shopify_app 21.6.0 → 22.5.0

data/lib/generators/shopify_app/add_declarative_webhook/add_declarative_webhook_generator.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "rails/generators/base"
+
+module ShopifyApp
+  module Generators
+    class AddDeclarativeWebhookGenerator < Rails::Generators::Base
+      source_root File.expand_path("../templates", __FILE__)
+      class_option :topic, type: :string, aliases: "-t", required: true
+      class_option :path, type: :string, aliases: "-p", required: true
+
+      hook_for :test_framework, as: :job, in: :rails do |instance, generator|
+        instance.invoke(generator, [instance.send(:file_name)])
+      end
+
+      def add_webhook_job
+        namespace = ShopifyApp.configuration.webhook_jobs_namespace
+        @job_file_name = if namespace.present?
+          "#{namespace}/#{file_name}_job"
+        else
+          "#{file_name}_job"
+        end
+        @job_class_name = @job_file_name.classify
+        template("webhook_job.rb", "app/jobs/#{@job_file_name}.rb")
+      end
+
+      def add_webhook_controller
+        @controller_file_name = "#{file_name}_controller"
+        @controller_class_name = @controller_file_name.classify
+        template("webhook_controller.rb", "app/controllers/webhooks/#{@controller_file_name}.rb")
+      end
+
+      def add_webhook_route
+        route = "\t\t\tpost '#{file_name}', to: '#{file_name}#receive'\n"
+        inject_into_file("config/routes.rb", route, after: /namespace :webhooks do\n/)
+      end
+
+      private
+
+      def file_name
+        path.split("/").last
+      end
+
+      def topic
+        options["topic"]
+      end
+
+      def path
+        options["path"]
+      end
+    end
+  end
+end

data/lib/generators/shopify_app/add_declarative_webhook/templates/webhook_controller.rb.tt

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Webhooks
+  class <%= @controller_class_name %> < ApplicationController
+    include ShopifyApp::WebhookVerification
+
+    def receive
+      webhook_request = ShopifyAPI::Webhooks::Request.new(raw_body: request.raw_post, headers: request.headers.to_h)
+      <%= @job_class_name %>.perform_later(shop_domain: webhook_request.shop, webhook: webhook_request.parsed_body)
+      head(:no_content)
+    end
+  end
+end

data/lib/generators/shopify_app/add_declarative_webhook/templates/webhook_job.rb.tt

@@ -0,0 +1,15 @@
+class <%= @job_class_name %> < ActiveJob::Base
+
+  def perform(shop_domain:, webhook:)
+    shop = Shop.find_by(shopify_domain: shop_domain)
+
+    if shop.nil?
+      logger.error("#{self.class} failed: cannot find shop with domain '#{shop_domain}'")
+
+      raise ActiveRecord::RecordNotFound, "Shop Not Found"
+    end
+
+    shop.with_shopify_session do |session|
+    end
+  end
+end

data/lib/generators/shopify_app/{add_gdpr_jobs/add_gdpr_jobs_generator.rb → add_privacy_jobs/add_privacy_jobs_generator.rb}

@@ -4,7 +4,7 @@ require "rails/generators/base"
 
 module ShopifyApp
   module Generators
-    class AddGdprJobsGenerator < Rails::Generators::Base
+    class AddPrivacyJobsGenerator < Rails::Generators::Base
       source_root File.expand_path("../templates", __FILE__)
 
       def add_customer_data_request_job

data/lib/generators/shopify_app/add_webhook/add_webhook_generator.rb

@@ -39,7 +39,12 @@ module ShopifyApp
       end
 
       def add_webhook_job
-        @job_file_name = job_file_name + "_job"
+        namespace = ShopifyApp.configuration.webhook_jobs_namespace
+        @job_file_name = if namespace.present?
+          "#{namespace}/#{job_file_name}_job"
+        else
+          "#{job_file_name}_job"
+        end
         @job_class_name = @job_file_name.classify
         template("webhook_job.rb", "app/jobs/#{@job_file_name}.rb")
       end

data/lib/generators/shopify_app/add_webhook/templates/webhook_job.rb.tt

@@ -17,6 +17,7 @@ class <%= @job_class_name %> < ActiveJob::Base
     end
 
     shop.with_shopify_session do |session|
+    ## webhook processing logic
     end
   end
 end

data/lib/generators/shopify_app/install/templates/shopify_app.rb.tt

@@ -4,6 +4,8 @@ ShopifyApp.configure do |config|
   config.scope = "<%= @scope %>" # Consult this page for more scope options:
                                   # https://help.shopify.com/en/api/getting-started/authentication/oauth/scopes
   config.embedded_app = <%= embedded_app? %>
+  config.new_embedded_auth_strategy = <%= embedded_app? %>
+
   config.after_authenticate_job = false
   config.api_version = "<%= @api_version %>"
   config.shop_session_repository = 'Shop'
@@ -12,7 +14,7 @@ ShopifyApp.configure do |config|
   config.webhooks = [
     { topic: "app/uninstalled", address: "webhooks/app_uninstalled"},
     { topic: "customers/data_request", address: "webhooks/customers_data_request" },
-    { topic: "customer/redact", address: "webhooks/customers_redact"},
+    { topic: "customers/redact", address: "webhooks/customers_redact"},
     { topic: "shop/redact", address: "webhooks/shop_redact"}
   ]
 
@@ -30,7 +32,8 @@ ShopifyApp.configure do |config|
   #   amount: 5,
   #   interval: ShopifyApp::BillingConfiguration::INTERVAL_EVERY_30_DAYS,
   #   currency_code: "USD", # Only supports USD for now
-  #   test: ENV.fetch('SHOPIFY_TEST_CHARGES', !Rails.env.production?)
+  #   trial_days: 0,
+  #   test: !ENV['SHOPIFY_TEST_CHARGES'].nil? ? ["true", "1"].include?(ENV['SHOPIFY_TEST_CHARGES']) : !Rails.env.production?
   # )
 
   if defined? Rails::Server

data/lib/generators/shopify_app/shopify_app_generator.rb

@@ -10,7 +10,7 @@ module ShopifyApp
 
       def run_all_generators
         generate("shopify_app:add_app_uninstalled_job")
-        generate("shopify_app:add_gdpr_jobs")
+        generate("shopify_app:add_privacy_jobs")
         generate("shopify_app:install #{@opts.join(" ")}")
         generate("shopify_app:shop_model #{@opts.join(" ")}")
         generate("shopify_app:authenticated_controller")

data/lib/generators/shopify_app/user_model/templates/db/migrate/add_user_expires_at_column.erb

@@ -0,0 +1,5 @@
+class AddUserExpiresAtColumn < ActiveRecord::Migration[<%= rails_migration_version %>]
+  def change
+    add_column :users, :expires_at, :datetime
+  end
+end

data/lib/generators/shopify_app/user_model/user_model_generator.rb

@@ -40,6 +40,26 @@ module ShopifyApp
         end
       end
 
+      def create_expires_at_storage_in_user_model
+        expires_at_column_prompt = <<~PROMPT
+          It is highly recommended that apps record the User session expiry date. \
+          This will allow to check if the session has expired and re-authenticate \
+          without a first call to Shopify.
+
+          After running the migration, the `check_session_expiry_date` configuration can be enabled.
+
+          The following migration will add an `expires_at` column to the User model. \
+          Do you want to include this migration? [y/n]
+        PROMPT
+
+        if new_shopify_cli_app? || Rails.env.test? || yes?(expires_at_column_prompt)
+          migration_template(
+            "db/migrate/add_user_expires_at_column.erb",
+            "db/migrate/add_user_expires_at_column.rb",
+          )
+        end
+      end
+
       def update_shopify_app_initializer
         gsub_file("config/initializers/shopify_app.rb", "ShopifyApp::InMemoryUserSessionStore", "User")
       end

data/lib/shopify_app/admin_api/with_token_refetch.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module AdminAPI
+    module WithTokenRefetch
+      def with_token_refetch(session, shopify_id_token)
+        retrying = false if retrying.nil?
+        yield
+      rescue ShopifyAPI::Errors::HttpResponseError => error
+        if error.code != 401
+          ShopifyApp::Logger.debug("Encountered error: #{error.code} - #{error.response.inspect}, re-raising")
+        elsif retrying
+          ShopifyApp::Logger.debug("Shopify API returned a 401 Unauthorized error that was not corrected " \
+            "with token exchange, re-raising error")
+        else
+          retrying = true
+          ShopifyApp::Logger.debug("Shopify API returned a 401 Unauthorized error, exchanging token and " \
+            "retrying with new session")
+          new_session = ShopifyApp::Auth::TokenExchange.perform(shopify_id_token)
+          session.copy_attributes_from(new_session)
+          retry
+        end
+        raise
+      end
+    end
+  end
+end

data/lib/shopify_app/auth/post_authenticate_tasks.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module Auth
+    class PostAuthenticateTasks
+      class << self
+        def perform(session)
+          ShopifyApp::Logger.debug("Performing post authenticate tasks")
+          # Ensure we use the shop session to install webhooks
+          session_for_shop = session.online? ? shop_session(session) : session
+
+          install_webhooks(session_for_shop)
+
+          perform_after_authenticate_job(session)
+        end
+
+        private
+
+        def shop_session(session)
+          ShopifyApp::SessionRepository.retrieve_shop_session_by_shopify_domain(session.shop)
+        end
+
+        def install_webhooks(session)
+          ShopifyApp::Logger.debug("PostAuthenticateTasks: Installing webhooks")
+          return unless ShopifyApp.configuration.has_webhooks?
+
+          WebhooksManager.queue(session.shop, session.access_token)
+        end
+
+        def perform_after_authenticate_job(session)
+          ShopifyApp::Logger.debug("PostAuthenticateTasks: Performing after_authenticate_job")
+          config = ShopifyApp.configuration.after_authenticate_job
+
+          return unless config && config[:job].present?
+
+          job = config[:job]
+          job = job.constantize if job.is_a?(String)
+
+          if config[:inline] == true
+            job.perform_now(shop_domain: session.shop)
+          else
+            job.perform_later(shop_domain: session.shop)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/shopify_app/auth/token_exchange.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  module Auth
+    class TokenExchange
+      attr_reader :id_token
+
+      def self.perform(id_token)
+        new(id_token).perform
+      end
+
+      def initialize(id_token)
+        @id_token = id_token
+      end
+
+      def perform
+        domain = ShopifyAPI::Auth::JwtPayload.new(id_token).shopify_domain
+
+        Logger.info("Performing Token Exchange for [#{domain}] - (Offline)")
+        session = exchange_token(
+          shop: domain,
+          id_token: id_token,
+          requested_token_type: ShopifyAPI::Auth::TokenExchange::RequestedTokenType::OFFLINE_ACCESS_TOKEN,
+        )
+
+        if online_token_configured?
+          Logger.info("Performing Token Exchange for [#{domain}] - (Online)")
+          session = exchange_token(
+            shop: domain,
+            id_token: id_token,
+            requested_token_type: ShopifyAPI::Auth::TokenExchange::RequestedTokenType::ONLINE_ACCESS_TOKEN,
+          )
+        end
+
+        ShopifyApp.configuration.post_authenticate_tasks.perform(session)
+
+        session
+      end
+
+      private
+
+      def exchange_token(shop:, id_token:, requested_token_type:)
+        session = ShopifyAPI::Auth::TokenExchange.exchange_token(
+          shop: shop,
+          session_token: id_token,
+          requested_token_type: requested_token_type,
+        )
+
+        SessionRepository.store_session(session)
+
+        session
+      rescue ShopifyAPI::Errors::InvalidJwtTokenError
+        Logger.error("Invalid id token '#{id_token}' during token exchange")
+        raise
+      rescue ShopifyAPI::Errors::HttpResponseError => error
+        Logger.error(
+          "A #{error.code} error (#{error.class}) occurred during the token exchange. Response: #{error.response.body}",
+        )
+        raise
+      rescue ActiveRecord::RecordNotUnique
+        Logger.debug("Session not stored due to concurrent token exchange calls")
+        session
+      rescue => error
+        Logger.error("An error occurred during the token exchange: [#{error.class}] #{error.message}")
+        raise
+      end
+
+      def online_token_configured?
+        ShopifyApp.configuration.online_token_configured?
+      end
+    end
+  end
+end

data/lib/shopify_app/configuration.rb

@@ -20,6 +20,7 @@ module ShopifyApp
     attr_accessor :api_version
 
     attr_accessor :reauth_on_access_scope_changes
+    attr_accessor :check_session_expiry_date
     attr_accessor :log_level
 
     # customise urls
@@ -28,6 +29,9 @@ module ShopifyApp
     attr_writer :login_callback_url
     attr_accessor :embedded_redirect_url
 
+    # customize post authenticate tasks
+    attr_accessor :custom_post_authenticate_tasks
+
     # customise ActiveJob queue names
     attr_accessor :scripttags_manager_queue_name
     attr_accessor :webhooks_manager_queue_name
@@ -35,6 +39,9 @@ module ShopifyApp
     # configure myshopify domain for local shopify development
     attr_accessor :myshopify_domain
 
+    # configure the unified admin domain for local shopify development
+    attr_accessor :unified_admin_domain
+
     # ability to have webpacker installed but not used in this gem and the generators
     attr_accessor :disable_webpacker
 
@@ -44,12 +51,19 @@ module ShopifyApp
     # takes a ShopifyApp::BillingConfiguration object
     attr_accessor :billing
 
+    # Enables new authorization flow using token exchange
+    attr_accessor :new_embedded_auth_strategy
+
     def initialize
       @root_url = "/"
       @myshopify_domain = "myshopify.com"
+      @unified_admin_domain = "shopify.com"
       @scripttags_manager_queue_name = Rails.application.config.active_job.queue_name
       @webhooks_manager_queue_name = Rails.application.config.active_job.queue_name
       @disable_webpacker = ENV["SHOPIFY_APP_DISABLE_WEBPACKER"].present?
+      @scope = []
+
+      log_v23_deprecations
     end
 
     def login_url
@@ -118,6 +132,58 @@ module ShopifyApp
     def user_access_scopes
       @user_access_scopes || scope
     end
+
+    def use_new_embedded_auth_strategy?
+      new_embedded_auth_strategy && embedded_app?
+    end
+
+    def online_token_configured?
+      !ShopifyApp.configuration.user_session_repository.blank? && ShopifyApp::SessionRepository.user_storage.present?
+    end
+
+    def post_authenticate_tasks
+      @post_authenticate_tasks || begin
+        if custom_post_authenticate_tasks
+          custom_class = if custom_post_authenticate_tasks.respond_to?(:safe_constantize)
+            custom_post_authenticate_tasks.safe_constantize
+          else
+            custom_post_authenticate_tasks
+          end
+        end
+
+        task_class = custom_class || ShopifyApp::Auth::PostAuthenticateTasks
+
+        [
+          :perform,
+        ].each do |method|
+          raise(
+            ::ShopifyApp::ConfigurationError,
+            "Missing method - '#{method}' for custom_post_authenticate_tasks",
+          ) unless task_class.respond_to?(method)
+        end
+
+        task_class
+      end
+    end
+
+    private
+
+    def log_v23_deprecations
+      return unless Rails.env.development?
+
+      # TODO: Remove this before releasing v23.0.0
+      message = <<~EOS
+        ================================================
+        => Upcoming changes in v23.0:
+        * 'CallbackController::perform_after_authenticate_job' and related methods 'install_webhooks', 'perform_after_authenticate_job'
+        * are deprecated and  will be removed from CallbackController in the next major release. If you need to customize
+        * post authentication tasks, see https://github.com/Shopify/shopify_app/blob/main/docs/shopify_app/authentication.md#post-authenticate-tasks
+
+        * ShopifyApp::JWTMiddleware will be removed, use ShopifyApp::WithShopifyIdToken instead.
+        ================================================
+      EOS
+      puts message
+    end
   end
 
