shopify_app 7.2.0 → 17.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (199) hide show
  1. checksums.yaml +5 -5
  2. data/.babelrc +5 -0
  3. data/.github/CODEOWNERS +1 -0
  4. data/.github/ISSUE_TEMPLATE/bug-report.md +63 -0
  5. data/.github/ISSUE_TEMPLATE/config.yml +1 -0
  6. data/.github/ISSUE_TEMPLATE/feature-request.md +33 -0
  7. data/.github/PULL_REQUEST_TEMPLATE.md +22 -0
  8. data/.github/probots.yml +2 -0
  9. data/.github/workflows/build.yml +38 -0
  10. data/.github/workflows/release.yml +24 -0
  11. data/.github/workflows/rubocop.yml +22 -0
  12. data/.gitignore +4 -1
  13. data/.nvmrc +1 -0
  14. data/.rubocop.yml +18 -0
  15. data/.ruby-version +1 -0
  16. data/CHANGELOG.md +465 -0
  17. data/CONTRIBUTING.md +76 -0
  18. data/Gemfile +7 -0
  19. data/Gemfile.lock +256 -0
  20. data/README.md +73 -288
  21. data/Rakefile +1 -0
  22. data/SECURITY.md +59 -0
  23. data/app/assets/images/storage_access.svg +1 -0
  24. data/app/assets/javascripts/shopify_app/enable_cookies.js +3 -0
  25. data/app/assets/javascripts/shopify_app/itp_helper.js +40 -0
  26. data/app/assets/javascripts/shopify_app/partition_cookies.js +8 -0
  27. data/app/assets/javascripts/shopify_app/redirect.js +33 -0
  28. data/app/assets/javascripts/shopify_app/request_storage_access.js +3 -0
  29. data/app/assets/javascripts/shopify_app/storage_access.js +154 -0
  30. data/app/assets/javascripts/shopify_app/storage_access_redirect.js +17 -0
  31. data/app/assets/javascripts/shopify_app/top_level.js +2 -0
  32. data/app/assets/javascripts/shopify_app/top_level_interaction.js +11 -0
  33. data/app/controllers/concerns/shopify_app/authenticated.rb +16 -0
  34. data/app/controllers/concerns/shopify_app/ensure_authenticated_links.rb +26 -0
  35. data/app/controllers/concerns/shopify_app/require_known_shop.rb +39 -0
  36. data/app/controllers/concerns/shopify_app/shop_access_scopes_verification.rb +32 -0
  37. data/app/controllers/shopify_app/authenticated_controller.rb +5 -5
  38. data/app/controllers/shopify_app/callback_controller.rb +196 -0
  39. data/app/controllers/shopify_app/extension_verification_controller.rb +15 -0
  40. data/app/controllers/shopify_app/sessions_controller.rb +190 -2
  41. data/app/controllers/shopify_app/webhooks_controller.rb +16 -7
  42. data/app/views/shopify_app/partials/_button_styles.html.erb +109 -0
  43. data/app/views/shopify_app/partials/_card_styles.html.erb +33 -0
  44. data/app/views/shopify_app/partials/_empty_state_styles.html.erb +98 -0
  45. data/app/views/shopify_app/partials/_form_styles.html.erb +56 -0
  46. data/app/views/shopify_app/partials/_layout_styles.html.erb +182 -0
  47. data/app/views/shopify_app/partials/_typography_styles.html.erb +35 -0
  48. data/app/views/shopify_app/sessions/enable_cookies.html.erb +70 -0
  49. data/app/views/shopify_app/sessions/new.html.erb +39 -83
  50. data/app/views/shopify_app/sessions/request_storage_access.html.erb +68 -0
  51. data/app/views/shopify_app/sessions/top_level_interaction.html.erb +63 -0
  52. data/app/views/shopify_app/shared/redirect.html.erb +23 -0
  53. data/config/locales/cs.yml +23 -0
  54. data/config/locales/da.yml +20 -0
  55. data/config/locales/de.yml +22 -0
  56. data/config/locales/en.yml +12 -1
  57. data/config/locales/es.yml +21 -3
  58. data/config/locales/fi.yml +20 -0
  59. data/config/locales/fr.yml +23 -0
  60. data/config/locales/hi.yml +23 -0
  61. data/config/locales/it.yml +21 -0
