shopify_api 16.1.0 → 16.3.0

data/lib/shopify_api/rest/resources/2026_07/variant.rb

@@ -0,0 +1,212 @@
+# typed: false
+# frozen_string_literal: true
+
+########################################################################################################################
+# This file is auto-generated. If you have an issue, please create a GitHub issue.                                     #
+########################################################################################################################
+
+module ShopifyAPI
+  class Variant < ShopifyAPI::Rest::Base
+    extend T::Sig
+
+    @prev_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @next_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    @api_call_limit = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @retry_request_after = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    sig { params(session: T.nilable(ShopifyAPI::Auth::Session), from_hash: T.nilable(T::Hash[T.untyped, T.untyped])).void }
+    def initialize(session: ShopifyAPI::Context.active_session, from_hash: nil)
+
+      @barcode = T.let(nil, T.nilable(String))
+      @compare_at_price = T.let(nil, T.nilable(String))
+      @created_at = T.let(nil, T.nilable(String))
+      @fulfillment_service = T.let(nil, T.nilable(String))
+      @grams = T.let(nil, T.nilable(Integer))
+      @id = T.let(nil, T.nilable(Integer))
+      @image_id = T.let(nil, T.nilable(Integer))
+      @inventory_item_id = T.let(nil, T.nilable(Integer))
+      @inventory_management = T.let(nil, T.nilable(String))
+      @inventory_policy = T.let(nil, T.nilable(String))
+      @inventory_quantity = T.let(nil, T.nilable(T.any(Integer, String)))
+      @old_inventory_quantity = T.let(nil, T.nilable(T.any(Integer, String)))
+      @option = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
+      @position = T.let(nil, T.nilable(Integer))
+      @presentment_prices = T.let(nil, T.nilable(T::Array[T.untyped]))
+      @price = T.let(nil, T.nilable(String))
+      @product_id = T.let(nil, T.nilable(Integer))
+      @requires_shipping = T.let(nil, T.nilable(T::Boolean))
+      @sku = T.let(nil, T.nilable(String))
+      @tax_code = T.let(nil, T.nilable(String))
+      @taxable = T.let(nil, T.nilable(T::Boolean))
+      @title = T.let(nil, T.nilable(String))
+      @updated_at = T.let(nil, T.nilable(String))
+      @weight = T.let(nil, T.nilable(Float))
+      @weight_unit = T.let(nil, T.nilable(String))
+
+      super(session: session, from_hash: from_hash)
+    end
+
+    @has_one = T.let({}, T::Hash[Symbol, Class])
+    @has_many = T.let({}, T::Hash[Symbol, Class])
+    @paths = T.let([
+      {http_method: :delete, operation: :delete, ids: [:product_id, :id], path: "products/<product_id>/variants/<id>.json"},
+      {http_method: :get, operation: :count, ids: [:product_id], path: "products/<product_id>/variants/count.json"},
+      {http_method: :get, operation: :get, ids: [:product_id], path: "products/<product_id>/variants.json"},
+      {http_method: :get, operation: :get, ids: [:id], path: "variants/<id>.json"},
+      {http_method: :post, operation: :post, ids: [:product_id], path: "products/<product_id>/variants.json"},
+      {http_method: :put, operation: :put, ids: [:id], path: "variants/<id>.json"}
+    ], T::Array[T::Hash[String, T.any(T::Array[Symbol], String, Symbol)]])
+    @read_only_attributes = T.let([
+      :inventory_quantity
+    ], T::Array[Symbol])
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :barcode
+    sig { returns(T.nilable(String)) }
+    attr_reader :compare_at_price
+    sig { returns(T.nilable(String)) }
+    attr_reader :created_at
+    sig { returns(T.nilable(String)) }
+    attr_reader :fulfillment_service
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :grams
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :id
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :image_id
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :inventory_item_id
+    sig { returns(T.nilable(String)) }
+    attr_reader :inventory_management
+    sig { returns(T.nilable(String)) }
+    attr_reader :inventory_policy
+    sig { returns(T.nilable(T.any(Integer, String))) }
+    attr_reader :inventory_quantity
+    sig { returns(T.nilable(T.any(Integer, String))) }
+    attr_reader :old_inventory_quantity
+    sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+    attr_reader :option
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :position
+    sig { returns(T.nilable(T::Array[T::Hash[T.untyped, T.untyped]])) }
+    attr_reader :presentment_prices
+    sig { returns(T.nilable(String)) }
+    attr_reader :price
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :product_id
+    sig { returns(T.nilable(T::Boolean)) }
+    attr_reader :requires_shipping
+    sig { returns(T.nilable(String)) }
+    attr_reader :sku
+    sig { returns(T.nilable(String)) }
+    attr_reader :tax_code
+    sig { returns(T.nilable(T::Boolean)) }
+    attr_reader :taxable
+    sig { returns(T.nilable(String)) }
+    attr_reader :title
+    sig { returns(T.nilable(String)) }
+    attr_reader :updated_at
+    sig { returns(T.nilable(Float)) }
+    attr_reader :weight
+    sig { returns(T.nilable(String)) }
+    attr_reader :weight_unit
+
+    class << self
+      sig do
+        params(
+          id: T.any(Integer, String),
+          fields: T.untyped,
+          session: Auth::Session
+        ).returns(T.nilable(Variant))
+      end
+      def find(
+        id:,
+        fields: nil,
+        session: ShopifyAPI::Context.active_session
+      )
+        result = base_find(
+          session: session,
+          ids: {id: id},
+          params: {fields: fields},
+        )
+        T.cast(result[0], T.nilable(Variant))
+      end
+
+      sig do
+        params(
+          id: T.any(Integer, String),
+          product_id: T.nilable(T.any(Integer, String)),
+          session: Auth::Session
+        ).returns(T.untyped)
+      end
+      def delete(
+        id:,
+        product_id: nil,
+        session: ShopifyAPI::Context.active_session
+      )
+        request(
+          http_method: :delete,
+          operation: :delete,
+          session: session,
+          ids: {id: id, product_id: product_id},
+          params: {},
+        )
+      end
+
+      sig do
+        params(
+          product_id: T.nilable(T.any(Integer, String)),
+          limit: T.untyped,
+          presentment_currencies: T.untyped,
+          since_id: T.untyped,
+          fields: T.untyped,
+          session: Auth::Session,
+          kwargs: T.untyped
+        ).returns(T::Array[Variant])
+      end
+      def all(
+        product_id: nil,
+        limit: nil,
+        presentment_currencies: nil,
+        since_id: nil,
+        fields: nil,
+        session: ShopifyAPI::Context.active_session,
+        **kwargs
+      )
+        response = base_find(
+          session: session,
+          ids: {product_id: product_id},
+          params: {limit: limit, presentment_currencies: presentment_currencies, since_id: since_id, fields: fields}.merge(kwargs).compact,
+        )
+
+        T.cast(response, T::Array[Variant])
+      end
+
+      sig do
+        params(
+          product_id: T.nilable(T.any(Integer, String)),
+          session: Auth::Session,
+          kwargs: T.untyped
+        ).returns(T.untyped)
+      end
+      def count(
+        product_id: nil,
+        session: ShopifyAPI::Context.active_session,
+        **kwargs
+      )
+        request(
+          http_method: :get,
+          operation: :count,
+          session: session,
+          ids: {product_id: product_id},
+          params: {}.merge(kwargs).compact,
+          body: {},
+          entity: nil,
+        )
+      end
+
+    end
+
+  end
+end

data/lib/shopify_api/rest/resources/2026_07/webhook.rb

@@ -0,0 +1,173 @@
+# typed: false
+# frozen_string_literal: true
+
+########################################################################################################################
+# This file is auto-generated. If you have an issue, please create a GitHub issue.                                     #
+########################################################################################################################
+
+module ShopifyAPI
+  class Webhook < ShopifyAPI::Rest::Base
+    extend T::Sig
+
+    @prev_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @next_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    @api_call_limit = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @retry_request_after = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    sig { params(session: T.nilable(ShopifyAPI::Auth::Session), from_hash: T.nilable(T::Hash[T.untyped, T.untyped])).void }
+    def initialize(session: ShopifyAPI::Context.active_session, from_hash: nil)
+
+      @address = T.let(nil, T.nilable(String))
+      @topic = T.let(nil, T.nilable(String))
+      @api_version = T.let(nil, T.nilable(String))
+      @created_at = T.let(nil, T.nilable(String))
+      @fields = T.let(nil, T.nilable(T::Array[T.untyped]))
+      @filter = T.let(nil, T.nilable(String))
+      @format = T.let(nil, T.nilable(String))
+      @id = T.let(nil, T.nilable(Integer))
+      @metafield_namespaces = T.let(nil, T.nilable(T::Array[T.untyped]))
+      @private_metafield_namespaces = T.let(nil, T.nilable(T::Array[T.untyped]))
+      @updated_at = T.let(nil, T.nilable(String))
+
+      super(session: session, from_hash: from_hash)
+    end
+
+    @has_one = T.let({}, T::Hash[Symbol, Class])
+    @has_many = T.let({}, T::Hash[Symbol, Class])
+    @paths = T.let([
+      {http_method: :delete, operation: :delete, ids: [:id], path: "webhooks/<id>.json"},
+      {http_method: :get, operation: :count, ids: [], path: "webhooks/count.json"},
+      {http_method: :get, operation: :get, ids: [], path: "webhooks.json"},
+      {http_method: :get, operation: :get, ids: [:id], path: "webhooks/<id>.json"},
+      {http_method: :post, operation: :post, ids: [], path: "webhooks.json"},
+      {http_method: :put, operation: :put, ids: [:id], path: "webhooks/<id>.json"}
+    ], T::Array[T::Hash[String, T.any(T::Array[Symbol], String, Symbol)]])
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :address
+    sig { returns(T.nilable(String)) }
+    attr_reader :topic
+    sig { returns(T.nilable(String)) }
+    attr_reader :api_version
+    sig { returns(T.nilable(String)) }
+    attr_reader :created_at
+    sig { returns(T.nilable(T::Array[String])) }
+    attr_reader :fields
+    sig { returns(T.nilable(String)) }
+    attr_reader :format
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :id
+    sig { returns(T.nilable(T::Array[String])) }
+    attr_reader :metafield_namespaces
+    sig { returns(T.nilable(T::Array[String])) }
+    attr_reader :private_metafield_namespaces
+    sig { returns(T.nilable(String)) }
+    attr_reader :updated_at
+
+    class << self
+      sig do
+        params(
+          id: T.any(Integer, String),
+          fields: T.untyped,
+          session: Auth::Session
+        ).returns(T.nilable(Webhook))
+      end
+      def find(
+        id:,
+        fields: nil,
+        session: ShopifyAPI::Context.active_session
+      )
+        result = base_find(
+          session: session,
+          ids: {id: id},
+          params: {fields: fields},
+        )
+        T.cast(result[0], T.nilable(Webhook))
+      end
+
+      sig do
+        params(
+          id: T.any(Integer, String),
+          session: Auth::Session
+        ).returns(T.untyped)
+      end
+      def delete(
+        id:,
+        session: ShopifyAPI::Context.active_session
+      )
+        request(
+          http_method: :delete,
+          operation: :delete,
+          session: session,
+          ids: {id: id},
+          params: {},
+        )
+      end
+
+      sig do
+        params(
+          address: T.untyped,
+          created_at_max: T.untyped,
+          created_at_min: T.untyped,
+          fields: T.untyped,
+          limit: T.untyped,
+          since_id: T.untyped,
+          topic: T.untyped,
+          updated_at_min: T.untyped,
+          updated_at_max: T.untyped,
+          session: Auth::Session,
+          kwargs: T.untyped
+        ).returns(T::Array[Webhook])
+      end
+      def all(
+        address: nil,
+        created_at_max: nil,
+        created_at_min: nil,
+        fields: nil,
+        limit: nil,
+        since_id: nil,
+        topic: nil,
+        updated_at_min: nil,
+        updated_at_max: nil,
+        session: ShopifyAPI::Context.active_session,
+        **kwargs
+      )
+        response = base_find(
+          session: session,
+          ids: {},
+          params: {address: address, created_at_max: created_at_max, created_at_min: created_at_min, fields: fields, limit: limit, since_id: since_id, topic: topic, updated_at_min: updated_at_min, updated_at_max: updated_at_max}.merge(kwargs).compact,
+        )
+
+        T.cast(response, T::Array[Webhook])
+      end
+
+      sig do
+        params(
+          address: T.untyped,
+          topic: T.untyped,
+          session: Auth::Session,
+          kwargs: T.untyped
+        ).returns(T.untyped)
+      end
+      def count(
+        address: nil,
+        topic: nil,
+        session: ShopifyAPI::Context.active_session,
+        **kwargs
+      )
+        request(
+          http_method: :get,
+          operation: :count,
+          session: session,
+          ids: {},
+          params: {address: address, topic: topic}.merge(kwargs).compact,
+          body: {},
+          entity: nil,
+        )
+      end
+
+    end
+
+  end
+end

data/lib/shopify_api/utils/shop_validator.rb

@@ -0,0 +1,118 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "addressable/uri"
+
+module ShopifyAPI
+  module Utils
+    module ShopValidator
+      TRUSTED_SHOPIFY_DOMAINS = T.let(
+        [
+          "shopify.com",
+          "myshopify.io",
+          "myshopify.com",
+          "spin.dev",
+          "shop.dev",
+        ].freeze,
+        T::Array[String],
+      )
+
+      class << self
+        extend T::Sig
+
+        sig do
+          params(
+            shop_domain: String,
+            myshopify_domain: T.nilable(String),
+          ).returns(T.nilable(String))
+        end
+        def sanitize_shop_domain(shop_domain, myshopify_domain: nil)
+          uri = uri_from_shop_domain(shop_domain, myshopify_domain)
+          return nil if uri.nil? || uri.host.nil? || uri.host.empty?
+
+          trusted_domains(myshopify_domain).each do |trusted_domain|
+            host = T.cast(uri.host, String)
+            uri_domain = uri.domain
+            next if uri_domain.nil?
+
+            no_shop_name_in_subdomain = host == trusted_domain
+            from_trusted_domain = trusted_domain == uri_domain
+
+            if unified_admin?(uri) && from_trusted_domain
+              return myshopify_domain_from_unified_admin(uri)
+            end
+            return nil if no_shop_name_in_subdomain || host.empty?
+            return host if from_trusted_domain
+          end
+          nil
+        end
+
+        sig do
+          params(
+            shop: String,
+            myshopify_domain: T.nilable(String),
+          ).returns(String)
+        end
+        def sanitize!(shop, myshopify_domain: nil)
+          host = sanitize_shop_domain(shop, myshopify_domain: myshopify_domain)
+          if host.nil? || host.empty?
+            raise Errors::InvalidShopError,
+              "shop must be a trusted Shopify domain (see ShopValidator::TRUSTED_SHOPIFY_DOMAINS), got: #{shop.inspect}"
+          end
+
+          host
+        end
+
+        private
+
+        sig { params(myshopify_domain: T.nilable(String)).returns(T::Array[String]) }
+        def trusted_domains(myshopify_domain)
+          trusted = TRUSTED_SHOPIFY_DOMAINS.dup
+          if myshopify_domain && !myshopify_domain.to_s.empty?
+            trusted << myshopify_domain
+            trusted.uniq!
+          end
+          trusted
+        end
+
+        sig do
+          params(
+            shop_domain: String,
+            myshopify_domain: T.nilable(String),
+          ).returns(T.nilable(Addressable::URI))
+        end
+        def uri_from_shop_domain(shop_domain, myshopify_domain)
+          name = shop_domain.to_s.downcase.strip
+          return nil if name.empty?
+          return nil if name.include?("@")
+
+          if myshopify_domain && !myshopify_domain.to_s.empty? &&
+              !name.include?(myshopify_domain.to_s) && !name.include?(".")
+            name += ".#{myshopify_domain}"
+          end
+
+          uri = Addressable::URI.parse(name)
+          if uri.scheme.nil?
+            name = "https://#{name}"
+            uri = Addressable::URI.parse(name)
+          end
+
+          uri
+        rescue Addressable::URI::InvalidURIError
+          nil
+        end
+
+        sig { params(uri: Addressable::URI).returns(T::Boolean) }
+        def unified_admin?(uri)
+          T.cast(uri.host, String).split(".").first == "admin"
+        end
+
+        sig { params(uri: Addressable::URI).returns(String) }
+        def myshopify_domain_from_unified_admin(uri)
+          shop = uri.path.to_s.split("/").last
+          "#{shop}.myshopify.com"
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module ShopifyAPI
-  VERSION = "16.1.0"
+  VERSION = "16.3.0"
 end

