shopify_api 10.1.0 → 11.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc4cfe78db0e88c911424f8d3e2b3ed88b41a3bb91db59beea5a250222a784af
-  data.tar.gz: c2f3d45bf47d0b0e5d8da086895c59145b0c84ef4b70f04acee72188278f4b74
+  metadata.gz: e6ef6d1ca6d9c8e54ddd8fd1c4ca34fdb015e2fe1157c1a101810c8036a69b02
+  data.tar.gz: 94cf5af5bf1e14d8fa1728bb87d0c138f92bebcdbb16d47885a2e2ce73ffba81
 SHA512:
-  metadata.gz: f5fdbadb1ba50cf494e3eee2e08c6e2ee29085093821d24da8965d3215c1197ddadbaf0c1b2fb979ba59a3e3fad315691a85658ba970dd8f58b0a5f4b23456ab
-  data.tar.gz: b71d5ec832995ae090aa52ee61c5fe3a67c05ad04d78a3e8f34cfee2fa8565f221ce5229a354f981c1de2d9eed25e2fd341919c6474695a973b7052b71db72df
+  metadata.gz: 505926c8d97d9ec73a4dbab76ff42aabf7f0559c503450ada931c51f900a62540ea52cfe4c8e02877a86f515b50b5f7c7f6536fde6d760ff44337d8e68bc6ed5
+  data.tar.gz: 84c6d2c78256cd4b84290ba324d3825ed2365aad7e142bd7f0ca0275f5f9c48d9f2251ff9a022cc2bb663a3a25c5d6c9841af25558a2dd154f62323305e4fd85

data/.github/workflows/build.yml

@@ -11,7 +11,6 @@ jobs:
     strategy:
       matrix:
         version:
-          - 2.6
           - 2.7
           - 3.0
           - 3.1

data/.rubocop.yml

@@ -5,7 +5,7 @@ require:
   - rubocop-sorbet
 
 AllCops:
-  TargetRubyVersion: 2.6
+  TargetRubyVersion: 2.7
   NewCops: enable
   Exclude:
     - "sorbet/**/*"