  62. data/config/locales/ja.yml +17 -0
  63. data/config/locales/ko.yml +19 -0
  64. data/config/locales/ms.yml +22 -0
  65. data/config/locales/nb.yml +21 -0
  66. data/config/locales/nl.yml +21 -0
  67. data/config/locales/pl.yml +21 -0
  68. data/config/locales/pt-BR.yml +21 -0
  69. data/config/locales/pt-PT.yml +22 -0
  70. data/config/locales/sv.yml +21 -0
  71. data/config/locales/th.yml +20 -0
  72. data/config/locales/tr.yml +22 -0
  73. data/config/locales/vi.yml +22 -0
  74. data/config/locales/zh-CN.yml +16 -0
  75. data/config/locales/zh-TW.yml +16 -0
  76. data/config/routes.rb +12 -1
  77. data/docs/Quickstart.md +31 -0
  78. data/docs/Releasing.md +21 -0
  79. data/docs/Troubleshooting.md +16 -0
  80. data/docs/Upgrading.md +110 -0
  81. data/docs/shopify_app/authentication.md +124 -0
  82. data/docs/shopify_app/engine.md +82 -0
  83. data/docs/shopify_app/generators.md +127 -0
  84. data/docs/shopify_app/handling-access-scopes-changes.md +8 -0
  85. data/docs/shopify_app/script-tags.md +28 -0
  86. data/docs/shopify_app/session-repository.md +88 -0
  87. data/docs/shopify_app/testing.md +38 -0
  88. data/docs/shopify_app/webhooks.md +72 -0
  89. data/karma.conf.js +44 -0
  90. data/lib/generators/shopify_app/add_after_authenticate_job/add_after_authenticate_job_generator.rb +47 -0
  91. data/lib/generators/shopify_app/add_after_authenticate_job/templates/after_authenticate_job.rb +11 -0
  92. data/lib/generators/shopify_app/add_marketing_activity_extension/add_marketing_activity_extension_generator.rb +40 -0
  93. data/lib/generators/shopify_app/add_marketing_activity_extension/templates/marketing_activities_controller.rb +62 -0
  94. data/lib/generators/shopify_app/add_webhook/add_webhook_generator.rb +5 -4
  95. data/lib/generators/shopify_app/add_webhook/templates/{webhook_job.rb → webhook_job.rb.tt} +5 -0
  96. data/lib/generators/shopify_app/app_proxy_controller/app_proxy_controller_generator.rb +4 -3
  97. data/lib/generators/shopify_app/app_proxy_controller/templates/app_proxy_controller.rb +3 -3
  98. data/lib/generators/shopify_app/app_proxy_controller/templates/app_proxy_route.rb +10 -9
  99. data/lib/generators/shopify_app/app_proxy_controller/templates/index.html.erb +2 -2
  100. data/lib/generators/shopify_app/authenticated_controller/authenticated_controller_generator.rb +15 -0
  101. data/lib/generators/shopify_app/authenticated_controller/templates/authenticated_controller.rb +5 -0
  102. data/lib/generators/shopify_app/controllers/controllers_generator.rb +2 -1
  103. data/lib/generators/shopify_app/home_controller/home_controller_generator.rb +31 -9
  104. data/lib/generators/shopify_app/home_controller/templates/home_controller.rb +6 -1
  105. data/lib/generators/shopify_app/home_controller/templates/index.html.erb +70 -6
  106. data/lib/generators/shopify_app/home_controller/templates/unauthenticated_home_controller.rb +11 -0
  107. data/lib/generators/shopify_app/install/install_generator.rb +78 -27
  108. data/lib/generators/shopify_app/install/templates/_flash_messages.html.erb +1 -13
  109. data/lib/generators/shopify_app/install/templates/embedded_app.html.erb +12 -11
  110. data/lib/generators/shopify_app/install/templates/flash_messages.js +24 -0
  111. data/lib/generators/shopify_app/install/templates/omniauth.rb +3 -1
  112. data/lib/generators/shopify_app/install/templates/session_store.rb +4 -0
  113. data/lib/generators/shopify_app/install/templates/shopify_app.js +15 -0
