shopify_app 20.0.0 → 20.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90ae6248163ec5df43b7859362604cd54d3c3402a13c34d47b81db36427262b9
-  data.tar.gz: f07b53d9d4d27e1c71531df33ac0ac2e1bc3d5c66244eda39a263eaaefa69fcf
+  metadata.gz: bd02305de4da4e2ffd996e7404103f9aa007d0f96dc7a8677e64bb358c27cd5c
+  data.tar.gz: 5519b4ee6fbb5c38de4e7e7c93a815dfe0a2722bc5e5280b834db8845f5341d3
 SHA512:
-  metadata.gz: 3e37d67ae0d3449af0b9027345f66a3783bf8bc11323977b400b1af0de0c77dd56751453047271bb30ce66e7a840a6c65f56e574590697ca71a4c4267be174a3
-  data.tar.gz: 3662b90bd2de575ba86a799ffb4c547d11132ba93e9655e8d53ae14c078b9e412fbc965404b65cf5665f4f7ee6d2cc3f12dd87de9ee0a92ce6b36ad4cad07fb1
+  metadata.gz: cc566b8087de98a2b75454611371bb2fe78d56e6e6fdf257f492fee8babe4fd96442309422be84fce66472e6780ce4cf59e9a20ee1343c73b322b5fff0c6683a
+  data.tar.gz: c760c3a573a3617adddcb0cb60b2517f8f27df2100781c172f88c7b8991bb728d4f2d03d0b86b3102b5342044580795bad02e3681bb4b7685de5fd640817e9c6

data/.github/workflows/cla.yml

@@ -0,0 +1,22 @@
+name: Contributor License Agreement (CLA)
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+  issue_comment:
+    types: [created]
+
+jobs:
+  cla:
+    runs-on: ubuntu-latest
+    if: |
+      (github.event.issue.pull_request 
+        && !github.event.issue.pull_request.merged_at
+        && contains(github.event.comment.body, 'signed')
+      ) 
+      || (github.event.pull_request && !github.event.pull_request.merged)
+    steps:
+      - uses: Shopify/shopify-cla-action@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cla-token: ${{ secrets.CLA_TOKEN }}

data/CHANGELOG.md

@@ -1,10 +1,28 @@
 Unreleased
 ----------
 
+20.1.0 (August 22, 2022)
+----------
+
+* Set the appropriate CSP `frame-ancestor` directive in controllers using the `EmbeddedApp` concern. [#1474](https://github.com/Shopify/shopify_app/pull/1474)
+* Allow [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare/) hosts in `config/environments/development.rb`.
+* Use [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare/) as example tunnel in readme/docs.
+* Change to optimize OAuth redirects to happen on the server side when possible.  Also, add an optional `.embedded_redirect_url` configuration parameter to enable customized App Bridge-supported redirect. [1483](https://github.com/Shopify/shopify_app/pull/1483)
+
+20.0.2 (July 7, 2022)
+----------
+
+* Bump [Shopify API](https://github.com/Shopify/shopify-api-ruby) to version 11.0.1. It includes [these updates](https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md#version-1101). Fix an issue where HMAC signature verification would fail in OAuth flows during API key rotation.
+
+20.0.1 (July 6, 2022)
+----------
+
+* Accept extra keyword arguments to WebhooksManagerJob to ease upgrade path from v18 or older (https://github.com/Shopify/shopify_app/pull/1466)
+
 20.0.0 (July 4, 2022)
 ----------
 
-* Bump [Shopify API](https://github.com/Shopify/shopify-api-ruby) to version 11.0.0. It includes [these updates](https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md#version-1100).  The breaking change relates to the removal of API version `2021-07` support.
+* Bump [Shopify API](https://github.com/Shopify/shopify-api-ruby) to version 11.0.0. It includes [these updates](https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md#version-1100). The breaking change relates to the removal of API version `2021-07` support.
 * Internal update, adding App Bridge 3 for redirect (only). [#1458](https://github.com/Shopify/shopify_app/pull/1458)
 
 19.1.0 (June 20, 2022)
@@ -18,15 +36,15 @@ Unreleased
 ----------
 
 * Fix regression in apps using online tokens. [#1413](https://github.com/Shopify/shopify_app/pull/1413)
-* Bump [Shopify API](https://github.com/Shopify/shopify_api) to version 10.0.3. It includes [these fixes](https://github.com/Shopify/shopify_api/blob/main/CHANGELOG.md#version-1003).
+* Bump [Shopify API](https://github.com/Shopify/shopify-api-ruby) to version 10.0.3. It includes [these fixes](https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md#version-1003).
 
