ruby_shopify_app 1.0.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (186) hide show
  1. checksums.yaml +7 -0
  2. data/.babelrc +5 -0
  3. data/.github/CODEOWNERS +2 -0
  4. data/.github/ISSUE_TEMPLATE/bug-report.md +63 -0
  5. data/.github/ISSUE_TEMPLATE/config.yml +1 -0
  6. data/.github/ISSUE_TEMPLATE/feature-request.md +33 -0
  7. data/.github/PULL_REQUEST_TEMPLATE.md +22 -0
  8. data/.github/probots.yml +2 -0
  9. data/.github/workflows/build.yml +40 -0
  10. data/.github/workflows/release.yml +24 -0
  11. data/.github/workflows/rubocop.yml +22 -0
  12. data/.gitignore +14 -0
  13. data/.nvmrc +1 -0
  14. data/.rubocop.yml +18 -0
  15. data/.ruby-version +1 -0
  16. data/CHANGELOG-OLD.md +643 -0
  17. data/CHANGELOG.md +6 -0
  18. data/CONTRIBUTING.md +81 -0
  19. data/Gemfile +11 -0
  20. data/Gemfile.lock +280 -0
  21. data/LICENSE +19 -0
  22. data/README.md +132 -0
  23. data/Rakefile +7 -0
  24. data/SECURITY.md +59 -0
  25. data/app/assets/images/storage_access.svg +1 -0
  26. data/app/assets/javascripts/shopify_app/app_bridge_2.0.12.js +10 -0
  27. data/app/assets/javascripts/shopify_app/app_bridge_redirect.js +22 -0
  28. data/app/assets/javascripts/shopify_app/enable_cookies.js +3 -0
  29. data/app/assets/javascripts/shopify_app/itp_helper.js +40 -0
  30. data/app/assets/javascripts/shopify_app/partition_cookies.js +8 -0
  31. data/app/assets/javascripts/shopify_app/post_redirect.js +9 -0
  32. data/app/assets/javascripts/shopify_app/redirect.js +31 -0
  33. data/app/assets/javascripts/shopify_app/request_storage_access.js +3 -0
  34. data/app/assets/javascripts/shopify_app/storage_access.js +148 -0
  35. data/app/assets/javascripts/shopify_app/storage_access_redirect.js +17 -0
  36. data/app/assets/javascripts/shopify_app/top_level.js +2 -0
  37. data/app/assets/javascripts/shopify_app/top_level_interaction.js +11 -0
  38. data/app/controllers/concerns/shopify_app/authenticated.rb +16 -0
  39. data/app/controllers/concerns/shopify_app/ensure_authenticated_links.rb +39 -0
  40. data/app/controllers/concerns/shopify_app/require_known_shop.rb +40 -0
  41. data/app/controllers/concerns/shopify_app/shop_access_scopes_verification.rb +32 -0
  42. data/app/controllers/shopify_app/authenticated_controller.rb +8 -0
  43. data/app/controllers/shopify_app/callback_controller.rb +195 -0
  44. data/app/controllers/shopify_app/extension_verification_controller.rb +15 -0
  45. data/app/controllers/shopify_app/sessions_controller.rb +202 -0
  46. data/app/controllers/shopify_app/webhooks_controller.rb +36 -0
  47. data/app/views/shopify_app/partials/_button_styles.html.erb +109 -0
  48. data/app/views/shopify_app/partials/_card_styles.html.erb +33 -0
  49. data/app/views/shopify_app/partials/_empty_state_styles.html.erb +98 -0
  50. data/app/views/shopify_app/partials/_form_styles.html.erb +56 -0
  51. data/app/views/shopify_app/partials/_layout_styles.html.erb +182 -0
  52. data/app/views/shopify_app/partials/_typography_styles.html.erb +35 -0
  53. data/app/views/shopify_app/sessions/enable_cookies.html.erb +70 -0
  54. data/app/views/shopify_app/sessions/new.html.erb +51 -0
  55. data/app/views/shopify_app/sessions/request_storage_access.html.erb +68 -0
  56. data/app/views/shopify_app/sessions/top_level_interaction.html.erb +63 -0
  57. data/app/views/shopify_app/shared/post_redirect_to_auth_shopify.html.erb +13 -0
  58. data/app/views/shopify_app/shared/redirect.html.erb +23 -0
  59. data/config/locales/cs.yml +23 -0
  60. data/config/locales/da.yml +20 -0
  61. data/config/locales/de.yml +22 -0
  62. data/config/locales/en.yml +15 -0
  63. data/config/locales/es.yml +22 -0
  64. data/config/locales/fi.yml +20 -0
  65. data/config/locales/fr.yml +23 -0
  66. data/config/locales/it.yml +21 -0
  67. data/config/locales/ja.yml +17 -0
  68. data/config/locales/ko.yml +19 -0
  69. data/config/locales/nb.yml +21 -0
  70. data/config/locales/nl.yml +21 -0
  71. data/config/locales/pl.yml +21 -0
  72. data/config/locales/pt-BR.yml +21 -0
  73. data/config/locales/pt-PT.yml +22 -0
  74. data/config/locales/sv.yml +21 -0
  75. data/config/locales/th.yml +20 -0
  76. data/config/locales/tr.yml +22 -0
  77. data/config/locales/vi.yml +22 -0
  78. data/config/locales/zh-CN.yml +16 -0
  79. data/config/locales/zh-TW.yml +16 -0
  80. data/config/routes.rb +23 -0
  81. data/docs/Quickstart.md +31 -0
  82. data/docs/Releasing.md +21 -0
  83. data/docs/Troubleshooting.md +159 -0
  84. data/docs/Upgrading.md +132 -0
  85. data/docs/shopify_app/authentication.md +124 -0
  86. data/docs/shopify_app/engine.md +82 -0
  87. data/docs/shopify_app/generators.md +127 -0
  88. data/docs/shopify_app/handling-access-scopes-changes.md +24 -0
  89. data/docs/shopify_app/script-tags.md +28 -0
  90. data/docs/shopify_app/session-repository.md +88 -0
  91. data/docs/shopify_app/testing.md +38 -0
  92. data/docs/shopify_app/webhooks.md +72 -0
  93. data/images/app-proxy-screenshot.png +0 -0
  94. data/karma.conf.js +44 -0
  95. data/lib/generators/shopify_app/add_after_authenticate_job/add_after_authenticate_job_generator.rb +47 -0
  96. data/lib/generators/shopify_app/add_after_authenticate_job/templates/after_authenticate_job.rb +11 -0
  97. data/lib/generators/shopify_app/add_marketing_activity_extension/add_marketing_activity_extension_generator.rb +40 -0
  98. data/lib/generators/shopify_app/add_marketing_activity_extension/templates/marketing_activities_controller.rb +62 -0
  99. data/lib/generators/shopify_app/add_webhook/add_webhook_generator.rb +69 -0
  100. data/lib/generators/shopify_app/add_webhook/templates/webhook_job.rb.tt +13 -0
  101. data/lib/generators/shopify_app/app_proxy_controller/app_proxy_controller_generator.rb +26 -0
  102. data/lib/generators/shopify_app/app_proxy_controller/templates/app_proxy_controller.rb +8 -0
  103. data/lib/generators/shopify_app/app_proxy_controller/templates/app_proxy_route.rb +11 -0
  104. data/lib/generators/shopify_app/app_proxy_controller/templates/index.html.erb +19 -0
  105. data/lib/generators/shopify_app/authenticated_controller/authenticated_controller_generator.rb +15 -0
  106. data/lib/generators/shopify_app/authenticated_controller/templates/authenticated_controller.rb +5 -0
  107. data/lib/generators/shopify_app/controllers/controllers_generator.rb +30 -0
  108. data/lib/generators/shopify_app/home_controller/home_controller_generator.rb +53 -0
  109. data/lib/generators/shopify_app/home_controller/templates/home_controller.rb +18 -0
  110. data/lib/generators/shopify_app/home_controller/templates/index.html.erb +75 -0
  111. data/lib/generators/shopify_app/home_controller/templates/unauthenticated_home_controller.rb +12 -0
  112. data/lib/generators/shopify_app/install/install_generator.rb +121 -0
  113. data/lib/generators/shopify_app/install/templates/_flash_messages.html.erb +3 -0
  114. data/lib/generators/shopify_app/install/templates/embedded_app.html.erb +44 -0
  115. data/lib/generators/shopify_app/install/templates/flash_messages.js +24 -0
  116. data/lib/generators/shopify_app/install/templates/omniauth.rb +4 -0
  117. data/lib/generators/shopify_app/install/templates/session_store.rb +4 -0
  118. data/lib/generators/shopify_app/install/templates/shopify_app.js +15 -0
  119. data/lib/generators/shopify_app/install/templates/shopify_app.rb.tt +25 -0
  120. data/lib/generators/shopify_app/install/templates/shopify_app_importmap.js +13 -0
  121. data/lib/generators/shopify_app/install/templates/shopify_app_index.js +2 -0
  122. data/lib/generators/shopify_app/install/templates/shopify_provider.rb.tt +8 -0
  123. data/lib/generators/shopify_app/install/templates/user_agent.rb +6 -0
  124. data/lib/generators/shopify_app/products_controller/products_controller_generator.rb +19 -0
  125. data/lib/generators/shopify_app/products_controller/templates/products_controller.rb +8 -0
  126. data/lib/generators/shopify_app/rotate_shopify_token_job/rotate_shopify_token_job_generator.rb +16 -0
  127. data/lib/generators/shopify_app/rotate_shopify_token_job/templates/rotate_shopify_token.rake +17 -0
  128. data/lib/generators/shopify_app/rotate_shopify_token_job/templates/rotate_shopify_token_job.rb +42 -0
  129. data/lib/generators/shopify_app/routes/routes_generator.rb +32 -0
  130. data/lib/generators/shopify_app/routes/templates/routes.rb +12 -0
  131. data/lib/generators/shopify_app/shop_model/shop_model_generator.rb +70 -0
  132. data/lib/generators/shopify_app/shop_model/templates/db/migrate/add_shop_access_scopes_column.erb +5 -0
  133. data/lib/generators/shopify_app/shop_model/templates/db/migrate/create_shops.erb +15 -0
  134. data/lib/generators/shopify_app/shop_model/templates/shop.rb +8 -0
  135. data/lib/generators/shopify_app/shop_model/templates/shops.yml +3 -0
  136. data/lib/generators/shopify_app/shopify_app_generator.rb +18 -0
  137. data/lib/generators/shopify_app/user_model/templates/db/migrate/add_user_access_scopes_column.erb +5 -0
  138. data/lib/generators/shopify_app/user_model/templates/db/migrate/create_users.erb +16 -0
  139. data/lib/generators/shopify_app/user_model/templates/user.rb +8 -0
  140. data/lib/generators/shopify_app/user_model/templates/users.yml +4 -0
  141. data/lib/generators/shopify_app/user_model/user_model_generator.rb +70 -0
  142. data/lib/generators/shopify_app/views/views_generator.rb +30 -0
