@shopify/shopify-app-remix 2.7.0 → 2.8.1

package/dist/esm/server/authenticate/admin/strategies/token-exchange.mjs

@@ -0,0 +1,108 @@
+import { InvalidJwtError, RequestedTokenType, HttpResponseError } from '@shopify/shopify-api';
+import { respondToInvalidSessionToken } from '../../helpers/respond-to-invalid-session-token.mjs';
+import 'isbot';
+import '@remix-run/server-runtime';
+import { handleClientErrorFactory } from '../helpers/handle-client-error.mjs';
+import { triggerAfterAuthHook } from '../helpers/trigger-after-auth-hook.mjs';
+
+class TokenExchangeStrategy {
+    constructor({ api, config, logger }) {
+        this.api = api;
+        this.config = config;
+        this.logger = logger;
+    }
+    async respondToOAuthRequests(_request) { }
+    async authenticate(request, sessionContext) {
+        const { api, config, logger } = this;
+        const { shop, session, sessionToken } = sessionContext;
+        if (!sessionToken)
+            throw new InvalidJwtError();
+        if (!session || session.isExpired()) {
+            logger.info('No valid session found');
+            logger.info('Requesting offline access token');
+            const { session: offlineSession } = await this.exchangeToken({
+                request,
+                sessionToken,
+                shop,
+                requestedTokenType: RequestedTokenType.OfflineAccessToken,
+            });
+            await config.sessionStorage.storeSession(offlineSession);
+            let newSession = offlineSession;
+            if (config.useOnlineTokens) {
+                logger.info('Requesting online access token');
+                const { session: onlineSession } = await this.exchangeToken({
+                    request,
+                    sessionToken,
+                    shop,
+                    requestedTokenType: RequestedTokenType.OnlineAccessToken,
+                });
+                await config.sessionStorage.storeSession(onlineSession);
+                newSession = onlineSession;
+            }
+            try {
+                await this.handleAfterAuthHook({ api, config, logger }, newSession, request, sessionToken);
+            }
+            catch (error) {
+                throw new Response(undefined, {
+                    status: 500,
+                    statusText: 'Internal Server Error',
+                });
+            }
+            return newSession;
+        }
+        return session;
+    }
+    handleClientError(request) {
+        const { api, config, logger } = this;
+        return handleClientErrorFactory({
+            request,
+            onError: async ({ session, error }) => {
+                if (error.response.code === 401) {
+                    config.sessionStorage.deleteSession(session.id);
+                    respondToInvalidSessionToken({
+                        params: { config, api, logger },
+                        request,
+                    });
+                }
+            },
+        });
+    }
+    async exchangeToken({ request, shop, sessionToken, requestedTokenType, }) {
+        const { api, config, logger } = this;
+        try {
+            return await api.auth.tokenExchange({
+                sessionToken,
+                shop,
+                requestedTokenType,
+            });
+        }
+        catch (error) {
+            if (error instanceof InvalidJwtError ||
+                (error instanceof HttpResponseError &&
+                    error.response.code === 400 &&
+                    error.response.body?.error === 'invalid_subject_token')) {
+                throw respondToInvalidSessionToken({
+                    params: { api, config, logger },
+                    request,
+                    retryRequest: true,
+                });
+            }
+            throw new Response(undefined, {
+                status: 500,
+                statusText: 'Internal Server Error',
+            });
+        }
+    }
+    async handleAfterAuthHook(params, session, request, sessionToken) {
+        const { config } = params;
+        await config.idempotentPromiseHandler.handlePromise({
+            promiseFunction: () => {
+                return triggerAfterAuthHook(params, session, request, this);
+            },
+            identifier: sessionToken,
+        });
+    }
+}
+
+export { TokenExchangeStrategy };
+//# sourceMappingURL=token-exchange.mjs.map

package/dist/esm/server/authenticate/admin/strategies/token-exchange.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.mjs","sources":["../../../../../../../src/server/authenticate/admin/strategies/token-exchange.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;MAqBa,qBAAqB,CAAA;AAYhC,IAAA,WAAA,CAAmB,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAgC,EAAA;AACrE,QAAA,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;AACf,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACrB,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;KACtB;AAEM,IAAA,MAAM,sBAAsB,CAAC,QAAiB,KAAmB;AAEjE,IAAA,MAAM,YAAY,CACvB,OAAgB,EAChB,cAA8B,EAAA;QAE9B,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;QACnC,MAAM,EAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAC,GAAG,cAAc,CAAC;AAErD,QAAA,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,eAAe,EAAE,CAAC;QAE/C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE;AACnC,YAAA,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AACtC,YAAA,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC/C,MAAM,EAAC,OAAO,EAAE,cAAc,EAAC,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBACzD,OAAO;gBACP,YAAY;gBACZ,IAAI;gBACJ,kBAAkB,EAAE,kBAAkB,CAAC,kBAAkB;AAC1D,aAAA,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;YAEzD,IAAI,UAAU,GAAG,cAAc,CAAC;AAEhC,YAAA,IAAI,MAAM,CAAC,eAAe,EAAE;AAC1B,gBAAA,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,MAAM,EAAC,OAAO,EAAE,aAAa,EAAC,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;oBACxD,OAAO;oBACP,YAAY;oBACZ,IAAI;oBACJ,kBAAkB,EAAE,kBAAkB,CAAC,iBAAiB;AACzD,iBAAA,CAAC,CAAC;gBAEH,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBACxD,UAAU,GAAG,aAAa,CAAC;aAC5B;AAED,YAAA,IAAI;AACF,gBAAA,MAAM,IAAI,CAAC,mBAAmB,CAC5B,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EACrB,UAAU,EACV,OAAO,EACP,YAAY,CACb,CAAC;aACH;YAAC,OAAO,KAAK,EAAE;AACd,gBAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,oBAAA,MAAM,EAAE,GAAG;AACX,oBAAA,UAAU,EAAE,uBAAuB;AACpC,iBAAA,CAAC,CAAC;aACJ;AAED,YAAA,OAAO,UAAU,CAAC;SACnB;AAED,QAAA,OAAO,OAAQ,CAAC;KACjB;AAEM,IAAA,iBAAiB,CAAC,OAAgB,EAAA;QACvC,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;AACnC,QAAA,OAAO,wBAAwB,CAAC;YAC9B,OAAO;YACP,OAAO,EAAE,OAAO,EAAC,OAAO,EAAE,KAAK,EAAiB,KAAI;gBAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,EAAE;oBAC/B,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEhD,oBAAA,4BAA4B,CAAC;AAC3B,wBAAA,MAAM,EAAE,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAC;wBAC7B,OAAO;AACR,qBAAA,CAAC,CAAC;iBACJ;aACF;AACF,SAAA,CAAC,CAAC;KACJ;IAEO,MAAM,aAAa,CAAC,EAC1B,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,kBAAkB,GAMnB,EAAA;QACC,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;AAEnC,QAAA,IAAI;AACF,YAAA,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;gBAClC,YAAY;gBACZ,IAAI;gBACJ,kBAAkB;AACnB,aAAA,CAAC,CAAC;SACJ;QAAC,OAAO,KAAK,EAAE;YACd,IACE,KAAK,YAAY,eAAe;iBAC/B,KAAK,YAAY,iBAAiB;AACjC,oBAAA,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG;oBAC3B,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,KAAK,uBAAuB,CAAC,EACzD;AACA,gBAAA,MAAM,4BAA4B,CAAC;AACjC,oBAAA,MAAM,EAAE,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC;oBAC7B,OAAO;AACP,oBAAA,YAAY,EAAE,IAAI;AACnB,iBAAA,CAAC,CAAC;aACJ;AAED,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,uBAAuB;AACpC,aAAA,CAAC,CAAC;SACJ;KACF;IAEO,MAAM,mBAAmB,CAC/B,MAAmB,EACnB,OAAgB,EAChB,OAAgB,EAChB,YAAoB,EAAA;AAEpB,QAAA,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,CAAC;AACxB,QAAA,MAAM,MAAM,CAAC,wBAAwB,CAAC,aAAa,CAAC;YAClD,eAAe,EAAE,MAAK;gBACpB,OAAO,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;aAC7D;AACD,YAAA,UAAU,EAAE,YAAY;AACzB,SAAA,CAAC,CAAC;KACJ;AACF;;;;"}

package/dist/esm/server/authenticate/const.mjs

@@ -0,0 +1,8 @@
+const APP_BRIDGE_URL = 'https://cdn.shopify.com/shopifycloud/app-bridge.js';
+const REAUTH_URL_HEADER = 'X-Shopify-API-Request-Failure-Reauthorize-Url';
+const RETRY_INVALID_SESSION_HEADER = {
+    'X-Shopify-Retry-Invalid-Session-Request': '1',
+};
+
+export { APP_BRIDGE_URL, REAUTH_URL_HEADER, RETRY_INVALID_SESSION_HEADER };
+//# sourceMappingURL=const.mjs.map

package/dist/esm/server/authenticate/const.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"const.mjs","sources":["../../../../../src/server/authenticate/const.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAO,MAAM,cAAc,GACzB,qDAAqD;AAEhD,MAAM,iBAAiB,GAC5B,gDAAgD;AAErC,MAAA,4BAA4B,GAAG;AAC1C,IAAA,yCAAyC,EAAE,GAAG;;;;;"}

package/dist/esm/server/authenticate/flow/authenticate.mjs

@@ -0,0 +1,51 @@
+import { adminClientFactory } from '../../clients/admin/factory.mjs';
+
+function authenticateFlowFactory(params) {
+    const { api, config, logger } = params;
+    return async function authenticate(request) {
+        logger.info('Authenticating flow request');
+        if (request.method !== 'POST') {
+            logger.debug('Received a non-POST request for flow. Only POST requests are allowed.', { url: request.url, method: request.method });
+            throw new Response(undefined, {
+                status: 405,
+                statusText: 'Method not allowed',
+            });
+        }
+        const rawBody = await request.text();
+        const result = await api.flow.validate({
+            rawBody,
+            rawRequest: request,
+        });
+        if (!result.valid) {
+            logger.error('Received an invalid flow request', { reason: result.reason });
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        const payload = JSON.parse(rawBody);
+        logger.debug('Flow request is valid, looking for an offline session', {
+            shop: payload.shopify_domain,
+        });
+        const sessionId = api.session.getOfflineId(payload.shopify_domain);
+        const session = await config.sessionStorage.loadSession(sessionId);
+        if (!session) {
+            logger.info('Flow request could not find session', {
+                shop: payload.shopify_domain,
+            });
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        logger.debug('Found a session for the flow request', { shop: session.shop });
+        return {
+            session,
+            payload,
+            admin: adminClientFactory({ params, session }),
+        };
+    };
+}
+
+export { authenticateFlowFactory };
+//# sourceMappingURL=authenticate.mjs.map

package/dist/esm/server/authenticate/flow/authenticate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.mjs","sources":["../../../../../../src/server/authenticate/flow/authenticate.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAOM,SAAU,uBAAuB,CAErC,MAAmB,EAAA;IACnB,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;AAErC,IAAA,OAAO,eAAe,YAAY,CAChC,OAAgB,EAAA;AAEhB,QAAA,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE3C,QAAA,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE;AAC7B,YAAA,MAAM,CAAC,KAAK,CACV,uEAAuE,EACvE,EAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAC,CAC3C,CAAC;AACF,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,oBAAoB;AACjC,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,OAAO;AACP,YAAA,UAAU,EAAE,OAAO;AACpB,SAAA,CAAC,CAAC;AAEH,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;AACjB,YAAA,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAC,CAAC,CAAC;AAE1E,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAEpC,QAAA,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;YACpE,IAAI,EAAE,OAAO,CAAC,cAAc;AAC7B,SAAA,CAAC,CAAC;AAEH,QAAA,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC,OAAO,EAAE;AACZ,YAAA,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBACjD,IAAI,EAAE,OAAO,CAAC,cAAc;AAC7B,aAAA,CAAC,CAAC;AACH,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAC,CAAC,CAAC;QAE3E,OAAO;YACL,OAAO;YACP,OAAO;YACP,KAAK,EAAE,kBAAkB,CAAY,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;SACxD,CAAC;AACJ,KAAC,CAAC;AACJ;;;;"}

package/dist/esm/server/authenticate/fulfillment-service/authenticate.mjs

@@ -0,0 +1,57 @@
+import { ShopifyHeader } from '@shopify/shopify-api';
+import { adminClientFactory } from '../../clients/admin/factory.mjs';
+
+function authenticateFulfillmentServiceFactory(params) {
+    const { api, config, logger } = params;
+    return async function authenticate(request) {
+        logger.info('Authenticating fulfillment service request');
+        if (request.method !== 'POST') {
+            logger.debug('Received a non-POST request for fulfillment service. Only POST requests are allowed.', { url: request.url, method: request.method });
+            throw new Response(undefined, {
+                status: 405,
+                statusText: 'Method not allowed',
+            });
+        }
+        const rawBody = await request.text();
+        const result = await api.fulfillmentService.validate({
+            rawBody,
+            rawRequest: request,
+        });
+        if (!result.valid) {
+            logger.error('Received an invalid fulfillment service request', {
+                reason: result.reason,
+            });
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        const payload = JSON.parse(rawBody);
+        const shop = request.headers.get(ShopifyHeader.Domain) || '';
+        logger.debug('Fulfillment service request is valid, looking for an offline session', {
+            shop,
+        });
+        const sessionId = api.session.getOfflineId(shop);
+        const session = await config.sessionStorage.loadSession(sessionId);
+        if (!session) {
+            logger.info('Fulfillment service request could not find session', {
+                shop,
+            });
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        logger.debug('Found a session for the fulfillment service request', {
+            shop,
+        });
+        return {
+            session,
+            payload,
+            admin: adminClientFactory({ params, session }),
+        };
+    };
+}
+
+export { authenticateFulfillmentServiceFactory };
+//# sourceMappingURL=authenticate.mjs.map

package/dist/esm/server/authenticate/fulfillment-service/authenticate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.mjs","sources":["../../../../../../src/server/authenticate/fulfillment-service/authenticate.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAUM,SAAU,qCAAqC,CAEnD,MAAmB,EAAA;IACnB,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;AAErC,IAAA,OAAO,eAAe,YAAY,CAChC,OAAgB,EAAA;AAEhB,QAAA,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;AAE1D,QAAA,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE;AAC7B,YAAA,MAAM,CAAC,KAAK,CACV,sFAAsF,EACtF,EAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAC,CAC3C,CAAC;AACF,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,oBAAoB;AACjC,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YACnD,OAAO;AACP,YAAA,UAAU,EAAE,OAAO;AACpB,SAAA,CAAC,CAAC;AAEH,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;AACjB,YAAA,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;gBAC9D,MAAM,EAAE,MAAM,CAAC,MAAM;AACtB,aAAA,CAAC,CAAC;AAEH,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpC,QAAA,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAE7D,QAAA,MAAM,CAAC,KAAK,CACV,sEAAsE,EACtE;YACE,IAAI;AACL,SAAA,CACF,CAAC;QAEF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC,OAAO,EAAE;AACZ,YAAA,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBAChE,IAAI;AACL,aAAA,CAAC,CAAC;AACH,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE;YAClE,IAAI;AACL,SAAA,CAAC,CAAC;QAEH,OAAO;YACL,OAAO;YACP,OAAO;YACP,KAAK,EAAE,kBAAkB,CAAY,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;SACxD,CAAC;AACJ,KAAC,CAAC;AACJ;;;;"}

package/dist/esm/server/authenticate/helpers/add-response-headers.mjs

@@ -0,0 +1,24 @@
+function addDocumentResponseHeadersFactory(params) {
+    const { api, config } = params;
+    return function (request, headers) {
+        const { searchParams } = new URL(request.url);
+        const shop = api.utils.sanitizeShop(searchParams.get('shop'));
+        addDocumentResponseHeaders(headers, config.isEmbeddedApp, shop);
+    };
+}
+function addDocumentResponseHeaders(headers, isEmbeddedApp, shop) {
+    if (shop) {
+        headers.set('Link', '<https://cdn.shopify.com/shopifycloud/app-bridge.js>; rel="preload"; as="script";');
+    }
+    if (isEmbeddedApp) {
+        if (shop) {
+            headers.set('Content-Security-Policy', `frame-ancestors https://${shop} https://admin.shopify.com https://*.spin.dev;`);
+        }
+    }
+    else {
+        headers.set('Content-Security-Policy', `frame-ancestors 'none';`);
+    }
+}
+
+export { addDocumentResponseHeaders, addDocumentResponseHeadersFactory };
+//# sourceMappingURL=add-response-headers.mjs.map

package/dist/esm/server/authenticate/helpers/add-response-headers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-response-headers.mjs","sources":["../../../../../../src/server/authenticate/helpers/add-response-headers.ts"],"sourcesContent":[null],"names":[],"mappings":"AAOM,SAAU,iCAAiC,CAC/C,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAC,GAAG,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;IAE7B,OAAO,UAAU,OAAgB,EAAE,OAAgB,EAAA;QACjD,MAAM,EAAC,YAAY,EAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC5C,QAAA,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC;QAE/D,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAClE,KAAC,CAAC;AACJ,CAAC;SAEe,0BAA0B,CACxC,OAAgB,EAChB,aAAsB,EACtB,IAA+B,EAAA;IAE/B,IAAI,IAAI,EAAE;AACR,QAAA,OAAO,CAAC,GAAG,CACT,MAAM,EACN,mFAAmF,CACpF,CAAC;KACH;IAED,IAAI,aAAa,EAAE;QACjB,IAAI,IAAI,EAAE;YACR,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,CAA2B,wBAAA,EAAA,IAAI,CAAgD,8CAAA,CAAA,CAChF,CAAC;SACH;KACF;SAAM;AACL,QAAA,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAA,uBAAA,CAAyB,CAAC,CAAC;KACnE;AACH;;;;"}

package/dist/esm/server/authenticate/helpers/app-bridge-url.mjs

@@ -0,0 +1,12 @@
+import { APP_BRIDGE_URL } from '../const.mjs';
+
+let appBridgeUrlOverride;
+function setAppBridgeUrlOverride(url) {
+    appBridgeUrlOverride = url;
+}
+function appBridgeUrl() {
+    return appBridgeUrlOverride || APP_BRIDGE_URL;
+}
+
+export { appBridgeUrl, setAppBridgeUrlOverride };
+//# sourceMappingURL=app-bridge-url.mjs.map

package/dist/esm/server/authenticate/helpers/app-bridge-url.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-bridge-url.mjs","sources":["../../../../../../src/server/authenticate/helpers/app-bridge-url.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAEA,IAAI,oBAAwC,CAAC;AACvC,SAAU,uBAAuB,CAAC,GAAW,EAAA;IACjD,oBAAoB,GAAG,GAAG,CAAC;AAC7B,CAAC;SAEe,YAAY,GAAA;IAC1B,OAAO,oBAAoB,IAAI,cAAc,CAAC;AAChD;;;;"}

package/dist/esm/server/authenticate/helpers/ensure-cors-headers.mjs

@@ -0,0 +1,23 @@
+import { REAUTH_URL_HEADER } from '../const.mjs';
+
+function ensureCORSHeadersFactory(params, request, corsHeaders = []) {
+    const { logger, config } = params;
+    return function ensureCORSHeaders(response) {
+        const origin = request.headers.get('Origin');
+        if (origin && origin !== config.appUrl) {
+            logger.debug('Request comes from a different origin, adding CORS headers');
+            const corsHeadersSet = new Set([
+                'Authorization',
+                'Content-Type',
+                ...corsHeaders,
+            ]);
+            response.headers.set('Access-Control-Allow-Origin', '*');
+            response.headers.set('Access-Control-Allow-Headers', [...corsHeadersSet].join(', '));
+            response.headers.set('Access-Control-Expose-Headers', REAUTH_URL_HEADER);
+        }
+        return response;
+    };
+}
+
+export { ensureCORSHeadersFactory };
+//# sourceMappingURL=ensure-cors-headers.mjs.map

package/dist/esm/server/authenticate/helpers/ensure-cors-headers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-cors-headers.mjs","sources":["../../../../../../src/server/authenticate/helpers/ensure-cors-headers.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAOM,SAAU,wBAAwB,CACtC,MAAmB,EACnB,OAAgB,EAChB,cAAwB,EAAE,EAAA;AAE1B,IAAA,MAAM,EAAC,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;IAEhC,OAAO,SAAS,iBAAiB,CAAC,QAAQ,EAAA;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;AACtC,YAAA,MAAM,CAAC,KAAK,CACV,4DAA4D,CAC7D,CAAC;AAEF,YAAA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;gBAC7B,eAAe;gBACf,cAAc;AACd,gBAAA,GAAG,WAAW;AACf,aAAA,CAAC,CAAC;YAEH,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AACzD,YAAA,QAAQ,CAAC,OAAO,CAAC,GAAG,CAClB,8BAA8B,EAC9B,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/B,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,iBAAiB,CAAC,CAAC;SAC1E;AAED,QAAA,OAAO,QAAQ,CAAC;AAClB,KAAC,CAAC;AACJ;;;;"}

package/dist/esm/server/authenticate/helpers/get-session-token-header.mjs

@@ -0,0 +1,11 @@
+const SESSION_TOKEN_PARAM = 'id_token';
+function getSessionTokenHeader(request) {
+    return request.headers.get('authorization')?.replace('Bearer ', '');
+}
+function getSessionTokenFromUrlParam(request) {
+    const url = new URL(request.url);
+    return url.searchParams.get(SESSION_TOKEN_PARAM);
+}
+
+export { getSessionTokenFromUrlParam, getSessionTokenHeader };
+//# sourceMappingURL=get-session-token-header.mjs.map

package/dist/esm/server/authenticate/helpers/get-session-token-header.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-session-token-header.mjs","sources":["../../../../../../src/server/authenticate/helpers/get-session-token-header.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAEjC,SAAU,qBAAqB,CAAC,OAAgB,EAAA;AACpD,IAAA,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAEK,SAAU,2BAA2B,CAAC,OAAgB,EAAA;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACnD;;;;"}

package/dist/esm/server/authenticate/helpers/idempotent-promise-handler.mjs

@@ -0,0 +1,34 @@
+const IDENTIFIER_TTL_MS = 60000;
+class IdempotentPromiseHandler {
+    constructor() {
+        this.identifiers = new Map();
+    }
+    async handlePromise({ promiseFunction, identifier, }) {
+        try {
+            if (this.isPromiseRunnable(identifier)) {
+                await promiseFunction();
+            }
+        }
+        finally {
+            this.clearStaleIdentifiers();
+        }
+        return Promise.resolve();
+    }
+    isPromiseRunnable(identifier) {
+        if (!this.identifiers.has(identifier)) {
+            this.identifiers.set(identifier, Date.now());
+            return true;
+        }
+        return false;
+    }
+    async clearStaleIdentifiers() {
+        this.identifiers.forEach((date, identifier, map) => {
+            if (Date.now() - date > IDENTIFIER_TTL_MS) {
+                map.delete(identifier);
+            }
+        });
+    }
+}
+
+export { IdempotentPromiseHandler };
+//# sourceMappingURL=idempotent-promise-handler.mjs.map

package/dist/esm/server/authenticate/helpers/idempotent-promise-handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotent-promise-handler.mjs","sources":["../../../../../../src/server/authenticate/helpers/idempotent-promise-handler.ts"],"sourcesContent":[null],"names":[],"mappings":"AAKA,MAAM,iBAAiB,GAAG,KAAK,CAAC;MAEnB,wBAAwB,CAAA;AAGnC,IAAA,WAAA,GAAA;AACE,QAAA,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;KAC9C;AAED,IAAA,MAAM,aAAa,CAAC,EAClB,eAAe,EACf,UAAU,GACoB,EAAA;AAC9B,QAAA,IAAI;AACF,YAAA,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE;gBACtC,MAAM,eAAe,EAAE,CAAC;aACzB;SACF;gBAAS;YACR,IAAI,CAAC,qBAAqB,EAAE,CAAC;SAC9B;AAED,QAAA,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;KAC1B;AAEO,IAAA,iBAAiB,CAAC,UAAkB,EAAA;QAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;AACrC,YAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC7C,YAAA,OAAO,IAAI,CAAC;SACb;AACD,QAAA,OAAO,KAAK,CAAC;KACd;AAEO,IAAA,MAAM,qBAAqB,GAAA;AACjC,QAAA,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,KAAI;YACjD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,iBAAiB,EAAE;AACzC,gBAAA,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;aACxB;AACH,SAAC,CAAC,CAAC;KACJ;AACF;;;;"}

package/dist/esm/server/authenticate/helpers/reject-bot-request.mjs

@@ -0,0 +1,11 @@
+import { isbot } from 'isbot';
+
+function respondToBotRequest({ logger }, request) {
+    if (isbot(request.headers.get('User-Agent'))) {
+        logger.debug('Request is from a bot, skipping auth');
+        throw new Response(undefined, { status: 410, statusText: 'Gone' });
+    }
+}
+
+export { respondToBotRequest };
+//# sourceMappingURL=reject-bot-request.mjs.map

package/dist/esm/server/authenticate/helpers/reject-bot-request.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reject-bot-request.mjs","sources":["../../../../../../src/server/authenticate/helpers/reject-bot-request.ts"],"sourcesContent":[null],"names":[],"mappings":";;SAIgB,mBAAmB,CACjC,EAAC,MAAM,EAAc,EACrB,OAAgB,EAAA;AAEhB,IAAA,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE;AAC5C,QAAA,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;AACrD,QAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAC,CAAC,CAAC;KAClE;AACH;;;;"}

package/dist/esm/server/authenticate/helpers/respond-to-invalid-session-token.mjs

@@ -0,0 +1,18 @@
+import { redirectToBouncePage } from '../admin/helpers/redirect-to-bounce-page.mjs';
+import { RETRY_INVALID_SESSION_HEADER } from '../const.mjs';
+
+function respondToInvalidSessionToken({ params, request, retryRequest = false, }) {
+    const { api, logger, config } = params;
+    const isDocumentRequest = !request.headers.get('authorization');
+    if (isDocumentRequest) {
+        return redirectToBouncePage({ api, logger, config }, new URL(request.url));
+    }
+    throw new Response(undefined, {
+        status: 401,
+        statusText: 'Unauthorized',
+        headers: retryRequest ? RETRY_INVALID_SESSION_HEADER : {},
+    });
+}
+
+export { respondToInvalidSessionToken };
+//# sourceMappingURL=respond-to-invalid-session-token.mjs.map

package/dist/esm/server/authenticate/helpers/respond-to-invalid-session-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"respond-to-invalid-session-token.mjs","sources":["../../../../../../src/server/authenticate/helpers/respond-to-invalid-session-token.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAWM,SAAU,4BAA4B,CAAC,EAC3C,MAAM,EACN,OAAO,EACP,YAAY,GAAG,KAAK,GACe,EAAA;IACnC,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;IAErC,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,iBAAiB,EAAE;AACrB,QAAA,OAAO,oBAAoB,CAAC,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1E;AAED,IAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,QAAA,MAAM,EAAE,GAAG;AACX,QAAA,UAAU,EAAE,cAAc;QAC1B,OAAO,EAAE,YAAY,GAAG,4BAA4B,GAAG,EAAE;AAC1D,KAAA,CAAC,CAAC;AACL;;;;"}

package/dist/esm/server/authenticate/helpers/respond-to-options-request.mjs

@@ -0,0 +1,16 @@
+import { ensureCORSHeadersFactory } from './ensure-cors-headers.mjs';
+
+function respondToOptionsRequest(params, request, corsHeaders) {
+    if (request.method === 'OPTIONS') {
+        const ensureCORSHeaders = ensureCORSHeadersFactory(params, request, corsHeaders);
+        throw ensureCORSHeaders(new Response(null, {
+            status: 204,
+            headers: {
+                'Access-Control-Max-Age': '7200',
+            },
+        }));
+    }
+}
+
+export { respondToOptionsRequest };
+//# sourceMappingURL=respond-to-options-request.mjs.map

package/dist/esm/server/authenticate/helpers/respond-to-options-request.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"respond-to-options-request.mjs","sources":["../../../../../../src/server/authenticate/helpers/respond-to-options-request.ts"],"sourcesContent":[null],"names":[],"mappings":";;SAIgB,uBAAuB,CACrC,MAAmB,EACnB,OAAgB,EAChB,WAAsB,EAAA;AAEtB,IAAA,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE;QAChC,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,MAAM,EACN,OAAO,EACP,WAAW,CACZ,CAAC;AAEF,QAAA,MAAM,iBAAiB,CACrB,IAAI,QAAQ,CAAC,IAAI,EAAE;AACjB,YAAA,MAAM,EAAE,GAAG;AACX,YAAA,OAAO,EAAE;AACP,gBAAA,wBAAwB,EAAE,MAAM;AACjC,aAAA;AACF,SAAA,CAAC,CACH,CAAC;KACH;AACH;;;;"}

package/dist/esm/server/authenticate/helpers/validate-session-token.mjs

@@ -0,0 +1,22 @@
+import { respondToInvalidSessionToken } from './respond-to-invalid-session-token.mjs';
+
+async function validateSessionToken(params, request, token, { checkAudience = true } = {}) {
+    const { api, logger } = params;
+    logger.debug('Validating session token');
+    try {
+        const payload = await api.session.decodeSessionToken(token, {
+            checkAudience,
+        });
+        logger.debug('Session token is valid', {
+            payload: JSON.stringify(payload),
+        });
+        return payload;
+    }
+    catch (error) {
+        logger.debug(`Failed to validate session token: ${error.message}`);
+        throw respondToInvalidSessionToken({ params, request, retryRequest: true });
+    }
+}
+
+export { validateSessionToken };
+//# sourceMappingURL=validate-session-token.mjs.map

package/dist/esm/server/authenticate/helpers/validate-session-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-session-token.mjs","sources":["../../../../../../src/server/authenticate/helpers/validate-session-token.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAUO,eAAe,oBAAoB,CACxC,MAAmB,EACnB,OAAgB,EAChB,KAAa,EACb,EAAC,aAAa,GAAG,IAAI,KAAiC,EAAE,EAAA;AAExD,IAAA,MAAM,EAAC,GAAG,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;AAC7B,IAAA,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAEzC,IAAA,IAAI;QACF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE;YAC1D,aAAa;AACd,SAAA,CAAC,CAAC;AACH,QAAA,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;AACrC,YAAA,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;AACjC,SAAA,CAAC,CAAC;AAEH,QAAA,OAAO,OAAO,CAAC;KAChB;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,CAAC,KAAK,CAAC,CAAA,kCAAA,EAAqC,KAAK,CAAC,OAAO,CAAE,CAAA,CAAC,CAAC;AAEnE,QAAA,MAAM,4BAA4B,CAAC,EAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;KAC3E;AACH;;;;"}

package/dist/esm/server/authenticate/login/login.mjs

@@ -0,0 +1,41 @@
+import { redirect } from '@remix-run/server-runtime';
+import { LoginErrorType } from '../../types.mjs';
+
+function loginFactory(params) {
+    const { api, config, logger } = params;
+    return async function login(request) {
+        const url = new URL(request.url);
+        const shopParam = url.searchParams.get('shop');
+        if (request.method === 'GET' && !shopParam) {
+            return {};
+        }
+        const shop = shopParam || (await request.formData()).get('shop');
+        if (!shop) {
+            logger.debug('Missing shop parameter', { shop });
+            return { shop: LoginErrorType.MissingShop };
+        }
+        const shopWithoutProtocol = shop
+            .replace(/^https?:\/\//, '')
+            .replace(/\/$/, '');
+        const shopWithDomain = shop?.indexOf('.') === -1
+            ? `${shopWithoutProtocol}.myshopify.com`
+            : shopWithoutProtocol;
+        const sanitizedShop = api.utils.sanitizeShop(shopWithDomain);
+        if (!sanitizedShop) {
+            logger.debug('Invalid shop parameter', { shop });
+            return { shop: LoginErrorType.InvalidShop };
+        }
+        const authPath = `${config.appUrl}${config.auth.path}?shop=${sanitizedShop}`;
+        const adminPath = api.utils.legacyUrlToShopAdminUrl(sanitizedShop);
+        const installPath = `https://${adminPath}/oauth/install?client_id=${config.apiKey}`;
+        const shouldInstall = config.isEmbeddedApp && config.future.unstable_newEmbeddedAuthStrategy;
+        const redirectUrl = shouldInstall ? installPath : authPath;
+        logger.info(`Redirecting login request to ${redirectUrl}`, {
+            shop: sanitizedShop,
+        });
+        throw redirect(redirectUrl);
+    };
+}
+
+export { loginFactory };
+//# sourceMappingURL=login.mjs.map

package/dist/esm/server/authenticate/login/login.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.mjs","sources":["../../../../../../src/server/authenticate/login/login.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAIM,SAAU,YAAY,CAAC,MAAmB,EAAA;IAC9C,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;AAErC,IAAA,OAAO,eAAe,KAAK,CAAC,OAAgB,EAAA;QAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,SAAS,EAAE;AAC1C,YAAA,OAAO,EAAE,CAAC;SACX;AAED,QAAA,MAAM,IAAI,GACR,SAAS,IAAK,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,MAAM,CAAY,CAAC;QAElE,IAAI,CAAC,IAAI,EAAE;YACT,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC;AAC/C,YAAA,OAAO,EAAC,IAAI,EAAE,cAAc,CAAC,WAAW,EAAC,CAAC;SAC3C;QAED,MAAM,mBAAmB,GAAG,IAAI;AAC7B,aAAA,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;AAC3B,aAAA,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,cAAc,GAClB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;cACrB,CAAG,EAAA,mBAAmB,CAAgB,cAAA,CAAA;cACtC,mBAAmB,CAAC;QAC1B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAE7D,IAAI,CAAC,aAAa,EAAE;YAClB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC;AAC/C,YAAA,OAAO,EAAC,IAAI,EAAE,cAAc,CAAC,WAAW,EAAC,CAAC;SAC3C;AAED,QAAA,MAAM,QAAQ,GAAG,CAAG,EAAA,MAAM,CAAC,MAAM,CAAA,EAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAS,MAAA,EAAA,aAAa,EAAE,CAAC;QAE7E,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,CAAW,QAAA,EAAA,SAAS,4BAA4B,MAAM,CAAC,MAAM,CAAA,CAAE,CAAC;QAEpF,MAAM,aAAa,GACjB,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,gCAAgC,CAAC;QACzE,MAAM,WAAW,GAAG,aAAa,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE3D,QAAA,MAAM,CAAC,IAAI,CAAC,CAAgC,6BAAA,EAAA,WAAW,EAAE,EAAE;AACzD,YAAA,IAAI,EAAE,aAAa;AACpB,SAAA,CAAC,CAAC;AAEH,QAAA,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9B,KAAC,CAAC;AACJ;;;;"}

package/dist/esm/server/authenticate/public/appProxy/authenticate.mjs

@@ -0,0 +1,93 @@
+import { adminClientFactory } from '../../../clients/admin/factory.mjs';
+import { storefrontClientFactory } from '../../../clients/storefront/factory.mjs';
+
+function authenticateAppProxyFactory(params) {
+    const { api, config, logger } = params;
+    return async function authenticate(request) {
+        logger.info('Authenticating app proxy request');
+        const url = new URL(request.url);
+        if (!(await validateAppProxyHmac(params, url))) {
+            logger.info('App proxy request has invalid signature');
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        const shop = url.searchParams.get('shop');
+        const sessionId = api.session.getOfflineId(shop);
+        const session = await config.sessionStorage.loadSession(sessionId);
+        if (!session) {
+            const context = {
+                liquid,
+                session: undefined,
+                admin: undefined,
+                storefront: undefined,
+            };
+            return context;
+        }
+        const context = {
+            liquid,
+            session,
+            admin: adminClientFactory({ params, session }),
+            storefront: storefrontClientFactory({ params, session }),
+        };
+        return context;
+    };
+}
+const liquid = (body, initAndOptions) => {
+    const processedBody = processLiquidBody(body);
+    if (typeof initAndOptions !== 'object') {
+        return new Response(processedBody, {
+            status: initAndOptions || 200,
+            headers: {
+                'Content-Type': 'application/liquid',
+            },
+        });
+    }
+    const { layout, ...responseInit } = initAndOptions || {};
+    const responseBody = layout === false ? `{% layout none %} ${processedBody}` : processedBody;
+    const headers = new Headers(responseInit.headers);
+    headers.set('Content-Type', 'application/liquid');
+    return new Response(responseBody, {
+        ...responseInit,
+        headers,
+    });
+};
+async function validateAppProxyHmac(params, url) {
+    const { api, logger } = params;
+    try {
+        let searchParams = new URLSearchParams(url.search);
+        if (!searchParams.get('index')) {
+            searchParams.delete('index');
+        }
+        let isValid = await api.utils.validateHmac(Object.fromEntries(searchParams.entries()), { signator: 'appProxy' });
+        if (!isValid) {
+            const cleanPath = url.pathname
+                .replace(/^\//, '')
+                .replace(/\/$/, '')
+                .replaceAll('/', '.');
+            const data = `routes%2F${cleanPath}`;
+            searchParams = new URLSearchParams(`?_data=${data}&${searchParams.toString().replace(/^\?/, '')}`);
+            isValid = await api.utils.validateHmac(Object.fromEntries(searchParams.entries()), { signator: 'appProxy' });
+            if (!isValid) {
+                const searchParams = new URLSearchParams(`?_data=${data}._index&${url.search.replace(/^\?/, '')}`);
+                isValid = await api.utils.validateHmac(Object.fromEntries(searchParams.entries()), { signator: 'appProxy' });
+            }
+        }
+        return isValid;
+    }
+    catch (error) {
+        logger.info(error.message);
+        throw new Response(undefined, { status: 400, statusText: 'Bad Request' });
+    }
+}
+function processLiquidBody(body) {
+    return (body
+        // Add trailing slashes to relative form action URLs
+        .replaceAll(/<(form[^>]+)action="(\/[^"?]+)(\?[^"]+)?">/g, '<$1action="$2/$3">')
+        // Add trailing slashes to relative link href URLs
+        .replaceAll(/<(a[^>]+)href="(\/[^"?]+)(\?[^"]+)?">/g, '<$1href="$2/$3">'));
+}
+
+export { authenticateAppProxyFactory };
+//# sourceMappingURL=authenticate.mjs.map

package/dist/esm/server/authenticate/public/appProxy/authenticate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.mjs","sources":["../../../../../../../src/server/authenticate/public/appProxy/authenticate.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAYM,SAAU,2BAA2B,CAEzC,MAAmB,EAAA;IACnB,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;AAErC,IAAA,OAAO,eAAe,YAAY,CAChC,OAAO,EAAA;AAEP,QAAA,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,EAAE,MAAM,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE;AAC9C,YAAA,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;AACvD,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC,OAAO,EAAE;AACZ,YAAA,MAAM,OAAO,GAAoB;gBAC/B,MAAM;AACN,gBAAA,OAAO,EAAE,SAAS;AAClB,gBAAA,KAAK,EAAE,SAAS;AAChB,gBAAA,UAAU,EAAE,SAAS;aACtB,CAAC;AAEF,YAAA,OAAO,OAAO,CAAC;SAChB;AAED,QAAA,MAAM,OAAO,GAA0C;YACrD,MAAM;YACN,OAAO;YACP,KAAK,EAAE,kBAAkB,CAAC,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;YAC5C,UAAU,EAAE,uBAAuB,CAAC,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;SACvD,CAAC;AAEF,QAAA,OAAO,OAAO,CAAC;AACjB,KAAC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAA2B,CAAC,IAAI,EAAE,cAAc,KAAI;AAC9D,IAAA,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAE9C,IAAA,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE;AACtC,QAAA,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE;YACjC,MAAM,EAAE,cAAc,IAAI,GAAG;AAC7B,YAAA,OAAO,EAAE;AACP,gBAAA,cAAc,EAAE,oBAAoB;AACrC,aAAA;AACF,SAAA,CAAC,CAAC;KACJ;IAED,MAAM,EAAC,MAAM,EAAE,GAAG,YAAY,EAAC,GAAG,cAAc,IAAI,EAAE,CAAC;AACvD,IAAA,MAAM,YAAY,GAChB,MAAM,KAAK,KAAK,GAAG,CAAA,kBAAA,EAAqB,aAAa,CAAE,CAAA,GAAG,aAAa,CAAC;IAE1E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAClD,IAAA,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;AAElD,IAAA,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE;AAChC,QAAA,GAAG,YAAY;QACf,OAAO;AACR,KAAA,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,oBAAoB,CACjC,MAAmB,EACnB,GAAQ,EAAA;AAER,IAAA,MAAM,EAAC,GAAG,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;AAE7B,IAAA,IAAI;QACF,IAAI,YAAY,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;AAC9B,YAAA,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SAC9B;QAED,IAAI,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,CACxC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,EAC1C,EAAC,QAAQ,EAAE,UAAU,EAAC,CACvB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE;AACZ,YAAA,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ;AAC3B,iBAAA,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAClB,iBAAA,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAClB,iBAAA,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACxB,YAAA,MAAM,IAAI,GAAG,CAAY,SAAA,EAAA,SAAS,EAAE,CAAC;YAErC,YAAY,GAAG,IAAI,eAAe,CAChC,UAAU,IAAI,CAAA,CAAA,EAAI,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA,CAAE,CAC/D,CAAC;YAEF,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,CACpC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,EAC1C,EAAC,QAAQ,EAAE,UAAU,EAAC,CACvB,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE;gBACZ,MAAM,YAAY,GAAG,IAAI,eAAe,CACtC,CAAU,OAAA,EAAA,IAAI,WAAW,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA,CAAE,CACzD,CAAC;gBAEF,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,CACpC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,EAC1C,EAAC,QAAQ,EAAE,UAAU,EAAC,CACvB,CAAC;aACH;SACF;AAED,QAAA,OAAO,OAAO,CAAC;KAChB;IAAC,OAAO,KAAK,EAAE;AACd,QAAA,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,QAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,aAAa,EAAC,CAAC,CAAC;KACzE;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAA;AACrC,IAAA,QACE,IAAI;;AAED,SAAA,UAAU,CACT,6CAA6C,EAC7C,oBAAoB,CACrB;;AAEA,SAAA,UAAU,CAAC,wCAAwC,EAAE,kBAAkB,CAAC,EAC3E;AACJ;;;;"}