 19.0.1 (April 11, 2022)
 ----------
-* Bump Shopify API (https://github.com/Shopify/shopify_api) to version 10.0.2. This update includes patch fixes since the initial v10 release.
+* Bump Shopify API (https://github.com/Shopify/shopify-api-ruby) to version 10.0.2. This update includes patch fixes since the initial v10 release.
 
 19.0.0 (April 6, 2022)
 ----------
-* Use v10 of the Shopify API (https://github.com/Shopify/shopify_api). This update requires changes to an app - please refer to the [migration guide](https://github.com/Shopify/shopify_app/blob/main/docs/Upgrading.md) for details.
+* Use v10 of the Shopify API (https://github.com/Shopify/shopify-api-ruby). This update requires changes to an app - please refer to the [migration guide](https://github.com/Shopify/shopify_app/blob/main/docs/Upgrading.md) for details.
 BREAKING, please see migration notes.
 
 18.1.2 (Mar 3, 2022)

data/Gemfile.lock

@@ -1,13 +1,13 @@
 PATH
   remote: .
   specs:
-    shopify_app (20.0.0)
+    shopify_app (20.1.0)
       activeresource
       browser_sniffer (~> 2.0)
       jwt (>= 2.2.3)
       rails (> 5.2.1)
       redirect_safely (~> 1.0)
-      shopify_api (~> 11.0)
+      shopify_api (~> 11.1)
       sprockets-rails (>= 2.0.0)
 
 GEM
@@ -124,7 +124,7 @@ GEM
     nokogiri (1.13.4)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
-    oj (3.13.15)
+    oj (3.13.21)
     openssl (3.0.0)
     parallel (1.21.0)
     parser (3.1.0.0)
@@ -194,7 +194,7 @@ GEM
       rubocop (~> 1.24)
     ruby-progressbar (1.11.0)
     securerandom (0.2.0)
-    shopify_api (11.0.0)
+    shopify_api (11.1.0)
       concurrent-ruby
       hash_diff
       httparty
@@ -204,7 +204,7 @@ GEM
       securerandom
       sorbet-runtime
       zeitwerk (~> 2.5)
-    sorbet-runtime (0.5.10139)
+    sorbet-runtime (0.5.10354)
     sprockets (4.1.1)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)

data/README.md

@@ -1,8 +1,6 @@
 # Shopify App
 
-**Shopify is doubling our engineering staff in 2021! [Join our team and work on libraries like this one.](https://smrtr.io/5GGrK)**
-
-[![Version][gem]][gem_url] [![Build Status](https://github.com/Shopify/shopify_app/workflows/CI/badge.svg)](https://github.com/Shopify/shopify_app/actions?query=workflow%3ACI) ![Supported Rails version][supported_rails_version]
+[![Version][gem]][gem_url] [![Build Status](https://github.com/Shopify/shopify_app/workflows/CI/badge.svg)](https://github.com/Shopify/shopify_app/actions?query=workflow%3ACI)
 
 [gem]: https://img.shields.io/gem/v/shopify_app.svg
 [gem_url]: https://rubygems.org/gems/shopify_app
@@ -34,6 +32,21 @@ This gem requires that you have the following credentials:
 - **Shopify API key:** The API key app credential specified in your [Shopify Partners dashboard](https://partners.shopify.com/organizations). 
 - **Shopify API secret:** The API secret key app credential specified in your [Shopify Partners dashboard](https://partners.shopify.com/organizations). 
 
+### OAuth Tunnel in Development
+
+In order to redirect OAuth requests securely to localhost, you'll need to setup a tunnel to redirect from the internet to localhost.
+
+We've validated that [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare/) works with this template.
+
+To do that, you can [install the `cloudflared` CLI tool](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation/), and run:
+
+```shell
+# Note that you can also use a different port
+cloudflared tunnel --url http://localhost:3000
+```
+
+You will need to keep this window running to maintain the tunnel during development.
+
 ## Usage
 
 1. To get started, create a new Rails app:
@@ -53,6 +66,7 @@ $ bundle add shopify_app
 ```
 SHOPIFY_API_KEY=<Your Shopify API key>
 SHOPIFY_API_SECRET=<Your Shopify API secret>
+HOST=<Your SSH tunnel host>
 ```
 
 > In a development environment, you can use a gem like `dotenv-rails` to manage environment variables. 
@@ -128,4 +142,4 @@ To learn more about how this gem authenticates with Shopify, see [*Authenticatio
 
 [Shopify's API is versioned](https://shopify.dev/concepts/about-apis/versioning). With Shopify App `v1.11.0`, the included Shopify API gem allows developers to specify and update the Shopify API version they want their app or service to use. The Shopify API gem also surfaces warnings to Rails apps about [deprecated endpoints, GraphQL fields and more](https://shopify.dev/concepts/about-apis/versioning#deprecation-practices).
 
-See the [Shopify API gem README](https://github.com/Shopify/shopify_api/) for more information.
+See the [Shopify API gem README](https://github.com/Shopify/shopify-api-ruby/) for more information.

data/app/controllers/concerns/shopify_app/require_known_shop.rb

@@ -3,6 +3,7 @@
 module ShopifyApp
   module RequireKnownShop
     extend ActiveSupport::Concern
+    include ShopifyApp::RedirectForEmbedded
 
     included do
       before_action :check_shop_domain
@@ -11,6 +12,7 @@ module ShopifyApp
 
     def current_shopify_domain
       return if params[:shop].blank?
+
       @shopify_domain ||= ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
     end
 
@@ -22,7 +24,13 @@ module ShopifyApp
 
     def check_shop_known
       @shop = SessionRepository.retrieve_shop_session_by_shopify_domain(current_shopify_domain)
-      redirect_to(shop_login) unless @shop
+      unless @shop
+        if embedded_param?
+          redirect_for_embedded
+        else
+          redirect_to(shop_login)
+        end
+      end
     end
 
     def shop_login

data/app/controllers/concerns/shopify_app/shop_access_scopes_verification.rb

@@ -3,6 +3,7 @@
 module ShopifyApp
   module ShopAccessScopesVerification
     extend ActiveSupport::Concern
+    include ShopifyApp::RedirectForEmbedded
 
     included do
       before_action :login_on_scope_changes
@@ -11,7 +12,13 @@ module ShopifyApp
     protected
 
     def login_on_scope_changes
-      redirect_to(shop_login) if scopes_mismatch?
+      if scopes_mismatch?
+        if embedded_param?
+          redirect_for_embedded
+        else
+          redirect_to(shop_login)
+        end
+      end
     end
 
     private
@@ -22,6 +29,7 @@ module ShopifyApp
 
     def current_shopify_domain
       return if params[:shop].blank?
+
       ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
     end
 

data/app/controllers/shopify_app/callback_controller.rb

@@ -43,7 +43,12 @@ module ShopifyApp
     private
 
     def respond_successfully
-      redirect_to(return_address)
+      if ShopifyAPI::Context.embedded?
+        return_to = session.delete(:return_to) || ""
+        redirect_to(ShopifyAPI::Auth.embedded_app_url(params[:host]) + return_to, allow_other_host: true)
+      else
+        redirect_to(return_address)
+      end
     end
 
     def respond_with_error
@@ -58,11 +63,13 @@ module ShopifyApp
     def start_user_token_flow?(shopify_session)
       return false unless ShopifyApp::SessionRepository.user_storage.present?
       return false if shopify_session.online?
+
       update_user_access_scopes?
     end
 
     def update_user_access_scopes?
       return true if session[:shopify_user_id].nil?
+
       user_access_scopes_strategy.update_access_scopes?(shopify_user_id: session[:shopify_user_id])
     end
 

data/app/controllers/shopify_app/sessions_controller.rb

@@ -3,6 +3,7 @@
 module ShopifyApp
   class SessionsController < ActionController::Base
     include ShopifyApp::LoginProtection
+    include ShopifyApp::RedirectForEmbedded
 
     layout false, only: :new
 
@@ -36,7 +37,13 @@ module ShopifyApp
 
       copy_return_to_param_to_session
 
-      if top_level?
+      if embedded_redirect_url?
+        if embedded_param?
+          redirect_for_embedded
+        else
+          start_oauth
+        end
+      elsif top_level?
         start_oauth
       else
         redirect_auth_to_top_level
@@ -82,6 +89,7 @@ module ShopifyApp
 
