shopify_api 9.5.1 → 13.1.0

data/lib/shopify_api/auth/oauth.rb

@@ -0,0 +1,133 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    module Oauth
+      extend T::Sig
+
+      NONCE_LENGTH = 15
+
+      class << self
+        extend T::Sig
+
+        sig do
+          params(
+            shop: String,
+            redirect_path: String,
+            is_online: T.nilable(T::Boolean),
+            scope_override: T.nilable(T.any(ShopifyAPI::Auth::AuthScopes, T::Array[String], String)),
+          ).returns(T::Hash[Symbol, T.any(String, SessionCookie)])
+        end
+        def begin_auth(shop:, redirect_path:, is_online: true, scope_override: nil)
+          scope = if scope_override.nil?
+            ShopifyAPI::Context.scope
+          elsif scope_override.is_a?(ShopifyAPI::Auth::AuthScopes)
+            scope_override
+          else
+            ShopifyAPI::Auth::AuthScopes.new(scope_override)
+          end
+
+          unless Context.setup?
+            raise Errors::ContextNotSetupError, "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
+          end
+          raise Errors::UnsupportedOauthError, "Cannot perform OAuth for private apps." if Context.private?
+
+          state = SecureRandom.alphanumeric(NONCE_LENGTH)
+
+          cookie = SessionCookie.new(value: state, expires: Time.now + 60)
+
+          query = {
+            client_id: ShopifyAPI::Context.api_key,
+            scope: scope.to_s,
+            redirect_uri: "#{ShopifyAPI::Context.host}#{redirect_path}",
+            state: state,
+            "grant_options[]": is_online ? "per-user" : "",
+          }
+
+          query_string = URI.encode_www_form(query)
+
+          auth_route = "https://#{shop}/admin/oauth/authorize?#{query_string}"
+          { auth_route: auth_route, cookie: cookie }
+        end
+
+        sig do
+          params(
+            cookies: T::Hash[String, String],
+            auth_query: AuthQuery,
+          ).returns(T::Hash[Symbol, T.any(Session, SessionCookie)])
+        end
+        def validate_auth_callback(cookies:, auth_query:)
+          unless Context.setup?
+            raise Errors::ContextNotSetupError, "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
+          end
+          raise Errors::InvalidOauthError, "Invalid OAuth callback." unless Utils::HmacValidator.validate(auth_query)
+          raise Errors::UnsupportedOauthError, "Cannot perform OAuth for private apps." if Context.private?
+
+          state = cookies[SessionCookie::SESSION_COOKIE_NAME]
+          raise Errors::NoSessionCookieError unless state
+
+          raise Errors::InvalidOauthError,
+            "Invalid state in OAuth callback." unless state == auth_query.state
+
+          # TODO: replace this call with the HTTP client once it is built
+          body = { client_id: Context.api_key, client_secret: Context.api_secret_key, code: auth_query.code }
+          response = HTTParty.post("https://#{auth_query.shop}/admin/oauth/access_token", body: body)
+          unless response.ok?
+            raise Errors::RequestAccessTokenError,
+              "Cannot complete OAuth process. Received a #{response.code} error while requesting access token."
+          end
+          session_params = response.to_h
+
+          session = create_new_session(session_params, auth_query.shop)
+
+          cookie = if Context.embedded?
+            SessionCookie.new(
+              value: "",
+              expires: Time.now,
+            )
+          else
+            SessionCookie.new(
+              value: session.id,
+              expires: session.online? ? session.expires : nil,
+            )
+          end
+
+          { session: session, cookie: cookie }
+        end
+
+        private
+
+        sig { params(session_params: T::Hash[String, T.untyped], shop: String).returns(Session) }
+        def create_new_session(session_params, shop)
+          session_params = session_params.to_h { |k, v| [k.to_sym, v] }
+
+          scope = session_params[:scope]
+
+          is_online = !session_params[:associated_user].nil?
+
+          if is_online
+            associated_user = AssociatedUser.new(session_params[:associated_user].to_h { |k, v| [k.to_sym, v] })
+            expires = Time.now + session_params[:expires_in].to_i
+            associated_user_scope = session_params[:associated_user_scope]
+            id = "#{shop}_#{associated_user.id}"
+          else
+            id = "offline_#{shop}"
+          end
+
+          Session.new(
+            id: id,
+            shop: shop,
+            access_token: session_params[:access_token],
+            scope: scope,
+            is_online: is_online,
+            associated_user_scope: associated_user_scope,
+            associated_user: associated_user,
+            expires: expires,
+            shopify_session_id: session_params[:session],
+          )
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/auth/session.rb

