shopify_app 13.0.0 → 14.0.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (86) hide show
  1. checksums.yaml +4 -4
  2. data/.github/PULL_REQUEST_TEMPLATE.md +6 -0
  3. data/.github/workflows/rubocop.yml +28 -0
  4. data/.rubocop.yml +13 -6
  5. data/.travis.yml +3 -3
  6. data/CHANGELOG.md +51 -0
  7. data/Gemfile +5 -0
  8. data/README.md +79 -41
  9. data/Rakefile +1 -0
  10. data/SECURITY.md +59 -0
  11. data/app/controllers/concerns/shopify_app/authenticated.rb +1 -0
  12. data/app/controllers/concerns/shopify_app/require_known_shop.rb +39 -0
  13. data/app/controllers/shopify_app/authenticated_controller.rb +1 -0
  14. data/app/controllers/shopify_app/callback_controller.rb +41 -10
  15. data/app/controllers/shopify_app/extension_verification_controller.rb +2 -7
  16. data/app/controllers/shopify_app/sessions_controller.rb +9 -6
  17. data/app/controllers/shopify_app/webhooks_controller.rb +6 -5
  18. data/config/locales/fi.yml +1 -1
  19. data/config/locales/nl.yml +7 -7
  20. data/config/routes.rb +1 -0
  21. data/docs/Quickstart.md +7 -17
  22. data/docs/Releasing.md +1 -0
  23. data/lib/generators/shopify_app/add_after_authenticate_job/add_after_authenticate_job_generator.rb +5 -3
  24. data/lib/generators/shopify_app/add_after_authenticate_job/templates/after_authenticate_job.rb +1 -0
  25. data/lib/generators/shopify_app/add_marketing_activity_extension/add_marketing_activity_extension_generator.rb +2 -1
  26. data/lib/generators/shopify_app/add_marketing_activity_extension/templates/marketing_activities_controller.rb +4 -4
  27. data/lib/generators/shopify_app/add_webhook/add_webhook_generator.rb +5 -4
  28. data/lib/generators/shopify_app/add_webhook/templates/{webhook_job.rb → webhook_job.rb.tt} +5 -0
  29. data/lib/generators/shopify_app/app_proxy_controller/app_proxy_controller_generator.rb +4 -3
  30. data/lib/generators/shopify_app/app_proxy_controller/templates/app_proxy_controller.rb +3 -3
  31. data/lib/generators/shopify_app/app_proxy_controller/templates/app_proxy_route.rb +10 -9
  32. data/lib/generators/shopify_app/authenticated_controller/authenticated_controller_generator.rb +1 -1
  33. data/lib/generators/shopify_app/controllers/controllers_generator.rb +1 -0
  34. data/lib/generators/shopify_app/home_controller/home_controller_generator.rb +22 -3
  35. data/lib/generators/shopify_app/home_controller/templates/index.html.erb +67 -17
  36. data/lib/generators/shopify_app/home_controller/templates/unauthenticated_home_controller.rb +10 -0
  37. data/lib/generators/shopify_app/install/install_generator.rb +10 -9
  38. data/lib/generators/shopify_app/install/templates/embedded_app.html.erb +1 -1
  39. data/lib/generators/shopify_app/install/templates/flash_messages.js +0 -2
  40. data/lib/generators/shopify_app/install/templates/omniauth.rb +2 -1
  41. data/lib/generators/shopify_app/install/templates/{shopify_app.rb → shopify_app.rb.tt} +2 -1
  42. data/lib/generators/shopify_app/install/templates/user_agent.rb +2 -1
  43. data/lib/generators/shopify_app/products_controller/products_controller_generator.rb +19 -0
  44. data/lib/generators/shopify_app/products_controller/templates/products_controller.rb +8 -0
  45. data/lib/generators/shopify_app/routes/routes_generator.rb +1 -0
  46. data/lib/generators/shopify_app/routes/templates/routes.rb +10 -9
  47. data/lib/generators/shopify_app/shop_model/shop_model_generator.rb +12 -7
  48. data/lib/generators/shopify_app/shop_model/templates/shop.rb +1 -0
  49. data/lib/generators/shopify_app/shopify_app_generator.rb +4 -3
  50. data/lib/generators/shopify_app/user_model/templates/user.rb +1 -0
  51. data/lib/generators/shopify_app/user_model/user_model_generator.rb +12 -7
  52. data/lib/generators/shopify_app/views/views_generator.rb +1 -0
  53. data/lib/shopify_app/configuration.rb +15 -8
  54. data/lib/shopify_app/controller_concerns/app_proxy_verification.rb +3 -3
  55. data/lib/shopify_app/controller_concerns/csrf_protection.rb +15 -0
  56. data/lib/shopify_app/controller_concerns/embedded_app.rb +3 -2
  57. data/lib/shopify_app/controller_concerns/localization.rb +1 -0
  58. data/lib/shopify_app/controller_concerns/login_protection.rb +60 -15
  59. data/lib/shopify_app/controller_concerns/payload_verification.rb +24 -0
  60. data/lib/shopify_app/controller_concerns/webhook_verification.rb +3 -18
  61. data/lib/shopify_app/engine.rb +5 -0
  62. data/lib/shopify_app/jobs/scripttags_manager_job.rb +1 -1
  63. data/lib/shopify_app/jobs/webhooks_manager_job.rb +1 -1
  64. data/lib/shopify_app/managers/scripttags_manager.rb +4 -3
  65. data/lib/shopify_app/managers/webhooks_manager.rb +4 -3
  66. data/lib/shopify_app/middleware/jwt_middleware.rb +42 -0
  67. data/lib/shopify_app/middleware/same_site_cookie_middleware.rb +2 -1
  68. data/lib/shopify_app/session/in_memory_session_store.rb +7 -3
  69. data/lib/shopify_app/session/in_memory_shop_session_store.rb +10 -0
  70. data/lib/shopify_app/session/in_memory_user_session_store.rb +10 -0
  71. data/lib/shopify_app/session/jwt.rb +61 -0
  72. data/lib/shopify_app/session/null_user_session_store.rb +22 -0
  73. data/lib/shopify_app/session/session_repository.rb +13 -16
  74. data/lib/shopify_app/session/session_storage.rb +1 -0
  75. data/lib/shopify_app/session/shop_session_storage.rb +21 -9
  76. data/lib/shopify_app/session/user_session_storage.rb +19 -8
  77. data/lib/shopify_app/test_helpers/all.rb +2 -0
  78. data/lib/shopify_app/test_helpers/webhook_verification_helper.rb +17 -0
  79. data/lib/shopify_app/utils.rb +6 -5
  80. data/lib/shopify_app/version.rb +2 -1
  81. data/lib/shopify_app.rb +12 -5
  82. data/package-lock.json +10 -78
  83. data/package.json +1 -1
  84. data/shopify_app.gemspec +12 -7
  85. data/yarn.lock +12 -12
  86. metadata +53 -10
@@ -1,3 +1,4 @@
1
+ # frozen_string_literal: true
1
2
  module Shopify
2
3
  class AfterAuthenticateJob < ActiveJob::Base
3
4
  def perform(shop_domain:)
@@ -1,3 +1,4 @@
1
+ # frozen_string_literal: true
1
2
  require 'rails/generators/base'
2
3
 
3
4
  module ShopifyApp
@@ -6,7 +7,7 @@ module ShopifyApp
6
7
  source_root File.expand_path('../templates', __FILE__)
7
8
 
8
9
  def generate_app_extension
9
- template "marketing_activities_controller.rb", "app/controllers/marketing_activities_controller.rb"
10
+ template("marketing_activities_controller.rb", "app/controllers/marketing_activities_controller.rb")
10
11
  generate_routes
11
12
  end
12
13
 
@@ -3,7 +3,7 @@
3
3
  class MarketingActivitiesController < ShopifyApp::ExtensionVerificationController
4
4
  def preload_form_data
5
5
  preload_data = {
6
- "form_data": {}
6
+ "form_data": {},
7
7
  }
8
8
  render(json: preload_data, status: :ok)
9
9
  end
@@ -31,14 +31,14 @@ class MarketingActivitiesController < ShopifyApp::ExtensionVerificationControlle
31
31
  "preview_url": placeholder_img,
32
32
  "content_type": "text/html",
33
33
  "width": 360,
34
- "height": 200
34
+ "height": 200,
35
35
  },
36
36
  "mobile": {
37
37
  "preview_url": placeholder_img,
38
38
  "content_type": "text/html",
39
39
  "width": 360,
40
- "height": 200
41
- }
40
+ "height": 200,
41
+ },
42
42
  }
43
43
  render(json: preview_response, status: :ok)
44
44
  end
@@ -1,3 +1,4 @@
1
+ # frozen_string_literal: true
1
2
  require 'rails/generators/base'
2
3
 
3
4
  module ShopifyApp
@@ -8,7 +9,7 @@ module ShopifyApp
8
9
  class_option :address, type: :string, aliases: "-a", required: true
9
10
 
10
11
  hook_for :test_framework, as: :job, in: :rails do |instance, generator|
11
- instance.invoke generator, [ instance.send(:job_file_name) ]
12
+ instance.invoke(generator, [instance.send(:job_file_name)])
12
13
  end
13
14
 
14
15
  def init_webhook_config
@@ -32,14 +33,14 @@ module ShopifyApp
32
33
  initializer = load_initializer
33
34
 
34
35
  unless initializer.include?(webhook_config)
35
- shell.say "Error adding webhook to config. Add this line manually: #{webhook_config}", :red
36
+ shell.say("Error adding webhook to config. Add this line manually: #{webhook_config}", :red)
36
37
  end
37
38
  end
38
39
 
39
40
  def add_webhook_job
40
41
  @job_file_name = job_file_name + '_job'
41
- @job_class_name = @job_file_name.classify
42
- template 'webhook_job.rb', "app/jobs/#{@job_file_name}.rb"
42
+ @job_class_name = @job_file_name.classify
43
+ template('webhook_job.rb', "app/jobs/#{@job_file_name}.rb")
43
44
  end
44
45
 
45
46
  private
@@ -2,6 +2,11 @@ class <%= @job_class_name %> < ActiveJob::Base
2
2
  def perform(shop_domain:, webhook:)
3
3
  shop = Shop.find_by(shopify_domain: shop_domain)
4
4
 
5
+ if shop.nil?
6
+ logger.error("#{self.class} failed: cannot find shop with domain '#{shop_domain}'")
7
+ return
8
+ end
9
+
5
10
  shop.with_shopify_session do
6
11
  end
7
12
  end
@@ -1,3 +1,4 @@
1
+ # frozen_string_literal: true
1
2
  require 'rails/generators/base'
2
3
 
3
4
  module ShopifyApp
@@ -6,11 +7,11 @@ module ShopifyApp
6
7
  source_root File.expand_path('../templates', __FILE__)
7
8
 
8
9
  def create_app_proxy_controller
9
- template 'app_proxy_controller.rb', 'app/controllers/app_proxy_controller.rb'
10
+ template('app_proxy_controller.rb', 'app/controllers/app_proxy_controller.rb')
10
11
  end
11
12
 
12
13
  def create_app_proxy_index_view
13
- copy_file 'index.html.erb', 'app/views/app_proxy/index.html.erb'
14
+ copy_file('index.html.erb', 'app/views/app_proxy/index.html.erb')
14
15
  end
15
16
 
16
17
  def add_app_proxy_route
@@ -18,7 +19,7 @@ module ShopifyApp
18
19
  'config/routes.rb',
19
20
  File.read(File.expand_path(find_in_source_paths('app_proxy_route.rb'))),
20
21
  after: "mount ShopifyApp::Engine, at: '/'\n"
21
- )
22
+ )
22
23
  end
23
24
  end
24
25
  end
@@ -1,8 +1,8 @@
1
+ # frozen_string_literal: true
1
2
  class AppProxyController < ApplicationController
2
- include ShopifyApp::AppProxyVerification
3
+ include ShopifyApp::AppProxyVerification
3
4
 
4
5
  def index
5
- render layout: false, content_type: 'application/liquid'
6
+ render(layout: false, content_type: 'application/liquid')
6
7
  end
7
-
8
8
  end
@@ -1,10 +1,11 @@
1
+ # frozen_string_literal: true
1
2
 
2
- namespace :app_proxy do
3
- root action: 'index'
4
- # simple routes without a specified controller will go to AppProxyController
5
-
6
- # more complex routes will go to controllers in the AppProxy namespace
7
- # resources :reviews
8
- # GET /app_proxy/reviews will now be routed to
9
- # AppProxy::ReviewsController#index, for example
10
- end
3
+ namespace :app_proxy do
4
+ root action: 'index'
5
+ # simple routes without a specified controller will go to AppProxyController
6
+
7
+ # more complex routes will go to controllers in the AppProxy namespace
8
+ # resources :reviews
9
+ # GET /app_proxy/reviews will now be routed to
10
+ # AppProxy::ReviewsController#index, for example
11
+ end
@@ -7,7 +7,7 @@ module ShopifyApp
7
7
  class AuthenticatedControllerGenerator < Rails::Generators::Base
8
8
  source_root File.expand_path('../templates', __FILE__)
9
9
 
10
- def create_home_controller
10
+ def create_authenticated_controller
11
11
  template('authenticated_controller.rb', 'app/controllers/authenticated_controller.rb')
12
12
  end
13
13
  end
@@ -1,3 +1,4 @@
1
+ # frozen_string_literal: true
1
2
  require 'rails/generators/base'
2
3
 
3
4
  module ShopifyApp
@@ -1,3 +1,4 @@
1
+ # frozen_string_literal: true
1
2
  require 'rails/generators/base'
2
3
 
3
4
  module ShopifyApp
@@ -5,21 +6,39 @@ module ShopifyApp
5
6
  class HomeControllerGenerator < Rails::Generators::Base
6
7
  source_root File.expand_path('../templates', __FILE__)
7
8
 
9
+ class_option :with_session_token, type: :boolean, default: false
10
+
8
11
  def create_home_controller
9
- template 'home_controller.rb', 'app/controllers/home_controller.rb'
12
+ @with_session_token = options['with_session_token']
13
+
14
+ template(home_controller_template, 'app/controllers/home_controller.rb')
15
+ end
16
+
17
+ def create_products_controller
18
+ generate("shopify_app:products_controller") if with_session_token?
10
19
  end
11
20
 
12
21
  def create_home_index_view
13
- copy_file 'index.html.erb', 'app/views/home/index.html.erb'
22
+ template('index.html.erb', 'app/views/home/index.html.erb')
14
23
  end
15
24
 
16
25
  def add_home_index_route
17
- route "root :to => 'home#index'"
26
+ route("root :to => 'home#index'")
18
27
  end
19
28
 
29
+ private
30
+
20
31
  def embedded_app?
21
32
  ShopifyApp.configuration.embedded_app?
22
33
  end
34
+
35
+ def with_session_token?
36
+ @with_session_token
37
+ end
38
+
39
+ def home_controller_template
40
+ with_session_token? ? 'unauthenticated_home_controller.rb' : 'home_controller.rb'
41
+ end
23
42
  end
24
43
  end
25
44
  end
@@ -1,21 +1,71 @@
1
- <h2>Products</h2>
1
+ <!DOCTYPE html>
2
+ <html lang="<%= I18n.locale %>">
3
+ <head>
4
+ <meta charset="utf-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
6
+ <link
7
+ rel="stylesheet"
8
+ href="https://unpkg.com/@shopify/polaris@4.25.0/styles.min.css"
9
+ />
10
+ <% if @with_session_token %> <script>
11
+ document.addEventListener("DOMContentLoaded", async function() {
12
+ var SessionToken = window["app-bridge"].actions.SessionToken
13
+ var app = window.app;
2
14
 
3
- <ul>
4
- <% @products.each do |product| %>
5
- <li><%= link_to product.title, "https://#{@current_shopify_session.domain}/admin/products/#{product.id}", target: "_top" %></li>
6
- <% end %>
7
- </ul>
15
+ app.dispatch(
16
+ SessionToken.request(),
17
+ );
8
18
 
9
- <hr>
19
+ // Save a session token for future requests
20
+ window.sessionToken = await new Promise((resolve) => {
21
+ app.subscribe(SessionToken.ActionType.RESPOND, (data) => {
22
+ resolve(data.sessionToken || "");
23
+ });
24
+ });
10
25
 
11
- <h2>Webhooks</h2>
26
+ var fetchProducts = function() {
27
+ var headers = new Headers({ "Authorization": "Bearer " + window.sessionToken });
28
+ return fetch("/products", { headers })
29
+ .then(response => response.json())
30
+ .then(data => {
31
+ var products = data.products;
12
32
 
