shopify_api 14.2.0 → 14.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58a7734df66af05601ae989f099fa50ad862bc60ded39ee711ec17a72e4ab1c5
-  data.tar.gz: ad5c4b5724ce8defa5058df1b59f743cebf834e425f75620070e304d9d274655
+  metadata.gz: 0f2fd17eb9b42d6054e8b676c5d446cbc9890b7156f5c4b402a5efb776ad1421
+  data.tar.gz: 1deefc0fdcc79f57b70fb1fbeb2072916847b8d68c614b4b150dafd86f0ff6d5
 SHA512:
-  metadata.gz: 29330b758a67691c6724cd78adfabf9b23466eccf6030510b0035d7e2ca0ea39fbc2eead5b6e2d53f8047aa137373ce8f2c402b71e06bd622208ccc24a34fb7d
-  data.tar.gz: 761253df5dbecfda0b33f4b4eb891d33536cc9489398bb0cb64f637912cdd346e2ab48fb8490e5e32d5e7c837c69dded7fb17af1eef412ed3253dba4446ea1b7
+  metadata.gz: 3cfdd1a407afb83e8557d607c65dd74322a7ca944fe58b2b42d68a911917442f51c78a0a7e59759a4fca59ae063c7af253ad8a297614a409621c52e0baf60ee6
+  data.tar.gz: e218a6a5c77d9de8e3b0a755c0bcb1b4941bb5cfba503564ffa4ca0a59c19b76e8c0cb56cb1ee458091bd43004fa3b16c200fa4696b058a0b90c9c3475bd37d0

data/CHANGELOG.md

@@ -4,6 +4,16 @@ Note: For changes to the API, see https://shopify.dev/changelog?filter=api
 
 ## Unreleased
 
+## 14.3.0
+- [#1312](https://github.com/Shopify/shopify-api-ruby/pull/1312) Use same leeway for `exp` and `nbf` when parsing JWT
+- [#1314](https://github.com/Shopify/shopify-api-ruby/pull/1314)
+  - Add new session util method `SessionUtils::session_id_from_shopify_id_token`
+  - `SessionUtils::current_session_id` now accepts shopify Id token in the format of `Bearer this_token` or just `this_token`
+- [#1315](https://github.com/Shopify/shopify-api-ruby/pull/1315) Add helper/alias methods to `ShopifyAPI::Auth::JwtPayload`:
+  - `shopify_domain` alias for `shop` - returns the sanitized shop domain
+  - `shopify_user_id` - returns the user Id (`sub`) as an Integer value
+  - `expires_at` alias for `exp` - returns the expiration time
+
 ## 14.2.0
 - [#1309](https://github.com/Shopify/shopify-api-ruby/pull/1309) Add `Session#copy_attributes_from` method
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_api (14.2.0)
+    shopify_api (14.3.0)
       activesupport
       concurrent-ruby
       hash_diff

data/docs/getting_started.md

@@ -46,13 +46,28 @@ Session persistence is handled by the [ShopifyApp](https://github.com/Shopify/sh
 #### Cookie
 Cookie based authentication is not supported for embedded apps due to browsers dropping support for third party cookies due to security concerns. Non-embedded apps are able to use cookies for session storage/retrieval.
 
-For *non-embedded* apps, you can pass the cookies into `ShopifyAPI::Utils::SessionUtils.current_session_id(nil, cookies, true)` for online (user) sessions or `ShopifyAPI::Utils::SessionUtils.current_session_id(nil, cookies, false)` for offline (store) sessions.
+For *non-embedded* apps, you can pass the cookies into:
+ - `ShopifyAPI::Utils::SessionUtils.current_session_id(nil, cookies, true)` for online (user) sessions or
+ - `ShopifyAPI::Utils::SessionUtils.current_session_id(nil, cookies, false)` for offline (store) sessions.
 
 #### Getting Session ID From Embedded Requests
-For *embedded* apps, you can pass the auth header into `ShopifyAPI::Utils::SessionUtils.current_session_id(auth_header, nil, true)` for online (user) sessions or `ShopifyAPI::Utils::SessionUtils.current_session_id(auth_header, nil, false)` for offline (store) sessions. This function needs an `auth_header` which is the `HTTP_AUTHORIZATION` header.
 
 If your app uses client side rendering instead of server side rendering, you will need to use App Bridge's [authenticatedFetch](https://shopify.dev/docs/apps/auth/oauth/session-tokens/getting-started) to make authenticated API requests from the client.
 