data/lib/shopify_api/webhooks/request.rb

@@ -9,27 +9,27 @@ module ShopifyAPI
 
       sig { override.returns(String) }
       def hmac
-        Digest.hexencode(Base64.decode64(T.cast(@headers["x-shopify-hmac-sha256"], String)))
+        Digest.hexencode(Base64.decode64(T.cast(shopify_header("hmac-sha256"), String)))
       end
 
       sig { returns(String) }
       def topic
-        T.cast(@headers["x-shopify-topic"], String)
+        T.cast(shopify_header("topic"), String)
       end
 
       sig { returns(String) }
       def shop
-        T.cast(@headers["x-shopify-shop-domain"], String)
+        T.cast(shopify_header("shop-domain"), String)
       end
 
       sig { returns(String) }
       def api_version
-        T.cast(@headers["x-shopify-api-version"], String)
+        T.cast(shopify_header("api-version"), String)
       end
 
       sig { returns(String) }
       def webhook_id
-        T.cast(@headers["x-shopify-webhook-id"], String)
+        T.cast(shopify_header("webhook-id"), String)
       end
 
       sig { override.returns(String) }
@@ -48,11 +48,11 @@ module ShopifyAPI
         headers = headers.to_h { |k, v| [k.to_s.downcase.sub("http_", "").gsub("_", "-"), v] }
 
         missing_headers = []
-        [
-          "x-shopify-topic",
-          "x-shopify-hmac-sha256",
-          "x-shopify-shop-domain",
-        ].each { |header| missing_headers << header unless headers.include?(header) }
+        ["topic", "hmac-sha256", "shop-domain"].each do |name|
+          unless headers.key?("shopify-#{name}") || headers.key?("x-shopify-#{name}")
+            missing_headers << "shopify-#{name} or x-shopify-#{name}"
+          end
+        end
         unless missing_headers.empty?
           raise Errors::InvalidWebhookError,
             "Missing one or more of the required HTTP headers to process webhooks: #{missing_headers}"
@@ -61,6 +61,13 @@ module ShopifyAPI
         @headers = headers
         @raw_body = raw_body
       end
+
+      private
+
+      sig { params(name: String).returns(T.untyped) }
+      def shopify_header(name)
+        @headers["shopify-#{name}"] || @headers["x-shopify-#{name}"]
+      end
     end
   end
 end

data/lib/shopify_api.rb

@@ -8,6 +8,7 @@ require "sorbet-runtime"
 require "securerandom"
 require "cgi"
 require "uri"
+require "logger"
 require "openssl"
 require "httparty"
 require "zeitwerk"
@@ -22,3 +23,71 @@ loader = Zeitwerk::Loader.for_gem
 loader.inflector = ShopifyAPI::Inflector.new(__FILE__)
 loader.ignore("#{__dir__}/shopify_api/rest/resources")
 loader.setup
+
+module ShopifyAPI
+  REST_RESOURCES_PATH = T.let("#{__dir__}/shopify_api/rest/resources", String)
+
+  class << self
+    extend T::Sig
+
+    # REST resources are only autoloaded for API versions this gem bundles (see
+    # Context.load_rest_resources). Without this hook, using a version whose
+    # resources aren't bundled - a newly released version, or `unstable` - fails
+    # with a bare "uninitialized constant", which reads like a gem bug instead
+    # of a version-coverage gap. GraphQL and the REST client are unaffected.
+    sig { params(name: Symbol).returns(T.untyped) }
+    def const_missing(name)
+      if bundled_rest_resource_names.include?(name.to_s)
+        # Pass `name` through so NameError#name still returns the missing
+        # constant, as it does for the NameError Ruby would have raised.
+        raise Errors::RestResourceNotLoadedError.new(rest_resource_not_loaded_message(name), name)
+      end
+
+      super
+    end
+
+    private
+
+    # Constant names of every REST resource bundled for any API version, derived
+    # the same way Zeitwerk derives them so the two cannot drift.
+    sig { returns(T::Array[String]) }
+    def bundled_rest_resource_names
+      @bundled_rest_resource_names ||= T.let(
+        Dir.glob("#{REST_RESOURCES_PATH}/*/*.rb").map do |path|
+          Zeitwerk::Inflector.new.camelize(File.basename(path, ".rb"), path)
+        end.uniq,
+        T.nilable(T::Array[String]),
+      )
+    end
+
+    sig { returns(T::Array[String]) }
+    def bundled_rest_resource_versions
+      @bundled_rest_resource_versions ||= T.let(
+        Dir.glob("#{REST_RESOURCES_PATH}/*")
+          .select { |path| File.directory?(path) }
+          .map { |path| File.basename(path).tr("_", "-") }
+          .sort,
+        T.nilable(T::Array[String]),
+      )
+    end
+
+    sig { params(name: Symbol).returns(String) }
+    def rest_resource_not_loaded_message(name)
+      api_version = Context.api_version
+
+      reason = if api_version.empty?
+        "ShopifyAPI::Context has not been set up, so no REST resources have been loaded. " \
+          "Call ShopifyAPI::Context.setup before using REST resources."
+      elsif api_version == "unstable"
+        "REST resources are not bundled for the \"unstable\" API version. Set api_version to a " \
+          "stable version to use REST resources, or use the GraphQL Admin API."
+      else
+        "shopify_api #{VERSION} does not bundle REST resources for API version \"#{api_version}\" " \
+          "(latest bundled: \"#{bundled_rest_resource_versions.last}\"). Upgrade the gem, set " \
+          "api_version to a bundled version, or use the GraphQL Admin API."
+      end
+
+      "uninitialized constant ShopifyAPI::#{name}. #{reason}"
+    end
+  end
+end

data/shopify_api.gemspec

@@ -33,10 +33,12 @@ Gem::Specification.new do |s|
   s.required_ruby_version = ">= 3.2"
 
   s.add_runtime_dependency("activesupport")
+  s.add_runtime_dependency("addressable", "~> 2.7")
   s.add_runtime_dependency("concurrent-ruby")
   s.add_runtime_dependency("hash_diff")
   s.add_runtime_dependency("httparty")
   s.add_runtime_dependency("jwt")
+  s.add_runtime_dependency("logger")
   s.add_runtime_dependency("oj")
   s.add_runtime_dependency("openssl")
   s.add_runtime_dependency("securerandom")