@@ -0,0 +1,119 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    class Session
+      extend T::Sig
+
+      sig { returns(String) }
+      attr_reader :id
+
+      sig { returns(T.nilable(String)) }
+      attr_accessor :state, :access_token
+
+      sig { returns(String) }
+      attr_accessor :shop
+
+      sig { returns(AuthScopes) }
+      attr_accessor :scope
+
+      sig { returns(T.nilable(AuthScopes)) }
+      attr_accessor :associated_user_scope
+
+      sig { returns(T.nilable(Time)) }
+      attr_accessor :expires
+
+      sig { returns(T.nilable(AssociatedUser)) }
+      attr_accessor :associated_user
+
+      sig { returns(T.nilable(String)) }
+      attr_accessor :shopify_session_id
+
+      sig { returns(T::Boolean) }
+      def online?
+        @is_online
+      end
+
+      sig do
+        params(
+          shop: String,
+          id: T.nilable(String),
+          state: T.nilable(String),
+          access_token: T.nilable(String),
+          scope: T.any(T::Array[String], String),
+          associated_user_scope: T.nilable(T.any(T::Array[String], String)),
+          expires: T.nilable(Time),
+          is_online: T.nilable(T::Boolean),
+          associated_user: T.nilable(AssociatedUser),
+          shopify_session_id: T.nilable(String),
+        ).void
+      end
+      def initialize(shop:, id: nil, state: nil, access_token: "", scope: [], associated_user_scope: nil, expires: nil,
+        is_online: nil, associated_user: nil, shopify_session_id: nil)
+        @id = T.let(id || SecureRandom.uuid, String)
+        @shop = shop
+        @state = state
+        @access_token = access_token
+        @scope = T.let(AuthScopes.new(scope), AuthScopes)
+        @associated_user_scope = T.let(
+          associated_user_scope.nil? ? nil : AuthScopes.new(associated_user_scope), T.nilable(AuthScopes)
+        )
+        @expires = expires
+        @associated_user = associated_user
+        @is_online = T.let(is_online || !associated_user.nil?, T::Boolean)
+        @shopify_session_id = shopify_session_id
+      end
+
+      class << self
+        extend T::Sig
+
+        sig do
+          params(shop: String, access_token: String,
+            blk: T.proc.params(arg0: Session).returns(T.untyped)).returns(T.untyped)
+        end
+        def temp(shop:, access_token:, &blk)
+          original_session = Context.active_session
+          temp_session = Session.new(shop: shop, access_token: access_token)
+
+          begin
+            Context.activate_session(temp_session)
+            yield temp_session
+          ensure
+            Context.activate_session(original_session)
+          end
+        end
+
+        sig { params(str: String).returns(Session) }
+        def deserialize(str)
+          Oj.load(str)
+        end
+      end
+
+      sig { returns(String) }
+      def serialize
+        Oj.dump(self)
+      end
+
+      alias_method :eql?, :==
+      sig { params(other: T.nilable(Session)).returns(T::Boolean) }
+      def ==(other)
+        if other
+          (
+            id == other.id &&
+            shop == other.shop &&
+            state == other.state &&
+            scope == other.scope &&
+            associated_user_scope == other.associated_user_scope &&
+            (!(expires.nil? ^ other.expires.nil?) && (expires.nil? || expires.to_i == other.expires.to_i)) &&
+            online? == other.online? &&
+            associated_user == other.associated_user &&
+            shopify_session_id == other.shopify_session_id
+          )
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/auth.rb

@@ -0,0 +1,26 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Auth
+    extend T::Sig
+
+    class << self
+      extend T::Sig
+
+      sig { params(host: T.nilable(String)).returns(String) }
+      def embedded_app_url(host)
+        unless Context.setup?
+          raise Errors::ContextNotSetupError, "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
+        end
+
+        unless host
+          raise Errors::MissingRequiredArgumentError, "host argument is required"
+        end
+
+        decoded_host = Base64.decode64(host)
+        "https://#{decoded_host}/apps/#{Context.api_key}"
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/graphql/admin.rb

@@ -0,0 +1,15 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    module Graphql
+      class Admin < Client
+        sig { params(session: T.nilable(Auth::Session), api_version: T.nilable(String)).void }
+        def initialize(session:, api_version: nil)
+          super(session: session, base_path: "/admin/api", api_version: api_version)
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/graphql/client.rb

@@ -0,0 +1,50 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    module Graphql
+      class Client
+        extend T::Sig
+
+        sig { params(session: T.nilable(Auth::Session), base_path: String, api_version: T.nilable(String)).void }
+        def initialize(session:, base_path:, api_version: nil)
+          @http_client = T.let(HttpClient.new(session: session, base_path: base_path), HttpClient)
+          @api_version = T.let(api_version || Context.api_version, String)
+          if api_version
+            if api_version == Context.api_version
+              Context.logger.debug("Graphql client has a redundant API version override "\
+                "to the default #{Context.api_version}")
+            else
+              Context.logger.debug("Graphql client overriding default API version "\
+                "#{Context.api_version} with #{api_version}")
+            end
+          end
+        end
+
+        sig do
+          params(
+            query: String,
+            variables: T.nilable(T::Hash[T.any(Symbol, String), T.untyped]),
+            headers: T.nilable(T::Hash[T.any(Symbol, String), T.untyped]),
+            tries: Integer,
+          ).returns(HttpResponse)
+        end
+        def query(query:, variables: nil, headers: nil, tries: 1)
+          body = { query: query, variables: variables }
+          @http_client.request(
+            HttpRequest.new(
+              http_method: :post,
+              path: "#{@api_version}/graphql.json",
+              body: body,
+              query: nil,
+              extra_headers: headers,
+              body_type: "application/json",
+              tries: tries,
+            ),
+          )
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/graphql/storefront.rb

@@ -0,0 +1,35 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    module Graphql
+      class Storefront < Client
+        sig { params(shop: String, storefront_access_token: String, api_version: T.nilable(String)).void }
+        def initialize(shop, storefront_access_token, api_version: nil)
+          session = Auth::Session.new(
+            id: shop,
+            shop: shop,
+            access_token: "",
+            is_online: false,
+          )
+          super(session: session, base_path: "/api", api_version: api_version)
+          @storefront_access_token = storefront_access_token
+        end
+
+        sig do
+          params(
+            query: String,
+            variables: T.nilable(T::Hash[T.any(Symbol, String), T.untyped]),
+            headers: T.nilable(T::Hash[T.any(Symbol, String), T.untyped]),
+            tries: Integer,
+          ).returns(HttpResponse)
+        end
+        def query(query:, variables: nil, headers: {}, tries: 1)
+          T.must(headers).merge!({ "X-Shopify-Storefront-Access-Token": @storefront_access_token })
+          super(query: query, variables: variables, headers: headers, tries: tries)
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/http_client.rb

@@ -0,0 +1,111 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    class HttpClient
+      extend T::Sig
+
+      RETRY_WAIT_TIME = 1
+
+      sig { params(base_path: String, session: T.nilable(Auth::Session)).void }
+      def initialize(base_path:, session: nil)
+        session ||= Context.active_session
+        raise Errors::NoActiveSessionError, "No passed or active session" unless session
+
+        @base_uri = T.let("https://#{session.shop}", String)
+        @base_uri_and_path = T.let("#{@base_uri}#{base_path}", String)
+
+        user_agent_prefix = Context.user_agent_prefix.nil? ? "" : "#{Context.user_agent_prefix} | "
+
+        @headers = T.let({
+          "User-Agent": "#{user_agent_prefix}Shopify API Library v#{VERSION} | Ruby #{RUBY_VERSION}",
+          "Accept": "application/json",
+        }, T::Hash[T.any(Symbol, String), T.untyped])
+
+        unless session.access_token.nil? || T.must(session.access_token).empty?
+          @headers["X-Shopify-Access-Token"] = T.cast(session.access_token, String)
+        end
+      end
+
+      sig { params(request: HttpRequest).returns(HttpResponse) }
+      def request(request)
+        request.verify
+
+        headers = @headers
+        headers["Content-Type"] = T.must(request.body_type) if request.body_type
+        headers = headers.merge(T.must(request.extra_headers)) if request.extra_headers
+
+        tries = 0
+        response = HttpResponse.new(code: 0, headers: {}, body: "")
+        while tries < request.tries
+          tries += 1
+          res = T.cast(HTTParty.send(
+            request.http_method,
+            request_url(request),
+            headers: headers,
+            query: request.query,
+            body: request.body.class == Hash ? T.unsafe(request.body).to_json : request.body,
+          ), HTTParty::Response)
+
+          begin
+            body = res.body.nil? || res.body.empty? ? {} : JSON.parse(res.body)
+          rescue JSON::ParserError
+            raise if res.code.to_i < 500
+
+            body = res.body
+          end
+
+          response = HttpResponse.new(code: res.code.to_i, headers: res.headers.to_h, body: body)
+
+          if response.headers["x-shopify-api-deprecated-reason"]
+            reason = T.must(response.headers["x-shopify-api-deprecated-reason"])[0]
+            Context.logger.warn("Deprecated request to Shopify API at #{request.path}, received reason: #{reason}")
+          end
+
+          break if response.ok?
+
+          error_message = serialized_error(response)
+
+          unless [429, 500].include?(response.code)
+            raise ShopifyAPI::Errors::HttpResponseError.new(response: response), error_message
+          end
+
+          if tries == request.tries
+            raise ShopifyAPI::Errors::HttpResponseError.new(response: response), error_message if request.tries == 1
+
+            raise ShopifyAPI::Errors::MaxHttpRetriesExceededError.new(response: response),
+              "Exceeded maximum retry count of #{request.tries}. Last message: #{error_message}"
+          end
+
+          if response.code == 500 || response.headers["retry-after"].nil?
+            sleep(RETRY_WAIT_TIME)
+          else
+            sleep(T.must(response.headers["retry-after"])[0].to_i)
+          end
+        end
+
+        response
+      end
+
+      protected
+
+      sig { params(request: HttpRequest).returns(String) }
+      def request_url(request)
+        "#{@base_uri_and_path}/#{request.path}"
+      end
+
+      sig { params(response: HttpResponse).returns(String) }
+      def serialized_error(response)
+        body = {}
+        body["errors"] = response.body["errors"] if response.body["errors"]
+
+        if response.headers["x-request-id"]
+          id = T.must(response.headers["x-request-id"])[0]
+          body["error_reference"] = "If you report this error, please include this id: #{id}."
+        end
+        body.to_json
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/http_request.rb

