@agnostack/next-shopify 1.13.4-beta.4 → 1.13.4-beta.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,17 @@
|
|
|
1
|
+
## [1.13.4-beta.6](https://github.com/agnostack/next-shopify/compare/v1.13.4-beta.5...v1.13.4-beta.6) (2023-11-27)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Bug Fixes
|
|
5
|
+
|
|
6
|
+
* wip ([fe4c28e](https://github.com/agnostack/next-shopify/commit/fe4c28ecd3d8dc52da7543974998df0cf474e9e6))
|
|
7
|
+
|
|
8
|
+
## [1.13.4-beta.5](https://github.com/agnostack/next-shopify/compare/v1.13.4-beta.4...v1.13.4-beta.5) (2023-11-27)
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
### Bug Fixes
|
|
12
|
+
|
|
13
|
+
* wip ([26e0379](https://github.com/agnostack/next-shopify/commit/26e0379e0a8c3934ae42a3ea28770eac2239dfd6))
|
|
14
|
+
|
|
1
15
|
## [1.13.4-beta.4](https://github.com/agnostack/next-shopify/compare/v1.13.4-beta.3...v1.13.4-beta.4) (2023-11-27)
|
|
2
16
|
|
|
3
17
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/lib/handlers/api/token.js"],"names":[],"mappings":"AAgBO,
|
|
1
|
+
{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/lib/handlers/api/token.js"],"names":[],"mappings":"AAgBO,qHA8JN"}
|
|
@@ -21,25 +21,45 @@ const handleSessionToken = (serverRuntimeConfig, signingData) => {
|
|
|
21
21
|
// TODO: pass along providerSetId??
|
|
22
22
|
'x-shop-domain': shopDomain, 'x-shopify-shop-domain': shopifyShopDomain, 'x-shopify-shop': shop = shopifyShopDomain !== null && shopifyShopDomain !== void 0 ? shopifyShopDomain : shopDomain } = _d, headers = tslib_1.__rest(_d, ["authorization", 'x-public-key', 'x-emphemeral-key', 'x-authorization-timestamp', 'x-shopify-app-installation-id', 'x-shopify-app-id', 'x-app-installation-id', 'x-app-id', 'x-key-id', 'x-shop-domain', 'x-shopify-shop-domain', 'x-shopify-shop']);
|
|
23
23
|
console.log(`>>> > handleSessionToken > req.headers:`, req.headers);
|
|
24
|
+
let body;
|
|
25
|
+
let token;
|
|
26
|
+
try {
|
|
27
|
+
// NOTE raw request body is required for validation
|
|
28
|
+
const _rawBody = yield (0, raw_body_1.default)(req);
|
|
29
|
+
const rawBody = _rawBody.toString();
|
|
30
|
+
body = JSON.parse(rawBody || '{}');
|
|
31
|
+
}
|
|
32
|
+
catch (error) {
|
|
33
|
+
console.error('Error generating session token', error);
|
|
34
|
+
return res.status(500).json({ message: 'Error generating session token' });
|
|
35
|
+
}
|
|
24
36
|
if (authorization) {
|
|
25
37
|
console.log(`>>> > next-shopify.handleSessionToken > authorization:`, authorization);
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
if (
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
38
|
+
const [authProtocol, authSignature] = (0, shared_1.ensureString)(authorization).split(' ');
|
|
39
|
+
console.log(`>>> > next-shopify.handleSessionToken > authProtocol, authSignature:`, { authProtocol, authSignature });
|
|
40
|
+
console.log(`>>> > next-shopify.handleSessionToken > keyPairs?.shared.publicKey:`, (_c = keyPairs === null || keyPairs === void 0 ? void 0 : keyPairs.shared) === null || _c === void 0 ? void 0 : _c.publicKey);
|
|
41
|
+
// TEMP!!! remove this outer if check once fully implemented
|
|
42
|
+
if (apiKey && emphemeralPublicKey && (keyPairs === null || keyPairs === void 0 ? void 0 : keyPairs.shared) && authTimestamp && authSignature && (authProtocol === 'HMAC-SHA256')) {
|
|
43
|
+
if (!apiKey || !emphemeralPublicKey || !(keyPairs === null || keyPairs === void 0 ? void 0 : keyPairs.shared) || !authTimestamp || !authSignature || (authProtocol !== 'HMAC-SHA256')) {
|
|
44
|
+
return res.status(401).json({ message: 'Invalid or missing authorization' });
|
|
45
|
+
}
|
|
46
|
+
console.log(`>>> > next-shopify.handleSessionToken > body:`, body);
|
|
47
|
+
const { derivedHMACKey } = yield shared_1.subtle.getVerificationKeys({
|
|
48
|
+
publicKey: emphemeralPublicKey,
|
|
49
|
+
privateKey: keyPairs.shared.privateKey,
|
|
50
|
+
});
|
|
51
|
+
console.log(`>>> > next-shopify.handleSessionToken > derivedHMACKey:`, derivedHMACKey);
|
|
52
|
+
const isValid = yield shared_1.subtle.verifyHMAC((0, shared_1.objectToSortedString)(Object.assign({ url: req.url, timestamp: authTimestamp }, body)), derivedHMACKey, authSignature);
|
|
53
|
+
console.log(`>>> > return > isValid:`, { isValid });
|
|
54
|
+
if (!isValid) {
|
|
55
|
+
return res.status(412).json({ message: 'Invalid or missing verification' });
|
|
56
|
+
}
|
|
41
57
|
}
|
|
42
58
|
}
|
|
59
|
+
// TODO: un-btoa the host and check??
|
|
60
|
+
if ((0, shared_1.stringEmpty)(shop) || (0, shared_1.stringEmpty)(host)) {
|
|
61
|
+
return res.status(412).json({ message: 'Missing required param' });
|
|
62
|
+
}
|
|
43
63
|
// NOTE/TODO: these need to move to app metafields instead
|
|
44
64
|
let signingSecret;
|
|
45
65
|
if (keyId && (keyPairs === null || keyPairs === void 0 ? void 0 : keyPairs.messenger) && (keyId == keyPairs.messenger)) {
|
|
@@ -49,17 +69,9 @@ const handleSessionToken = (serverRuntimeConfig, signingData) => {
|
|
|
49
69
|
const appClaims = Object.entries(headers).reduce((_appClaims, [headerKey, headerValue]) => (Object.assign(Object.assign({}, _appClaims), headerKey.startsWith('x-shopify-app-metafield-') && {
|
|
50
70
|
[(0, shared_1.snakecase)(headerKey.replace('x-shopify-app-metafield-', ''))]: headerValue,
|
|
51
71
|
})), Object.assign(Object.assign({}, appId && { app_id: (0, shared_1.normalizeShopifyId)(appId).id }), appInstallationId && { installation_id: (0, shared_1.normalizeShopifyId)(appInstallationId).id }));
|
|
52
|
-
// TODO: un-btoa the host and check??
|
|
53
|
-
if ((0, shared_1.stringEmpty)(shop) || (0, shared_1.stringEmpty)(host)) {
|
|
54
|
-
return res.status(412).json({ message: 'Missing required param' });
|
|
55
|
-
}
|
|
56
|
-
let token;
|
|
57
72
|
try {
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
const rawBody = _rawBody.toString();
|
|
61
|
-
const _e = JSON.parse(rawBody), { sub, aud = APP_CONFIG.apiKey } = _e, _body = tslib_1.__rest(_e, ["sub", "aud"]);
|
|
62
|
-
let { dest, iss, sid, jti } = _body, body = tslib_1.__rest(_body, ["dest", "iss", "sid", "jti"]);
|
|
73
|
+
const { sub, aud = APP_CONFIG.apiKey } = body, _body = tslib_1.__rest(body, ["sub", "aud"]);
|
|
74
|
+
let { dest, iss, sid, jti } = _body, tokenBody = tslib_1.__rest(_body, ["dest", "iss", "sid", "jti"]);
|
|
63
75
|
if ((0, shared_1.stringEmpty)(dest)) {
|
|
64
76
|
dest = shop;
|
|
65
77
|
}
|
|
@@ -79,8 +91,8 @@ const handleSessionToken = (serverRuntimeConfig, signingData) => {
|
|
|
79
91
|
dest,
|
|
80
92
|
jti,
|
|
81
93
|
sid,
|
|
82
|
-
aud }, sub && { sub }), appClaims),
|
|
83
|
-
if (
|
|
94
|
+
aud }, sub && { sub }), appClaims), tokenBody);
|
|
95
|
+
if ((0, shared_1.stringEmpty)(signingSecret)) {
|
|
84
96
|
signingSecret = (0, utils_1.generateHMAC)((0, shared_1.objectToSortedString)(payload), APP_CONFIG.apiSecretKey);
|
|
85
97
|
}
|
|
86
98
|
token = (0, jsonwebtoken_1.sign)(payload, signingSecret, signingData);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../../src/lib/handlers/api/token.js"],"names":[],"mappings":";;;;AAAA,gEAAiC;AACjC,yCAAkC;AAClC,+CAAmC;AACnC,+BAAmC;AAEnC,uCAA0C;AAC1C,4CAOwB;AAExB,yCAAyC;AAClC,MAAM,kBAAkB,GAAG,CAAC,mBAAmB,EAAE,WAAW,EAAE,EAAE;IACrE,MAAM,EACJ,QAAQ,EACR,UAAU,GACX,GAAG,mBAAmB,aAAnB,mBAAmB,cAAnB,mBAAmB,GAAI,EAAE,CAAA;IAC7B,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,QAAQ,CAAC,CAAA;IAE7D,OAAO,CAAO,GAAG,EAAE,GAAG,EAAE,EAAE;;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,CAAA;QAChC,MAAM,KAgBF,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,EAhBf;QACJ,kDAAkD;QAClD,aAAa,EACb,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,mBAAmB,EACvC,2BAA2B,EAAE,aAAa,EAC1C,+BAA+B,EAAE,wBAAwB,EACzD,kBAAkB,EAAE,YAAY,EAChC,uBAAuB,EAAE,iBAAiB,GAAG,wBAAwB,EACrE,UAAU,EAAE,KAAK,GAAG,YAAY,EAChC,UAAU,EAAE,KAAK,EAAE,0DAA0D;QAC7E,mCAAmC;QACnC,eAAe,EAAE,UAAU,EAC3B,uBAAuB,EAAE,iBAAiB,EAC1C,gBAAgB,EAAE,IAAI,GAAG,iBAAiB,aAAjB,iBAAiB,cAAjB,iBAAiB,GAAI,UAAU,OAErC,EADhB,OAAO,sBAfN,oPAgBL,CAAoB,CAAA;QACrB,OAAO,CAAC,GAAG,CAAC,yCAAyC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;QAEnE,IAAI,aAAa,EAAE;YACjB,OAAO,CAAC,GAAG,CAAC,wDAAwD,EAAE,aAAa,CAAC,CAAA;
|
|
1
|
+
{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../../src/lib/handlers/api/token.js"],"names":[],"mappings":";;;;AAAA,gEAAiC;AACjC,yCAAkC;AAClC,+CAAmC;AACnC,+BAAmC;AAEnC,uCAA0C;AAC1C,4CAOwB;AAExB,yCAAyC;AAClC,MAAM,kBAAkB,GAAG,CAAC,mBAAmB,EAAE,WAAW,EAAE,EAAE;IACrE,MAAM,EACJ,QAAQ,EACR,UAAU,GACX,GAAG,mBAAmB,aAAnB,mBAAmB,cAAnB,mBAAmB,GAAI,EAAE,CAAA;IAC7B,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,QAAQ,CAAC,CAAA;IAE7D,OAAO,CAAO,GAAG,EAAE,GAAG,EAAE,EAAE;;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,CAAA;QAChC,MAAM,KAgBF,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,EAhBf;QACJ,kDAAkD;QAClD,aAAa,EACb,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,mBAAmB,EACvC,2BAA2B,EAAE,aAAa,EAC1C,+BAA+B,EAAE,wBAAwB,EACzD,kBAAkB,EAAE,YAAY,EAChC,uBAAuB,EAAE,iBAAiB,GAAG,wBAAwB,EACrE,UAAU,EAAE,KAAK,GAAG,YAAY,EAChC,UAAU,EAAE,KAAK,EAAE,0DAA0D;QAC7E,mCAAmC;QACnC,eAAe,EAAE,UAAU,EAC3B,uBAAuB,EAAE,iBAAiB,EAC1C,gBAAgB,EAAE,IAAI,GAAG,iBAAiB,aAAjB,iBAAiB,cAAjB,iBAAiB,GAAI,UAAU,OAErC,EADhB,OAAO,sBAfN,oPAgBL,CAAoB,CAAA;QACrB,OAAO,CAAC,GAAG,CAAC,yCAAyC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;QAEnE,IAAI,IAAI,CAAA;QACR,IAAI,KAAK,CAAA;QACT,IAAI;YACF,mDAAmD;YACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAU,EAAC,GAAG,CAAC,CAAA;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;YACnC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAA;SACnC;QAAC,OAAO,KAAK,EAAE;YACd,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAA;YACtD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;SAC3E;QAED,IAAI,aAAa,EAAE;YACjB,OAAO,CAAC,GAAG,CAAC,wDAAwD,EAAE,aAAa,CAAC,CAAA;YAEpF,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,GAAG,IAAA,qBAAY,EAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC5E,OAAO,CAAC,GAAG,CAAC,sEAAsE,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAA;YACpH,OAAO,CAAC,GAAG,CAAC,qEAAqE,EAAE,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,0CAAE,SAAS,CAAC,CAAA;YAC/G,4DAA4D;YAC5D,IAAI,MAAM,IAAI,mBAAmB,KAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAA,IAAI,aAAa,IAAI,aAAa,IAAI,CAAC,YAAY,KAAK,aAAa,CAAC,EAAE;gBAC3H,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAA,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,KAAK,aAAa,CAAC,EAAE;oBAChI,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;iBAC7E;gBAED,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,CAAA;gBAClE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,eAAM,CAAC,mBAAmB,CAAC;oBAC1D,SAAS,EAAE,mBAAmB;oBAC9B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;iBACvC,CAAC,CAAA;gBACF,OAAO,CAAC,GAAG,CAAC,yDAAyD,EAAE,cAAc,CAAC,CAAA;gBAEtF,MAAM,OAAO,GAAG,MAAM,eAAM,CAAC,UAAU,CACrC,IAAA,6BAAoB,kBAClB,GAAG,EAAE,GAAG,CAAC,GAAG,EACZ,SAAS,EAAE,aAAa,IACrB,IAAI,EACP,EACF,cAAc,EACd,aAAa,CACd,CAAA;gBACD,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAC,OAAO,EAAC,CAAC,CAAA;gBACjD,IAAI,CAAC,OAAO,EAAE;oBACZ,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAA;iBAC5E;aACF;SACF;QAED,qCAAqC;QACrC,IAAI,IAAA,oBAAW,EAAC,IAAI,CAAC,IAAI,IAAA,oBAAW,EAAC,IAAI,CAAC,EAAE;YAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAA;SACnE;QAED,0DAA0D;QAC1D,IAAI,aAAa,CAAA;QACjB,IAAI,KAAK,KAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,SAAS,CAAA,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE;YACjE,WAAW,mCACN,WAAW,KACd,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,GAClC,CAAA;YAED,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAA;SAC9C;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,iCACtF,UAAU,GACV,SAAS,CAAC,UAAU,CAAC,0BAA0B,CAAC,IAAI;YACrD,CAAC,IAAA,kBAAS,EAAC,SAAS,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW;SAC5E,EACD,kCACG,KAAK,IAAI,EAAE,MAAM,EAAE,IAAA,2BAAkB,EAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GACjD,iBAAiB,IAAI,EAAE,eAAe,EAAE,IAAA,2BAAkB,EAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,EACrF,CAAA;QAEF,IAAI;YACF,MAAM,EACJ,GAAG,EACH,GAAG,GAAG,UAAU,CAAC,MAAM,KAErB,IAAI,EADH,KAAK,kBACN,IAAI,EAJF,cAIL,CAAO,CAAA;YAER,IAAI,EACF,IAAI,EACJ,GAAG,EACH,GAAG,EACH,GAAG,KAED,KAAK,EADJ,SAAS,kBACV,KAAK,EANL,6BAMH,CAAQ,CAAA;YAET,IAAI,IAAA,oBAAW,EAAC,IAAI,CAAC,EAAE;gBACrB,IAAI,GAAG,IAAI,CAAA;aACZ;YAED,IAAI,IAAA,oBAAW,EAAC,GAAG,CAAC,EAAE;gBACpB,GAAG,GAAG,IAAA,kBAAM,EAAC,IAAI,CAAC,CAAA;aACnB;YAED,IAAI,IAAA,oBAAW,EAAC,GAAG,CAAC,EAAE;gBACpB,GAAG,GAAG,IAAA,SAAM,GAAE,CAAA;aACf;YAED,IAAI,IAAA,oBAAW,EAAC,GAAG,CAAC,EAAE;gBACpB,GAAG,GAAG,IAAA,SAAM,GAAE,CAAA;gBACd,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,CAAA;aACtB;YAED,MAAM,OAAO,+CACX,IAAI;gBACJ,IAAI;gBACJ,GAAG;gBACH,IAAI;gBACJ,GAAG;gBACH,GAAG;gBACH,GAAG,IACA,GAAG,IAAI,EAAE,GAAG,EAAE,GACd,SAAS,GACT,SAAS,CACb,CAAA;YAED,IAAI,IAAA,oBAAW,EAAC,aAAa,CAAC,EAAE;gBAC9B,aAAa,GAAG,IAAA,oBAAY,EAAC,IAAA,6BAAoB,EAAC,OAAO,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAA;aACrF;YAED,KAAK,GAAG,IAAA,mBAAI,EAAC,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;SAClD;QAAC,OAAO,KAAK,EAAE;YACd,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAA;YACtD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;SAC3E;QAED,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACxC,CAAC,CAAA,CAAA;AACH,CAAC,CAAA;AA9JY,QAAA,kBAAkB,sBA8J9B"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agnostack/next-shopify",
|
|
3
|
-
"version": "1.13.4-beta.
|
|
3
|
+
"version": "1.13.4-beta.6",
|
|
4
4
|
"author": "agnoStack Dev <developers@agnostack.com> (https://agnostack.com)",
|
|
5
5
|
"owner": "agnoStack",
|
|
6
6
|
"description": "Please contact agnoStack via info@agnostack.com for any questions",
|