13
- <% if @webhooks.present? %>
14
- <ul>
15
- <% @webhooks.each do |webhook| %>
16
- <li><%= webhook.topic %> : <%= webhook.address %></li>
17
- <% end %>
18
- </ul>
19
- <% else %>
20
- <p>This app has not created any webhooks for this Shop. Add webhooks to your ShopifyApp initializer if you need webhooks</p>
21
- <% end %>
33
+ if (products === undefined || products.length == 0) {
34
+ document.getElementById("products").innerHTML = "<br>No products to display.";
35
+ } else {
36
+ var list = "";
37
+ products.forEach((product) => {
38
+ var link = `<a target="_top" href="https://<%%= @shop_origin %>/admin/products/${product.id}">`
39
+ list += "<li>" + link + product.title + "</a></li>";
40
+ });
41
+ document.getElementById("products").innerHTML = "<ul>" + list + "</ul>";
42
+ }
43
+ });
44
+ }();
45
+ });
46
+ </script>
47
+ <% end %> </head>
48
+ <body>
49
+ <h2>Products</h2>
50
+ <% if @with_session_token %> <div id="products"><br>Loading...</div><% else %>
51
+ <ul>
52
+ <%% @products.each do |product| %>
53
+ <li><%%= link_to product.title, "https://#{@current_shopify_session.domain}/admin/products/#{product.id}", target: "_top" %></li>
54
+ <%% end %>
55
+ </ul>
56
+
57
+ <hr>
58
+
59
+ <h2>Webhooks</h2>
60
+
61
+ <%% if @webhooks.present? %>
62
+ <ul>
63
+ <%% @webhooks.each do |webhook| %>
64
+ <li><%%= webhook.topic %> : <%%= webhook.address %></li>
65
+ <%% end %>
66
+ </ul>
67
+ <%% else %>
68
+ <p>This app has not created any webhooks for this Shop. Add webhooks to your ShopifyApp initializer if you need webhooks</p>
69
+ <%% end %><% end %>
70
+ </body>
71
+ </html>
@@ -0,0 +1,10 @@
1
+ # frozen_string_literal: true
2
+
3
+ class HomeController < ApplicationController
4
+ include ShopifyApp::EmbeddedApp
5
+ include ShopifyApp::RequireKnownShop
6
+
7
+ def index
8
+ @shop_origin = current_shopify_domain
9
+ end
10
+ end
@@ -1,3 +1,4 @@
1
+ # frozen_string_literal: true
1
2
  require 'rails/generators/base'
2
3
 
3
4
  module ShopifyApp
@@ -16,7 +17,7 @@ module ShopifyApp
16
17
  @scope = format_array_argument(options['scope'])
17
18
  @api_version = options['api_version'] || ShopifyAPI::Meta.admin_versions.find(&:latest_supported).handle
18
19
 
19
- template 'shopify_app.rb', 'config/initializers/shopify_app.rb'
20
+ template('shopify_app.rb', 'config/initializers/shopify_app.rb')
20
21
  end
21
22
 
22
23
  def create_session_store_initializer
@@ -24,28 +25,28 @@ module ShopifyApp
24
25
  end
25
26
 
26
27
  def create_and_inject_into_omniauth_initializer
27
- unless File.exist? "config/initializers/omniauth.rb"
28
- copy_file 'omniauth.rb', 'config/initializers/omniauth.rb'
28
+ unless File.exist?("config/initializers/omniauth.rb")
29
+ copy_file('omniauth.rb', 'config/initializers/omniauth.rb')
29
30
  end
30
31
 
31
32
  inject_into_file(
32
33
  'config/initializers/omniauth.rb',
33
34
  File.read(File.expand_path(find_in_source_paths('shopify_provider.rb'))),
34
- after: "Rails.application.config.middleware.use OmniAuth::Builder do\n"
35
+ after: "Rails.application.config.middleware.use(OmniAuth::Builder) do\n"
35
36
  )
36
37
  end
37
38
 
