shopify_api 1.0.4 → 12.3.0

data/lib/shopify_api/auth/file_session_storage.rb

@@ -0,0 +1,72 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "fileutils"
+
+module ShopifyAPI
+  module Auth
+    class FileSessionStorage
+      extend T::Sig
+      extend T::Helpers
+      include ShopifyAPI::Auth::SessionStorage
+
+      sig { returns(String) }
+      attr_accessor :path
+
+      sig { params(path: String).void }
+      def initialize(path: "/tmp/shopify_api_sessions")
+        @path = path
+        FileUtils.mkdir_p(path) unless Dir.exist?(path)
+      end
+
+      sig do
+        override.params(session: Session)
+          .returns(T::Boolean)
+      end
+      def store_session(session)
+        File.write(session_file_path(session.id), session.serialize) > 0
+      end
+
+      sig do
+        override.params(id: String)
+          .returns(T.nilable(Session))
+      end
+      def load_session(id)
+        session_path = session_file_path(id)
+        if File.exist?(session_path)
+          ShopifyAPI::Auth::Session.deserialize(File.read(session_path))
+        end
+      end
+
+      sig do
+        override.params(id: String)
+          .returns(T::Boolean)
+      end
+      def delete_session(id)
+        session_path = session_file_path(id)
+        File.delete(session_path) if File.exist?(session_path)
+        true
+      end
+
+      alias_method :eql?, :==
+      sig { params(other: T.nilable(FileSessionStorage)).returns(T::Boolean) }
+      def ==(other)
+        if other
+          @path == other.path
+        else
+          false
+        end
+      end
+
+      private
+
+      sig do
+        params(id: String)
+          .returns(String)
+      end
+      def session_file_path(id)
+        "#{@path}/#{id}"
+      end
+    end
+  end
+end

data/lib/shopify_api/auth/jwt_payload.rb

@@ -0,0 +1,83 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    class JwtPayload
+      extend T::Sig
+
+      JWT_EXPIRATION_LEEWAY = 10
+
+      sig { returns(String) }
+      attr_reader :iss, :dest, :aud, :sub, :jti, :sid
+
+      sig { returns(Integer) }
+      attr_reader :exp, :nbf, :iat
+
+      sig { params(token: String).void }
+      def initialize(token)
+        payload_hash = begin
+          decode_token(token, Context.api_secret_key)
+        rescue ShopifyAPI::Errors::InvalidJwtTokenError
+          raise unless Context.old_api_secret_key
+
+          decode_token(token, T.must(Context.old_api_secret_key))
+        end
+
+        @iss = T.let(payload_hash["iss"], String)
+        @dest = T.let(payload_hash["dest"], String)
+        @aud = T.let(payload_hash["aud"], String)
+        @sub = T.let(payload_hash["sub"], String)
+        @exp = T.let(payload_hash["exp"], Integer)
+        @nbf = T.let(payload_hash["nbf"], Integer)
+        @iat = T.let(payload_hash["iat"], Integer)
+        @jti = T.let(payload_hash["jti"], String)
+        @sid = T.let(payload_hash["sid"], String)
+
+        raise ShopifyAPI::Errors::InvalidJwtTokenError,
+          "Session token had invalid API key" unless @aud == Context.api_key
+      end
+
+      sig { returns(String) }
+      def shop
+        @dest.gsub("https://", "")
+      end
+
+      # TODO: Remove before releasing v11
+      sig { params(shop: String).returns(T::Boolean) }
+      def validate_shop(shop)
+        Context.logger.warn(
+          "Deprecation notice: ShopifyAPI::Auth::JwtPayload.validate_shop no longer checks the given shop and always " \
+            "returns true. It will be removed in v11.",
+        )
+        true
+      end
+
+      alias_method :eql?, :==
+      sig { params(other: T.nilable(JwtPayload)).returns(T::Boolean) }
+      def ==(other)
+        return false unless other
+
+        iss == other.iss &&
+          dest == other.dest &&
+          aud == other.aud &&
+          sub == other.sub &&
+          exp == other.exp &&
+          nbf == other.nbf &&
+          iat == other.iat &&
+          jti == other.jti &&
+          sid == other.sid
+      end
+
+      private
+
+      sig { params(token: String, api_secret_key: String).returns(T::Hash[String, T.untyped]) }
+      def decode_token(token, api_secret_key)
+        JWT.decode(token, api_secret_key, true,
+          { exp_leeway: JWT_EXPIRATION_LEEWAY, algorithm: "HS256" })[0]
+      rescue
+        raise ShopifyAPI::Errors::InvalidJwtTokenError, "Failed to parse session token '#{token}'"
+      end
+    end
+  end
+end

data/lib/shopify_api/auth/oauth/auth_query.rb

@@ -0,0 +1,47 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    module Oauth
+      class AuthQuery
+        extend T::Sig
+        include Utils::VerifiableQuery
+
+        sig { returns(String) }
+        attr_reader :code, :host, :hmac, :shop, :state, :timestamp
+
+        sig do
+          params(
+            code: String,
+            shop: String,
+            timestamp: String,
+            state: String,
+            host: String,
+            hmac: String,
+          ).void
+        end
+        def initialize(code:, shop:, timestamp:, state:, host:, hmac:)
+          @code = code
+          @shop = shop
+          @timestamp = timestamp
+          @state = state
+          @host = host
+          @hmac = hmac
+        end
+
+        sig { override.returns(String) }
+        def to_signable_string
+          params = {
+            code: code,
+            host: host,
+            shop: shop,
+            state: state,
+            timestamp: timestamp,
+          }
+          URI.encode_www_form(params)
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/auth/oauth/session_cookie.rb

@@ -0,0 +1,28 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    module Oauth
+      class SessionCookie < T::Struct
+        extend T::Sig
+
+        SESSION_COOKIE_NAME = "shopify_app_session"
+
+        const :name, String, default: SESSION_COOKIE_NAME
+        const :value, String
+        const :expires, T.nilable(Time)
+
+        alias_method :eql?, :==
+        sig { params(other: T.nilable(SessionCookie)).returns(T::Boolean) }
+        def ==(other)
+          return false unless other
+
+          name == other.name &&
+            value == other.value &&
+            expires == other.expires
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/auth/oauth.rb

@@ -0,0 +1,135 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    module Oauth
+      extend T::Sig
+
+      NONCE_LENGTH = 15
+
+      class << self
+        extend T::Sig
+
+        sig do
+          params(
+            shop: String,
+            redirect_path: String,
+            is_online: T.nilable(T::Boolean),
+            scope_override: T.nilable(T.any(ShopifyAPI::Auth::AuthScopes, T::Array[String], String)),
+          ).returns(T::Hash[Symbol, T.any(String, SessionCookie)])
+        end
+        def begin_auth(shop:, redirect_path:, is_online: true, scope_override: nil)
+          scope = if scope_override.nil?
+            ShopifyAPI::Context.scope
+          elsif scope_override.is_a?(ShopifyAPI::Auth::AuthScopes)
+            scope_override
+          else
+            ShopifyAPI::Auth::AuthScopes.new(scope_override)
+          end
+
+          unless Context.setup?
+            raise Errors::ContextNotSetupError, "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
+          end
+          raise Errors::UnsupportedOauthError, "Cannot perform OAuth for private apps." if Context.private?
+
+          state = SecureRandom.alphanumeric(NONCE_LENGTH)
+
+          cookie = SessionCookie.new(value: state, expires: Time.now + 60)
+
+          query = {
+            client_id: ShopifyAPI::Context.api_key,
+            scope: scope.to_s,
+            redirect_uri: "#{ShopifyAPI::Context.host}#{redirect_path}",
+            state: state,
+            "grant_options[]": is_online ? "per-user" : "",
+          }
+
+          query_string = URI.encode_www_form(query)
+
+          auth_route = "https://#{shop}/admin/oauth/authorize?#{query_string}"
+          { auth_route: auth_route, cookie: cookie }
+        end
+
+        sig do
+          params(
+            cookies: T::Hash[String, String],
+            auth_query: AuthQuery,
+          ).returns(T::Hash[Symbol, T.any(Session, SessionCookie)])
+        end
+        def validate_auth_callback(cookies:, auth_query:)
+          unless Context.setup?
+            raise Errors::ContextNotSetupError, "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
+          end
+          raise Errors::InvalidOauthError, "Invalid OAuth callback." unless Utils::HmacValidator.validate(auth_query)
+          raise Errors::UnsupportedOauthError, "Cannot perform OAuth for private apps." if Context.private?
+
+          state = cookies[SessionCookie::SESSION_COOKIE_NAME]
+          raise Errors::NoSessionCookieError unless state
+
+          raise Errors::InvalidOauthError,
+            "Invalid state in OAuth callback." unless state == auth_query.state
+
+          # TODO: replace this call with the HTTP client once it is built
+          body = { client_id: Context.api_key, client_secret: Context.api_secret_key, code: auth_query.code }
+          response = HTTParty.post("https://#{auth_query.shop}/admin/oauth/access_token", body: body)
+          unless response.ok?
+            raise Errors::RequestAccessTokenError,
+              "Cannot complete OAuth process. Received a #{response.code} error while requesting access token."
+          end
+          session_params = response.to_h
+
+          session = create_new_session(session_params, auth_query.shop)
+
+          cookie = if Context.embedded?
+            SessionCookie.new(
+              value: "",
+              expires: Time.now,
+            )
+          else
+            SessionCookie.new(
+              value: session.id,
+              expires: session.online? ? session.expires : nil,
+            )
+          end
+
+          Context.session_storage&.store_session(session)
+
+          { session: session, cookie: cookie }
+        end
+
+        private
+
+        sig { params(session_params: T::Hash[String, T.untyped], shop: String).returns(Session) }
+        def create_new_session(session_params, shop)
+          session_params = session_params.to_h { |k, v| [k.to_sym, v] }
+
+          scope = session_params[:scope]
+
+          is_online = !session_params[:associated_user].nil?
+
+          if is_online
+            associated_user = AssociatedUser.new(session_params[:associated_user].to_h { |k, v| [k.to_sym, v] })
+            expires = Time.now + session_params[:expires_in].to_i
+            associated_user_scope = session_params[:associated_user_scope]
+            id = "#{shop}_#{associated_user.id}"
+          else
+            id = "offline_#{shop}"
+          end
+
+          Session.new(
+            id: id,
+            shop: shop,
+            access_token: session_params[:access_token],
+            scope: scope,
+            is_online: is_online,
+            associated_user_scope: associated_user_scope,
+            associated_user: associated_user,
+            expires: expires,
+            shopify_session_id: session_params[:session],
+          )
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/auth/session.rb

@@ -0,0 +1,119 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    class Session
+      extend T::Sig
+
+      sig { returns(String) }
+      attr_reader :id
+
+      sig { returns(T.nilable(String)) }
+      attr_accessor :state, :access_token
+
+      sig { returns(String) }
+      attr_accessor :shop
+
+      sig { returns(AuthScopes) }
+      attr_accessor :scope
+
+      sig { returns(T.nilable(AuthScopes)) }
+      attr_accessor :associated_user_scope
+
+      sig { returns(T.nilable(Time)) }
+      attr_accessor :expires
+
+      sig { returns(T.nilable(AssociatedUser)) }
+      attr_accessor :associated_user
+
+      sig { returns(T.nilable(String)) }
+      attr_accessor :shopify_session_id
+
+      sig { returns(T::Boolean) }
+      def online?
+        @is_online
+      end
+
+      sig do
+        params(
+          shop: String,
+          id: T.nilable(String),
+          state: T.nilable(String),
+          access_token: T.nilable(String),
+          scope: T.any(T::Array[String], String),
+          associated_user_scope: T.nilable(T.any(T::Array[String], String)),
+          expires: T.nilable(Time),
+          is_online: T.nilable(T::Boolean),
+          associated_user: T.nilable(AssociatedUser),
+          shopify_session_id: T.nilable(String),
+        ).void
+      end
+      def initialize(shop:, id: nil, state: nil, access_token: "", scope: [], associated_user_scope: nil, expires: nil,
+        is_online: nil, associated_user: nil, shopify_session_id: nil)
+        @id = T.let(id || SecureRandom.uuid, String)
+        @shop = shop
+        @state = state
+        @access_token = access_token
+        @scope = T.let(AuthScopes.new(scope), AuthScopes)
+        @associated_user_scope = T.let(
+          associated_user_scope.nil? ? nil : AuthScopes.new(associated_user_scope), T.nilable(AuthScopes)
+        )
+        @expires = expires
+        @associated_user = associated_user
+        @is_online = T.let(is_online || !associated_user.nil?, T::Boolean)
+        @shopify_session_id = shopify_session_id
+      end
+
+      class << self
+        extend T::Sig
+
+        sig do
+          params(shop: String, access_token: String,
+            blk: T.proc.params(arg0: Session).returns(T.untyped)).returns(T.untyped)
+        end
+        def temp(shop:, access_token:, &blk)
+          original_session = Context.active_session
+          temp_session = Session.new(shop: shop, access_token: access_token)
+
+          begin
+            Context.activate_session(temp_session)
+            yield temp_session
+          ensure
+            Context.activate_session(original_session)
+          end
+        end
+
+        sig { params(str: String).returns(Session) }
+        def deserialize(str)
+          Oj.load(str)
+        end
+      end
+
+      sig { returns(String) }
+      def serialize
+        Oj.dump(self)
+      end
+
+      alias_method :eql?, :==
+      sig { params(other: T.nilable(Session)).returns(T::Boolean) }
+      def ==(other)
+        if other
+          (
+            id == other.id &&
+            shop == other.shop &&
+            state == other.state &&
+            scope == other.scope &&
+            associated_user_scope == other.associated_user_scope &&
+            (!(expires.nil? ^ other.expires.nil?) && (expires.nil? || expires.to_i == other.expires.to_i)) &&
+            online? == other.online? &&
+            associated_user == other.associated_user &&
+            shopify_session_id == other.shopify_session_id
+          )
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/auth/session_storage.rb

@@ -0,0 +1,30 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    module SessionStorage
+      extend T::Sig
+      extend T::Helpers
+      interface!
+
+      sig do
+        abstract.params(session: Session)
+          .returns(T::Boolean)
+      end
+      def store_session(session); end
+
+      sig do
+        abstract.params(id: String)
+          .returns(T.nilable(Session))
+      end
+      def load_session(id); end
+
+      sig do
+        abstract.params(id: String)
+          .returns(T::Boolean)
+      end
+      def delete_session(id); end
+    end
+  end
+end

data/lib/shopify_api/auth.rb

@@ -0,0 +1,26 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    extend T::Sig
+
+    class << self
+      extend T::Sig
+
+      sig { params(host: T.nilable(String)).returns(String) }
+      def embedded_app_url(host)
+        unless Context.setup?
+          raise Errors::ContextNotSetupError, "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
+        end
+
+        unless host
+          raise Errors::MissingRequiredArgumentError, "host argument is required"
+        end
+
+        decoded_host = Base64.decode64(host)
+        "https://#{decoded_host}/apps/#{Context.api_key}"
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/graphql/admin.rb

@@ -0,0 +1,15 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    module Graphql
+      class Admin < Client
+        sig { params(session: T.nilable(Auth::Session)).void }
+        def initialize(session:)
+          super(session: session, base_path: "/admin/api")
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/graphql/client.rb

@@ -0,0 +1,40 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    module Graphql
+      class Client
+        extend T::Sig
+
+        sig { params(session: T.nilable(Auth::Session), base_path: String).void }
+        def initialize(session:, base_path:)
+          @http_client = T.let(HttpClient.new(session: session, base_path: base_path), HttpClient)
+        end
+
+        sig do
+          params(
+            query: String,
+            variables: T.nilable(T::Hash[T.any(Symbol, String), T.untyped]),
+            headers: T.nilable(T::Hash[T.any(Symbol, String), T.untyped]),
+            tries: Integer,
+          ).returns(HttpResponse)
+        end
+        def query(query:, variables: nil, headers: nil, tries: 1)
+          body = { query: query, variables: variables }
+          @http_client.request(
+            HttpRequest.new(
+              http_method: :post,
+              path: "#{Context.api_version}/graphql.json",
+              body: body,
+              query: nil,
+              extra_headers: headers,
+              body_type: "application/json",
+              tries: tries,
+            ),
+          )
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/graphql/storefront.rb

@@ -0,0 +1,35 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    module Graphql
+      class Storefront < Client
+        sig { params(shop: String, storefront_access_token: String).void }
+        def initialize(shop, storefront_access_token)
+          session = Auth::Session.new(
+            id: shop,
+            shop: shop,
+            access_token: "",
+            is_online: false,
+          )
+          super(session: session, base_path: "/api")
+          @storefront_access_token = storefront_access_token
+        end
+
+        sig do
+          params(
+            query: String,
+            variables: T.nilable(T::Hash[T.any(Symbol, String), T.untyped]),
+            headers: T.nilable(T::Hash[T.any(Symbol, String), T.untyped]),
+            tries: Integer,
+          ).returns(HttpResponse)
+        end
+        def query(query:, variables: nil, headers: {}, tries: 1)
+          T.must(headers).merge!({ "X-Shopify-Storefront-Access-Token": @storefront_access_token })
+          super(query: query, variables: variables, headers: headers, tries: tries)
+        end
+      end
+    end
+  end
+end