@agnostack/next-shopify 1.7.3-beta.1 → 1.7.3-beta.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/handlers/api/proxy.js +15 -8
- package/dist/handlers/api/proxy.js.map +1 -1
- package/dist/utils/crypto.d.ts +2 -0
- package/dist/utils/crypto.js +19 -0
- package/dist/utils/crypto.js.map +1 -0
- package/dist/utils/index.d.ts +1 -0
- package/dist/utils/index.js +1 -0
- package/dist/utils/index.js.map +1 -1
- package/package.json +1 -1
|
@@ -21,8 +21,9 @@ const http_proxy_1 = __importDefault(require("http-proxy"));
|
|
|
21
21
|
const nextjs_cors_1 = __importDefault(require("nextjs-cors"));
|
|
22
22
|
const utils_1 = require("../../utils");
|
|
23
23
|
const PROXY_TIMEOUT = 6000; // NOTE: 6 seconds
|
|
24
|
+
const verifyAppProxySignature = (signature, sharedSecret, data) => (utils_1.compareHashes(signature, utils_1.generateHMAC(data, sharedSecret)));
|
|
24
25
|
const handleProxy = (serverRuntimeConfig) => async (req, res, _params) => {
|
|
25
|
-
const { SETTING_REPLACEMENTS, TARGET_SAFELIST, ORIGIN_SAFELIST } = serverRuntimeConfig;
|
|
26
|
+
const { SHOPIFY_API_KEY, SETTING_REPLACEMENTS, TARGET_SAFELIST, ORIGIN_SAFELIST } = serverRuntimeConfig;
|
|
26
27
|
const targetSafelist = utils_1.ensureObject(TARGET_SAFELIST);
|
|
27
28
|
const targetOriginsSafelist = Object.keys(targetSafelist);
|
|
28
29
|
const originsSafelist = [
|
|
@@ -58,17 +59,23 @@ const handleProxy = (serverRuntimeConfig) => async (req, res, _params) => {
|
|
|
58
59
|
return res.status(407).json({ message: 'Unproxyable target.' });
|
|
59
60
|
}
|
|
60
61
|
const { query: _query, headers: _headers } = req;
|
|
62
|
+
const query = utils_1.ensureObject(_query);
|
|
61
63
|
// TODO!!!!!!: update this to not send as querystring/get via app itself somehow on backend?
|
|
62
|
-
const {
|
|
64
|
+
const { signature } = query, verifiable = __rest(query, ["signature"]);
|
|
65
|
+
const { shop: _shop, host: _host, timestamp } = verifiable;
|
|
63
66
|
// TODO: explore moving this to sessionToken middleware??
|
|
64
67
|
const _a = _headers !== null && _headers !== void 0 ? _headers : {}, { 'x-extension-session': sessionToken, 'x-extension-point': extensionPoint } = _a, __headers = __rest(_a, ['x-extension-session', 'x-extension-point']);
|
|
65
|
-
if (!_shop || !_host || !extensionPoint || !
|
|
66
|
-
return res.status(400).json({ message: 'Invalid or missing headers.',
|
|
68
|
+
if (!_shop || !_host || !extensionPoint || !signature) {
|
|
69
|
+
return res.status(400).json({ message: 'Invalid or missing headers.', extensionPoint });
|
|
67
70
|
}
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
if (
|
|
71
|
-
|
|
71
|
+
const isGood = verifyAppProxySignature(signature, (extensionPoint === 'theme') ? timestamp : SHOPIFY_API_KEY, verifiable);
|
|
72
|
+
console.log(`>>> > handleProxy > isGood: '${isGood}'`, extensionPoint);
|
|
73
|
+
if (sessionToken) {
|
|
74
|
+
// NOTE: this does not contain sid for some reason (presuming permission approval)
|
|
75
|
+
const { shop, host } = utils_1.decodeShopData(sessionToken);
|
|
76
|
+
if ((shop !== _shop) || (host !== _host)) {
|
|
77
|
+
return res.status(403).json({ message: 'Unauthorized shop or host.' });
|
|
78
|
+
}
|
|
72
79
|
}
|
|
73
80
|
// TODO: explore adding hmac check/middleware?
|
|
74
81
|
const setting = utils_1.ensureObject(SETTING_REPLACEMENTS);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../../src/handlers/api/proxy.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,sDAAsD;AACtD,gDAAgD;AAChD,4DAAkC;AAClC,8DAAkC;AAElC,
|
|
1
|
+
{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../../src/handlers/api/proxy.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,sDAAsD;AACtD,gDAAgD;AAChD,4DAAkC;AAClC,8DAAkC;AAElC,uCAWoB;AAEpB,MAAM,aAAa,GAAG,IAAI,CAAA,CAAC,kBAAkB;AAE7C,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,CACjE,qBAAa,CAAC,SAAS,EAAE,oBAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAC3D,CAAA;AAEM,MAAM,WAAW,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAC9E,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAA;IAEvG,MAAM,cAAc,GAAG,oBAAY,CAAC,eAAe,CAAC,CAAA;IACpD,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACzD,MAAM,eAAe,GAAG;QACtB,GAAG,mBAAW,CAAC,eAAe,CAAC;QAC/B,yBAAyB;KAC1B,CAAA;IAED,MAAM,qBAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACvB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAC3C,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;;YAC3B,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBACpC,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;aAC5B;YAED,IAAI,KAAK,CAAA;YACT,IAAI;gBACF,KAAK,GAAG,oBAAY,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;aACpF;YAAC,OAAO,MAAM,EAAE;gBACf,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,MAAM,CAAC,CAAA;aACtD;YAED,IAAI,KAAK,IAAI,sBAAc,CAAC,MAAA,4BAAoB,CAAC,KAAK,CAAC,0CAAE,IAAI,CAAC,EAAE;gBAC9D,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;aAC5B;YAED,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA;QACnD,CAAC;QACD,oBAAoB,EAAE,GAAG,EAAE,6DAA6D;KACzF,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,oBAAS,CAAC,WAAW,EAAE,CAAA;IAErC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAA;IACzC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACtF,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,sBAAc,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEpE,IAAI,CAAC,SAAS,IAAI,kBAAU,CAAC,qBAAqB,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAChG,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAA;KAChE;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAA;IAChD,MAAM,KAAK,GAAG,oBAAY,CAAC,MAAM,CAAC,CAAA;IAClC,4FAA4F;IAC5F,MAAM,EAAE,SAAS,KAAoB,KAAK,EAApB,UAAU,UAAK,KAAK,EAApC,aAA4B,CAAQ,CAAA;IAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAA;IAE1D,yDAAyD;IACzD,MAAM,KAIF,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,EAJZ,EACJ,qBAAqB,EAAE,YAAY,EACnC,mBAAmB,EAAE,cAAc,OAEnB,EADb,SAAS,cAHR,4CAIL,CAAiB,CAAA;IAClB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE;QACrD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,CAAC,CAAA;KACxF;IAED,MAAM,MAAM,GAAG,uBAAuB,CACpC,SAAS,EACT,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAC1D,UAAU,CACX,CAAA;IACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,GAAG,EAAE,cAAc,CAAC,CAAA;IAEtE,IAAI,YAAY,EAAE;QAChB,kFAAkF;QAClF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,sBAAc,CAAC,YAAY,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE;YACxC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAA;SACvE;KACF;IAED,8CAA8C;IAC9C,MAAM,OAAO,GAAG,oBAAY,CAAC,oBAAoB,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAC5E,gBAAgB,EAChB,CAAC,MAAM,EAAE,WAAW,CAAC,EACrB,EAAE,CAAC,iCACA,gBAAgB,KACnB,CAAC,MAAM,CAAC,EAAE,uBAAe,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,IACnD,EAAE,SAAS,CAAC,CAAA;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;QACnB,GAAG,CAAC,OAAO,GAAG,OAAO,CAAA;QAErB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAE3B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YAClB,MAAM;YACN,OAAO,EAAE,aAAa;YACtB,YAAY,EAAE,aAAa;YAC3B,eAAe,EAAE,KAAK;YACtB,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,IAAI;SACb,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAnGY,QAAA,WAAW,eAmGvB"}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
3
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
4
|
+
};
|
|
5
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
6
|
+
exports.compareHashes = exports.generateHMAC = void 0;
|
|
7
|
+
const crypto_1 = __importDefault(require("crypto"));
|
|
8
|
+
const generateHMAC = (message, apiSecret, digest = 'hex') => (crypto_1.default.createHmac('sha256', apiSecret)
|
|
9
|
+
.update(message)
|
|
10
|
+
.digest(digest));
|
|
11
|
+
exports.generateHMAC = generateHMAC;
|
|
12
|
+
const compareHashes = (digestHash, checkSumHash, encoding = 'utf-8') => {
|
|
13
|
+
const digest = Buffer.from(digestHash, encoding);
|
|
14
|
+
const checkSum = Buffer.from(checkSumHash, encoding);
|
|
15
|
+
return ((digest.length === checkSum.length) &&
|
|
16
|
+
crypto_1.default.timingSafeEqual(digest, checkSum));
|
|
17
|
+
};
|
|
18
|
+
exports.compareHashes = compareHashes;
|
|
19
|
+
//# sourceMappingURL=crypto.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.js"],"names":[],"mappings":";;;;;;AAAA,oDAA2B;AAEpB,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,KAAK,EAAE,EAAE,CAAC,CAClE,gBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;KACnC,MAAM,CAAC,OAAO,CAAC;KACf,MAAM,CAAC,MAAM,CAAC,CAClB,CAAA;AAJY,QAAA,YAAY,gBAIxB;AAEM,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,GAAG,OAAO,EAAE,EAAE;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;IAEpD,OAAO,CACL,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;QACnC,gBAAM,CAAC,eAAe,CACpB,MAAM,EACN,QAAQ,CACT,CACF,CAAA;AACH,CAAC,CAAA;AAXY,QAAA,aAAa,iBAWzB"}
|
package/dist/utils/index.d.ts
CHANGED
package/dist/utils/index.js
CHANGED
|
@@ -12,6 +12,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
|
12
12
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
13
13
|
__exportStar(require("./billing"), exports);
|
|
14
14
|
__exportStar(require("./constants"), exports);
|
|
15
|
+
__exportStar(require("./crypto"), exports);
|
|
15
16
|
__exportStar(require("./display"), exports);
|
|
16
17
|
__exportStar(require("./errors"), exports);
|
|
17
18
|
__exportStar(require("./firebase"), exports);
|
package/dist/utils/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.js"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4CAAyB;AACzB,8CAA2B;AAC3B,4CAAyB;AACzB,2CAAwB;AACxB,6CAA0B;AAC1B,4CAAyB;AACzB,4CAAyB"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.js"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4CAAyB;AACzB,8CAA2B;AAC3B,2CAAwB;AACxB,4CAAyB;AACzB,2CAAwB;AACxB,6CAA0B;AAC1B,4CAAyB;AACzB,4CAAyB"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agnostack/next-shopify",
|
|
3
|
-
"version": "1.7.3-beta.
|
|
3
|
+
"version": "1.7.3-beta.2",
|
|
4
4
|
"author": "agnoStack Dev <developers@agnostack.com> (https://agnostack.com)",
|
|
5
5
|
"owner": "agnoStack",
|
|
6
6
|
"description": "Please contact agnoStack via info@agnostack.com for any questions",
|