@shopify/shopify-api 14.0.1 → 15.0.1

package/lib/auth/oauth/oauth.ts

@@ -96,6 +96,7 @@ export function begin(config: ConfigInterface): OAuthBegin {
       expires: new Date(Date.now() + 60000),
       sameSite: 'lax',
       secure: true,
+      httpOnly: true,
       path: callbackPath,
     });
 
@@ -225,6 +226,7 @@ export function callback(config: ConfigInterface): OAuthCallback {
         expires: session.expires,
         sameSite: 'lax',
         secure: true,
+        httpOnly: true,
         path: cookiePath,
       });
     }

package/lib/clients/common.ts

@@ -28,6 +28,7 @@ export function getUserAgent(config: ConfigInterface): string {
 const REDACTED_LOG_VALUE = '****';
 
 // These headers carry reusable credentials and must not reach the logs.
+// Keep in sync with SENSITIVE_HEADERS in @shopify/graphql-client.
 const SENSITIVE_LOG_HEADERS = new Set([
   'authorization',
   'cookie',

package/lib/types.ts

@@ -42,11 +42,9 @@ export const ShopifyEventsHeader = {
   Topic: 'shopify-topic',
   Domain: 'shopify-shop-domain',
   ApiVersion: 'shopify-api-version',
-  EventId: 'shopify-event-id',
   WebhookId: 'shopify-webhook-id',
   Handle: 'shopify-handle',
   Action: 'shopify-action',
-  ResourceId: 'shopify-resource-id',
   TriggeredAt: 'shopify-triggered-at',
 } as const;
 

package/lib/version.ts

@@ -1 +1 @@
-export const SHOPIFY_API_LIBRARY_VERSION = '14.0.1';
+export const SHOPIFY_API_LIBRARY_VERSION = '15.0.1';

package/lib/webhooks/types.ts

@@ -27,10 +27,8 @@ export const WEBHOOK_HEADER_NAMES = {
     domain: ShopifyEventsHeader.Domain,
     apiVersion: ShopifyEventsHeader.ApiVersion,
     webhookId: ShopifyEventsHeader.WebhookId,
-    eventId: ShopifyEventsHeader.EventId,
     handle: ShopifyEventsHeader.Handle,
     action: ShopifyEventsHeader.Action,
-    resourceId: ShopifyEventsHeader.ResourceId,
     triggeredAt: ShopifyEventsHeader.TriggeredAt,
   },
 } as const;
@@ -187,10 +185,8 @@ export interface WebhooksWebhookFields extends BaseWebhookFields {
 export interface EventsWebhookFields extends BaseWebhookFields {
   webhookType: typeof WebhookType.Events;
   webhookId: string;
-  eventId: string;
   handle?: string;
   action?: string;
-  resourceId?: string;
 }
 
 export type WebhookFields = WebhooksWebhookFields | EventsWebhookFields;

package/lib/webhooks/validate.ts

@@ -164,11 +164,6 @@ function checkEventsHeaders(
     headerNames.webhookId,
     missingHeaders,
   );
-  const eventId = getRequiredHeader(
-    headers,
-    headerNames.eventId,
-    missingHeaders,
-  );
 
   if (missingHeaders.length) {
     return {
@@ -185,7 +180,6 @@ function checkEventsHeaders(
     domain: domain!,
     apiVersion: apiVersion!,
     webhookId: webhookId!,
-    eventId: eventId!,
   };
 
   const handle = getHeader(headers, headerNames.handle);
@@ -194,9 +188,6 @@ function checkEventsHeaders(
   const action = getHeader(headers, headerNames.action);
   if (action) fields.action = action;
 
-  const resourceId = getHeader(headers, headerNames.resourceId);
-  if (resourceId) fields.resourceId = resourceId;
-
   const triggeredAt = getHeader(headers, headerNames.triggeredAt);
   if (triggeredAt) fields.triggeredAt = triggeredAt;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shopify/shopify-api",
-  "version": "14.0.1",
+  "version": "15.0.1",
   "description": "Shopify API Library for Node - accelerate development with support for authentication, graphql proxy, webhooks",
   "types": "./dist/ts/lib/index.d.ts",
   "module": "./dist/esm/lib/index.mjs",
@@ -71,9 +71,9 @@
     "Storefront API"
   ],
   "dependencies": {
-    "@shopify/admin-api-client": "^2.0.0",
-    "@shopify/graphql-client": "^2.0.0",
-    "@shopify/storefront-api-client": "^2.0.0",
+    "@shopify/admin-api-client": "^2.0.1",
+    "@shopify/graphql-client": "^2.0.1",
+    "@shopify/storefront-api-client": "^2.0.1",
     "compare-versions": "^6.1.1",
     "isbot": "^5.2.0",
     "jose": "^5.9.6",

package/runtime/http/cookies.ts

@@ -91,9 +91,13 @@ export class Cookies {
             name,
             value,
             ...Object.fromEntries(
-              opts.map((opt) =>
-                splitN(opt, '=', 2).map((value) => value.trim()),
-              ),
+              opts.map((opt) => {
+                const [key, value] = splitN(opt, '=', 2).map((value) =>
+                  value.trim(),
+                );
+                // Flag attributes like HttpOnly have no value
+                return [key, value ?? true];
+              }),
             ),
           },
         ];
@@ -111,8 +115,12 @@ export class Cookies {
     let result = '';
     result += `${data.name}=${data.value};`;
     result += Object.entries(data)
-      .filter(([key]) => !['name', 'value', 'expires'].includes(key))
-      .map(([key, value]) => `${key}=${value}`)
+      .filter(
+        ([key, value]) =>
+          !['name', 'value', 'expires'].includes(key) && value !== false,
+      )
+      // Boolean attributes are flags, so only write them when true
+      .map(([key, value]) => (value === true ? key : `${key}=${value}`))
       .join('; ');
     if (data.expires) {
       result += ';';
@@ -180,6 +188,7 @@ export class Cookies {
 
   set(name: string, value: string, opts: Partial<CookieData> = {}): void {
     this.outgoingCookieJar[name] = {
+      httpOnly: true,
       ...opts,
       name,
       value,