@shopify/shopify-app-remix 2.0.2 → 2.2.0

package/build/cjs/server/authenticate/admin/helpers/create-admin-api-context.js

@@ -0,0 +1,18 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var factory = require('../../../clients/admin/factory.js');
+var handleClientError = require('./handle-client-error.js');
+
+function createAdminApiContext(request, session, params) {
+  return factory.adminClientFactory({
+    session,
+    params,
+    handleClientError: handleClientError.handleClientErrorFactory({
+      request
+    })
+  });
+}
+
+exports.createAdminApiContext = createAdminApiContext;

package/build/cjs/server/authenticate/admin/helpers/ensure-app-is-embedded-if-required.js

@@ -0,0 +1,27 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var redirectToShopifyOrAppRoot = require('./redirect-to-shopify-or-app-root.js');
+
+const ensureAppIsEmbeddedIfRequired = async (params, request) => {
+  const {
+    api,
+    logger,
+    config
+  } = params;
+  const url = new URL(request.url);
+  const shop = url.searchParams.get('shop');
+  if (api.config.isEmbeddedApp && url.searchParams.get('embedded') !== '1') {
+    logger.debug('App is not embedded, redirecting to Shopify', {
+      shop
+    });
+    await redirectToShopifyOrAppRoot.redirectToShopifyOrAppRoot(request, {
+      api,
+      logger,
+      config
+    });
+  }
+};
+
+exports.ensureAppIsEmbeddedIfRequired = ensureAppIsEmbeddedIfRequired;

package/build/cjs/server/authenticate/admin/helpers/ensure-session-token-search-param-if-required.js

@@ -0,0 +1,25 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var redirectToBouncePage = require('./redirect-to-bounce-page.js');
+
+const SESSION_TOKEN_PARAM = 'id_token';
+const ensureSessionTokenSearchParamIfRequired = async (params, request) => {
+  const {
+    api,
+    logger
+  } = params;
+  const url = new URL(request.url);
+  const shop = url.searchParams.get('shop');
+  const searchParamSessionToken = url.searchParams.get(SESSION_TOKEN_PARAM);
+  const isEmbedded = url.searchParams.get('embedded') === '1';
+  if (api.config.isEmbeddedApp && isEmbedded && !searchParamSessionToken) {
+    logger.debug('Missing session token in search params, going to bounce page', {
+      shop
+    });
+    redirectToBouncePage.redirectToBouncePage(params, url);
+  }
+};
+
+exports.ensureSessionTokenSearchParamIfRequired = ensureSessionTokenSearchParamIfRequired;

package/build/cjs/server/authenticate/admin/helpers/redirect-to-bounce-page.js

@@ -0,0 +1,22 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var serverRuntime = require('@remix-run/server-runtime');
+
+const redirectToBouncePage = (params, url) => {
+  const {
+    config
+  } = params;
+
+  // Make sure we always point to the configured app URL so it also works behind reverse proxies (that alter the Host
+  // header).
+  url.searchParams.set('shopify-reload', `${config.appUrl}${url.pathname}${url.search}`);
+
+  // eslint-disable-next-line no-warning-comments
+  // TODO Make sure this works on chrome without a tunnel (weird HTTPS redirect issue)
+  // https://github.com/orgs/Shopify/projects/6899/views/1?pane=issue&itemId=28376650
+  throw serverRuntime.redirect(`${config.auth.patchSessionTokenPath}${url.search}`);
+};
+
+exports.redirectToBouncePage = redirectToBouncePage;

package/build/cjs/server/authenticate/admin/helpers/redirect-to-shopify-or-app-root.js

@@ -0,0 +1,22 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var serverRuntime = require('@remix-run/server-runtime');
+
+async function redirectToShopifyOrAppRoot(request, params, responseHeaders) {
+  const {
+    api
+  } = params;
+  const url = new URL(request.url);
+  const host = api.utils.sanitizeHost(url.searchParams.get('host'));
+  const shop = api.utils.sanitizeShop(url.searchParams.get('shop'));
+  const redirectUrl = api.config.isEmbeddedApp ? await api.auth.getEmbeddedAppUrl({
+    rawRequest: request
+  }) : `/?shop=${shop}&host=${encodeURIComponent(host)}`;
+  throw serverRuntime.redirect(redirectUrl, {
+    headers: responseHeaders
+  });
+}
+
+exports.redirectToShopifyOrAppRoot = redirectToShopifyOrAppRoot;

package/build/cjs/server/authenticate/admin/helpers/trigger-after-auth-hook.js

@@ -0,0 +1,21 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var createAdminApiContext = require('./create-admin-api-context.js');
+
+async function triggerAfterAuthHook(params, session, request) {
+  const {
+    config,
+    logger
+  } = params;
+  if (config.hooks.afterAuth) {
+    logger.info('Running afterAuth hook');
+    await config.hooks.afterAuth({
+      session,
+      admin: createAdminApiContext.createAdminApiContext(request, session, params)
+    });
+  }
+}
+
+exports.triggerAfterAuthHook = triggerAfterAuthHook;

package/build/cjs/server/authenticate/admin/helpers/validate-shop-and-host-params.js

@@ -0,0 +1,32 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var serverRuntime = require('@remix-run/server-runtime');
+
+function validateShopAndHostParams(params, request) {
+  const {
+    api,
+    config,
+    logger
+  } = params;
+  if (config.isEmbeddedApp) {
+    const url = new URL(request.url);
+    const shop = api.utils.sanitizeShop(url.searchParams.get('shop'));
+    if (!shop) {
+      logger.debug('Missing or invalid shop, redirecting to login path', {
+        shop
+      });
+      throw serverRuntime.redirect(config.auth.loginPath);
+    }
+    const host = api.utils.sanitizeHost(url.searchParams.get('host'));
+    if (!host) {
+      logger.debug('Invalid host, redirecting to login path', {
+        host: url.searchParams.get('host')
+      });
+      throw serverRuntime.redirect(config.auth.loginPath);
+    }
+  }
+}
+
+exports.validateShopAndHostParams = validateShopAndHostParams;

