@shopify/shopify-api 13.0.0 → 13.1.0

package/rest/admin/2026-04/variant.ts

@@ -0,0 +1,156 @@
+/***********************************************************************************************************************
+* This file is auto-generated. If you have an issue, please create a GitHub issue.                                     *
+***********************************************************************************************************************/
+
+import {Base, FindAllResponse} from '../../base';
+import {ResourcePath, ResourceNames} from '../../types';
+import {Session} from '../../../lib/session/session';
+import {ApiVersion} from '../../../lib/types';
+
+interface FindArgs {
+  session: Session;
+  id: number | string;
+  fields?: unknown;
+}
+interface DeleteArgs {
+  session: Session;
+  id: number | string;
+  product_id?: number | string | null;
+}
+interface AllArgs {
+  [key: string]: unknown;
+  session: Session;
+  product_id?: number | string | null;
+  limit?: unknown;
+  presentment_currencies?: unknown;
+  since_id?: unknown;
+  fields?: unknown;
+}
+interface CountArgs {
+  [key: string]: unknown;
+  session: Session;
+  product_id?: number | string | null;
+}
+
+export class Variant extends Base {
+  public static apiVersion = ApiVersion.April26;
+
+  protected static hasOne: {[key: string]: typeof Base} = {};
+  protected static hasMany: {[key: string]: typeof Base} = {};
+  protected static paths: ResourcePath[] = [
+    {"http_method": "delete", "operation": "delete", "ids": ["product_id", "id"], "path": "products/<product_id>/variants/<id>.json"},
+    {"http_method": "get", "operation": "count", "ids": ["product_id"], "path": "products/<product_id>/variants/count.json"},
+    {"http_method": "get", "operation": "get", "ids": ["product_id"], "path": "products/<product_id>/variants.json"},
+    {"http_method": "get", "operation": "get", "ids": ["id"], "path": "variants/<id>.json"},
+    {"http_method": "post", "operation": "post", "ids": ["product_id"], "path": "products/<product_id>/variants.json"},
+    {"http_method": "put", "operation": "put", "ids": ["id"], "path": "variants/<id>.json"}
+  ];
+  protected static readOnlyAttributes: string[] = [
+    "inventory_quantity"
+  ];
+  protected static resourceNames: ResourceNames[] = [
+    {
+      "singular": "variant",
+      "plural": "variants"
+    }
+  ];
+
+  public static async find(
+    {
+      session,
+      id,
+      fields = null
+    }: FindArgs
+  ): Promise<Variant | null> {
+    const result = await this.baseFind<Variant>({
+      session: session,
+      urlIds: {"id": id},
+      params: {"fields": fields},
+    });
+    return result.data ? result.data[0] : null;
+  }
+
+  public static async delete(
+    {
+      session,
+      id,
+      product_id = null
+    }: DeleteArgs
+  ): Promise<unknown> {
+    const response = await this.request<Variant>({
+      http_method: "delete",
+      operation: "delete",
+      session: session,
+      urlIds: {"id": id, "product_id": product_id},
+      params: {},
+    });
+
+    return response ? response.body : null;
+  }
+
+  public static async all(
+    {
+      session,
+      product_id = null,
+      limit = null,
+      presentment_currencies = null,
+      since_id = null,
+      fields = null,
+      ...otherArgs
+    }: AllArgs
+  ): Promise<FindAllResponse<Variant>> {
+    const response = await this.baseFind<Variant>({
+      session: session,
+      urlIds: {"product_id": product_id},
+      params: {"limit": limit, "presentment_currencies": presentment_currencies, "since_id": since_id, "fields": fields, ...otherArgs},
+    });
+
+    return response;
+  }
+
+  public static async count(
+    {
+      session,
+      product_id = null,
+      ...otherArgs
+    }: CountArgs
+  ): Promise<unknown> {
+    const response = await this.request<Variant>({
+      http_method: "get",
+      operation: "count",
+      session: session,
+      urlIds: {"product_id": product_id},
+      params: {...otherArgs},
+      body: {},
+      entity: null,
+    });
+
+    return response ? response.body : null;
+  }
+
+  public barcode: string | null;
+  public compare_at_price: string | null;
+  public created_at: string | null;
+  public fulfillment_service: string | null;
+  public grams: number | null;
+  public id: string | null;
+  public image_id: string | null;
+  public inventory_item_id: string | null;
+  public inventory_management: string | null;
+  public inventory_policy: string | null;
+  public inventory_quantity: number | null;
+  public old_inventory_quantity: number | null;
+  public option: {[key: string]: unknown} | null;
+  public position: number | null;
+  public presentment_prices: {[key: string]: unknown}[] | null;
+  public price: string | null;
+  public product_id: string | null;
+  public requires_shipping: boolean | null;
+  public sku: string | null;
+  public tax_code: string | null;
+  public taxable: boolean | null;
+  public title: string | null;
+  public updated_at: string | null;
+  public weight: number | null;
+  public weight_unit: string | null;
+}

