shopify_app 17.1.0 → 17.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db6d499169653da5b11b813fe35e2ecf11312403cfa418c755e43c6b2dea3667
-  data.tar.gz: 39d42cd9bba1bc353a5959376758fc52a71cfb3005c25dd9defb9d0816210244
+  metadata.gz: b7c85212f0a947dfc426afa1c06eec9330bfd47ff42794f05d070e7e01cdbe42
+  data.tar.gz: f919606ea20ae9b7626983783dc99aa1fc7776fc0cc2fe1f87b35653847f86ee
 SHA512:
-  metadata.gz: 013f7337c0018134bd389a4c968118d8f26a4df9dca4d22a2dfe8de7d514f6914c5c11bd9e7446e3ab15d7c81c744967621f03c9fd354c43843706e77db79d21
-  data.tar.gz: 3cc55404a0dd1e4dc0d3dadf1226c1755d887f13698dd87d118589a8c325b657d85de719a8a49ec3e6dcf33e7191968f7b04b8caaf5f722ee9ad36c1513937cb
+  metadata.gz: 0ed7553a6e6c0397668e7897bb42871bc96375f2773d017f18c3ef60572fb3979cd7ce101c3ffcf601057134676b4881aa96097123438ba83275c20086a9d4aa
+  data.tar.gz: 2a37f8439ad82010abddbc9108e08de3d8ef3c574a7ee24b67eb3ec36cfd36856563658f2f5014815a9cbea7210f495f8672337b6cd2c0ce5445e61a46753ce8

data/.github/workflows/build.yml

@@ -1,7 +1,10 @@
 name: CI
 
-on: 
+on:
   push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
 
 jobs:
   build:

data/CHANGELOG.md

@@ -1,6 +1,10 @@
 Unreleased
 ----------
 
+17.1.1 (March 12, 2021)
+----------
+* Fix issues with mocking OmniAuth callback controller tests [#1210](https://github.com/Shopify/shopify_app/pull/1210)
+
 17.1.0 (March 5, 2021)
 ----------
 * Create OmniAuthConfiguration object to build future OmniAuth strategies [#1190](https://github.com/Shopify/shopify_app/pull/1190)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_app (17.1.0)
+    shopify_app (17.1.1)
       browser_sniffer (~> 1.2.2)
       jwt (~> 2.2.1)
       omniauth-shopify-oauth2 (~> 2.2.2)

data/app/controllers/shopify_app/callback_controller.rb

@@ -129,8 +129,7 @@ module ShopifyApp
     end
 
     def access_scopes
-      return unless auth_hash['extra']['scope']
-      auth_hash['extra']['scope']
+      auth_hash.dig('extra', 'scope')
     end
 
     def reset_session_options

data/docs/Troubleshooting.md

@@ -1,7 +1,20 @@
-Troubleshooting Shopify App
-===========
+# Troubleshooting Shopify App
 
-### Generator shopify_app:install hangs
+#### Table of contents
+
+[Generators](#generators)
+  * [The `shopify_app:install` generator hangs](#the-shopifyappinstall-generator-hangs)
+
+[App installation](#app-installation)
+  * [My app won't install](#my-app-wont-install)
+
+[JWT session tokens](#jwt-session-tokens)
+  * [My app is still using cookies to authenticate](#my-app-is-still-using-cookies-to-authenticate)
+  * [My app can't make requests to the Shopify API](#my-app-cant-make-requests-to-the-shopify-api)
+
+## Generators
+
+### The shopify_app:install generator hangs
 
 Rails uses spring by default to speed up development. To run the generator, spring has to be stopped:
 
@@ -11,6 +24,85 @@ $ bundle exec spring stop
 
 Run shopify_app generator again.
 