package/build/cjs/server/authenticate/admin/strategies/auth-code-flow.js

@@ -0,0 +1,310 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var shopifyApi = require('@shopify/shopify-api');
+var beginAuth = require('../helpers/begin-auth.js');
+require('@shopify/shopify-api/runtime');
+var redirectToAuthPage = require('../helpers/redirect-to-auth-page.js');
+var redirectToShopifyOrAppRoot = require('../helpers/redirect-to-shopify-or-app-root.js');
+require('@remix-run/server-runtime');
+var redirectWithExitiframe = require('../helpers/redirect-with-exitiframe.js');
+var getSessionTokenHeader = require('../../helpers/get-session-token-header.js');
+var triggerAfterAuthHook = require('../helpers/trigger-after-auth-hook.js');
+var validateShopAndHostParams = require('../helpers/validate-shop-and-host-params.js');
+require('isbot');
+
+class AuthCodeFlowStrategy {
+  constructor({
+    api,
+    config,
+    logger
+  }) {
+    this.api = void 0;
+    this.config = void 0;
+    this.logger = void 0;
+    this.api = api;
+    this.config = config;
+    this.logger = logger;
+  }
+  async respondToOAuthRequests(request) {
+    const {
+      api,
+      config
+    } = this;
+    const url = new URL(request.url);
+    const isAuthRequest = url.pathname === config.auth.path;
+    const isAuthCallbackRequest = url.pathname === config.auth.callbackPath;
+    if (isAuthRequest || isAuthCallbackRequest) {
+      const shop = api.utils.sanitizeShop(url.searchParams.get('shop'));
+      if (!shop) throw new Response('Shop param is invalid', {
+        status: 400
+      });
+      if (isAuthRequest) {
+        throw await this.handleAuthBeginRequest(request, shop);
+      } else {
+        throw await this.handleAuthCallbackRequest(request, shop);
+      }
+    }
+    if (!getSessionTokenHeader.getSessionTokenHeader(request)) {
+      // This is a document request that doesn't contain a session token. We check if the app is installed.
+      // If the app isn't installed, we initiate the OAuth auth code flow.
+      // Requests with a header can only happen after the app is installed.
+      await this.ensureInstalledOnShop(request);
+    }
+  }
+  async authenticate(request, session, shop) {
+    const {
+      api,
+      config,
+      logger
+    } = this;
+    if (!session) {
+      logger.debug('No session found, redirecting to OAuth', {
+        shop
+      });
+      await redirectToAuthPage.redirectToAuthPage({
+        config,
+        logger,
+        api
+      }, request, shop);
+    } else if (!session.isActive(config.scopes)) {
+      logger.debug('Found a session, but it has expired, redirecting to OAuth', {
+        shop
+      });
+      await redirectToAuthPage.redirectToAuthPage({
+        config,
+        logger,
+        api
+      }, request, shop);
+    }
+    logger.debug('Found a valid session', {
+      shop
+    });
+    return session;
+  }
+  async ensureInstalledOnShop(request) {
+    const {
+      api,
+      config,
+      logger
+    } = this;
+    validateShopAndHostParams.validateShopAndHostParams({
+      api,
+      config,
+      logger
+    }, request);
+    const url = new URL(request.url);
+    let shop = url.searchParams.get('shop');
+
+    // Ensure app is installed
+    logger.debug('Ensuring app is installed on shop', {
+      shop
+    });
+    if (!(await this.hasValidOfflineId(request))) {
+      logger.info("Could not find a shop, can't authenticate request");
+      throw new Response(undefined, {
+        status: 400,
+        statusText: 'Bad Request'
+      });
+    }
+    const offlineSession = await this.getOfflineSession(request);
+    const isEmbedded = url.searchParams.get('embedded') === '1';
+    if (!offlineSession) {
+      logger.info("Shop hasn't installed app yet, redirecting to OAuth", {
+        shop
+      });
+      if (isEmbedded) {
+        redirectWithExitiframe.redirectWithExitIframe({
+          api,
+          config,
+          logger
+        }, request, shop);
+      } else {
+        throw await beginAuth.beginAuth({
+          api,
+          config,
+          logger
+        }, request, false, shop);
+      }
+    }
+    shop = shop || offlineSession.shop;
+    if (config.isEmbeddedApp && !isEmbedded) {
+      try {
+        logger.debug('Ensuring offline session is valid before embedding', {
+          shop
+        });
+        await this.testSession(offlineSession);
+        logger.debug('Offline session is still valid, embedding app', {
+          shop
+        });
+      } catch (error) {
+        await this.handleInvalidOfflineSession(error, request, shop);
+      }
+    }
+  }
+  async handleAuthBeginRequest(request, shop) {
+    const {
+      api,
+      config,
+      logger
+    } = this;
+    logger.info('Handling OAuth begin request', {
+      shop
+    });
+
+    // If we're loading from an iframe, we need to break out of it
+    if (config.isEmbeddedApp && request.headers.get('Sec-Fetch-Dest') === 'iframe') {
+      logger.debug('Auth request in iframe detected, exiting iframe', {
+        shop
+      });
+      throw redirectWithExitiframe.redirectWithExitIframe({
+        api,
+        config,
+        logger
+      }, request, shop);
+    } else {
+      throw await beginAuth.beginAuth({
+        api,
+        config,
+        logger
+      }, request, false, shop);
+    }
+  }
+  async handleAuthCallbackRequest(request, shop) {
+    const {
+      api,
+      config,
+      logger
+    } = this;
+    logger.info('Handling OAuth callback request');
+    try {
+      const {
+        session,
+        headers: responseHeaders
+      } = await api.auth.callback({
+        rawRequest: request
+      });
+      await config.sessionStorage.storeSession(session);
+      if (config.useOnlineTokens && !session.isOnline) {
+        logger.info('Requesting online access token for offline session');
+        await beginAuth.beginAuth({
+          api,
+          config,
+          logger
+        }, request, true, shop);
+      }
+      await triggerAfterAuthHook.triggerAfterAuthHook({
+        api,
+        config,
+        logger
+      }, session, request);
+      throw await redirectToShopifyOrAppRoot.redirectToShopifyOrAppRoot(request, {
+        api,
+        config,
+        logger
+      }, responseHeaders);
+    } catch (error) {
+      if (error instanceof Response) throw error;
+      throw await this.oauthCallbackError(error, request, shop);
+    }
+  }
+  async getOfflineSession(request) {
+    const offlineId = await this.getOfflineSessionId(request);
+    return this.config.sessionStorage.loadSession(offlineId);
+  }
+  async hasValidOfflineId(request) {
+    return Boolean(await this.getOfflineSessionId(request));
+  }
+  async getOfflineSessionId(request) {
+    const {
+      api
+    } = this;
+    const url = new URL(request.url);
+    const shop = url.searchParams.get('shop');
+    return shop ? api.session.getOfflineId(shop) : api.session.getCurrentId({
+      isOnline: false,
+      rawRequest: request
+    });
+  }
+  async testSession(session) {
+    const {
+      api
+    } = this;
+    const client = new api.clients.Graphql({
+      session
+    });
+    await client.query({
+      data: `#graphql
+        query shopifyAppShopName {
+          shop {
+            name
+          }
+        }
+      `
+    });
+  }
+  async oauthCallbackError(error, request, shop) {
+    const {
+      logger
+    } = this;
+    logger.error('Error during OAuth callback', {
+      error: error.message
+    });
+    if (error instanceof shopifyApi.CookieNotFound) {
+      return this.handleAuthBeginRequest(request, shop);
+    }
+    if (error instanceof shopifyApi.InvalidHmacError || error instanceof shopifyApi.InvalidOAuthError) {
+      return new Response(undefined, {
+        status: 400,
+        statusText: 'Invalid OAuth Request'
+      });
+    }
+    return new Response(undefined, {
+      status: 500,
+      statusText: 'Internal Server Error'
+    });
+  }
+  async handleInvalidOfflineSession(error, request, shop) {
+    const {
+      api,
+      logger,
+      config
+    } = this;
+    if (error instanceof shopifyApi.HttpResponseError) {
+      if (error.response.code === 401) {
+        logger.info('Shop session is no longer valid, redirecting to OAuth', {
+          shop
+        });
+        throw await beginAuth.beginAuth({
+          api,
+          config,
+          logger
+        }, request, false, shop);
+      } else {
+        const message = JSON.stringify(error.response.body, null, 2);
+        logger.error(`Unexpected error during session validation: ${message}`, {
+          shop
+        });
+        throw new Response(undefined, {
+          status: error.response.code,
+          statusText: error.response.statusText
+        });
+      }
+    } else if (error instanceof shopifyApi.GraphqlQueryError) {
+      const context = {
+        shop
+      };
+      if (error.response) {
+        context.response = JSON.stringify(error.response);
+      }
+      logger.error(`Unexpected error during session validation: ${error.message}`, context);
+      throw new Response(undefined, {
+        status: 500,
+        statusText: 'Internal Server Error'
+      });
+    }
+  }
+}
+
+exports.AuthCodeFlowStrategy = AuthCodeFlowStrategy;

