shopify_app 7.2.0 → 7.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 47504ce67fc91bae133ac9451f21eb46b2307f6b
-  data.tar.gz: 1c9430ae87f14834389188ea630a43574e1d31c4
+  metadata.gz: a6802e72897eb705326a9cc6639506aa5eefb912
+  data.tar.gz: 76ae92534abcbbc635adcab460e6d7b72898a5ca
 SHA512:
-  metadata.gz: dce462b93f79c591d00801bf8eaedec76be7fcee1aa65184d6d2cad28480c438c92b2b4e1239382225f7782eb62bf735f941ca1c6bed166b0a016a4b7ca9d055
-  data.tar.gz: f5e656f7f0c720daa423d20dea3bddc47439e556713d6bfa8cca030ef12617ac64bbdeedb4541dd85dc311b229231662635f1ea6994b18ed761806d18a24207a
+  metadata.gz: 22cb00e95696ddfce4f64cd77cbe422de626e17e654b151d89c83a2d0813469a4565f51725f848c557e70b58275f2dfb1f40e0600d2bd03f787fa97d38325ae7
+  data.tar.gz: fffd5d0b94281792e7911091060654f06192387b9a5d08f336a6ec18725af3094a65c4ff5d9e05771dd0fba7d326d04b17572f305d68a2f6cef93fe0cb30b49b

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+7.2.2
+-----
+* Use postMessage to redirect parent iframe during authentication
+  https://github.com/Shopify/shopify_app/pull/366
+
+7.2.1
+-----
+* Add support for dynamically generating scripttag URLs
+* Bug-fix: `--application_name` and `--scope` generates proper Configuration even when options supplied to them contain whitespaces.
+
 7.2.0
 -----
 * Disable application layout rendering for the `/login` page

data/README.md

@@ -127,8 +127,10 @@ $ rails generate shopify_app:install --api_key <your_api_key> --secret <your_app
 ```
 
 Other options include:
-* `application_name` - the name of your app
-* `scope` - the Oauth access scope required for your app, eg 'read_products, write_orders'. For more information read the [docs](http://docs.shopify.com/api/tutorials/oauth)
+* `application_name` - the name of your app, it can be supplied with or without double-quotes if a whitespace is present. (e.g. `--application_name Example App` or `--application_name "Example App"`)  
+* `scope` - the Oauth access scope required for your app, eg **read_products, write_orders**. *Multiple options* need to be delimited by a comma-space, and can be supplied with or without double-quotes  
+(e.g. `--scope read_products, write_orders, write_products` or `--scope "read_products, write_orders, write_products"`)  
+For more information, refer the [docs](http://docs.shopify.com/api/tutorials/oauth).
 * `embedded` - the default is to generate an [embedded app](http://docs.shopify.com/embedded-app-sdk), if you want a legacy non-embedded app then set this to false, `--embedded false`
 
 You can update any of these settings later on easily, the arguments are simply for convenience.
@@ -225,7 +227,7 @@ ShopifyApp can manage your app's webhooks for you by setting which webhooks you
 ```ruby
 ShopifyApp.configure do |config|
   config.webhooks = [
-    {topic: 'carts/update', address: 'example-app.com/webhooks/carts_update'}
+    {topic: 'carts/update', address: 'https://example-app.com/webhooks/carts_update'}
   ]
 end
 ```
@@ -234,6 +236,16 @@ When the oauth callback is completed successfully ShopifyApp will queue a backgr
 
 ShopifyApp also provides a WebhooksController that receives webhooks and queues a job based on the webhook url. For example if you register the webhook from above then all you need to do is create a job called `CartsUpdateJob`. The job will be queued with 2 params `shop_domain` and `webhook` which is the webhook body.
 
+If you are only interested in particular fields, you can optionally filter the data sent by Shopify by specifying the `fields` parameter in `config/webhooks`. Note that you will still receive a webhook request from Shopify every time the resource is updated, but only the specified fields will be sent.
+
+```ruby
+ShopifyApp.configure do |config|
+  config.webhooks = [
+    {topic: 'products/update', address: 'https://example-app.com/webhooks/products_update', fields: ['title', 'vendor']}
+  ]
+end
+```
+
 If you'd rather implement your own controller then you'll want to use the WebhookVerfication module to verify your webhooks:
 
 ```ruby
@@ -268,12 +280,15 @@ As with webhooks, ShopifyApp can manage your app's scripttags for you by setting
 ShopifyApp.configure do |config|
   config.scripttags = [
     {event:'onload', src: 'https://my-shopifyapp.herokuapp.com/fancy.js'}
+    {event:'onload', src: ->(domain) { dynamic_tag_url(domain) } }
   ]
 end
 ```
 
 Scripttags are created in the same way as the Webhooks, with a background job which will create the required scripttags.
 
+If `src` responds to `call` its return value will be used as the scripttag's source. It will be called on scripttag creation and deletion.
+
 ShopifyApp::SessionRepository
 -----------------------------
 
@@ -310,15 +325,7 @@ Create your app proxy url in the [Shopify Partners' Dashboard](https://app.shopi
 Troubleshooting
 ---------------
 
-### Generator shopify_app:install hangs
-
-Rails uses spring by default to speed up development. To run the generator, spring has to be stopped:
-
-```sh
-$ bundle exec spring stop
-```
-
-Run shopify_app generator again.
+see [TROUBLESHOOTING.md](TROUBLESHOOTING.md)
 
 Testing an embedded app outside the Shopify admin
 -------------------------------------------------

data/TROUBLESHOOTING.md

@@ -0,0 +1,16 @@
+Troubleshooting Shopify App
+===========
+
+### Generator shopify_app:install hangs
+
+Rails uses spring by default to speed up development. To run the generator, spring has to be stopped:
+
+```sh
+$ bundle exec spring stop
+```
+
+Run shopify_app generator again.
+
+### App installation fails with 'The page you’re looking for could not be found' if the app was installed before
+
+This issue can occur when the session (the model you set as `ShopifyApp::SessionRepository.storage`) isn't deleted when the user uninstalls your app. A possible fix for this is listening to the `app/uninstalled` webhook and deleting the corresponding session in the webhook handler.

data/lib/generators/shopify_app/install/install_generator.rb

@@ -7,17 +7,17 @@ module ShopifyApp
       include Rails::Generators::Migration
       source_root File.expand_path('../templates', __FILE__)
 
-      class_option :application_name, type: :string
+      class_option :application_name, type: :array, default: ['My', 'Shopify', 'App']
       class_option :api_key, type: :string, default: '<api_key>'
       class_option :secret, type: :string, default: '<secret>'
-      class_option :scope, type: :string, default: 'read_orders, read_products'
+      class_option :scope, type: :array, default: ['read_orders,', 'read_products']
       class_option :embedded, type: :string, default: 'true'
 
       def create_shopify_app_initializer
-        @application_name = options['application_name']
+        @application_name = format_array_argument(options['application_name'])
         @api_key = options['api_key']
         @secret = options['secret']
-        @scope = options['scope']
+        @scope = format_array_argument(options['scope'])
 
         template 'shopify_app.rb', 'config/initializers/shopify_app.rb'
       end
@@ -61,6 +61,10 @@ module ShopifyApp
       def embedded_app?
         options['embedded'] == 'true'
       end
+
+      def format_array_argument(array)
+        array.join(' ').tr('"', '')
+      end
     end
   end
 end

data/lib/generators/shopify_app/install/templates/embedded_app.html.erb

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8" />
     <% application_name = ShopifyApp.configuration.application_name %>
-    <title><%= application_name.presence || 'Embedded Shopify App Example' %></title>
+    <title><%= application_name %></title>
     <%= stylesheet_link_tag 'application' %>
     <%= javascript_include_tag 'application', "data-turbolinks-track" => true %>
     <%= csrf_meta_tags %>

data/lib/generators/shopify_app/install/templates/shopify_app.rb

@@ -1,7 +1,5 @@
 ShopifyApp.configure do |config|
-<% if @application_name.present? %>
   config.application_name = "<%= @application_name %>"
-<% end %>
   config.api_key = "<%= @api_key %>"
   config.secret = "<%= @secret %>"
   config.scope = "<%= @scope %>"

data/lib/shopify_app/login_protection.rb

@@ -39,65 +39,69 @@ module ShopifyApp
         head :unauthorized
       else
         session[:return_to] = request.fullpath if request.get?
-        redirect_to_with_fallback main_or_engine_login_url(shop: params[:shop])
+        redirect_to main_or_engine_login_url(shop: params[:shop])
       end
     end
 
     def close_session
       session[:shopify] = nil
       session[:shopify_domain] = nil
-      redirect_to_with_fallback main_or_engine_login_url(shop: params[:shop])
+      redirect_to main_or_engine_login_url(shop: params[:shop])
     end
 
     def main_or_engine_login_url(params = {})
       main_app.login_url(params)
-    rescue NoMethodError => e
+    rescue NoMethodError
       shopify_app.login_url(params)
     end
 
-    def redirect_to_with_fallback(url)
-      url_json = url.to_json
-      url_json_no_quotes = url_json.gsub(/\A"|"\Z/, '')
+    def fullpage_redirect_to(url)
+      if ShopifyApp.configuration.embedded_app?
+        render inline: redirection_javascript(url)
+      else
+        redirect_to url
+      end
+    end
 
-      render inline: %Q(
+    def redirection_javascript(url)
+      %(
         <!DOCTYPE html>
         <html lang="en">
           <head>
             <meta charset="utf-8" />
+            <base target="_top">
             <title>Redirecting…</title>
             <script type="text/javascript">
-              window.location.href = #{url_json};
+
+              // If the current window is the 'parent', change the URL by setting location.href
+              if (window.top == window.self) {
+                window.top.location.href = #{url.to_json};
+
+              // If the current window is the 'child', change the parent's URL with postMessage
+              } else {
+                data = JSON.stringify({
+                  message: 'Shopify.API.remoteRedirect',
+                  data: { location: window.location.origin + #{url.to_json} }
+                });
+                window.parent.postMessage(data, "https://#{sanitized_shop_name}");
+              }
+
             </script>
           </head>
           <body>
           </body>
         </html>
-      ), status: 302, location: url
+      )
     end
 
-    def fullpage_redirect_to(url)
-      url_json = url.to_json
-      url_json_no_quotes = url_json.gsub(/\A"|"\Z/, '')
+    def sanitized_shop_name
+      @sanitized_shop_name ||= sanitize_shop_param(params)
+    end
 
-      if ShopifyApp.configuration.embedded_app?
-        render inline: %Q(
-          <!DOCTYPE html>
-          <html lang="en">
-            <head>
-              <meta charset="utf-8" />
-              <base target="_top">
-              <title>Redirecting…</title>
-              <script type="text/javascript">
-                window.top.location.href = #{url_json};
-              </script>
-            </head>
-            <body>
-            </body>
-          </html>
-        )
-      else
-        redirect_to_with_fallback url
-      end
+    def sanitize_shop_param(params)
+      return unless params[:shop].present?
+      ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
     end
+
   end
 end

data/lib/shopify_app/scripttags_manager.rb

@@ -6,14 +6,25 @@ module ShopifyApp
       ShopifyApp::ScripttagsManagerJob.perform_later(
         shop_domain: shop_domain,
         shop_token: shop_token,
-        scripttags: scripttags
+        # Procs cannot be serialized so we interpolate now, if necessary
+        scripttags: build_src(scripttags, shop_domain)
       )
     end
 
-    attr_reader :required_scripttags
+    def self.build_src(scripttags, domain)
+      scripttags.map do |tag|
+        next tag unless tag[:src].respond_to?(:call)
+        tag = tag.dup
+        tag[:src] = tag[:src].call(domain)
+        tag
+      end
+    end
+
+    attr_reader :required_scripttags, :shop_domain
 
-    def initialize(scripttags)
+    def initialize(scripttags, shop_domain)
       @required_scripttags = scripttags
+      @shop_domain = shop_domain
     end
 
     def recreate_scripttags!
@@ -24,14 +35,15 @@ module ShopifyApp
     def create_scripttags
       return unless required_scripttags.present?
 
-      required_scripttags.each do |scripttag|
+      expanded_scripttags.each do |scripttag|
         create_scripttag(scripttag) unless scripttag_exists?(scripttag[:src])
       end
     end
 
     def destroy_scripttags
-      ShopifyAPI::ScriptTag.all.each do |scripttag|
-        ShopifyAPI::ScriptTag.delete(scripttag.id) if is_required_scripttag?(scripttag)
+      scripttags = expanded_scripttags
+      ShopifyAPI::ScriptTag.all.each do |tag|
+        ShopifyAPI::ScriptTag.delete(tag.id) if is_required_scripttag?(scripttags, tag)
       end
 
       @current_scripttags = nil
@@ -39,8 +51,12 @@ module ShopifyApp
 
     private
 
-    def is_required_scripttag?(scripttag)
-      required_scripttags.map{ |w| w[:src] }.include? scripttag.src
+    def expanded_scripttags
+      self.class.build_src(required_scripttags, shop_domain)
+    end
+
+    def is_required_scripttag?(scripttags, tag)
+      scripttags.map{ |w| w[:src] }.include? tag.src
     end
 
     def create_scripttag(attributes)

data/lib/shopify_app/scripttags_manager_job.rb

@@ -2,12 +2,12 @@ module ShopifyApp
   class ScripttagsManagerJob < ActiveJob::Base
 
     queue_as do
-      ShopifyApp.configuration.webhooks_manager_queue_name
+      ShopifyApp.configuration.scripttags_manager_queue_name
     end
 
     def perform(shop_domain:, shop_token:, scripttags:)
       ShopifyAPI::Session.temp(shop_domain, shop_token) do
-        manager = ScripttagsManager.new(scripttags)
+        manager = ScripttagsManager.new(scripttags, shop_domain)
         manager.create_scripttags
       end
     end

data/lib/shopify_app/sessions_concern.rb

@@ -22,10 +22,10 @@ module ShopifyApp
         install_scripttags
 
         flash[:notice] = I18n.t('.logged_in')
-        redirect_to_with_fallback return_address
+        redirect_to return_address
       else
         flash[:error] = I18n.t('could_not_log_in')
-        redirect_to_with_fallback login_url
+        redirect_to login_url
       end
     end
 
@@ -33,16 +33,16 @@ module ShopifyApp
       session[:shopify] = nil
       session[:shopify_domain] = nil
       flash[:notice] = I18n.t('.logged_out')
-      redirect_to_with_fallback login_url
+      redirect_to login_url
     end
 
     protected
 
     def authenticate
-      if shop_name = sanitize_shop_param(params)
-        fullpage_redirect_to "#{main_app.root_path}auth/shopify?shop=#{shop_name}"
+      if sanitized_shop_name.present?
+        fullpage_redirect_to "#{main_app.root_path}auth/shopify?shop=#{sanitized_shop_name}"
       else
-        redirect_to_with_fallback return_address
+        redirect_to return_address
       end
     end
 
@@ -88,14 +88,5 @@ module ShopifyApp
       session.delete(:return_to) || main_app.root_url
     end
 
-    def sanitized_shop_name
-      @sanitized_shop_name ||= sanitize_shop_param(params)
-    end
-
-    def sanitize_shop_param(params)
-      return unless params[:shop].present?
-      ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
-    end
-
   end
 end

data/lib/shopify_app/version.rb

@@ -1,3 +1,3 @@
 module ShopifyApp
-  VERSION = '7.2.0'
+  VERSION = '7.2.3'
 end

data/lib/shopify_app/webhook_verification.rb

@@ -22,7 +22,7 @@ module ShopifyApp
     def hmac_valid?(data)
       secret = ShopifyApp.configuration.secret
       digest = OpenSSL::Digest.new('sha256')
-      ActiveSupport::SecurityUtils.variable_size_secure_compare(
+      ActiveSupport::SecurityUtils.secure_compare(
         shopify_hmac,
         Base64.encode64(OpenSSL::HMAC.digest(digest, secret, data)).strip
       )

data/lib/shopify_app/webhooks_manager.rb

@@ -30,7 +30,7 @@ module ShopifyApp
     end
 
     def destroy_webhooks
-      ShopifyAPI::Webhook.all.each do |webhook|
+      ShopifyAPI::Webhook.all.to_a.each do |webhook|
         ShopifyAPI::Webhook.delete(webhook.id) if is_required_webhook?(webhook)
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 7.2.0
+  version: 7.2.3
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-08-24 00:00:00.000000000 Z
+date: 2017-01-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -141,6 +141,7 @@ files:
 - README.md
 - RELEASING
 - Rakefile
+- TROUBLESHOOTING.md
 - app/controllers/shopify_app/authenticated_controller.rb
 - app/controllers/shopify_app/sessions_controller.rb
 - app/controllers/shopify_app/webhooks_controller.rb