shopify_app 13.5.0

data/lib/shopify_app/jobs/scripttags_manager_job.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class ScripttagsManagerJob < ActiveJob::Base
+    queue_as do
+      ShopifyApp.configuration.scripttags_manager_queue_name
+    end
+
+    def perform(shop_domain:, shop_token:, scripttags:)
+      api_version = ShopifyApp.configuration.api_version
+      ShopifyAPI::Session.temp(domain: shop_domain, token: shop_token, api_version: api_version) do
+        manager = ScripttagsManager.new(scripttags, shop_domain)
+        manager.create_scripttags
+      end
+    end
+  end
+end

data/lib/shopify_app/jobs/webhooks_manager_job.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class WebhooksManagerJob < ActiveJob::Base
+    queue_as do
+      ShopifyApp.configuration.webhooks_manager_queue_name
+    end
+
+    def perform(shop_domain:, shop_token:, webhooks:)
+      api_version = ShopifyApp.configuration.api_version
+      ShopifyAPI::Session.temp(domain: shop_domain, token: shop_token, api_version: api_version) do
+        manager = WebhooksManager.new(webhooks)
+        manager.create_webhooks
+      end
+    end
+  end
+end

data/lib/shopify_app/managers/scripttags_manager.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class ScripttagsManager
+    class CreationFailed < StandardError; end
+
+    def self.queue(shop_domain, shop_token, scripttags)
+      ShopifyApp::ScripttagsManagerJob.perform_later(
+        shop_domain: shop_domain,
+        shop_token: shop_token,
+        # Procs cannot be serialized so we interpolate now, if necessary
+        scripttags: build_src(scripttags, shop_domain)
+      )
+    end
+
+    def self.build_src(scripttags, domain)
+      scripttags.map do |tag|
+        next tag unless tag[:src].respond_to?(:call)
+        tag = tag.dup
+        tag[:src] = tag[:src].call(domain)
+        tag
+      end
+    end
+
+    attr_reader :required_scripttags, :shop_domain
+
+    def initialize(scripttags, shop_domain)
+      @required_scripttags = scripttags
+      @shop_domain = shop_domain
+    end
+
+    def recreate_scripttags!
+      destroy_scripttags
+      create_scripttags
+    end
+
+    def create_scripttags
+      return unless required_scripttags.present?
+
+      expanded_scripttags.each do |scripttag|
+        create_scripttag(scripttag) unless scripttag_exists?(scripttag[:src])
+      end
+    end
+
+    def destroy_scripttags
+      scripttags = expanded_scripttags
+      ShopifyAPI::ScriptTag.all.each do |tag|
+        ShopifyAPI::ScriptTag.delete(tag.id) if required_scripttag?(scripttags, tag)
+      end
+
+      @current_scripttags = nil
+    end
+
+    private
+
+    def expanded_scripttags
+      self.class.build_src(required_scripttags, shop_domain)
+    end
+
+    def required_scripttag?(scripttags, tag)
+      scripttags.map { |w| w[:src] }.include?(tag.src)
+    end
+
+    def create_scripttag(attributes)
+      attributes.reverse_merge!(format: 'json')
+      scripttag = ShopifyAPI::ScriptTag.create(attributes)
+      raise CreationFailed, scripttag.errors.full_messages.to_sentence unless scripttag.persisted?
+      scripttag
+    end
+
+    def scripttag_exists?(src)
+      current_scripttags[src]
+    end
+
+    def current_scripttags
+      @current_scripttags ||= ShopifyAPI::ScriptTag.all.index_by(&:src)
+    end
+  end
+end

data/lib/shopify_app/managers/webhooks_manager.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class WebhooksManager
+    class CreationFailed < StandardError; end
+
+    def self.queue(shop_domain, shop_token, webhooks)
+      ShopifyApp::WebhooksManagerJob.perform_later(
+        shop_domain: shop_domain,
+        shop_token: shop_token,
+        webhooks: webhooks
+      )
+    end
+
+    attr_reader :required_webhooks
+
+    def initialize(webhooks)
+      @required_webhooks = webhooks
+    end
+
+    def recreate_webhooks!
+      destroy_webhooks
+      create_webhooks
+    end
+
+    def create_webhooks
+      return unless required_webhooks.present?
+
+      required_webhooks.each do |webhook|
+        create_webhook(webhook) unless webhook_exists?(webhook[:topic])
+      end
+    end
+
+    def destroy_webhooks
+      ShopifyAPI::Webhook.all.to_a.each do |webhook|
+        ShopifyAPI::Webhook.delete(webhook.id) if required_webhook?(webhook)
+      end
+
+      @current_webhooks = nil
+    end
+
+    private
+
+    def required_webhook?(webhook)
+      required_webhooks.map { |w| w[:address] }.include?(webhook.address)
+    end
+
+    def create_webhook(attributes)
+      attributes.reverse_merge!(format: 'json')
+      webhook = ShopifyAPI::Webhook.create(attributes)
+      raise CreationFailed, webhook.errors.full_messages.to_sentence unless webhook.persisted?
+      webhook
+    end
+
+    def webhook_exists?(topic)
+      current_webhooks[topic]
+    end
+
+    def current_webhooks
+      @current_webhooks ||= ShopifyAPI::Webhook.all.to_a.index_by(&:topic)
+    end
+  end
+end

data/lib/shopify_app/middleware/jwt_middleware.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class JWTMiddleware
+    TOKEN_REGEX = /^Bearer\s+(.*?)$/
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      return call_next(env) unless authorization_header(env)
+
+      token = extract_token(env)
+      return call_next(env) unless token
+
+      set_env_variables(token, env)
+      call_next(env)
+    end
+
+    private
+
+    def call_next(env)
+      @app.call(env)
+    end
+
+    def authorization_header(env)
+      env['HTTP_AUTHORIZATION']
+    end
+
+    def extract_token(env)
+      match = authorization_header(env).match(TOKEN_REGEX)
+      match && match[1]
+    end
+
+    def set_env_variables(token, env)
+      jwt = ShopifyApp::JWT.new(token)
+
+      env['jwt.shopify_domain'] = jwt.shopify_domain
+      env['jwt.shopify_user_id'] = jwt.shopify_user_id
+    end
+  end
+end

data/lib/shopify_app/middleware/same_site_cookie_middleware.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class SameSiteCookieMiddleware
+    COOKIE_SEPARATOR = "\n"
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+      user_agent = env['HTTP_USER_AGENT']
+
+      if headers && headers['Set-Cookie'] &&
+          BrowserSniffer.new(user_agent).same_site_none_compatible? &&
+          ShopifyApp.configuration.enable_same_site_none &&
+          Rack::Request.new(env).ssl?
+
+        set_cookies = headers['Set-Cookie']
+          .split(COOKIE_SEPARATOR)
+          .compact
+          .map do |cookie|
+            cookie << '; Secure' unless cookie =~ /;\s*secure/i
+            cookie << '; SameSite=None' unless cookie =~ /;\s*samesite=/i
+            cookie
+          end
+
+        headers['Set-Cookie'] = set_cookies.join(COOKIE_SEPARATOR)
+      end
+
+      [status, headers, body]
+    end
+  end
+end

data/lib/shopify_app/session/in_memory_session_store.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+module ShopifyApp
+  # rubocop:disable Style/ClassVars
+  # Class var repo is needed here in order to share data between the 2 child classes.
+  class InMemorySessionStore
+    class EnvironmentError < StandardError; end
+
+    def self.retrieve(id)
+      repo[id]
+    end
+
+    def self.store(session, *_args)
+      id = SecureRandom.uuid
+      repo[id] = session
+      id
+    end
+
+    def self.clear
+      @@repo = nil
+    end
+
+    def self.repo
+      if Rails.env.production?
+        raise EnvironmentError, "Cannot use InMemorySessionStore in a Production environment. \
+          Please initialize ShopifyApp with a model that can store and retrieve sessions"
+      end
+      @@repo ||= {}
+    end
+  end
+  # rubocop:enable Style/ClassVars
+end

data/lib/shopify_app/session/in_memory_shop_session_store.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class InMemoryShopSessionStore < InMemorySessionStore
+    def self.store(session, *args)
+      id = super
+      repo[session.domain] = session
+      id
+    end
+
+    def self.retrieve_by_shopify_domain(shopify_domain)
+      repo[shopify_domain]
+    end
+  end
+end

data/lib/shopify_app/session/in_memory_user_session_store.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class InMemoryUserSessionStore < InMemorySessionStore
+    def self.store(session, user)
+      id = super
+      repo[user.shopify_user_id] = session
+      id
+    end
+
+    def self.retrieve_by_shopify_user_id(user_id)
+      repo[user_id]
+    end
+  end
+end

