@shopify/shopify-api 4.0.0 → 5.0.0

package/CHANGELOG.md

@@ -7,34 +7,59 @@ and adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
 
+## [5.0.0] - 2022-07-28
+
+- ⚠️ [Breaking] If a response from a GraphQL query contains an `errors` attribute, `GraphqlClient` will now throw a `GraphqlQueryError`. The caller can check the `error.response` attribute to see what was returned from the GraphQL API. [#431](https://github.com/Shopify/shopify-api-node/pull/431)
+- ⚠️ [Breaking] Add utils functions to sanitize shops and hosts, and remove the `validateShop` utils function [#434](https://github.com/Shopify/shopify-api-node/pull/434)
+- Allow passing in options for the Redis client used by the session storage strategy [#430](https://github.com/Shopify/shopify-api-node/pull/430)
+- Fix User-Agent header sent in PUT / POST requests [#435](https://github.com/Shopify/shopify-api-node/pull/435)
+
+## [4.2.0] - 2022-07-20
+
+- Return a 401 instead of 403 when webhooks fail validation [#425](https://github.com/Shopify/shopify-api-node/pull/425)
+- Add optional new methods `deleteSession` and `findSessionsByShop` to `SessionStorage`, with the corresponding implementations for the various session storage adapters [#418](https://github.com/Shopify/shopify-api-node/pull/418)
+- Include subset of query body in API deprecation logs [#426](https://github.com/Shopify/shopify-api-node/pull/426)
+
+## [4.1.0] - 2022-07-14
+
+- Add new method to construct the host app URL [#419](https://github.com/Shopify/shopify-api-node/pull/419)
+
 ## [4.0.0] - 2022-07-04
 
-- ⚠️ [Breaking] Add REST resources for July 2022 API version, add `LATEST_API_VERSION` constant, remove support and REST resources for July 2021 (`2021-07`) API version [#415](https://github.com/Shopify/shopify-node-api/pull/415)
-- Add support for July 2022 API version [#409](https://github.com/Shopify/shopify-node-api/pull/409)
+- ⚠️ [Breaking] Add REST resources for July 2022 API version, add `LATEST_API_VERSION` constant, remove support and REST resources for July 2021 (`2021-07`) API version [#415](https://github.com/Shopify/shopify-api-node/pull/415)
+- Add support for July 2022 API version [#409](https://github.com/Shopify/shopify-api-node/pull/409)
+
+### Fixes
+
+- Fix a bug where the PostgreSQL session storage always attempted to create the sessions table [#413](https://github.com/Shopify/shopify-api-node/pull/413)
 
 ## [3.1.3] - 2022-06-08
 
 ### Fixes
+
 - Return instances of `Session` from session storages, not POJOs.
 
 ## [3.1.2] - 2022-06-07
 
 ### Added
+
 - Store user id and expiration date of online tokens
 
 ### Fixes
-- Properly parse a non-json HTTP response [#257](https://github.com/Shopify/shopify-node-api/issues/257)
-- Don’t create a SQLite DB file if the SQLite storage is not used.
 
+- Properly parse a non-json HTTP response [#257](https://github.com/Shopify/shopify-api-node/issues/257)
+- Don’t create a SQLite DB file if the SQLite storage is not used.
 
 ## [3.1.0] - 2022-05-16
 
 ### Added
-- Support for specifying the URI scheme of the host [#385](https://github.com/Shopify/shopify-node-api/pull/385)
+
+- Support for specifying the URI scheme of the host [#385](https://github.com/Shopify/shopify-api-node/pull/385)
 - Add optional `saving` parameter to `serialize` of `Base` class - default is `false` and will include read-only attributes in returned object; `true` used for `save` when committing via API to Shopify.
 
 ### Fixed
-- Fixes [#363](https://github.com/Shopify/shopify-node-api/issues/363)
+
+- Fixes [#363](https://github.com/Shopify/shopify-api-node/issues/363)
   - Webhooks `register` now checks for any attempt to register a GDPR topic (not done via API but by Partner Dashboard), provides an error message in response
   - For topics that don't exist, `register` checks the response from the initial API call for an `errors` field and returns accordingly
 
@@ -42,22 +67,22 @@ and adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ### Added
 
-- Allow REST resources to configure a deny list of attributes to be excluded when saving [#355](https://github.com/Shopify/shopify-node-api/pull/355)
+- Allow REST resources to configure a deny list of attributes to be excluded when saving [#355](https://github.com/Shopify/shopify-api-node/pull/355)
 
 ## [3.0.0] - 2022-04-04
 
 ### Added
 
-- ⚠️ [Breaking] Removing API version `2021-04` [#343](https://github.com/Shopify/shopify-node-api/pull/343)
+- ⚠️ [Breaking] Removing API version `2021-04` [#343](https://github.com/Shopify/shopify-api-node/pull/343)
 - ⚠️ [Breaking] The `HttpResponseError` error and its flavours (all returned from HTTP requests) have been slightly altered:
   - They now take in a hash of values, and will always include the response code, body (as a string if the response is not JSON), and headers
   - All response fields are now contained within a `response` object, to make it easier to access them
-- ⚠️ [Breaking] Update supported Admin API versions [#310](https://github.com/Shopify/shopify-node-api/pull/310)
-- Allow full paths in REST requests [#301](https://github.com/Shopify/shopify-node-api/pull/301)
+- ⚠️ [Breaking] Update supported Admin API versions [#310](https://github.com/Shopify/shopify-api-node/pull/310)
+- Allow full paths in REST requests [#301](https://github.com/Shopify/shopify-api-node/pull/301)
 
