@shopify/shopify-app-remix 2.8.0 → 2.8.1

package/dist/cjs/server/authenticate/admin/strategies/auth-code-flow.js

@@ -0,0 +1,225 @@
+'use strict';
+
+var shopifyApi = require('@shopify/shopify-api');
+var beginAuth = require('../helpers/begin-auth.js');
+var redirectToShopifyOrAppRoot = require('../helpers/redirect-to-shopify-or-app-root.js');
+require('@remix-run/server-runtime');
+var handleClientError = require('../helpers/handle-client-error.js');
+var redirectToAuthPage = require('../helpers/redirect-to-auth-page.js');
+var redirectWithExitiframe = require('../helpers/redirect-with-exitiframe.js');
+var getSessionTokenHeader = require('../../helpers/get-session-token-header.js');
+var triggerAfterAuthHook = require('../helpers/trigger-after-auth-hook.js');
+var validateShopAndHostParams = require('../helpers/validate-shop-and-host-params.js');
+require('isbot');
+
+class AuthCodeFlowStrategy {
+    constructor({ api, config, logger }) {
+        this.api = api;
+        this.config = config;
+        this.logger = logger;
+    }
+    async respondToOAuthRequests(request) {
+        const { api, config } = this;
+        const url = new URL(request.url);
+        const isAuthRequest = url.pathname === config.auth.path;
+        const isAuthCallbackRequest = url.pathname === config.auth.callbackPath;
+        if (isAuthRequest || isAuthCallbackRequest) {
+            const shop = api.utils.sanitizeShop(url.searchParams.get('shop'));
+            if (!shop)
+                throw new Response('Shop param is invalid', { status: 400 });
+            if (isAuthRequest) {
+                throw await this.handleAuthBeginRequest(request, shop);
+            }
+            else {
+                throw await this.handleAuthCallbackRequest(request, shop);
+            }
+        }
+        if (!getSessionTokenHeader.getSessionTokenHeader(request)) {
+            // This is a document request that doesn't contain a session token. We check if the app is installed.
+            // If the app isn't installed, we initiate the OAuth auth code flow.
+            // Requests with a header can only happen after the app is installed.
+            await this.ensureInstalledOnShop(request);
+        }
+    }
+    async authenticate(request, sessionContext) {
+        const { api, config, logger } = this;
+        const { shop, session } = sessionContext;
+        if (!session) {
+            logger.debug('No session found, redirecting to OAuth', { shop });
+            await redirectToAuthPage.redirectToAuthPage({ config, logger, api }, request, shop);
+        }
+        else if (!session.isActive(config.scopes)) {
+            logger.debug('Found a session, but it has expired, redirecting to OAuth', { shop });
+            await redirectToAuthPage.redirectToAuthPage({ config, logger, api }, request, shop);
+        }
+        logger.debug('Found a valid session', { shop });
+        return session;
+    }
+    handleClientError(request) {
+        const { api, config, logger } = this;
+        return handleClientError.handleClientErrorFactory({
+            request,
+            onError: async ({ session, error }) => {
+                if (error.response.code === 401) {
+                    throw await redirectToAuthPage.redirectToAuthPage({ api, config, logger }, request, session.shop);
+                }
+            },
+        });
+    }
+    async ensureInstalledOnShop(request) {
+        const { api, config, logger } = this;
+        validateShopAndHostParams.validateShopAndHostParams({ api, config, logger }, request);
+        const url = new URL(request.url);
+        let shop = url.searchParams.get('shop');
+        // Ensure app is installed
+        logger.debug('Ensuring app is installed on shop', { shop });
+        if (!(await this.hasValidOfflineId(request))) {
+            logger.info("Could not find a shop, can't authenticate request");
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        const offlineSession = await this.getOfflineSession(request);
+        const isEmbedded = url.searchParams.get('embedded') === '1';
+        if (!offlineSession) {
+            logger.info("Shop hasn't installed app yet, redirecting to OAuth", {
+                shop,
+            });
+            if (isEmbedded) {
+                redirectWithExitiframe.redirectWithExitIframe({ api, config, logger }, request, shop);
+            }
+            else {
+                throw await beginAuth.beginAuth({ api, config, logger }, request, false, shop);
+            }
+        }
+        shop = shop || offlineSession.shop;
+        if (config.isEmbeddedApp && !isEmbedded) {
+            try {
+                logger.debug('Ensuring offline session is valid before embedding', {
+                    shop,
+                });
+                await this.testSession(offlineSession);
+                logger.debug('Offline session is still valid, embedding app', { shop });
+            }
+            catch (error) {
+                await this.handleInvalidOfflineSession(error, request, shop);
+            }
+        }
+    }
+    async handleAuthBeginRequest(request, shop) {
+        const { api, config, logger } = this;
+        logger.info('Handling OAuth begin request', { shop });
+        // If we're loading from an iframe, we need to break out of it
+        if (config.isEmbeddedApp &&
+            request.headers.get('Sec-Fetch-Dest') === 'iframe') {
+            logger.debug('Auth request in iframe detected, exiting iframe', { shop });
+            throw redirectWithExitiframe.redirectWithExitIframe({ api, config, logger }, request, shop);
+        }
+        else {
+            throw await beginAuth.beginAuth({ api, config, logger }, request, false, shop);
+        }
+    }
+    async handleAuthCallbackRequest(request, shop) {
+        const { api, config, logger } = this;
+        logger.info('Handling OAuth callback request');
+        try {
+            const { session, headers: responseHeaders } = await api.auth.callback({
+                rawRequest: request,
+            });
+            await config.sessionStorage.storeSession(session);
+            if (config.useOnlineTokens && !session.isOnline) {
+                logger.info('Requesting online access token for offline session');
+                await beginAuth.beginAuth({ api, config, logger }, request, true, shop);
+            }
+            await triggerAfterAuthHook.triggerAfterAuthHook({ api, config, logger }, session, request, this);
+            throw await redirectToShopifyOrAppRoot.redirectToShopifyOrAppRoot(request, { api, config, logger }, responseHeaders);
+        }
+        catch (error) {
+            if (error instanceof Response)
+                throw error;
+            throw await this.oauthCallbackError(error, request, shop);
+        }
+    }
+    async getOfflineSession(request) {
+        const offlineId = await this.getOfflineSessionId(request);
+        return this.config.sessionStorage.loadSession(offlineId);
+    }
+    async hasValidOfflineId(request) {
+        return Boolean(await this.getOfflineSessionId(request));
+    }
+    async getOfflineSessionId(request) {
+        const { api } = this;
+        const url = new URL(request.url);
+        const shop = url.searchParams.get('shop');
+        return shop
+            ? api.session.getOfflineId(shop)
+            : api.session.getCurrentId({ isOnline: false, rawRequest: request });
+    }
+    async testSession(session) {
+        const { api } = this;
+        const client = new api.clients.Graphql({
+            session,
+        });
+        await client.request(`#graphql
+      query shopifyAppShopName {
+        shop {
+          name
+        }
+      }
+    `);
+    }
+    async oauthCallbackError(error, request, shop) {
+        const { logger } = this;
+        logger.error('Error during OAuth callback', { error: error.message });
+        if (error instanceof shopifyApi.CookieNotFound) {
+            return this.handleAuthBeginRequest(request, shop);
+        }
+        if (error instanceof shopifyApi.InvalidHmacError ||
+            error instanceof shopifyApi.InvalidOAuthError) {
+            return new Response(undefined, {
+                status: 400,
+                statusText: 'Invalid OAuth Request',
+            });
+        }
+        return new Response(undefined, {
+            status: 500,
+            statusText: 'Internal Server Error',
+        });
+    }
+    async handleInvalidOfflineSession(error, request, shop) {
+        const { api, logger, config } = this;
+        if (error instanceof shopifyApi.HttpResponseError) {
+            if (error.response.code === 401) {
+                logger.info('Shop session is no longer valid, redirecting to OAuth', {
+                    shop,
+                });
+                throw await beginAuth.beginAuth({ api, config, logger }, request, false, shop);
+            }
+            else {
+                const message = JSON.stringify(error.response.body, null, 2);
+                logger.error(`Unexpected error during session validation: ${message}`, {
+                    shop,
+                });
+                throw new Response(undefined, {
+                    status: error.response.code,
+                    statusText: error.response.statusText,
+                });
+            }
+        }
+        else if (error instanceof shopifyApi.GraphqlQueryError) {
+            const context = { shop };
+            if (error.response) {
+                context.response = JSON.stringify(error.body);
+            }
+            logger.error(`Unexpected error during session validation: ${error.message}`, context);
+            throw new Response(undefined, {
+                status: 500,
+                statusText: 'Internal Server Error',
+            });
+        }
+    }
+}
+
+exports.AuthCodeFlowStrategy = AuthCodeFlowStrategy;
+//# sourceMappingURL=auth-code-flow.js.map

package/dist/cjs/server/authenticate/admin/strategies/auth-code-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-code-flow.js","sources":["../../../../../../../src/server/authenticate/admin/strategies/auth-code-flow.ts"],"sourcesContent":[null],"names":["getSessionTokenHeader","redirectToAuthPage","handleClientErrorFactory","validateShopAndHostParams","redirectWithExitIframe","beginAuth","triggerAfterAuthHook","redirectToShopifyOrAppRoot","CookieNotFound","InvalidHmacError","InvalidOAuthError","HttpResponseError","GraphqlQueryError"],"mappings":";;;;;;;;;;;;;;MA+Ba,oBAAoB,CAAA;AAc/B,IAAA,WAAA,CAAmB,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAc,EAAA;AACnD,QAAA,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;AACf,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACrB,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;KACtB;IAEM,MAAM,sBAAsB,CAAC,OAAgB,EAAA;AAClD,QAAA,MAAM,EAAC,GAAG,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;QAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACxD,MAAM,qBAAqB,GAAG,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;AAExE,QAAA,IAAI,aAAa,IAAI,qBAAqB,EAAE;AAC1C,YAAA,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC;AACnE,YAAA,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAC,MAAM,EAAE,GAAG,EAAC,CAAC,CAAC;YAEtE,IAAI,aAAa,EAAE;gBACjB,MAAM,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;aACxD;iBAAM;gBACL,MAAM,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;aAC3D;SACF;AAED,QAAA,IAAI,CAACA,2CAAqB,CAAC,OAAO,CAAC,EAAE;;;;AAInC,YAAA,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;SAC3C;KACF;AAEM,IAAA,MAAM,YAAY,CACvB,OAAgB,EAChB,cAA8B,EAAA;QAE9B,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;AAEnC,QAAA,MAAM,EAAC,IAAI,EAAE,OAAO,EAAC,GAAG,cAAc,CAAC;QAEvC,IAAI,CAAC,OAAO,EAAE;YACZ,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC;AAC/D,YAAA,MAAMC,qCAAkB,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;SAChE;aAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YAC3C,MAAM,CAAC,KAAK,CACV,2DAA2D,EAC3D,EAAC,IAAI,EAAC,CACP,CAAC;AACF,YAAA,MAAMA,qCAAkB,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;SAChE;QAED,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC;AAE9C,QAAA,OAAO,OAAQ,CAAC;KACjB;AAEM,IAAA,iBAAiB,CAAC,OAAgB,EAAA;QACvC,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;AACnC,QAAA,OAAOC,0CAAwB,CAAC;YAC9B,OAAO;YACP,OAAO,EAAE,OAAO,EAAC,OAAO,EAAE,KAAK,EAAiB,KAAI;gBAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,EAAE;AAC/B,oBAAA,MAAM,MAAMD,qCAAkB,CAC5B,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EACrB,OAAO,EACP,OAAO,CAAC,IAAI,CACb,CAAC;iBACH;aACF;AACF,SAAA,CAAC,CAAC;KACJ;IAEO,MAAM,qBAAqB,CAAC,OAAgB,EAAA;QAClD,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;QAEnCE,mDAAyB,CAAC,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EAAE,OAAO,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;;QAGxC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC;QAE1D,IAAI,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE;AAC5C,YAAA,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;AACjE,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7D,QAAA,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC;QAE5D,IAAI,CAAC,cAAc,EAAE;AACnB,YAAA,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACjE,IAAI;AACL,aAAA,CAAC,CAAC;YACH,IAAI,UAAU,EAAE;AACd,gBAAAC,6CAAsB,CAAC,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EAAE,OAAO,EAAE,IAAK,CAAC,CAAC;aAC/D;iBAAM;AACL,gBAAA,MAAM,MAAMC,mBAAS,CAAC,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAK,CAAC,CAAC;aACrE;SACF;AAED,QAAA,IAAI,GAAG,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC;AAEnC,QAAA,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,UAAU,EAAE;AACvC,YAAA,IAAI;AACF,gBAAA,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;oBACjE,IAAI;AACL,iBAAA,CAAC,CAAC;AACH,gBAAA,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;gBAEvC,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC;aACvE;YAAC,OAAO,KAAK,EAAE;gBACd,MAAM,IAAI,CAAC,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;aAC9D;SACF;KACF;AAEO,IAAA,MAAM,sBAAsB,CAClC,OAAgB,EAChB,IAAY,EAAA;QAEZ,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;QAEnC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC;;QAGpD,IACE,MAAM,CAAC,aAAa;YACpB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,EAClD;YACA,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC;AACxE,YAAA,MAAMD,6CAAsB,CAAC,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;SACpE;aAAM;AACL,YAAA,MAAM,MAAMC,mBAAS,CAAC,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;SACpE;KACF;AAEO,IAAA,MAAM,yBAAyB,CACrC,OAAgB,EAChB,IAAY,EAAA;QAEZ,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;AAEnC,QAAA,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;AAE/C,QAAA,IAAI;AACF,YAAA,MAAM,EAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;AAClE,gBAAA,UAAU,EAAE,OAAO;AACpB,aAAA,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAElD,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;AAC/C,gBAAA,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;AAClE,gBAAA,MAAMA,mBAAS,CAAC,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;aAC7D;AAED,YAAA,MAAMC,yCAAoB,CACxB,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EACrB,OAAO,EACP,OAAO,EACP,IAAI,CACL,CAAC;AAEF,YAAA,MAAM,MAAMC,qDAA0B,CACpC,OAAO,EACP,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EACrB,eAAe,CAChB,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,IAAI,KAAK,YAAY,QAAQ;AAAE,gBAAA,MAAM,KAAK,CAAC;YAE3C,MAAM,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;SAC3D;KACF;IAEO,MAAM,iBAAiB,CAC7B,OAAgB,EAAA;QAEhB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,SAAU,CAAC,CAAC;KAC3D;IAEO,MAAM,iBAAiB,CAAC,OAAgB,EAAA;QAC9C,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD;IAEO,MAAM,mBAAmB,CAC/B,OAAgB,EAAA;AAEhB,QAAA,MAAM,EAAC,GAAG,EAAC,GAAG,IAAI,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAE1C,QAAA,OAAO,IAAI;cACP,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;AAChC,cAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAC,CAAC,CAAC;KACtE;IAEO,MAAM,WAAW,CAAC,OAAgB,EAAA;AACxC,QAAA,MAAM,EAAC,GAAG,EAAC,GAAG,IAAI,CAAC;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;YACrC,OAAO;AACR,SAAA,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;;;;;;AAMpB,IAAA,CAAA,CAAC,CAAC;KACJ;AAEO,IAAA,MAAM,kBAAkB,CAC9B,KAAY,EACZ,OAAgB,EAChB,IAAY,EAAA;AAEZ,QAAA,MAAM,EAAC,MAAM,EAAC,GAAG,IAAI,CAAC;AACtB,QAAA,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAC,CAAC,CAAC;AAEpE,QAAA,IAAI,KAAK,YAAYC,yBAAc,EAAE;YACnC,OAAO,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SACnD;QAED,IACE,KAAK,YAAYC,2BAAgB;YACjC,KAAK,YAAYC,4BAAiB,EAClC;AACA,YAAA,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC7B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,uBAAuB;AACpC,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC7B,YAAA,MAAM,EAAE,GAAG;AACX,YAAA,UAAU,EAAE,uBAAuB;AACpC,SAAA,CAAC,CAAC;KACJ;AAEO,IAAA,MAAM,2BAA2B,CACvC,KAAY,EACZ,OAAgB,EAChB,IAAY,EAAA;QAEZ,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;AACnC,QAAA,IAAI,KAAK,YAAYC,4BAAiB,EAAE;YACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,EAAE;AAC/B,gBAAA,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;oBACnE,IAAI;AACL,iBAAA,CAAC,CAAC;AACH,gBAAA,MAAM,MAAMN,mBAAS,CAAC,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;aACpE;iBAAM;AACL,gBAAA,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,gBAAA,MAAM,CAAC,KAAK,CAAC,CAA+C,4CAAA,EAAA,OAAO,EAAE,EAAE;oBACrE,IAAI;AACL,iBAAA,CAAC,CAAC;AAEH,gBAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,oBAAA,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;AAC3B,oBAAA,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;AACtC,iBAAA,CAAC,CAAC;aACJ;SACF;AAAM,aAAA,IAAI,KAAK,YAAYO,4BAAiB,EAAE;AAC7C,YAAA,MAAM,OAAO,GAA2B,EAAC,IAAI,EAAC,CAAC;AAC/C,YAAA,IAAI,KAAK,CAAC,QAAQ,EAAE;gBAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC/C;YAED,MAAM,CAAC,KAAK,CACV,CAA+C,4CAAA,EAAA,KAAK,CAAC,OAAO,CAAE,CAAA,EAC9D,OAAO,CACR,CAAC;AAEF,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,uBAAuB;AACpC,aAAA,CAAC,CAAC;SACJ;KACF;AACF;;;;"}

package/dist/cjs/server/authenticate/admin/strategies/token-exchange.js

@@ -0,0 +1,110 @@
+'use strict';
+
+var shopifyApi = require('@shopify/shopify-api');
+var respondToInvalidSessionToken = require('../../helpers/respond-to-invalid-session-token.js');
+require('isbot');
+require('@remix-run/server-runtime');
+var handleClientError = require('../helpers/handle-client-error.js');
+var triggerAfterAuthHook = require('../helpers/trigger-after-auth-hook.js');
+
+class TokenExchangeStrategy {
+    constructor({ api, config, logger }) {
+        this.api = api;
+        this.config = config;
+        this.logger = logger;
+    }
+    async respondToOAuthRequests(_request) { }
+    async authenticate(request, sessionContext) {
+        const { api, config, logger } = this;
+        const { shop, session, sessionToken } = sessionContext;
+        if (!sessionToken)
+            throw new shopifyApi.InvalidJwtError();
+        if (!session || session.isExpired()) {
+            logger.info('No valid session found');
+            logger.info('Requesting offline access token');
+            const { session: offlineSession } = await this.exchangeToken({
+                request,
+                sessionToken,
+                shop,
+                requestedTokenType: shopifyApi.RequestedTokenType.OfflineAccessToken,
+            });
+            await config.sessionStorage.storeSession(offlineSession);
+            let newSession = offlineSession;
+            if (config.useOnlineTokens) {
+                logger.info('Requesting online access token');
+                const { session: onlineSession } = await this.exchangeToken({
+                    request,
+                    sessionToken,
+                    shop,
+                    requestedTokenType: shopifyApi.RequestedTokenType.OnlineAccessToken,
+                });
+                await config.sessionStorage.storeSession(onlineSession);
+                newSession = onlineSession;
+            }
+            try {
+                await this.handleAfterAuthHook({ api, config, logger }, newSession, request, sessionToken);
+            }
+            catch (error) {
+                throw new Response(undefined, {
+                    status: 500,
+                    statusText: 'Internal Server Error',
+                });
+            }
+            return newSession;
+        }
+        return session;
+    }
+    handleClientError(request) {
+        const { api, config, logger } = this;
+        return handleClientError.handleClientErrorFactory({
+            request,
+            onError: async ({ session, error }) => {
+                if (error.response.code === 401) {
+                    config.sessionStorage.deleteSession(session.id);
+                    respondToInvalidSessionToken.respondToInvalidSessionToken({
+                        params: { config, api, logger },
+                        request,
+                    });
+                }
+            },
+        });
+    }
+    async exchangeToken({ request, shop, sessionToken, requestedTokenType, }) {
+        const { api, config, logger } = this;
+        try {
+            return await api.auth.tokenExchange({
+                sessionToken,
+                shop,
+                requestedTokenType,
+            });
+        }
+        catch (error) {
+            if (error instanceof shopifyApi.InvalidJwtError ||
+                (error instanceof shopifyApi.HttpResponseError &&
+                    error.response.code === 400 &&
+                    error.response.body?.error === 'invalid_subject_token')) {
+                throw respondToInvalidSessionToken.respondToInvalidSessionToken({
+                    params: { api, config, logger },
+                    request,
+                    retryRequest: true,
+                });
+            }
+            throw new Response(undefined, {
+                status: 500,
+                statusText: 'Internal Server Error',
+            });
+        }
+    }
+    async handleAfterAuthHook(params, session, request, sessionToken) {
+        const { config } = params;
+        await config.idempotentPromiseHandler.handlePromise({
+            promiseFunction: () => {
+                return triggerAfterAuthHook.triggerAfterAuthHook(params, session, request, this);
+            },
+            identifier: sessionToken,
+        });
+    }
+}
+
+exports.TokenExchangeStrategy = TokenExchangeStrategy;
+//# sourceMappingURL=token-exchange.js.map

package/dist/cjs/server/authenticate/admin/strategies/token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.js","sources":["../../../../../../../src/server/authenticate/admin/strategies/token-exchange.ts"],"sourcesContent":[null],"names":["InvalidJwtError","RequestedTokenType","handleClientErrorFactory","respondToInvalidSessionToken","HttpResponseError","triggerAfterAuthHook"],"mappings":";;;;;;;;;MAqBa,qBAAqB,CAAA;AAYhC,IAAA,WAAA,CAAmB,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAgC,EAAA;AACrE,QAAA,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;AACf,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;AACrB,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;KACtB;AAEM,IAAA,MAAM,sBAAsB,CAAC,QAAiB,KAAmB;AAEjE,IAAA,MAAM,YAAY,CACvB,OAAgB,EAChB,cAA8B,EAAA;QAE9B,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;QACnC,MAAM,EAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAC,GAAG,cAAc,CAAC;AAErD,QAAA,IAAI,CAAC,YAAY;YAAE,MAAM,IAAIA,0BAAe,EAAE,CAAC;QAE/C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE;AACnC,YAAA,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AACtC,YAAA,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC/C,MAAM,EAAC,OAAO,EAAE,cAAc,EAAC,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBACzD,OAAO;gBACP,YAAY;gBACZ,IAAI;gBACJ,kBAAkB,EAAEC,6BAAkB,CAAC,kBAAkB;AAC1D,aAAA,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;YAEzD,IAAI,UAAU,GAAG,cAAc,CAAC;AAEhC,YAAA,IAAI,MAAM,CAAC,eAAe,EAAE;AAC1B,gBAAA,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,MAAM,EAAC,OAAO,EAAE,aAAa,EAAC,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;oBACxD,OAAO;oBACP,YAAY;oBACZ,IAAI;oBACJ,kBAAkB,EAAEA,6BAAkB,CAAC,iBAAiB;AACzD,iBAAA,CAAC,CAAC;gBAEH,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBACxD,UAAU,GAAG,aAAa,CAAC;aAC5B;AAED,YAAA,IAAI;AACF,gBAAA,MAAM,IAAI,CAAC,mBAAmB,CAC5B,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,EACrB,UAAU,EACV,OAAO,EACP,YAAY,CACb,CAAC;aACH;YAAC,OAAO,KAAK,EAAE;AACd,gBAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,oBAAA,MAAM,EAAE,GAAG;AACX,oBAAA,UAAU,EAAE,uBAAuB;AACpC,iBAAA,CAAC,CAAC;aACJ;AAED,YAAA,OAAO,UAAU,CAAC;SACnB;AAED,QAAA,OAAO,OAAQ,CAAC;KACjB;AAEM,IAAA,iBAAiB,CAAC,OAAgB,EAAA;QACvC,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;AACnC,QAAA,OAAOC,0CAAwB,CAAC;YAC9B,OAAO;YACP,OAAO,EAAE,OAAO,EAAC,OAAO,EAAE,KAAK,EAAiB,KAAI;gBAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,EAAE;oBAC/B,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEhD,oBAAAC,yDAA4B,CAAC;AAC3B,wBAAA,MAAM,EAAE,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAC;wBAC7B,OAAO;AACR,qBAAA,CAAC,CAAC;iBACJ;aACF;AACF,SAAA,CAAC,CAAC;KACJ;IAEO,MAAM,aAAa,CAAC,EAC1B,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,kBAAkB,GAMnB,EAAA;QACC,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,IAAI,CAAC;AAEnC,QAAA,IAAI;AACF,YAAA,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;gBAClC,YAAY;gBACZ,IAAI;gBACJ,kBAAkB;AACnB,aAAA,CAAC,CAAC;SACJ;QAAC,OAAO,KAAK,EAAE;YACd,IACE,KAAK,YAAYH,0BAAe;iBAC/B,KAAK,YAAYI,4BAAiB;AACjC,oBAAA,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG;oBAC3B,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,KAAK,uBAAuB,CAAC,EACzD;AACA,gBAAA,MAAMD,yDAA4B,CAAC;AACjC,oBAAA,MAAM,EAAE,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC;oBAC7B,OAAO;AACP,oBAAA,YAAY,EAAE,IAAI;AACnB,iBAAA,CAAC,CAAC;aACJ;AAED,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,uBAAuB;AACpC,aAAA,CAAC,CAAC;SACJ;KACF;IAEO,MAAM,mBAAmB,CAC/B,MAAmB,EACnB,OAAgB,EAChB,OAAgB,EAChB,YAAoB,EAAA;AAEpB,QAAA,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,CAAC;AACxB,QAAA,MAAM,MAAM,CAAC,wBAAwB,CAAC,aAAa,CAAC;YAClD,eAAe,EAAE,MAAK;gBACpB,OAAOE,yCAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;aAC7D;AACD,YAAA,UAAU,EAAE,YAAY;AACzB,SAAA,CAAC,CAAC;KACJ;AACF;;;;"}