-### App installation fails with 'The page you’re looking for could not be found' if the app was installed before
+## App installation
+
+### My app won't install
+
+#### App installation fails with 'The page you’re looking for could not be found' if the app was installed before
 
 This issue can occur when the session (the model you set as `ShopifyApp::SessionRepository.storage`) isn't deleted when the user uninstalls your app. A possible fix for this is listening to the `app/uninstalled` webhook and deleting the corresponding session in the webhook handler.
+
+## JWT session tokens
+
+### My app is still using cookies to authenticate
+
+#### `shopify_app` gem version
+
+Ensure the app is using shopify_app gem v13.x.x+. See [*Upgrading to `v13.0.0`*](/docs/Upgrading.md#upgrading-to-v1300).
+
+#### `shopify_app` gem Rails configuration
+
+Edit `config/initializer/shopify_app.rb` and ensure the following configurations are set:
+
+```diff
++ config.embedded_app = true
+
++ config.allow_jwt_authentication = true
++ config.allow_cookie_authentication = false
+
+# This line should already exist if you're using shopify_app gem 13.x.x+
++ config.shop_session_repository = 'Shop'
+```
+
+#### Inspect server logs
+
+If you have checked the configurations above, and the app is still using cookies, then it is possible that the `shopify_app` gem defaulted to relying on cookies. This would happen when your browser allows third-party cookies and a session token was not successfully found as part of your request.
+
+In this case, check the server logs to see if the session token was invalid:
+
+```los
+[ShopifyApp::JWT] Failed to validate JWT: [JWT::<Error>] <Failure message>
+```
+
+*Example*
+
+```
+[ShopifyApp::JWT] Failed to validate JWT: [JWT::ImmatureSignature] Signature nbf has not been reached
+```
+
+**Note:** In a local development environment, you may want to temporarily update your `Gemfile` to point to a local instance of the `shopify_app` library instad of an installed gem. This will enable you to use a debugging tool like `byebug` to debug the library.
+
+```diff
+- gem 'shopify_app', '~> 14.2'
++ gem 'shopify_app', path: '/path/to/shopify_app'
+```
+
+### My app can't make requests to the Shopify API
+
+> **Note:** Session tokens cannot be used to make authenticated requests to the Shopify API. Learn more about authenticating your backend requests to Shopify APIs at [Shopify API authentication](https://shopify.dev/concepts/about-apis/authentication).
+
+#### The Shopify API returns `401 Unauthorized`
+
+If your app uses [user-based token storage](/docs/shopify_app/session-repository.md#user-based-token-storage), then your app is configured to use **online** access tokens (see [API access modes](https://shopify.dev/concepts/about-apis/authentication#api-access-modes) to learn the difference between "online" and "offline" access tokens ). Unlike offline access tokens, online access tokens expire daily and cannot be used to make authenticated requests to the Shopify API once they expire.
+
+Converting your app to use session tokens means that your app will most likely not go through the OAuth flow as often as it did when relying on cookie sessions. Since the online access tokens stored in your app's database are refreshed during OAuth, this may cause your app's user session repository to use expired online access tokens.
+
+If the Shopify API  returns `401 Unauthorized`, handle this error on your app by redirecting the user to your login path to start the OAuth flow. As a result, your app will be given a new online access token for the current user.
+
+> **Note:** The following are examples to common app configurations. Your specific use-case may differ.
+
+##### Example solution
+
+Add the following line to your app's unauthorized response handler:
+
+```diff
++ redirect_to(ShopifyApp.configuration.login_url, shop: current_shopify_domain)
+```
+
+_Example:_ If your embedded app cannot handle server-side XHR redirects, then configure your app's unauthorized response handler to set a response header:
+
+```
+X-Shopify-API-Request-Failure-Unauthorized: true
+```
+
+Then, use the [Shopify App Bridge Redirect](https://shopify.dev/tools/app-bridge/actions/navigation/redirect) action to redirect your app frontend to the app login URL if this header is set.

data/lib/shopify_app/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module ShopifyApp
-  VERSION = '17.1.0'
+  VERSION = '17.1.1'
 end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify_app",
-  "version": "17.1.0",
+  "version": "17.1.1",
   "repository": "git@github.com:Shopify/shopify_app.git",
   "author": "Shopify",
   "license": "MIT",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 17.1.0
+  version: 17.1.1
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-05 00:00:00.000000000 Z
+date: 2021-03-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: browser_sniffer