sinatra-embedded-shopify-app 0.5.16

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: c3adeba52cb9e2c6ede28614ce28aa48d7e4e5330d19299cfb72ccc0067d78df
+  data.tar.gz: 043165fe618b08beaae62b71f6a0b28e36ef9ad65dbc93b8fd8679abd38d70af
+SHA512:
+  metadata.gz: cf596cd12e016ca257adc07c0d81bbf39c4805f6c96bc618c60f0e1cc849ff81bbf9a027e7be0dd9b362a7cdfd38198afed267842503ea2914ce50f12f10b7f2
+  data.tar.gz: 80e85b3232a169a495d82bf5f535c444b87164cc8e783b6a99d03d4db8aacc67d6e6ccfda89a9b26821509887c0f3ae002ec78369be36a4ee3d34b148d67f351

data/.circleci/config.yml

@@ -0,0 +1,15 @@
+version: 2.1
+orbs:
+  ruby: circleci/ruby@2.0.0
+
+jobs:
+  build:
+    docker:
+      - image: cimg/ruby:2.7.7
+    executor: ruby/default
+    steps:
+      - checkout
+      - ruby/install-deps
+      - run:
+          name: Tests
+          command: ./bin/ci.sh

data/.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+- package-ecosystem: bundler
+  directory: "/"
+  schedule:
+    interval: daily
+    time: "09:00"
+    timezone: America/Toronto
+  open-pull-requests-limit: 3
+  ignore:
+  - dependency-name: omniauth
+    versions:
+    - 2.0.2
+    - 2.0.3

data/.gitignore

@@ -0,0 +1,2 @@
+*.gem
+*.sqlite3

data/.ruby-version

@@ -0,0 +1 @@
+2.7.7

data/CHANGELOG

@@ -0,0 +1,96 @@
+1.1.1
+-----
+* fix how the CSP is set
+
+1.1.0
+-----
+* update to Shopify App Bridge 3
+
+1.0.1
+-----
+* drop sinatra version requirement from gemspec
+
+1.0.0
+-----
+* Update to omniauth 2.0.4 and add rack protection authenticity token
+  * All forms will need an authenticity_token param added like in the login view
+  * Refactored the provided routes to be simpler. Now only login and logout (no more install)
+  * shopify_webhook now defines the route because it needs to also configure ignoring csrf for the route
+  * refactored other internal methods to simplify and reduce surface area
+* Removed heroku rake tasks. They are out of date and don't encourage best practises
+
+0.12.0
+------
+* Update to use the Shopify AppBridge instead of the ESDK
+  * This change is mostly to generated files so you'll need to apply those updates
+    to your own versions.
+* shop_origin no longer includes protocol
+* return_to re-worked to function with the AppBridge
+
+0.11.0
+------
+* remove rack-flash3 use sinatra-flash instead
+* remove a duplicate config of sessions that was breaking the same_site fix
+* remove a runtime dependency that didn't end up being used for the same_site fix but was added anyways
+* update ruby and rake versions
+
+0.10.0
+------
+* Add the api_version to settings and update to 2019-07
+
+0.9.0
+-----
+* set secure and and same_site options on the session cookie. Fixes auth with the upcoming chrome 80 release
+
+0.8.0
+-----
+* Shopify updated the way sessions are created: https://github.com/Shopify/shopify_api/blob/master/README.md#-breaking-change-notice-for-version-700-, updating code to reflect these changes.
+
+0.7.0
+-----
+* make base_url private (users can add back in their app easily if needed)
+* store request params in the session so they can be retrieved after the omniauth flow. This fixes app actions from the admin if the user's session has expired
+* refactored some smaller methods to make the shopify_session method easier on the eyes.
+
+0.6.0
+-----
+* remove current_shop* methods in favor of yielding shop_name to the block methods
+
+0.5.0
+-----
+* replace webhook_session and webhook_job with shopify_webhook
+* remove redis and resque as dependencies
+
+0.4.0
+-----
+* update to sinatra 2.0.1
+* update to attr_encrypted 3.1.0
+* remove SHOPIFY_REDIRECT_URI param
+
+0.3.4
+-----
+* rename lib to src in the example/template
+
+0.3.3
+-----
+* fix a bug in the generator
+
+0.3.2
+-----
+* remove an extra `%` from the redirect view
+
+0.3.1
+-----
+* update authentication code for upcoming chrome changes.
+
+0.3.0
+-----
+* Remove sinatra-twitter-bootstrap dependency. Include css from cdn directly for example app.
+
+0.2.0
+-----
+* added a SHOPIFY_REDIRECT_URI env param for setting the redirect_uri (was breifly HOSTNAME)
+* add versions to gemfile
+* refactored the generator
+* Changed install method to after_shopify_auth. Implementations of this method must now be idempotent as this will be called anytime the app is auth'd which may be due to just a lost session and not necessarily an install.
+* Always redo the full auth rather than trying to keep track of first time install state vs re-auth

data/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gemspec

data/Gemfile.lock

@@ -0,0 +1,118 @@
+PATH
+  remote: .
+  specs:
+    sinatra-embedded-shopify-app (0.5.16)
+      activesupport
+      omniauth (>= 2.0.4)
+      omniauth-shopify-oauth2 (>= 2.3.2)
+      shopify_api (= 9.5.1)
+      sinatra (>= 2.2, < 3.1)
+      sinatra-activerecord (~> 2.0.9)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activemodel (7.0.4.3)
+      activesupport (= 7.0.4.3)
+    activemodel-serializers-xml (1.0.2)
+      activemodel (> 5.x)
+      activesupport (> 5.x)
+      builder (~> 3.1)
+    activerecord (7.0.4.3)
+      activemodel (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
+    activeresource (6.0.0)
+      activemodel (>= 6.0)
+      activemodel-serializers-xml (~> 1.0)
+      activesupport (>= 6.0)
+    activesupport (7.0.4.3)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+    builder (3.2.4)
+    concurrent-ruby (1.2.2)
+    fakeweb (1.3.0)
+    faraday (2.7.4)
+      faraday-net_http (>= 2.0, < 3.1)
+      ruby2_keywords (>= 0.0.4)
+    faraday-net_http (3.0.2)
+    graphql (2.0.21)
+    graphql-client (0.18.0)
+      activesupport (>= 3.0)
+      graphql
+    hashie (5.0.0)
+    i18n (1.13.0)
+      concurrent-ruby (~> 1.0)
+    jwt (2.7.0)
+    mini_portile2 (2.8.2)
+    minitest (5.16.3)
+    mocha (2.0.2)
+      ruby2_keywords (>= 0.0.5)
+    multi_xml (0.6.0)
+    mustermann (3.0.0)
+      ruby2_keywords (~> 0.0.1)
+    oauth2 (2.0.9)
+      faraday (>= 0.17.3, < 3.0)
+      jwt (>= 1.0, < 3.0)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 4)
+      snaky_hash (~> 2.0)
+      version_gem (~> 1.1)
+    omniauth (2.1.1)
+      hashie (>= 3.4.6)
+      rack (>= 2.2.3)
+      rack-protection
+    omniauth-oauth2 (1.8.0)
+      oauth2 (>= 1.4, < 3)
+      omniauth (~> 2.0)
+    omniauth-shopify-oauth2 (2.3.2)
+      activesupport
+      omniauth-oauth2 (~> 1.5)
+    rack (2.2.6.4)
+    rack-protection (3.0.6)
+      rack
+    rack-test (2.0.2)
+      rack (>= 1.3)
+    rake (13.0.6)
+    ruby2_keywords (0.0.5)
+    shopify_api (9.5.1)
+      activeresource (>= 4.1.0)
+      graphql-client
+      rack
+    sinatra (3.0.6)
+      mustermann (~> 3.0)
+      rack (~> 2.2, >= 2.2.4)
+      rack-protection (= 3.0.6)
+      tilt (~> 2.0)
+    sinatra-activerecord (2.0.26)
+      activerecord (>= 4.1)
+      sinatra (>= 1.0)
+    snaky_hash (2.0.1)
+      hashie
+      version_gem (~> 1.1, >= 1.1.1)
+    sqlite3 (1.6.2)
+      mini_portile2 (~> 2.8.0)
+    sqlite3 (1.6.2-arm64-darwin)
+    sqlite3 (1.6.2-x86_64-linux)
+    tilt (2.1.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    version_gem (1.1.2)
+
+PLATFORMS
+  arm64-darwin-21
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  fakeweb
+  minitest
+  mocha
+  rack-test
+  rake (>= 12.3.3)
+  sinatra-embedded-shopify-app!
+  sqlite3
+
+BUNDLED WITH
+   2.4.12