data/BREAKING_CHANGES_FOR_OLDER_VERSIONS.md

@@ -0,0 +1,110 @@
+# Breaking changes for older versions
+
+The breaking changes for the previous major release are listed in the main [README](README.md).
+The breaking changes for older major releases are listed below.
+
+### Breaking change notice for version 8.0.0
+
+Version 7.0.0 introduced ApiVersion, and known versions were hardcoded into the gem. Manually defining API versions is no longer required for versions not listed in the gem. Version 8.0.0 removes the following:
+* `ShopifyAPI::ApiVersion::Unstable`
+* `ShopifyAPI::ApiVersion::Release`
+* `ShopifyAPI::ApiVersion.define_version`
+
+The following methods on `ApiVersion` have been deprecated:
+- `.coerce_to_version` deprecated. use `.find_version`
+- `.define_known_versions` deprecated. Use `.fetch_known_versions`
+- `.clear_defined_versions` deprecated. Use. `.clear_known_versions`
+- `.latest_stable_version` deprecated. Use `ShopifyAPI::Meta.admin_versions.find(&:latest_supported)` (this fetches info from Shopify servers. No authentication required.)
+- `#name` deprecated. Use `#handle`
+- `#stable?` deprecated. Use `#supported?`
+
+Version 8.0.0 introduces a _version lookup mode_. By default, `ShopifyAPI::ApiVersion.version_lookup_mode` is `:define_on_unknown`. When setting the api_version on `Session` or `Base`, the `api_version` attribute takes a version handle (i.e. `'2019-07'` or `:unstable`) and sets an instance of `ShopifyAPI::ApiVersion` matching the handle. When the version_lookup_mode is set to `:define_on_unknown`, any handle will naïvely create a new `ApiVersion` if the version is not in the known versions returned by `ShopifyAPI::ApiVersion.versions`.
+
+To ensure you're setting only known and active versions, call :
+
+```ruby
+ShopifyAPI::ApiVersion.version_lookup_mode = :raise_on_unknown
+ShopifyAPI::ApiVersion.fetch_known_versions
+```
+
+Known and active versions are fetched from https://app.shopify.com/services/apis.json and cached. Trying to use a version outside this cached set will raise an error. To switch back to naïve lookup and create a version if one is not found, call `ShopifyAPI::ApiVersion.version_lookup_mode = :define_on_unknown`.
+
+### Breaking change notice for version 7.0.0
+
+#### Changes to ShopifyAPI::Session
+When creating sessions, `api_version`is now required and uses keyword arguments.
+
+To upgrade your use of ShopifyAPI you will need to make the following changes.
+
+```ruby
+ShopifyAPI::Session.new(domain, token, extras)
+```
+is now
+```ruby
+ShopifyAPI::Session.new(domain: domain, token: token, api_version: api_version, extras: extras)
+```
+Note `extras` is still optional. The other arguments are required.
+
+```ruby
+ShopifyAPI::Session.temp(domain, token, extras) do
+  ...
+end
+```
+is now
+```ruby
+ShopifyAPI::Session.temp(domain: domain, token: token, api_version: api_version) do
+  ...
+end
+```
+
+For example, if you want to use the `2019-04` version, you will create a session like this:
+```ruby
+session = ShopifyAPI::Session.new(domain: domain, token: token, api_version: '2019-04')
+```
+if you want to use the `unstable` version, you will create a session like this:
+```ruby
+session = ShopifyAPI::Session.new(domain: domain, token: token, api_version: :unstable)
+```
+
+#### Changes to how to define resources
+
+If you have defined or customized Resources, classes that extend `ShopifyAPI::Base`:
+The use of `self.prefix =` has been deprecated; you should now use `self.resource =` and not include `/admin`.
+For example, if you specified a prefix like this before:
+```ruby
+class MyResource < ShopifyAPI::Base
+  self.prefix = '/admin/shop/'
+end
+```
+You will update this to:
+```ruby
+class MyResource < ShopifyAPI::Base
+  self.resource_prefix = 'shop/'
+end
+```
+
+#### URL construction
+
+If you have specified any full paths for API calls in find
+```ruby
+def self.current(options={})
+  find(:one, options.merge(from: "/admin/shop.#{format.extension}"))
+end
+```
+would be changed to
+
+```ruby
+def self.current(options = {})
+  find(:one, options.merge(
+    from: api_version.construct_api_path("shop.#{format.extension}")
+  ))
+end
+```
+
+#### URLs that have not changed
+
+- OAuth URLs for `authorize`, getting the `access_token` from a code, `access_scopes`, and using a `refresh_token` have _not_ changed.
+  - get: `/admin/oauth/authorize`
+  - post: `/admin/oauth/access_token`
+  - get: `/admin/oauth/access_scopes`
+- URLs for the merchant’s web admin have _not_ changed. For example: to send the merchant to the product page the url is still `/admin/product/<id>`

data/CHANGELOG.md

@@ -4,6 +4,12 @@ Note: For changes to the API, see https://shopify.dev/changelog?filter=api
 
 ## Unreleased
 
+## Version 11.0.0
+
+- [#987](https://github.com/Shopify/shopify_api/pull/987) ⚠️ [Breaking] Add REST resources for July 2022 API version, remove support and REST resources for July 2021 (`2021-07`) API version
+- [#979](https://github.com/Shopify/shopify_api/pull/979) Update `ShopifyAPI::Context.setup` to take `old_api_secret_key` to support API credentials rotation
+- [#977](https://github.com/Shopify/shopify_api/pull/977) Fix webhook requests when a header is present having a symbol key (e.g. `:clearance`)
+
 ## Version 10.1.0
 
 - [#933](https://github.com/Shopify/shopify_api/pull/933) Fix syntax of GraphQL query in `Webhooks.get_webhook_id` method by removing extra curly brace

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_api (10.1.0)
+    shopify_api (11.0.0)
       concurrent-ruby
       hash_diff
       httparty
@@ -36,7 +36,7 @@ GEM
       multi_xml (>= 0.5.2)
     i18n (1.8.11)
       concurrent-ruby (~> 1.0)
-    jwt (2.3.0)
+    jwt (2.4.1)
     method_source (1.0.0)
     mime-types (3.4.1)
       mime-types-data (~> 3.2015)
@@ -44,10 +44,10 @@ GEM
     minitest (5.15.0)
     mocha (1.13.0)
     multi_xml (0.6.0)
-    oj (3.13.11)
+    oj (3.13.15)
     openssl (3.0.0)
     parallel (1.21.0)
-    parser (3.1.0.0)
+    parser (3.1.2.0)
       ast (~> 2.4.1)
     pry (0.14.1)
       coderay (~> 1.1)
@@ -55,9 +55,9 @@ GEM
     public_suffix (4.0.6)
     rainbow (3.1.1)
     rake (13.0.6)
-    rbi (0.0.11)
+    rbi (0.0.14)
       ast
-      parser
+      parser (>= 2.6.4.0)
       sorbet-runtime (>= 0.5.9204)
       unparser
     regexp_parser (2.2.0)
@@ -79,29 +79,32 @@ GEM
       rubocop (>= 0.90.0)
     ruby-progressbar (1.11.0)
     securerandom (0.2.0)
-    sorbet (0.5.10016)
-      sorbet-static (= 0.5.10016)
-    sorbet-runtime (0.5.10016)
-    sorbet-static (0.5.10016-universal-darwin-21)
-    sorbet-static (0.5.10016-x86_64-linux)
-    spoom (1.1.8)
+    sorbet (0.5.10109)
+      sorbet-static (= 0.5.10109)
+    sorbet-runtime (0.5.10109)
+    sorbet-static (0.5.10109-universal-darwin-21)
+    sorbet-static (0.5.10109-x86_64-linux)
+    sorbet-static-and-runtime (0.5.10109)
+      sorbet (= 0.5.10109)
+      sorbet-runtime (= 0.5.10109)
+    spoom (1.1.11)
       sorbet (>= 0.5.9204)
       sorbet-runtime (>= 0.5.9204)
       thor (>= 0.19.2)
-    tapioca (0.6.4)
+    tapioca (0.8.3)
       bundler (>= 1.17.3)
+      parallel (>= 1.21.0)
       pry (>= 0.12.2)
-      rbi (~> 0.0.0, >= 0.0.9)
-      sorbet-runtime (>= 0.5.9204)
-      sorbet-static (>= 0.5.9204)
-      spoom (~> 1.1.0, >= 1.1.4)
+      rbi (~> 0.0.0, >= 0.0.14)
+      sorbet-static-and-runtime (>= 0.5.9204)
+      spoom (~> 1.1.0, >= 1.1.11)
       thor (>= 1.2.0)
       yard-sorbet
     thor (1.2.1)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.1.0)
-    unparser (0.6.3)
+    unparser (0.6.5)
       diff-lcs (~> 1.3)
       parser (>= 3.1.0)
     webmock (3.14.0)
@@ -109,12 +112,12 @@ GEM
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     webrick (1.7.0)
-    yard (0.9.27)
+    yard (0.9.28)
       webrick (~> 1.7.0)
     yard-sorbet (0.6.1)
       sorbet-runtime (>= 0.5)
       yard (>= 0.9)
-    zeitwerk (2.5.4)
+    zeitwerk (2.6.0)
 
 PLATFORMS
   arm64-darwin-21

data/README.md

@@ -115,112 +115,9 @@ With this, a lot changed in how apps access the library. Here are the updates yo
     | `order = Order.new(<id>)`<br/>`order.post(:close)` | `order = Order.new(session:)`<br/>`order.close()` |
     | `order = Order.new(<id>)`<br/>`order.delete` | `Order.delete(id: <id>, session:)` |
 
-### Breaking change notice for version 8.0.0
-
-Version 7.0.0 introduced ApiVersion, and known versions were hardcoded into the gem. Manually defining API versions is no longer required for versions not listed in the gem. Version 8.0.0 removes the following:
-* `ShopifyAPI::ApiVersion::Unstable`
-* `ShopifyAPI::ApiVersion::Release`
-* `ShopifyAPI::ApiVersion.define_version`
-
-The following methods on `ApiVersion` have been deprecated:
-- `.coerce_to_version` deprecated. use `.find_version`
-- `.define_known_versions` deprecated. Use `.fetch_known_versions`
-- `.clear_defined_versions` deprecated. Use. `.clear_known_versions`
-- `.latest_stable_version` deprecated. Use `ShopifyAPI::Meta.admin_versions.find(&:latest_supported)` (this fetches info from Shopify servers. No authentication required.)
-- `#name` deprecated. Use `#handle`
-- `#stable?` deprecated. Use `#supported?`
-
-Version 8.0.0 introduces a _version lookup mode_. By default, `ShopifyAPI::ApiVersion.version_lookup_mode` is `:define_on_unknown`. When setting the api_version on `Session` or `Base`, the `api_version` attribute takes a version handle (i.e. `'2019-07'` or `:unstable`) and sets an instance of `ShopifyAPI::ApiVersion` matching the handle. When the version_lookup_mode is set to `:define_on_unknown`, any handle will naïvely create a new `ApiVersion` if the version is not in the known versions returned by `ShopifyAPI::ApiVersion.versions`.
-
-To ensure you're setting only known and active versions, call :
-
-```ruby
-ShopifyAPI::ApiVersion.version_lookup_mode = :raise_on_unknown
-ShopifyAPI::ApiVersion.fetch_known_versions
-```
-
-Known and active versions are fetched from https://app.shopify.com/services/apis.json and cached. Trying to use a version outside this cached set will raise an error. To switch back to naïve lookup and create a version if one is not found, call `ShopifyAPI::ApiVersion.version_lookup_mode = :define_on_unknown`.
-
-### Breaking change notice for version 7.0.0
-
-#### Changes to ShopifyAPI::Session
-When creating sessions, `api_version`is now required and uses keyword arguments.
-
-To upgrade your use of ShopifyAPI you will need to make the following changes.
-
-```ruby
-ShopifyAPI::Session.new(domain, token, extras)
-```
-is now
-```ruby
-ShopifyAPI::Session.new(domain: domain, token: token, api_version: api_version, extras: extras)
-```
-Note `extras` is still optional. The other arguments are required.
-
-```ruby
-ShopifyAPI::Session.temp(domain, token, extras) do
-  ...
-end
-```
-is now
-```ruby
-ShopifyAPI::Session.temp(domain: domain, token: token, api_version: api_version) do
-  ...
-end
-```
-
-For example, if you want to use the `2019-04` version, you will create a session like this:
-```ruby
-session = ShopifyAPI::Session.new(domain: domain, token: token, api_version: '2019-04')
-```
-if you want to use the `unstable` version, you will create a session like this:
-```ruby
-session = ShopifyAPI::Session.new(domain: domain, token: token, api_version: :unstable)
-```
-
-#### Changes to how to define resources
-
-If you have defined or customized Resources, classes that extend `ShopifyAPI::Base`:
-The use of `self.prefix =` has been deprecated; you should now use `self.resource =` and not include `/admin`.
-For example, if you specified a prefix like this before:
-```ruby
-class MyResource < ShopifyAPI::Base
-  self.prefix = '/admin/shop/'
-end
-```
-You will update this to:
-```ruby
-class MyResource < ShopifyAPI::Base
-  self.resource_prefix = 'shop/'
-end
-```
-
-#### URL construction
-
-If you have specified any full paths for API calls in find
-```ruby
-def self.current(options={})
-  find(:one, options.merge(from: "/admin/shop.#{format.extension}"))
-end
-```
-would be changed to
-
-```ruby
-def self.current(options = {})
-  find(:one, options.merge(
-    from: api_version.construct_api_path("shop.#{format.extension}")
-  ))
-end
-```
-
-#### URLs that have not changed
-
-- OAuth URLs for `authorize`, getting the `access_token` from a code, `access_scopes`, and using a `refresh_token` have _not_ changed.
-  - get: `/admin/oauth/authorize`
-  - post: `/admin/oauth/access_token`
-  - get: `/admin/oauth/access_scopes`
-- URLs for the merchant’s web admin have _not_ changed. For example: to send the merchant to the product page the url is still `/admin/product/<id>`
+## Breaking changes for older versions
 
+See [BREAKING_CHANGES_FOR_OLDER_VERSIONS](BREAKING_CHANGES_FOR_OLDER_VERSIONS.md)
 
 ## Developing this gem
 

data/RELEASING.md

@@ -1,6 +1,7 @@
 # Releasing ShopifyAPI
 
-1. Before releasing, make sure `sorbet` and `sorbet-runtime` are up to date
+1. Before releasing, make sure `sorbet` and related gems are up to date:
+   `bundle update sorbet sorbet-runtime sorbet-static tapioca --conservative`
 1. Check the Semantic Versioning page for info on how to version the new release: http://semver.org
 1. Update the version of ShopifyAPI in lib/shopify_api/version.rb
 1. Run `bundle`

data/lib/shopify_api/admin_versions.rb

@@ -5,14 +5,13 @@ module ShopifyAPI
   module AdminVersions
     SUPPORTED_ADMIN_VERSIONS = T.let([
       "unstable",
+      "2022-07",
       "2022-04",
       "2022-01",
       "2021-10",
-      "2021-07",
-      "2021-04",
     ], T::Array[String])
 
-    LATEST_SUPPORTED_ADMIN_VERSION = T.let("2022-04", String)
+    LATEST_SUPPORTED_ADMIN_VERSION = T.let("2022-07", String)
   end
 
   SUPPORTED_ADMIN_VERSIONS = ShopifyAPI::AdminVersions::SUPPORTED_ADMIN_VERSIONS

data/lib/shopify_api/auth/jwt_payload.rb

@@ -16,11 +16,12 @@ module ShopifyAPI
 
       sig { params(token: String).void }
       def initialize(token)
-        begin
-          payload_hash = JWT.decode(token, Context.api_secret_key, true,
-            { exp_leeway: JWT_EXPIRATION_LEEWAY, algorithm: "HS256" })[0]
-        rescue
-          raise ShopifyAPI::Errors::InvalidJwtTokenError, "Failed to parse session token '#{token}'"
+        payload_hash = begin
+          decode_token(token, Context.api_secret_key)
+        rescue ShopifyAPI::Errors::InvalidJwtTokenError
+          raise unless Context.old_api_secret_key
+
+          decode_token(token, T.must(Context.old_api_secret_key))
         end
 
         @iss = T.let(payload_hash["iss"], String)
@@ -67,6 +68,16 @@ module ShopifyAPI
           jti == other.jti &&
           sid == other.sid
       end
+
+      private
+
+      sig { params(token: String, api_secret_key: String).returns(T::Hash[String, T.untyped]) }
+      def decode_token(token, api_secret_key)
+        JWT.decode(token, api_secret_key, true,
+          { exp_leeway: JWT_EXPIRATION_LEEWAY, algorithm: "HS256" })[0]
+      rescue
+        raise ShopifyAPI::Errors::InvalidJwtTokenError, "Failed to parse session token '#{token}'"
+      end
     end
   end
 end

data/lib/shopify_api/context.rb

@@ -18,6 +18,7 @@ module ShopifyAPI
     @notified_missing_resources_folder = T.let({}, T::Hash[String, T::Boolean])
     @active_session = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
     @user_agent_prefix = T.let(nil, T.nilable(String))
+    @old_api_secret_key = T.let(nil, T.nilable(String))
 
     @rest_resource_loader = T.let(nil, T.nilable(Zeitwerk::Loader))
 
@@ -37,6 +38,7 @@ module ShopifyAPI
           logger: Logger,
           private_shop: T.nilable(String),
           user_agent_prefix: T.nilable(String),
+          old_api_secret_key: T.nilable(String),
         ).void
       end
       def setup(
@@ -50,7 +52,8 @@ module ShopifyAPI
         session_storage:,
         logger: Logger.new($stdout),
         private_shop: nil,
-        user_agent_prefix: nil
+        user_agent_prefix: nil,
+        old_api_secret_key: nil
       )
         unless ShopifyAPI::AdminVersions::SUPPORTED_ADMIN_VERSIONS.include?(api_version)
           raise Errors::UnsupportedVersionError,
@@ -68,6 +71,7 @@ module ShopifyAPI
         @logger = logger
         @private_shop = private_shop
         @user_agent_prefix = user_agent_prefix
+        @old_api_secret_key = old_api_secret_key
 
         load_rest_resources(api_version: api_version)
       end
@@ -118,7 +122,7 @@ module ShopifyAPI
       end
 
       sig { returns(T.nilable(String)) }
-      attr_reader :private_shop, :user_agent_prefix
+      attr_reader :private_shop, :user_agent_prefix, :old_api_secret_key
 
       sig { returns(T::Boolean) }
       def embedded?

data/lib/shopify_api/rest/resources/{2021_07 → 2022_07}/carrier_service.rb

@@ -20,7 +20,6 @@ module ShopifyAPI
       @admin_graphql_api_id = T.let(nil, T.nilable(String))
       @callback_url = T.let(nil, T.nilable(String))
       @carrier_service_type = T.let(nil, T.nilable(String))
-      @format = T.let(nil, T.nilable(String))
       @id = T.let(nil, T.nilable(Integer))
       @name = T.let(nil, T.nilable(String))
       @service_discovery = T.let(nil, T.nilable(T::Boolean))
@@ -44,8 +43,6 @@ module ShopifyAPI
     attr_reader :callback_url
     sig { returns(T.nilable(String)) }
     attr_reader :carrier_service_type
-    sig { returns(T.nilable(String)) }
-    attr_reader :format
     sig { returns(T.nilable(Integer)) }
     attr_reader :id
     sig { returns(T.nilable(String)) }

data/lib/shopify_api/rest/resources/{2021_07 → 2022_07}/customer.rb

@@ -23,6 +23,7 @@ module ShopifyAPI
       @currency = T.let(nil, T.nilable(String))
       @default_address = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
       @email = T.let(nil, T.nilable(String))
+      @email_marketing_consent = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
       @first_name = T.let(nil, T.nilable(String))
       @id = T.let(nil, T.nilable(Integer))
       @last_name = T.let(nil, T.nilable(String))
@@ -33,7 +34,10 @@ module ShopifyAPI
       @multipass_identifier = T.let(nil, T.nilable(String))
       @note = T.let(nil, T.nilable(String))
       @orders_count = T.let(nil, T.nilable(Integer))
+      @password = T.let(nil, T.nilable(String))
+      @password_confirmation = T.let(nil, T.nilable(String))
       @phone = T.let(nil, T.nilable(String))
+      @sms_marketing_consent = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
       @state = T.let(nil, T.nilable(String))
       @tags = T.let(nil, T.nilable(String))
       @tax_exempt = T.let(nil, T.nilable(T::Boolean))
@@ -73,6 +77,8 @@ module ShopifyAPI
     attr_reader :default_address
     sig { returns(T.nilable(String)) }
     attr_reader :email
+    sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+    attr_reader :email_marketing_consent
     sig { returns(T.nilable(String)) }
     attr_reader :first_name
     sig { returns(T.nilable(Integer)) }
@@ -94,7 +100,13 @@ module ShopifyAPI
     sig { returns(T.nilable(Integer)) }
     attr_reader :orders_count
     sig { returns(T.nilable(String)) }
+    attr_reader :password
+    sig { returns(T.nilable(String)) }
+    attr_reader :password_confirmation
+    sig { returns(T.nilable(String)) }
     attr_reader :phone
+    sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+    attr_reader :sms_marketing_consent
     sig { returns(T.nilable(String)) }
     attr_reader :state
     sig { returns(T.nilable(String)) }