  143. data/lib/shopify_app/access_scopes/noop_strategy.rb +13 -0
  144. data/lib/shopify_app/access_scopes/shop_strategy.rb +24 -0
  145. data/lib/shopify_app/access_scopes/user_strategy.rb +41 -0
  146. data/lib/shopify_app/configuration.rb +119 -0
  147. data/lib/shopify_app/controller_concerns/app_proxy_verification.rb +38 -0
  148. data/lib/shopify_app/controller_concerns/csrf_protection.rb +15 -0
  149. data/lib/shopify_app/controller_concerns/embedded_app.rb +20 -0
  150. data/lib/shopify_app/controller_concerns/itp.rb +45 -0
  151. data/lib/shopify_app/controller_concerns/localization.rb +23 -0
  152. data/lib/shopify_app/controller_concerns/login_protection.rb +259 -0
  153. data/lib/shopify_app/controller_concerns/payload_verification.rb +24 -0
  154. data/lib/shopify_app/controller_concerns/webhook_verification.rb +23 -0
  155. data/lib/shopify_app/engine.rb +47 -0
  156. data/lib/shopify_app/jobs/scripttags_manager_job.rb +16 -0
  157. data/lib/shopify_app/jobs/webhooks_manager_job.rb +16 -0
  158. data/lib/shopify_app/managers/scripttags_manager.rb +78 -0
  159. data/lib/shopify_app/managers/webhooks_manager.rb +62 -0
  160. data/lib/shopify_app/middleware/jwt_middleware.rb +43 -0
  161. data/lib/shopify_app/middleware/same_site_cookie_middleware.rb +34 -0
  162. data/lib/shopify_app/omniauth/omniauth_configuration.rb +64 -0
  163. data/lib/shopify_app/session/in_memory_session_store.rb +31 -0
  164. data/lib/shopify_app/session/in_memory_shop_session_store.rb +16 -0
  165. data/lib/shopify_app/session/in_memory_user_session_store.rb +16 -0
  166. data/lib/shopify_app/session/jwt.rb +67 -0
  167. data/lib/shopify_app/session/null_user_session_store.rb +22 -0
  168. data/lib/shopify_app/session/session_repository.rb +56 -0
  169. data/lib/shopify_app/session/session_storage.rb +20 -0
  170. data/lib/shopify_app/session/shop_session_storage.rb +42 -0
  171. data/lib/shopify_app/session/shop_session_storage_with_scopes.rb +58 -0
  172. data/lib/shopify_app/session/user_session_storage.rb +42 -0
  173. data/lib/shopify_app/session/user_session_storage_with_scopes.rb +58 -0
  174. data/lib/shopify_app/test_helpers/all.rb +2 -0
  175. data/lib/shopify_app/test_helpers/webhook_verification_helper.rb +17 -0
  176. data/lib/shopify_app/utils.rb +37 -0
  177. data/lib/shopify_app/version.rb +4 -0
  178. data/lib/shopify_app.rb +80 -0
  179. data/package.json +27 -0
  180. data/service.yml +4 -0
  181. data/shipit.rubygems.yml +4 -0
  182. data/shopify_app.gemspec +39 -0
  183. data/translation.yml +7 -0
  184. data/webpack.config.js +24 -0
  185. data/yarn.lock +5230 -0
  186. metadata +465 -0
data/CHANGELOG-OLD.md ADDED
@@ -0,0 +1,643 @@
1
+ 18.1.2 (Mar 3, 2022)
2
+ ----------
3
+ * Use the App Bridge 2.0 redirect when attempting to break out of an iframe. This happens when an app is installed, requires new access scopes, or re-authentication because the login session is expired. [#1376](https://github.com/Shopify/shopify_app/pull/1376)
4
+
5
+ 18.1.1 (Feb 2, 2022)
6
+ ----------
7
+ * Fix bug causing `unsafe-inline` CSP violation. [#1362](https://github.com/Shopify/shopify_app/pull/1362)
8
+
9
+ 18.1.0 (Jan 28, 2022)
10
+ ----------
11
+ * Support Rails 7 [#1354](https://github.com/Shopify/shopify_app/pull/1354)
12
+ * Fix webhooks handling in Ruby 3 [#1342](https://github.com/Shopify/shopify_app/pull/1342)
13
+ * Update to Ruby 3 and drop support to Ruby 2.5 [#1359](https://github.com/Shopify/shopify_app/pull/1359)
14
+
15
+ 18.0.4 (Jan 27, 2022)
16
+ ----------
17
+ * Use App Bridge client for redirect [#1247](https://github.com/Shopify/shopify_app/pull/1247)
18
+ * Replaces deprecated EASDK with App Bridge when redirecting out of an embedded iframe.
19
+
20
+ 18.0.3 (Jan 7, 2022)
21
+ ----------
22
+ * Change regexp to match standard ngrok URLs. [#1311](https://github.com/Shopify/shopify_app/pull/1311)
23
+ * Make `EnsureAuthenticatedLinks` compatible with AppBridge 2.0. [#1277](https://github.com/Shopify/shopify_app/pull/1277)
24
+ * Includes the `host` parameter when redirecting to the splash page in an unauthenticated state.
25
+
26
+ 18.0.2 (Jun 15, 2021)
27
+ ----------
28
+ * Added careers link to readme. [#1274](https://github.com/Shopify/shopify_app/pull/1274)
29
+
30
+ 18.0.1 (May 7, 2021)
31
+ ----------
32
+ * Fix bug causing OAuth flow to fail due to CSP violation. [#1265](https://github.com/Shopify/shopify_app/pull/1265)
33
+
34
+ 18.0.0 (May 3, 2021)
35
+ ----------
36
+ * Support OmniAuth 2.x
37
+ * If your app has custom OmniAuth configuration, please refer to the [OmniAuth 2.0 upgrade guide](https://github.com/omniauth/omniauth/wiki/Upgrading-to-2.0).