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2014 Kevin Hughes
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,172 @@
+sinatra-embedded-shopify-app [![CircleCI](https://dl.circleci.com/status-badge/img/gh/kevinhughes27/sinatra-embedded-shopify-app/tree/master.svg?style=svg)](https://dl.circleci.com/status-badge/redirect/gh/kevinhughes27/sinatra-embedded-shopify-app/tree/master)
+===================
+
+"A classy shopify app"
+
+sinatra-embedded-shopify-app is lightweight extension for building Shopify apps using Sinatra. It comes with the Shopify API gem for interacting with the Shopify API and uses the Shopify omniauth gem to handle authentication via Oauth (other auth methods are not supported). The framework itself provides a handful of helper methods to make creating your app as easy as possible. The framework was designed with deployment to Heroku in mind and following the instructions below I've been able to create a new application from scratch, deploy it to Heroku and install on my live test shop in less than 5 minutes.
+
+
+Getting Started
+---------------
+
+Install the gem:
+
+```
+gem install sinatra-embedded-shopify-app
+```
+
+or build from source
+
+```
+gem build sinatra-embedded-shopify-app.gemspec
+gem install sinatra-embedded-shopify-app-X.X.X.gem
+```
+
+To create a new app use the generator:
+
+```
+sinatra-embedded-shopify-app-generator new <your new app name>
+```
+
+This will create a new skeleton sinatra-embedded-shopify-app. The generator will create several default files for you rather than having them bundled in the sinatra extension - its worthwhile to read this section to understand what each of these files is for.
+
+`config/database.yml` --> The database config for active record. Initially this is setup to use sqlite3 for development and testing which you may want to change to mimic your production database.
+
+`.gitignore` --> tells git which files to ignore, namely `.env` you may find more things you want to add to this file.
+
+`.env` --> a hidden file not tracked by source control for storing credentials etc. to be set as environment variables
+
+`config.ru` --> Rackup file - describes how to run a rack based app
+
+`Gemfile` --> manages the dependencies of the app
+
+`src/app.rb` --> This file is the skeleton app file. More details on how to use the methods provided by this extension are given in the following section. There are more comments inside this file explaining the skeleton app.
+
+`Procfile` --> Specific for deploying to Heroku, this file tells heroku how to run the app
+
+`public/icon.png` --> This icon file is used by the Shopify Embedded App SKD and is shown in the menu bar of your embedded app
+
+`Rakefile` --> includes some helper methods etc for running and managing the app. Standard for ruby based projects
+
+`views/layouts/appliction.erb` --> This is the layout file that all templates will use unless otherwise specified. It sets up some defaults for using the Shopify Embedded App SDK and Twitter Bootstrap for styling
+
+`views/_top_bar.erb` --> This is a partial view that describes the top bar inside a Shopify Embedded App. It also has some code to *forward* flash messages to the Embedded App SKD
+
+`views/*` --> The other views used by the app. You'll probably make a lot of changes to home.erb and install.erb to customize the experience for your app
+
+`test/*` --> Test files, fixtures and helpers for testing your app.
+
+### Setting the app to use your Shopify API credentials
+
+You'll need to create a Shopify Partner Account and a new application. You can make an account [here](http://www.shopify.ca/partners) and see this [tutorial](http://docs.shopify.com/api/the-basics/getting-started) for creating a new application. The requires 2 redirects configured:
+
+  * the default redirect_uri from omniauth `<your domain>/auth/shopify/callback`
+  * and `<your domain>/login`
+
+Note - The sinatra-embedded-shopify-app creates an embedded app! You need change the embedded setting to `enabled` in the [Shopify Partner area](https://app.shopify.com/services/partners/api_clients) for your app. If you don't want your app to be embedded then remove the related code in `layout/application.erb` and delete the `layout/_top_bar.erb` file and the references to it in the other views.
+
+After creating your new application you need to edit the `.env` file and add the following lines:
+
+```
+SHOPIFY_API_KEY=<your api key>
+SHOPIFY_SHARED_SECRET=<your shared secret>
+SECRET=<generate a random string to encrypt credentials with>
+```
+
+If your app has any other secret credentials you should add them to this file.
+
+
+Shopify::Methods
+----------------
+
+**shopify_session** - The main method of the framework, most of your routes will use this method to acquire a valid shopify session and then perform api calls to Shopfiy. The method activates a Shopify API session for you and accepts a block inside of which you can use the ShopifyAPI. Here is an example endpoint that displays products:
+
+```ruby
+get '/products.json' do
+  shopify_session do |shop_name|
+    products = ShopifyAPI::Product.all(limit: 5)
+    products.to_json
+  end
+end
+```
+
+**shopify_webhook** - This method defines a `post` endpoint that receives a webhook from Shopify. Webhooks are a great way to keep your app in sync with a shop's data without polling. You can read more about webhooks [here](http://docs.shopify.com/api/tutorials/using-webhooks). This method also takes a block and yields the `shop_name` and `webhook_body` as a hash (note only works for json webhooks, don't use xml). Here is an example that listens to an order creation webhook:
+
+```ruby
+shopify_webhook('/order.json') do |shop_name, webhook_data|
+  # do something with the data
+end
+```
+
+Note this method does not active a Shopify session by default but the current_shop* methods still work. It is not advised but if you want to handle the webhook in a web request you will need to activate the ShopifyAPI session manually:
+
+```ruby
+shop = Shop.find_by(shopify_domain: current_shop_name)
+api_session = ShopifyAPI::Session.new(shop.shopify_domain, shop.shopify_token)
+ShopifyAPI::Base.activate_session(api_session)
+```
+
+It's impossible to control the flow of webhooks to your app from Shopify especially if a larger store installs your app or if a shop has a flash sale. To prevent your app from getting overloaded with webhook requests it is best practise to process webhooks in a background queue and return a `200` to Shopify immediately. Ruby has several good background job frameworks that work with Sinatra including [Sidekiq](https://github.com/mperham/sidekiq) and [Resque](https://github.com/resque/resque).
+
+**after_shopify_auth** - This is a private method provided with the framework that gets called whenever the app is authorized. You should fill this method in with anything you need to initialize, for example webhooks and services on Shopify or any other database models you have created specific to a shop. Note that this method will be called anytime the auth flow is completed so this method should be idempotent (running it twice has the same effect as running it once).
+
+sinatra-embedded-shopify-app includes sinatra/activerecord for creating models that can be persisted in the database. You might want to read more about sinatra/activerecord and the methods it makes available to you: [https://github.com/janko-m/sinatra-activerecord](https://github.com/janko-m/sinatra-activerecord)
+
+sinatra-embedded-shopify-app also includes `sinatra-flash` and the flash messages are forwarded to the Shopify Embedded App SDK (see the code in `views/layouts/application.erb`). Flash messages are useful for signalling to your users that a request was successful without changing the page. The following is an example of how to use a flash message in a route:
+
+```ruby
+post '/flash_message' do
+  flash[:notice] = "Flash Message!"
+  redirect '/'
+end
+```
+
+note - a flash must be followed by a redirect or it won't work!
+
+
+Developing
+----------
+The embedded app sdk won't load non https content so you'll need to use a real domain or a forwarding service like [ngrok](https://ngrok.com/). Set your application url in the [Shopify Partner area](https://app.shopify.com/services/partners/api_clients) to your forwarded url and set the redirect_uri to your forwarded url + `/auth/shopify/callback` which will allow you to install your app on a live shop while running it locally.
+
+To run the app locally we use [overmind](https://github.com/DarthSim/overmind) a tool for running multiple process and setting our credentials as environment variables. To run the application run:
+
+```
+overmind start
+```
+
+To connect to a single process to use a debugger/break point use `overmind connect <process>`
+
+To debug your app add `require 'byebug'` at the top and then add `byebug` to your code where you would like to drop into an interactive session. You may also want to try out [Pry](http://pryrepl.org/).
+
+If you are testing webhooks locally make sure they also go through the forwarded url and not `localhost`.
+
+
+Testing
+-------
+
+Some basic tests are included in the generated app. To run them simply run:
+
+```
+bundle exec rake test:prepare
+bundle exec rake test
+```
+
+`test:prepare` will initialize your testing database using the `seeds.rb` file. If you have added additional models you can add them here.
+
+Checkout the contents of the `app_test.rb` file and the `test_helper.rb` and modify them as you add functionality to your app. You can also check the tests of other apps using this framework to see more about how to write tests for your own app.
+
+
+Apps using this framework
+-------------------------
+
+* [shopify-fulfillment-integration](https://github.com/Shopify/shopify-fulfillment-integration)
+* [shopify-tax-receipts](https://github.com/pickle27/shopify-tax-receipts)
+* Add yours!
+
+
+Contributing
+------------
+
+PRs welcome!
+
+Note - this framework does have tests! They are the same tests that get generated for new apps by the generator. You can run them with `./test.sh`

