shopify_app 20.0.1 → 20.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e588908fe2fd441a2e68e2c7081d9a08ae52ce95407254e96931228a2ead29f4
-  data.tar.gz: 061ba9bc6223dda87ac73d8c18994cf397c8bbd901335c3c165d21b31f4db413
+  metadata.gz: 87362d48113e64119d57d3f458fc3334f8097a7a234b9a77e806b327baa55196
+  data.tar.gz: 07bd6f5051b5e77a6c360699fb6fa090e55e8d7674ba9814eadcf025a8566523
 SHA512:
-  metadata.gz: 9815c07302e155feeb0ec22d734120b43ce5d1ba65d3cf22068936811971054e91c416118d046f4e9ceb1a91e107db0b020e95aca1c3bee054e7b5807b53c102
-  data.tar.gz: 7c90c68e8109862cc886dc037fd88583b096f4c423a2eb4018c92984d3790150e9bdef9f0db7a7666a9942343c9cde7c3be60c19519559371aac29193fdf7841
+  metadata.gz: 750c1ffd57c2922165af74710a27e243b4a32fb016b393e22c8f861428700c754ebacc98e9c6604c0937df0a2197ed164444b1fe0bc9bab28c84b4d2be5ff2d0
+  data.tar.gz: fc987464248ff4c0e88a91c9b5e8150659ef93f683a9912a3b1088e80fe50057bf6a821eb169a18d4e82e5a190d42abb82c10bcf6159a744831bdc07a7583a51

data/.github/workflows/cla.yml

@@ -0,0 +1,22 @@
+name: Contributor License Agreement (CLA)
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+  issue_comment:
+    types: [created]
+
+jobs:
+  cla:
+    runs-on: ubuntu-latest
+    if: |
+      (github.event.issue.pull_request 
+        && !github.event.issue.pull_request.merged_at
+        && contains(github.event.comment.body, 'signed')
+      ) 
+      || (github.event.pull_request && !github.event.pull_request.merged)
+    steps:
+      - uses: Shopify/shopify-cla-action@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          cla-token: ${{ secrets.CLA_TOKEN }}

data/.github/workflows/stale.yml

@@ -0,0 +1,25 @@
+name: Close inactive issues
+on:
+  schedule:
+    - cron: "30 1 * * *"
+
+jobs:
+  close-issues:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/stale@v5
+        with:
+          days-before-issue-stale: 730
+          days-before-issue-close: 14
+          stale-issue-label: "stale"
+          stale-issue-message: >
+            This issue is stale because it has been open for 2 years. It will be closed if no further action occurs in 14 days. 
+          close-issue-message: >
+            This issue was closed because it has been inactive for 14 days since being marked as stale.
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          operations_per_run: 100

data/CHANGELOG.md

@@ -1,6 +1,26 @@
 Unreleased
 ----------
 
+20.1.1 (September 2, 2022)
+----------
+
+* Fixed an issue where the `embedded_redirect_url` could lead to a redirect loop in server-side rendered (or production) apps. [#1497](https://github.com/Shopify/shopify_app/pull/1497)
+* Fixes bug where webhooks were generated with addresses instead of the [path the Ruby API](https://github.com/Shopify/shopify-api-ruby/blob/7a08ae9d96a7a85abd0113dae4eb76398cba8c64/lib/shopify_api/webhooks/registrations/http.rb#L12) is expecting [#1474](https://github.com/Shopify/shopify_app/pull/1474). The breaking change that was accidentially already shipped was that `address` attribute for webhooks should be paths not addresses with `https://` and the host name. While the `address` attribute name will still work assuming the value is a path, this name is deprecated. Please configure webhooks with the `path` attribute name instead.
+* Deduce webhook path from deprecated webhook address if initializer uses address attribute. This makes this attribute change a non-breaking change for those upgrading.
+
+20.1.0 (August 22, 2022)
+----------
+
+* Set the appropriate CSP `frame-ancestor` directive in controllers using the `EmbeddedApp` concern. [#1474](https://github.com/Shopify/shopify_app/pull/1474)
+* Allow [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare/) hosts in `config/environments/development.rb`.
+* Use [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare/) as example tunnel in readme/docs.
+* Change to optimize OAuth redirects to happen on the server side when possible.  Also, add an optional `.embedded_redirect_url` configuration parameter to enable customized App Bridge-supported redirect. [1483](https://github.com/Shopify/shopify_app/pull/1483)
+
+20.0.2 (July 7, 2022)
+----------
+
+* Bump [Shopify API](https://github.com/Shopify/shopify-api-ruby) to version 11.0.1. It includes [these updates](https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md#version-1101). Fix an issue where HMAC signature verification would fail in OAuth flows during API key rotation.
+
 20.0.1 (July 6, 2022)
 ----------
 
@@ -9,7 +29,7 @@ Unreleased
 20.0.0 (July 4, 2022)
 ----------
 
-* Bump [Shopify API](https://github.com/Shopify/shopify-api-ruby) to version 11.0.0. It includes [these updates](https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md#version-1100).  The breaking change relates to the removal of API version `2021-07` support.
+* Bump [Shopify API](https://github.com/Shopify/shopify-api-ruby) to version 11.0.0. It includes [these updates](https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md#version-1100). The breaking change relates to the removal of API version `2021-07` support.
 * Internal update, adding App Bridge 3 for redirect (only). [#1458](https://github.com/Shopify/shopify_app/pull/1458)
 
