@agnostack/next-shopify 1.13.6-beta.1 → 1.13.6

package/CHANGELOG.md

@@ -1,33 +1,16 @@
-## [1.13.6-beta.1](https://github.com/agnostack/next-shopify/compare/v1.13.5...v1.13.6-beta.1) (2023-11-30)
+## [1.13.6](https://github.com/agnostack/next-shopify/compare/v1.13.5...v1.13.6) (2023-12-01)
 
 
 ### Bug Fixes
 
-* added react export and useVerification ([7131369](https://github.com/agnostack/next-shopify/commit/71313698da5b30b94a0b28fa9a0d6e595e16c5bd))
-* wip ([088e2f8](https://github.com/agnostack/next-shopify/commit/088e2f84ecb27dc435f1d9a7e1a53eb955fc6fd6))
-* wip ([b0eb414](https://github.com/agnostack/next-shopify/commit/b0eb414b9a3c3d02aaef66b72569dba6c1bdccb0))
-* wip ([cd8d260](https://github.com/agnostack/next-shopify/commit/cd8d260f40672cc066da5695c7a72a790f71d4a1))
-* wip ([f8d453a](https://github.com/agnostack/next-shopify/commit/f8d453a850ead76d6d2c536fe1f8f472f380c1c6))
-* wip ([82e20e8](https://github.com/agnostack/next-shopify/commit/82e20e8e9878ac7f9424ff990e8959c3cbe66e9d))
-* wip ([ecd3625](https://github.com/agnostack/next-shopify/commit/ecd36257e4cde1bbdea48b895934e82ecedf0612))
-* wip ([825f688](https://github.com/agnostack/next-shopify/commit/825f688f614be631c13a70e1c652c45f742408ed))
-* wip ([a66af1e](https://github.com/agnostack/next-shopify/commit/a66af1e574e9e1cc08b2718c4a49f46caf42db9f))
-* wip ([ab11674](https://github.com/agnostack/next-shopify/commit/ab116749073075133350e46d272b5475bb6e9d1b))
+* wip ([a0e6d9b](https://github.com/agnostack/next-shopify/commit/a0e6d9b293964314160a9eb8f13d7992c7116af8))
 
-## [1.13.6-beta.1](https://github.com/agnostack/next-shopify/compare/v1.13.5-beta.7...v1.13.5-beta.8) (2023-11-30)
+## [1.13.6-alpha.1](https://github.com/agnostack/next-shopify/compare/v1.13.5...v1.13.6-alpha.1) (2023-12-01)
 
 
 ### Bug Fixes
 
-* wip ([b0eb414](https://github.com/agnostack/next-shopify/commit/b0eb414b9a3c3d02aaef66b72569dba6c1bdccb0))
-* wip ([cd8d260](https://github.com/agnostack/next-shopify/commit/cd8d260f40672cc066da5695c7a72a790f71d4a1))
-* wip ([f8d453a](https://github.com/agnostack/next-shopify/commit/f8d453a850ead76d6d2c536fe1f8f472f380c1c6))
-* wip ([82e20e8](https://github.com/agnostack/next-shopify/commit/82e20e8e9878ac7f9424ff990e8959c3cbe66e9d))
-* wip ([ecd3625](https://github.com/agnostack/next-shopify/commit/ecd36257e4cde1bbdea48b895934e82ecedf0612))
-* wip ([825f688](https://github.com/agnostack/next-shopify/commit/825f688f614be631c13a70e1c652c45f742408ed))
-* wip ([a66af1e](https://github.com/agnostack/next-shopify/commit/a66af1e574e9e1cc08b2718c4a49f46caf42db9f))
-* added react export and useVerification ([7131369](https://github.com/agnostack/next-shopify/commit/71313698da5b30b94a0b28fa9a0d6e595e16c5bd))
-* wip ([ab11674](https://github.com/agnostack/next-shopify/commit/ab116749073075133350e46d272b5475bb6e9d1b))
+* wip ([a0e6d9b](https://github.com/agnostack/next-shopify/commit/a0e6d9b293964314160a9eb8f13d7992c7116af8))
 
 ## [1.13.5](https://github.com/agnostack/next-shopify/compare/v1.13.4...v1.13.5) (2023-11-30)
 
@@ -36,7 +19,19 @@
 
 * wip ([d0e3583](https://github.com/agnostack/next-shopify/commit/d0e35831a73f4c8ffc0a8f073a25bf37f6877502))
 * wip ([6bc1e78](https://github.com/agnostack/next-shopify/commit/6bc1e78c764fde2673669c80ad525f733f413d7f))
+
+## [1.13.5-alpha.2](https://github.com/agnostack/next-shopify/compare/v1.13.5-alpha.1...v1.13.5-alpha.2) (2023-11-30)
+
+
+### Bug Fixes
+
 * wip ([d0e3583](https://github.com/agnostack/next-shopify/commit/d0e35831a73f4c8ffc0a8f073a25bf37f6877502))
+
+## [1.13.5-alpha.1](https://github.com/agnostack/next-shopify/compare/v1.13.4...v1.13.5-alpha.1) (2023-11-30)
+
+
+### Bug Fixes
+
 * wip ([6bc1e78](https://github.com/agnostack/next-shopify/commit/6bc1e78c764fde2673669c80ad525f733f413d7f))
 
 ## [1.13.4](https://github.com/agnostack/next-shopify/compare/v1.13.3...v1.13.4) (2023-11-29)

package/dist/lib/handlers/api/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../../src/lib/handlers/api/graph.js"],"names":[],"mappings":"AAmBO,yGAiHN"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../../src/lib/handlers/api/graph.js"],"names":[],"mappings":"AAkBO,yGA0GN"}

package/dist/lib/handlers/api/graph.js

@@ -5,94 +5,89 @@ const tslib_1 = require("tslib");
 const shopify_api_1 = require("@shopify/shopify-api");
 const utils_1 = require("../../utils");
 const shared_1 = require("../../../shared");
-const handleGraph = (serverRuntimeConfig) => {
-    const _getVerifiedBody = (0, utils_1.getVerifiedBody)(serverRuntimeConfig);
-    return (req, res, params) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
-        var _a, _b, _c;
-        const [requestBody, processResponse] = yield _getVerifiedBody(req, res);
-        const _d = (_a = req.query) !== null && _a !== void 0 ? _a : {}, { shop, apiVersion } = _d, _query = tslib_1.__rest(_d, ["shop", "apiVersion"]);
-        const _e = params !== null && params !== void 0 ? params : requestBody, { isOnline, query: graphQuery, variables: graphVariables, transform = (_data) => _data } = _e, graphParams = tslib_1.__rest(_e, ["isOnline", "query", "variables", "transform"]);
-        let query = _query;
-        if ((0, shared_1.isType)(query, 'string')) {
-            query = (0, shared_1.querystringToObject)(query);
-        }
-        if ((0, shared_1.stringEmpty)(shop) || (0, shared_1.stringEmpty)(graphQuery)) {
-            return res.status(400).json({ message: 'Invalid arguments' });
-        }
-        let statusCode;
-        let response;
-        let headers = {};
-        let message = 'Error handling query call';
-        try {
-            const { getVerifiedClients } = yield (0, utils_1.getShopifyHelpers)(serverRuntimeConfig, { shop });
-            const { Graphql } = yield getVerifiedClients({ req, res, shop, apiVersion, isOnline });
-            response = yield Graphql.query(Object.assign(Object.assign({ data: graphVariables ? {
-                    query: graphQuery,
-                    variables: graphVariables,
-                } : graphQuery }, (0, shared_1.objectNotEmpty)(query) && { query }), graphParams))
-                .then(processResponse);
-            statusCode = 200;
-        }
-        catch (error) {
-            statusCode = 500;
-            // TODO: clean up to share between rest and graph (pr at least keep in sync)
-            switch (true) {
-                case error instanceof shared_1.ShopifyAuthenticationError: {
-                    console.error(`${message}. Authentication Error.`, error);
-                    const errorResponse = (0, utils_1.getAuthErrorResponse)(serverRuntimeConfig, { error, shop });
-                    statusCode = errorResponse.statusCode;
-                    message = errorResponse.message;
-                    // HMMMM, should this be:
-                    // message = `${message}. Authentication Error -  ${errroResponse.message}.`
-                    headers = errorResponse.headers;
-                    break;
-                }
-                case error instanceof shopify_api_1.BillingError: {
-                    // HMMMM, should this be:
-                    // message = `${message}. Billing Error - ${error.message}.`
-                    console.error(`${message}. Billing Error - ${error.message}.`, error.errorData);
-                    statusCode = 402;
-                    if (error === null || error === void 0 ? void 0 : error.message) {
-                        message = error.message;
-                    }
-                    break;
-                }
-                case error instanceof shopify_api_1.GraphqlQueryError: {
-                    const errorMessages = (0, shared_1.ensureArray)((_b = error.response) === null || _b === void 0 ? void 0 : _b.errors).map(({ message }) => (0, shared_1.ensureString)(message));
-                    console.error(`${message}. ${errorMessages.join('. ')}.`);
-                    // HMMMM, should this be:
-                    // message = `${message}. ${errorMessages.join('. ')}.`
-                    // TODO: why are these not sending back different error codes?
-                    break;
-                }
-                default: {
-                    console.error(`${message}. HandleGraph Error - ${error.message}.`);
-                    break;
+const handleGraph = (serverRuntimeConfig) => (req, res, params) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const { body = '{}' } = req, _c = req.query, _d = _c === void 0 ? {} : _c, { shop, apiVersion } = _d, _query = tslib_1.__rest(_d, ["shop", "apiVersion"]);
+    const _e = params !== null && params !== void 0 ? params : JSON.parse(body), { isOnline, query: graphQuery, variables: graphVariables, transform = (_data) => _data } = _e, graphParams = tslib_1.__rest(_e, ["isOnline", "query", "variables", "transform"]);
+    let query = _query;
+    if ((0, shared_1.isType)(query, 'string')) {
+        query = (0, shared_1.querystringToObject)(query);
+    }
+    if ((0, shared_1.stringEmpty)(shop) || (0, shared_1.stringEmpty)(graphQuery)) {
+        return res.status(400).json({ message: 'Invalid arguments' });
+    }
+    let statusCode;
+    let response;
+    let headers = {};
+    let message = 'Error handling query call';
+    try {
+        const { getVerifiedClients } = yield (0, utils_1.getShopifyHelpers)(serverRuntimeConfig, { shop });
+        const { Graphql } = yield getVerifiedClients({ req, res, shop, apiVersion, isOnline });
+        response = yield Graphql.query(Object.assign(Object.assign({ data: graphVariables ? {
+                query: graphQuery,
+                variables: graphVariables,
+            } : graphQuery }, (0, shared_1.objectNotEmpty)(query) && { query }), graphParams));
+        statusCode = 200;
+    }
+    catch (error) {
+        statusCode = 500;
+        // TODO: clean up to share between rest and graph (pr at least keep in sync)
+        switch (true) {
+            case error instanceof shared_1.ShopifyAuthenticationError: {
+                console.error(`${message}. Authentication Error.`, error);
+                const errorResponse = (0, utils_1.getAuthErrorResponse)(serverRuntimeConfig, { error, shop });
+                statusCode = errorResponse.statusCode;
+                message = errorResponse.message;
+                // HMMMM, should this be:
+                // message = `${message}. Authentication Error -  ${errroResponse.message}.`
+                headers = errorResponse.headers;
+                break;
+            }
+            case error instanceof shopify_api_1.BillingError: {
+                // HMMMM, should this be:
+                // message = `${message}. Billing Error - ${error.message}.`
+                console.error(`${message}. Billing Error - ${error.message}.`, error.errorData);
+                statusCode = 402;
+                if (error === null || error === void 0 ? void 0 : error.message) {
+                    message = error.message;
                 }
+                break;
             }
-        }
-        Object.entries(headers).forEach(([key, value]) => {
-            res.setHeader(key, value);
-        });
-        if (!(response === null || response === void 0 ? void 0 : response.body)) {
-            return res.status(statusCode).json({ message });
-        }
-        try {
-            const responseBody = (_c = response.body.data) !== null && _c !== void 0 ? _c : response.body;
-            const [_responseData] = Object.values((0, shared_1.ensureObject)(responseBody));
-            const _f = (0, shared_1.ensureObject)(_responseData), { userErrors } = _f, responseData = tslib_1.__rest(_f, ["userErrors"]);
-            if ((0, shared_1.arrayNotEmpty)(userErrors)) {
-                const errorMessages = (0, shared_1.ensureArray)(userErrors).map(({ message }) => (0, shared_1.ensureString)(message));
-                return res.status(500).json({ message: `${message}. ${errorMessages.join('. ')}.` });
+            case error instanceof shopify_api_1.GraphqlQueryError: {
+                const errorMessages = (0, shared_1.ensureArray)((_a = error.response) === null || _a === void 0 ? void 0 : _a.errors).map(({ message }) => (0, shared_1.ensureString)(message));
+                console.error(`${message}. ${errorMessages.join('. ')}.`);
+                // HMMMM, should this be:
+                // message = `${message}. ${errorMessages.join('. ')}.`
+                // TODO: why are these not sending back different error codes?
+                break;
+            }
+            default: {
+                console.error(`${message}. HandleGraph Error - ${error.message}.`);
+                break;
             }
-            // NOTE: sending in both to transform in case someone needs the userErrors
-            return res.status(statusCode).json(transform(responseData, responseBody));
-        }
-        catch (error) {
-            console.error(`${message}. Transformation Error.`, error);
-            return res.status(500).json({ message });
         }
+    }
+    Object.entries(headers).forEach(([key, value]) => {
+        res.setHeader(key, value);
     });
-};
+    if (!(response === null || response === void 0 ? void 0 : response.body)) {
+        return res.status(statusCode).json({ message });
+    }
+    try {
+        const responseBody = (_b = response.body.data) !== null && _b !== void 0 ? _b : response.body;
+        const [_responseData] = Object.values((0, shared_1.ensureObject)(responseBody));
+        const _f = (0, shared_1.ensureObject)(_responseData), { userErrors } = _f, responseData = tslib_1.__rest(_f, ["userErrors"]);
+        if ((0, shared_1.arrayNotEmpty)(userErrors)) {
+            const errorMessages = (0, shared_1.ensureArray)(userErrors).map(({ message }) => (0, shared_1.ensureString)(message));
+            return res.status(500).json({ message: `${message}. ${errorMessages.join('. ')}.` });
+        }
+        // NOTE: sending in both to transform in case someone needs the userErrors
+        return res.status(statusCode).json(transform(responseData, responseBody));
+    }
+    catch (error) {
+        console.error(`${message}. Transformation Error.`, error);
+        return res.status(500).json({ message });
+    }
+});
 exports.handleGraph = handleGraph;
 //# sourceMappingURL=graph.js.map

package/dist/lib/handlers/api/graph.js.map

@@ -1 +1 @@
-{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../../src/lib/handlers/api/graph.js"],"names":[],"mappings":";;;;AAAA,sDAAsE;AAEtE,uCAIoB;AACpB,4CAUwB;AAEjB,MAAM,WAAW,GAAG,CAAC,mBAAmB,EAAE,EAAE;IACjD,MAAM,gBAAgB,GAAG,IAAA,uBAAe,EAAC,mBAAmB,CAAC,CAAA;IAE7D,OAAO,CAAO,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;;QAChC,MAAM,CAAC,WAAW,EAAE,eAAe,CAAC,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAEvE,MAAM,KAAkC,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,EAAjD,EAAE,IAAI,EAAE,UAAU,OAA+B,EAA1B,MAAM,sBAA7B,sBAA+B,CAAkB,CAAA;QACvD,MAAM,KAMF,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,WAAW,EANnB,EACJ,QAAQ,EACR,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,cAAc,EACzB,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,OAEL,EADpB,WAAW,sBALV,+CAML,CAAwB,CAAA;QAEzB,IAAI,KAAK,GAAG,MAAM,CAAA;QAClB,IAAI,IAAA,eAAM,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;YAC3B,KAAK,GAAG,IAAA,4BAAmB,EAAC,KAAK,CAAC,CAAA;SACnC;QAED,IAAI,IAAA,oBAAW,EAAC,IAAI,CAAC,IAAI,IAAA,oBAAW,EAAC,UAAU,CAAC,EAAE;YAChD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAA;SAC9D;QAED,IAAI,UAAU,CAAA;QACd,IAAI,QAAQ,CAAA;QACZ,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,IAAI,OAAO,GAAG,2BAA2B,CAAA;QAEzC,IAAI;YACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,IAAA,yBAAiB,EAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YACrF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;YAEtF,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,+BAC5B,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;oBACrB,KAAK,EAAE,UAAU;oBACjB,SAAS,EAAE,cAAc;iBAC1B,CAAC,CAAC,CAAC,UAAU,IACX,IAAA,uBAAc,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAClC,WAAW,EACd;iBACD,IAAI,CAAC,eAAe,CAAC,CAAA;YAEtB,UAAU,GAAG,GAAG,CAAA;SACjB;QAAC,OAAO,KAAK,EAAE;YACd,UAAU,GAAG,GAAG,CAAA;YAEhB,4EAA4E;YAC5E,QAAQ,IAAI,EAAE;gBACZ,KAAK,KAAK,YAAY,mCAA0B,CAAC,CAAC;oBAChD,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,yBAAyB,EAAE,KAAK,CAAC,CAAA;oBACzD,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;oBAChF,UAAU,GAAG,aAAa,CAAC,UAAU,CAAA;oBACrC,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;oBAC/B,yBAAyB;oBACzB,4EAA4E;oBAC5E,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;oBAC/B,MAAK;iBACN;gBAED,KAAK,KAAK,YAAY,0BAAY,CAAC,CAAC;oBAClC,yBAAyB;oBACzB,4DAA4D;oBAC5D,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,qBAAqB,KAAK,CAAC,OAAO,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;oBAC/E,UAAU,GAAG,GAAG,CAAA;oBAChB,IAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,EAAE;wBAClB,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;qBACxB;oBACD,MAAK;iBACN;gBAED,KAAK,KAAK,YAAY,+BAAiB,CAAC,CAAC;oBACvC,MAAM,aAAa,GAAG,IAAA,oBAAW,EAAC,MAAA,KAAK,CAAC,QAAQ,0CAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAY,EAAC,OAAO,CAAC,CAAC,CAAA;oBACrG,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACzD,yBAAyB;oBACzB,uDAAuD;oBACvD,8DAA8D;oBAC9D,MAAK;iBACN;gBAED,OAAO,CAAC,CAAC;oBACP,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,yBAAyB,KAAK,CAAC,OAAO,GAAG,CAAC,CAAA;oBAClE,MAAK;iBACN;aACF;SACF;QAED,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA,EAAE;YACnB,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;SAChD;QAED,IAAI;YACF,MAAM,YAAY,GAAG,MAAA,QAAQ,CAAC,IAAI,CAAC,IAAI,mCAAI,QAAQ,CAAC,IAAI,CAAA;YAExD,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC,CAAA;YACjE,MAAM,KAAkC,IAAA,qBAAY,EAAC,aAAa,CAAC,EAA7D,EAAE,UAAU,OAAiD,EAA5C,YAAY,sBAA7B,cAA+B,CAA8B,CAAA;YAEnE,IAAI,IAAA,sBAAa,EAAC,UAAU,CAAC,EAAE;gBAC7B,MAAM,aAAa,GAAG,IAAA,oBAAW,EAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAY,EAAC,OAAO,CAAC,CAAC,CAAA;gBACzF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;aACrF;YAED,0EAA0E;YAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;SAC1E;QAAC,OAAO,KAAK,EAAE;YACd,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,yBAAyB,EAAE,KAAK,CAAC,CAAA;YACzD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;SACzC;IACH,CAAC,CAAA,CAAA;AACH,CAAC,CAAA;AAjHY,QAAA,WAAW,eAiHvB"}
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../../src/lib/handlers/api/graph.js"],"names":[],"mappings":";;;;AAAA,sDAAsE;AAEtE,uCAGoB;AACpB,4CAUwB;AAEjB,MAAM,WAAW,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAO,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;;IAC7E,MAAM,EAAE,IAAI,GAAG,IAAI,KAAkD,GAAG,EAAnD,KAAgD,GAAG,MAAR,EAA3C,qBAAyC,EAAE,KAAA,EAA3C,EAAS,IAAI,EAAE,UAAU,OAAkB,EAAb,MAAM,sBAA7B,sBAA+B,CAAa,CAAA;IACxE,MAAM,KAMF,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EANxB,EACJ,QAAQ,EACR,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,cAAc,EACzB,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,OAEA,EADzB,WAAW,sBALV,+CAML,CAA6B,CAAA;IAE9B,IAAI,KAAK,GAAG,MAAM,CAAA;IAClB,IAAI,IAAA,eAAM,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;QAC3B,KAAK,GAAG,IAAA,4BAAmB,EAAC,KAAK,CAAC,CAAA;KACnC;IAED,IAAI,IAAA,oBAAW,EAAC,IAAI,CAAC,IAAI,IAAA,oBAAW,EAAC,UAAU,CAAC,EAAE;QAChD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAA;KAC9D;IAED,IAAI,UAAU,CAAA;IACd,IAAI,QAAQ,CAAA;IACZ,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,OAAO,GAAG,2BAA2B,CAAA;IAEzC,IAAI;QACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,IAAA,yBAAiB,EAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACrF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;QAEtF,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,+BAC5B,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;gBACrB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,cAAc;aAC1B,CAAC,CAAC,CAAC,UAAU,IACX,IAAA,uBAAc,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAClC,WAAW,EACd,CAAA;QAEF,UAAU,GAAG,GAAG,CAAA;KACjB;IAAC,OAAO,KAAK,EAAE;QACd,UAAU,GAAG,GAAG,CAAA;QAEhB,4EAA4E;QAC5E,QAAQ,IAAI,EAAE;YACZ,KAAK,KAAK,YAAY,mCAA0B,CAAC,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,yBAAyB,EAAE,KAAK,CAAC,CAAA;gBACzD,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAChF,UAAU,GAAG,aAAa,CAAC,UAAU,CAAA;gBACrC,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;gBAC/B,yBAAyB;gBACzB,4EAA4E;gBAC5E,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;gBAC/B,MAAK;aACN;YAED,KAAK,KAAK,YAAY,0BAAY,CAAC,CAAC;gBAClC,yBAAyB;gBACzB,4DAA4D;gBAC5D,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,qBAAqB,KAAK,CAAC,OAAO,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;gBAC/E,UAAU,GAAG,GAAG,CAAA;gBAChB,IAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,EAAE;oBAClB,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;iBACxB;gBACD,MAAK;aACN;YAED,KAAK,KAAK,YAAY,+BAAiB,CAAC,CAAC;gBACvC,MAAM,aAAa,GAAG,IAAA,oBAAW,EAAC,MAAA,KAAK,CAAC,QAAQ,0CAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAY,EAAC,OAAO,CAAC,CAAC,CAAA;gBACrG,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACzD,yBAAyB;gBACzB,uDAAuD;gBACvD,8DAA8D;gBAC9D,MAAK;aACN;YAED,OAAO,CAAC,CAAC;gBACP,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,yBAAyB,KAAK,CAAC,OAAO,GAAG,CAAC,CAAA;gBAClE,MAAK;aACN;SACF;KACF;IAED,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA,EAAE;QACnB,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;KAChD;IAED,IAAI;QACF,MAAM,YAAY,GAAG,MAAA,QAAQ,CAAC,IAAI,CAAC,IAAI,mCAAI,QAAQ,CAAC,IAAI,CAAA;QAExD,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC,CAAA;QACjE,MAAM,KAAkC,IAAA,qBAAY,EAAC,aAAa,CAAC,EAA7D,EAAE,UAAU,OAAiD,EAA5C,YAAY,sBAA7B,cAA+B,CAA8B,CAAA;QAEnE,IAAI,IAAA,sBAAa,EAAC,UAAU,CAAC,EAAE;YAC7B,MAAM,aAAa,GAAG,IAAA,oBAAW,EAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAY,EAAC,OAAO,CAAC,CAAC,CAAA;YACzF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;SACrF;QAED,0EAA0E;QAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;KAC1E;IAAC,OAAO,KAAK,EAAE;QACd,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,yBAAyB,EAAE,KAAK,CAAC,CAAA;QACzD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;KACzC;AACH,CAAC,CAAA,CAAA;AA1GY,QAAA,WAAW,eA0GvB"}

package/dist/lib/handlers/api/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../../../src/lib/handlers/api/proxy.js"],"names":[],"mappings":"AAmCO,sHAwLN"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../../../src/lib/handlers/api/proxy.js"],"names":[],"mappings":"AAsCO,sHAqQN"}

package/dist/lib/handlers/api/proxy.js

@@ -5,6 +5,7 @@ const tslib_1 = require("tslib");
 /* eslint-disable @typescript-eslint/no-unused-vars */
 const nextjs_cors_1 = tslib_1.__importDefault(require("nextjs-cors"));
 const http_proxy_1 = tslib_1.__importDefault(require("http-proxy"));
+const raw_body_1 = tslib_1.__importDefault(require("raw-body"));
 const node_http_proxy_json_1 = tslib_1.__importDefault(require("node-http-proxy-json"));
 const utils_1 = require("../../utils");
 const shared_1 = require("../../../shared");
@@ -13,131 +14,176 @@ const verifyAppProxySignature = (signature, verifiable, hmacSecret) => {
     const hmac = (0, utils_1.generateHMAC)((0, shared_1.objectToSortedString)(verifiable), hmacSecret);
     return (0, utils_1.compareHashes)(signature, hmac);
 };
-const handleProxy = (serverRuntimeConfig, config) => {
+const handleProxy = (serverRuntimeConfig, config) => (req, res, params) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
     const { generateReplacements } = config !== null && config !== void 0 ? config : {};
-    const { API_PATHS, APP_CONFIG, APP_BASE_URL, TARGET_SAFELIST, ORIGIN_SAFELIST, } = serverRuntimeConfig;
-    const _getVerifiedBody = (0, utils_1.getVerifiedBody)(serverRuntimeConfig);
-    return (req, res, params) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
-        var _a, _b;
-        const _c = (_a = req.headers) !== null && _a !== void 0 ? _a : {}, { origin, 'x-forwarded-for': _forwardFor, 'x-forwarded-proto': _forwardProto, 'x-forwarded-host': forwardHost, 'x-proxy-origin': proxyOrigin } = _c, _headers = tslib_1.__rest(_c, ["origin", 'x-forwarded-for', 'x-forwarded-proto', 'x-forwarded-host', 'x-proxy-origin']);
-        const { 'x-extension-session': sessionToken, 'x-extension-point': extensionPoint, 'x-shop-domain': shopDomainHeader, 'x-shopify-shop-domain': shopifyShopDomainHeader, 'x-shopify-shop': shopHeader = shopifyShopDomainHeader !== null && shopifyShopDomainHeader !== void 0 ? shopifyShopDomainHeader : shopDomainHeader, 'x-shopify-app-id': shopifyAppId, 'x-app-id': appId = shopifyAppId,
-        // 'x-shopify-app-installation-id': shopifyAppInstallationId,
-        // 'x-app-installation-id': appInstallationId = shopifyAppInstallationId, // TODO: pass along installationId??
-        // TODO: pass along providerSetId??
-         } = _headers;
-        let targetPath;
-        try {
-            // NOTE: GET requests are not always sending along origin
-            if ((0, shared_1.stringEmpty)(origin)) {
-                req.headers = Object.assign(Object.assign({}, req.headers), { origin: proxyOrigin || forwardHost });
-            }
-            const _d = (_b = req.query) !== null && _b !== void 0 ? _b : {}, { signature, proxyEncoded } = _d, verifiable = tslib_1.__rest(_d, ["signature", "proxyEncoded"]);
-            const { shop: _shop, host, timestamp, path_prefix } = verifiable;
-            const shop = _shop || shopHeader;
-            yield (0, nextjs_cors_1.default)(req, res, {
-                methods: ['PUT', 'PATCH', 'POST', 'DELETE'],
-                origin: (origin, callback) => {
-                    const isSafelisted = (0, shared_1.matchHostname)(origin, [
-                        ...ORIGIN_SAFELIST,
-                        'cdn.shopify.com' // NOTE: this is the domain for checkout UI extensions
-                    ]);
-                    if (isSafelisted) {
-                        return callback(null, true);
-                    }
-                    return callback(new Error('Invalid CORS origin'));
+    const { keyPairs, API_PATHS, APP_CONFIG, APP_BASE_URL, TARGET_SAFELIST, ORIGIN_SAFELIST, } = serverRuntimeConfig;
+    const _c = (_a = req.headers) !== null && _a !== void 0 ? _a : {}, { origin, 'x-forwarded-for': _forwardFor, 'x-forwarded-proto': _forwardProto, 'x-forwarded-host': forwardHost, 'x-proxy-origin': proxyOrigin } = _c, proxyableHeaders = tslib_1.__rest(_c, ["origin", 'x-forwarded-for', 'x-forwarded-proto', 'x-forwarded-host', 'x-proxy-origin']);
+    const { 'x-public-key': apiKey, 'x-ephemeral-key': ephemeralPublicKey, 'x-authorization-timestamp': customAuthTimestamp, 'x-authorization': customAuth, 'x-extension-session': sessionToken, 'x-extension-point': extensionPoint, 'x-shop-domain': shopDomainHeader, 'x-shopify-shop-domain': shopifyShopDomainHeader, 'x-shopify-shop': shopHeader = shopifyShopDomainHeader !== null && shopifyShopDomainHeader !== void 0 ? shopifyShopDomainHeader : shopDomainHeader, 'x-shopify-app-id': shopifyAppId, 'x-app-id': appId = shopifyAppId,
+    // 'x-shopify-app-installation-id': shopifyAppInstallationId,
+    // 'x-app-installation-id': appInstallationId = shopifyAppInstallationId, // TODO: pass along installationId??
+    // TODO: pass along providerSetId??
+     } = proxyableHeaders;
+    const verificationHeaders = {
+        'x-public-key': apiKey,
+        'x-ephemeral-key': ephemeralPublicKey,
+        'x-authorization-timestamp': customAuthTimestamp,
+        'x-authorization': customAuth,
+    };
+    let targetPath;
+    try {
+        const [authProtocol, authSignature] = (0, shared_1.ensureString)(customAuth).split(' ');
+        const isVerifiable = (apiKey &&
+            ephemeralPublicKey &&
+            customAuthTimestamp &&
+            authSignature &&
+            (keyPairs === null || keyPairs === void 0 ? void 0 : keyPairs.shared) &&
+            (authProtocol === 'HMAC-SHA256'));
+        let verificationKeys;
+        // NOTE raw request body is required for shopify's validation
+        const _rawBody = yield (0, raw_body_1.default)(req);
+        const rawBody = _rawBody.toString();
+        const parsedBody = JSON.parse(rawBody || '{}'); // NOTE: parsedBody should be encrypted when isVerifiable
+        let decryptedBody = parsedBody;
+        // NOTE: GET requests are not always sending along origin
+        if ((0, shared_1.stringEmpty)(origin)) {
+            req.headers = Object.assign(Object.assign({}, req.headers), { origin: proxyOrigin || forwardHost });
+        }
+        const _d = (_b = req.query) !== null && _b !== void 0 ? _b : {}, { signature, proxyEncoded } = _d, verifiable = tslib_1.__rest(_d, ["signature", "proxyEncoded"]);
+        const { shop: _shop, host, timestamp, path_prefix } = verifiable;
+        const shop = _shop || shopHeader;
+        yield (0, nextjs_cors_1.default)(req, res, {
+            methods: ['PUT', 'PATCH', 'POST', 'DELETE'],
+            origin: (origin, callback) => {
+                const isSafelisted = (0, shared_1.matchHostname)(origin, [
+                    ...ORIGIN_SAFELIST,
+                    'cdn.shopify.com' // NOTE: this is the domain for checkout UI extensions
+                ]);
+                if (isSafelisted) {
+                    return callback(null, true);
+                }
+                return callback(new Error('Invalid CORS origin'));
+            },
+            optionsSuccessStatus: 200, // some legacy browsers (IE11, various SmartTVs) choke on 204
+        });
+        const { target: targetParam } = params !== null && params !== void 0 ? params : {};
+        // eslint-disable-next-line max-len
+        const _targetUrl = ((0, shared_1.stringEmpty)(targetParam) || targetParam.startsWith('http')) ? targetParam : `${APP_BASE_URL}/${(0, shared_1.removeLeadingSlash)(targetParam)}`;
+        const { origin: target, hostname, pathname, search } = (0, shared_1.stringNotEmpty)(_targetUrl) ? new URL(_targetUrl) : {};
+        targetPath = [pathname, search].filter(shared_1.stringNotEmpty).join('');
+        const safelistedTarget = (0, shared_1.matchHostname)(hostname, Object.assign({ [new URL(APP_BASE_URL).hostname]: {
+                // HMMM: can we generate our own session token (or use the current one) so as to not have to tell handleGraph/Rest to behave as offline?
+                // headers: {
+                //   Authorization: 'Bearer {{setting.zendesk.token}}',
+                // },
+                params: {
+                    shop,
+                    host,
                 },
-                optionsSuccessStatus: 200, // some legacy browsers (IE11, various SmartTVs) choke on 204
-            });
-            const { target: targetParam } = params !== null && params !== void 0 ? params : {};
-            // eslint-disable-next-line max-len
-            const _targetUrl = ((0, shared_1.stringEmpty)(targetParam) || targetParam.startsWith('http')) ? targetParam : `${APP_BASE_URL}/${(0, shared_1.removeLeadingSlash)(targetParam)}`;
-            const { origin: target, hostname, pathname, search } = (0, shared_1.stringNotEmpty)(_targetUrl) ? new URL(_targetUrl) : {};
-            targetPath = [pathname, search].filter(shared_1.stringNotEmpty).join('');
-            const safelistedTarget = (0, shared_1.matchHostname)(hostname, Object.assign({ [new URL(APP_BASE_URL).hostname]: {
-                    // HMMM: can we generate our own session token (or use the current one) so as to not have to tell handleGraph/Rest to behave as offline?
-                    // headers: {
-                    //   Authorization: 'Bearer {{setting.zendesk.token}}',
-                    // },
-                    params: {
-                        shop,
-                        host,
-                    },
-                } }, TARGET_SAFELIST));
-            if ((0, shared_1.stringEmpty)(targetPath) || (safelistedTarget == undefined)) {
-                return res.status(407).json({ message: 'Unproxyable target' });
+            } }, TARGET_SAFELIST));
+        if ((0, shared_1.stringEmpty)(targetPath) || (safelistedTarget == undefined)) {
+            return res.status(407).json({ message: 'Unproxyable target' });
+        }
+        if (!shop || !host || !extensionPoint || !signature || !proxyEncoded) {
+            return res.status(400).json({ message: 'Invalid or missing headers', extensionPoint });
+        }
+        const isShopifyOriginOrRelative = (0, shared_1.stringNotEmpty)((0, shared_1.ensureString)(path_prefix).startsWith('http')
+            ? (0, shared_1.sanitizeShop)(new URL(path_prefix).hostname)
+            : path_prefix);
+        // TODO: once Shopify fixes CORS issue when origin is cdn.shopify.com, update this!
+        if (!verifyAppProxySignature(signature, verifiable, isShopifyOriginOrRelative ? APP_CONFIG.apiSecretKey : timestamp)) {
+            return res.status(403).json({ message: 'Invalid signature' });
+        }
+        // TODO: clean up targetParam.startsWith??
+        if (!targetParam.startsWith(API_PATHS[shared_1.API_ROUTE_NAMES.SESSION_TOKEN])) {
+            const _getVerifiedSessionData = (0, utils_1.getVerifiedSessionData)(serverRuntimeConfig);
+            if (!_getVerifiedSessionData(sessionToken, { shop, host }).catch((_error) => {
+                if (_error instanceof shared_1.ShopifySessionInvalidError) {
+                    return res.status(403).json({ message: _error.message });
+                }
+                throw _error;
+            })) {
+                return res.status(403).json({ message: 'Unverified signature' });
             }
-            if (!shop || !host || !extensionPoint || !signature || !proxyEncoded) {
-                return res.status(400).json({ message: 'Invalid or missing headers', extensionPoint });
+        }
+        const { headers: targetHeaders, params: targetParams } = (0, shared_1.ensureObject)(safelistedTarget);
+        if ((0, shared_1.objectNotEmpty)(targetParams)) {
+            targetPath = (0, shared_1.appendQuery)(targetPath, new URLSearchParams(targetParams).toString());
+        }
+        if (!apiKey || (apiKey !== keyPairs.shared.publicKey)) {
+            return res.status(401).json({ message: 'Invalid or missing public key' });
+        }
+        // TEMP!!! remove isVerifiable check once webwidget moved to react
+        if (isVerifiable) {
+            if (!ephemeralPublicKey ||
+                !customAuthTimestamp ||
+                !authSignature ||
+                (authProtocol !== 'HMAC-SHA256')) {
+                return res.status(401).json({ message: 'Invalid or missing authorization' });
             }
-            const isShopifyOriginOrRelative = (0, shared_1.stringNotEmpty)((0, shared_1.ensureString)(path_prefix).startsWith('http')
-                ? (0, shared_1.sanitizeShop)(new URL(path_prefix).hostname)
-                : path_prefix);
-            // TODO: once Shopify fixes CORS issue when origin is cdn.shopify.com, update this!
-            if (!verifyAppProxySignature(signature, verifiable, isShopifyOriginOrRelative ? APP_CONFIG.apiSecretKey : timestamp)) {
-                return res.status(403).json({ message: 'Invalid signature' });
+            verificationKeys = yield shared_1.subtle.getVerificationKeys({
+                publicKey: ephemeralPublicKey,
+                privateKey: keyPairs.shared.privateKey,
+            });
+            if (!verificationKeys) {
+                return res.status(412).json({ message: 'Invalid or missing verification' });
             }
-            // TODO: clean up targetParam.startsWith??
-            if (!targetParam.startsWith(API_PATHS[shared_1.API_ROUTE_NAMES.SESSION_TOKEN])) {
-                const _getVerifiedSessionData = (0, utils_1.getVerifiedSessionData)(serverRuntimeConfig);
-                if (!_getVerifiedSessionData(sessionToken, { shop, host }).catch((_error) => {
-                    if (_error instanceof shared_1.ShopifySessionInvalidError) {
-                        return res.status(403).json({ message: _error.message });
-                    }
-                    throw _error;
-                })) {
-                    return res.status(403).json({ message: 'Unverified signature' });
-                }
+            const verificationPayload = (0, shared_1.objectToSortedString)(Object.assign({ method: (0, shared_1.getRequestMethod)(rawBody, req.method), timestamp: customAuthTimestamp, body: parsedBody }, (0, shared_1.normalizeURIParts)(targetPath)));
+            const isValid = yield shared_1.subtle.verifyHMAC(verificationPayload, verificationKeys.derivedHMACKey, authSignature);
+            if (!isValid) {
+                return res.status(412).json({ message: 'Invalid or missing verification' });
             }
-            const { headers: targetHeaders, params: targetParams } = (0, shared_1.ensureObject)(safelistedTarget);
-            if ((0, shared_1.objectNotEmpty)(targetParams)) {
-                targetPath = (0, shared_1.appendQuery)(targetPath, new URLSearchParams(targetParams).toString());
+            if (rawBody) {
+                const decryptedMessage = yield shared_1.subtle.decryptMessage(parsedBody, verificationKeys.derivedSecretKey);
+                decryptedBody = JSON.parse(decryptedMessage !== null && decryptedMessage !== void 0 ? decryptedMessage : '{}');
             }
-            const [requestBody, processResponse] = yield _getVerifiedBody(req, res, targetPath);
-            console.log(`>>> > handleProxy > requestBody, processResponse:`, requestBody, processResponse);
-            const _prepareHeaders = (0, utils_1.prepareHeaders)(serverRuntimeConfig);
-            const headers = yield _prepareHeaders({
-                generateReplacements,
-                shop,
-                appId,
-                headers: Object.assign(Object.assign({}, _headers), targetHeaders),
-            });
-            const proxy = http_proxy_1.default.createProxy();
-            return new Promise((resolve, reject) => {
-                req.url = targetPath;
-                if (headers) {
-                    req.headers = headers;
+        }
+        const _prepareHeaders = (0, utils_1.prepareHeaders)(serverRuntimeConfig);
+        const headers = yield _prepareHeaders({
+            generateReplacements,
+            shop,
+            appId,
+            headers: Object.assign(Object.assign(Object.assign({}, !isVerifiable && Object.assign({}, verificationHeaders)), proxyableHeaders), targetHeaders),
+        });
+        const proxy = http_proxy_1.default.createProxy();
+        return new Promise((resolve, reject) => {
+            req.url = targetPath;
+            if (headers) {
+                req.headers = headers;
+            }
+            proxy.on('proxyReq', (proxyReq, proxyReqRequest, proxyReqResponse, options) => {
+                if ((0, shared_1.objectNotEmpty)(decryptedBody)) {
+                    const bodyData = JSON.stringify(decryptedBody);
+                    proxyReq.setHeader('Content-Length', Buffer.byteLength(bodyData));
+                    proxyReq.write(bodyData);
                 }
-                proxy.on('proxyReq', (proxyReq, proxyReqRequest, proxyReqResponse, options) => {
-                    if ((0, shared_1.objectNotEmpty)(requestBody)) {
-                        const bodyData = JSON.stringify(requestBody);
-                        proxyReq.setHeader('Content-Length', Buffer.byteLength(bodyData));
-                        proxyReq.write(bodyData);
+            });
+            proxy.on('proxyRes', function (proxyRes, proxyResRequest, proxyResResponse) {
+                (0, node_http_proxy_json_1.default)(proxyResResponse, proxyRes, function (proxyResBody) {
+                    if (!proxyResBody || !isVerifiable || !verificationKeys) {
+                        return proxyResBody;
                     }
-                });
-                proxy.on('proxyRes', function (proxyRes, proxyResRequest, proxyResResponse) {
-                    (0, node_http_proxy_json_1.default)(proxyResResponse, proxyRes, function (proxyResBody) {
-                        return processResponse(proxyResBody);
-                    });
-                });
-                proxy.once('error', (error) => {
-                    console.error('Proxy error', error);
-                    reject(error);
-                });
-                proxy.web(req, res, {
-                    target,
-                    timeout: PROXY_TIMEOUT,
-                    proxyTimeout: PROXY_TIMEOUT,
-                    followRedirects: false,
-                    changeOrigin: true,
-                    secure: true,
+                    return shared_1.subtle.encryptMessage(JSON.stringify(proxyResBody), verificationKeys.derivedSecretKey);
                 });
             });
-        }
-        catch (error) {
-            console.error(`Error handling proxy request for '${targetPath}'`, error);
-            return res.status(200).json({ message: (error === null || error === void 0 ? void 0 : error.message) || 'Error handling proxy request', targetPath });
-        }
-    });
-};
+            proxy.once('error', (error) => {
+                console.error('Proxy error', error);
+                reject(error);
+            });
+            proxy.web(req, res, {
+                target,
+                timeout: PROXY_TIMEOUT,
+                proxyTimeout: PROXY_TIMEOUT,
+                followRedirects: false,
+                changeOrigin: true,
+                secure: true,
+            });
+        });
+    }
+    catch (error) {
+        console.error(`Error handling proxy request for '${targetPath}'`, error);
+        return res.status(200).json({ message: (error === null || error === void 0 ? void 0 : error.message) || 'Error handling proxy request', targetPath });
+    }
+});
 exports.handleProxy = handleProxy;
 //# sourceMappingURL=proxy.js.map