data/lib/shopify_app/session/jwt.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class JWT
+    class InvalidDestinationError < StandardError; end
+    class MismatchedHostsError < StandardError; end
+    class InvalidAudienceError < StandardError; end
+
+    WARN_EXCEPTIONS = [
+      ::JWT::DecodeError,
+      ::JWT::ExpiredSignature,
+      ::JWT::ImmatureSignature,
+      ::JWT::VerificationError,
+      InvalidAudienceError,
+      InvalidDestinationError,
+      MismatchedHostsError,
+    ]
+
+    def initialize(token)
+      @token = token
+      set_payload
+    end
+
+    def shopify_domain
+      @payload && ShopifyApp::Utils.sanitize_shop_domain(@payload['dest'])
+    end
+
+    def shopify_user_id
+      @payload && @payload['sub']
+    end
+
+    private
+
+    def set_payload
+      payload, _ = parse_token_data(ShopifyApp.configuration&.secret, ShopifyApp.configuration&.old_secret)
+      @payload = validate_payload(payload)
+    rescue *WARN_EXCEPTIONS => error
+      Rails.logger.warn("[ShopifyApp::JWT] Failed to validate JWT: [#{error.class}] #{error}")
+      nil
+    end
+
+    def parse_token_data(secret, old_secret)
+      ::JWT.decode(@token, secret, true, { algorithm: 'HS256' })
+    rescue ::JWT::VerificationError
+      raise unless old_secret
+
+      ::JWT.decode(@token, old_secret, true, { algorithm: 'HS256' })
+    end
+
+    def validate_payload(payload)
+      dest_host = ShopifyApp::Utils.sanitize_shop_domain(payload['dest'])
+      iss_host = ShopifyApp::Utils.sanitize_shop_domain(payload['iss'])
+      api_key = ShopifyApp.configuration.api_key
+
+      raise InvalidAudienceError, "'aud' claim does not match api_key" unless payload['aud'] == api_key
+      raise InvalidDestinationError, "'dest' claim host not a valid shopify host" unless dest_host
+      raise MismatchedHostsError, "'dest' claim host does not match 'iss' claim host" unless dest_host == iss_host
+
+      payload
+    end
+  end
+end

data/lib/shopify_app/session/null_user_session_store.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class NullUserSessionStore
+    class << self
+      def retrieve(_)
+        nil
+      end
+
+      def store(_, _)
+        raise SessionRepository::ConfigurationError, 'user_storage is not configured'
+      end
+
+      def retrieve_by_shopify_user_id(_)
+        nil
+      end
+
+      def blank?
+        true
+      end
+    end
+  end
+end

data/lib/shopify_app/session/session_repository.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+module ShopifyApp
+  class SessionRepository
+    class ConfigurationError < StandardError; end
+
+    class << self
+      attr_writer :shop_storage
+
+      attr_writer :user_storage
+
+      def retrieve_shop_session(id)
+        shop_storage.retrieve(id)
+      end
+
+      def retrieve_user_session(id)
+        user_storage.retrieve(id)
+      end
+
+      def retrieve_shop_session_by_shopify_domain(shopify_domain)
+        shop_storage.retrieve_by_shopify_domain(shopify_domain)
+      end
+
+      def retrieve_user_session_by_shopify_user_id(user_id)
+        user_storage.retrieve_by_shopify_user_id(user_id)
+      end
+
+      def store_shop_session(session)
+        shop_storage.store(session)
+      end
+
+      def store_user_session(session, user)
+        user_storage.store(session, user)
+      end
+
+      def shop_storage
+        load_shop_storage || raise(ConfigurationError, "ShopifySessionRepository.shop_storage is not configured!")
+      end
+
+      def user_storage
+        load_user_storage
+      end
+
+      private
+
+      def load_shop_storage
+        return unless @shop_storage
+        @shop_storage.respond_to?(:safe_constantize) ? @shop_storage.safe_constantize : @shop_storage
+      end
+
+      def load_user_storage
+        return NullUserSessionStore unless @user_storage
+        @user_storage.respond_to?(:safe_constantize) ? @user_storage.safe_constantize : @user_storage
+      end
+    end
+  end
+end