shopify_api 9.4.0 → 9.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb95bdd7eace9c3fd781e8e05b8888b657ed84e85707f00d9220f049e13fdaa9
-  data.tar.gz: 856d86bf1f36fc436ad7d1a713b1956b5b69ef6c708b83edd4a5d6001eae5f91
+  metadata.gz: 9b4f86a8f19033687d5dda9d848efcc2906e506375d7f05365180afa065e0c7e
+  data.tar.gz: 47f66045afe505387863977fc14a02217fe85ac11d9d9d0f0e8ac061f2f2af6d
 SHA512:
-  metadata.gz: 978438061f1192357b7fe6b238f1fb88efb9d3129b4ed63efe0cab98330dd9420462cfb4548ee4024aeb4a5c9b07ea7d7ec865799798167b7dae09b2b26558f2
-  data.tar.gz: e07296eda7512ab2ba356bdf9f157e4dad758e4a2273d171c56423f0761815e8fd74a747f27b7c54ee33148f131e757e54b5ef1578c4c8506bf462905f2ea51a
+  metadata.gz: 2aa02363f15762bc316b4d5281799526ac00c9793570fc4b63ff41d7db033ae70ff046ca007d3d855dbb14dde54803a7d42e62a1466c45a30ddd3664493950a6
+  data.tar.gz: 5e720ca16972acd0dd2a96eac7d331d06ce3979efd7b97b007f612458f2b05de89d9a08a4d54bc8265553e3664811f3814c91b5cc8957317dd4e0f444f85c27a

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## Version 9.4.1
+
+* [#847](https://github.com/Shopify/shopify_api/pull/847) Update `create_permission_url` method to use grant_options
+* [#852](https://github.com/Shopify/shopify_api/pull/852) Bumping kramdown to fix a security vulnerability
+
 ## Version 9.4.0
 
 * [#843](https://github.com/Shopify/shopify_api/pull/843) Introduce a new `access_scopes` attribute on the Session class.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_api (9.4.0)
+    shopify_api (9.4.1)
       activeresource (>= 4.1.0, < 6.0.0)
       graphql-client
       rack
@@ -41,7 +41,7 @@ GEM
     eventmachine (1.2.7)
     ffi (1.12.2)
     forwardable-extended (2.6.0)
-    graphql (1.12.5)
+    graphql (1.12.6)
     graphql-client (0.16.0)
       activesupport (>= 3.0)
       graphql (~> 1.8)
@@ -68,7 +68,7 @@ GEM
       sassc (> 2.0.1, < 3.0)
     jekyll-watch (2.2.1)
       listen (~> 3.0)
-    kramdown (2.3.0)
+    kramdown (2.3.1)
       rexml
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)

data/README.md

@@ -149,7 +149,7 @@ Under the hood, the `create_permission_url` method is preparing the app to make
    * ``scope`` – Required – The list of required scopes (explained here: https://shopify.dev/tutorials/authenticate-with-oauth#scopes)
    * ``redirect_uri`` – Required – The URL where you want to redirect the users after they authorize the client. The complete URL specified here must be identical to one of the Application Redirect URLs set in the app's section of the Partners dashboard.
    * ``state`` – Optional – A randomly selected value provided by your application, which is unique for each authorization request. During the OAuth callback phase, your application must check that this value matches the one you provided during authorization. [This mechanism is essential for the security of your application](https://tools.ietf.org/html/rfc6819#section-3.6).
-   * ``grant_options[]`` - Optional - Set this parameter to `per-user` to receive an access token that respects the user's permission level when making API requests (called online access). We strongly recommend using this parameter for embedded apps.
+   * ``grant_options`` - Optional - Set this parameter to `per-user` to receive an access token that respects the user's permission level when making API requests (called online access). We strongly recommend using this parameter for embedded apps.
 
 ### 4) Trading your `code` for an access token.
 

data/lib/active_resource/detailed_log_subscriber.rb

@@ -3,6 +3,9 @@ module ActiveResource
   class DetailedLogSubscriber < ActiveSupport::LogSubscriber
     VERSION_EOL_WARNING_HEADER = 'x-shopify-api-version-warning'
     VERSION_DEPRECATION_HEADER = 'x-shopify-api-deprecated-reason'
+    SHOPIFY_ACCESS_TOKEN = 'X-Shopify-Access-Token'
+    FILTERED = '[FILTERED]'
+
     def request(event)
       log_request_response_details(event)
       warn_on_deprecated_header_or_version_eol_header(event)
@@ -17,6 +20,7 @@ module ActiveResource
     def log_request_response_details(event)
       data = event.payload[:data]
       headers = data.extract_options!
+      headers[SHOPIFY_ACCESS_TOKEN] = FILTERED
       request_body = data.first
 
       info("Request:\n#{request_body}") if request_body

data/lib/shopify_api/session.rb

@@ -103,6 +103,7 @@ module ShopifyAPI
     def create_permission_url(scope, redirect_uri, options = {})
       params = { client_id: api_key, scope: ShopifyAPI::ApiAccess.new(scope).to_s, redirect_uri: redirect_uri }
       params[:state] = options[:state] if options[:state]
+      params["grant_options[]".to_sym] = options[:grant_options] if options[:grant_options]
       construct_oauth_url("authorize", params)
     end
 

data/lib/shopify_api/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module ShopifyAPI
-  VERSION = "9.4.0"
+  VERSION = "9.4.1"
 end

data/test/detailed_log_subscriber_test.rb

@@ -14,7 +14,7 @@ class LogSubscriberTest < Test::Unit::TestCase
     @ua_header = "\"User-Agent\"=>\"ShopifyAPI/#{ShopifyAPI::VERSION} " \
       "ActiveResource/#{ActiveResource::VERSION::STRING} Ruby/#{RUBY_VERSION}\""
     @request_headers = "Headers: {\"Accept\"=>\"application/json\", " \
-      "#{@ua_header}, \"X-Shopify-Access-Token\"=>\"access_token\"}"
+      "#{@ua_header}, \"X-Shopify-Access-Token\"=>\"[FILTERED]\"}"
 
     ShopifyAPI::Base.clear_session
     fake(

data/test/session_test.rb

@@ -338,6 +338,22 @@ class SessionTest < Test::Unit::TestCase
     )
   end
 
+  test "create_permission_url returns correct url with grant_options[]" do
+    ShopifyAPI::Session.setup(api_key: "My_test_key", secret: "My test secret")
+    session = ShopifyAPI::Session.new(
+      domain: 'http://localhost.myshopify.com',
+      token: 'any-token',
+      api_version: any_api_version
+    )
+    scope = []
+    permission_url = session.create_permission_url(scope, "http://my_redirect_uri.com", grant_options: "per-user")
+    assert_equal(
+      "https://localhost.myshopify.com/admin/oauth/authorize?client_id=My_test_key&" \
+        "scope=&redirect_uri=http://my_redirect_uri.com&grant_options[]=per-user",
+      permission_url
+    )
+  end
+
   test "raise exception if code invalid in request token" do
     ShopifyAPI::Session.setup(api_key: "My test key", secret: "My test secret")
     session = ShopifyAPI::Session.new(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_api
 version: !ruby/object:Gem::Version
-  version: 9.4.0
+  version: 9.4.1
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-24 00:00:00.000000000 Z
+date: 2021-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeresource