@shopify/shopify-app-remix 1.0.0-rc.0

package/build/cjs/auth/admin/rest-client.js

@@ -0,0 +1,124 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+require('@remix-run/server-runtime');
+require('isbot');
+var handleClientError = require('../helpers/handle-client-error.js');
+
+class RemixRestClient {
+  constructor({
+    params,
+    request,
+    session
+  }) {
+    this.session = void 0;
+    this.resources = void 0;
+    this.params = void 0;
+    this.request = void 0;
+    this.params = params;
+    this.request = request;
+    this.session = session;
+  }
+
+  /**
+   * Performs a GET request on the given path.
+   */
+  async get(params) {
+    return this.makeRequest({
+      method: 'GET',
+      ...params
+    });
+  }
+
+  /**
+   * Performs a POST request on the given path.
+   */
+  async post(params) {
+    return this.makeRequest({
+      method: 'POST',
+      ...params
+    });
+  }
+
+  /**
+   * Performs a PUT request on the given path.
+   */
+  async put(params) {
+    return this.makeRequest({
+      method: 'PUT',
+      ...params
+    });
+  }
+
+  /**
+   * Performs a DELETE request on the given path.
+   */
+  async delete(params) {
+    return this.makeRequest({
+      method: 'DELETE',
+      ...params
+    });
+  }
+  async makeRequest(params) {
+    const originalClient = new this.params.api.clients.Rest({
+      session: this.session
+    });
+    const originalRequest = Reflect.get(originalClient, 'request');
+    try {
+      const apiResponse = await originalRequest.call(originalClient, params);
+
+      // We use a separate client for REST requests and REST resources because we want to override the API library
+      // client class to return a Response object instead.
+      return new Response(JSON.stringify(apiResponse.body), {
+        headers: apiResponse.headers
+      });
+    } catch (error) {
+      throw await handleClientError.handleClientError({
+        params: this.params,
+        request: this.request,
+        shop: this.session.shop,
+        error
+      });
+    }
+  }
+}
+function restResourceClientFactory({
+  params,
+  request,
+  session
+}) {
+  const {
+    api,
+    config,
+    logger
+  } = params;
+  const ApiClient = api.clients.Rest;
+  return class RestResourceClient extends ApiClient {
+    async request(params) {
+      const originalClient = new api.clients.Rest({
+        session
+      });
+      const originalRequest = Reflect.get(originalClient, 'request');
+      try {
+        // We just call through to the API library client, and handle the error response here, so that data parsing
+        // behaves the same way.
+        return await originalRequest.call(originalClient, params);
+      } catch (error) {
+        throw await handleClientError.handleClientError({
+          params: {
+            api,
+            config,
+            logger
+          },
+          request,
+          shop: session.shop,
+          error
+        });
+      }
+    }
+  };
+}
+
+exports.RemixRestClient = RemixRestClient;
+exports.restResourceClientFactory = restResourceClientFactory;

package/build/cjs/auth/const.js

@@ -0,0 +1,17 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+const APP_BRIDGE_NEXT_URL = 'https://cdn.shopify.com/shopifycloud/app-bridge-next.js';
+const REAUTH_URL_HEADER = 'X-Shopify-API-Request-Failure-Reauthorize-Url';
+const APP_BRIDGE_HEADERS = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Headers': 'Authorization',
+  'Access-Control-Expose-Headers': REAUTH_URL_HEADER
+};
+const DEFAULT_CSP_VALUE = `frame-ancestors https://*.myshopify.com https://admin.shopify.com;`;
+
+exports.APP_BRIDGE_HEADERS = APP_BRIDGE_HEADERS;
+exports.APP_BRIDGE_NEXT_URL = APP_BRIDGE_NEXT_URL;
+exports.DEFAULT_CSP_VALUE = DEFAULT_CSP_VALUE;
+exports.REAUTH_URL_HEADER = REAUTH_URL_HEADER;

package/build/cjs/auth/helpers/add-response-headers.js

@@ -0,0 +1,69 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var _const = require('../const.js');
+
+const ORIGINAL_HEADERS = Symbol.for('originalHeaders');
+function addResponseHeadersFactory(params) {
+  const {
+    api,
+    config
+  } = params;
+  return function (request, headers) {
+    const {
+      searchParams
+    } = new URL(request.url);
+    const shop = api.utils.sanitizeShop(searchParams.get('shop'));
+    addResponseHeaders(headers, config.isEmbeddedApp, shop);
+  };
+}
+function addResponseHeaders(headers, isEmbeddedApp, shop) {
+  if (isEmbeddedApp && shop) {
+    // Set or update the CSP with the shop subdomain instead of a wildcard:
+    let csp = headers.get('Content-Security-Policy') || _const.DEFAULT_CSP_VALUE;
+    if (shop) csp = csp.replace('*.myshopify.com', shop);
+    headers.set('Content-Security-Policy', csp);
+  }
+}
+function installGlobalResponseHeaders(isEmbeddedApp) {
+  const headersDescriptor = Object.getOwnPropertyDescriptor(Response.prototype, ORIGINAL_HEADERS) || Object.getOwnPropertyDescriptor(Response.prototype, 'headers');
+
+  // Store the original Response.prototype.headers descriptor so we can use it when live-reloading the server:
+  Object.defineProperty(Response.prototype, ORIGINAL_HEADERS, headersDescriptor);
+
+  // Overwrite the Response.prototype.headers getter with one that injects our global headers:
+  Object.defineProperty(Response.prototype, 'headers', {
+    ...headersDescriptor,
+    get() {
+      // Note: this is not an empty Headers, it will contain any headers passed to new Response():
+      const headers = headersDescriptor.get.call(this);
+      try {
+        // Inject CORS headers required by both Embedded Apps and UI Extensions:
+        if (isEmbeddedApp) {
+          for (const key in _const.APP_BRIDGE_HEADERS) {
+            if (!headers.get(key)) {
+              const value = _const.APP_BRIDGE_HEADERS[key];
+              headers.set(key, value);
+            }
+          }
+        }
+
+        // Apply a default CSP unless a more specific one (no wildcard) is present:
+        if (!headers.get('Content-Security-Policy')) {
+          headers.set('Content-Security-Policy', isEmbeddedApp ? _const.DEFAULT_CSP_VALUE : `frame-ancestors 'none';`);
+        }
+        if (!headers.get('Link')) {
+          headers.set('Link', `<${_const.APP_BRIDGE_NEXT_URL}>; rel="preload"`);
+        }
+      } catch (err) {
+        // Do nothing, this is not a standard Response object.
+      }
+      return headers;
+    }
+  });
+}
+
+exports.addResponseHeaders = addResponseHeaders;
+exports.addResponseHeadersFactory = addResponseHeadersFactory;
+exports.installGlobalResponseHeaders = installGlobalResponseHeaders;

package/build/cjs/auth/helpers/begin-auth.js

@@ -0,0 +1,18 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+async function beginAuth(params, request, isOnline, shop) {
+  const {
+    api,
+    config
+  } = params;
+  throw await api.auth.begin({
+    shop,
+    callbackPath: config.auth.callbackPath,
+    isOnline,
+    rawRequest: request
+  });
+}
+
+exports.beginAuth = beginAuth;

package/build/cjs/auth/helpers/get-session-token-header.js

@@ -0,0 +1,10 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+function getSessionTokenHeader(request) {
+  var _request$headers$get;
+  return (_request$headers$get = request.headers.get('authorization')) === null || _request$headers$get === void 0 ? void 0 : _request$headers$get.replace('Bearer ', '');
+}
+
+exports.getSessionTokenHeader = getSessionTokenHeader;

package/build/cjs/auth/helpers/handle-client-error.js

@@ -0,0 +1,37 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var shopifyApi = require('@shopify/shopify-api');
+var redirectToAuthPage = require('./redirect-to-auth-page.js');
+
+async function handleClientError({
+  params,
+  request,
+  error,
+  shop
+}) {
+  if (error instanceof shopifyApi.HttpResponseError) {
+    params.logger.debug(`Got an HTTP response error from the API: ${error.message}`, {
+      code: error.response.code,
+      statusText: error.response.statusText,
+      body: JSON.stringify(error.response.body)
+    });
+    if (error.response.code === 401) {
+      throw await redirectToAuthPage.redirectToAuthPage(params, request, shop);
+    } else {
+      // forward a minimal copy of the upstream HTTP response instead of an Error:
+      throw new Response(JSON.stringify(error.response.body), {
+        status: error.response.code,
+        headers: {
+          'Content-Type': error.response.headers['Content-Type']
+        }
+      });
+    }
+  } else {
+    params.logger.debug(`Got a response error from the API: ${error.message}`);
+    throw error;
+  }
+}
+
+exports.handleClientError = handleClientError;

package/build/cjs/auth/helpers/redirect-to-auth-page.js

@@ -0,0 +1,22 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var beginAuth = require('./begin-auth.js');
+var redirectWithExitiframe = require('./redirect-with-exitiframe.js');
+var redirectWithAppBridgeHeaders = require('./redirect-with-app-bridge-headers.js');
+
+async function redirectToAuthPage(params, request, shop, isOnline = false) {
+  const url = new URL(request.url);
+  const isEmbeddedRequest = url.searchParams.get('embedded') === '1';
+  const isXhrRequest = request.headers.get('authorization');
+  if (isXhrRequest) {
+    redirectWithAppBridgeHeaders.redirectWithAppBridgeHeaders(params, shop);
+  } else if (isEmbeddedRequest) {
+    redirectWithExitiframe.redirectWithExitIframe(params, request, shop);
+  } else {
+    throw await beginAuth.beginAuth(params, request, isOnline, shop);
+  }
+}
+
+exports.redirectToAuthPage = redirectToAuthPage;

package/build/cjs/auth/helpers/redirect-with-app-bridge-headers.js

@@ -0,0 +1,31 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var _const = require('../const.js');
+var addResponseHeaders = require('./add-response-headers.js');
+
+function redirectWithAppBridgeHeaders(params, shop) {
+  const {
+    config
+  } = params;
+  const redirectUri = `${config.appUrl}${config.auth.path}?shop=${shop}`;
+  throw new Response(undefined, {
+    status: 401,
+    statusText: 'Unauthorized',
+    headers: getAppBridgeHeaders(params, redirectUri, shop)
+  });
+}
+function getAppBridgeHeaders(params, url, shop) {
+  const {
+    config
+  } = params;
+  const headers = new Headers({
+    [_const.REAUTH_URL_HEADER]: url
+  });
+  addResponseHeaders.addResponseHeaders(headers, config.isEmbeddedApp, shop);
+  return headers;
+}
+
+exports.getAppBridgeHeaders = getAppBridgeHeaders;
+exports.redirectWithAppBridgeHeaders = redirectWithAppBridgeHeaders;

package/build/cjs/auth/helpers/redirect-with-exitiframe.js

@@ -0,0 +1,23 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var serverRuntime = require('@remix-run/server-runtime');
+
+function redirectWithExitIframe(params, request, shop) {
+  const {
+    api,
+    config
+  } = params;
+  const url = new URL(request.url);
+  const queryParams = url.searchParams;
+  const host = api.utils.sanitizeHost(queryParams.get('host'));
+  queryParams.set('shop', shop);
+  queryParams.set('exitIframe', `${config.auth.path}?shop=${shop}`);
+  if (host) {
+    queryParams.set('host', host);
+  }
+  throw serverRuntime.redirect(`${config.auth.exitIframePath}?${queryParams.toString()}`);
+}
+
+exports.redirectWithExitIframe = redirectWithExitIframe;

package/build/cjs/auth/helpers/reject-bot-request.js

@@ -0,0 +1,23 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var isbot = require('isbot');
+
+function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
+
+var isbot__default = /*#__PURE__*/_interopDefaultLegacy(isbot);
+
+function rejectBotRequest({
+  logger
+}, request) {
+  if (isbot__default["default"](request.headers.get('User-Agent'))) {
+    logger.debug('Request is from a bot, skipping auth');
+    throw new Response(undefined, {
+      status: 410,
+      statusText: 'Gone'
+    });
+  }
+}
+
+exports.rejectBotRequest = rejectBotRequest;

package/build/cjs/auth/helpers/validate-session-token.js

@@ -0,0 +1,25 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+async function validateSessionToken({
+  api,
+  logger
+}, token) {
+  logger.debug('Validating session token');
+  try {
+    const payload = await api.session.decodeSessionToken(token);
+    logger.debug('Session token is valid', {
+      payload: JSON.stringify(payload)
+    });
+    return payload;
+  } catch (error) {
+    logger.debug(`Failed to validate session token: ${error.message}`);
+    throw new Response(undefined, {
+      status: 401,
+      statusText: 'Unauthorized'
+    });
+  }
+}
+
+exports.validateSessionToken = validateSessionToken;

package/build/cjs/auth/login/login.js

@@ -0,0 +1,54 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var serverRuntime = require('@remix-run/server-runtime');
+var types = require('../../types.js');
+
+function loginFactory(params) {
+  const {
+    api,
+    config,
+    logger
+  } = params;
+  return async function login(request) {
+    if (!config.canUseLoginForm) {
+      logger.debug('Login endpoint not available for Shopify Admin custom apps');
+      throw new Response(undefined, {
+        status: 404
+      });
+    }
+    const url = new URL(request.url);
+    const shopParam = url.searchParams.get('shop');
+    if (request.method === 'GET' && !shopParam) {
+      return {};
+    }
+    const shop = shopParam || (await request.formData()).get('shop');
+    if (!shop) {
+      logger.debug('Missing shop parameter', {
+        shop
+      });
+      return {
+        shop: types.LoginErrorType.MissingShop
+      };
+    }
+    const shopWithoutProtocol = shop.replace(/^https?:\/\//, '');
+    const shopWithDomain = (shop === null || shop === void 0 ? void 0 : shop.indexOf('.')) === -1 ? `${shopWithoutProtocol}.myshopify.com` : shopWithoutProtocol;
+    const sanitizedShop = api.utils.sanitizeShop(shopWithDomain);
+    if (!sanitizedShop) {
+      logger.debug('Invalid shop parameter', {
+        shop
+      });
+      return {
+        shop: types.LoginErrorType.InvalidShop
+      };
+    }
+    const redirectUrl = `${config.appUrl}${config.auth.path}?shop=${sanitizedShop}`;
+    logger.info(`Redirecting login request to ${redirectUrl}`, {
+      shop: sanitizedShop
+    });
+    throw serverRuntime.redirect(redirectUrl);
+  };
+}
+
+exports.loginFactory = loginFactory;

package/build/cjs/auth/public/authenticate.js

@@ -0,0 +1,32 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+require('@remix-run/server-runtime');
+var validateSessionToken = require('../helpers/validate-session-token.js');
+var getSessionTokenHeader = require('../helpers/get-session-token-header.js');
+var rejectBotRequest = require('../helpers/reject-bot-request.js');
+require('@shopify/shopify-api');
+
+function authenticatePublicFactory(params) {
+  return async function authenticatePublic(request) {
+    const {
+      logger
+    } = params;
+    rejectBotRequest.rejectBotRequest(params, request);
+    const sessionTokenHeader = getSessionTokenHeader.getSessionTokenHeader(request);
+    logger.info('Authenticating public request');
+    if (!sessionTokenHeader) {
+      logger.debug('Request did not contain a session token');
+      throw new Response(undefined, {
+        status: 401,
+        statusText: 'Unauthorized'
+      });
+    }
+    return {
+      sessionToken: await validateSessionToken.validateSessionToken(params, sessionTokenHeader)
+    };
+  };
+}
+
+exports.authenticatePublicFactory = authenticatePublicFactory;

package/build/cjs/auth/webhooks/authenticate.js

@@ -0,0 +1,68 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+function authenticateWebhookFactory({
+  api,
+  config,
+  logger
+}) {
+  return async function authenticate(request) {
+    if (request.method !== 'POST') {
+      logger.debug('Received a non-POST request for a webhook. Only POST requests are allowed.', {
+        url: request.url,
+        method: request.method
+      });
+      throw new Response(undefined, {
+        status: 405,
+        statusText: 'Method not allowed'
+      });
+    }
+    const rawBody = await request.text();
+    const check = await api.webhooks.validate({
+      rawBody,
+      rawRequest: request
+    });
+    if (!check.valid) {
+      logger.debug('Webhook validation failed', check);
+      throw new Response(undefined, {
+        status: 400,
+        statusText: 'Bad Request'
+      });
+    }
+    const sessionId = api.session.getOfflineId(check.domain);
+    const session = await config.sessionStorage.loadSession(sessionId);
+    if (!session) {
+      logger.debug('No session found for shop', check);
+      throw new Response(undefined, {
+        status: 404,
+        statusText: 'Not found'
+      });
+    }
+    const restClient = new api.clients.Rest({
+      session,
+      apiVersion: check.apiVersion
+    });
+    const graphqlClient = new api.clients.Graphql({
+      session,
+      apiVersion: check.apiVersion
+    });
+    Object.entries(api.rest).forEach(([name, resource]) => {
+      Reflect.set(restClient, name, resource);
+    });
+    return {
+      apiVersion: check.apiVersion,
+      shop: check.domain,
+      topic: check.topic,
+      webhookId: check.webhookId,
+      payload: JSON.parse(rawBody),
+      session,
+      admin: {
+        rest: restClient,
+        graphql: graphqlClient
+      }
+    };
+  };
+}
+
+exports.authenticateWebhookFactory = authenticateWebhookFactory;

package/build/cjs/auth/webhooks/register.js

@@ -0,0 +1,40 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+function registerWebhooksFactory({
+  api,
+  logger
+}) {
+  return async function registerWebhooks({
+    session
+  }) {
+    return api.webhooks.register({
+      session
+    }).then(response => {
+      Object.entries(response).forEach(([topic, topicResults]) => {
+        topicResults.forEach(({
+          success,
+          ...rest
+        }) => {
+          if (success) {
+            logger.debug('Registered webhook', {
+              topic,
+              shop: session.shop,
+              operation: rest.operation
+            });
+          } else {
+            logger.error('Failed to register webhook', {
+              topic,
+              shop: session.shop,
+              result: JSON.stringify(rest.result)
+            });
+          }
+        });
+      });
+      return response;
+    });
+  };
+}
+
+exports.registerWebhooksFactory = registerWebhooksFactory;

package/build/cjs/billing/cancel.js

@@ -0,0 +1,40 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var shopifyApi = require('@shopify/shopify-api');
+var redirectToAuthPage = require('../auth/helpers/redirect-to-auth-page.js');
+require('@remix-run/server-runtime');
+require('isbot');
+
+function cancelBillingFactory(params, request, session) {
+  return async function cancelBilling(options) {
+    const {
+      api,
+      logger
+    } = params;
+    logger.debug('Cancelling billing', {
+      shop: session.shop,
+      ...options
+    });
+    try {
+      return await api.billing.cancel({
+        session,
+        subscriptionId: options.subscriptionId,
+        isTest: options.isTest,
+        prorate: options.prorate
+      });
+    } catch (error) {
+      if (error instanceof shopifyApi.HttpResponseError && error.response.code === 401) {
+        logger.debug('API token was invalid, redirecting to OAuth', {
+          shop: session.shop
+        });
+        throw await redirectToAuthPage.redirectToAuthPage(params, request, session.shop);
+      } else {
+        throw error;
+      }
+    }
+  };
+}
+
+exports.cancelBillingFactory = cancelBillingFactory;