package/rest/admin/2026-04/webhook.ts

@@ -0,0 +1,146 @@
+/***********************************************************************************************************************
+* This file is auto-generated. If you have an issue, please create a GitHub issue.                                     *
+***********************************************************************************************************************/
+
+import {Base, FindAllResponse} from '../../base';
+import {ResourcePath, ResourceNames} from '../../types';
+import {Session} from '../../../lib/session/session';
+import {ApiVersion} from '../../../lib/types';
+
+interface FindArgs {
+  session: Session;
+  id: number | string;
+  fields?: unknown;
+}
+interface DeleteArgs {
+  session: Session;
+  id: number | string;
+}
+interface AllArgs {
+  [key: string]: unknown;
+  session: Session;
+  address?: unknown;
+  created_at_max?: unknown;
+  created_at_min?: unknown;
+  fields?: unknown;
+  limit?: unknown;
+  since_id?: unknown;
+  topic?: unknown;
+  updated_at_min?: unknown;
+  updated_at_max?: unknown;
+}
+interface CountArgs {
+  [key: string]: unknown;
+  session: Session;
+  address?: unknown;
+  topic?: unknown;
+}
+
+export class Webhook extends Base {
+  public static apiVersion = ApiVersion.April26;
+
+  protected static hasOne: {[key: string]: typeof Base} = {};
+  protected static hasMany: {[key: string]: typeof Base} = {};
+  protected static paths: ResourcePath[] = [
+    {"http_method": "delete", "operation": "delete", "ids": ["id"], "path": "webhooks/<id>.json"},
+    {"http_method": "get", "operation": "count", "ids": [], "path": "webhooks/count.json"},
+    {"http_method": "get", "operation": "get", "ids": [], "path": "webhooks.json"},
+    {"http_method": "get", "operation": "get", "ids": ["id"], "path": "webhooks/<id>.json"},
+    {"http_method": "post", "operation": "post", "ids": [], "path": "webhooks.json"},
+    {"http_method": "put", "operation": "put", "ids": ["id"], "path": "webhooks/<id>.json"}
+  ];
+  protected static resourceNames: ResourceNames[] = [
+    {
+      "singular": "webhook",
+      "plural": "webhooks"
+    }
+  ];
+
+  public static async find(
+    {
+      session,
+      id,
+      fields = null
+    }: FindArgs
+  ): Promise<Webhook | null> {
+    const result = await this.baseFind<Webhook>({
+      session: session,
+      urlIds: {"id": id},
+      params: {"fields": fields},
+    });
+    return result.data ? result.data[0] : null;
+  }
+
+  public static async delete(
+    {
+      session,
+      id
+    }: DeleteArgs
+  ): Promise<unknown> {
+    const response = await this.request<Webhook>({
+      http_method: "delete",
+      operation: "delete",
+      session: session,
+      urlIds: {"id": id},
+      params: {},
+    });
+
+    return response ? response.body : null;
+  }
+
+  public static async all(
+    {
+      session,
+      address = null,
+      created_at_max = null,
+      created_at_min = null,
+      fields = null,
+      limit = null,
+      since_id = null,
+      topic = null,
+      updated_at_min = null,
+      updated_at_max = null,
+      ...otherArgs
+    }: AllArgs
+  ): Promise<FindAllResponse<Webhook>> {
+    const response = await this.baseFind<Webhook>({
+      session: session,
+      urlIds: {},
+      params: {"address": address, "created_at_max": created_at_max, "created_at_min": created_at_min, "fields": fields, "limit": limit, "since_id": since_id, "topic": topic, "updated_at_min": updated_at_min, "updated_at_max": updated_at_max, ...otherArgs},
+    });
+
+    return response;
+  }
+
+  public static async count(
+    {
+      session,
+      address = null,
+      topic = null,
+      ...otherArgs
+    }: CountArgs
+  ): Promise<unknown> {
+    const response = await this.request<Webhook>({
+      http_method: "get",
+      operation: "count",
+      session: session,
+      urlIds: {},
+      params: {"address": address, "topic": topic, ...otherArgs},
+      body: {},
+      entity: null,
+    });
+
+    return response ? response.body : null;
+  }
+
+  public address: string | null;
+  public topic: string | null;
+  public api_version: string | null;
+  public created_at: string | null;
+  public fields: string[] | null;
+  public format: string | null;
+  public id: string | null;
+  public metafield_namespaces: string[] | null;
+  public private_metafield_namespaces: string[] | null;
+  public updated_at: string | null;
+}

package/runtime/crypto/utils.ts

@@ -2,20 +2,29 @@ import {ShopifyError} from '../../lib/error';
 
 import {HashFormat} from './types';
 