     def top_level?
       return true unless ShopifyApp.configuration.embedded_app?
+
       !params[:top_level].nil?
     end
 

data/config/locales/ja.yml

@@ -1,6 +1,6 @@
 ---
 ja:
-  logged_out: ログインに成功しました
+  logged_out: ログアウトに成功しました
   could_not_log_in: Shopifyストアにログインできませんでした
   invalid_shop_url: ショップのドメインが無効です
   enable_cookies_heading: "%{app}からのCookieを有効にする"
@@ -10,8 +10,8 @@ ja:
   top_level_interaction_heading: お使いのブラウザを更新する必要があります%{app}
   top_level_interaction_body: Shopifyがアプリを開けるように、ブラウザーはCookieにアクセスするための%{app}のようなアプリが必要です。
   top_level_interaction_action: 続ける
-  request_storage_access_heading: "%{app}クッキーにアクセスする必要がある"
-  request_storage_access_body: Cookieを使用すると、個人情報を一時的に保存することで、アプリ認証を受けることができます。[続行]
-    をクリックして、Cookieでアプリを使用できるようにします。
+  request_storage_access_heading: "%{app}はCookieへのアクセス許可が必要です"
+  request_storage_access_body: Cookieを使用すると、個人情報を一時的に保存することで、アプリ認証を受けることができます。[続ける]
+    をクリックすると、アプリはCookieを利用します。
   request_storage_access_footer: Cookieは30日後に有効期限が切れます。
   request_storage_access_action: 続ける

data/docs/Quickstart.md

@@ -12,12 +12,13 @@ This guide assumes you have completed the steps to create a new Rails app using
 
 Your local app needs to be accessible from the public Internet in order to install it on a Shopify store, to use the [App Proxy Controller](/lib/generators/shopify_app/app_proxy_controller/templates/app_proxy_controller.rb) or receive [webhooks](/docs/shopify_app/webhooks.md).
 
-Use a tunneling service like [ngrok](https://ngrok.com/), [Beeceptor](https://beeceptor.com/), [Mockbin](http://mockbin.org/), or [Hookbin](https://hookbin.com/) to make your development environment accessible to the internet.
+Use a tunneling service like [Cloudflare](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare/) to make your development environment accessible to the internet.
 
-For example with [ngrok](https://ngrok.com/), run this command to set up a tunnel proxy to Rails' default port:
+To use Cloudflare, [install the `cloudflared` CLI tool](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation/), and run:
 