 19.1.0 (June 20, 2022)
@@ -23,15 +43,15 @@ Unreleased
 ----------
 
 * Fix regression in apps using online tokens. [#1413](https://github.com/Shopify/shopify_app/pull/1413)
-* Bump [Shopify API](https://github.com/Shopify/shopify_api) to version 10.0.3. It includes [these fixes](https://github.com/Shopify/shopify_api/blob/main/CHANGELOG.md#version-1003).
+* Bump [Shopify API](https://github.com/Shopify/shopify-api-ruby) to version 10.0.3. It includes [these fixes](https://github.com/Shopify/shopify-api-ruby/blob/main/CHANGELOG.md#version-1003).
 
 19.0.1 (April 11, 2022)
 ----------
-* Bump Shopify API (https://github.com/Shopify/shopify_api) to version 10.0.2. This update includes patch fixes since the initial v10 release.
+* Bump Shopify API (https://github.com/Shopify/shopify-api-ruby) to version 10.0.2. This update includes patch fixes since the initial v10 release.
 
 19.0.0 (April 6, 2022)
 ----------
-* Use v10 of the Shopify API (https://github.com/Shopify/shopify_api). This update requires changes to an app - please refer to the [migration guide](https://github.com/Shopify/shopify_app/blob/main/docs/Upgrading.md) for details.
+* Use v10 of the Shopify API (https://github.com/Shopify/shopify-api-ruby). This update requires changes to an app - please refer to the [migration guide](https://github.com/Shopify/shopify_app/blob/main/docs/Upgrading.md) for details.
 BREAKING, please see migration notes.
 
 18.1.2 (Mar 3, 2022)

data/Gemfile.lock

@@ -1,13 +1,13 @@
 PATH
   remote: .
   specs:
-    shopify_app (20.0.1)
+    shopify_app (20.1.1)
       activeresource
       browser_sniffer (~> 2.0)
       jwt (>= 2.2.3)
       rails (> 5.2.1)
       redirect_safely (~> 1.0)
-      shopify_api (~> 11.0)
+      shopify_api (~> 11.1)
       sprockets-rails (>= 2.0.0)
 
 GEM
@@ -97,14 +97,14 @@ GEM
     erubi (1.10.0)
     globalid (1.0.0)
       activesupport (>= 5.0)
-    hash_diff (1.0.0)
+    hash_diff (1.1.1)
     hashdiff (1.0.1)
     httparty (0.20.0)
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     i18n (1.10.0)
       concurrent-ruby (~> 1.0)
-    jwt (2.4.1)
+    jwt (2.5.0)
     loofah (2.15.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
@@ -124,7 +124,7 @@ GEM
     nokogiri (1.13.4)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
-    oj (3.13.15)
+    oj (3.13.21)
     openssl (3.0.0)
     parallel (1.21.0)
     parser (3.1.0.0)
@@ -194,7 +194,7 @@ GEM
       rubocop (~> 1.24)
     ruby-progressbar (1.11.0)
     securerandom (0.2.0)
-    shopify_api (11.0.0)
+    shopify_api (11.1.0)
       concurrent-ruby
       hash_diff
       httparty
@@ -204,7 +204,7 @@ GEM
       securerandom
       sorbet-runtime
       zeitwerk (~> 2.5)
-    sorbet-runtime (0.5.10139)
+    sorbet-runtime (0.5.10398)
     sprockets (4.1.1)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)

data/README.md

@@ -1,8 +1,6 @@
 # Shopify App
 
-**Shopify is doubling our engineering staff in 2021! [Join our team and work on libraries like this one.](https://smrtr.io/5GGrK)**
-
-[![Version][gem]][gem_url] [![Build Status](https://github.com/Shopify/shopify_app/workflows/CI/badge.svg)](https://github.com/Shopify/shopify_app/actions?query=workflow%3ACI) ![Supported Rails version][supported_rails_version]
+[![Version][gem]][gem_url] [![Build Status](https://github.com/Shopify/shopify_app/workflows/CI/badge.svg)](https://github.com/Shopify/shopify_app/actions?query=workflow%3ACI)
 
 [gem]: https://img.shields.io/gem/v/shopify_app.svg
 [gem_url]: https://rubygems.org/gems/shopify_app
@@ -34,6 +32,21 @@ This gem requires that you have the following credentials:
 - **Shopify API key:** The API key app credential specified in your [Shopify Partners dashboard](https://partners.shopify.com/organizations). 
 - **Shopify API secret:** The API secret key app credential specified in your [Shopify Partners dashboard](https://partners.shopify.com/organizations). 
 
+### OAuth Tunnel in Development
+
+In order to redirect OAuth requests securely to localhost, you'll need to setup a tunnel to redirect from the internet to localhost.
+
+We've validated that [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare/) works with this template.
+
+To do that, you can [install the `cloudflared` CLI tool](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation/), and run:
+
+```shell
+# Note that you can also use a different port
+cloudflared tunnel --url http://localhost:3000
+```
+
+You will need to keep this window running to maintain the tunnel during development.
+
 ## Usage
 
 1. To get started, create a new Rails app:
@@ -53,6 +66,7 @@ $ bundle add shopify_app
 ```
 SHOPIFY_API_KEY=<Your Shopify API key>
 SHOPIFY_API_SECRET=<Your Shopify API secret>
+HOST=<Your SSH tunnel host>
 ```
 
 > In a development environment, you can use a gem like `dotenv-rails` to manage environment variables. 
@@ -128,4 +142,4 @@ To learn more about how this gem authenticates with Shopify, see [*Authenticatio
 
 [Shopify's API is versioned](https://shopify.dev/concepts/about-apis/versioning). With Shopify App `v1.11.0`, the included Shopify API gem allows developers to specify and update the Shopify API version they want their app or service to use. The Shopify API gem also surfaces warnings to Rails apps about [deprecated endpoints, GraphQL fields and more](https://shopify.dev/concepts/about-apis/versioning#deprecation-practices).
 
-See the [Shopify API gem README](https://github.com/Shopify/shopify_api/) for more information.
+See the [Shopify API gem README](https://github.com/Shopify/shopify-api-ruby/) for more information.

data/app/controllers/concerns/shopify_app/require_known_shop.rb

@@ -3,6 +3,7 @@
 module ShopifyApp
   module RequireKnownShop
     extend ActiveSupport::Concern
+    include ShopifyApp::RedirectForEmbedded
 
     included do
       before_action :check_shop_domain
@@ -11,6 +12,7 @@ module ShopifyApp
 
     def current_shopify_domain
       return if params[:shop].blank?
+
       @shopify_domain ||= ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
     end
 
@@ -22,7 +24,13 @@ module ShopifyApp
 
     def check_shop_known
       @shop = SessionRepository.retrieve_shop_session_by_shopify_domain(current_shopify_domain)
-      redirect_to(shop_login) unless @shop
+      unless @shop
+        if embedded_param?
+          redirect_for_embedded
+        else
+          redirect_to(shop_login)
+        end
+      end
     end
 
     def shop_login

data/app/controllers/concerns/shopify_app/shop_access_scopes_verification.rb

@@ -3,6 +3,7 @@
 module ShopifyApp
   module ShopAccessScopesVerification
     extend ActiveSupport::Concern
+    include ShopifyApp::RedirectForEmbedded
 
     included do
       before_action :login_on_scope_changes
@@ -11,7 +12,13 @@ module ShopifyApp
     protected
 
     def login_on_scope_changes
-      redirect_to(shop_login) if scopes_mismatch?
+      if scopes_mismatch?
+        if embedded_param?
+          redirect_for_embedded
+        else
+          redirect_to(shop_login)
+        end
+      end
     end
 
     private
@@ -22,6 +29,7 @@ module ShopifyApp
 
     def current_shopify_domain
       return if params[:shop].blank?
+
       ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
     end
 

data/app/controllers/shopify_app/callback_controller.rb

@@ -43,7 +43,12 @@ module ShopifyApp
     private
 
     def respond_successfully
-      redirect_to(return_address)
+      if ShopifyAPI::Context.embedded?
+        return_to = session.delete(:return_to) || ""
+        redirect_to(ShopifyAPI::Auth.embedded_app_url(params[:host]) + return_to, allow_other_host: true)
+      else
+        redirect_to(return_address)
+      end
     end
 
     def respond_with_error
@@ -58,11 +63,13 @@ module ShopifyApp
     def start_user_token_flow?(shopify_session)
       return false unless ShopifyApp::SessionRepository.user_storage.present?
       return false if shopify_session.online?
+
       update_user_access_scopes?
     end
 
     def update_user_access_scopes?
       return true if session[:shopify_user_id].nil?
+
       user_access_scopes_strategy.update_access_scopes?(shopify_user_id: session[:shopify_user_id])
     end
 

data/app/controllers/shopify_app/sessions_controller.rb

@@ -3,6 +3,7 @@
 module ShopifyApp
   class SessionsController < ActionController::Base
     include ShopifyApp::LoginProtection
+    include ShopifyApp::RedirectForEmbedded
 
     layout false, only: :new
 
@@ -36,7 +37,13 @@ module ShopifyApp
 
       copy_return_to_param_to_session
 
-      if top_level?
+      if embedded_redirect_url?
+        if embedded_param?
+          redirect_for_embedded
+        else
+          start_oauth
+        end
+      elsif top_level?
         start_oauth
       else
         redirect_auth_to_top_level
@@ -82,6 +89,7 @@ module ShopifyApp
 
     def top_level?
       return true unless ShopifyApp.configuration.embedded_app?
+
       !params[:top_level].nil?
     end
 

data/config/locales/ja.yml

@@ -1,6 +1,6 @@
 ---
 ja:
-  logged_out: ログインに成功しました
+  logged_out: ログアウトに成功しました
   could_not_log_in: Shopifyストアにログインできませんでした
   invalid_shop_url: ショップのドメインが無効です
   enable_cookies_heading: "%{app}からのCookieを有効にする"
@@ -10,8 +10,8 @@ ja:
   top_level_interaction_heading: お使いのブラウザを更新する必要があります%{app}
   top_level_interaction_body: Shopifyがアプリを開けるように、ブラウザーはCookieにアクセスするための%{app}のようなアプリが必要です。
   top_level_interaction_action: 続ける
-  request_storage_access_heading: "%{app}クッキーにアクセスする必要がある"
-  request_storage_access_body: Cookieを使用すると、個人情報を一時的に保存することで、アプリ認証を受けることができます。[続行]
-    をクリックして、Cookieでアプリを使用できるようにします。
+  request_storage_access_heading: "%{app}はCookieへのアクセス許可が必要です"
+  request_storage_access_body: Cookieを使用すると、個人情報を一時的に保存することで、アプリ認証を受けることができます。[続ける]
+    をクリックすると、アプリはCookieを利用します。
   request_storage_access_footer: Cookieは30日後に有効期限が切れます。
   request_storage_access_action: 続ける

data/docs/Quickstart.md

@@ -12,12 +12,13 @@ This guide assumes you have completed the steps to create a new Rails app using
 
 Your local app needs to be accessible from the public Internet in order to install it on a Shopify store, to use the [App Proxy Controller](/lib/generators/shopify_app/app_proxy_controller/templates/app_proxy_controller.rb) or receive [webhooks](/docs/shopify_app/webhooks.md).
 
-Use a tunneling service like [ngrok](https://ngrok.com/), [Beeceptor](https://beeceptor.com/), [Mockbin](http://mockbin.org/), or [Hookbin](https://hookbin.com/) to make your development environment accessible to the internet.
+Use a tunneling service like [Cloudflare](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare/) to make your development environment accessible to the internet.
 
-For example with [ngrok](https://ngrok.com/), run this command to set up a tunnel proxy to Rails' default port:
+To use Cloudflare, [install the `cloudflared` CLI tool](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation/), and run:
 
-```sh
-ngrok http 3000
+```shell
+# Note that you can also use a different port
+cloudflared tunnel --url http://localhost:3000
 ```
 
 See the [*Embed the app in Shopify*](https://shopify.dev/tutorials/build-rails-react-app-that-uses-app-bridge-authentication#embed-the-app-in-shopify) section of [*Build a Shopify app with Rails, React, and App Bridge*](https://shopify.dev/tutorials/build-rails-react-app-that-uses-app-bridge-authentication) to learn more.

data/docs/Upgrading.md

@@ -4,6 +4,8 @@ This file documents important changes needed to upgrade your app's Shopify App v
 
 #### Table of contents
 
+[Upgrading to `v20.1.0`](#upgrading-to-v2010)
+
 [Upgrading to `v19.0.0`](#upgrading-to-v1900)
 
 [Upgrading to `v18.1.2`](#upgrading-to-v1812)
@@ -16,9 +18,18 @@ This file documents important changes needed to upgrade your app's Shopify App v
 
 [Upgrading from `v8.6` to `v9.0.0`](#upgrading-from-v86-to-v900)
 
+## Upgrading to `v20.1.0`
+
+Note that the following steps are *optional* and only apply to **embedded** applications. However, they can improve the loading time of your embedded app at installation and re-auth.
+
+- For embedded applications, update any controller that renders a full page reload (e.g: your home controller) to redirect using `Shopify::Auth.embedded_app_url`, if the `embedded` query argument is not present or does not equal `1`. Example [here](https://github.com/Shopify/shopify-app-template-ruby/pull/35/files#)
+- If your app already has a frontend that uses App Bridge, this gem now supports using that to redirect out of the iframe before OAuth.  Example [here](https://github.com/Shopify/shopify-frontend-template-react/blob/main/pages/ExitIframe.jsx)
+  - In your `shopify_app.rb` initializer, configure `.embedded_redirect_url` to the path of the route you added above.
+  - If you don't set this route, then the `shopify_app` gem will automatically load its own copy of App Bridge and perform this redirection without any additional configuration.
+
 ## Upgrading to `v19.0.0`
 
-This update moves API authentication logic from this gem to the [`shopify_api`](https://github.com/Shopify/shopify_api)
+This update moves API authentication logic from this gem to the [`shopify_api`](https://github.com/Shopify/shopify-api-ruby)
 gem.
 
 ### High-level process
@@ -31,7 +42,7 @@ gem.
   `config/initializers/shopify_app.rb` as the decision logic for which authentication method to use is now handled
   internally by the `shopify_api` gem, using the `ShopifyAPI::Context.embedded_app` setting.
 - `v19.0.0` updates the `shopify_api` dependency to `10.0.0`. This version of `shopify_api` has breaking changes. See
-  the documentation for addressing these breaking changes on GitHub [here](https://github.com/Shopify/shopify_api#breaking-change-notice-for-version-1000).
+  the documentation for addressing these breaking changes on GitHub [here](https://github.com/Shopify/shopify-api-ruby#breaking-change-notice-for-version-1000).
 
 ### Specific cases
 
@@ -87,6 +98,7 @@ Rails.application.config.after_initialize do
     ShopifyAPI::Context.setup(
       api_key: ShopifyApp.configuration.api_key,
       api_secret_key: ShopifyApp.configuration.secret,
+      old_api_secret_key: ShopifyApp.configuration.old_secret,
       api_version: ShopifyApp.configuration.api_version,
       host_name: URI(ENV.fetch('HOST', '')).host || '',
       scope: ShopifyApp.configuration.scope,
@@ -222,7 +234,7 @@ is changed to
 
 ### ShopifyAPI changes
 
-You will need to also follow the ShopifyAPI [upgrade guide](https://github.com/Shopify/shopify_api/blob/master/README.md#-breaking-change-notice-for-version-700-) to ensure your app is ready to work with API versioning.
+You will need to also follow the ShopifyAPI [upgrade guide](https://github.com/Shopify/shopify-api-ruby/blob/master/README.md#-breaking-change-notice-for-version-700-) to ensure your app is ready to work with API versioning.
 
 [dashboard]: https://partners.shopify.com
 [app-bridge]: https://shopify.dev/apps/tools/app-bridge

data/docs/shopify_app/webhooks.md

@@ -12,7 +12,7 @@ ShopifyApp can manage your app's webhooks for you if you set which webhooks you
 ```ruby
 ShopifyApp.configure do |config|
   config.webhooks = [
-    {topic: 'carts/update', address: 'https://example.com/webhooks/carts_update'}
+    {topic: 'carts/update', path: 'webhooks/carts_update'}
   ]
 end
 ```
@@ -34,7 +34,7 @@ If you are only interested in particular fields, you can optionally filter the d
 ```ruby
 ShopifyApp.configure do |config|
   config.webhooks = [
-    {topic: 'products/update', address: 'https://example.com/webhooks/products_update', fields: ['title', 'vendor']}
+    {topic: 'products/update', path: 'webhooks/products_update', fields: ['title', 'vendor']}
   ]
 end
 ```
@@ -66,7 +66,7 @@ The WebhooksManager uses ActiveJob. If ActiveJob is not configured then by defau
 ShopifyApp can create webhooks for you using the `add_webhook` generator. This will add the new webhook to your config and create the required job class for you.
 
