shopify_app 21.0.0 → 22.5.0

data/lib/shopify_app/session/user_session_storage.rb

@@ -28,6 +28,10 @@ module ShopifyApp
         construct_session(user)
       end
 
+      def destroy_by_shopify_user_id(user_id)
+        destroy_by(shopify_user_id: user_id)
+      end
+
       private
 
       def construct_session(user)
@@ -41,13 +45,13 @@ module ShopifyApp
           email_verified: false,
           account_owner: false,
           locale: "",
-          collaborator: false
+          collaborator: false,
         )
 
         ShopifyAPI::Auth::Session.new(
           shop: user.shopify_domain,
           access_token: user.shopify_token,
-          associated_user: associated_user
+          associated_user: associated_user,
         )
       end
     end

data/lib/shopify_app/session/user_session_storage_with_scopes.rb

@@ -15,6 +15,7 @@ module ShopifyApp
         user.shopify_token = auth_session.access_token
         user.shopify_domain = auth_session.shop
         user.access_scopes = auth_session.scope.to_s
+        user.expires_at = auth_session.expires
 
         user.save!
         user.id
@@ -30,6 +31,10 @@ module ShopifyApp
         construct_session(user)
       end
 
+      def destroy_by_shopify_user_id(user_id)
+        destroy_by(shopify_user_id: user_id)
+      end
+
       private
 
       def construct_session(user)
@@ -43,7 +48,7 @@ module ShopifyApp
           email_verified: false,
           account_owner: false,
           locale: "",
-          collaborator: false
+          collaborator: false,
         )
 
         ShopifyAPI::Auth::Session.new(
@@ -51,7 +56,8 @@ module ShopifyApp
           access_token: user.shopify_token,
           scope: user.access_scopes,
           associated_user_scope: user.access_scopes,
-          associated_user: associated_user
+          associated_user: associated_user,
+          expires: user.expires_at,
         )
       end
     end
@@ -67,5 +73,24 @@ module ShopifyApp
     rescue NotImplementedError, NoMethodError
       raise NotImplementedError, "#access_scopes= must be defined to hook into stored access scopes"
     end
+
+    def expires_at=(expires_at)
+      super
+    rescue NotImplementedError, NoMethodError
+      if ShopifyApp.configuration.check_session_expiry_date
+        raise NotImplementedError,
+          "#expires_at= must be defined to handle storing the session expiry date"
+      end
+    end
+
+    def expires_at
+      super
+    rescue NotImplementedError, NoMethodError
+      if ShopifyApp.configuration.check_session_expiry_date
+        raise NotImplementedError, "#expires_at must be defined to check the session expiry date"
+      end
+
+      nil
+    end
   end
 end

data/lib/shopify_app/test_helpers/all.rb

@@ -1,3 +1,4 @@
 # frozen_string_literal: true
 
 require "shopify_app/test_helpers/webhook_verification_helper"
+require "shopify_app/test_helpers/shopify_session_helper"

data/lib/shopify_app/test_helpers/shopify_session_helper.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module TestHelpers
+    module ShopifySessionHelper
+      def setup_shopify_session(session_id:, shop_domain:)
+        ShopifyAPI::Auth::Session.new(id: session_id, shop: shop_domain).tap do |session|
+          ShopifyApp::SessionRepository.stubs(:load_session).returns(session)
+          ShopifyAPI::Utils::SessionUtils.stubs(:current_session_id).returns(session.id)
+          ShopifyAPI::Utils::SessionUtils.stubs(:session_id_from_shopify_id_token).returns(session.id)
+          ShopifyAPI::Context.activate_session(session)
+        end
+      end
+    end
+  end
+end