package/build/cjs/server/authenticate/helpers/get-session-token-header.js

@@ -2,9 +2,15 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
+const SESSION_TOKEN_PARAM = 'id_token';
 function getSessionTokenHeader(request) {
   var _request$headers$get;
   return (_request$headers$get = request.headers.get('authorization')) === null || _request$headers$get === void 0 ? void 0 : _request$headers$get.replace('Bearer ', '');
 }
+function getSessionTokenFromUrlParam(request) {
+  const url = new URL(request.url);
+  return url.searchParams.get(SESSION_TOKEN_PARAM);
+}
 
+exports.getSessionTokenFromUrlParam = getSessionTokenFromUrlParam;
 exports.getSessionTokenHeader = getSessionTokenHeader;

package/build/cjs/server/authenticate/helpers/reject-bot-request.js

@@ -8,7 +8,7 @@ function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'defau
 
 var isbot__default = /*#__PURE__*/_interopDefaultLegacy(isbot);
 
-function rejectBotRequest({
+function respondToBotRequest({
   logger
 }, request) {
   if (isbot__default["default"](request.headers.get('User-Agent'))) {
@@ -20,4 +20,4 @@ function rejectBotRequest({
   }
 }
 
-exports.rejectBotRequest = rejectBotRequest;
+exports.respondToBotRequest = respondToBotRequest;

package/build/cjs/server/authenticate/public/checkout/authenticate.js

@@ -15,7 +15,7 @@ function authenticateCheckoutFactory(params) {
       logger
     } = params;
     const corsHeaders = (_options$corsHeaders = options.corsHeaders) !== null && _options$corsHeaders !== void 0 ? _options$corsHeaders : [];
-    rejectBotRequest.rejectBotRequest(params, request);
+    rejectBotRequest.respondToBotRequest(params, request);
     respondToOptionsRequest.respondToOptionsRequest(params, request, corsHeaders);
     const sessionTokenHeader = getSessionTokenHeader.getSessionTokenHeader(request);
     logger.info('Authenticating checkout request');

package/build/cjs/server/authenticate/public/factory.js

@@ -2,20 +2,29 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var authenticate$1 = require('./checkout/authenticate.js');
-var authenticate = require('./appProxy/authenticate.js');
+var authenticate = require('./checkout/authenticate.js');
+var authenticate$1 = require('./appProxy/authenticate.js');
 
 function authenticatePublicFactory(params) {
   const {
-    logger
+    logger,
+    config
   } = params;
-  const authenticateCheckout = authenticate$1.authenticateCheckoutFactory(params);
+  const authenticateCheckout = authenticate.authenticateCheckoutFactory(params);
+  const authenticateAppProxy = authenticate$1.authenticateAppProxyFactory(params);
+  if (config.future.v3_authenticatePublic) {
+    const context = {
+      checkout: authenticateCheckout,
+      appProxy: authenticateAppProxy
+    };
+    return context;
+  }
   const authenticatePublic = (request, options) => {
     logger.deprecated('3.0.0', 'authenticate.public() will be deprecated in v3. Use authenticate.public.checkout() instead.');
     return authenticateCheckout(request, options);
   };
   authenticatePublic.checkout = authenticateCheckout;
-  authenticatePublic.appProxy = authenticate.authenticateAppProxyFactory(params);
+  authenticatePublic.appProxy = authenticateAppProxy;
   return authenticatePublic;
 }
 

package/build/cjs/server/authenticate/webhooks/authenticate.js

@@ -2,6 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
+var shopifyApi = require('@shopify/shopify-api');
 var factory = require('../../clients/admin/factory.js');
 require('@shopify/shopify-api/runtime');
 var handleClientError = require('../admin/helpers/handle-client-error.js');
@@ -30,11 +31,19 @@ function authenticateWebhookFactory(params) {
       rawRequest: request
     });
     if (!check.valid) {
-      logger.debug('Webhook validation failed', check);
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
+      if (check.reason === shopifyApi.WebhookValidationErrorReason.InvalidHmac) {
+        logger.debug('Webhook HMAC validation failed', check);
+        throw new Response(undefined, {
+          status: 401,
+          statusText: 'Unauthorized'
+        });
+      } else {
+        logger.debug('Webhook validation failed', check);
+        throw new Response(undefined, {
+          status: 400,
+          statusText: 'Bad Request'
+        });
+      }
     }
     const sessionId = api.session.getOfflineId(check.domain);
     const session = await config.sessionStorage.loadSession(sessionId);

package/build/cjs/server/clients/admin/graphql.js

@@ -13,22 +13,20 @@ function graphqlClientFactory({
   handleClientError,
   session
 }) {
-  return async function query(query, options) {
-    var _options;
+  return async function query(operation, options) {
     const client = new params.api.clients.Graphql({
       session,
-      apiVersion: (_options = options) === null || _options === void 0 ? void 0 : _options.apiVersion
+      apiVersion: options === null || options === void 0 ? void 0 : options.apiVersion
     });
     try {
-      var _options2, _options3, _options4;
       // We convert the incoming response to a Response object to bring this client closer to the Remix client.
       const apiResponse = await client.query({
         data: {
-          query,
-          variables: (_options2 = options) === null || _options2 === void 0 ? void 0 : _options2.variables
+          query: operation,
+          variables: options === null || options === void 0 ? void 0 : options.variables
         },
-        tries: (_options3 = options) === null || _options3 === void 0 ? void 0 : _options3.tries,
-        extraHeaders: (_options4 = options) === null || _options4 === void 0 ? void 0 : _options4.headers
+        tries: options === null || options === void 0 ? void 0 : options.tries,
+        extraHeaders: options === null || options === void 0 ? void 0 : options.headers
       });
       return new Response(JSON.stringify(apiResponse.body), {
         headers: runtime.flatHeaders(apiResponse.headers)

package/build/cjs/server/shopify-app.js

@@ -7,8 +7,8 @@ var shopifyApi = require('@shopify/shopify-api');
 var types = require('./types.js');
 var version = require('./version.js');
 var register = require('./authenticate/webhooks/register.js');
-var authenticate$1 = require('./authenticate/admin/authenticate.js');
-var authenticate = require('./authenticate/webhooks/authenticate.js');
+var authenticate = require('./authenticate/admin/authenticate.js');
+var authenticate$1 = require('./authenticate/webhooks/authenticate.js');
 var overrideLogger = require('./override-logger.js');
 var addResponseHeaders = require('./authenticate/helpers/add-response-headers.js');
 require('isbot');
@@ -16,6 +16,7 @@ var login = require('./authenticate/login/login.js');
 var factory$1 = require('./unauthenticated/admin/factory.js');
 var factory = require('./authenticate/public/factory.js');
 var factory$2 = require('./unauthenticated/storefront/factory.js');
+var authCodeFlow = require('./authenticate/admin/strategies/auth-code-flow.js');
 
 /**
  * Creates an object your app will use to interact with Shopify.
@@ -49,15 +50,19 @@ function shopifyApp(appConfig) {
     config,
     logger
   };
-  const oauth = new authenticate$1.AuthStrategy(params);
+  const oauth = new authCodeFlow.AuthCodeFlowStrategy(params);
+  const authStrategy = authenticate.authStrategyFactory({
+    ...params,
+    strategy: oauth
+  });
   const shopify = {
     sessionStorage: config.sessionStorage,
     addDocumentResponseHeaders: addResponseHeaders.addDocumentResponseHeadersFactory(params),
     registerWebhooks: register.registerWebhooksFactory(params),
     authenticate: {
-      admin: oauth.authenticateAdmin.bind(oauth),
+      admin: authStrategy,
       public: factory.authenticatePublicFactory(params),
-      webhook: authenticate.authenticateWebhookFactory(params)
+      webhook: authenticate$1.authenticateWebhookFactory(params)
     },
     unauthenticated: {
       admin: factory$1.unauthenticatedAdminContextFactory(params),
@@ -101,7 +106,8 @@ function deriveApi(appConfig) {
     userAgentPrefix,
     isEmbeddedApp: (_appConfig$isEmbedded = appConfig.isEmbeddedApp) !== null && _appConfig$isEmbedded !== void 0 ? _appConfig$isEmbedded : true,
     apiVersion: (_appConfig$apiVersion = appConfig.apiVersion) !== null && _appConfig$apiVersion !== void 0 ? _appConfig$apiVersion : shopifyApi.LATEST_API_VERSION,
-    isCustomStoreApp: appConfig.distribution === types.AppDistribution.ShopifyAdmin
+    isCustomStoreApp: appConfig.distribution === types.AppDistribution.ShopifyAdmin,
+    future: {}
   });
 }
 function deriveConfig(appConfig, apiConfig) {