@shopify/cli-kit 3.38.0 → 3.40.0

package/assets/cli-ruby/lib/shopify_cli/heroku.rb

@@ -0,0 +1,140 @@
+module ShopifyCLI
+  class Heroku
+    DOWNLOAD_URLS = {
+      linux: "https://cli-assets.heroku.com/heroku-linux-x64.tar.gz",
+      mac: "https://cli-assets.heroku.com/heroku-darwin-x64.tar.gz",
+      windows: "https://cli-assets.heroku.com/heroku-x64.exe",
+      mac_m1: "https://cli-assets.heroku.com/heroku-darwin-x64.tar.gz",
+    }
+
+    def initialize(ctx)
+      @ctx = ctx
+    end
+
+    def app
+      return nil unless (app = git_remote)
+      app = app.split("/").last
+      app = app.split(".").first
+      app
+    end
+
+    def authenticate
+      result = @ctx.system(heroku_command, "login")
+      @ctx.abort(@ctx.message("core.heroku.error.authentication")) unless result.success?
+    end
+
+    def create_new_app
+      output, status = @ctx.capture2e(heroku_command, "create")
+      @ctx.abort(@ctx.message("core.heroku.error.creation")) unless status.success?
+      @ctx.puts(output)
+    end
+
+    def deploy(branch_to_deploy)
+      result = @ctx.system("git", "push", "-u", "heroku", "#{branch_to_deploy}:master")
+      @ctx.abort(@ctx.message("core.heroku.error.deploy")) unless result.success?
+    end
+
+    def download
+      return if installed?
+
+      result = @ctx.system("curl", "-o", download_path, DOWNLOAD_URLS[@ctx.os], chdir: ShopifyCLI.cache_dir)
+      @ctx.abort(@ctx.message("core.heroku.error.download")) unless result.success?
+      @ctx.abort(@ctx.message("core.heroku.error.download")) unless File.exist?(download_path)
+    end
+
+    def install
+      return if installed?
+
+      result = if @ctx.windows?
+        @ctx.system("\"#{download_path}\"")
+      else
+        @ctx.system("tar", "-xf", download_path, chdir: ShopifyCLI.cache_dir)
+      end
+      @ctx.abort(@ctx.message("core.heroku.error.install")) unless result.success?
+
+      @ctx.rm(download_path)
+    end
+
+    def select_existing_app(app_name)
+      result = @ctx.system(heroku_command, "git:remote", "-a", app_name)
+
+      msg = @ctx.message("core.heroku.error.could_not_select_app", app_name)
+      @ctx.abort(msg) unless result.success?
+    end
+
+    def whoami
+      output, status = @ctx.capture2e(heroku_command, "whoami")
+      return output.strip if status.success?
+      nil
+    end
+
+    def get_config(config)
+      output, status = @ctx.capture2e(heroku_command, "config:get", config.to_s)
+      return output.strip if status.success?
+      nil
+    end
+
+    def set_config(config, value)
+      result = @ctx.system(heroku_command, "config:set", "#{config}=#{value}")
+
+      msg = @ctx.message("core.heroku.error.set_config", config, value)
+      @ctx.abort(msg) unless result.success?
+    end
+
+    def add_buildpacks(buildpacks)
+      result = @ctx.system(heroku_command, "buildpacks:clear")
+      msg = @ctx.message("core.heroku.error.add_buildpacks")
+      @ctx.abort(msg) unless result.success?
+
+      buildpacks.each do |buildpack|
+        result = @ctx.system(heroku_command, "buildpacks:add", buildpack)
+        msg = @ctx.message("core.heroku.error.add_buildpacks")
+        @ctx.abort(msg) unless result.success?
+      end
+    end
+
+    def heroku_command
+      local_path = File.join(ShopifyCLI.cache_dir, "heroku", "bin", "heroku").to_s
+      if File.exist?(local_path)
+        local_path
+      elsif @ctx.windows?
+        begin
+          # Check if Heroku exists in the Windows registry and run it from there
+          require "win32/registry"
+
+          windows_path = Win32::Registry::HKEY_CURRENT_USER.open('SOFTWARE\heroku') do |reg|
+            reg[""] # This reads the 'Default' registry key
+          end
+
+          File.join(windows_path, "bin", "heroku").to_s
+        rescue StandardError, LoadError
+          "heroku"
+        end
+      else
+        "heroku"
+      end
+    end
+
+    private
+
+    def download_filename
+      URI.parse(DOWNLOAD_URLS[@ctx.os]).path.split("/").last
+    end
+
+    def download_path
+      File.join(ShopifyCLI.cache_dir, download_filename)
+    end
+
+    def git_remote
+      output, status = @ctx.capture2e("git", "remote", "get-url", "heroku")
+      status.success? ? output : nil
+    end
+
+    def installed?
+      _output, status = @ctx.capture2e(heroku_command, "--version")
+      status.success?
+    rescue
+      false
+    end
+  end
+end

package/assets/cli-ruby/lib/shopify_cli/http_request.rb

@@ -0,0 +1,43 @@
+require "net/http"
+require "openssl"
+
+module ShopifyCLI
+  class HttpRequest
+    class << self
+      def post(uri, body, headers)
+        req = ::Net::HTTP::Post.new(uri.request_uri)
+        request(uri, body, headers, req)
+      end
+
+      def put(uri, body, headers)
+        req = ::Net::HTTP::Put.new(uri.request_uri)
+        request(uri, body, headers, req)
+      end
+
+      def get(uri, body, headers)
+        req = ::Net::HTTP::Get.new(uri.request_uri)
+        request(uri, body, headers, req)
+      end
+
+      def delete(uri, body, headers)
+        req = ::Net::HTTP::Delete.new(uri.request_uri)
+        request(uri, body, headers, req)
+      end
+
+      def request(uri, body, headers, req)
+        cert_store = OpenSSL::X509::Store.new
+        cert_store.set_default_paths
+
+        http = ::Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = true
+        http.cert_store = cert_store
+        http.verify_mode = OpenSSL::SSL::VERIFY_NONE if ENV["SSL_VERIFY_NONE"]
+
+        req.body = body unless body.nil?
+        req["Content-Type"] = "application/json"
+        headers.each { |header, value| req[header] = value }
+        http.request(req)
+      end
+    end
+  end
+end

package/assets/cli-ruby/lib/shopify_cli/identity_auth/env_auth_token.rb

@@ -0,0 +1,34 @@
+module ShopifyCLI
+  class IdentityAuth
+    class EnvAuthToken
+      Token = Struct.new(:token, :expires_at, keyword_init: true)
+
+      class << self
+        attr_accessor :exchanged_partners_token
+
+        def partners_token_present?
+          Environment.auth_token
+        end
+
+        def fetch_exchanged_partners_token
+          current_time = Time.now.to_i
+
+          # If we have an in-memory token that hasn't expired yet, we reuse it.
+          if exchanged_partners_token && current_time < exchanged_partners_token.expires_at.to_i
+            return exchanged_partners_token.token
+          end
+
+          new_exchanged_token = yield(Environment.auth_token)
+          token = new_exchanged_token["access_token"]
+          expires_in = new_exchanged_token["expires_in"].to_i
+          expires_at = Time.at(current_time + expires_in)
+
+          token = Token.new(token: token, expires_at: expires_at)
+
+          self.exchanged_partners_token = token
+          token.token
+        end
+      end
+    end
+  end
+end

package/assets/cli-ruby/lib/shopify_cli/identity_auth/servlet.rb

@@ -0,0 +1,44 @@
+module ShopifyCLI
+  class IdentityAuth
+    class Servlet < WEBrick::HTTPServlet::AbstractServlet
+      ERB_FILENAME = File.join(ROOT, "lib/shopify_cli/assets/post_auth_page/index.html.erb")
+      CSS_FILENAME = File.join(ROOT, "lib/shopify_cli/assets/post_auth_page/style.css")
+
+      def initialize(server, identity_auth, token)
+        super
+        @server = server
+        @identity_auth = identity_auth
+        @state_token = token
+      end
+
+      def do_GET(req, res) # rubocop:disable Naming/MethodName
+        if !req.query["error"].nil?
+          respond_with(
+            res,
+            400,
+            Context.message("core.identity_auth.servlet.invalid_request_response", req.query["error_description"])
+          )
+        elsif req.query["state"] != @state_token
+          response_message = Context.message("core.identity_auth.servlet.invalid_state_response")
+          req.query.merge!("error" => "invalid_state", "error_description" => response_message)
+          respond_with(res, 403, response_message)
+        else
+          respond_with(res, 200, Context.message("core.identity_auth.servlet.success_response"))
+        end
+        @identity_auth.response_query = req.query
+        @server.shutdown
+      end
+
+      def respond_with(response, status, message)
+        successful = status == 200
+        locals = {
+          status: status,
+          message: message,
+          css: File.read(CSS_FILENAME),
+        }
+        response.status = status
+        response.body = ERB.new(File.read(ERB_FILENAME)).result(binding)
+      end
+    end
+  end
+end

package/assets/cli-ruby/lib/shopify_cli/identity_auth.rb

@@ -0,0 +1,333 @@
+require "base64"
+require "digest"
+require "json"
+require "net/http"
+require "securerandom"
+require "openssl"
+require "shopify_cli"
+require "uri"
+require "webrick"
+
+module ShopifyCLI
+  class IdentityAuth
+    include SmartProperties
+
+    autoload :Servlet, "shopify_cli/identity_auth/servlet"
+    autoload :EnvAuthToken, "shopify_cli/identity_auth/env_auth_token"
+
+    class Error < StandardError; end
+    class Timeout < StandardError; end
+    LocalRequest = Struct.new(:method, :path, :query, :protocol)
+
+    DEFAULT_PORT = 3456
+    REDIRECT_HOST = "http://127.0.0.1:#{DEFAULT_PORT}"
+
+    APPLICATION_SCOPES = {
+      "shopify" => %w[https://api.shopify.com/auth/shop.admin.graphql https://api.shopify.com/auth/shop.admin.themes https://api.shopify.com/auth/partners.collaborator-relationships.readonly],
+      "storefront_renderer_production" => %w[https://api.shopify.com/auth/shop.storefront-renderer.devtools],
+      "partners" => %w[https://api.shopify.com/auth/partners.app.cli.access],
+    }
+
+    APPLICATION_CLIENT_IDS = {
+      "shopify" => "7ee65a63608843c577db8b23c4d7316ea0a01bd2f7594f8a9c06ea668c1b775c",
+      "storefront_renderer_production" => "ee139b3d-5861-4d45-b387-1bc3ada7811c",
+      "partners" => "271e16d403dfa18082ffb3d197bd2b5f4479c3fc32736d69296829cbb28d41a6",
+    }
+
+    DEV_APPLICATION_CLIENT_IDS = {
+      "shopify" => "e92482cebb9bfb9fb5a0199cc770fde3de6c8d16b798ee73e36c9d815e070e52",
+      "storefront_renderer_production" => "46f603de-894f-488d-9471-5b721280ff49",
+      "partners" => "df89d73339ac3c6c5f0a98d9ca93260763e384d51d6038da129889c308973978",
+    }
+
+    EXCHANGE_TOKENS = APPLICATION_SCOPES.keys.map do |key|
+      "#{key}_exchange_token".to_sym
+    end
+
+    IDENTITY_ACCESS_TOKENS = %i[
+      identity_access_token
+      identity_refresh_token
+    ]
+
+    property! :ctx
+    property :store, default: -> { ShopifyCLI::DB.new }
+    property :state_token, accepts: String, default: SecureRandom.hex(30)
+    property :code_verifier, accepts: String, default: SecureRandom.hex(30)
+
+    attr_accessor :response_query
+
+    def authenticate(spinner: false)
+      return if with_spinner(spinner, ctx.message("core.login.spinner.initiating")) do
+        attempt_reauthenticate
+      end
+
+      initiate_authentication
+
+      begin
+        request_access_token(code: receive_access_code)
+      rescue IdentityAuth::Timeout => e
+        ctx.abort(e.message)
+      end
+      with_spinner(spinner, ctx.message("core.login.spinner.finalizing")) do
+        request_exchange_tokens
+      end
+    end
+
+    def with_spinner(spinner, message, &block)
+      result = nil
+      if spinner
+        CLI::UI::Spinner.spin(message) do
+          result = block.call
+        end
+      else
+        result = block.call
+      end
+      result
+    end
+
+    def fetch_or_auth_partners_token
+      if EnvAuthToken.partners_token_present?
+        return Environment.auth_token if Environment.run_as_subprocess?
+        return EnvAuthToken.fetch_exchanged_partners_token do |env_token|
+          exchange_partners_auth_token(env_token)
+        end
+      end
+
+      ShopifyCLI::DB.get(:partners_exchange_token) do
+        IdentityAuth.new(ctx: ctx).authenticate
+        ShopifyCLI::DB.get(:partners_exchange_token)
+      end
+    end
+
+    def exchange_partners_auth_token(subject_token)
+      application = "partners"
+      request_exchange_token(
+        audience: client_id_for_application(application),
+        scopes: APPLICATION_SCOPES[application],
+        subject_token: subject_token,
+      )
+    end
+
+    def self.environment_auth_token?
+      !!Environment.auth_token
+    end
+
+    def self.authenticated?
+      environment_auth_token? || IDENTITY_ACCESS_TOKENS.all? { |key| ShopifyCLI::DB.exists?(key) }
+    end
+
+    def reauthenticate
+      return if attempt_reauthenticate
+      ctx.abort(ctx.message("core.identity_auth.error.reauthenticate", ShopifyCLI::TOOL_NAME))
+    end
+
+    def attempt_reauthenticate
+      refresh_exchange_tokens || refresh_access_tokens
+    end
+
+    def code_challenge
+      @code_challenge ||= Base64.urlsafe_encode64(
+        OpenSSL::Digest::SHA256.digest(code_verifier),
+        padding: false,
+      )
+    end
+
+    def server
+      @server ||= begin
+        server = WEBrick::HTTPServer.new(
+          Port: DEFAULT_PORT,
+          Logger: WEBrick::Log.new(File.open(File::NULL, "w")),
+          AccessLog: [],
+        )
+        server.mount("/", Servlet, self, state_token)
+        server
+      end
+    end
+
+    def self.delete_tokens_and_keys
+      ShopifyCLI::DB.del(*IDENTITY_ACCESS_TOKENS)
+      ShopifyCLI::DB.del(*EXCHANGE_TOKENS)
+    end
+
+    private
+
+    def initiate_authentication
+      @server_thread = Thread.new { server.start }
+      params = {
+        client_id: client_id,
+        scope: scopes(APPLICATION_SCOPES.values.flatten),
+        redirect_uri: REDIRECT_HOST,
+        state: state_token,
+        response_type: :code,
+      }
+      params.merge!(challange_params)
+      uri = URI.parse("#{auth_url}/authorize")
+      uri.query = URI.encode_www_form(params)
+      open_browser_authentication(uri)
+    end
+
+    def open_browser_authentication(uri)
+      ctx.open_browser_url!(uri)
+    end
+
+    def receive_access_code
+      @access_code ||= begin
+        @server_thread.join(240)
+        raise Timeout, ctx.message("core.identity_auth.error.timeout") if response_query.nil?
+        raise Error, response_query["error_description"] unless response_query["error"].nil?
+        response_query["code"]
+      end
+    end
+
+    def request_access_token(code:)
+      resp = post_token_request(
+        grant_type: :authorization_code,
+        code: code,
+        redirect_uri: REDIRECT_HOST,
+        client_id: client_id,
+        code_verifier: code_verifier,
+      )
+      store.set(
+        identity_access_token: resp["access_token"],
+        identity_refresh_token: resp["refresh_token"],
+      )
+    end
+
+    def refresh_access_tokens
+      return false unless IDENTITY_ACCESS_TOKENS.all? { |key| store.exists?(key) }
+
+      resp = post_token_request(
+        grant_type: :refresh_token,
+        access_token: store.get(:identity_access_token),
+        refresh_token: store.get(:identity_refresh_token),
+        client_id: client_id,
+      )
+      store.set(
+        identity_access_token: resp["access_token"],
+        identity_refresh_token: resp["refresh_token"],
+      )
+
+      # Need to refresh the exchange token on successful access token refresh
+      request_exchange_tokens
+
+      true
+    rescue
+      store.del(*IDENTITY_ACCESS_TOKENS)
+      false
+    end
+
+    def refresh_exchange_tokens
+      return false unless EXCHANGE_TOKENS.all? { |key| store.exists?(key) }
+
+      request_exchange_tokens
+
+      true
+    rescue
+      store.del(*EXCHANGE_TOKENS)
+      false
+    end
+
+    def request_exchange_tokens
+      APPLICATION_SCOPES.each do |key, scopes|
+        request_and_save_exchange_token(key, client_id_for_application(key), scopes)
+      end
+    end
+
+    def request_and_save_exchange_token(name, audience, additional_scopes)
+      return if name == "shopify" && !store.exists?(:shop)
+      access_token = request_exchange_token(
+        audience: audience,
+        scopes: scopes(additional_scopes),
+        subject_token: store.get(:identity_access_token),
+        destination: name == "shopify" ? "https://#{store.get(:shop)}/admin" : nil
+      )["access_token"]
+      store.set("#{name}_exchange_token".to_sym => access_token)
+      ctx.debug("#{name}_exchange_token: " + access_token)
+    end
+
+    def request_exchange_token(audience:, scopes:, subject_token:, destination: nil)
+      params = {
+        grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+        requested_token_type: "urn:ietf:params:oauth:token-type:access_token",
+        subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
+        client_id: client_id,
+        audience: audience,
+        scope: scopes,
+        subject_token: subject_token,
+        destination: destination,
+      }.compact
+      # ctx.debug(params)
+      post_token_request(params)
+    end
+
+    def post_token_request(params)
+      post_request("/token", params)
+    end
+
+    def post_request(endpoint, params)
+      uri = URI.parse("#{auth_url}#{endpoint}")
+      https = Net::HTTP.new(uri.host, uri.port)
+      https.use_ssl = true
+      https.verify_mode = OpenSSL::SSL::VERIFY_NONE if ENV["SSL_VERIFY_NONE"]
+      request = Net::HTTP::Post.new(uri.path)
+      request["User-Agent"] = "Shopify CLI #{::ShopifyCLI::VERSION}"
+      request.body = URI.encode_www_form(params)
+      res = https.request(request)
+      unless res.is_a?(Net::HTTPSuccess)
+        error_msg = JSON.parse(res.body)["error_description"]
+        shop = store.get(:shop)
+        if error_msg.include?("destination")
+          store.del(:shop)
+          ctx.abort(ctx.message("core.identity_auth.error.invalid_destination", shop))
+        end
+        raise Error, error_msg
+      end
+      JSON.parse(res.body)
+    end
+
+    def challange_params
+      {
+        code_challenge: code_challenge,
+        code_challenge_method: "S256",
+      }
+    end
+
+    def auth_url
+      if Environment.use_local_partners_instance?
+        "https://identity.myshopify.io/oauth"
+      elsif Environment.use_spin?
+        "https://identity.#{Environment.spin_url}/oauth"
+      else
+        "https://accounts.shopify.com/oauth"
+      end
+    end
+
+    def client_id_for_application(application_name)
+      client_ids = if Environment.use_local_partners_instance? || Environment.use_spin?
+        DEV_APPLICATION_CLIENT_IDS
+      else
+        APPLICATION_CLIENT_IDS
+      end
+
+      client_ids[application_name]
+    end
+
+    def scopes(additional_scopes = [])
+      (["openid"] + additional_scopes).tap do |result|
+        result << "employee" if ShopifyCLI::Shopifolk.acting_as_shopify_organization?
+      end.join(" ")
+    end
+
+    def client_id
+      if Environment.use_local_partners_instance? || Environment.use_spin?
+        Constants::Identity::CLIENT_ID_DEV
+      else
+        # In the future we might want to use Identity's dynamic
+        # registration. To migrate to a dynamic client ID we
+        # need to refactor some code that relies on a static
+        # value for the client
+        Constants::Identity::CLIENT_ID
+      end
+    end
+  end
+end

package/assets/cli-ruby/lib/shopify_cli/js_deps.rb

@@ -0,0 +1,110 @@
+require "shopify_cli"
+
+module ShopifyCLI
+  ##
+  # ShopifyCLI::JsDeps ensures that all JavaScript dependencies are installed for projects.
+  #
+  class JsDeps
+    include SmartProperties
+
+    property! :ctx, accepts: ShopifyCLI::Context
+    property! :system, accepts: JsSystem, default: -> { JsSystem.new(ctx: ctx) }
+
+    ##
+    # Proxy to instance method ShopifyCLI::JsDeps.new.install.
+    #
+    # #### Parameters
+    # - `ctx`: running context from your command
+    # - `verbose`: whether to run the installation tools in silent mode
+    #
+    # #### Example
+    #
+    #   ShopifyCLI::JsDeps.install(ctx)
+    #
+    def self.install(ctx, verbose = false)
+      new(ctx: ctx).install(verbose)
+    end
+
+    ##
+    # Installs all of a project's JavaScript dependencies using Yarn or NPM, based on the project's settings.
+    #
+    # #### Parameters
+    # - `verbose`: whether to run the installation tools in silent mode
+    #
+    # #### Example
+    #
+    #   # context is the running context for the command
+    #   ShopifyCLI::JsDeps.new(context).install(true)
+    #
+    def install(verbose = false)
+      title = ctx.message("core.js_deps.installing", @system.package_manager)
+      success = ctx.message("core.js_deps.installed")
+      failure = ctx.message("core.js_deps.error.install_error", @system.package_manager)
+
+      CLI::UI::Frame.open(title, success_text: success, failure_text: failure) do
+        @system.call(
+          yarn: -> { yarn(verbose) },
+          npm: -> { npm(verbose) }
+        )
+      end
+    end
+
+    private
+
+    def yarn(verbose = false)
+      cmd = %w(yarn install)
+      cmd << "--silent" unless verbose
+
+      run_install_command(cmd)
+    end
+
+    def npm(verbose = false)
+      cmd = %w(npm install --no-audit)
+      cmd << "--quiet" unless verbose
+
+      run_install_command(cmd)
+    end
+
+    def run_install_command(cmd)
+      deps = parse_dependencies
+      errors = nil
+
+      spinner_title = ctx.message("core.js_deps.installing", @system.package_manager)
+      success = CLI::UI::Spinner.spin(spinner_title, auto_debrief: false) do |spinner|
+        _, errors, status = CLI::Kit::System.capture3(*cmd, env: @ctx.env, chdir: ctx.root)
+        update_spinner_title_and_status(spinner, status, deps)
+      end
+
+      errors.lines.each { |e| ctx.puts e } unless success || errors.nil?
+      success
+    end
+
+    def update_spinner_title_and_status(spinner, status, deps)
+      if status.success?
+        spinner.update_title(ctx.message("core.js_deps.installed", deps.size))
+      else
+        spinner.update_title(ctx.message("core.js_deps.error.install_spinner_error", deps.size))
+        CLI::UI::Spinner::TASK_FAILED
+      end
+    end
+
+    def parse_dependencies
+      package_json = File.join(ctx.root, "package.json")
+      pkg = begin
+              JSON.parse(File.read(package_json))
+            rescue Errno::ENOENT, Errno::ENOTDIR
+              ctx.abort(ctx.message("core.js_deps.error.missing_package", package_json))
+            end
+
+      %w(dependencies devDependencies).map do |key|
+        pkg.fetch(key, []).keys
+      end.flatten
+    rescue JSON::ParserError
+      ctx.puts(
+        ctx.message("core.js_deps.error.invalid_package", File.read(File.join(path, "package.json"))),
+        error: true
+      )
+      raise ShopifyCLI::AbortSilent
+    end
+  end
+end