data/lib/shopify_app/utils.rb

@@ -2,30 +2,92 @@
 
 module ShopifyApp
   module Utils
-    def self.sanitize_shop_domain(shop_domain)
-      myshopify_domain = ShopifyApp.configuration.myshopify_domain
-      name = shop_domain.to_s.downcase.strip
-      name += ".#{myshopify_domain}" if !name.include?(myshopify_domain.to_s) && !name.include?(".")
-      name.sub!(%r|https?://|, "")
-
-      u = URI("http://#{name}")
-      u.host if u.host&.match(/^[a-z0-9][a-z0-9\-]*[a-z0-9]\.#{Regexp.escape(myshopify_domain)}$/)
-    rescue URI::InvalidURIError
-      nil
-    end
+    class << self
+      TRUSTED_SHOPIFY_DOMAINS = [
+        "shopify.com",
+        "myshopify.io",
+        "myshopify.com",
+        "spin.dev",
+      ].freeze
+
+      def sanitize_shop_domain(shop_domain)
+        uri = uri_from_shop_domain(shop_domain)
+        return nil if uri.nil? || uri.host.nil?
+
+        trusted_domains.each do |trusted_domain|
+          no_shop_name_in_subdomain = uri.host == trusted_domain
+          from_trusted_domain = trusted_domain == uri.domain
+
+          return myshopify_domain_from_unified_admin(uri) if unified_admin?(uri) && from_trusted_domain
+          return nil if no_shop_name_in_subdomain || uri.host&.empty?
+          return uri.host if from_trusted_domain
+        end
+        nil
+      end
+
+      def shop_login_url(shop:, host:, return_to:)
+        return ShopifyApp.configuration.login_url unless shop
+
+        url = URI(ShopifyApp.configuration.login_url)
+
+        url.query = URI.encode_www_form(
+          shop: shop,
+          host: host,
+          return_to: return_to,
+        )
+
+        url.to_s
+      end
+
+      def unified_admin_path(shop)
+        spin_env = ENV.fetch("SPIN_FQDN", nil)
+        if spin_env
+          "https://admin.web.#{spin_env}/store/#{shop}"
+        else
+          "https://admin.#{unified_admin_domain}/store/#{shop}"
+        end
+      end
+
+      private
+
+      def myshopify_domain
+        ShopifyApp.configuration.myshopify_domain
+      end
+
+      def unified_admin_domain
+        ShopifyApp.configuration.unified_admin_domain
+      end
+
+      def trusted_domains
+        trusted_domains = TRUSTED_SHOPIFY_DOMAINS.dup
+        trusted_domains.append(myshopify_domain).uniq! if myshopify_domain
+        trusted_domains
+      end
+
+      def uri_from_shop_domain(shop_domain)
+        name = shop_domain.to_s.downcase.strip
+        name += ".#{myshopify_domain}" if !name.include?(myshopify_domain.to_s) && !name.include?(".")
+        uri = Addressable::URI.parse(name)
+
+        if uri.scheme.nil?
+          name = "https://" + name
+          uri = Addressable::URI.parse(name)
+        end
 
-    def self.shop_login_url(shop:, host:, return_to:)
-      return ShopifyApp.configuration.login_url unless shop
+        uri
+      rescue Addressable::URI::InvalidURIError
+        nil
+      end
 
-      url = URI(ShopifyApp.configuration.login_url)
+      def unified_admin?(uri)
+        uri.host.split(".").first == "admin"
+      end
 
-      url.query = URI.encode_www_form(
-        shop: shop,
-        host: host,
-        return_to: return_to,
-      )
+      def myshopify_domain_from_unified_admin(uri)
+        shop = uri.path.split("/").last
 
-      url.to_s
+        "#{shop}.myshopify.com"
+      end
     end
   end
 end

data/lib/shopify_app/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ShopifyApp
-  VERSION = "21.0.0"
+  VERSION = "22.5.0"
 end

data/lib/shopify_app.rb

@@ -5,6 +5,7 @@ require "shopify_app/version"
 # deps
 require "shopify_api"
 require "redirect_safely"
+require "addressable"
 
 module ShopifyApp
   def self.rails6?
@@ -37,11 +38,15 @@ module ShopifyApp
   # errors
   require "shopify_app/errors"
 
+  require "shopify_app/logger"
+
+  # Admin API helpers
+  require "shopify_app/admin_api/with_token_refetch"
+
   # controller concerns
   require "shopify_app/controller_concerns/csrf_protection"
   require "shopify_app/controller_concerns/localization"
   require "shopify_app/controller_concerns/frame_ancestors"
-  require "shopify_app/controller_concerns/itp"
   require "shopify_app/controller_concerns/sanitized_params"
   require "shopify_app/controller_concerns/redirect_for_embedded"
   require "shopify_app/controller_concerns/login_protection"
@@ -50,14 +55,18 @@ module ShopifyApp
   require "shopify_app/controller_concerns/payload_verification"
   require "shopify_app/controller_concerns/app_proxy_verification"
   require "shopify_app/controller_concerns/webhook_verification"
+  require "shopify_app/controller_concerns/token_exchange"
+  require "shopify_app/controller_concerns/with_shopify_id_token"
+
+  # Auth helpers
+  require "shopify_app/auth/post_authenticate_tasks"
+  require "shopify_app/auth/token_exchange"
 