   class BillingConfiguration
@@ -129,13 +195,15 @@ module ShopifyApp
     attr_reader :amount
     attr_reader :currency_code
     attr_reader :interval
+    attr_reader :trial_days
     attr_reader :test
 
-    def initialize(charge_name:, amount:, interval:, currency_code: "USD", test: !Rails.env.production?)
+    def initialize(charge_name:, amount:, interval:, currency_code: "USD", trial_days: 0, test: !Rails.env.production?)
       @charge_name = charge_name
       @amount = amount
       @currency_code = currency_code
       @interval = interval
+      @trial_days = trial_days
       @test = test
     end
   end

data/lib/shopify_app/controller_concerns/app_proxy_verification.rb

@@ -9,7 +9,7 @@ module ShopifyApp
     end
 
     def verify_proxy_request
-      return head(:forbidden) unless query_string_valid?(request.query_string)
+      head(:forbidden) unless query_string_valid?(request.query_string)
     end
 
     private

data/lib/shopify_app/controller_concerns/csrf_protection.rb

@@ -4,13 +4,14 @@ module ShopifyApp
   module CsrfProtection
     extend ActiveSupport::Concern
     included do
+      include ShopifyApp::WithShopifyIdToken
       protect_from_forgery with: :exception, unless: :valid_session_token?
     end
 
     private
 
     def valid_session_token?
-      request.env["jwt.shopify_domain"]
+      jwt_payload.present?
     end
   end
 end

data/lib/shopify_app/controller_concerns/embedded_app.rb

@@ -5,19 +5,58 @@ module ShopifyApp
     extend ActiveSupport::Concern
 
     include ShopifyApp::FrameAncestors
+    include ShopifyApp::SanitizedParams
 
     included do
-      if ShopifyApp.configuration.embedded_app?
-        after_action(:set_esdk_headers)
-        layout("embedded_app")
+      layout :embedded_app_layout
+      after_action :set_esdk_headers, if: -> { ShopifyApp.configuration.embedded_app? }
+    end
+
+    protected
+
+    def redirect_to_embed_app_in_admin
+      ShopifyApp::Logger.debug("Redirecting to embed app in admin")
+
+      host = if params[:host]
+        params[:host]
+      elsif params[:shop]
+        Base64.encode64("#{sanitized_shop_name}/admin")
+      else
+        return redirect_to(ShopifyApp.configuration.login_url)
       end
+
+      original_path = request.path
+      original_params = request.query_parameters.except(:host, :shop, :id_token)
+      original_path += "?#{original_params.to_query}" if original_params.present?
+
+      redirect_path = ShopifyAPI::Auth.embedded_app_url(host) + original_path.to_s
+      redirect_path = ShopifyApp.configuration.root_url if deduced_phishing_attack?(redirect_path)
+      redirect_to(redirect_path, allow_other_host: true)
+    end
+
+    def use_embedded_app_layout?
+      ShopifyApp.configuration.embedded_app?
     end
 
     private
 
+    def embedded_app_layout
+      "embedded_app" if use_embedded_app_layout?
+    end
+
     def set_esdk_headers
       response.set_header("P3P", 'CP="Not used"')
       response.headers.except!("X-Frame-Options")
     end
+
+    def deduced_phishing_attack?(decoded_host)
+      sanitized_host = ShopifyApp::Utils.sanitize_shop_domain(decoded_host)
+      if sanitized_host.nil?
+        message = "Host param for redirect to embed app in admin is not from a trusted domain, " \
+          "redirecting to root as this is likely a phishing attack."
+        ShopifyApp::Logger.info(message)
+      end
+      sanitized_host.nil?
+    end
   end
 end

data/lib/shopify_app/controller_concerns/ensure_billing.rb

@@ -27,7 +27,7 @@ module ShopifyApp
 
       unless has_payment
         if request.xhr?
-          add_top_level_redirection_headers(url: confirmation_url, ignore_response_code: true)
+          RedirectForEmbedded.add_app_bridge_redirect_url_header(confirmation_url, response)
           ShopifyApp::Logger.debug("Responding with 401 unauthorized")
           head(:unauthorized)
         elsif ShopifyApp.configuration.embedded_app?
@@ -45,8 +45,16 @@ module ShopifyApp
     end
 
     def handle_billing_error(error)
-      logger.info("#{error.message}: #{error.errors}")
-      redirect_to_login
+      ShopifyApp::Logger.warn("Encountered billing error - #{error.message}: #{error.errors}\n" \
+        "Redirecting to login page")
+
+      login_url = ShopifyApp.configuration.login_url
+      if request.xhr?
+        RedirectForEmbedded.add_app_bridge_redirect_url_header(login_url, response)
+        head(:unauthorized)
+      else
+        fullpage_redirect_to(login_url)
+      end
     end
 
     def has_active_payment?(session)
@@ -136,6 +144,7 @@ module ShopifyApp
             },
           },
           returnUrl: return_url,
+          trialDays: ShopifyApp.configuration.billing.trial_days,
           test: ShopifyApp.configuration.billing.test,
         },
       )
@@ -208,12 +217,14 @@ module ShopifyApp
         $name: String!
         $lineItems: [AppSubscriptionLineItemInput!]!
         $returnUrl: URL!
+        $trialDays: Int
         $test: Boolean
       ) {
         appSubscriptionCreate(
           name: $name
           lineItems: $lineItems
           returnUrl: $returnUrl
+          trialDays: $trialDays
           test: $test
         ) {
           confirmationUrl

data/lib/shopify_app/controller_concerns/frame_ancestors.rb

@@ -8,7 +8,7 @@ module ShopifyApp
       content_security_policy do |policy|
         policy.frame_ancestors(-> do
           domain_host = current_shopify_domain || "*.#{::ShopifyApp.configuration.myshopify_domain}"
-          "#{ShopifyAPI::Context.host_scheme}://#{domain_host} https://admin.shopify.com"
+          "#{ShopifyAPI::Context.host_scheme}://#{domain_host} https://admin.#{::ShopifyApp.configuration.unified_admin_domain}"
         end)
       end
     end

data/lib/shopify_app/controller_concerns/localization.rb

@@ -5,20 +5,23 @@ module ShopifyApp
     extend ActiveSupport::Concern
 
     included do
-      before_action :set_locale
+      around_action :set_locale
     end
 
     private
 
-    def set_locale
-      if params[:locale]
-        session[:locale] = params[:locale]
-      else
-        session[:locale] ||= I18n.default_locale
+    def set_locale(&action)
+      locale = params[:locale] || session[:locale] || I18n.default_locale
+
+      # Fallback to the 2 letter language code if the requested locale unavailable
+      unless I18n.available_locales.include?(locale.to_sym)
+        locale = locale.split("-").first
       end
-      I18n.locale = session[:locale]
+
+      session[:locale] = locale
+      I18n.with_locale(session[:locale], &action)
     rescue I18n::InvalidLocale
-      I18n.locale = I18n.default_locale
+      I18n.with_locale(I18n.default_locale, &action)
     end
   end
 end