38
+ * Support App Bridge version 2.x in the Embedded App layout. [#1241](https://github.com/Shopify/shopify_app/pull/1241)
39
+
40
+ 17.2.1 (April 1, 2021)
41
+ ----------
42
+ * Bug fix: Lock the CDN App Bridge version to `v1.X.Y` in the Embedded App layout [#1238](https://github.com/Shopify/shopify_app/pull/1238)
43
+ * App Bridge `v2.0` is a non-backwards compatible release
44
+ * A future major shopify_app gem release will support only App Bridge `v2.0`
45
+
46
+ 17.2.0 (April 1, 2021)
47
+ ----------
48
+ * Support Rails `v6.1` [#1221](https://github.com/Shopify/shopify_app/pull/1221)
49
+ * Check out [Upgrading to `v17.2.0`](/docs/Upgrading.md#upgrading-to-v1720) in the Upgrading.md guide for the changes needed to support Rails `v6.1`
50
+
51
+ 17.1.1 (March 12, 2021)
52
+ ----------
53
+ * Fix issues with mocking OmniAuth callback controller tests [#1210](https://github.com/Shopify/shopify_app/pull/1210)
54
+
55
+ 17.1.0 (March 5, 2021)
56
+ ----------
57
+ * Create OmniAuthConfiguration object to build future OmniAuth strategies [#1190](https://github.com/Shopify/shopify_app/pull/1190)
58
+ * Added access scopes to Shop and User models, added checks to handle scope changes [#1192](https://github.com/Shopify/shopify_app/pull/1192) [#1197](https://github.com/Shopify/shopify_app/pull/1197)
59
+
60
+ 17.0.5 (January 27, 2021)
61
+ ----------
62
+ * Fix omniauth strategy not being set correctly for apps using session tokens [#1164](https://github.com/Shopify/shopify_app/pull/1164)
63
+
64
+ 17.0.4 (January 25, 2021)
65
+ ----------
66
+ * Redirect user to login page if shopify domain is not found in the `EnsureAuthenticatedLinks` concern [#1158](https://github.com/Shopify/shopify_app/pull/1158)
67
+
68
+ 17.0.3 (January 22, 2021)
69
+ ----------
70
+ * Amend fix for #1144 to raise on missing API keys only when running the server [#1155](https://github.com/Shopify/shopify_app/pull/1155)
71
+
72
+ 17.0.2 (January 20, 2021)
73
+ ------
74
+ * Fix failing script tags and webhooks installs after completing OAuth [#1151](https://github.com/Shopify/shopify_app/pull/1151)
75
+
76
+ 17.0.1 (January 18, 2021)
77
+ ------
78
+ * Don't attempt to read Shopify environment variables when the generators are running, since they may not be present yet [#1144](https://github.com/Shopify/shopify_app/pull/1144)
79
+
80
+ 17.0.0 (January 13, 2021)
81
+ ------
82
+ * Rails 6.1 is not yet supported [#1134](https://github.com/Shopify/shopify_app/pull/1134)
83
+
84
+ 16.1.0
85
+ ------
86
+ * Use Session Token auth strategy by default for new embedded apps [#1111](https://github.com/Shopify/shopify_app/pull/1111)
87
+ * Create optional `EnsureAuthenticatedLinks` concern to authenticate deep links using Turbolinks [#1118](https://github.com/Shopify/shopify_app/pull/1118)
88
+
89
+ 16.0.0
90
+ ------
91
+ * Update all `html.erb` and `css` files to correspond with updated store admin design language [#1102](https://github.com/Shopify/shopify_app/pull/1102)
92
+
93
+ 15.0.1
94
+ ------
95
+ * Allow JWT session token `sub` field to be parsed as a string [#1103](https://github.com/Shopify/shopify_app/pull/1103)
96
+
97
+ 15.0.0
98
+ ------
99
+ * Change `X-Shopify-API-Request-Failure-Unauthorized` HTTP header value from boolean to string
100
+
101
+ 14.4.4
102
+ ------
103
+ * Patch to not log params in ShopifyApp jobs [#1086](https://github.com/Shopify/shopify_app/pull/1086)
104
+
105
+ 14.4.3
106
+ ------
107
+ * Fix to ensure post authenticate jobs are run after callback requests [#1079](https://github.com/Shopify/shopify_app/pull/1079)
108
+
109
+ 14.4.2
110
+ ------
111
+ * Add debug logs in sessions controller
112
+
113
+ 14.4.1
114
+ ------
115
+ * Add debug logs for investigating authentication issues
116
+
117
+ 14.4.0
118
+ ------
119
+ * Replace script tags for ITP screens with data attributes
120
+
121
+ 14.3.0
122
+ ------
123
+ * Create user session if one does not exist but was expected
124
+
125
+ 14.2.0
126
+ ------
127
+ * Revert "Replace redirect calls to use App Bridge redirect functionality"
128
+
129
+ 14.1.0
130
+ ------
131
+ * Replace redirect calls to use App Bridge redirect functionality
132
+
133
+ 14.0.0
134
+ ------
135
+ * Ruby 2.4 is no longer supported by this gem
136
+ * Bump gemspec ruby dependency to 2.5
137
+ * (Beta) Add `--with-session-token` flag to the Shopify App generator to create an app that is compatible with App Bridge Authentication
138
+
139
+ 13.5.0
140
+ ------
141
+ * Add `signal_access_token_required` helper method for apps to indicate access token has expired and that a new one is required
142
+
143
+ 13.4.1
144
+ ------
145
+ * Fix the version checks for the dependency on `shopify_api` to allow all of v9.X
146
+
147
+ 13.4.0
148
+ ------
149
+ * Skip CSRF protection if a valid signed JWT token is present as we trust Shopify to be the only source that can sign it securely. [#994](https://github.com/Shopify/shopify_app/pull/994)
