shopify_gdpr 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1105cbfcd70fd87f3796604ad5d5380b04ad7ed770300a87e2094c9074d2b1f1
-  data.tar.gz: 7105445df7270d58c8a9f38c7ee0e19557687147fb6fe6a5df9cfa204094ae8e
+  metadata.gz: e6b9a1a5211c629e13f183a3cd8150a09548b8b6db4a18369d26f5eeeb233e5b
+  data.tar.gz: 7291ca80e68b9971b8d3c6cffe27bbeac98883b9a0191162b8fbddce1367a585
 SHA512:
-  metadata.gz: '015994501f5fa6a83903451b07c32a05efeb02c15a6a7394c5c5485334eb5c283ed34070ab117a8d4d0e3b07738355556d7f8a299b34adeef4e9f14b38f0d502'
-  data.tar.gz: e7322904a4698730a3f8543f47a4553bdd2c550ebaaa7db67be13b7e201f9bcea46485245512384f6148120d268804c1fb6fb43afa248eea608f68c67a1e3456
+  metadata.gz: 6e3d7a4b6af6121a415ca227430ade432dc4bf7bfe73bdf925dc56759b31f9620e3e21a63416b5461d5dfae180dc0a9ad6811bd56ad6aa6aa99380a554c36ebd
+  data.tar.gz: 8967ce6d335cd92cb800ea782a9d463338d4afaee1bb5f90db9c75947e96c585e4cb966ff77cdcb36c118cd3062a39684501290dbced12dc01bdd021aa4120d0

data/Gemfile.lock

@@ -0,0 +1,20 @@
+PATH
+  remote: .
+  specs:
+    shopify_gdpr (0.1.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    rake (10.5.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bundler (~> 1.16)
+  rake (~> 10.0)
+  shopify_gdpr!
+
+BUNDLED WITH
+   1.16.2

data/README.md

@@ -19,6 +19,17 @@ Or install it yourself as:
 Generate the three required endpoints for Shopify's GDPR webhooks with `rails generate shopify_gdpr`
 NOTE: shop/redact assumes use of the Shop class generated by the ShopifyAPI / ShopifyApp engines.
 
+The three endpoints to direct webhooks at:
+`/shop_redact`
+`/customers_redact`
+`/customers_data_request`
+
+
+## Validation
+
+Add the ShopifyApp::WebhookVerification module with the `--validate` option when running the generator.
+This module assumes that your app has its secret API key saved to ShopifyApp.config.secret
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/generators/shopify_gdpr/shopify_gdpr_generator.rb

@@ -5,6 +5,7 @@ module ShopifyGdpr
     # generates basic GDPR endpoints
     class ShopifyGdprGenerator < Rails::Generators::Base
       source_root File.expand_path('../templates', __FILE__)
+      class_option :validate, type: :boolean, default: false
       def create_endpoints
         create_file 'app/controllers/shopify_gdpr_controller.rb', 
     "class ShopifyGdprController < ActionController::Base
@@ -37,6 +38,14 @@ module ShopifyGdpr
     end
     end"
         create_routes
+        if options.validate?
+          add_validator
+          inject_into_file 'app/controllers/shopify_gdpr_controller.rb', after: "class ShopifyGdprController < ActionController::Base\n" do 
+        <<-'RUBY'
+  include ShopifyApp::WebhookVerification
+        RUBY
+          end
+        end
       end
 
       private
@@ -46,6 +55,44 @@ module ShopifyGdpr
         route "post 'customers_redact', to: 'shopify_gdpr#customers_redact'"
         route "post 'customers_data_request', to: 'shopify_gdpr#customers_data_request'"
       end
+
+      def add_validator
+        create_file 'lib/webhook_verification.rb', "module ShopifyApp
+        module WebhookVerification
+          extend ActiveSupport::Concern
+      
+          included do
+            skip_before_action :verify_authenticity_token, raise: false
+            before_action :verify_request
+          end
+      
+          private
+      
+          def verify_request
+            data = request.raw_post
+            return head :unauthorized unless hmac_valid?(data)
+          end
+      
+          def hmac_valid?(data)
+            secret = ShopifyApp.configuration.secret
+            digest = OpenSSL::Digest.new('sha256')
+            ActiveSupport::SecurityUtils.secure_compare(
+              shopify_hmac,
+              Base64.encode64(OpenSSL::HMAC.digest(digest, secret, data)).strip
+            )
+          end
+      
+          def shop_domain
+            request.headers['HTTP_X_SHOPIFY_SHOP_DOMAIN']
+          end
+      
+          def shopify_hmac
+            request.headers['HTTP_X_SHOPIFY_HMAC_SHA256']
+          end
+        end
+      end
+        "
+      end
     end
   end
 end

data/lib/shopify_gdpr/version.rb

@@ -1,3 +1,3 @@
 module ShopifyGdpr
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_gdpr
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - James Dunn
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-08-27 00:00:00.000000000 Z
+date: 2018-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -47,6 +47,7 @@ extra_rdoc_files: []
 files:
 - ".gitignore"
 - Gemfile
+- Gemfile.lock
 - LICENSE.txt
 - README.md
 - Rakefile
@@ -55,6 +56,7 @@ files:
 - lib/generators/shopify_gdpr/shopify_gdpr_generator.rb
 - lib/shopify_gdpr.rb
 - lib/shopify_gdpr/version.rb
+- shopify_gdpr-0.1.0.gem
 - shopify_gdpr.gemspec
 homepage: https://github.com/jdgc/shopify_gdpr
 licenses: