omniauth-shopify-oauth2 1.1.14 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e88a21bce303e6c6d637d58c50a2bfa7d75dfe86
-  data.tar.gz: bced14c2fffa27c843425fe95dd088dbb5866c28
+  metadata.gz: 3c2fdff942824597bca290d63c4d5f2e8ad3fea3
+  data.tar.gz: 175291a1282389126084a7d32c2fd7c4965faa9c
 SHA512:
-  metadata.gz: 575588b874c8c8d1774070ed66fbf55e8d70f9b82f9097c6f97e1ccb3423e792b82b400c2c3e481527eb60f5f54a69092aebd5715a5211845033bdc3a3be974c
-  data.tar.gz: 3aa7bb0263d3c262f6c93aa39ce8729d92225fe712c9f0acc46560aed468f8c9dc125b4820a20273add6d4490b424215ba89565ac8c9fd8488d74dcc4dbe0f17
+  metadata.gz: f905cd84cc0df6a8b1ef9d61ae432e0aaeb2d88547b77e4ddf5ca09c991ef181d131690a5ec6022553ff31b1246875cc76fd7420911cb463d021f459a72b8b4b
+  data.tar.gz: e909527c818473c35ae5e9caf4f3afaffe38e9fdf835fc7bff13fe41c1be8ab2e81f71f1fca02011013d78303d1baccb222fb9e2c6cd7be9704fd9645c668e31

data/.github/probots.yml

@@ -0,0 +1,2 @@
+enabled:
+  - cla

data/.travis.yml

@@ -1,4 +1,4 @@
 language: ruby
 rvm:
-  - 2.1.0
+  - 2.1.9
   - 2.2.2

data/Gemfile

@@ -1,3 +1,7 @@
 source "https://rubygems.org"
 
 gemspec
+
+if Gem::Version.new(RUBY_VERSION) < Gem::Version.new("2.2")
+  gem 'rack', '~> 1.6'
+end

data/README.md

@@ -26,8 +26,20 @@ Rails.application.config.middleware.use OmniAuth::Builder do
 end
 ```
 
+Authenticate the user by having them visit /auth/shopify with a `shop` query parameter of their shop's myshopify.com domain. For example, the following form could be used
+
+```html
+<form action="/auth/shopify" method="get">
+  <label for="shop">Enter your store's URL:</label>
+  <input type="text" name="shop" placeholder="your-shop-url.myshopify.com">
+  <button type="submit">Log In</button>
+</form>
+```
+
 ## Configuring
 
+### Scope
+
 You can configure the scope, which you pass in to the `provider` method via a `Hash`:
 
 * `scope`: A comma-separated list of permissions you want to request from the user. See [the Shopify API docs](http://docs.shopify.com/api/tutorials/oauth) for a full list of available permissions.
@@ -40,6 +52,19 @@ Rails.application.config.middleware.use OmniAuth::Builder do
 end
 ```
 
+### Online Access
+
+Shopify offers two different types of access tokens: [online access and offline access](https://help.shopify.com/api/getting-started/authentication/oauth/api-access-modes). You can configure for online-access by passing the `per_user_permissions` option:
+
+```
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :shopify, ENV['SHOPIFY_API_KEY'],
+                     ENV['SHOPIFY_SHARED_SECRET'],
+                     :scope => 'read_orders',
+                     :per_user_permissions => true
+end
+```
+
 ## Authentication Hash
 
 Here's an example *Authentication Hash* available in `request.env['omniauth.auth']`:

data/lib/omniauth/shopify/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Shopify
-    VERSION = "1.1.14"
+    VERSION = "2.0.0"
   end
 end

data/lib/omniauth/strategies/shopify.rb

@@ -18,17 +18,35 @@ module OmniAuth
       option :callback_url
       option :myshopify_domain, 'myshopify.com'
 
-      # When `true`, the authorization phase will fail if the granted scopes
-      # mismatch the requested scopes.
-      option :validate_granted_scopes, true
+      # When `true`, the user's permission level will apply (in addition to
+      # the requested access scope) when making API requests to Shopify.
+      option :per_user_permissions, false
 
       option :setup, proc { |env|
-        request = Rack::Request.new(env)
-        env['omniauth.strategy'].options[:client_options][:site] = "https://#{request.GET['shop']}"
+        strategy = env['omniauth.strategy']
+
+        shopify_auth_params = strategy.session['shopify.omniauth_params'] && strategy.session['shopify.omniauth_params'].with_indifferent_access
+        shop = if shopify_auth_params && shopify_auth_params['shop']
+          "https://#{shopify_auth_params['shop']}"
+        else
+          ''
+        end
+
+        strategy.options[:client_options][:site] = shop
       }
 
       uid { URI.parse(options[:client_options][:site]).host }
 
+      extra do
+        if access_token
+          {
+            'associated_user' => access_token['associated_user'],
+            'associated_user_scope' => access_token['associated_user_scope'],
+            'scope' => access_token['scope'],
+          }
+        end
+      end
+
       def valid_site?
         !!(/\A(https|http)\:\/\/[a-zA-Z0-9][a-zA-Z0-9\-]*\.#{Regexp.quote(options[:myshopify_domain])}[\/]?\z/ =~ options[:client_options][:site])
       end
@@ -71,8 +89,12 @@ module OmniAuth
         OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, secret, encoded_params)
       end
 
+      def valid_permissions?(token)
+        token && (options[:per_user_permissions] == !token['associated_user'].nil?)
+      end
+
       def fix_https
-        options[:client_options][:site].gsub!(/\Ahttp\:/, 'https:')
+        options[:client_options][:site] = options[:client_options][:site].gsub(/\Ahttp\:/, 'https:')
       end
 
       def setup_phase
@@ -96,6 +118,9 @@ module OmniAuth
         unless valid_scope?(token)
           return fail!(:invalid_scope, CallbackError.new(:invalid_scope, "Scope does not match, it may have been tampered with."))
         end
+        unless valid_permissions?(token)
+          return fail!(:invalid_permissions, CallbackError.new(:invalid_permissions, "Requested API access mode does not match."))
+        end
 
         super
       end
@@ -107,6 +132,7 @@ module OmniAuth
       def authorize_params
         super.tap do |params|
           params[:scope] = normalized_scopes(params[:scope] || DEFAULT_SCOPE).join(SCOPE_DELIMITER)
+          params[:grant_options] = ['per-user'] if options[:per_user_permissions]
         end
       end
 

data/omniauth-shopify-oauth2.gemspec

@@ -6,7 +6,7 @@ Gem::Specification.new do |s|
   s.name     = 'omniauth-shopify-oauth2'
   s.version  = OmniAuth::Shopify::VERSION
   s.authors  = ['Denis Odorcic']
-  s.email    = ['denis.odorcic@shopify.com']
+  s.email    = ['gems@shopify.com']
   s.summary  = 'Shopify strategy for OmniAuth'
   s.homepage = 'https://github.com/Shopify/omniauth-shopify-oauth2'
   s.license = 'MIT'
@@ -15,8 +15,10 @@ Gem::Specification.new do |s|
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
   s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
   s.require_paths = ['lib']
+  s.required_ruby_version = '>= 2.1.9'
 
-  s.add_runtime_dependency 'omniauth-oauth2', '~> 1.2'
+  s.add_runtime_dependency 'omniauth-oauth2', '~> 1.5.0'
+  s.add_runtime_dependency 'activesupport'
 
   s.add_development_dependency 'minitest', '~> 5.6'
   s.add_development_dependency 'fakeweb', '~> 1.3'

data/spec/omniauth/strategies/shopify_spec.rb

@@ -29,6 +29,12 @@ describe OmniAuth::Strategies::Shopify do
       subject.options[:client_options][:site].should eq('https://foo.bar/')
     end
 
+    it 'replaces http scheme by https with an immutable string' do
+      @options = {:client_options => {:site => 'http://foo.bar/'.freeze}}
+      subject.fix_https
+      subject.options[:client_options][:site].should eq('https://foo.bar/')
+    end
+
     it 'does not replace https scheme' do
       @options = {:client_options => {:site => 'https://foo.bar/'}}
       subject.fix_https

data/test/integration_test.rb

@@ -13,11 +13,19 @@ class IntegrationTest < Minitest::Test
   def test_authorize
     response = authorize('snowdevil.myshopify.com')
     assert_equal 302, response.status
-    assert_match /\A#{Regexp.quote("https://snowdevil.myshopify.com/admin/oauth/authorize?")}/, response.location
+    assert_match %r{\A#{Regexp.quote(shopify_authorize_url)}}, response.location
     redirect_params = Rack::Utils.parse_query(URI(response.location).query)
     assert_equal "123", redirect_params['client_id']
     assert_equal "https://app.example.com/auth/shopify/callback", redirect_params['redirect_uri']
     assert_equal "read_products", redirect_params['scope']
+    assert_nil redirect_params['grant_options']
+  end
+
+  def test_authorize_includes_auth_type_when_per_user_permissions_are_requested
+    build_app(per_user_permissions: true)
+    response = authorize('snowdevil.myshopify.com')
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal 'per-user', redirect_params['grant_options[]']
   end
 
   def test_authorize_overrides_site_with_https_scheme
@@ -26,8 +34,8 @@ class IntegrationTest < Minitest::Test
       env['omniauth.strategy'].options[:client_options][:site] = "http://#{params['shop']}"
     }
 
-    response = authorize('snowdevil.myshopify.com')
-    assert_match /\A#{Regexp.quote("https://snowdevil.myshopify.com/admin/oauth/authorize?")}/, response.location
+    response = request.get('https://app.example.com/auth/shopify?shop=snowdevil.myshopify.com')
+    assert_match %r{\A#{Regexp.quote(shopify_authorize_url)}}, response.location
   end
 
   def test_site_validation
@@ -40,6 +48,7 @@ class IntegrationTest < Minitest::Test
       'user@snowdevil.myshopify.com',   # shop contains user
       'snowdevil.myshopify.com:22',     # shop contains port
     ].each do |shop, valid|
+      @shop = shop
       response = authorize(shop)
       assert_auth_failure(response, 'invalid_site')
 
@@ -125,7 +134,10 @@ class IntegrationTest < Minitest::Test
 
     response = request.get("https://app.example.com/auth/shopify/callback?#{Rack::Utils.build_query(params)}",
                            input: body,
-                           "CONTENT_TYPE" => 'application/x-www-form-urlencoded')
+                           "CONTENT_TYPE" => 'application/x-www-form-urlencoded',
+                           'rack.session' => {
+                              'shopify.omniauth_params' => { shop: 'snowdevil.myshopify.com' }
+                            })
 
     assert_auth_failure(response, 'invalid_signature')
   end
@@ -140,25 +152,33 @@ class IntegrationTest < Minitest::Test
                 env['omniauth.strategy'].options[:client_options][:site] = "https://#{shop}"
               }
 
-    response = authorize('snowdevil')
+    response = request.get("https://app.example.com/auth/shopify?shop=snowdevil.myshopify.dev:3000")
     assert_equal 302, response.status
-    assert_match /\A#{Regexp.quote("https://snowdevil.myshopify.dev:3000/admin/oauth/authorize?")}/, response.location
+    assert_match %r{\A#{Regexp.quote("https://snowdevil.myshopify.dev:3000/admin/oauth/authorize?")}}, response.location
     redirect_params = Rack::Utils.parse_query(URI(response.location).query)
     assert_equal 'read_products,read_orders,write_content', redirect_params['scope']
     assert_equal 'https://app.example.com/admin/auth/legacy/callback', redirect_params['redirect_uri']
   end
 
+  def test_default_setup_reads_shop_from_session
+    build_app
+    response = authorize('snowdevil.myshopify.com')
+    assert_equal 302, response.status
+    assert_match %r{\A#{Regexp.quote("https://snowdevil.myshopify.com/admin/oauth/authorize?")}}, response.location
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal 'https://app.example.com/auth/shopify/callback', redirect_params['redirect_uri']
+  end
+
   def test_unnecessary_read_scopes_are_removed
     build_app scope: 'read_content,read_products,write_products',
               callback_path: '/admin/auth/legacy/callback',
               myshopify_domain: 'myshopify.dev:3000',
               setup: lambda { |env|
                 shop = Rack::Request.new(env).GET['shop']
-                shop += ".myshopify.dev:3000" unless shop.include?(".")
                 env['omniauth.strategy'].options[:client_options][:site] = "https://#{shop}"
               }
 
-    response = authorize('snowdevil')
+    response = request.get("https://app.example.com/auth/shopify?shop=snowdevil.myshopify.dev:3000")
     assert_equal 302, response.status
     redirect_params = Rack::Utils.parse_query(URI(response.location).query)
     assert_equal 'read_content,write_products', redirect_params['scope']
@@ -178,7 +198,7 @@ class IntegrationTest < Minitest::Test
   def test_callback_with_mismatching_scope_fails
     access_token = SecureRandom.hex(16)
     code = SecureRandom.hex(16)
-    expect_access_token_request(access_token, 'some_invalid_scope')
+    expect_access_token_request(access_token, 'some_invalid_scope', nil)
 
     response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
@@ -247,6 +267,44 @@ class IntegrationTest < Minitest::Test
     assert_callback_success(response, access_token, code)
   end
 
+  def test_callback_when_per_user_permissions_are_present_but_not_requested
+    build_app(scope: 'scope', per_user_permissions: false)
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'})
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_permissions&strategy=shopify', response.location
+  end
+
+  def test_callback_when_per_user_permissions_are_not_present_but_requested
+    build_app(scope: 'scope', per_user_permissions: true)
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', nil)
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_permissions&strategy=shopify', response.location
+  end
+
+  def test_callback_works_when_per_user_permissions_are_present_and_requested
+    build_app(scope: 'scope', per_user_permissions: true)
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'})
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 200, response.status
+  end
+
   private
 
   def sign_params(params)
@@ -259,9 +317,9 @@ class IntegrationTest < Minitest::Test
     params
   end
 
-  def expect_access_token_request(access_token, scope)
+  def expect_access_token_request(access_token, scope, associated_user=nil)
     FakeWeb.register_uri(:post, "https://snowdevil.myshopify.com/admin/oauth/access_token",
-                         body: JSON.dump(access_token: access_token, scope: scope),
+                         body: JSON.dump(access_token: access_token, scope: scope, associated_user: associated_user),
                          content_type: 'application/json')
   end
 
@@ -282,7 +340,7 @@ class IntegrationTest < Minitest::Test
   def assert_auth_failure(response, reason)
     assert_nil FakeWeb.last_request
     assert_equal 302, response.status
-    assert_match /\A#{Regexp.quote("/auth/failure?message=#{reason}")}/, response.location
+    assert_match %r{\A#{Regexp.quote("/auth/failure?message=#{reason}")}}, response.location
   end
 
   def build_app(options={})
@@ -299,11 +357,17 @@ class IntegrationTest < Minitest::Test
     @app = Rack::Session::Cookie.new(app, secret: SecureRandom.hex(64))
   end
 
+  def shop
+    @shop ||= 'snowdevil.myshopify.com'
+  end
+
   def authorize(shop)
-    request.get("https://app.example.com/auth/shopify?shop=#{CGI.escape(shop)}", opts)
+    @opts['rack.session']['shopify.omniauth_params'] = { shop: shop }
+    request.get('https://app.example.com/auth/shopify', opts)
   end
 
   def callback(params)
+    @opts['rack.session']['shopify.omniauth_params'] = { shop: shop }
     request.get("https://app.example.com/auth/shopify/callback?#{Rack::Utils.build_query(params)}", opts)
   end
 
@@ -314,4 +378,8 @@ class IntegrationTest < Minitest::Test
   def request
     Rack::MockRequest.new(@app)
   end
+
+  def shopify_authorize_url
+    "https://snowdevil.myshopify.com/admin/oauth/authorize?"
+  end
 end

data/test/test_helper.rb

@@ -5,6 +5,7 @@ require 'omniauth-shopify-oauth2'
 require 'minitest/autorun'
 require 'fakeweb'
 require 'json'
+require 'active_support/core_ext/hash'
 
 OmniAuth.config.logger = Logger.new(nil)
 FakeWeb.allow_net_connect = false

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-shopify-oauth2
 version: !ruby/object:Gem::Version
-  version: 1.1.14
+  version: 2.0.0
 platform: ruby
 authors:
 - Denis Odorcic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-25 00:00:00.000000000 Z
+date: 2018-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
@@ -16,14 +16,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: 1.5.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: 1.5.0
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -68,11 +82,12 @@ dependencies:
         version: '0'
 description: 
 email:
-- denis.odorcic@shopify.com
+- gems@shopify.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/probots.yml"
 - ".gitignore"
 - ".travis.yml"
 - Gemfile
@@ -101,7 +116,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.1.9
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -109,7 +124,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.3
+rubygems_version: 2.6.14
 signing_key: 
 specification_version: 4
 summary: Shopify strategy for OmniAuth