 ### Fixed
 
-- ⚠️ [Breaking] Stop responding to the request in the GraphQL Proxy function, returning Shopify's response instead [#312](https://github.com/Shopify/shopify-node-api/pull/312)
+- ⚠️ [Breaking] Stop responding to the request in the GraphQL Proxy function, returning Shopify's response instead [#312](https://github.com/Shopify/shopify-api-node/pull/312)
 
   The examples below are in [express](https://expressjs.com/); you will now need to handle the response yourself.
 
@@ -82,76 +107,76 @@ and adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ### Added
 
-- Add support for January 2022 API version [#285](https://github.com/Shopify/shopify-node-api/pull/285)
+- Add support for January 2022 API version [#285](https://github.com/Shopify/shopify-api-node/pull/285)
 
 ## [2.0.0] - 2021-10-28
 
 ### Added
 
-- Add a 5 second `clockTolerance` to fix `jwt not active` error [#227](https://github.com/Shopify/shopify-node-api/pull/227)
-- [Breaking] Change default for OAuth.beginAuth to online sessions [#203](https://github.com/Shopify/shopify-node-api/pull/203)
-  - see [oauth.md](https://github.com/Shopify/shopify-node-api/blob/main/docs/usage/oauth.md) for updated docs
-- [Breaking] Return and delete session in `validateAuthCallback` [#217](https://github.com/Shopify/shopify-node-api/pull/217)
-  - see [oauth.md](https://github.com/Shopify/shopify-node-api/blob/main/docs/usage/oauth.md) for updated usage
-- [Breaking] Extract `addHandler` and `getHandler` methods for webhooks out of `register` [#205](https://github.com/Shopify/shopify-node-api/pull/205)
-- [Breaking] Sessions no longer default to `false` for `isOnline` [#169](https://github.com/Shopify/shopify-node-api/pull/169)
-- Required `Session` arguments must be passed to the constructor [#169](https://github.com/Shopify/shopify-node-api/pull/169)
-- Allow `undefined` in `AuthScopes` [#169](https://github.com/Shopify/shopify-node-api/pull/169)
+- Add a 5 second `clockTolerance` to fix `jwt not active` error [#227](https://github.com/Shopify/shopify-api-node/pull/227)
+- ⚠️ [Breaking] Change default for OAuth.beginAuth to online sessions [#203](https://github.com/Shopify/shopify-api-node/pull/203)
+  - see [oauth.md](https://github.com/Shopify/shopify-api-node/blob/main/docs/usage/oauth.md) for updated docs
+- ⚠️ [Breaking] Return and delete session in `validateAuthCallback` [#217](https://github.com/Shopify/shopify-api-node/pull/217)
+  - see [oauth.md](https://github.com/Shopify/shopify-api-node/blob/main/docs/usage/oauth.md) for updated usage
+- ⚠️ [Breaking] Extract `addHandler` and `getHandler` methods for webhooks out of `register` [#205](https://github.com/Shopify/shopify-api-node/pull/205)
+- ⚠️ [Breaking] Sessions no longer default to `false` for `isOnline` [#169](https://github.com/Shopify/shopify-api-node/pull/169)
+- Required `Session` arguments must be passed to the constructor [#169](https://github.com/Shopify/shopify-api-node/pull/169)
+- Allow `undefined` in `AuthScopes` [#169](https://github.com/Shopify/shopify-api-node/pull/169)
 
 ## [1.4.3] - 2021-10-22
 
 ### Fixed
 
-- Fixed the HTTP client error messages to expand objects [#252](https://github.com/Shopify/shopify-node-api/pull/252)
+- Fixed the HTTP client error messages to expand objects [#252](https://github.com/Shopify/shopify-api-node/pull/252)
 
 ## [1.4.2] - 2021-10-20
 
-- Added `October21` to `ApiVersion` [#247](https://github.com/Shopify/shopify-node-api/pull/247)
+- Added `October21` to `ApiVersion` [#247](https://github.com/Shopify/shopify-api-node/pull/247)
 
 ## [1.4.1] - 2021-06-11
 
-- Don't include extra params when calculating local hmac [#196](https://github.com/Shopify/shopify-node-api/pull/196)
+- Don't include extra params when calculating local hmac [#196](https://github.com/Shopify/shopify-api-node/pull/196)
 
 ## [1.4.0] - 2021-05-21
 
 ### Added
 
-- Add support for registering Google Pub/Sub webhooks [#181](https://github.com/Shopify/shopify-node-api/pull/181)
-- Added `July21` to `ApiVersion` [#181](https://github.com/Shopify/shopify-node-api/pull/181)
+- Add support for registering Google Pub/Sub webhooks [#181](https://github.com/Shopify/shopify-api-node/pull/181)
+- Added `July21` to `ApiVersion` [#181](https://github.com/Shopify/shopify-api-node/pull/181)
 
 ## [1.3.0] - 2021-05-12
 
 ### Added
 
 - Added Storefront API client under `Shopify.Clients.Storefront`
-- Add `isActive()` method to `Session` class to check if session is active, replace `Session` with `SessionInterface` when used as a type [#153](https://github.com/Shopify/shopify-node-api/pull/153)
+- Add `isActive()` method to `Session` class to check if session is active, replace `Session` with `SessionInterface` when used as a type [#153](https://github.com/Shopify/shopify-api-node/pull/153)
 
 ## [1.2.1] - 2021-03-26
 
 ### Added
 
-- Added `April21` to `ApiVersion` [#149](https://github.com/Shopify/shopify-node-api/pull/149)
+- Added `April21` to `ApiVersion` [#149](https://github.com/Shopify/shopify-api-node/pull/149)
 
 ## [1.2.0] - 2021-03-16
 
 ### Added
 
-- Allow plain objects to be returned from the `loadCallback` on `CustomSessionStorage` [#126](https://github.com/shopify/shopify-node-api/pull/126)
-- Documentation and example code for `CustomSessionStorage` [#129](https://github.com/shopify/shopify-node-api/pull/129)
+- Allow plain objects to be returned from the `loadCallback` on `CustomSessionStorage` [#126](https://github.com/Shopify/shopify-api-node/pull/126)
+- Documentation and example code for `CustomSessionStorage` [#129](https://github.com/Shopify/shopify-api-node/pull/129)
 
 ### Fixed
 
-- Throw a different error for a missing cookie upon OAuth return [#131](https://github.com/shopify/shopify-node-api/pull/131)
-- Improved documentation for GraphQL and Rest Clients. [#123](https://github.com/Shopify/shopify-node-api/pull/123)
-- Made Docs directory more browseable in GitHub. [#136](https://github.com/Shopify/shopify-node-api/pull/136)
-- Make sure `CustomSessionStorage` converts the `expires` field from a string to `Date`. [#132](https://github.com/Shopify/shopify-node-api/pull/132)
-- Made `limit` optional for get-requests with query [#135](https://github.com/Shopify/shopify-node-api/pull/135)
+- Throw a different error for a missing cookie upon OAuth return [#131](https://github.com/Shopify/shopify-api-node/pull/131)
+- Improved documentation for GraphQL and Rest Clients. [#123](https://github.com/Shopify/shopify-api-node/pull/123)
+- Made Docs directory more browseable in GitHub. [#136](https://github.com/Shopify/shopify-api-node/pull/136)
+- Make sure `CustomSessionStorage` converts the `expires` field from a string to `Date`. [#132](https://github.com/Shopify/shopify-api-node/pull/132)
+- Made `limit` optional for get-requests with query [#135](https://github.com/Shopify/shopify-api-node/pull/135)
 
 ## [1.1.0] - 2021-03-02
 
 - Minor text/doc changes
-- Added `2021-01` API version to enum. [#117](https://github.com/shopify/shopify-node-api/pull/117)
-- Allow retrieving offline sessions using `loadCurrentSession`. [#119](https://github.com/shopify/shopify-node-api/pull/119)
+- Added `2021-01` API version to enum. [#117](https://github.com/Shopify/shopify-api-node/pull/117)
+- Allow retrieving offline sessions using `loadCurrentSession`. [#119](https://github.com/Shopify/shopify-api-node/pull/119)
 
 ## [1.0.0]
 
@@ -161,56 +186,56 @@ and adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ### Added
 
-- Added `AuthScopes` value object to allow apps to easily check whether scopes have been updated. [#110](https://github.com/shopify/shopify-node-api/pull/110)
+- Added `AuthScopes` value object to allow apps to easily check whether scopes have been updated. [#110](https://github.com/Shopify/shopify-api-node/pull/110)
 
 ### Fixed
 
-- GraphQL Proxy attempts to parse the request body as JSON before passing it to the client. [#106](https://github.com/shopify/shopify-node-api/pull/106)
+- GraphQL Proxy attempts to parse the request body as JSON before passing it to the client. [#106](https://github.com/Shopify/shopify-api-node/pull/106)
 
 ## [0.4.0] - 2021-02-10
 
 ### Added
 
-- Webhooks types are now exported outside the library [#91](https://github.com/shopify/shopify-node-api/pull/91)
-- Added support for private apps [#99](https://github.com/Shopify/shopify-node-api/pull/99)
-- `USER_AGENT_PREFIX` added to Context, to add agent to all requests [#101](https://github.com/Shopify/shopify-node-api/pull/101)
-- Add link to tutorial on how to rotate credentials if neccesary [#107](https://github.com/Shopify/shopify-node-api/pull/107)
+- Webhooks types are now exported outside the library [#91](https://github.com/Shopify/shopify-api-node/pull/91)
+- Added support for private apps [#99](https://github.com/Shopify/shopify-api-node/pull/99)
+- `USER_AGENT_PREFIX` added to Context, to add agent to all requests [#101](https://github.com/Shopify/shopify-api-node/pull/101)
+- Add link to tutorial on how to rotate credentials if neccesary [#107](https://github.com/Shopify/shopify-api-node/pull/107)
 
