActionsController < ActionController::Base
+
+      include DiscoApp::Flow::Concerns::ActionsController
+
+    end
+  end
+end

data/app/controllers/disco_app/flow/concerns/actions_controller.rb

@@ -0,0 +1,50 @@
+module DiscoApp
+  module Flow
+    module Concerns
+      module ActionsController
+
+        extend ActiveSupport::Concern
+
+        included do
+          before_action :verify_flow_action
+          before_action :find_shop
+          protect_from_forgery with: :null_session
+        end
+
+        def create_flow_action
+          DiscoApp::Flow::CreateAction.call(
+            shop: @shop,
+            action_id: params[:id],
+            action_run_id: params[:action_run_id],
+            properties: params[:properties]
+          )
+
+          head :ok
+        end
+
+        private
+
+          def verify_flow_action
+            return head :unauthorized unless flow_action_is_valid?
+
+            request.body.rewind
+          end
+
+          # Shopify Flow action endpoints use the same verification method as webhooks, which is why we reuse this
+          # service method here.
+          def flow_action_is_valid?
+            DiscoApp::WebhookService.valid_hmac?(
+              request.body.read.to_s,
+              ShopifyApp.configuration.secret,
+              request.headers['HTTP_X_SHOPIFY_HMAC_SHA256']
+            )
+          end
+
+          def find_shop
+            @shop = DiscoApp::Shop.find_by!(shopify_domain: params[:shopify_domain])
+          end
+
+      end
+    end
+  end
+end

data/app/controllers/disco_app/frame_controller.rb

@@ -3,7 +3,6 @@ class DiscoApp::FrameController < ActionController::Base
   layout nil
 
   def frame
-
   end
 
 end