data/bin/ci.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+set -e
+
+cd example
+
+bundle install
+bundle exec rake db:migrate
+bundle exec rake test:prepare
+bundle exec rake test

data/bin/sinatra-embedded-shopify-app-generator

@@ -0,0 +1,85 @@
+#!/usr/bin/env ruby
+
+require 'fileutils'
+
+# Generator
+class Generator
+  attr_reader :spec, :app_dir, :example_dir
+
+  def initialize(app_name)
+    @spec = Gem::Specification.find_by_name('sinatra-embedded-shopify-app')
+    gem_root = spec.gem_dir
+    @example_dir = "#{gem_root}/example"
+
+    working_dir = Dir.pwd
+    @app_dir = "#{working_dir}/#{app_name}"
+
+    log "Generating new app: #{app_name}"
+    log "fullpath: #{app_dir}"
+  end
+
+  def run
+    if Dir.exist? app_dir
+      log 'App directory alread exists, pick a new app name or delete the existing folder'
+      return
+    end
+
+    copy_example_app
+    create_dot_env
+    sub_latest_version
+    bundle_install
+    migrate_database
+  end
+
+  private
+
+  def copy_example_app
+    FileUtils.cp_r(example_dir, app_dir)
+  end
+
+  def create_dot_env
+    FileUtils.touch("#{app_dir}/.env")
+    file = File.open("#{app_dir}/.env", 'w')
+    file.write("SHOPIFY_API_KEY=your_api_key\n")
+    file.write("SHOPIFY_SHARED_SECRET=your_shared_secret\n")
+    file.write("SECRET=random_string_to_encrypt_credentials_with\n")
+    file.close
+  end
+
+  def sub_latest_version
+    file_name = "#{app_dir}/Gemfile"
+    text = File.read(file_name)
+    new_contents = text.gsub("gem 'sinatra-embedded-shopify-app', path: '../'",
+                             "gem 'sinatra-embedded-shopify-app', '~> #{spec.version}'")
+    File.open(file_name, 'w') { |file| file.puts new_contents }
+  end
+
+  def bundle_install
+    Dir.chdir(app_dir)
+
+    pipe = IO.popen('bundle install')
+    while (line = pipe.gets)
+      print line
+    end
+  end
+
+  def migrate_database
+    Dir.chdir(app_dir)
+
+    pipe = IO.popen('bundle exec rake db:migrate')
+    while (line = pipe.gets)
+      print line
+    end
+  end
+
+  def log(msg)
+    puts msg
+  end
+end
+
+if ARGV.length < 2
+  puts "Usage:\nsinatra-embedded-shopify-app-generator new <app_name>"
+else
+  app_name = ARGV[1]
+  Generator.new(app_name).run
+end

data/example/.gitignore

@@ -0,0 +1,3 @@
+.env
+*.sqlite3
+.byebug_history

data/example/.ruby-version

@@ -0,0 +1 @@
+2.7.7

data/example/Gemfile

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+ruby '2.7.7'
+
+gem 'sinatra-activerecord'
+gem 'sinatra-embedded-shopify-app', path: '../'
+gem 'sinatra-flash'
+
+group :production do
+  gem 'pg'
+end
+
+group :development, :test do
+  gem 'byebug'
+  gem 'sqlite3'
+end
+
+group :development do
+  gem 'rake', '>= 12.3.3'
+end
+
+group :test do
+  gem 'fakeweb'
+  gem 'minitest'
+  gem 'mocha', require: false
+  gem 'rack-test'
+end