38
39
  def create_embedded_app_layout
39
40
  return unless embedded_app?
40
41
 
41
- copy_file 'embedded_app.html.erb', 'app/views/layouts/embedded_app.html.erb'
42
- copy_file '_flash_messages.html.erb', 'app/views/layouts/_flash_messages.html.erb'
42
+ copy_file('embedded_app.html.erb', 'app/views/layouts/embedded_app.html.erb')
43
+ copy_file('_flash_messages.html.erb', 'app/views/layouts/_flash_messages.html.erb')
43
44
 
44
45
  if ShopifyApp.use_webpacker?
45
46
  copy_file('shopify_app.js', 'app/javascript/shopify_app/shopify_app.js')
46
47
  copy_file('flash_messages.js', 'app/javascript/shopify_app/flash_messages.js')
47
48
  copy_file('shopify_app_index.js', 'app/javascript/shopify_app/index.js')
48
- append_to_file('app/javascript/packs/application.js', 'require("shopify_app")')
49
+ append_to_file('app/javascript/packs/application.js', "require(\"shopify_app\")\n")
49
50
  else
50
51
  copy_file('shopify_app.js', 'app/assets/javascripts/shopify_app.js')
51
52
  copy_file('flash_messages.js', 'app/assets/javascripts/flash_messages.js')
@@ -53,11 +54,11 @@ module ShopifyApp
53
54
  end
54
55
 
55
56
  def create_user_agent_initializer
56
- template 'user_agent.rb', 'config/initializers/user_agent.rb'
57
+ template('user_agent.rb', 'config/initializers/user_agent.rb')
57
58
  end
58
59
 
59
60
  def mount_engine
60
- route "mount ShopifyApp::Engine, at: '/'"
61
+ route("mount ShopifyApp::Engine, at: '/'")
61
62
  end
62
63
 
63
64
  def insert_hosts_into_development_config
@@ -28,7 +28,7 @@
28
28
 
29
29
  <%= content_tag(:div, nil, id: 'shopify-app-init', data: {
30
30
  api_key: ShopifyApp.configuration.api_key,
31
- shop_origin: (@current_shopify_session.domain if @current_shopify_session),
31
+ shop_origin: @shop_origin || (@current_shopify_session.domain if @current_shopify_session),
32
32
  debug: Rails.env.development?
33
33
  } ) %>
34
34
 
@@ -20,7 +20,5 @@ if (!document.documentElement.hasAttribute("data-turbolinks-preview")) {
20
20
  isError: true,
21
21
  }).dispatch(Toast.Action.SHOW);
22
22
  }
23
-
24
- document.removeEventListener(eventName, flash)
25
23
  });
26
24
  }
@@ -1,2 +1,3 @@
1
- Rails.application.config.middleware.use OmniAuth::Builder do
1
+ # frozen_string_literal: true
2
+ Rails.application.config.middleware.use(OmniAuth::Builder) do
2
3
  end
@@ -8,7 +8,8 @@ ShopifyApp.configure do |config|
8
8
  config.embedded_app = <%= embedded_app? %>
9
9
  config.after_authenticate_job = false
10
10
  config.api_version = "<%= @api_version %>"
11
- config.shop_session_repository = 'ShopifyApp::InMemoryShopSessionStore'
11
+ config.shop_session_repository = 'Shop'
12
+ config.allow_jwt_authentication = true
12
13
  end
13
14
 
14
15
  # ShopifyApp::Utils.fetch_known_api_versions # Uncomment to fetch known api versions from shopify servers on boot
@@ -1,5 +1,6 @@
1
+ # frozen_string_literal: true
1
2
  module ShopifyAPI
2
3
  class Base < ActiveResource::Base
3
- self.headers['User-Agent'] << " | ShopifyApp/#{ShopifyApp::VERSION}"
4
+ headers['User-Agent'] << " | ShopifyApp/#{ShopifyApp::VERSION}"
4
5
  end
5
6
  end
@@ -0,0 +1,19 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'rails/generators/base'
4
+
5
+ module ShopifyApp
6
+ module Generators
7
+ class ProductsControllerGenerator < Rails::Generators::Base
8
+ source_root File.expand_path('../templates', __FILE__)
9
+
10
+ def create_products_controller
11
+ template('products_controller.rb', 'app/controllers/products_controller.rb')
12
+ end
13
+
14
+ def add_products_route
15
+ route("get '/products', :to => 'products#index'")
16
+ end
17
+ end
18
+ end
19
+ end