@@ -0,0 +1,35 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    class HttpRequest < T::Struct
+      extend T::Sig
+
+      prop :http_method, Symbol
+      prop :path, String
+      prop :body, T.nilable(T.any(T::Hash[T.any(Symbol, String), T.untyped], String))
+      prop :body_type, T.nilable(String)
+      prop :query, T.nilable(T::Hash[T.any(Symbol, String), T.untyped])
+      prop :extra_headers, T.nilable(T::Hash[T.any(Symbol, String), T.untyped])
+      prop :tries, Integer, default: 1
+
+      sig { void }
+      def verify
+        unless [:get, :delete, :put, :post].include?(http_method)
+          raise ShopifyAPI::Errors::InvalidHttpRequestError, "Invalid Http method #{http_method}."
+        end
+
+        if body && !body_type
+          raise ShopifyAPI::Errors::InvalidHttpRequestError, "Cannot set a body without also setting body_type."
+        end
+
+        return unless [:put, :post].include?(http_method)
+
+        unless  body
+          raise ShopifyAPI::Errors::InvalidHttpRequestError, "Cannot use #{http_method} without specifying data."
+        end
+      end
+    end
+  end
+end

data/lib/shopify_api/clients/http_response.rb

@@ -0,0 +1,66 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Clients
+    class HttpResponse
+      extend T::Sig
+
+      sig { returns(Integer) }
+      attr_reader :code
+
+      sig { returns(T::Hash[String, T::Array[String]]) }
+      attr_reader :headers
+
+      sig { returns(T.any(T::Hash[String, T.untyped], String)) }
+      attr_reader :body
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :prev_page_info, :next_page_info
+
+      sig do
+        params(
+          code: Integer,
+          headers: T::Hash[String, T::Array[String]],
+          body: T.any(T::Hash[String, T.untyped], String),
+        ).void
+      end
+      def initialize(code:, headers:, body:)
+        @code = code
+        @headers = headers
+        @body = body
+
+        @prev_page_info = T.let(nil, T.nilable(String))
+        @next_page_info = T.let(nil, T.nilable(String))
+        @prev_page_info, @next_page_info = parse_link_header
+      end
+
+      sig { returns(T::Boolean) }
+      def ok?
+        code >= 200 && code <= 299
+      end
+
+      private
+
+      sig { returns(T::Array[T.nilable(String)]) }
+      def parse_link_header
+        return [nil, nil] if @headers["link"].nil?
+
+        page_info = {}
+        T.must(T.must(@headers["link"])[0]).split(",").each do |link|
+          rel = T.must(link.match(/rel="(.*?)"/))[1]
+          url = T.must(T.must(link.match(/<(.*?)>/))[1])
+
+          T.must(URI.parse(url).query).split("&").each do |param|
+            if param.split("=")[0] == "page_info"
+              page_info[rel] = param.split("=")[1]
+              break
+            end
+          end
+        end
+
+        [page_info["previous"], page_info["next"]]
+      end
+    end
+  end
+end