@shopify/shopify-api 5.1.0 → 6.0.0-rc1

package/dist/auth/get-embedded-app-url.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBuildEmbeddedAppUrl = exports.createGetEmbeddedAppUrl = void 0;
+var tslib_1 = require("tslib");
+var ShopifyErrors = tslib_1.__importStar(require("../error"));
+var http_1 = require("../runtime/http");
+var shop_validator_1 = require("../utils/shop-validator");
+function createGetEmbeddedAppUrl(config) {
+    var _this = this;
+    return function (_a) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
+        var request, url, host;
+        var adapterArgs = tslib_1.__rest(_a, []);
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, http_1.abstractConvertRequest)(adapterArgs)];
+                case 1:
+                    request = _b.sent();
+                    if (!request) {
+                        throw new ShopifyErrors.MissingRequiredArgument('getEmbeddedAppUrl requires a request object argument');
+                    }
+                    if (!request.url) {
+                        throw new ShopifyErrors.InvalidRequestError('Request does not contain a URL');
+                    }
+                    url = new URL(request.url, "https://".concat(request.headers.host));
+                    host = url.searchParams.get('host');
+                    if (typeof host !== 'string') {
+                        throw new ShopifyErrors.InvalidRequestError('Request does not contain a host query parameter');
+                    }
+                    return [2 /*return*/, createBuildEmbeddedAppUrl(config)(host)];
+            }
+        });
+    }); };
+}
+exports.createGetEmbeddedAppUrl = createGetEmbeddedAppUrl;
+function createBuildEmbeddedAppUrl(config) {
+    return function (host) {
+        (0, shop_validator_1.createSanitizeHost)(config)(host, true);
+        // eslint-disable-next-line no-warning-comments
+        // TODO Remove the Buffer.from call when dropping Node 14 support
+        var decodedHost = typeof atob === 'undefined'
+            ? Buffer.from(host, 'base64').toString()
+            : atob(host);
+        return "https://".concat(decodedHost, "/apps/").concat(config.apiKey);
+    };
+}
+exports.createBuildEmbeddedAppUrl = createBuildEmbeddedAppUrl;

package/dist/auth/index.d.ts

@@ -0,0 +1,12 @@
+import { ConfigInterface } from '../base-types';
+import { nonce } from './oauth/nonce';
+import { safeCompare } from './oauth/safe-compare';
+export declare function shopifyAuth(config: ConfigInterface): {
+    begin: ({ shop, callbackPath, isOnline, ...adapterArgs }: import("./types").BeginParams) => Promise<any>;
+    callback: <T = any>({ isOnline, ...adapterArgs }: import("./types").CallbackParams) => Promise<import("./types").CallbackResponse<T>>;
+    nonce: typeof nonce;
+    safeCompare: typeof safeCompare;
+    getEmbeddedAppUrl: ({ ...adapterArgs }: import("./types").GetEmbeddedAppUrlParams) => Promise<string>;
+    buildEmbeddedAppUrl: (host: string) => string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,eAAe,EAAC,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAC,KAAK,EAAC,MAAM,eAAe,CAAC;AACpC,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAMjD,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe;;;;;;;EASlD"}

package/dist/auth/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shopifyAuth = void 0;
+var oauth_1 = require("./oauth/oauth");
+var nonce_1 = require("./oauth/nonce");
+var safe_compare_1 = require("./oauth/safe-compare");
+var get_embedded_app_url_1 = require("./get-embedded-app-url");
+function shopifyAuth(config) {
+    return {
+        begin: (0, oauth_1.createBegin)(config),
+        callback: (0, oauth_1.createCallback)(config),
+        nonce: nonce_1.nonce,
+        safeCompare: safe_compare_1.safeCompare,
+        getEmbeddedAppUrl: (0, get_embedded_app_url_1.createGetEmbeddedAppUrl)(config),
+        buildEmbeddedAppUrl: (0, get_embedded_app_url_1.createBuildEmbeddedAppUrl)(config),
+    };
+}
+exports.shopifyAuth = shopifyAuth;

package/dist/auth/oauth/nonce.d.ts

@@ -0,0 +1,2 @@
+export declare function nonce(): string;
+//# sourceMappingURL=nonce.d.ts.map

package/dist/auth/oauth/nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/nonce.ts"],"names":[],"mappings":"AAEA,wBAAgB,KAAK,IAAI,MAAM,CAgB9B"}

package/dist/auth/oauth/nonce.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nonce = void 0;
+var crypto_1 = require("../../runtime/crypto");
+function nonce() {
+    var length = 15;
+    // eslint-disable-next-line no-warning-comments
+    // TODO Remove the randomBytes call when dropping Node 14 support
+    var bytes = crypto_1.crypto.getRandomValues
+        ? crypto_1.crypto.getRandomValues(new Uint8Array(length))
+        : crypto_1.crypto.randomBytes(length);
+    var nonce = bytes
+        .map(function (byte) {
+        return byte % 10;
+    })
+        .join('');
+    return nonce;
+}
+exports.nonce = nonce;

package/dist/auth/oauth/oauth.d.ts

@@ -1,62 +1,8 @@
-import http from 'http';
-import { SessionInterface } from '../session/types';
-import { AuthQuery } from './types';
-declare const ShopifyOAuth: {
-    SESSION_COOKIE_NAME: string;
-    STATE_COOKIE_NAME: string;
-    /**
-     * Initializes a session and cookie for the OAuth process, and returns the necessary authorization url.
-     *
-     * @param request Current HTTP Request
-     * @param response Current HTTP Response
-     * @param shop Shop url: {shop}.myshopify.com
-     * @param redirect Redirect url for callback
-     * @param isOnline Boolean value. If true, appends 'per-user' grant options to authorization url to receive online access token.
-     *                 During final oauth request, will receive back the online access token and current online session information.
-     *                 Defaults to online access.
-     */
-    beginAuth(request: http.IncomingMessage, response: http.ServerResponse, shop: string, redirectPath: string, isOnline?: boolean): Promise<string>;
-    /**
-     * Validates the received callback query.
-     * If valid, will make the subsequent request to update the current session with the appropriate access token.
-     * Throws errors for missing sessions and invalid callbacks.
-     *
-     * @param request Current HTTP Request
-     * @param response Current HTTP Response
-     * @param query Current HTTP Request Query, containing the information to be validated.
-     *              Depending on framework, this may need to be cast as "unknown" before being passed.
-     * @param isOnline Boolean value. Defaults to true (online access).
-     * @returns SessionInterface
-     */
-    validateAuthCallback(request: http.IncomingMessage, response: http.ServerResponse, query: AuthQuery): Promise<SessionInterface>;
-    /**
-     * Loads the current session id from the session cookie.
-     *
-     * @param request HTTP request object
-     * @param response HTTP response object
-     */
-    getCookieSessionId(request: http.IncomingMessage, response: http.ServerResponse): string | undefined;
-    /**
-     * Builds a JWT session id from the current shop and user.
-     *
-     * @param shop Shopify shop domain
-     * @param userId Current actor id
-     */
-    getJwtSessionId(shop: string, userId: string): string;
-    /**
-     * Builds an offline session id for the given shop.
-     *
-     * @param shop Shopify shop domain
-     */
-    getOfflineSessionId(shop: string): string;
-    /**
-     * Extracts the current session id from the request / response pair.
-     *
-     * @param request  HTTP request object
-     * @param response HTTP response object
-     * @param isOnline Whether to load online (default) or offline sessions (optional)
-     */
-    getCurrentSessionId(request: http.IncomingMessage, response: http.ServerResponse, isOnline?: boolean): string | undefined;
-};
-export { ShopifyOAuth };
+import { ConfigInterface } from '../../base-types';
+import { AdapterResponse } from '../../runtime/http';
+import { BeginParams, CallbackParams, CallbackResponse } from './types';
+export declare const SESSION_COOKIE_NAME = "shopify_app_session";
+export declare const STATE_COOKIE_NAME = "shopify_app_state";
+export declare function createBegin(config: ConfigInterface): ({ shop, callbackPath, isOnline, ...adapterArgs }: BeginParams) => Promise<AdapterResponse>;
+export declare function createCallback(config: ConfigInterface): <T = any>({ isOnline, ...adapterArgs }: CallbackParams) => Promise<CallbackResponse<T>>;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAexB,OAAO,EAAC,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAGlD,OAAO,EACL,SAAS,EAIV,MAAM,SAAS,CAAC;AAEjB,QAAA,MAAM,YAAY;;;IAIhB;;;;;;;;;;OAUG;uBAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,QACvB,MAAM,gBACE,MAAM,uBAEnB,QAAQ,MAAM,CAAC;IAkClB;;;;;;;;;;;OAWG;kCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,SACtB,SAAS,GACf,QAAQ,gBAAgB,CAAC;IAwE5B;;;;;OAKG;gCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,GAC5B,MAAM,GAAG,SAAS;IAIrB;;;;;OAKG;0BACmB,MAAM,UAAU,MAAM,GAAG,MAAM;IAIrD;;;;OAIG;8BACuB,MAAM,GAAG,MAAM;IAIzC;;;;;;OAMG;iCAEQ,KAAK,eAAe,YACnB,KAAK,cAAc,uBAE5B,MAAM,GAAG,SAAS;CAqCtB,CAAC;AAwGF,OAAO,EAAC,YAAY,EAAC,CAAC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/oauth.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAYjD,OAAO,EAIL,eAAe,EAIhB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,WAAW,EACX,cAAc,EAKd,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAIjB,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe,sDAM9C,WAAW,KAAG,QAAQ,eAAe,CAAC,CA6C1C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,2CAIjD,cAAc,kCAiFlB"}

package/dist/auth/oauth/oauth.js

@@ -1,267 +1,206 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ShopifyOAuth = void 0;
+exports.createCallback = exports.createBegin = exports.STATE_COOKIE_NAME = exports.SESSION_COOKIE_NAME = void 0;
 var tslib_1 = require("tslib");
-var querystring_1 = tslib_1.__importDefault(require("querystring"));
 var uuid_1 = require("uuid");
-var cookies_1 = tslib_1.__importDefault(require("cookies"));
-var context_1 = require("../../context");
-var nonce_1 = tslib_1.__importDefault(require("../../utils/nonce"));
-var hmac_validator_1 = tslib_1.__importDefault(require("../../utils/hmac-validator"));
-var safe_compare_1 = tslib_1.__importDefault(require("../../utils/safe-compare"));
-var decode_session_token_1 = tslib_1.__importDefault(require("../../utils/decode-session-token"));
-var session_1 = require("../session");
-var http_client_1 = require("../../clients/http_client/http_client");
-var types_1 = require("../../clients/http_client/types");
+var processed_query_1 = tslib_1.__importDefault(require("../../utils/processed-query"));
 var ShopifyErrors = tslib_1.__importStar(require("../../error"));
+var hmac_validator_1 = require("../../utils/hmac-validator");
 var shop_validator_1 = require("../../utils/shop-validator");
-var ShopifyOAuth = {
-    SESSION_COOKIE_NAME: 'shopify_app_session',
-    STATE_COOKIE_NAME: 'shopify_app_state',
-    /**
-     * Initializes a session and cookie for the OAuth process, and returns the necessary authorization url.
-     *
-     * @param request Current HTTP Request
-     * @param response Current HTTP Response
-     * @param shop Shop url: {shop}.myshopify.com
-     * @param redirect Redirect url for callback
-     * @param isOnline Boolean value. If true, appends 'per-user' grant options to authorization url to receive online access token.
-     *                 During final oauth request, will receive back the online access token and current online session information.
-     *                 Defaults to online access.
-     */
-    beginAuth: function (request, response, shop, redirectPath, isOnline) {
-        if (isOnline === void 0) { isOnline = true; }
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var cleanShop, cookies, state, query, queryString;
-            return tslib_1.__generator(this, function (_a) {
-                context_1.Context.throwIfUninitialized();
-                context_1.Context.throwIfPrivateApp('Cannot perform OAuth for private apps');
-                cleanShop = (0, shop_validator_1.sanitizeShop)(shop, true);
-                cookies = new cookies_1.default(request, response, {
-                    keys: [context_1.Context.API_SECRET_KEY],
-                    secure: true,
-                });
-                state = isOnline ? "online_".concat((0, nonce_1.default)()) : "offline_".concat((0, nonce_1.default)());
-                cookies.set(ShopifyOAuth.STATE_COOKIE_NAME, state, {
-                    signed: true,
-                    expires: new Date(Date.now() + 60000),
-                    sameSite: 'lax',
-                    secure: true,
-                });
-                query = {
-                    client_id: context_1.Context.API_KEY,
-                    scope: context_1.Context.SCOPES.toString(),
-                    redirect_uri: "".concat(context_1.Context.HOST_SCHEME, "://").concat(context_1.Context.HOST_NAME).concat(redirectPath),
-                    state: state,
-                    'grant_options[]': isOnline ? 'per-user' : '',
-                };
-                queryString = querystring_1.default.stringify(query);
-                return [2 /*return*/, "https://".concat(cleanShop, "/admin/oauth/authorize?").concat(queryString)];
-            });
+var session_1 = require("../../session/session");
+var session_utils_1 = require("../../session/session-utils");
+var http_client_1 = require("../../clients/http_client/http_client");
+var types_1 = require("../../clients/http_client/types");
+var http_1 = require("../../runtime/http");
+var nonce_1 = require("./nonce");
+var safe_compare_1 = require("./safe-compare");
+exports.SESSION_COOKIE_NAME = 'shopify_app_session';
+exports.STATE_COOKIE_NAME = 'shopify_app_state';
+function createBegin(config) {
+    var _this = this;
+    return function (_a) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
+        var cleanShop, request, cookies, state, query, processedQuery, response;
+        var shop = _a.shop, callbackPath = _a.callbackPath, isOnline = _a.isOnline, adapterArgs = tslib_1.__rest(_a, ["shop", "callbackPath", "isOnline"]);
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    throwIfPrivateApp(config.isPrivateApp, 'Cannot perform OAuth for private apps');
+                    cleanShop = (0, shop_validator_1.createSanitizeShop)(config)(shop, true);
+                    return [4 /*yield*/, (0, http_1.abstractConvertRequest)(adapterArgs)];
+                case 1:
+                    request = _b.sent();
+                    cookies = new http_1.Cookies(request, {}, {
+                        keys: [config.apiSecretKey],
+                        secure: true,
+                    });
+                    state = (0, nonce_1.nonce)();
+                    return [4 /*yield*/, cookies.setAndSign(exports.STATE_COOKIE_NAME, state, {
+                            expires: new Date(Date.now() + 60000),
+                            sameSite: 'lax',
+                            secure: true,
+                        })];
+                case 2:
+                    _b.sent();
+                    query = {
+                        client_id: config.apiKey,
+                        scope: config.scopes.toString(),
+                        redirect_uri: "".concat(config.hostScheme, "://").concat(config.hostName).concat(callbackPath),
+                        state: state,
+                        'grant_options[]': isOnline ? 'per-user' : '',
+                    };
+                    processedQuery = new processed_query_1.default();
+                    processedQuery.putAll(query);
+                    response = {
+                        statusCode: 302,
+                        statusText: 'Found',
+                        headers: tslib_1.__assign(tslib_1.__assign({}, cookies.response.headers), { Location: "".concat(config.hostScheme, "://").concat(cleanShop, "/admin/oauth/authorize").concat(processedQuery.stringify()) }),
+                    };
+                    return [2 /*return*/, (0, http_1.abstractConvertResponse)(response, adapterArgs)];
+            }
         });
-    },
-    /**
-     * Validates the received callback query.
-     * If valid, will make the subsequent request to update the current session with the appropriate access token.
-     * Throws errors for missing sessions and invalid callbacks.
-     *
-     * @param request Current HTTP Request
-     * @param response Current HTTP Response
-     * @param query Current HTTP Request Query, containing the information to be validated.
-     *              Depending on framework, this may need to be cast as "unknown" before being passed.
-     * @param isOnline Boolean value. Defaults to true (online access).
-     * @returns SessionInterface
-     */
-    validateAuthCallback: function (request, response, query) {
+    }); };
+}
+exports.createBegin = createBegin;
+function createCallback(config) {
+    return function callback(_a) {
+        var isOnline = _a.isOnline, adapterArgs = tslib_1.__rest(_a, ["isOnline"]);
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var stateFromCookie, isOnline, body, postParams, cleanShop, client, postResponse, session, cookies, sessionStored;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
+            var request, query, cookies, stateFromCookie, authQuery, body, postParams, cleanShop, HttpClient, client, postResponse, session, sessionStored;
+            var _b;
+            return tslib_1.__generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
-                        context_1.Context.throwIfUninitialized();
-                        context_1.Context.throwIfPrivateApp('Cannot perform OAuth for private apps');
-                        stateFromCookie = getValueFromCookie(request, response, this.STATE_COOKIE_NAME);
-                        deleteCookie(request, response, this.STATE_COOKIE_NAME);
+                        throwIfPrivateApp(config.isPrivateApp, 'Cannot perform OAuth for private apps');
+                        return [4 /*yield*/, (0, http_1.abstractConvertRequest)(adapterArgs)];
+                    case 1:
+                        request = _c.sent();
+                        query = new URL(request.url, "".concat(config.hostScheme, "://").concat(config.hostName)).searchParams;
+                        cookies = new http_1.Cookies(request, {}, {
+                            keys: [config.apiSecretKey],
+                            secure: true,
+                        });
+                        return [4 /*yield*/, cookies.getAndVerify(exports.STATE_COOKIE_NAME)];
+                    case 2:
+                        stateFromCookie = _c.sent();
+                        cookies.deleteCookie(exports.STATE_COOKIE_NAME);
                         if (!stateFromCookie) {
-                            throw new ShopifyErrors.CookieNotFound("Cannot complete OAuth process. Could not find an OAuth cookie for shop url: ".concat(query.shop));
+                            throw new ShopifyErrors.CookieNotFound("Cannot complete OAuth process. Could not find an OAuth cookie for shop url: ".concat(query.get('shop')));
                         }
-                        if (!validQuery(query, stateFromCookie)) {
+                        authQuery = Object.fromEntries(query.entries());
+                        return [4 /*yield*/, validQuery({ config: config, query: authQuery, stateFromCookie: stateFromCookie })];
+                    case 3:
+                        if (!(_c.sent())) {
                             throw new ShopifyErrors.InvalidOAuthError('Invalid OAuth callback.');
                         }
-                        isOnline = stateFromCookie.startsWith('online_');
                         body = {
-                            client_id: context_1.Context.API_KEY,
-                            client_secret: context_1.Context.API_SECRET_KEY,
-                            code: query.code,
+                            client_id: config.apiKey,
+                            client_secret: config.apiSecretKey,
+                            code: query.get('code'),
                         };
                         postParams = {
                             path: '/admin/oauth/access_token',
                             type: types_1.DataType.JSON,
                             data: body,
                         };
-                        cleanShop = (0, shop_validator_1.sanitizeShop)(query.shop, true);
-                        client = new http_client_1.HttpClient(cleanShop);
+                        cleanShop = (0, shop_validator_1.createSanitizeShop)(config)(query.get('shop'), true);
+                        HttpClient = (0, http_client_1.createHttpClientClass)(config);
+                        client = new HttpClient({ domain: cleanShop });
                         return [4 /*yield*/, client.post(postParams)];
-                    case 1:
-                        postResponse = _a.sent();
-                        session = createSession(postResponse, cleanShop, stateFromCookie, isOnline);
-                        if (!context_1.Context.IS_EMBEDDED_APP) {
-                            cookies = new cookies_1.default(request, response, {
-                                keys: [context_1.Context.API_SECRET_KEY],
-                                secure: true,
-                            });
-                            cookies.set(ShopifyOAuth.SESSION_COOKIE_NAME, session.id, {
-                                signed: true,
+                    case 4:
+                        postResponse = _c.sent();
+                        session = createSession({
+                            postResponse: postResponse,
+                            shop: cleanShop,
+                            stateFromCookie: stateFromCookie,
+                            isOnline: isOnline,
+                            config: config,
+                        });
+                        if (!!config.isEmbeddedApp) return [3 /*break*/, 6];
+                        return [4 /*yield*/, cookies.setAndSign(exports.SESSION_COOKIE_NAME, session.id, {
                                 expires: session.expires,
                                 sameSite: 'lax',
                                 secure: true,
-                            });
-                        }
-                        return [4 /*yield*/, context_1.Context.SESSION_STORAGE.storeSession(session)];
-                    case 2:
-                        sessionStored = _a.sent();
+                            })];
+                    case 5:
+                        _c.sent();
+                        _c.label = 6;
+                    case 6: return [4 /*yield*/, config.sessionStorage.storeSession(session)];
+                    case 7:
+                        sessionStored = _c.sent();
                         if (!sessionStored) {
                             throw new ShopifyErrors.SessionStorageError('Session could not be saved. Please check your session storage functionality.');
                         }
-                        return [2 /*return*/, session];
+                        _b = {};
+                        return [4 /*yield*/, (0, http_1.abstractConvertHeaders)(cookies.response.headers, adapterArgs)];
+                    case 8: return [2 /*return*/, (_b.headers = (_c.sent()),
+                            _b.session = session,
+                            _b)];
                 }
             });
         });
-    },
-    /**
-     * Loads the current session id from the session cookie.
-     *
-     * @param request HTTP request object
-     * @param response HTTP response object
-     */
-    getCookieSessionId: function (request, response) {
-        return getValueFromCookie(request, response, this.SESSION_COOKIE_NAME);
-    },
-    /**
-     * Builds a JWT session id from the current shop and user.
-     *
-     * @param shop Shopify shop domain
-     * @param userId Current actor id
-     */
-    getJwtSessionId: function (shop, userId) {
-        return "".concat((0, shop_validator_1.sanitizeShop)(shop, true), "_").concat(userId);
-    },
-    /**
-     * Builds an offline session id for the given shop.
-     *
-     * @param shop Shopify shop domain
-     */
-    getOfflineSessionId: function (shop) {
-        return "offline_".concat((0, shop_validator_1.sanitizeShop)(shop, true));
-    },
-    /**
-     * Extracts the current session id from the request / response pair.
-     *
-     * @param request  HTTP request object
-     * @param response HTTP response object
-     * @param isOnline Whether to load online (default) or offline sessions (optional)
-     */
-    getCurrentSessionId: function (request, response, isOnline) {
-        if (isOnline === void 0) { isOnline = true; }
-        var currentSessionId;
-        if (context_1.Context.IS_EMBEDDED_APP) {
-            var authHeader = request.headers.authorization;
-            if (authHeader) {
-                var matches = authHeader.match(/^Bearer (.+)$/);
-                if (!matches) {
-                    throw new ShopifyErrors.MissingJwtTokenError('Missing Bearer token in authorization header');
-                }
-                var jwtPayload = (0, decode_session_token_1.default)(matches[1]);
-                var shop = jwtPayload.dest.replace(/^https:\/\//, '');
-                if (isOnline) {
-                    currentSessionId = this.getJwtSessionId(shop, jwtPayload.sub);
-                }
-                else {
-                    currentSessionId = this.getOfflineSessionId(shop);
-                }
-            }
-        }
-        // Non-embedded apps will always load sessions using cookies. However, we fall back to the cookie session for
-        // embedded apps to allow apps to load their skeleton page after OAuth, so they can set up App Bridge and get a new
-        // JWT.
-        if (!currentSessionId) {
-            // We still want to get the offline session id from the cookie to make sure it's validated
-            currentSessionId = getValueFromCookie(request, response, this.SESSION_COOKIE_NAME);
-        }
-        return currentSessionId;
-    },
-};
-exports.ShopifyOAuth = ShopifyOAuth;
-/**
- * Uses the validation utils validateHmac, and safeCompare to assess whether the callback is valid.
- *
- * @param query Current HTTP Request Query
- * @param stateFromCookie state value from the current cookie
- */
-function validQuery(query, stateFromCookie) {
-    return (0, hmac_validator_1.default)(query) && (0, safe_compare_1.default)(query.state, stateFromCookie);
-}
-/**
- * Loads a given value from the cookie
- *
- * @param request HTTP request object
- * @param response HTTP response object
- * @param name Name of the cookie to load
- */
-function getValueFromCookie(request, response, name) {
-    var cookies = new cookies_1.default(request, response, {
-        secure: true,
-        keys: [context_1.Context.API_SECRET_KEY],
-    });
-    return cookies.get(name, { signed: true });
+    };
 }
-/**
- * Loads a given value from the cookie
- *
- * @param request HTTP request object
- * @param response HTTP response object
- * @param name Name of the cookie to load
- */
-function deleteCookie(request, response, name) {
-    var cookies = new cookies_1.default(request, response, {
-        secure: true,
-        keys: [context_1.Context.API_SECRET_KEY],
+exports.createCallback = createCallback;
+function validQuery(_a) {
+    var config = _a.config, query = _a.query, stateFromCookie = _a.stateFromCookie;
+    return tslib_1.__awaiter(this, void 0, void 0, function () {
+        return tslib_1.__generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, hmac_validator_1.createValidateHmac)(config)(query)];
+                case 1: return [2 /*return*/, ((_b.sent()) &&
+                        (0, safe_compare_1.safeCompare)(query.state, stateFromCookie))];
+            }
+        });
     });
-    cookies.set(name);
 }
-/**
- * Creates a new session from the response from the access token request.
- *
- * @param postResponse Response from the access token request
- * @param shop Shop url: {shop}.myshopify.com
- * @param stateFromCookie State from the cookie received by the OAuth callback
- * @param isOnline Boolean indicating if the access token is for online access
- * @returns SessionInterface
- */
-function createSession(postResponse, shop, stateFromCookie, isOnline) {
-    var session;
+function createSession(_a) {
+    var config = _a.config, postResponse = _a.postResponse, shop = _a.shop, stateFromCookie = _a.stateFromCookie, isOnline = _a.isOnline;
+    if (!isOnline &&
+        postResponse.body.associated_user) {
+        throw new ShopifyErrors.InvalidOAuthError('Attempted to complete offline OAuth flow, but received an online token response. This is likely because ' +
+            "you're not setting the isOnline parameter consistently between begin() and callback()");
+    }
+    if (isOnline &&
+        !postResponse.body.associated_user) {
+        throw new ShopifyErrors.InvalidOAuthError('Attempted to complete online OAuth flow, but received an offline token response. This is likely because ' +
+            "you're not setting the isOnline parameter consistently between begin() and callback()");
+    }
     if (isOnline) {
         var sessionId = void 0;
         var responseBody = postResponse.body;
-        var access_token = responseBody.access_token, scope = responseBody.scope, rest = tslib_1.__rest(responseBody, ["access_token", "scope"]); // eslint-disable-line @typescript-eslint/naming-convention
+        var access_token = responseBody.access_token, scope = responseBody.scope, rest = tslib_1.__rest(responseBody, ["access_token", "scope"]);
         var sessionExpiration = new Date(Date.now() + responseBody.expires_in * 1000);
-        if (context_1.Context.IS_EMBEDDED_APP) {
-            sessionId = ShopifyOAuth.getJwtSessionId(shop, "".concat(rest.associated_user.id));
+        if (config.isEmbeddedApp) {
+            sessionId = (0, session_utils_1.createGetJwtSessionId)(config)(shop, "".concat(rest.associated_user.id));
         }
         else {
             sessionId = (0, uuid_1.v4)();
         }
-        session = new session_1.Session(sessionId, shop, stateFromCookie, isOnline);
-        session.accessToken = access_token;
-        session.scope = scope;
-        session.expires = sessionExpiration;
-        session.onlineAccessInfo = rest;
+        return new session_1.Session({
+            id: sessionId,
+            shop: shop,
+            state: stateFromCookie,
+            isOnline: isOnline,
+            accessToken: access_token,
+            scope: scope,
+            expires: sessionExpiration,
+            onlineAccessInfo: rest,
+        });
     }
     else {
         var responseBody = postResponse.body;
-        session = new session_1.Session(ShopifyOAuth.getOfflineSessionId(shop), shop, stateFromCookie, isOnline);
-        session.accessToken = responseBody.access_token;
-        session.scope = responseBody.scope;
+        return new session_1.Session({
+            id: (0, session_utils_1.createGetOfflineId)(config)(shop),
+            shop: shop,
+            state: stateFromCookie,
+            isOnline: isOnline,
+            accessToken: responseBody.access_token,
+            scope: responseBody.scope,
+        });
+    }
+}
+function throwIfPrivateApp(isPrivateApp, message) {
+    if (isPrivateApp) {
+        throw new ShopifyErrors.PrivateAppError(message);
     }
-    return session;
 }

package/dist/auth/oauth/safe-compare.d.ts

@@ -0,0 +1,6 @@
+export declare function safeCompare(strA: string | {
+    [key: string]: string;
+} | string[] | number[], strB: string | {
+    [key: string]: string;
+} | string[] | number[]): boolean;
+//# sourceMappingURL=safe-compare.d.ts.map

package/dist/auth/oauth/safe-compare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-compare.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/safe-compare.ts"],"names":[],"mappings":"AAEA,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,GAAG;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,EAC5D,IAAI,EAAE,MAAM,GAAG;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,GAC3D,OAAO,CAeT"}