 ```
-rails g shopify_app:add_webhook -t carts/update -a /webhooks/carts_update
+rails g shopify_app:add_webhook --topic carts/update --path webhooks/carts_update
 ```
 
-Where `-t` is the topic and `-a` is the address the webhook should be sent to.
+Where `--topic` is the topic and `--path` is the path the webhook should be sent to.

data/lib/generators/shopify_app/add_webhook/add_webhook_generator.rb

@@ -7,7 +7,7 @@ module ShopifyApp
     class AddWebhookGenerator < Rails::Generators::Base
       source_root File.expand_path("../templates", __FILE__)
       class_option :topic, type: :string, aliases: "-t", required: true
-      class_option :address, type: :string, aliases: "-a", required: true
+      class_option :path, type: :string, aliases: "-p", required: true
 
       hook_for :test_framework, as: :job, in: :rails do |instance, generator|
         instance.invoke(generator, [instance.send(:job_file_name)])
@@ -47,7 +47,7 @@ module ShopifyApp
       private
 
       def job_file_name
-        address.split("/").last
+        path.split("/").last
       end
 
       def load_initializer
@@ -55,15 +55,15 @@ module ShopifyApp
       end
 
       def webhook_config
-        "\n    { topic: \"#{topic}\", address: \"#{address}\" },"
+        "\n    { topic: \"#{topic}\", path: \"#{path}\" },"
       end
 
       def topic
         options["topic"]
       end
 
-      def address
-        options["address"]
+      def path
+        options["path"]
       end
     end
   end

data/lib/generators/shopify_app/home_controller/templates/unauthenticated_home_controller.rb

@@ -6,7 +6,11 @@ class HomeController < ApplicationController
   include ShopifyApp::ShopAccessScopesVerification
 
   def index
-    @shop_origin = current_shopify_domain
-    @host = params[:host]
+    if ShopifyAPI::Context.embedded? && (!params[:embedded].present? || params[:embedded] != "1")
+      redirect_to(ShopifyAPI::Auth.embedded_app_url(params[:host]) + request.path, allow_other_host: true)
+    else
+      @shop_origin = current_shopify_domain
+      @host = params[:host]
+    end
   end
 end

data/lib/generators/shopify_app/install/install_generator.rb

@@ -13,6 +13,9 @@ module ShopifyApp
       class_option :embedded, type: :string, default: "true"
       class_option :api_version, type: :string, default: nil
 
+      NGROK_HOST = "/\[-\\w]+\\.ngrok\\.io/"
+      CLOUDFLARE_HOST = "/\[-\\w]+\\.trycloudflare\\.com/"
+
       def create_shopify_app_initializer
         @application_name = format_array_argument(options["application_name"])
         @scope = format_array_argument(options["scope"])
@@ -51,14 +54,34 @@ module ShopifyApp
       end
 
       def insert_hosts_into_development_config
+        "Rails.application.configure do\n"
+          .then { insert_tunnel_host_rules("ngrok", _1, NGROK_HOST + "\n") }
+          .then { insert_tunnel_host_rules("Cloudflare", _1, CLOUDFLARE_HOST + "\n") }
+      end
+
+      private
+
+      def add_comment_explaining_tunnel_host(provider_name, insert_after_line)
+        comment = "  # Allow #{provider_name} tunnels for secure Shopify OAuth redirects\n"
         inject_into_file(
           "config/environments/development.rb",
-          "  config.hosts = (config.hosts rescue []) << /\[-\\w]+\\.ngrok\\.io/\n",
-          after: "Rails.application.configure do\n"
+          comment,
+          after: insert_after_line
         )
+        comment
       end
 
-      private
+      def insert_tunnel_host_rules(provider_name, insert_after_line, provider_host_domain)
+        explaination_comment = add_comment_explaining_tunnel_host(provider_name, insert_after_line)
+        host_line = "  config.hosts = (config.hosts rescue []) << #{provider_host_domain}"
+
+        inject_into_file(
+          "config/environments/development.rb",
+          host_line,
+          after: explaination_comment
+        )
+        host_line
+      end
 
       def embedded_app?
         options["embedded"] == "true"

data/lib/shopify_app/access_scopes/user_strategy.rb

@@ -9,6 +9,7 @@ module ShopifyApp
         def update_access_scopes?(user_id: nil, shopify_user_id: nil)
           return update_access_scopes_for_user_id?(user_id) if user_id
           return update_access_scopes_for_shopify_user_id?(shopify_user_id) if shopify_user_id
+
           raise(InvalidInput, "#update_access_scopes? requires user_id or shopify_user_id parameter inputs")
         end
 

data/lib/shopify_app/configuration.rb

@@ -25,6 +25,7 @@ module ShopifyApp
     attr_accessor :root_url
     attr_writer :login_url
     attr_writer :login_callback_url
+    attr_accessor :embedded_redirect_url
 
     # customise ActiveJob queue names
     attr_accessor :scripttags_manager_queue_name
@@ -77,11 +78,13 @@ module ShopifyApp
 
     def shop_access_scopes_strategy
       return ShopifyApp::AccessScopes::NoopStrategy unless reauth_on_access_scope_changes
+
       ShopifyApp::AccessScopes::ShopStrategy
     end
 
     def user_access_scopes_strategy
       return ShopifyApp::AccessScopes::NoopStrategy unless reauth_on_access_scope_changes
+
       ShopifyApp::AccessScopes::UserStrategy
     end
 

data/lib/shopify_app/controller_concerns/embedded_app.rb

@@ -4,6 +4,8 @@ module ShopifyApp
   module EmbeddedApp
     extend ActiveSupport::Concern
 
+    include ShopifyApp::FrameAncestors
+
     included do
       if ShopifyApp.configuration.embedded_app?
         after_action(:set_esdk_headers)

data/lib/shopify_app/controller_concerns/frame_ancestors.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module FrameAncestors
+    extend ActiveSupport::Concern
+
+    included do
+      content_security_policy do |policy|
+        policy.frame_ancestors(-> do
+          domain_host = current_shopify_domain || "*.myshopify.com"
+          "https://#{domain_host} https://admin.shopify.com;"
+        end)
+      end
+    end
+  end
+end

data/lib/shopify_app/controller_concerns/login_protection.rb

@@ -6,6 +6,7 @@ module ShopifyApp
   module LoginProtection
     extend ActiveSupport::Concern
     include ShopifyApp::Itp
+    include ShopifyApp::SanitizedParams
 
     class ShopifyDomainNotFound < StandardError; end
 
@@ -56,6 +57,7 @@ module ShopifyApp
 
     def login_again_if_different_user_or_shop
       return unless session_id_conflicts_with_params || session_shop_conflicts_with_params
+
       clear_shopify_session
       redirect_to_login
     end
@@ -67,6 +69,7 @@ module ShopifyApp
     def jwt_expire_at
       expire_at = request.env["jwt.expire_at"]
       return unless expire_at
+
       expire_at - 5.seconds # 5s gap to start fetching new token in advance
     end
 
@@ -114,7 +117,8 @@ module ShopifyApp
         else
           referer = URI(request.referer || "/")
           path = referer.path
-          query = "#{referer.query}&#{sanitized_params.to_query}"
+          query = Rack::Utils.parse_nested_query(referer.query)
+          query = query.merge(sanitized_params).to_query
         end
         session[:return_to] = query.blank? ? path.to_s : "#{path}?#{query}"
         redirect_to(login_url_with_optional_shop)
@@ -193,34 +197,6 @@ module ShopifyApp
       raise ShopifyDomainNotFound
     end
 
-    def sanitized_shop_name
-      @sanitized_shop_name ||= sanitize_shop_param(params)
-    end
-
-    def referer_sanitized_shop_name
-      return unless request.referer.present?
-
-      @referer_sanitized_shop_name ||= begin
-        referer_uri = URI(request.referer)
-        query_params = Rack::Utils.parse_query(referer_uri.query)
-
-        sanitize_shop_param(query_params.with_indifferent_access)
-      end
-    end
-
-    def sanitize_shop_param(params)
-      return unless params[:shop].present?
-      ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
-    end
-
-    def sanitized_params
-      request.query_parameters.clone.tap do |query_params|
-        if params[:shop].is_a?(String)
-          query_params[:shop] = sanitize_shop_param(params)
-        end
-      end
-    end
-
     def return_address
       return_address_with_params(shop: current_shopify_domain, host: host)
     rescue ShopifyDomainNotFound, ShopifyHostNotFound
@@ -259,6 +235,7 @@ module ShopifyApp
     def user_session_expected?
       return false if shop_session.nil?
       return false if ShopifyApp.configuration.shop_access_scopes_strategy.update_access_scopes?(shop_session.shop)
+
       !ShopifyApp.configuration.user_session_repository.blank? && ShopifyApp::SessionRepository.user_storage.present?
     end
   end

data/lib/shopify_app/controller_concerns/redirect_for_embedded.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module RedirectForEmbedded
+    include ShopifyApp::SanitizedParams
+
+    private
+
+    def embedded_redirect_url?
+      ShopifyApp.configuration.embedded_redirect_url.present?
+    end
+
+    def embedded_param?
+      embedded_redirect_url? && params[:embedded].present? && params[:embedded] == "1"
+    end
+
+    def redirect_for_embedded
