shopify_app 20.1.0 → 20.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd02305de4da4e2ffd996e7404103f9aa007d0f96dc7a8677e64bb358c27cd5c
-  data.tar.gz: 5519b4ee6fbb5c38de4e7e7c93a815dfe0a2722bc5e5280b834db8845f5341d3
+  metadata.gz: 87362d48113e64119d57d3f458fc3334f8097a7a234b9a77e806b327baa55196
+  data.tar.gz: 07bd6f5051b5e77a6c360699fb6fa090e55e8d7674ba9814eadcf025a8566523
 SHA512:
-  metadata.gz: cc566b8087de98a2b75454611371bb2fe78d56e6e6fdf257f492fee8babe4fd96442309422be84fce66472e6780ce4cf59e9a20ee1343c73b322b5fff0c6683a
-  data.tar.gz: c760c3a573a3617adddcb0cb60b2517f8f27df2100781c172f88c7b8991bb728d4f2d03d0b86b3102b5342044580795bad02e3681bb4b7685de5fd640817e9c6
+  metadata.gz: 750c1ffd57c2922165af74710a27e243b4a32fb016b393e22c8f861428700c754ebacc98e9c6604c0937df0a2197ed164444b1fe0bc9bab28c84b4d2be5ff2d0
+  data.tar.gz: fc987464248ff4c0e88a91c9b5e8150659ef93f683a9912a3b1088e80fe50057bf6a821eb169a18d4e82e5a190d42abb82c10bcf6159a744831bdc07a7583a51

data/.github/workflows/stale.yml

@@ -0,0 +1,25 @@
+name: Close inactive issues
+on:
+  schedule:
+    - cron: "30 1 * * *"
+
+jobs:
+  close-issues:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/stale@v5
+        with:
+          days-before-issue-stale: 730
+          days-before-issue-close: 14
+          stale-issue-label: "stale"
+          stale-issue-message: >
+            This issue is stale because it has been open for 2 years. It will be closed if no further action occurs in 14 days. 
+          close-issue-message: >
+            This issue was closed because it has been inactive for 14 days since being marked as stale.
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          operations_per_run: 100

data/CHANGELOG.md

@@ -1,6 +1,13 @@
 Unreleased
 ----------
 
+20.1.1 (September 2, 2022)
+----------
+
+* Fixed an issue where the `embedded_redirect_url` could lead to a redirect loop in server-side rendered (or production) apps. [#1497](https://github.com/Shopify/shopify_app/pull/1497)
+* Fixes bug where webhooks were generated with addresses instead of the [path the Ruby API](https://github.com/Shopify/shopify-api-ruby/blob/7a08ae9d96a7a85abd0113dae4eb76398cba8c64/lib/shopify_api/webhooks/registrations/http.rb#L12) is expecting [#1474](https://github.com/Shopify/shopify_app/pull/1474). The breaking change that was accidentially already shipped was that `address` attribute for webhooks should be paths not addresses with `https://` and the host name. While the `address` attribute name will still work assuming the value is a path, this name is deprecated. Please configure webhooks with the `path` attribute name instead.
+* Deduce webhook path from deprecated webhook address if initializer uses address attribute. This makes this attribute change a non-breaking change for those upgrading.
+
 20.1.0 (August 22, 2022)
 ----------
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_app (20.1.0)
+    shopify_app (20.1.1)
       activeresource
       browser_sniffer (~> 2.0)
       jwt (>= 2.2.3)
@@ -97,14 +97,14 @@ GEM
     erubi (1.10.0)
     globalid (1.0.0)
       activesupport (>= 5.0)
-    hash_diff (1.0.0)
+    hash_diff (1.1.1)
     hashdiff (1.0.1)
     httparty (0.20.0)
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     i18n (1.10.0)
       concurrent-ruby (~> 1.0)
-    jwt (2.4.1)
+    jwt (2.5.0)
     loofah (2.15.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
@@ -204,7 +204,7 @@ GEM
       securerandom
       sorbet-runtime
       zeitwerk (~> 2.5)
-    sorbet-runtime (0.5.10354)
+    sorbet-runtime (0.5.10398)
     sprockets (4.1.1)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)

data/docs/shopify_app/webhooks.md

@@ -12,7 +12,7 @@ ShopifyApp can manage your app's webhooks for you if you set which webhooks you
 ```ruby
 ShopifyApp.configure do |config|
   config.webhooks = [
-    {topic: 'carts/update', address: 'https://example.com/webhooks/carts_update'}
+    {topic: 'carts/update', path: 'webhooks/carts_update'}
   ]
 end
 ```
@@ -34,7 +34,7 @@ If you are only interested in particular fields, you can optionally filter the d
 ```ruby
 ShopifyApp.configure do |config|
   config.webhooks = [
-    {topic: 'products/update', address: 'https://example.com/webhooks/products_update', fields: ['title', 'vendor']}
+    {topic: 'products/update', path: 'webhooks/products_update', fields: ['title', 'vendor']}
   ]
 end
 ```
@@ -66,7 +66,7 @@ The WebhooksManager uses ActiveJob. If ActiveJob is not configured then by defau
 ShopifyApp can create webhooks for you using the `add_webhook` generator. This will add the new webhook to your config and create the required job class for you.
 
 ```
-rails g shopify_app:add_webhook -t carts/update -a /webhooks/carts_update
+rails g shopify_app:add_webhook --topic carts/update --path webhooks/carts_update
 ```
 
-Where `-t` is the topic and `-a` is the address the webhook should be sent to.
+Where `--topic` is the topic and `--path` is the path the webhook should be sent to.