150
+
151
+ 13.3.0
152
+ ------
153
+ * Added Payload Verification module [#992](https://github.com/Shopify/shopify_app/pull/992)
154
+ * Add concern to check for valid shop domains in the unauthenticated controller
155
+
156
+ 13.2.0
157
+ ------
158
+ * Get current shop domain from JWT header
159
+ * Validate that the omniauth data matches the JWT data
160
+ * Persist the token information to the session store
161
+
162
+ 13.1.1
163
+ ------
164
+ * Update browser_sniffer to 1.2.2
165
+
166
+ 13.1.0
167
+ ------
168
+ * Adds the shop URL as a parameter when redirecting after the callback
169
+ * Bump minimum Ruby version to 2.4
170
+ * Bug fixes
171
+
172
+ 13.0.1
173
+ ------
174
+ * Small addition to WebhookJob to return if the shop is nil #952
175
+ * Added Rubocop to the Repo #948
176
+ * Added a WebhookVerification test helper #950
177
+ * Fix for deprecation warning while loading session storage at startup
178
+ * Changes that will allow future JWT authentication
179
+
180
+ 13.0.1
181
+ ------
182
+ * fix for deprecation warning while loading session storage at startup
183
+
184
+ 13.0.0
185
+ ------
186
+ + #887 Added concurrent user and shop session support (online/offline)
187
+ BREAKING, please see README for migration notes.
188
+
189
+ 12.0.7
190
+ ------
191
+ * Remove check for API_KEY in config that was throwing errors during install #919
192
+
193
+ 12.0.6
194
+ ------
195
+ * Adds changelog information and README updates for 8.4.0 #916
196
+
197
+ 12.0.5
198
+ ------
199
+ * Updating shopify_api gem to 9.0.1
200
+
201
+ 12.0.4
202
+ ------
203
+ * Reverts reverted PR (#895) #897
204
+
205
+ 12.0.3
206
+ ------
207
+ * Moves samesite middleware higher in the stack #898
208
+ * Fix issue where not redirecting user to granted storage page casues infinite loop #900
209
+
210
+ 12.0.2
211
+ ------
212
+ * Reverts "Fix for return_to in safari after enable_cookies/granted_storage_access" introduced in 12.0.1
213
+
214
+ 12.0.1
215
+ ------
216
+ * disable samesite cookie middleware in tests
217
+ * middleware compatibility for ruby 2.3
218
+ * samesite cookie fixes for javascript libraries
219
+ * change generators to add AppBridge instead of EASDK
220
+ * Fix for return_to in safari after enable_cookies/granted_storage_access
221
+
222
+ 12.0.0
223
+ -----
224
+ * Updating shopify_api gem to 9.0.0
225
+
226
+ 11.7.1
227
+ -----
228
+ * Fix to allow SessionStorage to be flexible on what model names that the are used for storing shop and user data
229
+
230
+ 11.7.0
231
+ -----
232
+ * Move ExtensionVerificationController from engine to app controllers, as being in the engine makes ActionController::Base get loaded before app initiates [#855](https://github.com/Shopify/shopify_app/pull/855)
233
+ * Add back per-user token support (added in 11.5.0, reverted in 11.5.1)
234
+ * If you have an override on the `self.store(auth_session)` method on your `SessionRepository` model, the method signature must be changed as according to this [change](https://github.com/Shopify/shopify_app/pull/856/files#diff-deaed2b262ec885f4e36de05621e41eaR18)
235
+
236
+ 11.6.0
237
+ -----
238
+ * Enable SameSite=None; Secure by default on all cookies for embedded apps [#851](https://github.com/Shopify/shopify_app/pull/851)
239
+ * Ensures compatibility of embedded apps with upcoming Chrome version 80 changes to cookie behaviour
240
+ * Configurable via `ShopifyApp.configuration.enable_same_site_none` (default true for embedded apps)
241
+
242
+ 11.5.1
243
+ -----
244
+ * Revert per-user token support temporarily
245
+
246
+ 11.5.0
247
+ -----
248
+ * Modularizes durable session storage
249
+ * Introduces per-user token support and user session management
250
+
251
+ 11.4.0
252
+ -----
253
+ * Remove `dotenv-rails` dependency. [#835](https://github.com/Shopify/shopify_app/pull/835)
254
+
255
+ 11.3.2
256
+ -----
257
+ * Fix hosts generator in Rails 5 [#823](https://github.com/Shopify/shopify_app/pull/823)
258
+
259
+ 11.3.1
260
+ -----
261
+ * Bump browser_sniffer version to 1.1.3 [#824](https://github.com/Shopify/shopify_app/pull/824)
262
+
263
+ 11.3.0
264
+ -----
265
+ * Update assets to be compatible with Rails 6 [#808](https://github.com/Shopify/shopify_app/pull/808)
266
+
267
+ 11.2.1
268
+ -----
269
+ * Adds ngrok whitelist in development [#802](https://github.com/Shopify/shopify_app/pull/802)
270
+
271
+ 11.2.0
272
+ -----
273
+
274
+ * Bump omniauth-shopify-oauth2 gem to v2.2.0
275
+
276
+ 11.1.0
277
+ -----
278
+
279
+ * Add Webmock and Pry as development dependencies
280
+ * Update install generator to leverage updates to ShopifyAPI::ApiVersion add in v8.0.0 of the shopify_api gem [#790](https://github.com/Shopify/shopify_app/pull/790)
281
+
282
+
283
+ 11.0.2
284
+ -----
285
+
286
+ * Lock shopify_api gem dependency to `~> 7.0` from `>= 7.0.0`.
287
+ * Remove flakey JS Tests
288
+ * bump sqlite3 development dependency to `~>1.4` from `~> 1.3.6`. [#789](https://github.com/Shopify/shopify_app/pull/789)
289
+
290
+ 11.0.1
291
+ -----
292
+
293
+ * Add dotenv-rails gem to install generator, so apps fetch credentials from `.env` by default: [#776](https://github.com/Shopify/shopify_app/pull/776)
294
+
295
+ 11.0.0
296
+ -----
297
+
298
+ * Rename `login_url` method to `login_url_with_optional_shop` to avoid ambiguity with Rails' route helper method of the
299
+ same name (see [#585](https://github.com/Shopify/shopify_app/pull/585)).
300
+
301
+ 10.0.0
302
+ -----
303
+
304
+ * Make sure OAuth-related redirects return user to originally requested URL once authenticated
305
+ * Add/update translations
306
+ * Update README to clarify nested routes
307
+ * Remove example app. Users should instead use the generators to scaffold an example app.
308
+ * Bump required Rails version to `> 5.2.1` to ensure `5.2.1.1` or greater is used. This ensures two things:
309
+ * Apps are not vulnerable to [CVE-2018-16476](https://nvd.nist.gov/vuln/detail/CVE-2018-16476)
310
+ * Webhook payloads, from Shopify for API version 2019-07, which are processed in ActiveJob background jobs (the
311
+ default behaviour of shopify_app's WebhooksController) are compatible, due to how ActiveJob versions prior to
312
+ 5.2.1.1 process GlobalIDs encoded as string in job parameters. This prevents the
313
+ [exceptions reported previously](https://github.com/Shopify/shopify_app/issues/600).
314
+
315
+ 9.0.4
316
+ -----
317
+
318
+ * Fix returning to a deep link after authentication [#746](https://github.com/Shopify/shopify_app/pull/746)
319
+
320
+ 9.0.3
321
+ -----
322
+
323
+ * Add `meta viewport` tags to fix mobile responsive problems
324
+ * Remove outdated, extraneous `yarn.lock` file (and rely on existing `package-lock.json` instead)
325
+ * Move inline js to a js asset file
326
+ * Minor documentation corrections
327
+
328
+ 9.0.2
329
+ -----
330
+
331
+ * Update browser_sniffer to fix unnecessary ITP flows in Shopify Mobile
332
+ * Add additional languages to translation.yml
333
+ * Minor documentation corrections
334
+
335
+ 9.0.1
336
+ -----
337
+
338
+ * Minor documentation corrections
339
+ * Handle `Webhook.all` returning `nil` and raising on `index_by`
340
+
341
+
342
+ 9.0.0
343
+ -----
344
+
345
+ * Breaking change: Api version support added see [migration guide](README.md#upgrading-from-86-to-900)
346
+
347
+ 8.6.1
348
+ -----
349
+
350
+ * Locked `shopify_api` gem to version < 7.0. 7.0 will have breaking changes that are incompatable with `shopify_app`
351
+
352
+ * Session storage validation for shopify_domain is now set to `case_sensitive: false`.
353
+
354
+ 8.6.0
355
+ -----
356
+
357
+ * Added an `Authenticated` concern to allow gem users to inherit from a custom `AuthenticatedController` instead of
358
+ `ShopifyApp::AuthenticatedController`
359
+
360
+ 8.5.1
361
+ -----
362
+
363
+ * Fixed a typo in RotateShopifyTokenJob
364
+
365
+ 8.5.0
366
+ -----
367
+ Added support for rotating Shopify access tokens:
368
+
369
+ * Added a generator shopify_app:rotate_shopify_token_job for generating the job to perform token rotation
370
+ * Extend Shopify app configuration to support a new and old secret token
371
+ * Extended webhook validation code to support validating against new and old secret tokens
372
+ * See the README for more details: https://github.com/Shopify/shopify_app#rotateshopifytokenjob
373
+
374
+ 8.4.2
375
+ -----
376
+ * Clear stale user session during auth callback
377
+
378
+ 8.4.1
379
+ -----
380
+ * Update README and Releasing.md
381
+ * Allow user agent to not be set
382
+ * Remove legacy EASDK examples
383
+ * Add .ruby-version file
384
+ * Clean up omniauth setup and fix examples
385
+ * Fix infinite redirect loops if users have disabled 3rd party cookies in their browser
386
+
387
+ 8.4.0
388
+ ----
389
+ * Fix embedded app session management in Safari 12.1
390
+ * Note that with this change we have extracted the callback action in its own controller. If you are relying on it, see the README for more details: https://github.com/Shopify/shopify_app#callback
391
+ * Shop names passed to OAuth are no longer case sensitive
392
+
393
+ 8.3.2
394
+ ----
395
+ * Removes `read_orders` from the default scopes provided upon app generation
396
+
397
+ 8.3.1
398
+ ----
399
+ * Adds the ability to customize the login URL through the initializer
400
+
401
+ 8.3.0
402
+ ----
403
+ * Fix embedded app session management in Safari 12
404
+ * Add support for translation platform
405
+
406
+ 8.2.6
407
+ ----
408
+ * Sanitize the shop query param to include `.myshopify.com` if no domain was provided
409
+
410
+ 8.2.5
411
+ ----
412
+ * fix iframe headers on session controller
413
+
414
+ 8.2.4
415
+ -----
416
+ * Add CSRF protection through `protect_from_forgery with: :exception` on `ShopifyApp::AuthenticatedController`
417
+
418
+ 8.2.3
419
+ -----
420
+ * Send head :forbidden instead of :unauthorized when AppProxyVerification fails