+      # Don't actually redirect if we're already in the redirect route - we want the request to reach the FE
+      redirect_to(redirect_uri_for_embedded) unless request.path == ShopifyApp.configuration.embedded_redirect_url
+    end
+
+    def redirect_uri_for_embedded
+      redirect_query_params = {}
+      redirect_uri = "https://#{ShopifyAPI::Context.host_name}#{ShopifyApp.configuration.login_url}"
+      redirect_query_params[:shop] = sanitized_shop_name
+      redirect_query_params[:shop] ||= referer_sanitized_shop_name if referer_sanitized_shop_name.present?
+      redirect_query_params[:host] ||= params[:host] if params[:host].present?
+      redirect_uri = "#{redirect_uri}?#{redirect_query_params.to_query}" if redirect_query_params.present?
+
+      query_params = sanitized_params.except(:redirect_uri)
+      query_params[:redirectUri] = redirect_uri
+
+      "#{ShopifyApp.configuration.embedded_redirect_url}?#{query_params.to_query}"
+    end
+  end
+end

data/lib/shopify_app/controller_concerns/sanitized_params.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module SanitizedParams
+    protected
+
+    def sanitized_shop_name
+      @sanitized_shop_name ||= sanitize_shop_param(params)
+    end
+
+    def referer_sanitized_shop_name
+      return unless request.referer.present?
+
+      @referer_sanitized_shop_name ||= begin
+        referer_uri = URI(request.referer)
+        query_params = Rack::Utils.parse_query(referer_uri.query)
+
+        sanitize_shop_param(query_params.with_indifferent_access)
+      end
+    end
+
+    def sanitize_shop_param(params)
+      return unless params[:shop].present?
+      ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
+    end
+
+    def sanitized_params
+      parameters = request.post? ? request.request_parameters : request.query_parameters
+      parameters.clone.tap do |params_copy|
+        if params[:shop].is_a?(String)
+          params_copy[:shop] = sanitize_shop_param(params)
+        end
+      end
+    end
+  end
+end

data/lib/shopify_app/engine.rb

@@ -7,6 +7,7 @@ module ShopifyApp
     def args_info(job)
       log_disabled_classes = ["ShopifyApp::ScripttagsManagerJob", "ShopifyApp::WebhooksManagerJob"]
       return "" if log_disabled_classes.include?(job.class.name)
+
       super
     end
   end

data/lib/shopify_app/managers/scripttags_manager.rb

@@ -16,6 +16,7 @@ module ShopifyApp
     def self.build_src(scripttags, domain)
       scripttags.map do |tag|
         next tag unless tag[:src].respond_to?(:call)
+
         tag = tag.dup
         tag[:src] = tag[:src].call(domain)
         tag

data/lib/shopify_app/managers/webhooks_manager.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "uri"
+
 module ShopifyApp
   class WebhooksManager
     class CreationFailed < StandardError; end
@@ -14,12 +16,14 @@ module ShopifyApp
 
       def create_webhooks(session:)
         return unless ShopifyApp.configuration.has_webhooks?
+
         ShopifyAPI::Webhooks::Registry.register_all(session: session)
       end
 
       def recreate_webhooks!(session:)
         destroy_webhooks
         return unless ShopifyApp.configuration.has_webhooks?
+
         add_registrations
         ShopifyAPI::Webhooks::Registry.register_all(session: session)
       end
@@ -36,11 +40,13 @@ module ShopifyApp
         return unless ShopifyApp.configuration.has_webhooks?
 
         ShopifyApp.configuration.webhooks.each do |attributes|
+          webhook_path = path(attributes)
+
           ShopifyAPI::Webhooks::Registry.add_registration(
             topic: attributes[:topic],
             delivery_method: attributes[:delivery_method] || :http,
-            path: attributes[:address],
-            handler: webhook_job_klass(attributes[:topic]),
+            path: webhook_path,
+            handler: webhook_job_klass(webhook_path),
             fields: attributes[:fields]
           )
         end
@@ -48,12 +54,29 @@ module ShopifyApp
 
       private
 
-      def webhook_job_klass(topic)
-        webhook_job_klass_name(topic).safe_constantize || raise(ShopifyApp::MissingWebhookJobError)
+      def path(webhook_attributes)
+        path = webhook_attributes[:path]
+        address = webhook_attributes[:address]
+        uri = URI(address) if address
+
+        if path.present?
+          path
+        elsif uri&.path&.present?
+          uri.path
+        else
+          raise ShopifyApp::MissingWebhookJobError, "The :path attribute is required for webhook registration."
+        end
+      end
+
+      def webhook_job_klass(path)
+        webhook_job_klass_name(path).safe_constantize || raise(ShopifyApp::MissingWebhookJobError)
       end
 
-      def webhook_job_klass_name(topic)
-        [ShopifyApp.configuration.webhook_jobs_namespace, "#{topic.gsub("/", "_")}_job"].compact.join("/").classify
+      def webhook_job_klass_name(path)
+        job_file_name = Pathname(path.to_s).basename
+
+        [ShopifyApp.configuration.webhook_jobs_namespace,
+         "#{job_file_name}_job",].compact.join("/").classify
       end
     end
   end

data/lib/shopify_app/session/session_repository.rb

@@ -81,11 +81,13 @@ module ShopifyApp
 
       def load_shop_storage
         return unless @shop_storage
+
         @shop_storage.respond_to?(:safe_constantize) ? @shop_storage.safe_constantize : @shop_storage
       end
 
       def load_user_storage
         return NullUserSessionStore unless @user_storage
+
         @user_storage.respond_to?(:safe_constantize) ? @user_storage.safe_constantize : @user_storage
       end
     end

data/lib/shopify_app/utils.rb

@@ -16,6 +16,7 @@ module ShopifyApp
 
     def self.shop_login_url(shop:, host:, return_to:)
       return ShopifyApp.configuration.login_url unless shop
+
       url = URI(ShopifyApp.configuration.login_url)
 
       url.query = URI.encode_www_form(

data/lib/shopify_app/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ShopifyApp
-  VERSION = "20.0.1"
+  VERSION = "20.1.1"
 end

data/lib/shopify_app.rb

@@ -37,7 +37,10 @@ module ShopifyApp
   # controller concerns
   require "shopify_app/controller_concerns/csrf_protection"
   require "shopify_app/controller_concerns/localization"
+  require "shopify_app/controller_concerns/frame_ancestors"
   require "shopify_app/controller_concerns/itp"
+  require "shopify_app/controller_concerns/sanitized_params"
+  require "shopify_app/controller_concerns/redirect_for_embedded"
   require "shopify_app/controller_concerns/login_protection"
   require "shopify_app/controller_concerns/ensure_billing"
   require "shopify_app/controller_concerns/embedded_app"

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify_app",
-  "version": "20.0.1",
+  "version": "20.1.1",
   "repository": "git@github.com:Shopify/shopify_app.git",
   "author": "Shopify",
   "license": "MIT",

data/service.yml

@@ -1,4 +1,3 @@
 audience: partner
-classification: library
 slack_channels:
 - shopify_app_gem

data/shopify_app.gemspec

@@ -19,7 +19,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency("jwt", ">= 2.2.3")
   s.add_runtime_dependency("rails", "> 5.2.1")
   s.add_runtime_dependency("redirect_safely", "~> 1.0")
-  s.add_runtime_dependency("shopify_api", "~> 11.0")
+  s.add_runtime_dependency("shopify_api", "~> 11.1")
   s.add_runtime_dependency("sprockets-rails", ">= 2.0.0")
 
   s.add_development_dependency("byebug")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 20.0.1
+  version: 20.1.1
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-07-06 00:00:00.000000000 Z
+date: 2022-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeresource
@@ -86,14 +86,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '11.0'
+        version: '11.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '11.0'
+        version: '11.1'
 - !ruby/object:Gem::Dependency
   name: sprockets-rails
   requirement: !ruby/object:Gem::Requirement
@@ -260,10 +260,11 @@ files:
 - ".github/ISSUE_TEMPLATE/config.yml"
 - ".github/ISSUE_TEMPLATE/feature-request.md"
 - ".github/PULL_REQUEST_TEMPLATE.md"
-- ".github/probots.yml"
 - ".github/workflows/build.yml"
+- ".github/workflows/cla.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/rubocop.yml"
+- ".github/workflows/stale.yml"
 - ".gitignore"
 - ".nvmrc"
 - ".rubocop.yml"
@@ -401,10 +402,13 @@ files:
 - lib/shopify_app/controller_concerns/csrf_protection.rb
 - lib/shopify_app/controller_concerns/embedded_app.rb
 - lib/shopify_app/controller_concerns/ensure_billing.rb
+- lib/shopify_app/controller_concerns/frame_ancestors.rb
 - lib/shopify_app/controller_concerns/itp.rb
 - lib/shopify_app/controller_concerns/localization.rb
 - lib/shopify_app/controller_concerns/login_protection.rb
 - lib/shopify_app/controller_concerns/payload_verification.rb
+- lib/shopify_app/controller_concerns/redirect_for_embedded.rb
+- lib/shopify_app/controller_concerns/sanitized_params.rb
 - lib/shopify_app/controller_concerns/webhook_verification.rb
 - lib/shopify_app/engine.rb
 - lib/shopify_app/jobs/scripttags_manager_job.rb

data/.github/probots.yml

@@ -1,2 +0,0 @@
-enabled:
-  - cla