+type HMACSecret = string | ArrayBuffer;
+
+const enc = new TextEncoder();
+
+function getCryptoLib(): Crypto {
+  return typeof (crypto as any)?.webcrypto === 'undefined'
+    ? crypto
+    : (crypto as any).webcrypto;
+}
+
+function hmacKeyData(secret: HMACSecret): BufferSource {
+  return typeof secret === 'string' ? enc.encode(secret) : secret;
+}
+
 export async function createSHA256HMAC(
-  secret: string,
+  secret: HMACSecret,
   payload: string,
   returnFormat: HashFormat = HashFormat.Base64,
 ): Promise<string> {
-  const cryptoLib =
-    typeof (crypto as any)?.webcrypto === 'undefined'
-      ? crypto
-      : (crypto as any).webcrypto;
-
-  const enc = new TextEncoder();
+  const cryptoLib = getCryptoLib();
   const key = await cryptoLib.subtle.importKey(
     'raw',
-    enc.encode(secret),
+    hmacKeyData(secret),
     {
       name: 'HMAC',
       hash: {name: 'SHA-256'},
@@ -34,7 +43,32 @@ export async function createSHA256HMAC(
     : asHex(signature);
 }
 
-export function asHex(buffer: ArrayBuffer): string {
+export async function deriveSHA256HMACKey(
+  secret: string,
+  info: string,
+): Promise<ArrayBuffer> {
+  const cryptoLib = getCryptoLib();
+  const keyMaterial = await cryptoLib.subtle.importKey(
+    'raw',
+    enc.encode(secret),
+    'HKDF',
+    false,
+    ['deriveBits'],
+  );
+
+  return cryptoLib.subtle.deriveBits(
+    {
+      name: 'HKDF',
+      hash: 'SHA-256',
+      salt: new Uint8Array(0),
+      info: enc.encode(info),
+    },
+    keyMaterial,
+    256,
+  );
+}
+
+export function asHex(buffer: ArrayBuffer | Uint8Array): string {
   return [...new Uint8Array(buffer)]
     .map((byte) => byte.toString(16).padStart(2, '0'))
     .join('');
@@ -42,7 +76,7 @@ export function asHex(buffer: ArrayBuffer): string {
 
 const LookupTable =
   'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
-export function asBase64(buffer: ArrayBuffer): string {
+export function asBase64(buffer: ArrayBuffer | Uint8Array): string {
   let output = '';
 
   const input = new Uint8Array(buffer);

package/runtime/http/cookies.ts

@@ -1,5 +1,5 @@
 // import type {Headers} from "./headers";
-import {createSHA256HMAC} from '../crypto/utils';
+import {createSHA256HMAC, deriveSHA256HMACKey} from '../crypto/utils';
 
 import {splitN} from './utils';
 import {getHeader, getHeaders, removeHeader, addHeader} from './headers';
@@ -44,6 +44,33 @@ export interface CookieData {
 }
 
 export type CookieJar = Record<string, CookieData>;
+
+const COOKIE_SIGNING_INFO = 'shopify-app-js/cookie-signing/v1';
+
+async function createCookieSignature(
+  key: string,
+  value: string,
+): Promise<string> {
+  const cookieSigningKey = await deriveSHA256HMACKey(key, COOKIE_SIGNING_INFO);
+  return createSHA256HMAC(cookieSigningKey, value);
+}
+
+const signatureEncoder = new TextEncoder();
+
+function safelyCompareSignatures(signatureA: string, signatureB: string) {
+  const buffA = signatureEncoder.encode(signatureA);
+  const buffB = signatureEncoder.encode(signatureB);
+
+  if (buffA.length !== buffB.length) return false;
+
+  let out = 0;
+  for (let i = 0; i < buffA.length; i++) {
+    out |= buffA[i] ^ buffB[i];
+  }
+
+  return out === 0;
+}
+
 interface CookiesOptions {
   keys: string[];
   // Ignored. Only for type-compatibility with the node package for now.
@@ -170,7 +197,7 @@ export class Cookies {
     }
     this.set(name, value, opts);
     const sigName = `${name}.sig`;
-    const signature = await createSHA256HMAC(this.keys[0], value);
+    const signature = await createCookieSignature(this.keys[0], value);
     this.set(sigName, signature, opts);
     this.updateHeader();
   }
@@ -193,10 +220,14 @@ export class Cookies {
     }
 
     const allCheckSignatures = await Promise.all(
-      this.keys.map((key) => createSHA256HMAC(key, cookieValue)),
+      this.keys.map((key) => createCookieSignature(key, cookieValue)),
+    );
+
+    const validSignature = allCheckSignatures.some((checkSignature) =>
+      safelyCompareSignatures(checkSignature, signature),
     );
 
-    if (!allCheckSignatures.includes(signature)) {
+    if (!validSignature) {
       this.deleteInvalidCookies(cookieName, signedCookieName);
       return false;
     }