  114. data/lib/generators/shopify_app/install/templates/shopify_app.rb.tt +25 -0
  115. data/lib/generators/shopify_app/install/templates/shopify_app_index.js +2 -0
  116. data/lib/generators/shopify_app/install/templates/shopify_provider.rb.tt +8 -0
  117. data/lib/generators/shopify_app/install/templates/user_agent.rb +6 -0
  118. data/lib/generators/shopify_app/products_controller/products_controller_generator.rb +19 -0
  119. data/lib/generators/shopify_app/products_controller/templates/products_controller.rb +8 -0
  120. data/lib/generators/shopify_app/rotate_shopify_token_job/rotate_shopify_token_job_generator.rb +16 -0
  121. data/lib/generators/shopify_app/rotate_shopify_token_job/templates/rotate_shopify_token.rake +17 -0
  122. data/lib/generators/shopify_app/rotate_shopify_token_job/templates/rotate_shopify_token_job.rb +42 -0
  123. data/lib/generators/shopify_app/routes/routes_generator.rb +1 -0
  124. data/lib/generators/shopify_app/routes/templates/routes.rb +10 -9
  125. data/lib/generators/shopify_app/shop_model/shop_model_generator.rb +42 -14
  126. data/lib/generators/shopify_app/shop_model/templates/db/migrate/add_shop_access_scopes_column.erb +5 -0
  127. data/lib/generators/shopify_app/shop_model/templates/db/migrate/{create_shops.rb → create_shops.erb} +1 -1
  128. data/lib/generators/shopify_app/shop_model/templates/shop.rb +6 -2
  129. data/lib/generators/shopify_app/shopify_app_generator.rb +5 -3
  130. data/lib/generators/shopify_app/user_model/templates/db/migrate/add_user_access_scopes_column.erb +5 -0
  131. data/lib/generators/shopify_app/user_model/templates/db/migrate/create_users.erb +16 -0
  132. data/lib/generators/shopify_app/user_model/templates/user.rb +8 -0
  133. data/lib/generators/shopify_app/user_model/templates/users.yml +4 -0
  134. data/lib/generators/shopify_app/user_model/user_model_generator.rb +70 -0
  135. data/lib/generators/shopify_app/views/views_generator.rb +2 -1
  136. data/lib/shopify_app/access_scopes/noop_strategy.rb +13 -0
  137. data/lib/shopify_app/access_scopes/shop_strategy.rb +24 -0
  138. data/lib/shopify_app/access_scopes/user_strategy.rb +41 -0
  139. data/lib/shopify_app/configuration.rb +69 -5
  140. data/lib/shopify_app/{app_proxy_verification.rb → controller_concerns/app_proxy_verification.rb} +4 -9
  141. data/lib/shopify_app/controller_concerns/csrf_protection.rb +15 -0
  142. data/lib/shopify_app/controller_concerns/embedded_app.rb +20 -0
  143. data/lib/shopify_app/controller_concerns/itp.rb +45 -0
  144. data/lib/shopify_app/controller_concerns/localization.rb +23 -0
  145. data/lib/shopify_app/controller_concerns/login_protection.rb +244 -0
  146. data/lib/shopify_app/controller_concerns/payload_verification.rb +24 -0
  147. data/lib/shopify_app/controller_concerns/webhook_verification.rb +23 -0
  148. data/lib/shopify_app/engine.rb +40 -0
  149. data/lib/shopify_app/jobs/scripttags_manager_job.rb +16 -0
  150. data/lib/shopify_app/{webhooks_manager_job.rb → jobs/webhooks_manager_job.rb} +3 -2
  151. data/lib/shopify_app/{scripttags_manager.rb → managers/scripttags_manager.rb} +25 -8
  152. data/lib/shopify_app/{webhooks_manager.rb → managers/webhooks_manager.rb} +6 -5
  153. data/lib/shopify_app/middleware/jwt_middleware.rb +42 -0
  154. data/lib/shopify_app/middleware/same_site_cookie_middleware.rb +34 -0
  155. data/lib/shopify_app/omniauth/omniauth_configuration.rb +64 -0
  156. data/lib/shopify_app/session/in_memory_session_store.rb +31 -0
  157. data/lib/shopify_app/session/in_memory_shop_session_store.rb +16 -0
  158. data/lib/shopify_app/session/in_memory_user_session_store.rb +16 -0
  159. data/lib/shopify_app/session/jwt.rb +63 -0
  160. data/lib/shopify_app/session/null_user_session_store.rb +22 -0
  161. data/lib/shopify_app/session/session_repository.rb +56 -0
  162. data/lib/shopify_app/session/session_storage.rb +20 -0
  163. data/lib/shopify_app/session/shop_session_storage.rb +42 -0
  164. data/lib/shopify_app/session/shop_session_storage_with_scopes.rb +58 -0
  165. data/lib/shopify_app/session/user_session_storage.rb +42 -0
  166. data/lib/shopify_app/session/user_session_storage_with_scopes.rb +58 -0
  167. data/lib/shopify_app/test_helpers/all.rb +2 -0
  168. data/lib/shopify_app/test_helpers/webhook_verification_helper.rb +17 -0
  169. data/lib/shopify_app/utils.rb +24 -4
  170. data/lib/shopify_app/version.rb +2 -1
  171. data/lib/shopify_app.rb +65 -24
  172. data/package.json +27 -0
  173. data/service.yml +7 -0
  174. data/shipit.rubygems.yml +3 -0
  175. data/shopify_app.gemspec +20 -9
  176. data/translation.yml +7 -0
  177. data/webpack.config.js +24 -0
  178. data/yarn.lock +5215 -0
  179. metadata +274 -43
  180. data/.travis.yml +0 -17
  181. data/Gemfile.rails50 +0 -5
  182. data/Gemfile.ruby22 +0 -6
  183. data/Gemfile.ruby22.rails50 +0 -9
  184. data/ISSUE_TEMPLATE.md +0 -14
  185. data/QUICKSTART.md +0 -72
  186. data/RELEASING +0 -13
  187. data/lib/generators/shopify_app/home_controller/templates/shopify_app_ready_script.html.erb +0 -11
  188. data/lib/generators/shopify_app/install/templates/shopify_app.rb +0 -9
  189. data/lib/generators/shopify_app/install/templates/shopify_provider.rb +0 -4
  190. data/lib/generators/shopify_app/install/templates/shopify_session_repository.rb +0 -23
  191. data/lib/generators/shopify_app/shop_model/templates/shopify_session_repository.rb +0 -7
  192. data/lib/shopify_app/in_memory_session_store.rb +0 -25
  193. data/lib/shopify_app/login_protection.rb +0 -103
  194. data/lib/shopify_app/scripttags_manager_job.rb +0 -15
  195. data/lib/shopify_app/session_storage.rb +0 -23
  196. data/lib/shopify_app/sessions_concern.rb +0 -101
  197. data/lib/shopify_app/shop.rb +0 -15
  198. data/lib/shopify_app/shopify_session_repository.rb +0 -34
  199. data/lib/shopify_app/webhook_verification.rb +0 -39
@@ -1,103 +0,0 @@
1
- module ShopifyApp
2
- module LoginProtection
3
- extend ActiveSupport::Concern
4
-
5
- included do
6
- rescue_from ActiveResource::UnauthorizedAccess, :with => :close_session
7
- end
8
-
9
- def shopify_session
10
- if shop_session
11
- begin
12
- ShopifyAPI::Base.activate_session(shop_session)
13
- yield
14
- ensure
15
- ShopifyAPI::Base.clear_session
16
- end
17
- else
18
- redirect_to_login
19
- end
20
- end
21
-
22
- def shop_session
23
- return unless session[:shopify]
24
- @shop_session ||= ShopifyApp::SessionRepository.retrieve(session[:shopify])
25
- end
26
-
27
- def login_again_if_different_shop
28
- if shop_session && params[:shop] && params[:shop].is_a?(String) && shop_session.url != params[:shop]
29
- session[:shopify] = nil
30
- session[:shopify_domain] = nil
31
- redirect_to_login
32
- end
33
- end
34
-
35
- protected
36
-
37
- def redirect_to_login
38
- if request.xhr?
39
- head :unauthorized
40
- else
41
- session[:return_to] = request.fullpath if request.get?
42
- redirect_to_with_fallback main_or_engine_login_url(shop: params[:shop])
43
- end
44
- end
45
-
46
- def close_session
47
- session[:shopify] = nil
48
- session[:shopify_domain] = nil
49
- redirect_to_with_fallback main_or_engine_login_url(shop: params[:shop])
50
- end
51
-
52
- def main_or_engine_login_url(params = {})
53
- main_app.login_url(params)
54
- rescue NoMethodError => e
55
- shopify_app.login_url(params)
56
- end
57
-
58
- def redirect_to_with_fallback(url)
59
- url_json = url.to_json
60
- url_json_no_quotes = url_json.gsub(/\A"|"\Z/, '')
61
-
62
- render inline: %Q(
63
- <!DOCTYPE html>
64
- <html lang="en">
65
- <head>
66
- <meta charset="utf-8" />
67
- <title>Redirecting…</title>
68
- <script type="text/javascript">
69
- window.location.href = #{url_json};
70
- </script>
71
- </head>
72
- <body>
73
- </body>
74
- </html>
75
- ), status: 302, location: url
76
- end
77
-
78
- def fullpage_redirect_to(url)
79
- url_json = url.to_json
80
- url_json_no_quotes = url_json.gsub(/\A"|"\Z/, '')
81
-
82
- if ShopifyApp.configuration.embedded_app?
83
- render inline: %Q(
84
- <!DOCTYPE html>
85
- <html lang="en">
86
- <head>
87
- <meta charset="utf-8" />
88
- <base target="_top">
89
- <title>Redirecting…</title>
90
- <script type="text/javascript">
91
- window.top.location.href = #{url_json};
92
- </script>
93
- </head>
94
- <body>
95
- </body>
96
- </html>
97
- )
98
- else
99
- redirect_to_with_fallback url
100
- end
101
- end
102
- end
103
- end
@@ -1,15 +0,0 @@
1
- module ShopifyApp
2
- class ScripttagsManagerJob < ActiveJob::Base
3
-
4
- queue_as do
5
- ShopifyApp.configuration.webhooks_manager_queue_name
6
- end
7
-
8
- def perform(shop_domain:, shop_token:, scripttags:)
9
- ShopifyAPI::Session.temp(shop_domain, shop_token) do
10
- manager = ScripttagsManager.new(scripttags)
11
- manager.create_scripttags
12
- end
13
- end
14
- end
15
- end
@@ -1,23 +0,0 @@
1
- module ShopifyApp
2
- module SessionStorage
3
- extend ActiveSupport::Concern
4
-
5
- class_methods do
6
- def store(session)
7
- shop = self.find_or_initialize_by(shopify_domain: session.url)
8
- shop.shopify_token = session.token
9
- shop.save!
10
- shop.id
11
- end
12
-
13
- def retrieve(id)
14
- return unless id
15
-
16
- if shop = self.find_by(id: id)
17
- ShopifyAPI::Session.new(shop.shopify_domain, shop.shopify_token)
18
- end
19
- end
20
- end
21
-
22
- end
23
- end
@@ -1,101 +0,0 @@
1
- module ShopifyApp
2
- module SessionsConcern
3
- extend ActiveSupport::Concern
4
-
5
- included do
6
- include ShopifyApp::LoginProtection
7
- layout false, only: :new
8
- end
9
-
10
- def new
11
- authenticate if params[:shop].present?
12
- end
13
-
14
- def create
15
- authenticate
16
- end
17
-
18
- def callback
19
- if auth_hash
20
- login_shop
21
- install_webhooks
22
- install_scripttags
23
-
24
- flash[:notice] = I18n.t('.logged_in')
25
- redirect_to_with_fallback return_address
26
- else
27
- flash[:error] = I18n.t('could_not_log_in')
28
- redirect_to_with_fallback login_url
29
- end
30
- end
31
-
32
- def destroy
33
- session[:shopify] = nil
34
- session[:shopify_domain] = nil
35
- flash[:notice] = I18n.t('.logged_out')
36
- redirect_to_with_fallback login_url
37
- end
38
-
39
- protected
40
-
41
- def authenticate
42
- if shop_name = sanitize_shop_param(params)
43
- fullpage_redirect_to "#{main_app.root_path}auth/shopify?shop=#{shop_name}"
44
- else
45
- redirect_to_with_fallback return_address
46
- end
47
- end
48
-
49
- def login_shop
50
- sess = ShopifyAPI::Session.new(shop_name, token)
51
- session[:shopify] = ShopifyApp::SessionRepository.store(sess)
52
- session[:shopify_domain] = shop_name
53
- end
54
-
55
- def auth_hash
56
- request.env['omniauth.auth']
57
- end
58
-
59
- def shop_name
60
- auth_hash.uid
61
- end
62
-
63
- def token
64
- auth_hash['credentials']['token']
65
- end
66
-
67
- def install_webhooks
68
- return unless ShopifyApp.configuration.has_webhooks?
69
-
70
- WebhooksManager.queue(
71
- shop_name,
72
- token,
73
- ShopifyApp.configuration.webhooks
74
- )
75
- end
76
-
77
- def install_scripttags
78
- return unless ShopifyApp.configuration.has_scripttags?
79
-
80
- ScripttagsManager.queue(
81
- shop_name,
82
- token,
83
- ShopifyApp.configuration.scripttags
84
- )
85
- end
86
-
87
- def return_address
88
- session.delete(:return_to) || main_app.root_url
89
- end
90
-
91
- def sanitized_shop_name
92
- @sanitized_shop_name ||= sanitize_shop_param(params)
93
- end
94
-
95
- def sanitize_shop_param(params)
96
- return unless params[:shop].present?
97
- ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
98
- end
99
-
100
- end
101
- end
@@ -1,15 +0,0 @@
1
- module ShopifyApp
2
- module Shop
3
- extend ActiveSupport::Concern
4
-
5
- included do
6
- validates :shopify_domain, presence: true, uniqueness: true
7
- validates :shopify_token, presence: true
8
- end
9
-
10
- def with_shopify_session(&block)
11
- ShopifyAPI::Session.temp(shopify_domain, shopify_token, &block)
12
- end
13
-
14
- end
15
- end
@@ -1,34 +0,0 @@
1
- module ShopifyApp
2
- class SessionRepository
3
- class ConfigurationError < StandardError; end
4
-
5
- class << self
6
- def storage=(storage)
7
- @storage = storage
8
-
9
- unless storage.nil? || self.storage.respond_to?(:store) && self.storage.respond_to?(:retrieve)
10
- raise ArgumentError, "storage must respond to :store and :retrieve"
11
- end
12
- end
13
-
14
- def retrieve(id)
15
- storage.retrieve(id)
16
- end
17
-
18
- def store(session)
19
- storage.store(session)
20
- end
21
-
22
- def storage
23
- load_storage || raise(ConfigurationError.new("ShopifySessionRepository.storage is not configured!"))
24
- end
25
-
26
- private
27
-
28
- def load_storage
29
- return unless @storage
30
- @storage.respond_to?(:safe_constantize) ? @storage.safe_constantize : @storage
31
- end
32
- end
33
- end
34
- end
@@ -1,39 +0,0 @@
1
- module ShopifyApp
2
- module WebhookVerification
3
- extend ActiveSupport::Concern
4
-
5
- included do
6
- if Rails.version >= '5.0'
7
- skip_before_action :verify_authenticity_token, raise: false
8
- else
9
- skip_before_action :verify_authenticity_token
10
- end
11
-
12
- before_action :verify_request
13
- end
14
-
15
- private
16
-
17
- def verify_request
18
- data = request.raw_post
19
- return head :unauthorized unless hmac_valid?(data)
20
- end
21
-
22
- def hmac_valid?(data)
23
- secret = ShopifyApp.configuration.secret
24
- digest = OpenSSL::Digest.new('sha256')
25
- ActiveSupport::SecurityUtils.variable_size_secure_compare(
26
- shopify_hmac,
27
- Base64.encode64(OpenSSL::HMAC.digest(digest, secret, data)).strip
28
- )
29
- end
30
-
31
- def shop_domain
32
- request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN']
33
- end
34
-
35
- def shopify_hmac
36
- request.headers['HTTP_X_SHOPIFY_HMAC_SHA256']
37
- end
38
- end
39
- end