 ### Fixed
 
-- Export `withSession` utility method [#96](https://github.com/Shopify/shopify-node-api/pull/96)
-- GraphQL Client appropriately handles queries with variables [#97](https://github.com/Shopify/shopify-node-api/pull/97)
-- Use cryptographically random bytes to generate nonce [#98](https://github.com/Shopify/shopify-node-api/pull/98)
-- Stop using `SameSite=none` cookies for OAuth, using `lax` instead [#100](https://github.com/Shopify/shopify-node-api/pull/100)
+- Export `withSession` utility method [#96](https://github.com/Shopify/shopify-api-node/pull/96)
+- GraphQL Client appropriately handles queries with variables [#97](https://github.com/Shopify/shopify-api-node/pull/97)
+- Use cryptographically random bytes to generate nonce [#98](https://github.com/Shopify/shopify-api-node/pull/98)
+- Stop using `SameSite=none` cookies for OAuth, using `lax` instead [#100](https://github.com/Shopify/shopify-api-node/pull/100)
 
 ## [0.3.1] - 2021-02-03
 
 ### Fixed
 
-- Fixed an issue when deleting the current session for embedded apps [#88](https://github.com/shopify/shopify-node-api/pull/88)
+- Fixed an issue when deleting the current session for embedded apps [#88](https://github.com/Shopify/shopify-api-node/pull/88)
 
 ## [0.3.0] - 2021-01-27
 
 ### Added
 
-- Add `withSession` utility method [#83](https://github.com/shopify/shopify-node-api/pull/83)
+- Add `withSession` utility method [#83](https://github.com/Shopify/shopify-api-node/pull/83)
 
 ### Fixed
 
-- Refactor library public interface [#87](https://github.com/shopify/shopify-node-api/pull/87)
-- Check if a webhook is registered before calling Shopify [#82](https://github.com/shopify/shopify-node-api/pull/82)
+- Refactor library public interface [#87](https://github.com/Shopify/shopify-api-node/pull/87)
+- Check if a webhook is registered before calling Shopify [#82](https://github.com/Shopify/shopify-api-node/pull/82)
 
 ## [0.2.2] - 2021-01-14
 
 ### Fixed
 
-- Ensure that the OAuth session expiration matches the cookie expiration [#72](https://github.com/shopify/shopify-node-api/pull/72) / [#73](https://github.com/shopify/shopify-node-api/pull/73)
+- Ensure that the OAuth session expiration matches the cookie expiration [#72](https://github.com/Shopify/shopify-api-node/pull/72) / [#73](https://github.com/Shopify/shopify-api-node/pull/73)
 
 ## [0.2.0] - 2021-01-13
 
-- Preserve the OAuth cookie session for a few seconds so SPA can perform their initial load using it [#70](https://github.com/shopify/shopify-node-api/pull/70)
-- Session fetches now return `undefined` when a session is not available [#64](https://github.com/shopify/shopify-node-api/pull/64)
-- Add `deleteCurrentSession` utils method [#60](https://github.com/shopify/shopify-node-api/pull/60)
+- Preserve the OAuth cookie session for a few seconds so SPA can perform their initial load using it [#70](https://github.com/Shopify/shopify-api-node/pull/70)
+- Session fetches now return `undefined` when a session is not available [#64](https://github.com/Shopify/shopify-api-node/pull/64)
+- Add `deleteCurrentSession` utils method [#60](https://github.com/Shopify/shopify-api-node/pull/60)
 
 ## [0.1.0] - 2020-12-17
 

package/dist/auth/oauth/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAexB,OAAO,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAElD,OAAO,EACL,SAAS,EAIV,MAAM,SAAS,CAAC;AAEjB,QAAA,MAAM,YAAY;;IAGhB;;;;;;;;;;OAUG;uBAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,QACvB,MAAM,gBACE,MAAM,uBAEnB,QAAQ,MAAM,CAAC;IAgDlB;;;;;;;;;;OAUG;kCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,SACtB,SAAS,GACf,QAAQ,gBAAgB,CAAC;IAuG5B;;;;;OAKG;gCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,GAC5B,MAAM,GAAG,SAAS;IAQrB;;;;;OAKG;0BACmB,MAAM,UAAU,MAAM,GAAG,MAAM;IAIrD;;;;OAIG;8BACuB,MAAM,GAAG,MAAM;IAIzC;;;;;;OAMG;iCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,uBAE5B,MAAM,GAAG,SAAS;CAiCtB,CAAC;AAcF,OAAO,EAAC,YAAY,EAAC,CAAC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAexB,OAAO,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,SAAS,EAIV,MAAM,SAAS,CAAC;AAEjB,QAAA,MAAM,YAAY;;IAGhB;;;;;;;;;;OAUG;uBAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,QACvB,MAAM,gBACE,MAAM,uBAEnB,QAAQ,MAAM,CAAC;IAiDlB;;;;;;;;;;OAUG;kCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,SACtB,SAAS,GACf,QAAQ,gBAAgB,CAAC;IAuG5B;;;;;OAKG;gCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,GAC5B,MAAM,GAAG,SAAS;IAQrB;;;;;OAKG;0BACmB,MAAM,UAAU,MAAM,GAAG,MAAM;IAIrD;;;;OAIG;8BACuB,MAAM,GAAG,MAAM;IAIzC;;;;;;OAMG;iCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,uBAE5B,MAAM,GAAG,SAAS;CAiCtB,CAAC;AAcF,OAAO,EAAC,YAAY,EAAC,CAAC"}

package/dist/auth/oauth/oauth.js

@@ -14,6 +14,7 @@ var session_1 = require("../session");
 var http_client_1 = require("../../clients/http_client/http_client");
 var types_1 = require("../../clients/http_client/types");
 var ShopifyErrors = tslib_1.__importStar(require("../../error"));
+var shop_validator_1 = require("../../utils/shop-validator");
 var ShopifyOAuth = {
     SESSION_COOKIE_NAME: 'shopify_app_session',
     /**
@@ -30,18 +31,19 @@ var ShopifyOAuth = {
     beginAuth: function (request, response, shop, redirectPath, isOnline) {
         if (isOnline === void 0) { isOnline = true; }
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var cookies, state, session, sessionStored, query, queryString;
+            var cleanShop, cookies, state, session, sessionStored, query, queryString;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         context_1.Context.throwIfUninitialized();
                         context_1.Context.throwIfPrivateApp('Cannot perform OAuth for private apps');
+                        cleanShop = (0, shop_validator_1.sanitizeShop)(shop, true);
                         cookies = new cookies_1.default(request, response, {
                             keys: [context_1.Context.API_SECRET_KEY],
                             secure: true,
                         });
                         state = (0, nonce_1.default)();
-                        session = new session_1.Session(isOnline ? (0, uuid_1.v4)() : this.getOfflineSessionId(shop), shop, state, isOnline);
+                        session = new session_1.Session(isOnline ? (0, uuid_1.v4)() : this.getOfflineSessionId(cleanShop), cleanShop, state, isOnline);
                         return [4 /*yield*/, context_1.Context.SESSION_STORAGE.storeSession(session)];
                     case 1:
                         sessionStored = _a.sent();
@@ -62,7 +64,7 @@ var ShopifyOAuth = {
                             'grant_options[]': isOnline ? 'per-user' : '',
                         };
                         queryString = querystring_1.default.stringify(query);
-                        return [2 /*return*/, "https://".concat(shop, "/admin/oauth/authorize?").concat(queryString)];
+                        return [2 /*return*/, "https://".concat(cleanShop, "/admin/oauth/authorize?").concat(queryString)];
                 }
             });
         });
@@ -181,7 +183,7 @@ var ShopifyOAuth = {
      * @param userId Current actor id
      */
     getJwtSessionId: function (shop, userId) {
-        return "".concat(shop, "_").concat(userId);
+        return "".concat((0, shop_validator_1.sanitizeShop)(shop, true), "_").concat(userId);
     },
     /**
      * Builds an offline session id for the given shop.
@@ -189,7 +191,7 @@ var ShopifyOAuth = {
      * @param shop Shopify shop domain
      */
     getOfflineSessionId: function (shop) {
-        return "offline_".concat(shop);
+        return "offline_".concat((0, shop_validator_1.sanitizeShop)(shop, true));
     },
     /**
      * Extracts the current session id from the request / response pair.

package/dist/auth/session/session_storage.d.ts

@@ -21,6 +21,18 @@ interface SessionStorage {
      * @param id Id of the session to delete
      */
     deleteSession(id: string): Promise<boolean>;
+    /**
+     * Deletes an array of sessions from storage.
+     *
+     * @param ids Array of session id's to delete
+     */
+    deleteSessions?(ids: string[]): Promise<boolean>;
+    /**
+     * Return an array of sessions for a given shop (or [] if none found).
+     *
+     * @param shop shop of the session(s) to return
+     */
+    findSessionsByShop?(shop: string): Promise<SessionInterface[]>;
 }
 export { SessionStorage };
 //# sourceMappingURL=session_storage.d.ts.map

package/dist/auth/session/session_storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_storage.d.ts","sourceRoot":"","sources":["../../../src/auth/session/session_storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gBAAgB,EAAC,MAAM,SAAS,CAAC;AAEzC;;GAEG;AACH,UAAU,cAAc;IACtB;;;;OAIG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;OAIG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED,OAAO,EAAC,cAAc,EAAC,CAAC"}
+{"version":3,"file":"session_storage.d.ts","sourceRoot":"","sources":["../../../src/auth/session/session_storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gBAAgB,EAAC,MAAM,SAAS,CAAC;AAEzC;;GAEG;AACH,UAAU,cAAc;IACtB;;;;OAIG;IACH,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;OAIG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5C;;;;OAIG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjD;;;;OAIG;IACH,kBAAkB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAChE;AAED,OAAO,EAAC,cAAc,EAAC,CAAC"}

package/dist/auth/session/storage/custom.d.ts

@@ -6,11 +6,15 @@ export declare class CustomSessionStorage implements SessionStorage {
         [key: string]: unknown;
     } | undefined>;
     readonly deleteCallback: (id: string) => Promise<boolean>;
+    readonly deleteSessionsCallback?: ((ids: string[]) => Promise<boolean>) | undefined;
+    readonly findSessionsByShopCallback?: ((shop: string) => Promise<SessionInterface[]>) | undefined;
     constructor(storeCallback: (session: SessionInterface) => Promise<boolean>, loadCallback: (id: string) => Promise<SessionInterface | {
         [key: string]: unknown;
-    } | undefined>, deleteCallback: (id: string) => Promise<boolean>);
+    } | undefined>, deleteCallback: (id: string) => Promise<boolean>, deleteSessionsCallback?: ((ids: string[]) => Promise<boolean>) | undefined, findSessionsByShopCallback?: ((shop: string) => Promise<SessionInterface[]>) | undefined);
     storeSession(session: SessionInterface): Promise<boolean>;
     loadSession(id: string): Promise<SessionInterface | undefined>;
     deleteSession(id: string): Promise<boolean>;
+    deleteSessions(ids: string[]): Promise<boolean>;
+    findSessionsByShop(shop: string): Promise<SessionInterface[]>;
 }
 //# sourceMappingURL=custom.d.ts.map

package/dist/auth/session/storage/custom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom.d.ts","sourceRoot":"","sources":["../../../../src/auth/session/storage/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,gBAAgB,EAAC,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAGlD,qBAAa,oBAAqB,YAAW,cAAc;IAEvD,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC;IACvE,QAAQ,CAAC,YAAY,EAAE,CACrB,EAAE,EAAE,MAAM,KACP,OAAO,CAAC,gBAAgB,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAC,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;gBAJhD,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,EAC9D,YAAY,EAAE,CACrB,EAAE,EAAE,MAAM,KACP,OAAO,CAAC,gBAAgB,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAC,GAAG,SAAS,CAAC,EAC5D,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;IAO9C,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IA0C9D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASzD"}
+{"version":3,"file":"custom.d.ts","sourceRoot":"","sources":["../../../../src/auth/session/storage/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,gBAAgB,EAAC,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAIlD,qBAAa,oBAAqB,YAAW,cAAc;IAEvD,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC;IACvE,QAAQ,CAAC,YAAY,EAAE,CACrB,EAAE,EAAE,MAAM,KACP,OAAO,CAAC,gBAAgB,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAC,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;IACzD,QAAQ,CAAC,sBAAsB,CAAC,SAAQ,MAAM,EAAE,KAAK,QAAQ,OAAO,CAAC;IACrE,QAAQ,CAAC,0BAA0B,CAAC,UAC5B,MAAM,KACT,QAAQ,gBAAgB,EAAE,CAAC;gBARvB,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,EAC9D,YAAY,EAAE,CACrB,EAAE,EAAE,MAAM,KACP,OAAO,CAAC,gBAAgB,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAC,GAAG,SAAS,CAAC,EAC5D,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAChD,sBAAsB,CAAC,SAAQ,MAAM,EAAE,KAAK,QAAQ,OAAO,CAAC,aAAA,EAC5D,0BAA0B,CAAC,UAC5B,MAAM,KACT,QAAQ,gBAAgB,EAAE,CAAC,aAAA;IASrB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IA2C9D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU3C,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB/C,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAoB3E"}

package/dist/auth/session/storage/custom.js

@@ -4,14 +4,19 @@ exports.CustomSessionStorage = void 0;
 var tslib_1 = require("tslib");
 var session_1 = require("../session");
 var ShopifyErrors = tslib_1.__importStar(require("../../../error"));
+var shop_validator_1 = require("../../../utils/shop-validator");
 var CustomSessionStorage = /** @class */ (function () {
-    function CustomSessionStorage(storeCallback, loadCallback, deleteCallback) {
+    function CustomSessionStorage(storeCallback, loadCallback, deleteCallback, deleteSessionsCallback, findSessionsByShopCallback) {
         this.storeCallback = storeCallback;
         this.loadCallback = loadCallback;
         this.deleteCallback = deleteCallback;
+        this.deleteSessionsCallback = deleteSessionsCallback;
+        this.findSessionsByShopCallback = findSessionsByShopCallback;
         this.storeCallback = storeCallback;
         this.loadCallback = loadCallback;
         this.deleteCallback = deleteCallback;
+        this.deleteSessionsCallback = deleteSessionsCallback;
+        this.findSessionsByShopCallback = findSessionsByShopCallback;
     }
     CustomSessionStorage.prototype.storeSession = function (session) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
@@ -58,6 +63,7 @@ var CustomSessionStorage = /** @class */ (function () {
                                 if (session.expires && typeof session.expires === 'string') {
                                     session.expires = new Date(session.expires);
                                 }
+                                Object.setPrototypeOf(session, session_1.Session.prototype);
                                 return [2 /*return*/, session];
                             }
                             else {
@@ -89,6 +95,58 @@ var CustomSessionStorage = /** @class */ (function () {
             });
         });
     };
+    CustomSessionStorage.prototype.deleteSessions = function (ids) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var error_4;
+            return tslib_1.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!this.deleteSessionsCallback) return [3 /*break*/, 5];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.deleteSessionsCallback(ids)];
+                    case 2: return [2 /*return*/, _a.sent()];
+                    case 3:
+                        error_4 = _a.sent();
+                        throw new ShopifyErrors.SessionStorageError("CustomSessionStorage failed to delete array of sessions. Error Details: ".concat(error_4));
+                    case 4: return [3 /*break*/, 6];
+                    case 5:
+                        console.warn("CustomSessionStorage failed to delete array of sessions. Error Details: deleteSessionsCallback not defined.");
+                        _a.label = 6;
+                    case 6: return [2 /*return*/, false];
+                }
+            });
+        });
+    };
+    CustomSessionStorage.prototype.findSessionsByShop = function (shop) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var cleanShop, sessions, error_5;
+            return tslib_1.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        cleanShop = (0, shop_validator_1.sanitizeShop)(shop, true);
+                        sessions = [];
+                        if (!this.findSessionsByShopCallback) return [3 /*break*/, 5];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, this.findSessionsByShopCallback(cleanShop)];
+                    case 2:
+                        sessions = _a.sent();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        error_5 = _a.sent();
+                        throw new ShopifyErrors.SessionStorageError("CustomSessionStorage failed to find sessions by shop. Error Details: ".concat(error_5));
+                    case 4: return [3 /*break*/, 6];
+                    case 5:
+                        console.warn("CustomSessionStorage failed to find sessions by shop. Error Details: findSessionsByShopCallback not defined.");
+                        _a.label = 6;
+                    case 6: return [2 /*return*/, sessions];
+                }
+            });
+        });
+    };
     return CustomSessionStorage;
 }());
 exports.CustomSessionStorage = CustomSessionStorage;

package/dist/auth/session/storage/memory.d.ts

@@ -5,5 +5,7 @@ export declare class MemorySessionStorage implements SessionStorage {
     storeSession(session: SessionInterface): Promise<boolean>;
     loadSession(id: string): Promise<SessionInterface | undefined>;
     deleteSession(id: string): Promise<boolean>;
+    deleteSessions(ids: string[]): Promise<boolean>;
+    findSessionsByShop(shop: string): Promise<SessionInterface[]>;
 }
 //# sourceMappingURL=memory.d.ts.map

package/dist/auth/session/storage/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../../src/auth/session/storage/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gBAAgB,EAAC,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAElD,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,QAAQ,CAAwC;IAE3C,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAI9D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAMzD"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../../src/auth/session/storage/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gBAAgB,EAAC,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAGlD,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,QAAQ,CAAwC;IAE3C,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAI9D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3C,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAK/C,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAQ3E"}

package/dist/auth/session/storage/memory.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MemorySessionStorage = void 0;
 var tslib_1 = require("tslib");
+var shop_validator_1 = require("../../../utils/shop-validator");
 var MemorySessionStorage = /** @class */ (function () {
     function MemorySessionStorage() {
         this.sessions = {};
@@ -31,6 +32,25 @@ var MemorySessionStorage = /** @class */ (function () {
             });
         });
     };
+    MemorySessionStorage.prototype.deleteSessions = function (ids) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var _this = this;
+            return tslib_1.__generator(this, function (_a) {
+                ids.forEach(function (id) { return delete _this.sessions[id]; });
+                return [2 /*return*/, true];
+            });
+        });
+    };
+    MemorySessionStorage.prototype.findSessionsByShop = function (shop) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var cleanShop, results;
+            return tslib_1.__generator(this, function (_a) {
+                cleanShop = (0, shop_validator_1.sanitizeShop)(shop, true);
+                results = Object.values(this.sessions).filter(function (session) { return session.shop === cleanShop; });
+                return [2 /*return*/, results];
+            });
+        });
+    };
     return MemorySessionStorage;
 }());
 exports.MemorySessionStorage = MemorySessionStorage;

package/dist/auth/session/storage/mongodb.d.ts

@@ -14,6 +14,8 @@ export declare class MongoDBSessionStorage implements SessionStorage {
     storeSession(session: SessionInterface): Promise<boolean>;
     loadSession(id: string): Promise<SessionInterface | undefined>;
     deleteSession(id: string): Promise<boolean>;
+    deleteSessions(ids: string[]): Promise<boolean>;
+    findSessionsByShop(shop: string): Promise<SessionInterface[]>;
     disconnect(): Promise<void>;
     private get collection();
     private init;

