@shopify/cli-kit 3.84.1 → 3.85.0

package/dist/private/node/session.js

@@ -2,16 +2,38 @@ import { applicationId } from './session/identity.js';
 import { validateSession } from './session/validate.js';
 import { allDefaultScopes, apiScopes } from './session/scopes.js';
 import { exchangeAccessForApplicationTokens, exchangeCustomPartnerToken, refreshAccessToken, InvalidGrantError, InvalidRequestError, } from './session/exchange.js';
-import * as secureStore from './session/store.js';
+import * as sessionStore from './session/store.js';
 import { pollForDeviceAuthorization, requestDeviceAuthorization } from './session/device-authorization.js';
 import { isThemeAccessSession } from './api/rest.js';
+import { getCurrentSessionId, setCurrentSessionId } from './conf-store.js';
+import { UserEmailQueryString } from './api/graphql/business-platform-destinations/user-email.js';
 import { outputContent, outputToken, outputDebug, outputCompleted } from '../../public/node/output.js';
 import { firstPartyDev, themeToken } from '../../public/node/context/local.js';
-import { AbortError, BugError } from '../../public/node/error.js';
+import { AbortError } from '../../public/node/error.js';
 import { normalizeStoreFqdn, identityFqdn } from '../../public/node/context/fqdn.js';
 import { getIdentityTokenInformation, getPartnersToken } from '../../public/node/environment.js';
-import { isSpin } from '../../public/node/context/spin.js';
+import { logout } from '../../public/node/session.js';
 import { nonRandomUUID } from '../../public/node/crypto.js';
+import { isEmpty } from '../../public/common/object.js';
+import { businessPlatformRequest } from '../../public/node/api/business-platform.js';
+/**
+ * Fetches the user's email from the Business Platform API
+ * @param businessPlatformToken - The business platform token
+ * @returns The user's email address or undefined if not found
+ */
+async function fetchEmail(businessPlatformToken) {
+    if (!businessPlatformToken)
+        return undefined;
+    try {
+        const userEmailResult = await businessPlatformRequest(UserEmailQueryString, businessPlatformToken);
+        return userEmailResult.currentUserAccount?.email;
+        // eslint-disable-next-line no-catch-all/no-catch-all
+    }
+    catch (error) {
+        outputDebug(outputContent `Failed to fetch user email: ${error.message ?? String(error)}`);
+        return undefined;
+    }
+}
 let userId;
 let authMethod = 'none';
 /**
@@ -19,7 +41,7 @@ let authMethod = 'none';
  *
  * This function performs the following steps:
  * 1. Checks for a cached user ID in memory (obtained in the current run).
- * 2. Attempts to fetch it from the secure store (from a previous auth session).
+ * 2. Attempts to fetch it from the local storage (from a previous auth session).
  * 3. Checks if a custom token was used (either as a theme password or partners token).
  * 4. If a custom token is present in the environment, generates a UUID and uses it as userId.
  * 5. If after all this we don't have a userId, then reports as 'unknown'.
@@ -29,11 +51,9 @@ let authMethod = 'none';
 export async function getLastSeenUserIdAfterAuth() {
     if (userId)
         return userId;
-    const currentSession = (await secureStore.fetch()) || {};
-    const fqdn = await identityFqdn();
-    const cachedUserId = currentSession[fqdn]?.identity.userId;
-    if (cachedUserId)
-        return cachedUserId;
+    const currentSessionId = getCurrentSessionId();
+    if (currentSessionId)
+        return currentSessionId;
     const customToken = getPartnersToken() ?? themeToken();
     return customToken ? nonRandomUUID(customToken) : 'unknown';
 }
@@ -55,10 +75,7 @@ export function setLastSeenUserIdAfterAuth(id) {
 export async function getLastSeenAuthMethod() {
     if (authMethod !== 'none')
         return authMethod;
-    const currentSession = (await secureStore.fetch()) || {};
-    const fqdn = await identityFqdn();
-    const cachedUserId = currentSession[fqdn]?.identity.userId;
-    if (cachedUserId)
+    if (getCurrentSessionId())
         return 'device_auth';
     const partnersToken = getPartnersToken();
     if (partnersToken)
@@ -77,10 +94,10 @@ export function setLastSeenAuthMethod(method) {
  *
  * @param applications - An object containing the applications we need to be authenticated with.
  * @param _env - Optional environment variables to use.
- * @param forceRefresh - Optional flag to force a refresh of the token.
+ * @param options - Optional extra options to use.
  * @returns An instance with the access tokens organized by application.
  */
-export async function ensureAuthenticated(applications, _env, { forceRefresh = false, noPrompt = false } = {}) {
+export async function ensureAuthenticated(applications, _env, { forceRefresh = false, noPrompt = false, forceNewSession = false } = {}) {
     const fqdn = await identityFqdn();
     const previousStoreFqdn = applications.adminApi?.storeFqdn;
     if (previousStoreFqdn) {
@@ -89,41 +106,40 @@ export async function ensureAuthenticated(applications, _env, { forceRefresh = f
             applications.adminApi.storeFqdn = normalizedStoreName;
         }
     }
-    const currentSession = (await secureStore.fetch()) || {};
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-    const fqdnSession = currentSession[fqdn];
+    const sessions = (await sessionStore.fetch()) ?? {};
+    let currentSessionId = getCurrentSessionId();
+    if (!currentSessionId) {
+        const userIds = Object.keys(sessions[fqdn] ?? {});
+        if (userIds.length > 0)
+            currentSessionId = userIds[0];
+    }
+    const currentSession = currentSessionId && !forceNewSession ? sessions[fqdn]?.[currentSessionId] : undefined;
     const scopes = getFlattenScopes(applications);
     outputDebug(outputContent `Validating existing session against the scopes:
 ${outputToken.json(scopes)}
 For applications:
 ${outputToken.json(applications)}
 `);
-    const validationResult = await validateSession(scopes, applications, fqdnSession);
+    const validationResult = await validateSession(scopes, applications, currentSession);
     let newSession = {};
-    function throwOnNoPrompt() {
-        if (!noPrompt || (isSpin() && firstPartyDev()))
-            return;
-        throw new AbortError(`The currently available CLI credentials are invalid.
-
-The CLI is currently unable to prompt for reauthentication.`, 'Restart the CLI process you were running. If in an interactive terminal, you will be prompted to reauthenticate. If in a non-interactive terminal, ensure the correct credentials are available in the program environment.');
-    }
     if (validationResult === 'needs_full_auth') {
-        throwOnNoPrompt();
+        await throwOnNoPrompt(noPrompt);
         outputDebug(outputContent `Initiating the full authentication flow...`);
-        newSession = await executeCompleteFlow(applications, fqdn);
+        newSession = await executeCompleteFlow(applications);
     }
     else if (validationResult === 'needs_refresh' || forceRefresh) {
         outputDebug(outputContent `The current session is valid but needs refresh. Refreshing...`);
         try {
-            newSession = await refreshTokens(fqdnSession.identity, applications, fqdn);
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            newSession = await refreshTokens(currentSession, applications);
         }
         catch (error) {
             if (error instanceof InvalidGrantError) {
-                throwOnNoPrompt();
-                newSession = await executeCompleteFlow(applications, fqdn);
+                await throwOnNoPrompt(noPrompt);
+                newSession = await executeCompleteFlow(applications);
             }
             else if (error instanceof InvalidRequestError) {
-                await secureStore.remove();
+                await sessionStore.remove();
                 throw new AbortError('\nError validating auth session', "We've cleared the current session, please try again");
             }
             else {
@@ -132,10 +148,17 @@ The CLI is currently unable to prompt for reauthentication.`, 'Restart the CLI p
         }
     }
     const completeSession = { ...currentSession, ...newSession };
+    const newSessionId = completeSession.identity.userId;
+    const updatedSessions = {
+        ...sessions,
+        [fqdn]: { ...sessions[fqdn], [newSessionId]: completeSession },
+    };
     // Save the new session info if it has changed
-    if (Object.keys(newSession).length > 0)
-        await secureStore.store(completeSession);
-    const tokens = await tokensFor(applications, completeSession, fqdn);
+    if (!isEmpty(newSession)) {
+        await sessionStore.store(updatedSessions);
+        setCurrentSessionId(newSessionId);
+    }
+    const tokens = await tokensFor(applications, completeSession);
     // Overwrite partners token if using a custom CLI Token
     const envToken = getPartnersToken();
     if (envToken && applications.partnersApi) {
@@ -145,13 +168,21 @@ The CLI is currently unable to prompt for reauthentication.`, 'Restart the CLI p
     setLastSeenUserIdAfterAuth(tokens.userId);
     return tokens;
 }
+async function throwOnNoPrompt(noPrompt) {
+    if (!noPrompt)
+        return;
+    await logout();
+    throw new AbortError(`The currently available CLI credentials are invalid.
+
+The CLI is currently unable to prompt for reauthentication.`, 'Restart the CLI process you were running. If in an interactive terminal, you will be prompted to reauthenticate. If in a non-interactive terminal, ensure the correct credentials are available in the program environment.');
+}
 /**
  * Execute the full authentication flow.
  *
  * @param applications - An object containing the applications we need to be authenticated with.
- * @param identityFqdn - The identity FQDN.
+ * @param alias - Optional alias to use for the session.
  */
-async function executeCompleteFlow(applications, identityFqdn) {
+async function executeCompleteFlow(applications) {
     const scopes = getFlattenScopes(applications);
     const exchangeScopes = getExchangeScopes(applications);
     const store = applications.adminApi?.storeFqdn;
@@ -175,33 +206,33 @@ async function executeCompleteFlow(applications, identityFqdn) {
     // Exchange identity token for application tokens
     outputDebug(outputContent `CLI token received. Exchanging it for application tokens...`);
     const result = await exchangeAccessForApplicationTokens(identityToken, exchangeScopes, store);
+    // Get the alias for the session (email or userId)
+    const businessPlatformToken = result[applicationId('business-platform')]?.accessToken;
+    const alias = (await fetchEmail(businessPlatformToken)) ?? identityToken.userId;
     const session = {
-        [identityFqdn]: {
-            identity: identityToken,
-            applications: result,
+        identity: {
+            ...identityToken,
+            alias,
         },
+        applications: result,
     };
-    outputCompleted('Logged in.');
+    outputCompleted(`Logged in.`);
     return session;
 }
 /**
  * Refresh the tokens for a given session.
  *
- * @param token - Identity token.
- * @param applications - An object containing the applications we need to be authenticated with.
- * @param fqdn - The identity FQDN.
+ * @param session - The session to refresh.
  */
-async function refreshTokens(token, applications, fqdn) {
+async function refreshTokens(session, applications) {
     // Refresh Identity Token
-    const identityToken = await refreshAccessToken(token);
+    const identityToken = await refreshAccessToken(session.identity);
     // Exchange new identity token for application tokens
     const exchangeScopes = getExchangeScopes(applications);
     const applicationTokens = await exchangeAccessForApplicationTokens(identityToken, exchangeScopes, applications.adminApi?.storeFqdn);
     return {
-        [fqdn]: {
-            identity: identityToken,
-            applications: applicationTokens,
-        },
+        identity: identityToken,
+        applications: applicationTokens,
     };
 }
 /**
@@ -211,37 +242,33 @@ async function refreshTokens(token, applications, fqdn) {
  * @param session - The current session.
  * @param fqdn - The identity FQDN.
  */
-async function tokensFor(applications, session, fqdn) {
-    const fqdnSession = session[fqdn];
-    if (!fqdnSession) {
-        throw new BugError('No session found after ensuring authenticated');
-    }
+async function tokensFor(applications, session) {
     const tokens = {
-        userId: fqdnSession.identity.userId,
+        userId: session.identity.userId,
     };
     if (applications.adminApi) {
         const appId = applicationId('admin');
         const realAppId = `${applications.adminApi.storeFqdn}-${appId}`;
-        const token = fqdnSession.applications[realAppId]?.accessToken;
+        const token = session.applications[realAppId]?.accessToken;
         if (token) {
             tokens.admin = { token, storeFqdn: applications.adminApi.storeFqdn };
         }
     }
     if (applications.partnersApi) {
         const appId = applicationId('partners');
-        tokens.partners = fqdnSession.applications[appId]?.accessToken;
+        tokens.partners = session.applications[appId]?.accessToken;
     }
     if (applications.storefrontRendererApi) {
         const appId = applicationId('storefront-renderer');
-        tokens.storefront = fqdnSession.applications[appId]?.accessToken;
+        tokens.storefront = session.applications[appId]?.accessToken;
     }
     if (applications.businessPlatformApi) {
         const appId = applicationId('business-platform');
-        tokens.businessPlatform = fqdnSession.applications[appId]?.accessToken;
+        tokens.businessPlatform = session.applications[appId]?.accessToken;
     }
     if (applications.appManagementApi) {
         const appId = applicationId('app-management');
-        tokens.appManagement = fqdnSession.applications[appId]?.accessToken;
+        tokens.appManagement = session.applications[appId]?.accessToken;
     }
     return tokens;
 }
@@ -253,11 +280,11 @@ async function tokensFor(applications, session, fqdn) {
  * @returns A flattened array of scopes.
  */
 function getFlattenScopes(apps) {
-    const admin = apps.adminApi?.scopes || [];
-    const partner = apps.partnersApi?.scopes || [];
-    const storefront = apps.storefrontRendererApi?.scopes || [];
-    const businessPlatform = apps.businessPlatformApi?.scopes || [];
-    const appManagement = apps.appManagementApi?.scopes || [];
+    const admin = apps.adminApi?.scopes ?? [];
+    const partner = apps.partnersApi?.scopes ?? [];
+    const storefront = apps.storefrontRendererApi?.scopes ?? [];
+    const businessPlatform = apps.businessPlatformApi?.scopes ?? [];
+    const appManagement = apps.appManagementApi?.scopes ?? [];
     const requestedScopes = [...admin, ...partner, ...storefront, ...businessPlatform, ...appManagement];
     return allDefaultScopes(requestedScopes);
 }
@@ -268,11 +295,11 @@ function getFlattenScopes(apps) {
  * @returns An object containing the scopes for each application.
  */
 function getExchangeScopes(apps) {
-    const adminScope = apps.adminApi?.scopes || [];
-    const partnerScope = apps.partnersApi?.scopes || [];
-    const storefrontScopes = apps.storefrontRendererApi?.scopes || [];
-    const businessPlatformScopes = apps.businessPlatformApi?.scopes || [];
-    const appManagementScopes = apps.appManagementApi?.scopes || [];
+    const adminScope = apps.adminApi?.scopes ?? [];
+    const partnerScope = apps.partnersApi?.scopes ?? [];
+    const storefrontScopes = apps.storefrontRendererApi?.scopes ?? [];
+    const businessPlatformScopes = apps.businessPlatformApi?.scopes ?? [];
+    const appManagementScopes = apps.appManagementApi?.scopes ?? [];
     return {
         admin: apiScopes('admin', adminScope),
         partners: apiScopes('partners', partnerScope),
@@ -286,6 +313,7 @@ function buildIdentityTokenFromEnv(scopes, identityTokenInformation) {
         ...identityTokenInformation,
         expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
         scopes,
+        alias: identityTokenInformation.userId,
     };
 }
 //# sourceMappingURL=session.js.map

package/dist/private/node/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/private/node/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAC,gBAAgB,EAAE,SAAS,EAAC,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,kCAAkC,EAClC,0BAA0B,EAE1B,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,WAAW,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAC,0BAA0B,EAAE,0BAA0B,EAAC,MAAM,mCAAmC,CAAA;AACxG,OAAO,EAAC,oBAAoB,EAAC,MAAM,eAAe,CAAA;AAClD,OAAO,EAAC,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAC,MAAM,6BAA6B,CAAA;AACpG,OAAO,EAAC,aAAa,EAAE,UAAU,EAAC,MAAM,oCAAoC,CAAA;AAC5E,OAAO,EAAC,UAAU,EAAE,QAAQ,EAAC,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAC,kBAAkB,EAAE,YAAY,EAAC,MAAM,mCAAmC,CAAA;AAClF,OAAO,EAAC,2BAA2B,EAAE,gBAAgB,EAAC,MAAM,kCAAkC,CAAA;AAE9F,OAAO,EAAC,MAAM,EAAC,MAAM,mCAAmC,CAAA;AACxD,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAA;AA2EzD,IAAI,MAA0B,CAAA;AAC9B,IAAI,UAAU,GAAe,MAAM,CAAA;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,cAAc,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAA;IACxD,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAA;IACjC,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAA;IAC1D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAA;IAErC,MAAM,WAAW,GAAG,gBAAgB,EAAE,IAAI,UAAU,EAAE,CAAA;IACtD,OAAO,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACnD,MAAM,GAAG,EAAE,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,UAAU,CAAA;IAE5C,MAAM,cAAc,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAA;IACxD,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAA;IACjC,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAA;IAC1D,IAAI,YAAY;QAAE,OAAO,aAAa,CAAA;IAEtC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAA;IACxC,IAAI,aAAa;QAAE,OAAO,gBAAgB,CAAA;IAE1C,MAAM,aAAa,GAAG,UAAU,EAAE,CAAA;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,oBAAoB,CAAC,EAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAA;IAChH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,UAAU,GAAG,MAAM,CAAA;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,YAA+B,EAC/B,IAAwB,EACxB,EAAC,YAAY,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,KAAkD,EAAE;IAE3F,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAA;IAEjC,MAAM,iBAAiB,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC1D,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;QACvE,IAAI,iBAAiB,KAAK,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;YAC3D,YAAY,CAAC,QAAQ,CAAC,SAAS,GAAG,mBAAmB,CAAA;QACvD,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAA;IACxD,oEAAoE;IACpE,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAE,CAAA;IACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAA;IAE7C,WAAW,CAAC,aAAa,CAAA;EACzB,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;;EAExB,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;CAC/B,CAAC,CAAA;IACA,MAAM,gBAAgB,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAA;IAEjF,IAAI,UAAU,GAAG,EAAE,CAAA;IAEnB,SAAS,eAAe;QACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAAE,OAAM;QACtD,MAAM,IAAI,UAAU,CAClB;;4DAEsD,EACtD,6NAA6N,CAC9N,CAAA;IACH,CAAC;IAED,IAAI,gBAAgB,KAAK,iBAAiB,EAAE,CAAC;QAC3C,eAAe,EAAE,CAAA;QACjB,WAAW,CAAC,aAAa,CAAA,4CAA4C,CAAC,CAAA;QACtE,UAAU,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC;SAAM,IAAI,gBAAgB,KAAK,eAAe,IAAI,YAAY,EAAE,CAAC;QAChE,WAAW,CAAC,aAAa,CAAA,+DAA+D,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,CAAA;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;gBACvC,eAAe,EAAE,CAAA;gBACjB,UAAU,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;YAC5D,CAAC;iBAAM,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBAChD,MAAM,WAAW,CAAC,MAAM,EAAE,CAAA;gBAC1B,MAAM,IAAI,UAAU,CAAC,iCAAiC,EAAE,qDAAqD,CAAC,CAAA;YAChH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAY,EAAC,GAAG,cAAc,EAAE,GAAG,UAAU,EAAC,CAAA;IAEnE,8CAA8C;IAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;IAChF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,CAAA;IAEnE,uDAAuD;IACvD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IACnC,IAAI,QAAQ,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,CAAC,QAAQ,GAAG,CAAC,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAA;IAC5E,CAAC;IAED,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IAClE,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,YAA+B,EAAE,YAAoB;IACtF,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC9C,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,WAAW,CAAC,aAAa,CAAA,uCAAuC,CAAC,CAAA;QACjE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,aAA4B,CAAA;IAChC,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAA;IAC9D,IAAI,wBAAwB,EAAE,CAAC;QAC7B,aAAa,GAAG,yBAAyB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;IAC7E,CAAC;SAAM,CAAC;QACN,iEAAiE;QACjE,WAAW,CAAC,aAAa,CAAA,yCAAyC,CAAC,CAAA;QACnE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAA;QAE3D,8BAA8B;QAC9B,WAAW,CAAC,aAAa,CAAA,4CAA4C,CAAC,CAAA;QACtE,aAAa,GAAG,MAAM,0BAA0B,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC9F,CAAC;IAED,iDAAiD;IACjD,WAAW,CAAC,aAAa,CAAA,6DAA6D,CAAC,CAAA;IACvF,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;IAE7F,MAAM,OAAO,GAAY;QACvB,CAAC,YAAY,CAAC,EAAE;YACd,QAAQ,EAAE,aAAa;YACvB,YAAY,EAAE,MAAM;SACrB;KACF,CAAA;IAED,eAAe,CAAC,YAAY,CAAC,CAAA;IAE7B,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,KAAoB,EAAE,YAA+B,EAAE,IAAY;IAC9F,yBAAyB;IACzB,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACrD,qDAAqD;IACrD,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACtD,MAAM,iBAAiB,GAAG,MAAM,kCAAkC,CAChE,aAAa,EACb,cAAc,EACd,YAAY,CAAC,QAAQ,EAAE,SAAS,CACjC,CAAA;IAED,OAAO;QACL,CAAC,IAAI,CAAC,EAAE;YACN,QAAQ,EAAE,aAAa;YACvB,YAAY,EAAE,iBAAiB;SAChC;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CAAC,YAA+B,EAAE,OAAgB,EAAE,IAAY;IACtF,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,MAAM,GAAiB;QAC3B,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM;KACpC,CAAA;IACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,EAAE,CAAA;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,WAAW,CAAA;QAC9D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,GAAG,EAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;QACvC,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAChE,CAAC;IAED,IAAI,YAAY,CAAC,qBAAqB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAA;QAClD,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAClE,CAAC;IAED,IAAI,YAAY,CAAC,mBAAmB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAA;QAChD,MAAM,CAAC,gBAAgB,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IACxE,CAAC;IAED,IAAI,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAA;QAC7C,MAAM,CAAC,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IACrE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gBAAgB;AAChB;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,EAAE,MAAM,IAAI,EAAE,CAAA;IAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE,CAAA;IAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,EAAE,CAAA;IACzD,MAAM,eAAe,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,aAAa,CAAC,CAAA;IACpG,OAAO,gBAAgB,CAAC,eAAe,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAA;IACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,EAAE,MAAM,IAAI,EAAE,CAAA;IACjE,MAAM,sBAAsB,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE,CAAA;IACrE,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,EAAE,CAAA;IAC/D,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC;QACrC,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC;QAC7C,UAAU,EAAE,SAAS,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;QAC9D,gBAAgB,EAAE,SAAS,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;QACxE,aAAa,EAAE,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAChE,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAgB,EAChB,wBAAqF;IAErF,OAAO;QACL,GAAG,wBAAwB;QAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1D,MAAM;KACP,CAAA;AACH,CAAC","sourcesContent":["import {applicationId} from './session/identity.js'\nimport {validateSession} from './session/validate.js'\nimport {allDefaultScopes, apiScopes} from './session/scopes.js'\nimport {\n  exchangeAccessForApplicationTokens,\n  exchangeCustomPartnerToken,\n  ExchangeScopes,\n  refreshAccessToken,\n  InvalidGrantError,\n  InvalidRequestError,\n} from './session/exchange.js'\nimport {IdentityToken, Session} from './session/schema.js'\nimport * as secureStore from './session/store.js'\nimport {pollForDeviceAuthorization, requestDeviceAuthorization} from './session/device-authorization.js'\nimport {isThemeAccessSession} from './api/rest.js'\nimport {outputContent, outputToken, outputDebug, outputCompleted} from '../../public/node/output.js'\nimport {firstPartyDev, themeToken} from '../../public/node/context/local.js'\nimport {AbortError, BugError} from '../../public/node/error.js'\nimport {normalizeStoreFqdn, identityFqdn} from '../../public/node/context/fqdn.js'\nimport {getIdentityTokenInformation, getPartnersToken} from '../../public/node/environment.js'\nimport {AdminSession} from '../../public/node/session.js'\nimport {isSpin} from '../../public/node/context/spin.js'\nimport {nonRandomUUID} from '../../public/node/crypto.js'\n\n/**\n * A scope supported by the Shopify Admin API.\n */\nexport type AdminAPIScope = 'graphql' | 'themes' | 'collaborator'\n\n/**\n * It represents the options to authenticate against the Shopify Admin API.\n */\n\ninterface AdminAPIOAuthOptions {\n  /** Store to request permissions for. */\n  storeFqdn: string\n  /** List of scopes to request permissions for. */\n  scopes: AdminAPIScope[]\n}\n\n/**\n * A scope supported by the Partners API.\n */\nexport type PartnersAPIScope = 'cli'\ninterface PartnersAPIOAuthOptions {\n  /** List of scopes to request permissions for. */\n  scopes: PartnersAPIScope[]\n}\n\n/**\n * A scope supported by the Developer Platform API.\n */\nexport type AppManagementAPIScope = 'https://api.shopify.com/auth/organization.apps.manage'\ninterface AppManagementAPIOauthOptions {\n  /** List of scopes to request permissions for. */\n  scopes: AppManagementAPIScope[]\n}\n\n/**\n * A scope supported by the Storefront Renderer API.\n */\nexport type StorefrontRendererScope = 'devtools'\ninterface StorefrontRendererAPIOAuthOptions {\n  /** List of scopes to request permissions for. */\n  scopes: StorefrontRendererScope[]\n}\n\nexport type BusinessPlatformScope = 'destinations'\ninterface BusinessPlatformAPIOAuthOptions {\n  /** List of scopes to request permissions for. */\n  scopes: BusinessPlatformScope[]\n}\n\n/**\n * It represents the authentication requirements and\n * is the input necessary to trigger the authentication\n * flow.\n */\nexport interface OAuthApplications {\n  adminApi?: AdminAPIOAuthOptions\n  storefrontRendererApi?: StorefrontRendererAPIOAuthOptions\n  partnersApi?: PartnersAPIOAuthOptions\n  businessPlatformApi?: BusinessPlatformAPIOAuthOptions\n  appManagementApi?: AppManagementAPIOauthOptions\n}\n\nexport interface OAuthSession {\n  admin?: AdminSession\n  partners?: string\n  storefront?: string\n  businessPlatform?: string\n  appManagement?: string\n  userId: string\n}\n\ntype AuthMethod = 'partners_token' | 'device_auth' | 'theme_access_token' | 'custom_app_token' | 'none'\n\nlet userId: undefined | string\nlet authMethod: AuthMethod = 'none'\n\n/**\n * Retrieves the user ID from the current session or returns 'unknown' if not found.\n *\n * This function performs the following steps:\n * 1. Checks for a cached user ID in memory (obtained in the current run).\n * 2. Attempts to fetch it from the secure store (from a previous auth session).\n * 3. Checks if a custom token was used (either as a theme password or partners token).\n * 4. If a custom token is present in the environment, generates a UUID and uses it as userId.\n * 5. If after all this we don't have a userId, then reports as 'unknown'.\n *\n * @returns A Promise that resolves to the user ID as a string.\n */\nexport async function getLastSeenUserIdAfterAuth(): Promise<string> {\n  if (userId) return userId\n\n  const currentSession = (await secureStore.fetch()) || {}\n  const fqdn = await identityFqdn()\n  const cachedUserId = currentSession[fqdn]?.identity.userId\n  if (cachedUserId) return cachedUserId\n\n  const customToken = getPartnersToken() ?? themeToken()\n  return customToken ? nonRandomUUID(customToken) : 'unknown'\n}\n\nexport function setLastSeenUserIdAfterAuth(id: string) {\n  userId = id\n}\n\n/**\n * Retrieves the last seen authentication method used in the current session.\n *\n * This function checks for the authentication method in the following order:\n * 1. Returns the cached auth method if it's not 'none'.\n * 2. Checks for a cached session, which implies 'device_auth' was used.\n * 3. Checks for a partners token in the environment.\n * 4. Checks for a theme password in the environment.\n * 5. If none of the above are true, returns 'none'.\n *\n * @returns A Promise that resolves to the last seen authentication method as an AuthMethod type.\n */\nexport async function getLastSeenAuthMethod(): Promise<AuthMethod> {\n  if (authMethod !== 'none') return authMethod\n\n  const currentSession = (await secureStore.fetch()) || {}\n  const fqdn = await identityFqdn()\n  const cachedUserId = currentSession[fqdn]?.identity.userId\n  if (cachedUserId) return 'device_auth'\n\n  const partnersToken = getPartnersToken()\n  if (partnersToken) return 'partners_token'\n\n  const themePassword = themeToken()\n  if (themePassword) {\n    return isThemeAccessSession({token: themePassword, storeFqdn: ''}) ? 'theme_access_token' : 'custom_app_token'\n  }\n\n  return 'none'\n}\n\nexport function setLastSeenAuthMethod(method: AuthMethod) {\n  authMethod = method\n}\n\n/**\n * This method ensures that we have a valid session to authenticate against the given applications using the provided scopes.\n *\n * @param applications - An object containing the applications we need to be authenticated with.\n * @param _env - Optional environment variables to use.\n * @param forceRefresh - Optional flag to force a refresh of the token.\n * @returns An instance with the access tokens organized by application.\n */\nexport async function ensureAuthenticated(\n  applications: OAuthApplications,\n  _env?: NodeJS.ProcessEnv,\n  {forceRefresh = false, noPrompt = false}: {forceRefresh?: boolean; noPrompt?: boolean} = {},\n): Promise<OAuthSession> {\n  const fqdn = await identityFqdn()\n\n  const previousStoreFqdn = applications.adminApi?.storeFqdn\n  if (previousStoreFqdn) {\n    const normalizedStoreName = await normalizeStoreFqdn(previousStoreFqdn)\n    if (previousStoreFqdn === applications.adminApi?.storeFqdn) {\n      applications.adminApi.storeFqdn = normalizedStoreName\n    }\n  }\n\n  const currentSession = (await secureStore.fetch()) || {}\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  const fqdnSession = currentSession[fqdn]!\n  const scopes = getFlattenScopes(applications)\n\n  outputDebug(outputContent`Validating existing session against the scopes:\n${outputToken.json(scopes)}\nFor applications:\n${outputToken.json(applications)}\n`)\n  const validationResult = await validateSession(scopes, applications, fqdnSession)\n\n  let newSession = {}\n\n  function throwOnNoPrompt() {\n    if (!noPrompt || (isSpin() && firstPartyDev())) return\n    throw new AbortError(\n      `The currently available CLI credentials are invalid.\n\nThe CLI is currently unable to prompt for reauthentication.`,\n      'Restart the CLI process you were running. If in an interactive terminal, you will be prompted to reauthenticate. If in a non-interactive terminal, ensure the correct credentials are available in the program environment.',\n    )\n  }\n\n  if (validationResult === 'needs_full_auth') {\n    throwOnNoPrompt()\n    outputDebug(outputContent`Initiating the full authentication flow...`)\n    newSession = await executeCompleteFlow(applications, fqdn)\n  } else if (validationResult === 'needs_refresh' || forceRefresh) {\n    outputDebug(outputContent`The current session is valid but needs refresh. Refreshing...`)\n    try {\n      newSession = await refreshTokens(fqdnSession.identity, applications, fqdn)\n    } catch (error) {\n      if (error instanceof InvalidGrantError) {\n        throwOnNoPrompt()\n        newSession = await executeCompleteFlow(applications, fqdn)\n      } else if (error instanceof InvalidRequestError) {\n        await secureStore.remove()\n        throw new AbortError('\\nError validating auth session', \"We've cleared the current session, please try again\")\n      } else {\n        throw error\n      }\n    }\n  }\n\n  const completeSession: Session = {...currentSession, ...newSession}\n\n  // Save the new session info if it has changed\n  if (Object.keys(newSession).length > 0) await secureStore.store(completeSession)\n  const tokens = await tokensFor(applications, completeSession, fqdn)\n\n  // Overwrite partners token if using a custom CLI Token\n  const envToken = getPartnersToken()\n  if (envToken && applications.partnersApi) {\n    tokens.partners = (await exchangeCustomPartnerToken(envToken)).accessToken\n  }\n\n  setLastSeenAuthMethod(envToken ? 'partners_token' : 'device_auth')\n  setLastSeenUserIdAfterAuth(tokens.userId)\n  return tokens\n}\n\n/**\n * Execute the full authentication flow.\n *\n * @param applications - An object containing the applications we need to be authenticated with.\n * @param identityFqdn - The identity FQDN.\n */\nasync function executeCompleteFlow(applications: OAuthApplications, identityFqdn: string): Promise<Session> {\n  const scopes = getFlattenScopes(applications)\n  const exchangeScopes = getExchangeScopes(applications)\n  const store = applications.adminApi?.storeFqdn\n  if (firstPartyDev()) {\n    outputDebug(outputContent`Authenticating as Shopify Employee...`)\n    scopes.push('employee')\n  }\n\n  let identityToken: IdentityToken\n  const identityTokenInformation = getIdentityTokenInformation()\n  if (identityTokenInformation) {\n    identityToken = buildIdentityTokenFromEnv(scopes, identityTokenInformation)\n  } else {\n    // Request a device code to authorize without a browser redirect.\n    outputDebug(outputContent`Requesting device authorization code...`)\n    const deviceAuth = await requestDeviceAuthorization(scopes)\n\n    // Poll for the identity token\n    outputDebug(outputContent`Starting polling for the identity token...`)\n    identityToken = await pollForDeviceAuthorization(deviceAuth.deviceCode, deviceAuth.interval)\n  }\n\n  // Exchange identity token for application tokens\n  outputDebug(outputContent`CLI token received. Exchanging it for application tokens...`)\n  const result = await exchangeAccessForApplicationTokens(identityToken, exchangeScopes, store)\n\n  const session: Session = {\n    [identityFqdn]: {\n      identity: identityToken,\n      applications: result,\n    },\n  }\n\n  outputCompleted('Logged in.')\n\n  return session\n}\n\n/**\n * Refresh the tokens for a given session.\n *\n * @param token - Identity token.\n * @param applications - An object containing the applications we need to be authenticated with.\n * @param fqdn - The identity FQDN.\n */\nasync function refreshTokens(token: IdentityToken, applications: OAuthApplications, fqdn: string): Promise<Session> {\n  // Refresh Identity Token\n  const identityToken = await refreshAccessToken(token)\n  // Exchange new identity token for application tokens\n  const exchangeScopes = getExchangeScopes(applications)\n  const applicationTokens = await exchangeAccessForApplicationTokens(\n    identityToken,\n    exchangeScopes,\n    applications.adminApi?.storeFqdn,\n  )\n\n  return {\n    [fqdn]: {\n      identity: identityToken,\n      applications: applicationTokens,\n    },\n  }\n}\n\n/**\n * Get the application tokens for a given session.\n *\n * @param applications - An object containing the applications we need the tokens for.\n * @param session - The current session.\n * @param fqdn - The identity FQDN.\n */\nasync function tokensFor(applications: OAuthApplications, session: Session, fqdn: string): Promise<OAuthSession> {\n  const fqdnSession = session[fqdn]\n  if (!fqdnSession) {\n    throw new BugError('No session found after ensuring authenticated')\n  }\n  const tokens: OAuthSession = {\n    userId: fqdnSession.identity.userId,\n  }\n  if (applications.adminApi) {\n    const appId = applicationId('admin')\n    const realAppId = `${applications.adminApi.storeFqdn}-${appId}`\n    const token = fqdnSession.applications[realAppId]?.accessToken\n    if (token) {\n      tokens.admin = {token, storeFqdn: applications.adminApi.storeFqdn}\n    }\n  }\n\n  if (applications.partnersApi) {\n    const appId = applicationId('partners')\n    tokens.partners = fqdnSession.applications[appId]?.accessToken\n  }\n\n  if (applications.storefrontRendererApi) {\n    const appId = applicationId('storefront-renderer')\n    tokens.storefront = fqdnSession.applications[appId]?.accessToken\n  }\n\n  if (applications.businessPlatformApi) {\n    const appId = applicationId('business-platform')\n    tokens.businessPlatform = fqdnSession.applications[appId]?.accessToken\n  }\n\n  if (applications.appManagementApi) {\n    const appId = applicationId('app-management')\n    tokens.appManagement = fqdnSession.applications[appId]?.accessToken\n  }\n\n  return tokens\n}\n\n// Scope Helpers\n/**\n * Get a flattened array of scopes for the given applications.\n *\n * @param apps - An object containing the applications we need the scopes for.\n * @returns A flattened array of scopes.\n */\nfunction getFlattenScopes(apps: OAuthApplications): string[] {\n  const admin = apps.adminApi?.scopes || []\n  const partner = apps.partnersApi?.scopes || []\n  const storefront = apps.storefrontRendererApi?.scopes || []\n  const businessPlatform = apps.businessPlatformApi?.scopes || []\n  const appManagement = apps.appManagementApi?.scopes || []\n  const requestedScopes = [...admin, ...partner, ...storefront, ...businessPlatform, ...appManagement]\n  return allDefaultScopes(requestedScopes)\n}\n\n/**\n * Get the scopes for the given applications.\n *\n * @param apps - An object containing the applications we need the scopes for.\n * @returns An object containing the scopes for each application.\n */\nfunction getExchangeScopes(apps: OAuthApplications): ExchangeScopes {\n  const adminScope = apps.adminApi?.scopes || []\n  const partnerScope = apps.partnersApi?.scopes || []\n  const storefrontScopes = apps.storefrontRendererApi?.scopes || []\n  const businessPlatformScopes = apps.businessPlatformApi?.scopes || []\n  const appManagementScopes = apps.appManagementApi?.scopes || []\n  return {\n    admin: apiScopes('admin', adminScope),\n    partners: apiScopes('partners', partnerScope),\n    storefront: apiScopes('storefront-renderer', storefrontScopes),\n    businessPlatform: apiScopes('business-platform', businessPlatformScopes),\n    appManagement: apiScopes('app-management', appManagementScopes),\n  }\n}\n\nfunction buildIdentityTokenFromEnv(\n  scopes: string[],\n  identityTokenInformation: {accessToken: string; refreshToken: string; userId: string},\n) {\n  return {\n    ...identityTokenInformation,\n    expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),\n    scopes,\n  }\n}\n"]}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/private/node/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAC,gBAAgB,EAAE,SAAS,EAAC,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,kCAAkC,EAClC,0BAA0B,EAE1B,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAC,0BAA0B,EAAE,0BAA0B,EAAC,MAAM,mCAAmC,CAAA;AACxG,OAAO,EAAC,oBAAoB,EAAC,MAAM,eAAe,CAAA;AAClD,OAAO,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,iBAAiB,CAAA;AACxE,OAAO,EAAC,oBAAoB,EAAiB,MAAM,4DAA4D,CAAA;AAC/G,OAAO,EAAC,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAC,MAAM,6BAA6B,CAAA;AACpG,OAAO,EAAC,aAAa,EAAE,UAAU,EAAC,MAAM,oCAAoC,CAAA;AAC5E,OAAO,EAAC,UAAU,EAAC,MAAM,4BAA4B,CAAA;AACrD,OAAO,EAAC,kBAAkB,EAAE,YAAY,EAAC,MAAM,mCAAmC,CAAA;AAClF,OAAO,EAAC,2BAA2B,EAAE,gBAAgB,EAAC,MAAM,kCAAkC,CAAA;AAC9F,OAAO,EAAe,MAAM,EAAC,MAAM,8BAA8B,CAAA;AACjE,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAC,OAAO,EAAC,MAAM,+BAA+B,CAAA;AACrD,OAAO,EAAC,uBAAuB,EAAC,MAAM,4CAA4C,CAAA;AAElF;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,qBAAyC;IACjE,IAAI,CAAC,qBAAqB;QAAE,OAAO,SAAS,CAAA;IAE5C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,uBAAuB,CAAiB,oBAAoB,EAAE,qBAAqB,CAAC,CAAA;QAClH,OAAO,eAAe,CAAC,kBAAkB,EAAE,KAAK,CAAA;QAChD,qDAAqD;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,aAAa,CAAA,+BAAgC,KAAe,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpG,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AA2ED,IAAI,MAA0B,CAAA;AAC9B,IAAI,UAAU,GAAe,MAAM,CAAA;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAA;IAC9C,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAA;IAE7C,MAAM,WAAW,GAAG,gBAAgB,EAAE,IAAI,UAAU,EAAE,CAAA;IACtD,OAAO,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACnD,MAAM,GAAG,EAAE,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,UAAU,CAAA;IAE5C,IAAI,mBAAmB,EAAE;QAAE,OAAO,aAAa,CAAA;IAE/C,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAA;IACxC,IAAI,aAAa;QAAE,OAAO,gBAAgB,CAAA;IAE1C,MAAM,aAAa,GAAG,UAAU,EAAE,CAAA;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,oBAAoB,CAAC,EAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAA;IAChH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,UAAU,GAAG,MAAM,CAAA;AACrB,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,YAA+B,EAC/B,IAAwB,EACxB,EAAC,YAAY,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,EAAE,eAAe,GAAG,KAAK,KAA0C,EAAE;IAE5G,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAA;IAEjC,MAAM,iBAAiB,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC1D,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;QACvE,IAAI,iBAAiB,KAAK,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;YAC3D,YAAY,CAAC,QAAQ,CAAC,SAAS,GAAG,mBAAmB,CAAA;QACvD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAA;IAEnD,IAAI,gBAAgB,GAAG,mBAAmB,EAAE,CAAA;IAC5C,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,cAAc,GAClB,gBAAgB,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAA;IAE7C,WAAW,CAAC,aAAa,CAAA;EACzB,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;;EAExB,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;CAC/B,CAAC,CAAA;IAEA,MAAM,gBAAgB,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAA;IAEpF,IAAI,UAAU,GAAG,EAAE,CAAA;IAEnB,IAAI,gBAAgB,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC/B,WAAW,CAAC,aAAa,CAAA,4CAA4C,CAAC,CAAA;QACtE,UAAU,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,gBAAgB,KAAK,eAAe,IAAI,YAAY,EAAE,CAAC;QAChE,WAAW,CAAC,aAAa,CAAA,+DAA+D,CAAC,CAAA;QACzF,IAAI,CAAC;YACH,oEAAoE;YACpE,UAAU,GAAG,MAAM,aAAa,CAAC,cAAe,EAAE,YAAY,CAAC,CAAA;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;gBACvC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;gBAC/B,UAAU,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAA;YACtD,CAAC;iBAAM,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBAChD,MAAM,YAAY,CAAC,MAAM,EAAE,CAAA;gBAC3B,MAAM,IAAI,UAAU,CAAC,iCAAiC,EAAE,qDAAqD,CAAC,CAAA;YAChH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,EAAC,GAAG,cAAc,EAAE,GAAG,UAAU,EAAY,CAAA;IACrE,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAA;IACpD,MAAM,eAAe,GAAa;QAChC,GAAG,QAAQ;QACX,CAAC,IAAI,CAAC,EAAE,EAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,EAAC;KAC7D,CAAA;IAED,8CAA8C;IAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACzB,MAAM,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QACzC,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACnC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAE7D,uDAAuD;IACvD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IACnC,IAAI,QAAQ,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,CAAC,QAAQ,GAAG,CAAC,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAA;IAC5E,CAAC;IAED,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IAClE,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAiB;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAM;IACrB,MAAM,MAAM,EAAE,CAAA;IACd,MAAM,IAAI,UAAU,CAClB;;4DAEwD,EACxD,6NAA6N,CAC9N,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,YAA+B;IAChE,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC9C,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,WAAW,CAAC,aAAa,CAAA,uCAAuC,CAAC,CAAA;QACjE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,aAA4B,CAAA;IAChC,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAA;IAC9D,IAAI,wBAAwB,EAAE,CAAC;QAC7B,aAAa,GAAG,yBAAyB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;IAC7E,CAAC;SAAM,CAAC;QACN,iEAAiE;QACjE,WAAW,CAAC,aAAa,CAAA,yCAAyC,CAAC,CAAA;QACnE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAA;QAE3D,8BAA8B;QAC9B,WAAW,CAAC,aAAa,CAAA,4CAA4C,CAAC,CAAA;QACtE,aAAa,GAAG,MAAM,0BAA0B,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC9F,CAAC;IAED,iDAAiD;IACjD,WAAW,CAAC,aAAa,CAAA,6DAA6D,CAAC,CAAA;IACvF,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;IAE7F,kDAAkD;IAClD,MAAM,qBAAqB,GAAG,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,EAAE,WAAW,CAAA;IACrF,MAAM,KAAK,GAAG,CAAC,MAAM,UAAU,CAAC,qBAAqB,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAA;IAE/E,MAAM,OAAO,GAAY;QACvB,QAAQ,EAAE;YACR,GAAG,aAAa;YAChB,KAAK;SACN;QACD,YAAY,EAAE,MAAM;KACrB,CAAA;IAED,eAAe,CAAC,YAAY,CAAC,CAAA;IAE7B,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,YAA+B;IAC5E,yBAAyB;IACzB,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChE,qDAAqD;IACrD,MAAM,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;IACtD,MAAM,iBAAiB,GAAG,MAAM,kCAAkC,CAChE,aAAa,EACb,cAAc,EACd,YAAY,CAAC,QAAQ,EAAE,SAAS,CACjC,CAAA;IAED,OAAO;QACL,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,iBAAiB;KAChC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CAAC,YAA+B,EAAE,OAAgB;IACxE,MAAM,MAAM,GAAiB;QAC3B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;KAChC,CAAA;IAED,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,EAAE,CAAA;QAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,WAAW,CAAA;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,GAAG,EAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;QACvC,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAC5D,CAAC;IAED,IAAI,YAAY,CAAC,qBAAqB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAA;QAClD,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAC9D,CAAC;IAED,IAAI,YAAY,CAAC,mBAAmB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAA;QAChD,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IACpE,CAAC;IAED,IAAI,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAA;QAC7C,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IACjE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gBAAgB;AAChB;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,EAAE,MAAM,IAAI,EAAE,CAAA;IAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE,CAAA;IAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,EAAE,CAAA;IACzD,MAAM,eAAe,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,aAAa,CAAC,CAAA;IACpG,OAAO,gBAAgB,CAAC,eAAe,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAA;IACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,EAAE,MAAM,IAAI,EAAE,CAAA;IACjE,MAAM,sBAAsB,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE,CAAA;IACrE,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,EAAE,CAAA;IAC/D,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC;QACrC,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC;QAC7C,UAAU,EAAE,SAAS,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;QAC9D,gBAAgB,EAAE,SAAS,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;QACxE,aAAa,EAAE,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAChE,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAgB,EAChB,wBAAqF;IAErF,OAAO;QACL,GAAG,wBAAwB;QAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1D,MAAM;QACN,KAAK,EAAE,wBAAwB,CAAC,MAAM;KACvC,CAAA;AACH,CAAC","sourcesContent":["import {applicationId} from './session/identity.js'\nimport {validateSession} from './session/validate.js'\nimport {allDefaultScopes, apiScopes} from './session/scopes.js'\nimport {\n  exchangeAccessForApplicationTokens,\n  exchangeCustomPartnerToken,\n  ExchangeScopes,\n  refreshAccessToken,\n  InvalidGrantError,\n  InvalidRequestError,\n} from './session/exchange.js'\nimport {IdentityToken, Session, Sessions} from './session/schema.js'\nimport * as sessionStore from './session/store.js'\nimport {pollForDeviceAuthorization, requestDeviceAuthorization} from './session/device-authorization.js'\nimport {isThemeAccessSession} from './api/rest.js'\nimport {getCurrentSessionId, setCurrentSessionId} from './conf-store.js'\nimport {UserEmailQueryString, UserEmailQuery} from './api/graphql/business-platform-destinations/user-email.js'\nimport {outputContent, outputToken, outputDebug, outputCompleted} from '../../public/node/output.js'\nimport {firstPartyDev, themeToken} from '../../public/node/context/local.js'\nimport {AbortError} from '../../public/node/error.js'\nimport {normalizeStoreFqdn, identityFqdn} from '../../public/node/context/fqdn.js'\nimport {getIdentityTokenInformation, getPartnersToken} from '../../public/node/environment.js'\nimport {AdminSession, logout} from '../../public/node/session.js'\nimport {nonRandomUUID} from '../../public/node/crypto.js'\nimport {isEmpty} from '../../public/common/object.js'\nimport {businessPlatformRequest} from '../../public/node/api/business-platform.js'\n\n/**\n * Fetches the user's email from the Business Platform API\n * @param businessPlatformToken - The business platform token\n * @returns The user's email address or undefined if not found\n */\nasync function fetchEmail(businessPlatformToken: string | undefined): Promise<string | undefined> {\n  if (!businessPlatformToken) return undefined\n\n  try {\n    const userEmailResult = await businessPlatformRequest<UserEmailQuery>(UserEmailQueryString, businessPlatformToken)\n    return userEmailResult.currentUserAccount?.email\n    // eslint-disable-next-line no-catch-all/no-catch-all\n  } catch (error) {\n    outputDebug(outputContent`Failed to fetch user email: ${(error as Error).message ?? String(error)}`)\n    return undefined\n  }\n}\n\n/**\n * A scope supported by the Shopify Admin API.\n */\nexport type AdminAPIScope = 'graphql' | 'themes' | 'collaborator'\n\n/**\n * It represents the options to authenticate against the Shopify Admin API.\n */\n\ninterface AdminAPIOAuthOptions {\n  /** Store to request permissions for. */\n  storeFqdn: string\n  /** List of scopes to request permissions for. */\n  scopes: AdminAPIScope[]\n}\n\n/**\n * A scope supported by the Partners API.\n */\nexport type PartnersAPIScope = 'cli'\ninterface PartnersAPIOAuthOptions {\n  /** List of scopes to request permissions for. */\n  scopes: PartnersAPIScope[]\n}\n\n/**\n * A scope supported by the Developer Platform API.\n */\nexport type AppManagementAPIScope = 'https://api.shopify.com/auth/organization.apps.manage'\ninterface AppManagementAPIOauthOptions {\n  /** List of scopes to request permissions for. */\n  scopes: AppManagementAPIScope[]\n}\n\n/**\n * A scope supported by the Storefront Renderer API.\n */\nexport type StorefrontRendererScope = 'devtools'\ninterface StorefrontRendererAPIOAuthOptions {\n  /** List of scopes to request permissions for. */\n  scopes: StorefrontRendererScope[]\n}\n\nexport type BusinessPlatformScope = 'destinations'\ninterface BusinessPlatformAPIOAuthOptions {\n  /** List of scopes to request permissions for. */\n  scopes: BusinessPlatformScope[]\n}\n\n/**\n * It represents the authentication requirements and\n * is the input necessary to trigger the authentication\n * flow.\n */\nexport interface OAuthApplications {\n  adminApi?: AdminAPIOAuthOptions\n  storefrontRendererApi?: StorefrontRendererAPIOAuthOptions\n  partnersApi?: PartnersAPIOAuthOptions\n  businessPlatformApi?: BusinessPlatformAPIOAuthOptions\n  appManagementApi?: AppManagementAPIOauthOptions\n}\n\nexport interface OAuthSession {\n  admin?: AdminSession\n  partners?: string\n  storefront?: string\n  businessPlatform?: string\n  appManagement?: string\n  userId: string\n}\n\ntype AuthMethod = 'partners_token' | 'device_auth' | 'theme_access_token' | 'custom_app_token' | 'none'\n\nlet userId: undefined | string\nlet authMethod: AuthMethod = 'none'\n\n/**\n * Retrieves the user ID from the current session or returns 'unknown' if not found.\n *\n * This function performs the following steps:\n * 1. Checks for a cached user ID in memory (obtained in the current run).\n * 2. Attempts to fetch it from the local storage (from a previous auth session).\n * 3. Checks if a custom token was used (either as a theme password or partners token).\n * 4. If a custom token is present in the environment, generates a UUID and uses it as userId.\n * 5. If after all this we don't have a userId, then reports as 'unknown'.\n *\n * @returns A Promise that resolves to the user ID as a string.\n */\nexport async function getLastSeenUserIdAfterAuth(): Promise<string> {\n  if (userId) return userId\n\n  const currentSessionId = getCurrentSessionId()\n  if (currentSessionId) return currentSessionId\n\n  const customToken = getPartnersToken() ?? themeToken()\n  return customToken ? nonRandomUUID(customToken) : 'unknown'\n}\n\nexport function setLastSeenUserIdAfterAuth(id: string) {\n  userId = id\n}\n\n/**\n * Retrieves the last seen authentication method used in the current session.\n *\n * This function checks for the authentication method in the following order:\n * 1. Returns the cached auth method if it's not 'none'.\n * 2. Checks for a cached session, which implies 'device_auth' was used.\n * 3. Checks for a partners token in the environment.\n * 4. Checks for a theme password in the environment.\n * 5. If none of the above are true, returns 'none'.\n *\n * @returns A Promise that resolves to the last seen authentication method as an AuthMethod type.\n */\nexport async function getLastSeenAuthMethod(): Promise<AuthMethod> {\n  if (authMethod !== 'none') return authMethod\n\n  if (getCurrentSessionId()) return 'device_auth'\n\n  const partnersToken = getPartnersToken()\n  if (partnersToken) return 'partners_token'\n\n  const themePassword = themeToken()\n  if (themePassword) {\n    return isThemeAccessSession({token: themePassword, storeFqdn: ''}) ? 'theme_access_token' : 'custom_app_token'\n  }\n\n  return 'none'\n}\n\nexport function setLastSeenAuthMethod(method: AuthMethod) {\n  authMethod = method\n}\n\nexport interface EnsureAuthenticatedAdditionalOptions {\n  noPrompt?: boolean\n  forceRefresh?: boolean\n  forceNewSession?: boolean\n}\n\n/**\n * This method ensures that we have a valid session to authenticate against the given applications using the provided scopes.\n *\n * @param applications - An object containing the applications we need to be authenticated with.\n * @param _env - Optional environment variables to use.\n * @param options - Optional extra options to use.\n * @returns An instance with the access tokens organized by application.\n */\nexport async function ensureAuthenticated(\n  applications: OAuthApplications,\n  _env?: NodeJS.ProcessEnv,\n  {forceRefresh = false, noPrompt = false, forceNewSession = false}: EnsureAuthenticatedAdditionalOptions = {},\n): Promise<OAuthSession> {\n  const fqdn = await identityFqdn()\n\n  const previousStoreFqdn = applications.adminApi?.storeFqdn\n  if (previousStoreFqdn) {\n    const normalizedStoreName = await normalizeStoreFqdn(previousStoreFqdn)\n    if (previousStoreFqdn === applications.adminApi?.storeFqdn) {\n      applications.adminApi.storeFqdn = normalizedStoreName\n    }\n  }\n\n  const sessions = (await sessionStore.fetch()) ?? {}\n\n  let currentSessionId = getCurrentSessionId()\n  if (!currentSessionId) {\n    const userIds = Object.keys(sessions[fqdn] ?? {})\n    if (userIds.length > 0) currentSessionId = userIds[0]\n  }\n  const currentSession: Session | undefined =\n    currentSessionId && !forceNewSession ? sessions[fqdn]?.[currentSessionId] : undefined\n  const scopes = getFlattenScopes(applications)\n\n  outputDebug(outputContent`Validating existing session against the scopes:\n${outputToken.json(scopes)}\nFor applications:\n${outputToken.json(applications)}\n`)\n\n  const validationResult = await validateSession(scopes, applications, currentSession)\n\n  let newSession = {}\n\n  if (validationResult === 'needs_full_auth') {\n    await throwOnNoPrompt(noPrompt)\n    outputDebug(outputContent`Initiating the full authentication flow...`)\n    newSession = await executeCompleteFlow(applications)\n  } else if (validationResult === 'needs_refresh' || forceRefresh) {\n    outputDebug(outputContent`The current session is valid but needs refresh. Refreshing...`)\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      newSession = await refreshTokens(currentSession!, applications)\n    } catch (error) {\n      if (error instanceof InvalidGrantError) {\n        await throwOnNoPrompt(noPrompt)\n        newSession = await executeCompleteFlow(applications)\n      } else if (error instanceof InvalidRequestError) {\n        await sessionStore.remove()\n        throw new AbortError('\\nError validating auth session', \"We've cleared the current session, please try again\")\n      } else {\n        throw error\n      }\n    }\n  }\n\n  const completeSession = {...currentSession, ...newSession} as Session\n  const newSessionId = completeSession.identity.userId\n  const updatedSessions: Sessions = {\n    ...sessions,\n    [fqdn]: {...sessions[fqdn], [newSessionId]: completeSession},\n  }\n\n  // Save the new session info if it has changed\n  if (!isEmpty(newSession)) {\n    await sessionStore.store(updatedSessions)\n    setCurrentSessionId(newSessionId)\n  }\n\n  const tokens = await tokensFor(applications, completeSession)\n\n  // Overwrite partners token if using a custom CLI Token\n  const envToken = getPartnersToken()\n  if (envToken && applications.partnersApi) {\n    tokens.partners = (await exchangeCustomPartnerToken(envToken)).accessToken\n  }\n\n  setLastSeenAuthMethod(envToken ? 'partners_token' : 'device_auth')\n  setLastSeenUserIdAfterAuth(tokens.userId)\n  return tokens\n}\n\nasync function throwOnNoPrompt(noPrompt: boolean) {\n  if (!noPrompt) return\n  await logout()\n  throw new AbortError(\n    `The currently available CLI credentials are invalid.\n\nThe CLI is currently unable to prompt for reauthentication.`,\n    'Restart the CLI process you were running. If in an interactive terminal, you will be prompted to reauthenticate. If in a non-interactive terminal, ensure the correct credentials are available in the program environment.',\n  )\n}\n\n/**\n * Execute the full authentication flow.\n *\n * @param applications - An object containing the applications we need to be authenticated with.\n * @param alias - Optional alias to use for the session.\n */\nasync function executeCompleteFlow(applications: OAuthApplications): Promise<Session> {\n  const scopes = getFlattenScopes(applications)\n  const exchangeScopes = getExchangeScopes(applications)\n  const store = applications.adminApi?.storeFqdn\n  if (firstPartyDev()) {\n    outputDebug(outputContent`Authenticating as Shopify Employee...`)\n    scopes.push('employee')\n  }\n\n  let identityToken: IdentityToken\n  const identityTokenInformation = getIdentityTokenInformation()\n  if (identityTokenInformation) {\n    identityToken = buildIdentityTokenFromEnv(scopes, identityTokenInformation)\n  } else {\n    // Request a device code to authorize without a browser redirect.\n    outputDebug(outputContent`Requesting device authorization code...