shopify_app 7.2.0 → 8.5.0

data/lib/generators/shopify_app/shop_model/shop_model_generator.rb

@@ -12,11 +12,11 @@ module ShopifyApp
       end
 
       def create_shop_migration
-        copy_migration 'create_shops.rb'
+        migration_template 'db/migrate/create_shops.erb', 'db/migrate/create_shops.rb'
       end
 
-      def create_session_storage_initializer
-        copy_file 'shopify_session_repository.rb', 'config/initializers/shopify_session_repository.rb', force: true
+      def update_shopify_app_initializer
+        gsub_file 'config/initializers/shopify_app.rb', 'ShopifyApp::InMemorySessionStore', 'Shop'
       end
 
       def create_shop_fixtures
@@ -25,12 +25,8 @@ module ShopifyApp
 
       private
 
-      def copy_migration(migration_name, config = {})
-        migration_template(
-          "db/migrate/#{migration_name}",
-          "db/migrate/#{migration_name}",
-          config
-        )
+      def rails_migration_version
+        Rails.version.match(/\d\.\d/)[0]
       end
 
       # for generating a timestamp when using `create_migration`

data/lib/generators/shopify_app/shop_model/templates/db/migrate/{create_shops.rb → create_shops.erb}

@@ -1,4 +1,4 @@
-class CreateShops < ActiveRecord::Migration
+class CreateShops < ActiveRecord::Migration[<%= rails_migration_version %>]
   def self.up
     create_table :shops  do |t|
       t.string :shopify_domain, null: false

data/lib/generators/shopify_app/shop_model/templates/shop.rb

@@ -1,4 +1,3 @@
 class Shop < ActiveRecord::Base
-  include ShopifyApp::Shop
   include ShopifyApp::SessionStorage
 end

data/lib/shopify_app/configuration.rb

@@ -7,11 +7,18 @@ module ShopifyApp
     attr_accessor :application_name
     attr_accessor :api_key
     attr_accessor :secret
+    attr_accessor :old_secret
     attr_accessor :scope
     attr_accessor :embedded_app
     alias_method  :embedded_app?, :embedded_app
     attr_accessor :webhooks
     attr_accessor :scripttags
+    attr_accessor :after_authenticate_job
+    attr_accessor :session_repository
+
+    # customise urls
+    attr_accessor :root_url
+    attr_accessor :login_url
 
     # customise ActiveJob queue names
     attr_accessor :scripttags_manager_queue_name
@@ -20,24 +27,36 @@ module ShopifyApp
     # configure myshopify domain for local shopify development
     attr_accessor :myshopify_domain
 
+    # allow namespacing webhook jobs
+    attr_accessor :webhook_jobs_namespace
+
     def initialize
+      @root_url = '/'
       @myshopify_domain = 'myshopify.com'
+      @scripttags_manager_queue_name = Rails.application.config.active_job.queue_name
+      @webhooks_manager_queue_name = Rails.application.config.active_job.queue_name
     end
 
-    def has_webhooks?
-      webhooks.present?
+    def login_url
+      @login_url || File.join(@root_url, 'login')
     end
 
-    def has_scripttags?
-      scripttags.present?
+    def session_repository=(klass)
+      if Rails.configuration.cache_classes
+        ShopifyApp::SessionRepository.storage = klass
+      else
+        ActiveSupport::Reloader.to_prepare do
+          ShopifyApp::SessionRepository.storage = klass
+        end
+      end
     end
 
-    def scripttags_manager_queue_name
-      @scripttags_manager_queue_name ||= Rails.application.config.active_job.queue_name
+    def has_webhooks?
+      webhooks.present?
     end
 
-    def webhooks_manager_queue_name
-      @webhooks_manager_queue_name ||= Rails.application.config.active_job.queue_name
+    def has_scripttags?
+      scripttags.present?
     end
   end
 

data/lib/shopify_app/{app_proxy_verification.rb → controller_concerns/app_proxy_verification.rb}

@@ -3,17 +3,12 @@ module ShopifyApp
     extend ActiveSupport::Concern
 
     included do
-      if Rails.version >= '5.0'
-        skip_before_action :verify_authenticity_token, raise: false
-      else
-        skip_before_action :verify_authenticity_token
-      end
-
+      skip_before_action :verify_authenticity_token, raise: false
       before_action :verify_proxy_request
     end
 
     def verify_proxy_request
-      return head :unauthorized unless query_string_valid?(request.query_string)
+      return head :forbidden unless query_string_valid?(request.query_string)
     end
 
     private

data/lib/shopify_app/controller_concerns/embedded_app.rb

@@ -0,0 +1,19 @@
+module ShopifyApp
+  module EmbeddedApp
+    extend ActiveSupport::Concern
+
+    included do
+      if ShopifyApp.configuration.embedded_app?
+        after_action :set_esdk_headers
+        layout 'embedded_app'
+      end
+    end
+
+    private
+
+    def set_esdk_headers
+      response.set_header('P3P', 'CP="Not used"')
+      response.headers.except!('X-Frame-Options')
+    end
+  end
+end

data/lib/shopify_app/controller_concerns/itp.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module ShopifyApp
+  # Cookie management helpers required for ITP implementation
+  module Itp
+    private
+
+    def set_test_cookie
+      return unless ShopifyApp.configuration.embedded_app?
+      return unless user_agent_can_partition_cookies
+
+      session['shopify.cookies_persist'] = true
+    end
+
+    def set_top_level_oauth_cookie
+      session['shopify.top_level_oauth'] = true
+    end
+
+    def clear_top_level_oauth_cookie
+      session.delete('shopify.top_level_oauth')
+    end
+
+    def user_agent_is_mobile
+      user_agent = BrowserSniffer.new(request.user_agent).browser_info
+
+      user_agent[:name].to_s.match(/Shopify\sMobile/)
+    end
+
+    def user_agent_is_pos
+      user_agent = BrowserSniffer.new(request.user_agent).browser_info
+
+      user_agent[:name].to_s.match(/Shopify\sPOS/)
+    end
+
+    def user_agent_can_partition_cookies
+      user_agent = BrowserSniffer.new(request.user_agent).browser_info
+
+      is_safari = user_agent[:name].to_s.match(/Safari/)
+
+      return false unless is_safari
+
+      user_agent[:version].to_s.match(/12\.0/)
+    end
+  end
+end

data/lib/shopify_app/controller_concerns/localization.rb

@@ -0,0 +1,22 @@
+module ShopifyApp
+  module Localization
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_locale
+    end
+
+    private
+
+    def set_locale
+      if params[:locale]
+        session[:locale] = params[:locale]
+      else
+        session[:locale] ||= I18n.default_locale
+      end
+      I18n.locale = session[:locale]
+    rescue I18n::InvalidLocale
+      I18n.locale = I18n.default_locale
+    end
+  end
+end

data/lib/shopify_app/controller_concerns/login_protection.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require 'browser_sniffer'
+
+module ShopifyApp
+  module LoginProtection
+    extend ActiveSupport::Concern
+    include ShopifyApp::Itp
+
+    class ShopifyDomainNotFound < StandardError; end
+
+    included do
+      after_action :set_test_cookie
+      rescue_from ActiveResource::UnauthorizedAccess, :with => :close_session
+    end
+
+    def shopify_session
+      return redirect_to_login unless shop_session
+      clear_top_level_oauth_cookie
+
+      begin
+        ShopifyAPI::Base.activate_session(shop_session)
+        yield
+      ensure
+        ShopifyAPI::Base.clear_session
+      end
+    end
+
+    def shop_session
+      return unless session[:shopify]
+      @shop_session ||= ShopifyApp::SessionRepository.retrieve(session[:shopify])
+    end
+
+    def login_again_if_different_shop
+      if shop_session && params[:shop] && params[:shop].is_a?(String) && (shop_session.url != params[:shop])
+        clear_shop_session
+        redirect_to_login
+      end
+    end
+
+    protected
+
+    def redirect_to_login
+      if request.xhr?
+        head :unauthorized
+      else
+        if request.get?
+          session[:return_to] = "#{request.path}?#{sanitized_params.to_query}"
+        end
+        redirect_to login_url
+      end
+    end
+
+    def close_session
+      clear_shop_session
+      redirect_to login_url
+    end
+
+    def clear_shop_session
+      session[:shopify] = nil
+      session[:shopify_domain] = nil
+      session[:shopify_user] = nil
+    end
+
+    def login_url(top_level: false)
+      url = ShopifyApp.configuration.login_url
+
+      query_params = login_url_params(top_level: top_level)
+
+      url = "#{url}?#{query_params.to_query}" if query_params.present?
+      url
+    end
+
+    def login_url_params(top_level:)
+      query_params = {}
+      query_params[:shop] = sanitized_params[:shop] if params[:shop].present?
+
+      has_referer_shop_name = referer_sanitized_shop_name.present?
+
+      if has_referer_shop_name
+        query_params[:shop] ||= referer_sanitized_shop_name
+      end
+
+      query_params[:top_level] = true if top_level
+      query_params
+    end
+
+    def fullpage_redirect_to(url)
+      if ShopifyApp.configuration.embedded_app?
+        render 'shopify_app/shared/redirect', layout: false, locals: { url: url, current_shopify_domain: current_shopify_domain }
+      else
+        redirect_to url
+      end
+    end
+
+    def current_shopify_domain
+      shopify_domain = sanitized_shop_name || session[:shopify_domain]
+      return shopify_domain if shopify_domain.present?
+
+      raise ShopifyDomainNotFound
+    end
+
+    def sanitized_shop_name
+      @sanitized_shop_name ||= sanitize_shop_param(params)
+    end
+
+    def referer_sanitized_shop_name
+      return unless request.referer.present?
+
+      @referer_sanitized_shop_name ||= begin
+        referer_uri = URI(request.referer)
+        query_params = Rack::Utils.parse_query(referer_uri.query)
+
+        sanitize_shop_param(query_params.with_indifferent_access)
+      end
+    end
+
+    def sanitize_shop_param(params)
+      return unless params[:shop].present?
+      ShopifyApp::Utils.sanitize_shop_domain(params[:shop])
+    end
+
+    def sanitized_params
+      request.query_parameters.clone.tap do |query_params|
+        if params[:shop].is_a?(String)
+          query_params[:shop] = sanitize_shop_param(params)
+        end
+      end
+    end
+
+    def return_address
+      session.delete(:return_to) || ShopifyApp.configuration.root_url
+    end
+  end
+end

data/lib/shopify_app/{webhook_verification.rb → controller_concerns/webhook_verification.rb}

@@ -3,12 +3,7 @@ module ShopifyApp
     extend ActiveSupport::Concern
 
     included do
-      if Rails.version >= '5.0'
-        skip_before_action :verify_authenticity_token, raise: false
-      else
-        skip_before_action :verify_authenticity_token
-      end
-
+      skip_before_action :verify_authenticity_token, raise: false
       before_action :verify_request
     end
 
@@ -20,12 +15,16 @@ module ShopifyApp
     end
 
     def hmac_valid?(data)
-      secret = ShopifyApp.configuration.secret
-      digest = OpenSSL::Digest.new('sha256')
-      ActiveSupport::SecurityUtils.variable_size_secure_compare(
-        shopify_hmac,
-        Base64.encode64(OpenSSL::HMAC.digest(digest, secret, data)).strip
-      )
+      secrets = [ShopifyApp.configuration.secret, ShopifyApp.configuration.old_secret].reject(&:blank?)
+
+      secrets.any? do |secret|
+        digest = OpenSSL::Digest.new('sha256')
+
+        ActiveSupport::SecurityUtils.secure_compare(
+          shopify_hmac,
+          Base64.strict_encode64(OpenSSL::HMAC.digest(digest, secret, data))
+        )
+      end
     end
 
     def shop_domain

data/lib/shopify_app/engine.rb

@@ -2,5 +2,15 @@ module ShopifyApp
   class Engine < Rails::Engine
     engine_name 'shopify_app'
     isolate_namespace ShopifyApp
+
+    initializer "shopify_app.assets.precompile" do |app|
+      app.config.assets.precompile += %w[
+        shopify_app/redirect.js
+        shopify_app/top_level.js
+        shopify_app/enable_cookies.js
+        shopify_app/request_storage_access.js
+        storage_access.svg
+      ]
+    end
   end
 end

data/lib/shopify_app/{scripttags_manager_job.rb → jobs/scripttags_manager_job.rb}

@@ -2,12 +2,12 @@ module ShopifyApp
   class ScripttagsManagerJob < ActiveJob::Base
 
     queue_as do
-      ShopifyApp.configuration.webhooks_manager_queue_name
+      ShopifyApp.configuration.scripttags_manager_queue_name
     end
 
     def perform(shop_domain:, shop_token:, scripttags:)
       ShopifyAPI::Session.temp(shop_domain, shop_token) do
-        manager = ScripttagsManager.new(scripttags)
+        manager = ScripttagsManager.new(scripttags, shop_domain)
         manager.create_scripttags
       end
     end

data/lib/shopify_app/{scripttags_manager.rb → managers/scripttags_manager.rb}

@@ -6,14 +6,25 @@ module ShopifyApp
       ShopifyApp::ScripttagsManagerJob.perform_later(
         shop_domain: shop_domain,
         shop_token: shop_token,
-        scripttags: scripttags
+        # Procs cannot be serialized so we interpolate now, if necessary
+        scripttags: build_src(scripttags, shop_domain)
       )
     end
 
-    attr_reader :required_scripttags
+    def self.build_src(scripttags, domain)
+      scripttags.map do |tag|
+        next tag unless tag[:src].respond_to?(:call)
+        tag = tag.dup
+        tag[:src] = tag[:src].call(domain)
+        tag
+      end
+    end
+
+    attr_reader :required_scripttags, :shop_domain
 
-    def initialize(scripttags)
+    def initialize(scripttags, shop_domain)
       @required_scripttags = scripttags
+      @shop_domain = shop_domain
     end
 
     def recreate_scripttags!
@@ -24,14 +35,15 @@ module ShopifyApp
     def create_scripttags
       return unless required_scripttags.present?
 
-      required_scripttags.each do |scripttag|
+      expanded_scripttags.each do |scripttag|
         create_scripttag(scripttag) unless scripttag_exists?(scripttag[:src])
       end
     end
 
     def destroy_scripttags
-      ShopifyAPI::ScriptTag.all.each do |scripttag|
-        ShopifyAPI::ScriptTag.delete(scripttag.id) if is_required_scripttag?(scripttag)
+      scripttags = expanded_scripttags
+      ShopifyAPI::ScriptTag.all.each do |tag|
+        ShopifyAPI::ScriptTag.delete(tag.id) if is_required_scripttag?(scripttags, tag)
       end
 
       @current_scripttags = nil
@@ -39,8 +51,12 @@ module ShopifyApp
 
     private
 
-    def is_required_scripttag?(scripttag)
-      required_scripttags.map{ |w| w[:src] }.include? scripttag.src
+    def expanded_scripttags
+      self.class.build_src(required_scripttags, shop_domain)
+    end
+
+    def is_required_scripttag?(scripttags, tag)
+      scripttags.map{ |w| w[:src] }.include? tag.src
     end
 
     def create_scripttag(attributes)

data/lib/shopify_app/{webhooks_manager.rb → managers/webhooks_manager.rb}

@@ -30,7 +30,7 @@ module ShopifyApp
     end
 
     def destroy_webhooks
-      ShopifyAPI::Webhook.all.each do |webhook|
+      ShopifyAPI::Webhook.all.to_a.each do |webhook|
         ShopifyAPI::Webhook.delete(webhook.id) if is_required_webhook?(webhook)
       end
 

data/lib/shopify_app/session/in_memory_session_store.rb

@@ -0,0 +1,27 @@
+module ShopifyApp
+  class InMemorySessionStore
+    class EnvironmentError < StandardError; end
+
+    def self.retrieve(id)
+      repo[id]
+    end
+
+    def self.store(session)
+      id = SecureRandom.uuid
+      repo[id] = session
+      id
+    end
+
+    def self.clear
+      @@repo = nil
+    end
+
+    def self.repo
+      if Rails.env.production?
+        raise EnvironmentError.new("Cannot use InMemorySessionStore in a Production environment. \
+          Please initialize ShopifyApp with a model that can store and retrieve sessions")
+      end
+      @@repo ||= {}
+    end
+  end
+end

data/lib/shopify_app/{session_storage.rb → session/session_storage.rb}

@@ -2,6 +2,15 @@ module ShopifyApp
   module SessionStorage
     extend ActiveSupport::Concern
 
+    included do
+      validates :shopify_domain, presence: true, uniqueness: true
+      validates :shopify_token, presence: true
+    end
+
+    def with_shopify_session(&block)
+      ShopifyAPI::Session.temp(shopify_domain, shopify_token, &block)
+    end
+
     class_methods do
       def store(session)
         shop = self.find_or_initialize_by(shopify_domain: session.url)

data/lib/shopify_app/utils.rb

@@ -2,12 +2,12 @@ module ShopifyApp
   module Utils
 
     def self.sanitize_shop_domain(shop_domain)
-      name = shop_domain.to_s.strip
+      name = shop_domain.to_s.downcase.strip
       name += ".#{ShopifyApp.configuration.myshopify_domain}" if !name.include?("#{ShopifyApp.configuration.myshopify_domain}") && !name.include?(".")
       name.sub!(%r|https?://|, '')
 
       u = URI("http://#{name}")
-      u.host && u.host.ends_with?(".#{ShopifyApp.configuration.myshopify_domain}") ? u.host : nil
+      u.host if u.host&.match(/^[a-z0-9][a-z0-9\-]*[a-z0-9]\.#{Regexp.escape(ShopifyApp.configuration.myshopify_domain)}$/)
     rescue URI::InvalidURIError
       nil
     end

data/lib/shopify_app/version.rb

@@ -1,3 +1,3 @@
 module ShopifyApp
-  VERSION = '7.2.0'
+  VERSION = '8.5.0'.freeze
 end

data/lib/shopify_app.rb

@@ -10,21 +10,26 @@ require 'shopify_app/configuration'
 # engine
 require 'shopify_app/engine'
 
-# jobs
-require 'shopify_app/webhooks_manager_job'
-require 'shopify_app/scripttags_manager_job'
-
-# helpers and concerns
-require 'shopify_app/shop'
-require 'shopify_app/session_storage'
-require 'shopify_app/sessions_concern'
-require 'shopify_app/login_protection'
-require 'shopify_app/webhooks_manager'
-require 'shopify_app/scripttags_manager'
-require 'shopify_app/webhook_verification'
-require 'shopify_app/app_proxy_verification'
+# utils
 require 'shopify_app/utils'
 
-# session repository
-require 'shopify_app/shopify_session_repository'
-require 'shopify_app/in_memory_session_store'
+# controller concerns
+require 'shopify_app/controller_concerns/localization'
+require 'shopify_app/controller_concerns/itp'
+require 'shopify_app/controller_concerns/login_protection'
+require 'shopify_app/controller_concerns/embedded_app'
+require 'shopify_app/controller_concerns/webhook_verification'
+require 'shopify_app/controller_concerns/app_proxy_verification'
+
+# jobs
+require 'shopify_app/jobs/webhooks_manager_job'
+require 'shopify_app/jobs/scripttags_manager_job'
+
+# managers
+require 'shopify_app/managers/webhooks_manager'
+require 'shopify_app/managers/scripttags_manager'
+
+# session
+require 'shopify_app/session/session_storage'
+require 'shopify_app/session/session_repository'
+require 'shopify_app/session/in_memory_session_store'

data/package-lock.json

@@ -0,0 +1,23 @@
+{
+  "name": "shopify_app",
+  "version": "1.0.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {
+    "karma-mocha": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/karma-mocha/-/karma-mocha-1.3.0.tgz",
+      "integrity": "sha1-7qrH/8DiAetjxGdEDStpx883eL8=",
+      "dev": true,
+      "requires": {
+        "minimist": "1.2.0"
+      }
+    },
+    "minimist": {
+      "version": "1.2.0",
+      "resolved": "http://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
+      "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
+      "dev": true
+    }
+  }
+}

data/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "shopify_app",
+  "version": "8.4.2",
+  "repository": "git@github.com:Shopify/shopify_app.git",
+  "author": "Shopify",
+  "license": "MIT",
+  "dependencies": {},
+  "devDependencies": {
+    "babel-loader": "^8.0.2",
+    "babel-preset-shopify": "^16.5.0",
+    "chai": "^4.1.2",
+    "karma": "^3.0.0",
+    "karma-chai-sinon": "^0.1.5",
+    "karma-chrome-launcher": "^2.2.0",
+    "karma-cli": "^1.0.1",
+    "karma-mocha": "^1.3.0",
+    "karma-mocha-clean-reporter": "^0.0.1",
+    "karma-mocha-debug": "^0.1.2",
+    "karma-webpack": "^3.0.5",
+    "mocha-debug": "^0.0.1",
+    "sinon": "^6.3.4",
+    "sinon-chai": "^3.2.0",
+    "webpack": "^4.20.2"
+  },
+  "scripts": {
+    "test": "./node_modules/.bin/karma start --browsers ChromeHeadless --single-run"
+  }
+}

data/service.yml

@@ -0,0 +1,7 @@
+audience: partner
+classification: library
+org_line: App & Partner Platform
+owners:
+  - Shopify/app-partner-dev-tools-education
+slack_channels:
+  - dev-tools-education

data/shipit.rubygems.yml

@@ -1 +1,3 @@
 # using the default shipit config
+ hide:
+  - code-review/policial