package/dist/auth/session/storage/mongodb.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mongodb.d.ts","sourceRoot":"","sources":["../../../../src/auth/session/storage/mongodb.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,gBAAgB,EAAC,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAGlD,MAAM,WAAW,4BAA4B;IAC3C,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAKD,qBAAa,qBAAsB,YAAW,cAAc;IAyBxD,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAzBhB,MAAM,CAAC,eAAe,CACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,CAAC,4BAA4B,CAAC;IAa7C,SAAgB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,OAAO,CAA+B;IAE9C,OAAO,CAAC,MAAM,CAAM;gBAGV,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,MAAM,EACtB,IAAI,GAAE,OAAO,CAAC,4BAA4B,CAAM;IASrC,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAazD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAS9D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxC,OAAO,KAAK,UAAU,GAIrB;YAEa,IAAI;YAOJ,oBAAoB;YAOpB,gBAAgB;CAM/B"}
+{"version":3,"file":"mongodb.d.ts","sourceRoot":"","sources":["../../../../src/auth/session/storage/mongodb.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,gBAAgB,EAAC,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAIlD,MAAM,WAAW,4BAA4B;IAC3C,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAKD,qBAAa,qBAAsB,YAAW,cAAc;IAyBxD,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAzBhB,MAAM,CAAC,eAAe,CACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,CAAC,4BAA4B,CAAC;IAa7C,SAAgB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,OAAO,CAA+B;IAE9C,OAAO,CAAC,MAAM,CAAM;gBAGV,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,MAAM,EACtB,IAAI,GAAE,OAAO,CAAC,4BAA4B,CAAM;IASrC,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAazD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAQ9D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3C,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAM/C,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAY7D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxC,OAAO,KAAK,UAAU,GAIrB;YAEa,IAAI;YAOJ,oBAAoB;YAOpB,gBAAgB;CAM/B"}

package/dist/auth/session/storage/mongodb.js

@@ -4,6 +4,7 @@ exports.MongoDBSessionStorage = void 0;
 var tslib_1 = require("tslib");
 var mongodb = tslib_1.__importStar(require("mongodb"));
 var session_utils_1 = require("../session-utils");
+var shop_validator_1 = require("../../../utils/shop-validator");
 var defaultMongoDBSessionStorageOptions = {
     sessionCollectionName: 'shopify_sessions',
 };
@@ -28,7 +29,7 @@ var MongoDBSessionStorage = /** @class */ (function () {
                     case 0: return [4 /*yield*/, this.ready];
                     case 1:
                         _a.sent();
-                        return [4 /*yield*/, this.collection.findOneAndReplace({ id: session.id }, { id: session.id, entries: (0, session_utils_1.sessionEntries)(session) }, {
+                        return [4 /*yield*/, this.collection.findOneAndReplace({ id: session.id }, Object.fromEntries((0, session_utils_1.sessionEntries)(session)), {
                                 upsert: true,
                             })];
                     case 2:
@@ -40,7 +41,7 @@ var MongoDBSessionStorage = /** @class */ (function () {
     };
     MongoDBSessionStorage.prototype.loadSession = function (id) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var rawResult;
+            var result;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0: return [4 /*yield*/, this.ready];
@@ -48,10 +49,8 @@ var MongoDBSessionStorage = /** @class */ (function () {
                         _a.sent();
                         return [4 /*yield*/, this.collection.findOne({ id: id })];
                     case 2:
-                        rawResult = _a.sent();
-                        if (!rawResult)
-                            return [2 /*return*/, undefined];
-                        return [2 /*return*/, (0, session_utils_1.sessionFromEntries)(rawResult.entries)];
+                        result = _a.sent();
+                        return [2 /*return*/, result ? (0, session_utils_1.sessionFromEntries)(Object.entries(result)) : undefined];
                 }
             });
         });
@@ -71,6 +70,42 @@ var MongoDBSessionStorage = /** @class */ (function () {
             });
         });
     };
+    MongoDBSessionStorage.prototype.deleteSessions = function (ids) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            return tslib_1.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.ready];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, this.collection.deleteMany({ id: { $in: ids } })];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/, true];
+                }
+            });
+        });
+    };
+    MongoDBSessionStorage.prototype.findSessionsByShop = function (shop) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var cleanShop, rawResults;
+            return tslib_1.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.ready];
+                    case 1:
+                        _a.sent();
+                        cleanShop = (0, shop_validator_1.sanitizeShop)(shop, true);
+                        return [4 /*yield*/, this.collection.find({ shop: cleanShop }).toArray()];
+                    case 2:
+                        rawResults = _a.sent();
+                        if (!rawResults || (rawResults === null || rawResults === void 0 ? void 0 : rawResults.length) === 0)
+                            return [2 /*return*/, []];
+                        return [2 /*return*/, rawResults.map(function (rawResult) {
+                                return (0, session_utils_1.sessionFromEntries)(Object.entries(rawResult));
+                            })];
+                }
+            });
+        });
+    };
     MongoDBSessionStorage.prototype.disconnect = function () {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             return tslib_1.__generator(this, function (_a) {