data/lib/generators/shopify_app/add_webhook/add_webhook_generator.rb

@@ -7,7 +7,7 @@ module ShopifyApp
     class AddWebhookGenerator < Rails::Generators::Base
       source_root File.expand_path("../templates", __FILE__)
       class_option :topic, type: :string, aliases: "-t", required: true
-      class_option :address, type: :string, aliases: "-a", required: true
+      class_option :path, type: :string, aliases: "-p", required: true
 
       hook_for :test_framework, as: :job, in: :rails do |instance, generator|
         instance.invoke(generator, [instance.send(:job_file_name)])
@@ -47,7 +47,7 @@ module ShopifyApp
       private
 
       def job_file_name
-        address.split("/").last
+        path.split("/").last
       end
 
       def load_initializer
@@ -55,15 +55,15 @@ module ShopifyApp
       end
 
       def webhook_config
-        "\n    { topic: \"#{topic}\", address: \"#{address}\" },"
+        "\n    { topic: \"#{topic}\", path: \"#{path}\" },"
       end
 
       def topic
         options["topic"]
       end
 
-      def address
-        options["address"]
+      def path
+        options["path"]
       end
     end
   end

data/lib/shopify_app/controller_concerns/login_protection.rb

@@ -117,7 +117,8 @@ module ShopifyApp
         else
           referer = URI(request.referer || "/")
           path = referer.path
-          query = "#{referer.query}&#{sanitized_params.to_query}"
+          query = Rack::Utils.parse_nested_query(referer.query)
+          query = query.merge(sanitized_params).to_query
         end
         session[:return_to] = query.blank? ? path.to_s : "#{path}?#{query}"
         redirect_to(login_url_with_optional_shop)

data/lib/shopify_app/controller_concerns/redirect_for_embedded.rb

@@ -15,7 +15,8 @@ module ShopifyApp
     end
 
     def redirect_for_embedded
-      redirect_to(redirect_uri_for_embedded)
+      # Don't actually redirect if we're already in the redirect route - we want the request to reach the FE
+      redirect_to(redirect_uri_for_embedded) unless request.path == ShopifyApp.configuration.embedded_redirect_url
     end
 
     def redirect_uri_for_embedded
@@ -26,7 +27,7 @@ module ShopifyApp
       redirect_query_params[:host] ||= params[:host] if params[:host].present?
       redirect_uri = "#{redirect_uri}?#{redirect_query_params.to_query}" if redirect_query_params.present?
 
-      query_params = sanitized_params.except(:redirect_uri, :embedded)
+      query_params = sanitized_params.except(:redirect_uri)
       query_params[:redirectUri] = redirect_uri
 
       "#{ShopifyApp.configuration.embedded_redirect_url}?#{query_params.to_query}"

data/lib/shopify_app/controller_concerns/sanitized_params.rb

@@ -25,9 +25,10 @@ module ShopifyApp
     end
 
     def sanitized_params
-      request.query_parameters.clone.tap do |query_params|
+      parameters = request.post? ? request.request_parameters : request.query_parameters
+      parameters.clone.tap do |params_copy|
         if params[:shop].is_a?(String)
-          query_params[:shop] = sanitize_shop_param(params)
+          params_copy[:shop] = sanitize_shop_param(params)
         end
       end
     end

data/lib/shopify_app/managers/webhooks_manager.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "uri"
+
 module ShopifyApp
   class WebhooksManager
     class CreationFailed < StandardError; end
@@ -38,11 +40,13 @@ module ShopifyApp
         return unless ShopifyApp.configuration.has_webhooks?
 
         ShopifyApp.configuration.webhooks.each do |attributes|
+          webhook_path = path(attributes)
+
           ShopifyAPI::Webhooks::Registry.add_registration(
             topic: attributes[:topic],
             delivery_method: attributes[:delivery_method] || :http,
-            path: attributes[:address],
-            handler: webhook_job_klass(attributes[:topic]),
+            path: webhook_path,
+            handler: webhook_job_klass(webhook_path),
             fields: attributes[:fields]
           )
         end
@@ -50,12 +54,29 @@ module ShopifyApp
 
       private
 
-      def webhook_job_klass(topic)
-        webhook_job_klass_name(topic).safe_constantize || raise(ShopifyApp::MissingWebhookJobError)
+      def path(webhook_attributes)
+        path = webhook_attributes[:path]
+        address = webhook_attributes[:address]
+        uri = URI(address) if address
+
+        if path.present?
+          path
+        elsif uri&.path&.present?
+          uri.path
+        else
+          raise ShopifyApp::MissingWebhookJobError, "The :path attribute is required for webhook registration."
+        end
       end
 
-      def webhook_job_klass_name(topic)
-        [ShopifyApp.configuration.webhook_jobs_namespace, "#{topic.gsub("/", "_")}_job"].compact.join("/").classify
+      def webhook_job_klass(path)
+        webhook_job_klass_name(path).safe_constantize || raise(ShopifyApp::MissingWebhookJobError)
+      end
+
+      def webhook_job_klass_name(path)
+        job_file_name = Pathname(path.to_s).basename
+
+        [ShopifyApp.configuration.webhook_jobs_namespace,
+         "#{job_file_name}_job",].compact.join("/").classify
       end
     end
   end

data/lib/shopify_app/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ShopifyApp
-  VERSION = "20.1.0"
+  VERSION = "20.1.1"
 end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify_app",
-  "version": "20.1.0",
+  "version": "20.1.1",
   "repository": "git@github.com:Shopify/shopify_app.git",
   "author": "Shopify",
   "license": "MIT",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 20.1.0
+  version: 20.1.1
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-22 00:00:00.000000000 Z
+date: 2022-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeresource
@@ -264,6 +264,7 @@ files:
 - ".github/workflows/cla.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/rubocop.yml"
+- ".github/workflows/stale.yml"
 - ".gitignore"
 - ".nvmrc"
 - ".rubocop.yml"