`)\n    const deviceAuth = await requestDeviceAuthorization(scopes)\n\n    // Poll for the identity token\n    outputDebug(outputContent`Starting polling for the identity token...`)\n    identityToken = await pollForDeviceAuthorization(deviceAuth.deviceCode, deviceAuth.interval)\n  }\n\n  // Exchange identity token for application tokens\n  outputDebug(outputContent`CLI token received. Exchanging it for application tokens...`)\n  const result = await exchangeAccessForApplicationTokens(identityToken, exchangeScopes, store)\n\n  // Get the alias for the session (email or userId)\n  const businessPlatformToken = result[applicationId('business-platform')]?.accessToken\n  const alias = (await fetchEmail(businessPlatformToken)) ?? identityToken.userId\n\n  const session: Session = {\n    identity: {\n      ...identityToken,\n      alias,\n    },\n    applications: result,\n  }\n\n  outputCompleted(`Logged in.`)\n\n  return session\n}\n\n/**\n * Refresh the tokens for a given session.\n *\n * @param session - The session to refresh.\n */\nasync function refreshTokens(session: Session, applications: OAuthApplications): Promise<Session> {\n  // Refresh Identity Token\n  const identityToken = await refreshAccessToken(session.identity)\n  // Exchange new identity token for application tokens\n  const exchangeScopes = getExchangeScopes(applications)\n  const applicationTokens = await exchangeAccessForApplicationTokens(\n    identityToken,\n    exchangeScopes,\n    applications.adminApi?.storeFqdn,\n  )\n\n  return {\n    identity: identityToken,\n    applications: applicationTokens,\n  }\n}\n\n/**\n * Get the application tokens for a given session.\n *\n * @param applications - An object containing the applications we need the tokens for.\n * @param session - The current session.\n * @param fqdn - The identity FQDN.\n */\nasync function tokensFor(applications: OAuthApplications, session: Session): Promise<OAuthSession> {\n  const tokens: OAuthSession = {\n    userId: session.identity.userId,\n  }\n\n  if (applications.adminApi) {\n    const appId = applicationId('admin')\n    const realAppId = `${applications.adminApi.storeFqdn}-${appId}`\n    const token = session.applications[realAppId]?.accessToken\n    if (token) {\n      tokens.admin = {token, storeFqdn: applications.adminApi.storeFqdn}\n    }\n  }\n\n  if (applications.partnersApi) {\n    const appId = applicationId('partners')\n    tokens.partners = session.applications[appId]?.accessToken\n  }\n\n  if (applications.storefrontRendererApi) {\n    const appId = applicationId('storefront-renderer')\n    tokens.storefront = session.applications[appId]?.accessToken\n  }\n\n  if (applications.businessPlatformApi) {\n    const appId = applicationId('business-platform')\n    tokens.businessPlatform = session.applications[appId]?.accessToken\n  }\n\n  if (applications.appManagementApi) {\n    const appId = applicationId('app-management')\n    tokens.appManagement = session.applications[appId]?.accessToken\n  }\n\n  return tokens\n}\n\n// Scope Helpers\n/**\n * Get a flattened array of scopes for the given applications.\n *\n * @param apps - An object containing the applications we need the scopes for.\n * @returns A flattened array of scopes.\n */\nfunction getFlattenScopes(apps: OAuthApplications): string[] {\n  const admin = apps.adminApi?.scopes ?? []\n  const partner = apps.partnersApi?.scopes ?? []\n  const storefront = apps.storefrontRendererApi?.scopes ?? []\n  const businessPlatform = apps.businessPlatformApi?.scopes ?? []\n  const appManagement = apps.appManagementApi?.scopes ?? []\n  const requestedScopes = [...admin, ...partner, ...storefront, ...businessPlatform, ...appManagement]\n  return allDefaultScopes(requestedScopes)\n}\n\n/**\n * Get the scopes for the given applications.\n *\n * @param apps - An object containing the applications we need the scopes for.\n * @returns An object containing the scopes for each application.\n */\nfunction getExchangeScopes(apps: OAuthApplications): ExchangeScopes {\n  const adminScope = apps.adminApi?.scopes ?? []\n  const partnerScope = apps.partnersApi?.scopes ?? []\n  const storefrontScopes = apps.storefrontRendererApi?.scopes ?? []\n  const businessPlatformScopes = apps.businessPlatformApi?.scopes ?? []\n  const appManagementScopes = apps.appManagementApi?.scopes ?? []\n  return {\n    admin: apiScopes('admin', adminScope),\n    partners: apiScopes('partners', partnerScope),\n    storefront: apiScopes('storefront-renderer', storefrontScopes),\n    businessPlatform: apiScopes('business-platform', businessPlatformScopes),\n    appManagement: apiScopes('app-management', appManagementScopes),\n  }\n}\n\nfunction buildIdentityTokenFromEnv(\n  scopes: string[],\n  identityTokenInformation: {accessToken: string; refreshToken: string; userId: string},\n) {\n  return {\n    ...identityTokenInformation,\n    expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),\n    scopes,\n    alias: identityTokenInformation.userId,\n  }\n}\n"]}

package/dist/private/node/ui/components/LoadingBar.d.ts

@@ -0,0 +1,8 @@
+import React from 'react';
+interface LoadingBarProps {
+    title: string;
+    noColor?: boolean;
+    noProgressBar?: boolean;
+}
+declare const LoadingBar: ({ title, noColor, noProgressBar }: React.PropsWithChildren<LoadingBarProps>) => JSX.Element;
+export { LoadingBar };

package/dist/private/node/ui/components/LoadingBar.js

@@ -0,0 +1,21 @@
+import { TextAnimation } from './TextAnimation.js';
+import useLayout from '../hooks/use-layout.js';
+import { shouldDisplayColors } from '../../../../public/node/output.js';
+import React from 'react';
+import { Box, Text } from 'ink';
+const loadingBarChar = '▀';
+const hillString = '▁▁▂▂▃▃▄▄▅▅▆▆▇▇██▇▇▆▆▅▅▄▄▃▃▂▂▁▁';
+const LoadingBar = ({ title, noColor, noProgressBar }) => {
+    const { twoThirds } = useLayout();
+    let loadingBar = new Array(twoThirds).fill(loadingBarChar).join('');
+    if (noColor ?? !shouldDisplayColors()) {
+        loadingBar = hillString.repeat(Math.ceil(twoThirds / hillString.length));
+    }
+    return (React.createElement(Box, { flexDirection: "column" },
+        !noProgressBar && React.createElement(TextAnimation, { text: loadingBar, maxWidth: twoThirds }),
+        React.createElement(Text, null,
+            title,
+            " ...")));
+};
+export { LoadingBar };
+//# sourceMappingURL=LoadingBar.js.map

package/dist/private/node/ui/components/LoadingBar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoadingBar.js","sourceRoot":"","sources":["../../../../../src/private/node/ui/components/LoadingBar.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAA;AAChD,OAAO,SAAS,MAAM,wBAAwB,CAAA;AAC9C,OAAO,EAAC,mBAAmB,EAAC,MAAM,mCAAmC,CAAA;AACrE,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAC,GAAG,EAAE,IAAI,EAAC,MAAM,KAAK,CAAA;AAE7B,MAAM,cAAc,GAAG,GAAG,CAAA;AAC1B,MAAM,UAAU,GAAG,gCAAgC,CAAA;AAQnD,MAAM,UAAU,GAAG,CAAC,EAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAA2C,EAAE,EAAE;IAC/F,MAAM,EAAC,SAAS,EAAC,GAAG,SAAS,EAAE,CAAA;IAC/B,IAAI,UAAU,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnE,IAAI,OAAO,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACtC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,CACL,oBAAC,GAAG,IAAC,aAAa,EAAC,QAAQ;QACxB,CAAC,aAAa,IAAI,oBAAC,aAAa,IAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,GAAI;QAC3E,oBAAC,IAAI;YAAE,KAAK;mBAAY,CACpB,CACP,CAAA;AACH,CAAC,CAAA;AAED,OAAO,EAAC,UAAU,EAAC,CAAA","sourcesContent":["import {TextAnimation} from './TextAnimation.js'\nimport useLayout from '../hooks/use-layout.js'\nimport {shouldDisplayColors} from '../../../../public/node/output.js'\nimport React from 'react'\nimport {Box, Text} from 'ink'\n\nconst loadingBarChar = '▀'\nconst hillString = '▁▁▂▂▃▃▄▄▅▅▆▆▇▇██▇▇▆▆▅▅▄▄▃▃▂▂▁▁'\n\ninterface LoadingBarProps {\n  title: string\n  noColor?: boolean\n  noProgressBar?: boolean\n}\n\nconst LoadingBar = ({title, noColor, noProgressBar}: React.PropsWithChildren<LoadingBarProps>) => {\n  const {twoThirds} = useLayout()\n  let loadingBar = new Array(twoThirds).fill(loadingBarChar).join('')\n  if (noColor ?? !shouldDisplayColors()) {\n    loadingBar = hillString.repeat(Math.ceil(twoThirds / hillString.length))\n  }\n\n  return (\n    <Box flexDirection=\"column\">\n      {!noProgressBar && <TextAnimation text={loadingBar} maxWidth={twoThirds} />}\n      <Text>{title} ...</Text>\n    </Box>\n  )\n}\n\nexport {LoadingBar}\n"]}

package/dist/private/node/ui/components/LoadingBar.test.d.ts

@@ -0,0 +1 @@
+export {};