   # jobs
   require "shopify_app/jobs/webhooks_manager_job"
-  require "shopify_app/jobs/scripttags_manager_job"
 
   # managers
   require "shopify_app/managers/webhooks_manager"
-  require "shopify_app/managers/scripttags_manager"
 
   # middleware
   require "shopify_app/middleware/jwt_middleware"

data/package.json

@@ -1,25 +1,24 @@
 {
   "name": "shopify_app",
-  "version": "21.0.0",
+  "version": "22.5.0",
   "repository": "git@github.com:Shopify/shopify_app.git",
   "author": "Shopify",
   "license": "MIT",
-  "dependencies": {},
   "devDependencies": {
     "babel-loader": "^8.0.6",
     "babel-preset-shopify": "^21.0.0",
     "chai": "^4.1.2",
-    "karma": "^5.2.1",
+    "karma": "^6.4.2",
     "karma-chai-sinon": "^0.1.5",
     "karma-chrome-launcher": "^3.1.0",
     "karma-cli": "^2.0.0",
     "karma-mocha": "^2.0.1",
     "karma-mocha-clean-reporter": "^0.0.1",
-    "karma-webpack": "^4.0.2",
-    "mocha": "^8.1.3",
+    "karma-webpack": "^5.0.0",
+    "mocha": "^10.2.0",
     "sinon": "^9.0.3",
     "sinon-chai": "^3.2.0",
-    "webpack": "^4.44.1"
+    "webpack": "^5.94.0"
   },
   "scripts": {
     "test": "./node_modules/.bin/karma start --browsers ChromeHeadless --single-run"

data/service.yml

@@ -1,3 +1 @@
 audience: partner
-slack_channels:
-- shopify_app_gem

data/shopify_app.gemspec

@@ -10,17 +10,18 @@ Gem::Specification.new do |s|
   s.author      = "Shopify"
   s.summary     = "This gem is used to get quickly started with the Shopify API"
 
-  s.required_ruby_version = ">= 2.7"
+  s.required_ruby_version = ">= 3.0"
 
   s.metadata["allowed_push_host"] = "https://rubygems.org"
 
   s.add_runtime_dependency("activeresource") # TODO: Remove this once all active resource dependencies are removed
-  s.add_runtime_dependency("browser_sniffer", "~> 2.0")
-  s.add_runtime_dependency("jwt", ">= 2.2.3")
+  s.add_runtime_dependency("addressable", "~> 2.7")
   s.add_runtime_dependency("rails", "> 5.2.1")
   s.add_runtime_dependency("redirect_safely", "~> 1.0")
-  s.add_runtime_dependency("shopify_api", "~> 12.0.0")
+  s.add_runtime_dependency("shopify_api", ">= 14.7.0", "< 15.0")
   s.add_runtime_dependency("sprockets-rails", ">= 2.0.0")
+  # Deprecated: move to development dependencies when releasing v23
+  s.add_runtime_dependency("jwt", ">= 2.2.3")
 
   s.add_development_dependency("byebug")
   s.add_development_dependency("minitest")
@@ -30,10 +31,10 @@ Gem::Specification.new do |s|
   s.add_development_dependency("pry-stack_explorer")
   s.add_development_dependency("rake")
   s.add_development_dependency("rb-readline")
+  s.add_development_dependency("ruby-lsp")
   s.add_development_dependency("sqlite3", "~> 1.4")
   s.add_development_dependency("webmock")
 
   s.files         = %x(git ls-files).split("\n").reject { |f| f.match(%r{^(test|example)/}) }
-  s.test_files    = %x(git ls-files -- {test}/*).split("\n")
   s.require_paths = ["lib"]
 end

data/translation.yml

@@ -1,5 +1,6 @@
 source_language: en
 target_languages: [cs, da, de, es, fi, fr, it, ja, ko, nb, nl, pl, pt-BR, pt-PT, sv, th, tr, vi, zh-CN, zh-TW]
+async_pr_mode: per_pr
 components:
   - name: 'merchant'
     paths: