shopify_app 8.0.0 → 8.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3c17b0036bfc249437b86de35f0ad6a42bae8a74
-  data.tar.gz: 4c1840a61918df21033a9492662a5b48810aa4fc
+  metadata.gz: 4542a5b3f58a2e7a539c6de59632620df01c36f8
+  data.tar.gz: '022092d414e237445b38a68476b03331362753c5'
 SHA512:
-  metadata.gz: e9e9c0e4930528ab48b9ea7dfbb3d4722a650dbd97bc97c4e254115398026c462ca25a660aa91a85654a37bde1ecf1195744cb31c8da7facc748f9985bb46b34
-  data.tar.gz: bb0726fb075b047ceb02b8a7b10cd04e3b2c925ea7e5efcf14df1465d347b6edc164599ceb894af52aae50cf6ff0cb7448fac7e175e1b8332ffcb22706f4e03e
+  metadata.gz: c63e25613286a63914472aba0e791502e683fb2a4b32715f8f69426c4edf48e6b63efe07880d91a33437ea0ae3fec96acd3cff4e9b2ec113a3e064532280dee0
+  data.tar.gz: 9164dbf445acb30e6937cadea35bb2e4fa63a144cca5d97da8c4708e49b6122e5ccf850f400cd3963ed2c9aed0934b72fb68ba26aab841e17de65af0b8435458

data/CHANGELOG.md

@@ -1,8 +1,13 @@
+8.1.0
+-----
+* Add support for per_user_authentication
+* Pass the shop param in the session for authentication instead of a url param (prevents csrf)
+
 8.0.0
 -----
 * Removed the `shopify_session_repository` initializer. The SessionRepository is now configured through the main ShopifyApp configuration object and the generated initializer
 * Moved InMemorySessionStore into the ShopifyApp namespace
-* Remove ShopifySession concern. This module made the code internal to this engine harder to follow and we want do discourage over-writing the auth code now that we have generic hooks for all extra tasks during install.
+* Remove ShopifySession concern. This module made the code internal to this engine harder to follow and we want to discourage over-writing the auth code now that we have generic hooks for all extra tasks during install.
 * Changed engine controllers to subclass ActionController::Base to avoid any possible conflict with the parent application
 * Removed the `ShopifyApp::Shop` concern and added its methods to `ShopifyApp::SessionStorage`. To update for this change just remove this concern anywhere it is being used in your application.
 * Add `ShopifyApp::EmbeddedApp` controller concern which handles setting the required headers for the ESDK. Previously this was done by injecting configuration into applicaton.rb which affects the entire app.

data/README.md

@@ -207,6 +207,22 @@ provider :shopify,
   callback_path: '/nested/auth/shopify/callback'
 ```
 
+Per User Authentication
+-----------------------
+To enable per user authentication you need to update the `omniauth.rb` initializer:
+
+```ruby
+provider :shopify,
+  ShopifyApp.configuration.api_key,
+  ShopifyApp.configuration.secret,
+  scope: ShopifyApp.configuration.scope,
+  per_user_permissions: true
+```
+
+The current Shopify user will be stored in the rails session at `session[:shopify_user]`
+
+This will change the type of token that Shopify returns and it will only be valid for a short time. Read more about `Online access` [here](https://help.shopify.com/api/getting-started/authentication/oauth). Note that this means you won't be able to use this token to respond to Webhooks.
+
 Managing Api Keys
 -----------------
 

data/app/controllers/shopify_app/sessions_controller.rb

@@ -26,8 +26,7 @@ module ShopifyApp
     end
 
     def destroy
-      session[:shopify] = nil
-      session[:shopify_domain] = nil
+      reset_session
       flash[:notice] = I18n.t('.logged_out')
       redirect_to login_url
     end
@@ -36,7 +35,8 @@ module ShopifyApp
 
     def authenticate
       if sanitized_shop_name.present?
-        fullpage_redirect_to "#{main_app.root_path}auth/shopify?shop=#{sanitized_shop_name}"
+        session['shopify.omniauth_params'] = { shop: sanitized_shop_name }
+        fullpage_redirect_to "#{main_app.root_path}auth/shopify"
       else
         redirect_to return_address
       end
@@ -44,8 +44,13 @@ module ShopifyApp
 
     def login_shop
       sess = ShopifyAPI::Session.new(shop_name, token)
+
+      request.session_options[:renew] = true
+      session.delete(:_csrf_token)
+
       session[:shopify] = ShopifyApp::SessionRepository.store(sess)
       session[:shopify_domain] = shop_name
+      session[:shopify_user] = associated_user if associated_user.present?
     end
 
     def auth_hash
@@ -56,6 +61,11 @@ module ShopifyApp
       auth_hash.uid
     end
 
+    def associated_user
+      return unless auth_hash['extra'].present?
+      auth_hash['extra']['associated_user']
+    end
+
     def token
       auth_hash['credentials']['token']
     end

data/lib/generators/shopify_app/install/templates/shopify_provider.rb

@@ -1,4 +1,16 @@
   provider :shopify,
            ShopifyApp.configuration.api_key,
            ShopifyApp.configuration.secret,
-           scope: ShopifyApp.configuration.scope
+           scope: ShopifyApp.configuration.scope,
+           setup: lambda { |env|
+             strategy = env['omniauth.strategy']
+
+             shopify_auth_params = strategy.session['shopify.omniauth_params']&.with_indifferent_access
+             shop = if shopify_auth_params.present?
+               "https://#{shopify_auth_params[:shop]}"
+             else
+               ''
+             end
+
+             strategy.options[:client_options][:site] = shop
+           }

data/lib/shopify_app/version.rb

@@ -1,3 +1,3 @@
 module ShopifyApp
-  VERSION = '8.0.0'
+  VERSION = '8.1.0'
 end

data/shopify_app.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.required_ruby_version = ">= 2.2.2"
 
   s.add_runtime_dependency('rails', '>= 5.0.0')
-  s.add_runtime_dependency('shopify_api', '>= 4.3.2')
+  s.add_runtime_dependency('shopify_api', '>= 4.3.5')
   s.add_runtime_dependency('omniauth-shopify-oauth2', '~> 1.2.0')
 
   s.add_development_dependency('rake')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 8.0.0
+  version: 8.1.0
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-08-14 00:00:00.000000000 Z
+date: 2017-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.3.2
+        version: 4.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.3.2
+        version: 4.3.5
 - !ruby/object:Gem::Dependency
   name: omniauth-shopify-oauth2
   requirement: !ruby/object:Gem::Requirement