omniauth-shopify-oauth2 1.1.14 → 1.1.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e88a21bce303e6c6d637d58c50a2bfa7d75dfe86
-  data.tar.gz: bced14c2fffa27c843425fe95dd088dbb5866c28
+  metadata.gz: 9fb79e1fb61eb4b740f0599821ce94f0d90bbf07
+  data.tar.gz: 5717243aa9a50abe95ce4b195d068a3b9e3605d1
 SHA512:
-  metadata.gz: 575588b874c8c8d1774070ed66fbf55e8d70f9b82f9097c6f97e1ccb3423e792b82b400c2c3e481527eb60f5f54a69092aebd5715a5211845033bdc3a3be974c
-  data.tar.gz: 3aa7bb0263d3c262f6c93aa39ce8729d92225fe712c9f0acc46560aed468f8c9dc125b4820a20273add6d4490b424215ba89565ac8c9fd8488d74dcc4dbe0f17
+  metadata.gz: 14c7013cd7138bb608422125897bec4662984b4080a7d13b479bb8fcdba8f838713ec8a0a7ef8eb7d8168b84532faec118b3a8f554d61df8e2bffa53ef542800
+  data.tar.gz: 2514636e95bf710c68545b420266e372ff9ad60df555c883df95bafa72a18125181473a29b5fdc1db0de68f6c38d82cec6c6752b54f46452db8858fad35bc24e

data/Gemfile

@@ -1,3 +1,7 @@
 source "https://rubygems.org"
 
 gemspec
+
+if Gem::Version.new(RUBY_VERSION) < Gem::Version.new("2.2")
+  gem 'rack', '~> 1.6'
+end

data/README.md

@@ -26,6 +26,16 @@ Rails.application.config.middleware.use OmniAuth::Builder do
 end
 ```
 
+Authenticate the user by having them visit /auth/shopify with a `shop` query parameter of their shop's myshopify.com domain. For example, the following form could be used
+
+```html
+<form action="/auth/shopify" method="get">
+  <label for="shop">Enter your store's URL:</label>
+  <input type="text" name="shop" placeholder="your-shop-url.myshopify.com">
+  <button type="submit">Log In</button>
+</form>
+```
+
 ## Configuring
 
 You can configure the scope, which you pass in to the `provider` method via a `Hash`:

data/lib/omniauth/shopify/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Shopify
-    VERSION = "1.1.14"
+    VERSION = "1.1.15"
   end
 end

data/lib/omniauth/strategies/shopify.rb

@@ -18,6 +18,10 @@ module OmniAuth
       option :callback_url
       option :myshopify_domain, 'myshopify.com'
 
+      # When `true`, the user's permission level will apply (in addition to
+      # the requested access scope) when making API requests to Shopify.
+      option :per_user_permissions, false
+
       # When `true`, the authorization phase will fail if the granted scopes
       # mismatch the requested scopes.
       option :validate_granted_scopes, true
@@ -29,6 +33,16 @@ module OmniAuth
 
       uid { URI.parse(options[:client_options][:site]).host }
 
+      extra do
+        if access_token
+          {
+            'associated_user' => access_token['associated_user'],
+            'associated_user_scope' => access_token['associated_user_scope'],
+            'scope' => access_token['scope'],
+          }
+        end
+      end
+
       def valid_site?
         !!(/\A(https|http)\:\/\/[a-zA-Z0-9][a-zA-Z0-9\-]*\.#{Regexp.quote(options[:myshopify_domain])}[\/]?\z/ =~ options[:client_options][:site])
       end
@@ -71,6 +85,10 @@ module OmniAuth
         OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, secret, encoded_params)
       end
 
+      def valid_permissions?(token)
+        token && (options[:per_user_permissions] == !token['associated_user'].nil?)
+      end
+
       def fix_https
         options[:client_options][:site].gsub!(/\Ahttp\:/, 'https:')
       end
@@ -96,6 +114,9 @@ module OmniAuth
         unless valid_scope?(token)
           return fail!(:invalid_scope, CallbackError.new(:invalid_scope, "Scope does not match, it may have been tampered with."))
         end
+        unless valid_permissions?(token)
+          return fail!(:invalid_permissions, CallbackError.new(:invalid_permissions, "Requested API access mode does not match."))
+        end
 
         super
       end
@@ -107,6 +128,7 @@ module OmniAuth
       def authorize_params
         super.tap do |params|
           params[:scope] = normalized_scopes(params[:scope] || DEFAULT_SCOPE).join(SCOPE_DELIMITER)
+          params[:grant_options] = ['per-user'] if options[:per_user_permissions]
         end
       end
 

data/omniauth-shopify-oauth2.gemspec

@@ -6,7 +6,7 @@ Gem::Specification.new do |s|
   s.name     = 'omniauth-shopify-oauth2'
   s.version  = OmniAuth::Shopify::VERSION
   s.authors  = ['Denis Odorcic']
-  s.email    = ['denis.odorcic@shopify.com']
+  s.email    = ['gems@shopify.com']
   s.summary  = 'Shopify strategy for OmniAuth'
   s.homepage = 'https://github.com/Shopify/omniauth-shopify-oauth2'
   s.license = 'MIT'

data/test/integration_test.rb

@@ -13,11 +13,19 @@ class IntegrationTest < Minitest::Test
   def test_authorize
     response = authorize('snowdevil.myshopify.com')
     assert_equal 302, response.status
-    assert_match /\A#{Regexp.quote("https://snowdevil.myshopify.com/admin/oauth/authorize?")}/, response.location
+    assert_match %r{\A#{Regexp.quote(shopify_authorize_url)}}, response.location
     redirect_params = Rack::Utils.parse_query(URI(response.location).query)
     assert_equal "123", redirect_params['client_id']
     assert_equal "https://app.example.com/auth/shopify/callback", redirect_params['redirect_uri']
     assert_equal "read_products", redirect_params['scope']
+    assert_nil redirect_params['grant_options']
+  end
+
+  def test_authorize_includes_auth_type_when_per_user_permissions_are_requested
+    build_app(per_user_permissions: true)
+    response = authorize('snowdevil.myshopify.com')
+    redirect_params = Rack::Utils.parse_query(URI(response.location).query)
+    assert_equal 'per-user', redirect_params['grant_options[]']
   end
 
   def test_authorize_overrides_site_with_https_scheme
@@ -27,7 +35,7 @@ class IntegrationTest < Minitest::Test
     }
 
     response = authorize('snowdevil.myshopify.com')
-    assert_match /\A#{Regexp.quote("https://snowdevil.myshopify.com/admin/oauth/authorize?")}/, response.location
+    assert_match %r{\A#{Regexp.quote(shopify_authorize_url)}}, response.location
   end
 
   def test_site_validation
@@ -142,7 +150,7 @@ class IntegrationTest < Minitest::Test
 
     response = authorize('snowdevil')
     assert_equal 302, response.status
-    assert_match /\A#{Regexp.quote("https://snowdevil.myshopify.dev:3000/admin/oauth/authorize?")}/, response.location
+    assert_match %r{\A#{Regexp.quote("https://snowdevil.myshopify.dev:3000/admin/oauth/authorize?")}}, response.location
     redirect_params = Rack::Utils.parse_query(URI(response.location).query)
     assert_equal 'read_products,read_orders,write_content', redirect_params['scope']
     assert_equal 'https://app.example.com/admin/auth/legacy/callback', redirect_params['redirect_uri']
@@ -178,7 +186,7 @@ class IntegrationTest < Minitest::Test
   def test_callback_with_mismatching_scope_fails
     access_token = SecureRandom.hex(16)
     code = SecureRandom.hex(16)
-    expect_access_token_request(access_token, 'some_invalid_scope')
+    expect_access_token_request(access_token, 'some_invalid_scope', nil)
 
     response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
 
@@ -247,6 +255,44 @@ class IntegrationTest < Minitest::Test
     assert_callback_success(response, access_token, code)
   end
 
+  def test_callback_when_per_user_permissions_are_present_but_not_requested
+    build_app(scope: 'scope', per_user_permissions: false)
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'})
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_permissions&strategy=shopify', response.location
+  end
+
+  def test_callback_when_per_user_permissions_are_not_present_but_requested
+    build_app(scope: 'scope', per_user_permissions: true)
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', nil)
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 302, response.status
+    assert_equal '/auth/failure?message=invalid_permissions&strategy=shopify', response.location
+  end
+
+  def test_callback_works_when_per_user_permissions_are_present_and_requested
+    build_app(scope: 'scope', per_user_permissions: true)
+
+    access_token = SecureRandom.hex(16)
+    code = SecureRandom.hex(16)
+    expect_access_token_request(access_token, 'scope', { id: 1, email: 'bob@bobsen.com'})
+
+    response = callback(sign_params(shop: 'snowdevil.myshopify.com', code: code, state: opts["rack.session"]["omniauth.state"]))
+
+    assert_equal 200, response.status
+  end
+
   private
 
   def sign_params(params)
@@ -259,9 +305,9 @@ class IntegrationTest < Minitest::Test
     params
   end
 
-  def expect_access_token_request(access_token, scope)
+  def expect_access_token_request(access_token, scope, associated_user=nil)
     FakeWeb.register_uri(:post, "https://snowdevil.myshopify.com/admin/oauth/access_token",
-                         body: JSON.dump(access_token: access_token, scope: scope),
+                         body: JSON.dump(access_token: access_token, scope: scope, associated_user: associated_user),
                          content_type: 'application/json')
   end
 
@@ -282,7 +328,7 @@ class IntegrationTest < Minitest::Test
   def assert_auth_failure(response, reason)
     assert_nil FakeWeb.last_request
     assert_equal 302, response.status
-    assert_match /\A#{Regexp.quote("/auth/failure?message=#{reason}")}/, response.location
+    assert_match %r{\A#{Regexp.quote("/auth/failure?message=#{reason}")}}, response.location
   end
 
   def build_app(options={})
@@ -314,4 +360,8 @@ class IntegrationTest < Minitest::Test
   def request
     Rack::MockRequest.new(@app)
   end
+
+  def shopify_authorize_url
+    "https://snowdevil.myshopify.com/admin/oauth/authorize?"
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-shopify-oauth2
 version: !ruby/object:Gem::Version
-  version: 1.1.14
+  version: 1.1.15
 platform: ruby
 authors:
 - Denis Odorcic
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-25 00:00:00.000000000 Z
+date: 2016-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-oauth2
@@ -68,7 +68,7 @@ dependencies:
         version: '0'
 description: 
 email:
-- denis.odorcic@shopify.com
+- gems@shopify.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -109,7 +109,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.3
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Shopify strategy for OmniAuth