shopify_app 7.0.9 → 7.0.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6716a0798368b5ef8645264b3e2c15c8eccd8dfc
-  data.tar.gz: 30f28d2b2e8424e14780bb23066e4db19964f68e
+  metadata.gz: 1d6309c0a72b84c1a7643960b79466c21b9ab04c
+  data.tar.gz: 79097e759876a3fcff79093b51796ba8d7d47266
 SHA512:
-  metadata.gz: d6fadaef635bfbb845906ed29948955f26cfc55340c61ebf42088a1581de915133143b3ea8c433e011143cae4efdf9fe7a540b3c9bedcd04d19c983c98ad6ba2
-  data.tar.gz: e9a1504508ac6c9e3cea11d8cb96c6c6bf5558fdbca556494c608b7484edf5434ebab4cf109d13941d2e9992fab020d5ff5793e52e42f497f8d5b52cd560aa0a
+  metadata.gz: 405f3a3afadb611f2d160a94756061873b4bf324aadc32e0405eaf380818291d886b03455e37e28dc3295d90edb8b3dc7fe3aa1ade85429ff0d43d84df2e18dc
+  data.tar.gz: d113dc8aa5e61eef97f79ad8cbc5f7e5bb23e2bd48cd5c3dcd38e64752970013a56afe216b9feb7d334806aaa5838b70f7d0166f6ea25ce2a77afca2b68b74a3

data/README.md

@@ -202,6 +202,48 @@ AuthenticatedController
 
 The engine includes a controller called `ShopifyApp::AuthenticatedController` which inherits from `ApplicationController`. It adds some before_filters which ensure the user is authenticated and will redirect to the login page if not. It is best practice to have all controllers that belong to the Shopify part of your app inherit from this controller. The HomeController that is generated already inherits from AuthenticatedController.
 
+AppProxyVerification
+--------------------
+
+The engine provides a mixin for verifying incoming HTTP requests sent via an App Proxy. Any controller that `include`s `ShopifyApp::AppProxyVerification` will verify that each request has a valid `signature` query parameter that is calculated using the other query parameters and the app's shared secret.
+
+### Recommended Usage
+
+1. Use the `namespace` method to create app proxy routes
+    ```ruby
+    # config/routes.rb
+    namespace :app_proxy do
+      # simple routes without a specified controller will go to AppProxyController
+      get :basic
+
+      # more complex routes will go to controllers in the AppProxy namespace
+      resources :reviews
+      # GET /app_proxy/reviews will now be routed to
+      # AppProxy::ReviewsController#index, for example
+    end
+    ```
+
+2. `include` the mixin in your app proxy controllers
+    ```ruby
+    # app/controllers/app_proxy_controller.rb
+    class AppProxyController < ApplicationController
+      include ShopifyApp::AppProxyVerification
+
+      def basic
+        render text: 'Signature verification passed!'
+      end
+    end
+
+    # app/controllers/app_proxy/reviews_controller.rb
+    class ReviewsController < ApplicationController
+      include ShopifyApp::AppProxyVerification
+      # ...
+    end
+    ```
+
+3. Create your app proxy url in the [Shopify Partners' Dashboard](https://app.shopify.com/services/partners/api_clients), making sure to point it to `https://your_app_website.com/app_proxy`.
+![Creating an App Proxy](/images/app-proxy-screenshot.png)
+
 Troubleshooting
 ---------------
 

data/lib/shopify_app.rb

@@ -22,6 +22,7 @@ require 'shopify_app/login_protection'
 require 'shopify_app/webhooks_manager'
 require 'shopify_app/scripttags_manager'
 require 'shopify_app/webhook_verification'
+require 'shopify_app/app_proxy_verification'
 require 'shopify_app/utils'
 
 # session repository

data/lib/shopify_app/app_proxy_verification.rb

@@ -0,0 +1,38 @@
+module ShopifyApp
+  module AppProxyVerification
+    extend ActiveSupport::Concern
+
+    included do
+      skip_before_action :verify_authenticity_token
+      before_action :verify_proxy_request
+    end
+
+    def verify_proxy_request
+      return head :unauthorized unless query_string_valid?(request.query_string)
+    end
+
+    private
+
+    def query_string_valid?(query_string)
+      query_hash = Rack::Utils.parse_query(query_string)
+
+      signature = query_hash.delete('signature')
+      return false if signature.nil?
+
+      ActiveSupport::SecurityUtils.secure_compare(
+        calculated_signature(query_hash),
+        signature
+      )
+    end
+
+    def calculated_signature(query_hash_without_signature)
+      sorted_params = query_hash_without_signature.collect{|k,v| "#{k}=#{Array(v).join(',')}"}.sort.join
+
+      OpenSSL::HMAC.hexdigest(
+        OpenSSL::Digest.new('sha256'),
+        ShopifyApp.configuration.secret,
+        sorted_params
+      )
+    end
+  end
+end

data/lib/shopify_app/version.rb

@@ -1,3 +1,3 @@
 module ShopifyApp
-  VERSION = '7.0.9'
+  VERSION = '7.0.10'
 end

data/shopify_app.gemspec

@@ -8,7 +8,7 @@ Gem::Specification.new do |s|
   s.author      = "Shopify"
   s.summary     = %q{This gem is used to get quickly started with the Shopify API}
 
-  s.add_dependency('rails', '>= 4.2.6', '< 5.0')
+  s.add_dependency('rails', '>= 4.2.6')
 
   s.add_runtime_dependency('shopify_api', '~> 4.2')
   s.add_runtime_dependency('omniauth-shopify-oauth2', '~> 1.1.11')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 7.0.9
+  version: 7.0.10
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-06-29 00:00:00.000000000 Z
+date: 2016-07-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -17,9 +17,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 4.2.6
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '5.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -27,9 +24,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 4.2.6
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: shopify_api
   requirement: !ruby/object:Gem::Requirement
@@ -151,6 +145,7 @@ files:
 - config/locales/en.yml
 - config/locales/es.yml
 - config/routes.rb
+- images/app-proxy-screenshot.png
 - lib/generators/shopify_app/add_webhook/add_webhook_generator.rb
 - lib/generators/shopify_app/add_webhook/templates/webhook_job.rb
 - lib/generators/shopify_app/controllers/controllers_generator.rb
@@ -175,6 +170,7 @@ files:
 - lib/generators/shopify_app/shopify_app_generator.rb
 - lib/generators/shopify_app/views/views_generator.rb
 - lib/shopify_app.rb
+- lib/shopify_app/app_proxy_verification.rb
 - lib/shopify_app/configuration.rb
 - lib/shopify_app/engine.rb
 - lib/shopify_app/in_memory_session_store.rb