+For *embedded* apps:
+
+If you have an `HTTP_AUTHORIZATION` header or `id_token` from the request URL params , you can pass that as `shopify_id_token` into:
+- `ShopifyAPI::Utils::SessionUtils.current_session_id(shopify_id_token, nil, true)` for online (user) sessions or
+- `ShopifyAPI::Utils::SessionUtils.current_session_id(shopify_id_token, nil, false)` for offline (store) sessions.
+
+`current_session_id` accepts shopify_id_token in the format of `Bearer this_token` or just `this_token`.
+
+You can also use this method to get session ID:
+- `ShopifyAPI::Utils::SessionUtils::session_id_from_shopify_id_token(id_token: id_token, online: true)` for online (user) sessions or
+- `ShopifyAPI::Utils::SessionUtils::session_id_from_shopify_id_token(id_token: id_token, online: false)` for offline (store) sessions.
+
+`session_id_from_shopify_id_token` does **NOT** accept shopify_id_token in the format of `Bearer this_token`, you must pass in `this_token`.
+
 #### Start Making Authenticated Shopify Requests
 
 You can now start making authenticated Shopify API calls using the Admin [REST](usage/rest.md) or [GraphQL](usage/graphql.md) Clients or the [Storefront GraphQL Client](usage/graphql_storefront.md).

data/lib/shopify_api/auth/jwt_payload.rb

@@ -6,7 +6,8 @@ module ShopifyAPI
     class JwtPayload
       extend T::Sig
 
-      JWT_EXPIRATION_LEEWAY = 10
+      JWT_LEEWAY = 10
+      JWT_EXPIRATION_LEEWAY = JWT_LEEWAY
 
       sig { returns(String) }
       attr_reader :iss, :dest, :aud, :sub, :jti, :sid
@@ -14,6 +15,8 @@ module ShopifyAPI
       sig { returns(Integer) }
       attr_reader :exp, :nbf, :iat
 
+      alias_method :expire_at, :exp
+
       sig { params(token: String).void }
       def initialize(token)
         payload_hash = begin
@@ -42,6 +45,12 @@ module ShopifyAPI
       def shop
         @dest.gsub("https://", "")
       end
+      alias_method :shopify_domain, :shop
+
+      sig { returns(Integer) }
+      def shopify_user_id
+        @sub.to_i
+      end
 
       # TODO: Remove before releasing v11
       sig { params(shop: String).returns(T::Boolean) }
@@ -73,8 +82,7 @@ module ShopifyAPI
 
       sig { params(token: String, api_secret_key: String).returns(T::Hash[String, T.untyped]) }
       def decode_token(token, api_secret_key)
-        JWT.decode(token, api_secret_key, true,
-          { exp_leeway: JWT_EXPIRATION_LEEWAY, algorithm: "HS256" })[0]
+        JWT.decode(token, api_secret_key, true, leeway: JWT_LEEWAY, algorithm: "HS256")[0]
       rescue JWT::DecodeError => err
         raise ShopifyAPI::Errors::InvalidJwtTokenError, "Error decoding session token: #{err.message}"
       end

data/lib/shopify_api/utils/session_utils.rb

@@ -11,28 +11,16 @@ module ShopifyAPI
 
         sig do
           params(
-            auth_header: T.nilable(String),
+            shopify_id_token: T.nilable(String),
             cookies: T.nilable(T::Hash[String, String]),
             online: T::Boolean,
           ).returns(T.nilable(String))
         end
-        def current_session_id(auth_header, cookies, online)
+        def current_session_id(shopify_id_token, cookies, online)
           if Context.embedded?
-            if auth_header
-              matches = auth_header.match(/^Bearer (.+)$/)
-              unless matches
-                ShopifyAPI::Logger.warn("Missing Bearer token in authorization header")
-                raise Errors::MissingJwtTokenError, "Missing Bearer token in authorization header"
-              end
-
-              jwt_payload = Auth::JwtPayload.new(T.must(matches[1]))
-              shop = jwt_payload.shop
-
-              if online
-                jwt_session_id(shop, jwt_payload.sub)
-              else
-                offline_session_id(shop)
-              end
+            if shopify_id_token
+              id_token = shopify_id_token.gsub("Bearer ", "")
+              session_id_from_shopify_id_token(id_token: id_token, online: online)
             else
               # falling back to session cookie
               raise Errors::CookieNotFoundError, "JWT token or Session cookie not found for app" unless
@@ -48,6 +36,25 @@ module ShopifyAPI
           end
         end
 
+        sig do
+          params(
+            id_token: T.nilable(String),
+            online: T::Boolean,
+          ).returns(String)
+        end
+        def session_id_from_shopify_id_token(id_token:, online:)
+          raise Errors::MissingJwtTokenError, "Missing Shopify ID Token" if id_token.nil? || id_token.empty?
+
+          payload = Auth::JwtPayload.new(id_token)
+          shop = payload.shop
+
+          if online
+            jwt_session_id(shop, payload.sub)
+          else
+            offline_session_id(shop)
+          end
+        end
+
         sig { params(shop: String, user_id: String).returns(String) }
         def jwt_session_id(shop, user_id)
           "#{shop}_#{user_id}"

data/lib/shopify_api/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module ShopifyAPI
-  VERSION = "14.2.0"
+  VERSION = "14.3.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_api
 version: !ruby/object:Gem::Version
-  version: 14.2.0
+  version: 14.3.0
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-04-15 00:00:00.000000000 Z
+date: 2024-04-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport