@drawbridge/drawbridge-utils 0.0.175 → 0.0.177

package/dist/shopify/oauth.cjs

@@ -0,0 +1,509 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/shopify/oauth.js
+var oauth_exports = {};
+__export(oauth_exports, {
+  SHOPIFY_REQUIRED_SCOPES: () => SHOPIFY_REQUIRED_SCOPES,
+  createStorefrontToken: () => createStorefrontToken,
+  getAdminToken: () => getAdminToken,
+  getShop: () => getShop,
+  missingScopes: () => missingScopes,
+  ping: () => ping,
+  refreshAdminToken: () => refreshAdminToken,
+  resolveConnectionSettings: () => resolveConnectionSettings
+});
+module.exports = __toCommonJS(oauth_exports);
+
+// lib/encrypt.js
+var import_crypto2 = __toESM(require("crypto"), 1);
+
+// lib/token.js
+var import_crypto = __toESM(require("crypto"), 1);
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = import_crypto.default.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+
+// lib/encrypt.js
+var ALGORITHM = "aes-256-gcm";
+var getKey = () => Buffer.from(process.env.ENCRYPT_CONNECTION_SECRET, "hex");
+var encrypt = (value) => {
+  const iv = generate(12, null);
+  const cipher = import_crypto2.default.createCipheriv(ALGORITHM, getKey(), iv);
+  const data = Buffer.concat([
+    cipher.update(JSON.stringify(value), "utf8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  return [iv, tag, data].map((b) => b.toString("hex")).join(":");
+};
+var decrypt = (value) => {
+  if (typeof value !== "string") return value;
+  const [ivHex, tagHex, dataHex] = value.split(":");
+  const decipher = import_crypto2.default.createDecipheriv(
+    ALGORITHM,
+    getKey(),
+    Buffer.from(ivHex, "hex")
+  );
+  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+  const result = Buffer.concat([
+    decipher.update(Buffer.from(dataHex, "hex")),
+    decipher.final()
+  ]);
+  return JSON.parse(result.toString("utf8"));
+};
+
+// lib/http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var request = async ({
+  body,
+  // THE TRANSPORT, injectable and defaulted to the real one.
+  //
+  // Every other vendor client in this package takes a `fetcher` — it is how
+  // klaviyo, mailchimp and attentive are tested without a network, and it is a
+  // declared HOOK_OPTION. The Shopify client had no seam at all, so the only way
+  // to test a hook that used it was to inject the whole SDK namespace; that
+  // injection existed to work around an import cycle, and when the cycle went
+  // the tests lost their only hold. This is the seam they should have had.
+  fetcher = fetch,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const fullUrl = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([k, v]) => fullUrl.searchParams.set(k, v));
+  }
+  ;
+  const isForm = type === "form";
+  const response = await fetcher(fullUrl.toString(), {
+    method,
+    headers: {
+      "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+      ...headers
+    },
+    signal: AbortSignal.timeout(timeout),
+    ...body !== void 0 && {
+      body: isForm ? new URLSearchParams(body).toString() : JSON.stringify(body)
+    }
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    const error = new Error(text2 || response.statusText);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const text = await response.text();
+  try {
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+};
+
+// lib/shopify/constants.js
+var SHOPIFY_ADMIN_API_VERSION = "2026-04";
+var SHOPIFY_REQUIRED_SCOPES = [
+  "read_customers",
+  "write_customers",
+  "read_discounts",
+  "write_discounts",
+  "read_orders",
+  "read_products",
+  "read_publications",
+  "write_resource_feedbacks",
+  "unauthenticated_read_checkouts",
+  "unauthenticated_read_product_inventory",
+  "unauthenticated_read_product_listings",
+  "unauthenticated_write_checkouts"
+];
+var REFRESH_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
+var ACCESS_TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var PARTNER_API_VERSION = process.env.SHOPIFY_PARTNER_API_VERSION || "2026-07";
+
+// lib/shopify/admin.js
+var adminUrl = (domain) => `https://${domain}/admin/api/${SHOPIFY_ADMIN_API_VERSION}`;
+var adminFetch = async ({ adminAccessToken, domain, fetcher, query, variables }) => {
+  var _a;
+  const { data, errors } = await request({
+    fetcher,
+    method: "POST",
+    url: adminUrl(domain) + "/graphql.json",
+    headers: {
+      "X-Shopify-Access-Token": adminAccessToken
+    },
+    body: {
+      query,
+      ...variables && { variables }
+    }
+  });
+  if (errors) {
+    throw new Error("Shopify GraphQL error: " + ((_a = errors[0]) == null ? void 0 : _a.message));
+  }
+  ;
+  return data;
+};
+
+// lib/shopify/oauth.js
+var required = (name, value) => {
+  if (!value) {
+    throw new Error("Shopify " + name + " is required");
+  }
+  ;
+  return value;
+};
+var missingScopes = (granted) => {
+  const grantedSet = new Set(
+    (Array.isArray(granted) ? granted : String(granted || "").split(",")).map((scope) => scope.trim()).filter(Boolean)
+  );
+  const satisfied = (scope) => grantedSet.has(scope) || grantedSet.has(scope.replace(/(^|_)read_/, "$1write_"));
+  return SHOPIFY_REQUIRED_SCOPES.filter((scope) => !satisfied(scope));
+};
+var ping = async ({ fetcher, adminAccessToken, domain }) => {
+  var _a;
+  const response = await fetch(
+    `https://${domain}/admin/api/${SHOPIFY_ADMIN_API_VERSION}/graphql.json`,
+    {
+      body: JSON.stringify({ query: "{ shop { name } }" }),
+      headers: {
+        "Content-Type": "application/json",
+        "X-Shopify-Access-Token": adminAccessToken
+      },
+      method: "POST"
+    }
+  );
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    const error = new Error(response.status + ": " + text);
+    error.status = response.status;
+    throw error;
+  }
+  ;
+  const { errors } = await response.json().catch(() => ({}));
+  if (errors == null ? void 0 : errors.length) {
+    throw new Error("GraphQL: " + (((_a = errors[0]) == null ? void 0 : _a.message) || "unknown error"));
+  }
+  ;
+};
+var OAUTH_ERROR_TITLE_PATTERN = /Oauth error (\w+)/i;
+var parseOAuthErrorCode = (text) => {
+  var _a;
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed == null ? void 0 : parsed.error) return parsed.error;
+  } catch {
+  }
+  ;
+  return ((_a = text.match(OAUTH_ERROR_TITLE_PATTERN)) == null ? void 0 : _a[1]) || null;
+};
+var shopifyOAuthFetch = async (url, body) => {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    const error = new Error(response.status + ": " + text);
+    error.status = response.status;
+    error.code = parseOAuthErrorCode(text);
+    throw error;
+  }
+  ;
+  return response.json();
+};
+var getShop = async ({ fetcher, adminAccessToken, shop }) => {
+  const data = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain: shop,
+    query: `{
+			shop {
+				currencyCode
+				id
+				myshopifyDomain
+				name
+			}
+		}`
+  });
+  const shopData = data == null ? void 0 : data.shop;
+  if (!(shopData == null ? void 0 : shopData.id)) {
+    throw new Error("Shopify shop lookup failed: no shop returned");
+  }
+  ;
+  return {
+    currency: shopData.currencyCode || null,
+    id: shopData.id.split("/").pop(),
+    myshopifyDomain: shopData.myshopifyDomain,
+    name: shopData.name
+  };
+};
+var createStorefrontToken = async ({ fetcher, adminAccessToken, shop }) => {
+  var _a, _b, _c, _d, _e;
+  try {
+    const listed = await adminFetch({
+      fetcher,
+      adminAccessToken,
+      domain: shop,
+      query: `{
+				shop {
+					storefrontAccessTokens(first: 100) {
+						edges {
+							node {
+								id
+								title
+							}
+						}
+					}
+				}
+			}`
+    });
+    const existing = (((_b = (_a = listed == null ? void 0 : listed.shop) == null ? void 0 : _a.storefrontAccessTokens) == null ? void 0 : _b.edges) || []).map((edge) => edge == null ? void 0 : edge.node);
+    const orphaned = existing.filter((token) => (token == null ? void 0 : token.title) === "Drawbridge");
+    await Promise.allSettled(
+      orphaned.map((token) => adminFetch({
+        adminAccessToken,
+        domain: shop,
+        query: `
+					mutation StorefrontAccessTokenDelete($input: StorefrontAccessTokenDeleteInput!) {
+						storefrontAccessTokenDelete(input: $input) {
+							deletedStorefrontAccessTokenId
+							userErrors {
+								field
+								message
+							}
+						}
+					}
+				`,
+        variables: {
+          input: {
+            id: token.id
+          }
+        }
+      }))
+    );
+  } catch {
+  }
+  const created = await adminFetch({
+    fetcher,
+    adminAccessToken,
+    domain: shop,
+    query: `
+			mutation StorefrontAccessTokenCreate($input: StorefrontAccessTokenInput!) {
+				storefrontAccessTokenCreate(input: $input) {
+					storefrontAccessToken {
+						accessToken
+					}
+					userErrors {
+						field
+						message
+					}
+				}
+			}
+		`,
+    variables: {
+      input: {
+        title: "Drawbridge"
+      }
+    }
+  });
+  const createErrors = (_c = created == null ? void 0 : created.storefrontAccessTokenCreate) == null ? void 0 : _c.userErrors;
+  if (createErrors == null ? void 0 : createErrors.length) {
+    throw new Error("Shopify storefront token create failed: " + createErrors[0].message);
+  }
+  ;
+  return ((_e = (_d = created == null ? void 0 : created.storefrontAccessTokenCreate) == null ? void 0 : _d.storefrontAccessToken) == null ? void 0 : _e.accessToken) || null;
+};
+var resolveTokenContext = async ({ connection, controller }) => {
+  const decrypted = (connection == null ? void 0 : connection.settings) ? decrypt(connection.settings) : {};
+  if ((decrypted == null ? void 0 : decrypted.ref) !== "shop") {
+    return {
+      raw: (connection == null ? void 0 : connection.settings) || null,
+      session: null,
+      settings: decrypted,
+      shop: null,
+      target: "connection"
+    };
+  }
+  ;
+  const shop = decrypted.shop;
+  if (!controller || !shop) {
+    return { raw: null, session: {}, settings: {}, shop, target: "shop" };
+  }
+  ;
+  const record = await controller.get({ collection: "shop", query: { shop } });
+  const session = (record == null ? void 0 : record.settings) ? decrypt(record.settings) : {};
+  const storefront = (record == null ? void 0 : record.storefront) ? decrypt(record.storefront) : null;
+  return {
+    raw: (record == null ? void 0 : record.settings) || null,
+    session,
+    settings: {
+      adminAccessToken: session.accessToken || null,
+      refreshToken: session.refreshToken || null,
+      refreshTokenExpiresAt: session.refreshTokenExpires || null,
+      storefrontAccessToken: (storefront == null ? void 0 : storefront.token) || null,
+      tokenExpiresAt: session.expires || null
+    },
+    shop,
+    target: "shop"
+  };
+};
+var resolveConnectionSettings = async ({ fetcher, connection, controller }) => {
+  const { settings } = await resolveTokenContext({ connection, controller });
+  return settings;
+};
+var refreshAdminToken = async ({ fetcher, clientId, clientSecret, connection, controller }) => {
+  var _a;
+  const { raw, session, settings, shop, target } = await resolveTokenContext({ connection, controller });
+  const domain = (connection == null ? void 0 : connection.shop) || ((_a = settings.source) == null ? void 0 : _a.domain) || settings.domain || shop;
+  const { refreshToken } = settings;
+  const data = await shopifyOAuthFetch(
+    `https://${domain}/admin/oauth/access_token`,
+    {
+      grant_type: "refresh_token",
+      // Throw before the grant: rotation RETIRES the old pair the moment it
+      // returns, so a credential-less call that Shopify rejects opaquely is
+      // the one failure mode worth being loud about.
+      client_id: required("clientId", clientId),
+      client_secret: required("clientSecret", clientSecret),
+      refresh_token: refreshToken
+    }
+  );
+  const adminAccessToken = data.access_token;
+  const newRefreshToken = data.refresh_token;
+  const expiresIn = data.expires_in;
+  const tokenExpiresAt = expiresIn ? new Date(Date.now() + expiresIn * 1e3) : null;
+  const refreshTokenExpiresAt = new Date(Date.now() + REFRESH_TOKEN_LIFETIME_MS);
+  let liveToken = adminAccessToken;
+  if (target === "shop") {
+    const written = await controller.update({
+      collection: "shop",
+      data: {
+        $set: {
+          settings: encrypt({
+            ...session,
+            accessToken: adminAccessToken,
+            expires: tokenExpiresAt,
+            refreshToken: newRefreshToken,
+            refreshTokenExpires: refreshTokenExpiresAt
+          })
+        }
+      },
+      query: {
+        shop,
+        ...raw && { settings: raw }
+      }
+    });
+    if (!written) {
+      const current = await controller.get({ collection: "shop", query: { shop } });
+      if (!(current == null ? void 0 : current.settings)) {
+        throw new Error("Shopify token refresh write-back failed: shop record missing for " + shop);
+      }
+      ;
+      const currentSession = decrypt(current.settings);
+      if ((currentSession == null ? void 0 : currentSession.accessToken) && currentSession.accessToken !== settings.adminAccessToken) {
+        liveToken = currentSession.accessToken;
+      } else {
+        throw new Error("Shopify token refresh write-back failed for " + shop);
+      }
+      ;
+    }
+    ;
+  } else {
+    const written = await controller.update({
+      collection: "connection",
+      data: {
+        $set: {
+          settings: encrypt({
+            ...settings,
+            adminAccessToken,
+            refreshToken: newRefreshToken,
+            refreshTokenExpiresAt,
+            tokenExpiresAt
+          })
+        }
+      },
+      query: {
+        id: connection.id,
+        ...raw && { settings: raw }
+      }
+    });
+    if (!written) {
+      const current = await controller.get({ collection: "connection", query: { id: connection.id } });
+      const currentSettings = (current == null ? void 0 : current.settings) ? decrypt(current.settings) : null;
+      if ((currentSettings == null ? void 0 : currentSettings.adminAccessToken) && currentSettings.adminAccessToken !== settings.adminAccessToken) {
+        liveToken = currentSettings.adminAccessToken;
+      } else {
+        throw new Error("Shopify token refresh write-back failed for connection " + (connection == null ? void 0 : connection.id));
+      }
+      ;
+    }
+    ;
+  }
+  ;
+  await ping({ adminAccessToken: liveToken, domain });
+  return liveToken;
+};
+var getAdminToken = async ({ fetcher, clientId, clientSecret, connection, controller }) => {
+  required("clientId", clientId);
+  required("clientSecret", clientSecret);
+  const settings = await resolveConnectionSettings({ connection, controller });
+  const { adminAccessToken, refreshToken, tokenExpiresAt } = settings;
+  if (!adminAccessToken) {
+    return null;
+  }
+  ;
+  if (!refreshToken) {
+    return adminAccessToken;
+  }
+  ;
+  const needsRefresh = !tokenExpiresAt || new Date(tokenExpiresAt) < new Date(Date.now() + ACCESS_TOKEN_REFRESH_BUFFER_MS);
+  if (needsRefresh) {
+    return refreshAdminToken({ clientId, clientSecret, connection, controller });
+  }
+  ;
+  return adminAccessToken;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SHOPIFY_REQUIRED_SCOPES,
+  createStorefrontToken,
+  getAdminToken,
+  getShop,
+  missingScopes,
+  ping,
+  refreshAdminToken,
+  resolveConnectionSettings
+});

package/dist/shopify/oauth.d.cts

@@ -0,0 +1,7 @@
+import '../encrypt.cjs';
+import '../admin-B9ZaLvan.cjs';
+export { SHOPIFY_REQUIRED_SCOPES } from './constants.cjs';
+export { c as createStorefrontToken, g as getAdminToken, a as getShop, m as missingScopes, p as ping, r as refreshAdminToken, b as resolveConnectionSettings } from '../oauth-BJDh0sdM.cjs';
+import 'crypto';
+import '../token.cjs';
+import '../http.cjs';

package/dist/shopify/oauth.d.ts

@@ -0,0 +1,7 @@
+import '../encrypt.js';
+import '../admin-C3HtEM6h.js';
+export { SHOPIFY_REQUIRED_SCOPES } from './constants.js';
+export { c as createStorefrontToken, g as getAdminToken, a as getShop, m as missingScopes, p as ping, r as refreshAdminToken, b as resolveConnectionSettings } from '../oauth-DveZMLHx.js';
+import 'crypto';
+import '../token.js';
+import '../http.js';