421
+
422
+ 8.2.2
423
+ -----
424
+ * Changes how the ESDK concern allows iframes. Fixes an issue with the first request for some people
425
+
426
+ 8.2.1
427
+ -----
428
+ * Bugfix: Don't logout shops from `login_again_if_different_shop` when Rails
429
+ params for a 'Shop' model are passed in [[#477]](https://github.com/Shopify/shopify_app/pull/477)
430
+
431
+ 8.2.0
432
+ -----
433
+ Known bug: Shop logged out when submitting a form for 'Shop' objects, fixed in 8.2.1 [[See #480 for details]](https://github.com/Shopify/shopify_app/issues/480)
434
+
435
+ * Add `webhook_jobs_namespace` config option. [[#463]](https://github.com/Shopify/shopify_app/pull/463)
436
+ * Updates login page styles to match the [Polaris](https://polaris.shopify.com/) design system. [[#474]](https://github.com/Shopify/shopify_app/pull/474)
437
+
438
+ 8.1.0
439
+ -----
440
+ Known bug: Shop logged out when submitting a form for 'Shop' objects, fixed in 8.2.1 [[See #480 for details]](https://github.com/Shopify/shopify_app/issues/480)
441
+
442
+ * Add support for per_user_authentication
443
+ * Pass the shop param in the session for authentication instead of a url param (prevents csrf). If you are upgrading from an older version of the gem you will need to update your omniauth.rb initializer file. Check the example app for what it what it should look like.
444
+
445
+ 8.0.0
446
+ -----
447
+ Known bug: Shop logged out when submitting a form for 'Shop' objects, fixed in 8.2.1 [[See #480 for details]](https://github.com/Shopify/shopify_app/issues/480)
448
+
449
+ * Removed the `shopify_session_repository` initializer. The SessionRepository is now configured through the main ShopifyApp configuration object and the generated initializer
450
+ * Moved InMemorySessionStore into the ShopifyApp namespace
451
+ * Remove ShopifySession concern. This module made the code internal to this engine harder to follow and we want to discourage over-writing the auth code now that we have generic hooks for all extra tasks during install.
452
+ * Changed engine controllers to subclass ActionController::Base to avoid any possible conflict with the parent application
453
+ * Removed the `ShopifyApp::Shop` concern and added its methods to `ShopifyApp::SessionStorage`. To update for this change just remove this concern anywhere it is being used in your application.
454
+ * Add `ShopifyApp::EmbeddedApp` controller concern which handles setting the required headers for the ESDK. Previously this was done by injecting configuration into applicaton.rb which affects the entire app.
455
+ * Add webhooks to generated home controller. This should help new users debug issues.
456
+
457
+ 7.4.0
458
+ -----
459
+ Known bug: Shop logged out when submitting a form for 'Shop' objects, fixed in 8.2.1 [[See #480 for details]](https://github.com/Shopify/shopify_app/issues/480)
460
+
461
+ * Add an after_authenticate job which will be run once the shop is authenticated. [[#431]](https://github.com/Shopify/shopify_app/pull/432)
462
+
463
+ 7.3.0
464
+ -----
465
+ Known bug: Shop logged out when submitting a form for 'Shop' objects, fixed in 8.2.1 [[See #480 for details]](https://github.com/Shopify/shopify_app/issues/480)
466
+
467
+ * Bump required omniauth-shopify-oauth2 version to 1.2.0.
468
+ * Always expect params[:shop] to be a string.
469
+
470
+ 7.2.11
471
+ -----
472
+ * Remove 'Logged in' flash message [[#425]](https://github.com/Shopify/shopify_app/pull/425)
473
+
474
+ 7.2.10
475
+ -----
476
+ * Fix an issue with the create_shops generator template
477
+ [[#423]](https://github.com/Shopify/shopify_app/pull/423)
478
+
479
+ 7.2.9
480
+ -----
481
+ * Remove support for Rails 4
482
+ [[#417]](https://github.com/Shopify/shopify_app/pull/417)
483
+
484
+ 7.2.8
485
+ -----
486
+ * Add i18n locale param support
487
+ [[#409]](https://github.com/Shopify/shopify_app/pull/409)
488
+
489
+
490
+ 7.2.7
491
+ -----
492
+ * Require `shopify_app` `>= 4.3.2`. This version relaxes the ruby version requirement from `>= 2.3.0` to `>= 2.0`
493
+ * Rails 5: ActionDispatch::Reloader#to_prepare is deprecated
494
+ [[#404]](https://github.com/Shopify/shopify_app/pull/404)
495
+
496
+ 7.2.6
497
+ -----
498
+ * Update LoginProtection#fullpage_redirect_to to get shopify domain from session
499
+ [[#401]](https://github.com/Shopify/shopify_app/pull/401)
500
+
501
+ 7.2.5
502
+ -----
503
+ * Update LoginProtection.redirection_javascript to work with absolute URLS
504
+ [[#389]](https://github.com/Shopify/shopify_app/pull/389)
505
+
506
+ 7.2.4
507
+ -----
508
+ * Fix redirect issue by sanitizing shop name on sessions#new
509
+
510
+ 7.2.3
511
+ -----
512
+ * Use postMessage to redirect parent iframe during authentication [[#366]](https://github.com/Shopify/shopify_app/pull/366)
513
+ * Add support for dynamically generating scripttag URLs
514
+ * Bug-fix: Update scripttags_manager_job
515
+ * Bug-fix: `--application_name` and `--scope` generates proper Configuration even when options supplied to them contain whitespaces.
516
+
517
+ 7.2.0
518
+ -----
519
+ * Disable application layout rendering for the `/login` page
520
+
521
+ 7.1.1
522
+ -----
523
+ * Lower required Ruby version to 2.2.2 to better match up with Rails 5.0
524
+
525
+ 7.1.0
526
+ -----
527
+ * Update login page copy
528
+ * Add application_name configuration option
529
+ * Add new optional App Proxy Controller Generator to the Engine. Refer README for details.
530
+ * Include ShopifyApp::LoginProtection in Authenticated and Session Controller directly instead of Application Controller.
531
+ * Loosen ShopifyAPI dependency requirements to `>= 4.2.2` and allow ShopifyAPI 4.3.0 and above.
532
+ * Move application.js to inside HEAD in Embedded App Template.
533
+ * Add ability to override the ActiveJob queue names in initializer file.
534
+
535
+ 7.0.11
536
+ ------
537
+ * Pass configured resources (like webhooks or scripttags) into the job rather than reading the config again. This allows for dynamically setting ShopifyApp config in a web request and having the job handle it correctly. This change does not affect the usage of webhooks or scripttags
538
+
539
+ 7.0.10
540
+ ------
541
+ * Loosen Rails dependency requirements to `>= 4.2.6` and allow Rails 5.0
542
+ * Add support for App Proxies
543
+
544
+ 7.0.9
545
+ -----
546
+
547
+ * Remove http-equiv meta tag as it causes OAuth issues in Chrome
548
+
549
+ 7.0.5
550
+ -----
551
+
552
+ * Remove obtrusive “Continue” text in redirects
553
+
554
+ 7.0.4
555
+ -----
556
+
557
+ * Bump required shopify_api version to 4.x.
558
+
559
+ 7.0.3
560
+ -----
561
+
562
+ * Bump required Rails version to `>= 4.2.6` since we are now using `ActiveSupport::SecurityUtils:Module`
563
+
564
+ 7.0.2
565
+ -----
566
+
567
+ * Fix CSRF redirect issue
568
+
569
+ 7.0.1
570
+ -----
571
+
572
+ * add support to i18n for flash messages (English and Spanish).
573
+
574
+ 7.0.0
575
+ -----
576
+
577
+ * rename WebhooksController module to WebhookVerification
578
+ * added a WebhooksController which automatically delegates to jobs
579
+ * moved all engine controllers under the ShopifyApp namespace
580
+ * rename SessionsController module to SessionsConcern
581
+ * more robust redirects, with valid HTML in HTTP response bodies
582
+ * `ShopifyApp::Controller` has been removed. You’ll need to replace all includes of `ShopifyApp::Controller` with `ShopifyApp::LoginProtection`
583
+ * adds add_webhook generator to make it easier to add new webhooks to your app
584
+ * update the install generator to use standard rails generate arguments, usage has changed from `-api_key=your_key` to `--api_key your_key`
585
+ * remove the redirect uri - this is done automatically inside omniauth now
586
+
587
+ 6.4.2
588
+ -----
589
+
590
+ * Update minimum required rails version to 4.2 to include active job
591
+
592
+ 6.4.0
593
+ -----
594
+
595
+ * More semantic and accessible markup in the sessions/new, embedded_app, and product
596
+ index views.
597
+ * Moved all JavaScript to load at the bottom of the page instead of the head, for
598
+ page loading better performance.
599
+
600
+ 6.3.0
601
+ -----
602
+
603
+ * Move SessionStorage from a generated class to a re-usable module. To
604
+ migrate to the new module, delete the old generated SessionStorage class
605
+ in the models directory and include the SessionStorage module in your Shop model.
606
+ * Adds a WebhooksManager class and allows you to configure what webhooks your app
607
+ needs. The rest is taken care of by ShopifyApp provided you set up a backgroud queue
608
+ with ActiveJob
609
+ * Adds a WebhooksController module which can be included to handle the boiler plate code
610
+ for a controller receiving webhooks from Shopify
611
+
612
+ 6.2.1
613
+ -----
614
+
615
+ * add callback url to omniauth provider
616
+ * add default redirect_uri
617
+
618
+ 6.2.0
619
+ -----
620
+
621
+ * Return an HTTP 401 for XHRs that aren't logged in
622
+
623
+ 6.1.3
624
+ -----
625
+ * add redirect_uri which is now required
626
+ * fix login again with different shop
627
+
628
+ 6.0.0
629
+ -----
630
+ * Re-written as a proper rails engine
631
+ * New modular generators
632
+ * generates embedded apps by default
633
+ * can bootstrap your app with a standard shop table and model
634
+ * code now lives as concerns in the engine which are included in your controllers
635
+ feel free to override anything you need in your app
636
+
637
+ Historical
638
+ ----------
639
+ * re-styled with Twitter Bootstrap css framework and updated docs [warren]
640
+ * Require shopify_api gem via proper railtie setup [willem]
641
+ * Don't require shopify.yml when using environment variables [cody]
642
+ * Renamed instances of current_shop to shop_session to maintain logic
643
+ * Replace old LoginController with a RESTful SessionsController
data/CHANGELOG.md ADDED
@@ -0,0 +1,6 @@
1
+
2
+ 1.0.0
3
+ -----
4
+
5
+ * Keep using ShopifyAPI the old way. (Fork from Shopify's v18.1.2)
6
+