-```sh
-ngrok http 3000
+```shell
+# Note that you can also use a different port
+cloudflared tunnel --url http://localhost:3000
 ```
 
 See the [*Embed the app in Shopify*](https://shopify.dev/tutorials/build-rails-react-app-that-uses-app-bridge-authentication#embed-the-app-in-shopify) section of [*Build a Shopify app with Rails, React, and App Bridge*](https://shopify.dev/tutorials/build-rails-react-app-that-uses-app-bridge-authentication) to learn more.

data/docs/Upgrading.md

@@ -4,6 +4,8 @@ This file documents important changes needed to upgrade your app's Shopify App v
 
 #### Table of contents
 
+[Upgrading to `v20.1.0`](#upgrading-to-v2010)
+
 [Upgrading to `v19.0.0`](#upgrading-to-v1900)
 
 [Upgrading to `v18.1.2`](#upgrading-to-v1812)
@@ -16,9 +18,18 @@ This file documents important changes needed to upgrade your app's Shopify App v
 
 [Upgrading from `v8.6` to `v9.0.0`](#upgrading-from-v86-to-v900)
 
+## Upgrading to `v20.1.0`
+
+Note that the following steps are *optional* and only apply to **embedded** applications. However, they can improve the loading time of your embedded app at installation and re-auth.
+
+- For embedded applications, update any controller that renders a full page reload (e.g: your home controller) to redirect using `Shopify::Auth.embedded_app_url`, if the `embedded` query argument is not present or does not equal `1`. Example [here](https://github.com/Shopify/shopify-app-template-ruby/pull/35/files#)
+- If your app already has a frontend that uses App Bridge, this gem now supports using that to redirect out of the iframe before OAuth.  Example [here](https://github.com/Shopify/shopify-frontend-template-react/blob/main/pages/ExitIframe.jsx)
+  - In your `shopify_app.rb` initializer, configure `.embedded_redirect_url` to the path of the route you added above.
+  - If you don't set this route, then the `shopify_app` gem will automatically load its own copy of App Bridge and perform this redirection without any additional configuration.
+
 ## Upgrading to `v19.0.0`
 
-This update moves API authentication logic from this gem to the [`shopify_api`](https://github.com/Shopify/shopify_api)
+This update moves API authentication logic from this gem to the [`shopify_api`](https://github.com/Shopify/shopify-api-ruby)
 gem.
 
 ### High-level process
@@ -31,7 +42,7 @@ gem.
   `config/initializers/shopify_app.rb` as the decision logic for which authentication method to use is now handled
   internally by the `shopify_api` gem, using the `ShopifyAPI::Context.embedded_app` setting.
 - `v19.0.0` updates the `shopify_api` dependency to `10.0.0`. This version of `shopify_api` has breaking changes. See
-  the documentation for addressing these breaking changes on GitHub [here](https://github.com/Shopify/shopify_api#breaking-change-notice-for-version-1000).
+  the documentation for addressing these breaking changes on GitHub [here](https://github.com/Shopify/shopify-api-ruby#breaking-change-notice-for-version-1000).
 
 ### Specific cases
 
@@ -87,6 +98,7 @@ Rails.application.config.after_initialize do
     ShopifyAPI::Context.setup(
       api_key: ShopifyApp.configuration.api_key,
       api_secret_key: ShopifyApp.configuration.secret,
+      old_api_secret_key: ShopifyApp.configuration.old_secret,
       api_version: ShopifyApp.configuration.api_version,
       host_name: URI(ENV.fetch('HOST', '')).host || '',
       scope: ShopifyApp.configuration.scope,
@@ -222,7 +234,7 @@ is changed to
 
 ### ShopifyAPI changes
 
-You will need to also follow the ShopifyAPI [upgrade guide](https://github.com/Shopify/shopify_api/blob/master/README.md#-breaking-change-notice-for-version-700-) to ensure your app is ready to work with API versioning.
+You will need to also follow the ShopifyAPI [upgrade guide](https://github.com/Shopify/shopify-api-ruby/blob/master/README.md#-breaking-change-notice-for-version-700-) to ensure your app is ready to work with API versioning.
 
 [dashboard]: https://partners.shopify.com
 [app-bridge]: https://shopify.dev/apps/tools/app-bridge

data/lib/generators/shopify_app/home_controller/templates/unauthenticated_home_controller.rb

@@ -6,7 +6,11 @@ class HomeController < ApplicationController
   include ShopifyApp::ShopAccessScopesVerification
 
   def index
-    @shop_origin = current_shopify_domain
-    @host = params[:host]
+    if ShopifyAPI::Context.embedded? && (!params[:embedded].present? || params[:embedded] != "1")
+      redirect_to(ShopifyAPI::Auth.embedded_app_url(params[:host]) + request.path, allow_other_host: true)
+    else
+      @shop_origin = current_shopify_domain
+      @host = params[:host]
+    end
   end
 end

data/lib/generators/shopify_app/install/install_generator.rb

@@ -13,6 +13,9 @@ module ShopifyApp
       class_option :embedded, type: :string, default: "true"
       class_option :api_version, type: :string, default: nil
 
+      NGROK_HOST = "/\[-\\w]+\\.ngrok\\.io/"
+      CLOUDFLARE_HOST = "/\[-\\w]+\\.trycloudflare\\.com/"
+
       def create_shopify_app_initializer
         @application_name = format_array_argument(options["application_name"])
         @scope = format_array_argument(options["scope"])
@@ -51,14 +54,34 @@ module ShopifyApp
       end
 
       def insert_hosts_into_development_config
+        "Rails.application.configure do\n"
+          .then { insert_tunnel_host_rules("ngrok", _1, NGROK_HOST + "\n") }
+          .then { insert_tunnel_host_rules("Cloudflare", _1, CLOUDFLARE_HOST + "\n") }
+      end
+
+      private
+
+      def add_comment_explaining_tunnel_host(provider_name, insert_after_line)
+        comment = "  # Allow #{provider_name} tunnels for secure Shopify OAuth redirects\n"
         inject_into_file(
           "config/environments/development.rb",
-          "  config.hosts = (config.hosts rescue []) << /\[-\\w]+\\.ngrok\\.io/\n",
-          after: "Rails.application.configure do\n"
+          comment,
+          after: insert_after_line
         )
+        comment
       end
 
-      private
+      def insert_tunnel_host_rules(provider_name, insert_after_line, provider_host_domain)
+        explaination_comment = add_comment_explaining_tunnel_host(provider_name, insert_after_line)
+        host_line = "  config.hosts = (config.hosts rescue []) << #{provider_host_domain}"
+
+        inject_into_file(
+          "config/environments/development.rb",
+          host_line,
+          after: explaination_comment
+        )
+        host_line
+      end
 
       def embedded_app?
         options["embedded"] == "true"

data/lib/shopify_app/access_scopes/user_strategy.rb

@@ -9,6 +9,7 @@ module ShopifyApp
         def update_access_scopes?(user_id: nil, shopify_user_id: nil)
           return update_access_scopes_for_user_id?(user_id) if user_id
           return update_access_scopes_for_shopify_user_id?(shopify_user_id) if shopify_user_id
+
           raise(InvalidInput, "#update_access_scopes? requires user_id or shopify_user_id parameter inputs")
         end
 

data/lib/shopify_app/configuration.rb

@@ -25,6 +25,7 @@ module ShopifyApp
     attr_accessor :root_url
     attr_writer :login_url
     attr_writer :login_callback_url
+    attr_accessor :embedded_redirect_url
 
     # customise ActiveJob queue names
     attr_accessor :scripttags_manager_queue_name
@@ -77,11 +78,13 @@ module ShopifyApp
 
     def shop_access_scopes_strategy
       return ShopifyApp::AccessScopes::NoopStrategy unless reauth_on_access_scope_changes
+
       ShopifyApp::AccessScopes::ShopStrategy
     end
 
     def user_access_scopes_strategy
       return ShopifyApp::AccessScopes::NoopStrategy unless reauth_on_access_scope_changes
+
       ShopifyApp::AccessScopes::UserStrategy
     end
 

data/lib/shopify_app/controller_concerns/embedded_app.rb

@@ -4,6 +4,8 @@ module ShopifyApp
   module EmbeddedApp
     extend ActiveSupport::Concern
 
+    include ShopifyApp::FrameAncestors
+
     included do
       if ShopifyApp.configuration.embedded_app?
         after_action(:set_esdk_headers)

data/lib/shopify_app/controller_concerns/frame_ancestors.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module FrameAncestors
+    extend ActiveSupport::Concern
+
+    included do
+      content_security_policy do |policy|
+        policy.frame_ancestors(-> do
+          domain_host = current_shopify_domain || "*.myshopify.com"
+          "https://#{domain_host} https://admin.shopify.com;"
+        end)
+      end
+    end
+  end
+end

data/lib/shopify_app/controller_concerns/login_protection.rb

@@ -6,6 +6,7 @@ module ShopifyApp
   module LoginProtection
     extend ActiveSupport::Concern
     include ShopifyApp::Itp
+    include ShopifyApp::SanitizedParams
 
     class ShopifyDomainNotFound < StandardError; end
 
@@ -56,6 +57,7 @@ module ShopifyApp
 
     def login_again_if_different_user_or_shop
       return unless session_id_conflicts_with_params || session_shop_conflicts_with_params
+
       clear_shopify_session
       redirect_to_login
     end
@@ -67,6 +69,7 @@ module ShopifyApp
     def jwt_expire_at
       expire_at = request.env["jwt.expire_at"]
       return unless expire_at
+
       expire_at - 5.seconds # 5s gap to start fetching new token in advance
     end
 
@@ -193,34 +196,6 @@ module ShopifyApp
       raise ShopifyDomainNotFound
     end
 
-    def sanitized_shop_name
-      @sanitized_shop_name ||= sanitize_shop_param(params)
-    end
-
-    def referer_sanitized_shop_name
-      return unless request.referer.present?
-
-      @referer_sanitized_shop_name ||= begin
-        referer_uri = URI(request.referer)
-        query_params = Rack::Utils.parse_query(referer_uri.query)
-
-        sanitize_shop_param(query_params.with_indifferent_access)
-      end
-    end
-
-    def sanitize_shop_param(params)
-      return unless params[:shop].present?
-      ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
-    end
-
-    def sanitized_params
-      request.query_parameters.clone.tap do |query_params|
-        if params[:shop].is_a?(String)
-          query_params[:shop] = sanitize_shop_param(params)
-        end
-      end
-    end
-
     def return_address
       return_address_with_params(shop: current_shopify_domain, host: host)
     rescue ShopifyDomainNotFound, ShopifyHostNotFound
@@ -259,6 +234,7 @@ module ShopifyApp
     def user_session_expected?
       return false if shop_session.nil?
       return false if ShopifyApp.configuration.shop_access_scopes_strategy.update_access_scopes?(shop_session.shop)
+
       !ShopifyApp.configuration.user_session_repository.blank? && ShopifyApp::SessionRepository.user_storage.present?
     end
   end

data/lib/shopify_app/controller_concerns/redirect_for_embedded.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module RedirectForEmbedded
+    include ShopifyApp::SanitizedParams
+
+    private
+
+    def embedded_redirect_url?
+      ShopifyApp.configuration.embedded_redirect_url.present?
+    end
+
+    def embedded_param?
+      embedded_redirect_url? && params[:embedded].present? && params[:embedded] == "1"
+    end
+
+    def redirect_for_embedded
+      redirect_to(redirect_uri_for_embedded)
+    end
+
+    def redirect_uri_for_embedded
+      redirect_query_params = {}
+      redirect_uri = "https://#{ShopifyAPI::Context.host_name}#{ShopifyApp.configuration.login_url}"
+      redirect_query_params[:shop] = sanitized_shop_name
+      redirect_query_params[:shop] ||= referer_sanitized_shop_name if referer_sanitized_shop_name.present?
+      redirect_query_params[:host] ||= params[:host] if params[:host].present?
+      redirect_uri = "#{redirect_uri}?#{redirect_query_params.to_query}" if redirect_query_params.present?
+
+      query_params = sanitized_params.except(:redirect_uri, :embedded)
+      query_params[:redirectUri] = redirect_uri
+
+      "#{ShopifyApp.configuration.embedded_redirect_url}?#{query_params.to_query}"
+    end
+  end
+end

data/lib/shopify_app/controller_concerns/sanitized_params.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module SanitizedParams
+    protected
+
+    def sanitized_shop_name
+      @sanitized_shop_name ||= sanitize_shop_param(params)
+    end
+
+    def referer_sanitized_shop_name
+      return unless request.referer.present?
+
+      @referer_sanitized_shop_name ||= begin
+        referer_uri = URI(request.referer)
+        query_params = Rack::Utils.parse_query(referer_uri.query)
+
+        sanitize_shop_param(query_params.with_indifferent_access)
+      end
+    end
+
+    def sanitize_shop_param(params)
+      return unless params[:shop].present?
+      ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
+    end
+
+    def sanitized_params
+      request.query_parameters.clone.tap do |query_params|
+        if params[:shop].is_a?(String)
+          query_params[:shop] = sanitize_shop_param(params)
+        end
+      end
+    end
+  end
+end

data/lib/shopify_app/engine.rb

@@ -7,6 +7,7 @@ module ShopifyApp
     def args_info(job)
       log_disabled_classes = ["ShopifyApp::ScripttagsManagerJob", "ShopifyApp::WebhooksManagerJob"]
       return "" if log_disabled_classes.include?(job.class.name)
+
       super
     end
   end

data/lib/shopify_app/jobs/webhooks_manager_job.rb

@@ -6,7 +6,7 @@ module ShopifyApp
       ShopifyApp.configuration.webhooks_manager_queue_name
     end
 
-    def perform(shop_domain:, shop_token:)
+    def perform(shop_domain:, shop_token:, **)
       ShopifyAPI::Auth::Session.temp(shop: shop_domain, access_token: shop_token) do |session|
         WebhooksManager.create_webhooks(session: session)
       end

data/lib/shopify_app/managers/scripttags_manager.rb

@@ -16,6 +16,7 @@ module ShopifyApp
     def self.build_src(scripttags, domain)
       scripttags.map do |tag|
         next tag unless tag[:src].respond_to?(:call)
+
         tag = tag.dup
         tag[:src] = tag[:src].call(domain)
         tag

data/lib/shopify_app/managers/webhooks_manager.rb

@@ -14,12 +14,14 @@ module ShopifyApp
 
       def create_webhooks(session:)
         return unless ShopifyApp.configuration.has_webhooks?
+
         ShopifyAPI::Webhooks::Registry.register_all(session: session)
       end
 
       def recreate_webhooks!(session:)
         destroy_webhooks
         return unless ShopifyApp.configuration.has_webhooks?
+
         add_registrations
         ShopifyAPI::Webhooks::Registry.register_all(session: session)
       end

data/lib/shopify_app/session/session_repository.rb

@@ -81,11 +81,13 @@ module ShopifyApp
 
       def load_shop_storage
         return unless @shop_storage
+
         @shop_storage.respond_to?(:safe_constantize) ? @shop_storage.safe_constantize : @shop_storage
       end
 
       def load_user_storage
         return NullUserSessionStore unless @user_storage
+
         @user_storage.respond_to?(:safe_constantize) ? @user_storage.safe_constantize : @user_storage
       end
     end

data/lib/shopify_app/utils.rb

@@ -16,6 +16,7 @@ module ShopifyApp
 
     def self.shop_login_url(shop:, host:, return_to:)
       return ShopifyApp.configuration.login_url unless shop
+
       url = URI(ShopifyApp.configuration.login_url)
 
       url.query = URI.encode_www_form(

data/lib/shopify_app/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ShopifyApp
-  VERSION = "20.0.0"
+  VERSION = "20.1.0"
 end

data/lib/shopify_app.rb

@@ -37,7 +37,10 @@ module ShopifyApp
   # controller concerns
   require "shopify_app/controller_concerns/csrf_protection"
   require "shopify_app/controller_concerns/localization"
+  require "shopify_app/controller_concerns/frame_ancestors"
   require "shopify_app/controller_concerns/itp"
+  require "shopify_app/controller_concerns/sanitized_params"
+  require "shopify_app/controller_concerns/redirect_for_embedded"
   require "shopify_app/controller_concerns/login_protection"
   require "shopify_app/controller_concerns/ensure_billing"
   require "shopify_app/controller_concerns/embedded_app"

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify_app",
-  "version": "20.0.0",
+  "version": "20.1.0",
   "repository": "git@github.com:Shopify/shopify_app.git",
   "author": "Shopify",
   "license": "MIT",

data/service.yml

@@ -1,4 +1,3 @@
 audience: partner
-classification: library
 slack_channels:
 - shopify_app_gem

data/shopify_app.gemspec

@@ -19,7 +19,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency("jwt", ">= 2.2.3")
   s.add_runtime_dependency("rails", "> 5.2.1")
   s.add_runtime_dependency("redirect_safely", "~> 1.0")
-  s.add_runtime_dependency("shopify_api", "~> 11.0")
+  s.add_runtime_dependency("shopify_api", "~> 11.1")
   s.add_runtime_dependency("sprockets-rails", ">= 2.0.0")
 
   s.add_development_dependency("byebug")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 20.0.0
+  version: 20.1.0
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-07-04 00:00:00.000000000 Z
+date: 2022-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeresource
@@ -86,14 +86,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '11.0'
+        version: '11.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '11.0'
+        version: '11.1'
 - !ruby/object:Gem::Dependency
   name: sprockets-rails
   requirement: !ruby/object:Gem::Requirement
@@ -260,8 +260,8 @@ files:
 - ".github/ISSUE_TEMPLATE/config.yml"
 - ".github/ISSUE_TEMPLATE/feature-request.md"
 - ".github/PULL_REQUEST_TEMPLATE.md"
-- ".github/probots.yml"
 - ".github/workflows/build.yml"
+- ".github/workflows/cla.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/rubocop.yml"
 - ".gitignore"
@@ -401,10 +401,13 @@ files:
 - lib/shopify_app/controller_concerns/csrf_protection.rb
 - lib/shopify_app/controller_concerns/embedded_app.rb
 - lib/shopify_app/controller_concerns/ensure_billing.rb
+- lib/shopify_app/controller_concerns/frame_ancestors.rb
 - lib/shopify_app/controller_concerns/itp.rb
 - lib/shopify_app/controller_concerns/localization.rb
 - lib/shopify_app/controller_concerns/login_protection.rb
 - lib/shopify_app/controller_concerns/payload_verification.rb
+- lib/shopify_app/controller_concerns/redirect_for_embedded.rb
+- lib/shopify_app/controller_concerns/sanitized_params.rb
 - lib/shopify_app/controller_concerns/webhook_verification.rb
 - lib/shopify_app/engine.rb
 - lib/shopify_app/jobs/scripttags_manager_job.rb

data/.github/probots.yml

@@ -1,2 +0,0 @@
-enabled:
-  - cla