@shopify/shopify-api 14.0.0 → 15.0.0

package/lib/clients/common.ts

@@ -25,6 +25,86 @@ export function getUserAgent(config: ConfigInterface): string {
   return userAgentPrefix;
 }
 
+const REDACTED_LOG_VALUE = '****';
+
+// These headers carry reusable credentials and must not reach the logs.
+const SENSITIVE_LOG_HEADERS = new Set([
+  'authorization',
+  'cookie',
+  'set-cookie',
+  'shopify-storefront-private-token',
+  'x-shopify-access-token',
+  'x-shopify-storefront-access-token',
+]);
+
+function sanitizeHeaderValue(name: string, value: unknown): unknown {
+  return SENSITIVE_LOG_HEADERS.has(name.toLowerCase())
+    ? REDACTED_LOG_VALUE
+    : value;
+}
+
+// Keep the original serialized shape of request headers. A Headers instance
+// has no own enumerable properties, so it stays opaque here, the same as
+// JSON.stringify shows it.
+function sanitizeHeaders(headers: any): any {
+  if (!headers || typeof headers !== 'object') {
+    return headers;
+  }
+
+  if (Array.isArray(headers)) {
+    return headers.map((header) =>
+      Array.isArray(header)
+        ? [header[0], sanitizeHeaderValue(header[0], header[1])]
+        : header,
+    );
+  }
+
+  return Object.fromEntries(
+    Object.entries(headers).map(([name, value]) => [
+      name,
+      sanitizeHeaderValue(name, value),
+    ]),
+  );
+}
+
+// Response headers were always enumerated in the log, so keep that and
+// redact the credential values.
+function sanitizeEnumerableHeaders(headers: any): any {
+  if (typeof headers?.entries === 'function' && !Array.isArray(headers)) {
+    return Object.fromEntries(
+      [...headers.entries()].map(([name, value]: [string, string]) => [
+        name,
+        sanitizeHeaderValue(name, value),
+      ]),
+    );
+  }
+
+  return sanitizeHeaders(headers);
+}
+
+function sanitizeRequestParams<T>(requestParams: T): T {
+  if (Array.isArray(requestParams)) {
+    return requestParams.map((param) =>
+      param && typeof param === 'object' && 'headers' in param
+        ? {...param, headers: sanitizeHeaders(param.headers)}
+        : param,
+    ) as T;
+  }
+
+  if (
+    requestParams &&
+    typeof requestParams === 'object' &&
+    'headers' in requestParams
+  ) {
+    return {
+      ...requestParams,
+      headers: sanitizeHeaders((requestParams as {headers: any}).headers),
+    };
+  }
+
+  return requestParams;
+}
+
 function serializeResponse(response: Response | any) {
   if (!response) {
     return {error: 'No response object provided'};
@@ -42,10 +122,8 @@ function serializeResponse(response: Response | any) {
       url,
     };
 
-    if (headers?.entries) {
-      serialized.headers = Object.fromEntries(headers.entries());
-    } else if (headers) {
-      serialized.headers = headers;
+    if (headers) {
+      serialized.headers = sanitizeEnumerableHeaders(headers);
     }
 
     return serialized;
@@ -61,7 +139,9 @@ export function clientLoggerFactory(config: ConfigInterface) {
         case 'HTTP-Response': {
           const responseLog: HTTPResponseLog['content'] = logContent.content;
           logger(config).debug('Received response for HTTP request', {
-            requestParams: JSON.stringify(responseLog.requestParams),
+            requestParams: JSON.stringify(
+              sanitizeRequestParams(responseLog.requestParams),
+            ),
             response: JSON.stringify(serializeResponse(responseLog.response)),
           });
           break;
@@ -69,7 +149,9 @@ export function clientLoggerFactory(config: ConfigInterface) {
         case 'HTTP-Retry': {
           const responseLog: HTTPRetryLog['content'] = logContent.content;
           logger(config).debug('Retrying HTTP request', {
-            requestParams: JSON.stringify(responseLog.requestParams),
+            requestParams: JSON.stringify(
+              sanitizeRequestParams(responseLog.requestParams),
+            ),
             retryAttempt: responseLog.retryAttempt,
             maxRetries: responseLog.maxRetries,
             response: responseLog.lastResponse
@@ -84,7 +166,9 @@ export function clientLoggerFactory(config: ConfigInterface) {
           logger(config).debug(
             'Received response containing Deprecated GraphQL Notice',
             {
-              requestParams: JSON.stringify(responseLog.requestParams),
+              requestParams: JSON.stringify(
+                sanitizeRequestParams(responseLog.requestParams),
+              ),
               deprecationNotice: responseLog.deprecationNotice,
             },
           );

package/lib/types.ts

@@ -42,11 +42,9 @@ export const ShopifyEventsHeader = {
   Topic: 'shopify-topic',
   Domain: 'shopify-shop-domain',
   ApiVersion: 'shopify-api-version',
-  EventId: 'shopify-event-id',
   WebhookId: 'shopify-webhook-id',
   Handle: 'shopify-handle',
   Action: 'shopify-action',
-  ResourceId: 'shopify-resource-id',
   TriggeredAt: 'shopify-triggered-at',
 } as const;
 

package/lib/utils/fetch-request.ts

@@ -3,6 +3,18 @@ import {LogSeverity} from '../types';
 import {abstractFetch} from '../../runtime';
 import {ConfigInterface} from '../base-types';
 
+const OAUTH_TOKEN_ENDPOINT_PATH = '/admin/oauth/access_token';
+
+// Token endpoint bodies carry OAuth secrets, so they must not reach the logs.
+// When the URL does not parse, fail closed and keep the body out of the logs.
+function canLogRequestBody(url: string): boolean {
+  try {
+    return new URL(url).pathname !== OAUTH_TOKEN_ENDPOINT_PATH;
+  } catch {
+    return false;
+  }
+}
+
 export function fetchRequestFactory(config: ConfigInterface) {
   return async function fetchRequest(
     url: string,
@@ -16,7 +28,7 @@ export function fetchRequestFactory(config: ConfigInterface) {
       log.debug('Making HTTP request', {
         method: options?.method || 'GET',
         url,
-        ...(options?.body && {body: options?.body}),
+        ...(options?.body && canLogRequestBody(url) && {body: options.body}),
       });
     }
 

package/lib/version.ts

@@ -1 +1 @@
-export const SHOPIFY_API_LIBRARY_VERSION = '14.0.0';
+export const SHOPIFY_API_LIBRARY_VERSION = '15.0.0';

package/lib/webhooks/types.ts

@@ -27,10 +27,8 @@ export const WEBHOOK_HEADER_NAMES = {
     domain: ShopifyEventsHeader.Domain,
     apiVersion: ShopifyEventsHeader.ApiVersion,
     webhookId: ShopifyEventsHeader.WebhookId,
-    eventId: ShopifyEventsHeader.EventId,
     handle: ShopifyEventsHeader.Handle,
     action: ShopifyEventsHeader.Action,
-    resourceId: ShopifyEventsHeader.ResourceId,
     triggeredAt: ShopifyEventsHeader.TriggeredAt,
   },
 } as const;
@@ -187,10 +185,8 @@ export interface WebhooksWebhookFields extends BaseWebhookFields {
 export interface EventsWebhookFields extends BaseWebhookFields {
   webhookType: typeof WebhookType.Events;
   webhookId: string;
-  eventId: string;
   handle?: string;
   action?: string;
-  resourceId?: string;
 }
 
 export type WebhookFields = WebhooksWebhookFields | EventsWebhookFields;

package/lib/webhooks/validate.ts

@@ -164,11 +164,6 @@ function checkEventsHeaders(
     headerNames.webhookId,
     missingHeaders,
   );
-  const eventId = getRequiredHeader(
-    headers,
-    headerNames.eventId,
-    missingHeaders,
-  );
 
   if (missingHeaders.length) {
     return {
@@ -185,7 +180,6 @@ function checkEventsHeaders(
     domain: domain!,
     apiVersion: apiVersion!,
     webhookId: webhookId!,
-    eventId: eventId!,
   };
 
   const handle = getHeader(headers, headerNames.handle);
@@ -194,9 +188,6 @@ function checkEventsHeaders(
   const action = getHeader(headers, headerNames.action);
   if (action) fields.action = action;
 
-  const resourceId = getHeader(headers, headerNames.resourceId);
-  if (resourceId) fields.resourceId = resourceId;
-
   const triggeredAt = getHeader(headers, headerNames.triggeredAt);
   if (triggeredAt) fields.triggeredAt = triggeredAt;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shopify/shopify-api",
-  "version": "14.0.0",
+  "version": "15.0.0",
   "description": "Shopify API Library for Node - accelerate development with support for authentication, graphql proxy, webhooks",
   "types": "./dist/ts/lib/index.d.ts",
   "module": "./dist/esm/lib/index.mjs",