@shopify/shopify-app-remix 2.7.0 → 2.8.1

package/build/cjs/server/authenticate/admin/strategies/auth-code-flow.js

@@ -1,334 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var shopifyApi = require('@shopify/shopify-api');
-var beginAuth = require('../helpers/begin-auth.js');
-var redirectToShopifyOrAppRoot = require('../helpers/redirect-to-shopify-or-app-root.js');
-require('@remix-run/server-runtime');
-var handleClientError = require('../helpers/handle-client-error.js');
-var redirectToAuthPage = require('../helpers/redirect-to-auth-page.js');
-var redirectWithExitiframe = require('../helpers/redirect-with-exitiframe.js');
-var getSessionTokenHeader = require('../../helpers/get-session-token-header.js');
-var triggerAfterAuthHook = require('../helpers/trigger-after-auth-hook.js');
-var validateShopAndHostParams = require('../helpers/validate-shop-and-host-params.js');
-require('isbot');
-
-class AuthCodeFlowStrategy {
-  constructor({
-    api,
-    config,
-    logger
-  }) {
-    this.api = void 0;
-    this.config = void 0;
-    this.logger = void 0;
-    this.api = api;
-    this.config = config;
-    this.logger = logger;
-  }
-  async respondToOAuthRequests(request) {
-    const {
-      api,
-      config
-    } = this;
-    const url = new URL(request.url);
-    const isAuthRequest = url.pathname === config.auth.path;
-    const isAuthCallbackRequest = url.pathname === config.auth.callbackPath;
-    if (isAuthRequest || isAuthCallbackRequest) {
-      const shop = api.utils.sanitizeShop(url.searchParams.get('shop'));
-      if (!shop) throw new Response('Shop param is invalid', {
-        status: 400
-      });
-      if (isAuthRequest) {
-        throw await this.handleAuthBeginRequest(request, shop);
-      } else {
-        throw await this.handleAuthCallbackRequest(request, shop);
-      }
-    }
-    if (!getSessionTokenHeader.getSessionTokenHeader(request)) {
-      // This is a document request that doesn't contain a session token. We check if the app is installed.
-      // If the app isn't installed, we initiate the OAuth auth code flow.
-      // Requests with a header can only happen after the app is installed.
-      await this.ensureInstalledOnShop(request);
-    }
-  }
-  async authenticate(request, sessionContext) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    const {
-      shop,
-      session
-    } = sessionContext;
-    if (!session) {
-      logger.debug('No session found, redirecting to OAuth', {
-        shop
-      });
-      await redirectToAuthPage.redirectToAuthPage({
-        config,
-        logger,
-        api
-      }, request, shop);
-    } else if (!session.isActive(config.scopes)) {
-      logger.debug('Found a session, but it has expired, redirecting to OAuth', {
-        shop
-      });
-      await redirectToAuthPage.redirectToAuthPage({
-        config,
-        logger,
-        api
-      }, request, shop);
-    }
-    logger.debug('Found a valid session', {
-      shop
-    });
-    return session;
-  }
-  handleClientError(request) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    return handleClientError.handleClientErrorFactory({
-      request,
-      onError: async ({
-        session,
-        error
-      }) => {
-        if (error.response.code === 401) {
-          throw await redirectToAuthPage.redirectToAuthPage({
-            api,
-            config,
-            logger
-          }, request, session.shop);
-        }
-      }
-    });
-  }
-  async ensureInstalledOnShop(request) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    validateShopAndHostParams.validateShopAndHostParams({
-      api,
-      config,
-      logger
-    }, request);
-    const url = new URL(request.url);
-    let shop = url.searchParams.get('shop');
-
-    // Ensure app is installed
-    logger.debug('Ensuring app is installed on shop', {
-      shop
-    });
-    if (!(await this.hasValidOfflineId(request))) {
-      logger.info("Could not find a shop, can't authenticate request");
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    const offlineSession = await this.getOfflineSession(request);
-    const isEmbedded = url.searchParams.get('embedded') === '1';
-    if (!offlineSession) {
-      logger.info("Shop hasn't installed app yet, redirecting to OAuth", {
-        shop
-      });
-      if (isEmbedded) {
-        redirectWithExitiframe.redirectWithExitIframe({
-          api,
-          config,
-          logger
-        }, request, shop);
-      } else {
-        throw await beginAuth.beginAuth({
-          api,
-          config,
-          logger
-        }, request, false, shop);
-      }
-    }
-    shop = shop || offlineSession.shop;
-    if (config.isEmbeddedApp && !isEmbedded) {
-      try {
-        logger.debug('Ensuring offline session is valid before embedding', {
-          shop
-        });
-        await this.testSession(offlineSession);
-        logger.debug('Offline session is still valid, embedding app', {
-          shop
-        });
-      } catch (error) {
-        await this.handleInvalidOfflineSession(error, request, shop);
-      }
-    }
-  }
-  async handleAuthBeginRequest(request, shop) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    logger.info('Handling OAuth begin request', {
-      shop
-    });
-
-    // If we're loading from an iframe, we need to break out of it
-    if (config.isEmbeddedApp && request.headers.get('Sec-Fetch-Dest') === 'iframe') {
-      logger.debug('Auth request in iframe detected, exiting iframe', {
-        shop
-      });
-      throw redirectWithExitiframe.redirectWithExitIframe({
-        api,
-        config,
-        logger
-      }, request, shop);
-    } else {
-      throw await beginAuth.beginAuth({
-        api,
-        config,
-        logger
-      }, request, false, shop);
-    }
-  }
-  async handleAuthCallbackRequest(request, shop) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    logger.info('Handling OAuth callback request');
-    try {
-      const {
-        session,
-        headers: responseHeaders
-      } = await api.auth.callback({
-        rawRequest: request
-      });
-      await config.sessionStorage.storeSession(session);
-      if (config.useOnlineTokens && !session.isOnline) {
-        logger.info('Requesting online access token for offline session');
-        await beginAuth.beginAuth({
-          api,
-          config,
-          logger
-        }, request, true, shop);
-      }
-      await triggerAfterAuthHook.triggerAfterAuthHook({
-        api,
-        config,
-        logger
-      }, session, request, this);
-      throw await redirectToShopifyOrAppRoot.redirectToShopifyOrAppRoot(request, {
-        api,
-        config,
-        logger
-      }, responseHeaders);
-    } catch (error) {
-      if (error instanceof Response) throw error;
-      throw await this.oauthCallbackError(error, request, shop);
-    }
-  }
-  async getOfflineSession(request) {
-    const offlineId = await this.getOfflineSessionId(request);
-    return this.config.sessionStorage.loadSession(offlineId);
-  }
-  async hasValidOfflineId(request) {
-    return Boolean(await this.getOfflineSessionId(request));
-  }
-  async getOfflineSessionId(request) {
-    const {
-      api
-    } = this;
-    const url = new URL(request.url);
-    const shop = url.searchParams.get('shop');
-    return shop ? api.session.getOfflineId(shop) : api.session.getCurrentId({
-      isOnline: false,
-      rawRequest: request
-    });
-  }
-  async testSession(session) {
-    const {
-      api
-    } = this;
-    const client = new api.clients.Graphql({
-      session
-    });
-    await client.request(`#graphql
-      query shopifyAppShopName {
-        shop {
-          name
-        }
-      }
-    `);
-  }
-  async oauthCallbackError(error, request, shop) {
-    const {
-      logger
-    } = this;
-    logger.error('Error during OAuth callback', {
-      error: error.message
-    });
-    if (error instanceof shopifyApi.CookieNotFound) {
-      return this.handleAuthBeginRequest(request, shop);
-    }
-    if (error instanceof shopifyApi.InvalidHmacError || error instanceof shopifyApi.InvalidOAuthError) {
-      return new Response(undefined, {
-        status: 400,
-        statusText: 'Invalid OAuth Request'
-      });
-    }
-    return new Response(undefined, {
-      status: 500,
-      statusText: 'Internal Server Error'
-    });
-  }
-  async handleInvalidOfflineSession(error, request, shop) {
-    const {
-      api,
-      logger,
-      config
-    } = this;
-    if (error instanceof shopifyApi.HttpResponseError) {
-      if (error.response.code === 401) {
-        logger.info('Shop session is no longer valid, redirecting to OAuth', {
-          shop
-        });
-        throw await beginAuth.beginAuth({
-          api,
-          config,
-          logger
-        }, request, false, shop);
-      } else {
-        const message = JSON.stringify(error.response.body, null, 2);
-        logger.error(`Unexpected error during session validation: ${message}`, {
-          shop
-        });
-        throw new Response(undefined, {
-          status: error.response.code,
-          statusText: error.response.statusText
-        });
-      }
-    } else if (error instanceof shopifyApi.GraphqlQueryError) {
-      const context = {
-        shop
-      };
-      if (error.response) {
-        context.response = JSON.stringify(error.body);
-      }
-      logger.error(`Unexpected error during session validation: ${error.message}`, context);
-      throw new Response(undefined, {
-        status: 500,
-        statusText: 'Internal Server Error'
-      });
-    }
-  }
-}
-
-exports.AuthCodeFlowStrategy = AuthCodeFlowStrategy;

package/build/cjs/server/authenticate/admin/strategies/token-exchange.js

@@ -1,155 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var shopifyApi = require('@shopify/shopify-api');
-require('isbot');
-var respondToInvalidSessionToken = require('../../helpers/respond-to-invalid-session-token.js');
-require('@remix-run/server-runtime');
-var handleClientError = require('../helpers/handle-client-error.js');
-var triggerAfterAuthHook = require('../helpers/trigger-after-auth-hook.js');
-
-class TokenExchangeStrategy {
-  constructor({
-    api,
-    config,
-    logger
-  }) {
-    this.api = void 0;
-    this.config = void 0;
-    this.logger = void 0;
-    this.api = api;
-    this.config = config;
-    this.logger = logger;
-  }
-  async respondToOAuthRequests(_request) {}
-  async authenticate(request, sessionContext) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    const {
-      shop,
-      session,
-      sessionToken
-    } = sessionContext;
-    if (!sessionToken) throw new shopifyApi.InvalidJwtError();
-    if (!session || session.isExpired()) {
-      logger.info('No valid session found');
-      logger.info('Requesting offline access token');
-      const {
-        session: offlineSession
-      } = await this.exchangeToken({
-        request,
-        sessionToken,
-        shop,
-        requestedTokenType: shopifyApi.RequestedTokenType.OfflineAccessToken
-      });
-      await config.sessionStorage.storeSession(offlineSession);
-      let newSession = offlineSession;
-      if (config.useOnlineTokens) {
-        logger.info('Requesting online access token');
-        const {
-          session: onlineSession
-        } = await this.exchangeToken({
-          request,
-          sessionToken,
-          shop,
-          requestedTokenType: shopifyApi.RequestedTokenType.OnlineAccessToken
-        });
-        await config.sessionStorage.storeSession(onlineSession);
-        newSession = onlineSession;
-      }
-      try {
-        await this.handleAfterAuthHook({
-          api,
-          config,
-          logger
-        }, newSession, request, sessionToken);
-      } catch (error) {
-        throw new Response(undefined, {
-          status: 500,
-          statusText: 'Internal Server Error'
-        });
-      }
-      return newSession;
-    }
-    return session;
-  }
-  handleClientError(request) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    return handleClientError.handleClientErrorFactory({
-      request,
-      onError: async ({
-        session,
-        error
-      }) => {
-        if (error.response.code === 401) {
-          config.sessionStorage.deleteSession(session.id);
-          respondToInvalidSessionToken.respondToInvalidSessionToken({
-            params: {
-              config,
-              api,
-              logger
-            },
-            request
-          });
-        }
-      }
-    });
-  }
-  async exchangeToken({
-    request,
-    shop,
-    sessionToken,
-    requestedTokenType
-  }) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    try {
-      return await api.auth.tokenExchange({
-        sessionToken,
-        shop,
-        requestedTokenType
-      });
-    } catch (error) {
-      var _error$response$body;
-      if (error instanceof shopifyApi.InvalidJwtError || error instanceof shopifyApi.HttpResponseError && error.response.code === 400 && ((_error$response$body = error.response.body) === null || _error$response$body === void 0 ? void 0 : _error$response$body.error) === 'invalid_subject_token') {
-        throw respondToInvalidSessionToken.respondToInvalidSessionToken({
-          params: {
-            api,
-            config,
-            logger
-          },
-          request,
-          retryRequest: true
-        });
-      }
-      throw new Response(undefined, {
-        status: 500,
-        statusText: 'Internal Server Error'
-      });
-    }
-  }
-  async handleAfterAuthHook(params, session, request, sessionToken) {
-    const {
-      config
-    } = params;
-    await config.idempotentPromiseHandler.handlePromise({
-      promiseFunction: () => {
-        return triggerAfterAuthHook.triggerAfterAuthHook(params, session, request, this);
-      },
-      identifier: sessionToken
-    });
-  }
-}
-
-exports.TokenExchangeStrategy = TokenExchangeStrategy;

package/build/cjs/server/authenticate/const.js

@@ -1,13 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-const APP_BRIDGE_URL = 'https://cdn.shopify.com/shopifycloud/app-bridge.js';
-const REAUTH_URL_HEADER = 'X-Shopify-API-Request-Failure-Reauthorize-Url';
-const RETRY_INVALID_SESSION_HEADER = {
-  'X-Shopify-Retry-Invalid-Session-Request': '1'
-};
-
-exports.APP_BRIDGE_URL = APP_BRIDGE_URL;
-exports.REAUTH_URL_HEADER = REAUTH_URL_HEADER;
-exports.RETRY_INVALID_SESSION_HEADER = RETRY_INVALID_SESSION_HEADER;

package/build/cjs/server/authenticate/flow/authenticate.js

@@ -1,68 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var factory = require('../../clients/admin/factory.js');
-
-function authenticateFlowFactory(params) {
-  const {
-    api,
-    config,
-    logger
-  } = params;
-  return async function authenticate(request) {
-    logger.info('Authenticating flow request');
-    if (request.method !== 'POST') {
-      logger.debug('Received a non-POST request for flow. Only POST requests are allowed.', {
-        url: request.url,
-        method: request.method
-      });
-      throw new Response(undefined, {
-        status: 405,
-        statusText: 'Method not allowed'
-      });
-    }
-    const rawBody = await request.text();
-    const result = await api.flow.validate({
-      rawBody,
-      rawRequest: request
-    });
-    if (!result.valid) {
-      logger.error('Received an invalid flow request', {
-        reason: result.reason
-      });
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    const payload = JSON.parse(rawBody);
-    logger.debug('Flow request is valid, looking for an offline session', {
-      shop: payload.shopify_domain
-    });
-    const sessionId = api.session.getOfflineId(payload.shopify_domain);
-    const session = await config.sessionStorage.loadSession(sessionId);
-    if (!session) {
-      logger.info('Flow request could not find session', {
-        shop: payload.shopify_domain
-      });
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    logger.debug('Found a session for the flow request', {
-      shop: session.shop
-    });
-    return {
-      session,
-      payload,
-      admin: factory.adminClientFactory({
-        params,
-        session
-      })
-    };
-  };
-}
-
-exports.authenticateFlowFactory = authenticateFlowFactory;

package/build/cjs/server/authenticate/fulfillment-service/authenticate.js

@@ -1,70 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var shopifyApi = require('@shopify/shopify-api');
-var factory = require('../../clients/admin/factory.js');
-
-function authenticateFulfillmentServiceFactory(params) {
-  const {
-    api,
-    config,
-    logger
-  } = params;
-  return async function authenticate(request) {
-    logger.info('Authenticating fulfillment service request');
-    if (request.method !== 'POST') {
-      logger.debug('Received a non-POST request for fulfillment service. Only POST requests are allowed.', {
-        url: request.url,
-        method: request.method
-      });
-      throw new Response(undefined, {
-        status: 405,
-        statusText: 'Method not allowed'
-      });
-    }
-    const rawBody = await request.text();
-    const result = await api.fulfillmentService.validate({
-      rawBody,
-      rawRequest: request
-    });
-    if (!result.valid) {
-      logger.error('Received an invalid fulfillment service request', {
-        reason: result.reason
-      });
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    const payload = JSON.parse(rawBody);
-    const shop = request.headers.get(shopifyApi.ShopifyHeader.Domain) || '';
-    logger.debug('Fulfillment service request is valid, looking for an offline session', {
-      shop
-    });
-    const sessionId = api.session.getOfflineId(shop);
-    const session = await config.sessionStorage.loadSession(sessionId);
-    if (!session) {
-      logger.info('Fulfillment service request could not find session', {
-        shop
-      });
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    logger.debug('Found a session for the fulfillment service request', {
-      shop
-    });
-    return {
-      session,
-      payload,
-      admin: factory.adminClientFactory({
-        params,
-        session
-      })
-    };
-  };
-}
-
-exports.authenticateFulfillmentServiceFactory = authenticateFulfillmentServiceFactory;

package/build/cjs/server/authenticate/helpers/add-response-headers.js

@@ -1,32 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-function addDocumentResponseHeadersFactory(params) {
-  const {
-    api,
-    config
-  } = params;
-  return function (request, headers) {
-    const {
-      searchParams
-    } = new URL(request.url);
-    const shop = api.utils.sanitizeShop(searchParams.get('shop'));
-    addDocumentResponseHeaders(headers, config.isEmbeddedApp, shop);
-  };
-}
-function addDocumentResponseHeaders(headers, isEmbeddedApp, shop) {
-  if (shop) {
-    headers.set('Link', '<https://cdn.shopify.com/shopifycloud/app-bridge.js>; rel="preload"; as="script";');
-  }
-  if (isEmbeddedApp) {
-    if (shop) {
-      headers.set('Content-Security-Policy', `frame-ancestors https://${shop} https://admin.shopify.com https://*.spin.dev;`);
-    }
-  } else {
-    headers.set('Content-Security-Policy', `frame-ancestors 'none';`);
-  }
-}
-
-exports.addDocumentResponseHeaders = addDocumentResponseHeaders;
-exports.addDocumentResponseHeadersFactory = addDocumentResponseHeadersFactory;

package/build/cjs/server/authenticate/helpers/app-bridge-url.js

@@ -1,16 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var _const = require('../const.js');
-
-let appBridgeUrlOverride;
-function setAppBridgeUrlOverride(url) {
-  appBridgeUrlOverride = url;
-}
-function appBridgeUrl() {
-  return appBridgeUrlOverride || _const.APP_BRIDGE_URL;
-}
-
-exports.appBridgeUrl = appBridgeUrl;
-exports.setAppBridgeUrlOverride = setAppBridgeUrlOverride;