package/{build → dist}/cjs/server/authenticate/const.js

@@ -1,13 +1,12 @@
 'use strict';
 
-Object.defineProperty(exports, '__esModule', { value: true });
-
 const APP_BRIDGE_URL = 'https://cdn.shopify.com/shopifycloud/app-bridge.js';
 const REAUTH_URL_HEADER = 'X-Shopify-API-Request-Failure-Reauthorize-Url';
 const RETRY_INVALID_SESSION_HEADER = {
-  'X-Shopify-Retry-Invalid-Session-Request': '1'
+    'X-Shopify-Retry-Invalid-Session-Request': '1',
 };
 
 exports.APP_BRIDGE_URL = APP_BRIDGE_URL;
 exports.REAUTH_URL_HEADER = REAUTH_URL_HEADER;
 exports.RETRY_INVALID_SESSION_HEADER = RETRY_INVALID_SESSION_HEADER;
+//# sourceMappingURL=const.js.map

package/dist/cjs/server/authenticate/const.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"const.js","sources":["../../../../../src/server/authenticate/const.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAO,MAAM,cAAc,GACzB,qDAAqD;AAEhD,MAAM,iBAAiB,GAC5B,gDAAgD;AAErC,MAAA,4BAA4B,GAAG;AAC1C,IAAA,yCAAyC,EAAE,GAAG;;;;;;;"}

package/dist/cjs/server/authenticate/flow/authenticate.js

@@ -0,0 +1,53 @@
+'use strict';
+
+var factory = require('../../clients/admin/factory.js');
+
+function authenticateFlowFactory(params) {
+    const { api, config, logger } = params;
+    return async function authenticate(request) {
+        logger.info('Authenticating flow request');
+        if (request.method !== 'POST') {
+            logger.debug('Received a non-POST request for flow. Only POST requests are allowed.', { url: request.url, method: request.method });
+            throw new Response(undefined, {
+                status: 405,
+                statusText: 'Method not allowed',
+            });
+        }
+        const rawBody = await request.text();
+        const result = await api.flow.validate({
+            rawBody,
+            rawRequest: request,
+        });
+        if (!result.valid) {
+            logger.error('Received an invalid flow request', { reason: result.reason });
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        const payload = JSON.parse(rawBody);
+        logger.debug('Flow request is valid, looking for an offline session', {
+            shop: payload.shopify_domain,
+        });
+        const sessionId = api.session.getOfflineId(payload.shopify_domain);
+        const session = await config.sessionStorage.loadSession(sessionId);
+        if (!session) {
+            logger.info('Flow request could not find session', {
+                shop: payload.shopify_domain,
+            });
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        logger.debug('Found a session for the flow request', { shop: session.shop });
+        return {
+            session,
+            payload,
+            admin: factory.adminClientFactory({ params, session }),
+        };
+    };
+}
+
+exports.authenticateFlowFactory = authenticateFlowFactory;
+//# sourceMappingURL=authenticate.js.map

package/dist/cjs/server/authenticate/flow/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sources":["../../../../../../src/server/authenticate/flow/authenticate.ts"],"sourcesContent":[null],"names":["adminClientFactory"],"mappings":";;;;AAOM,SAAU,uBAAuB,CAErC,MAAmB,EAAA;IACnB,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;AAErC,IAAA,OAAO,eAAe,YAAY,CAChC,OAAgB,EAAA;AAEhB,QAAA,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;AAE3C,QAAA,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE;AAC7B,YAAA,MAAM,CAAC,KAAK,CACV,uEAAuE,EACvE,EAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAC,CAC3C,CAAC;AACF,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,oBAAoB;AACjC,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,OAAO;AACP,YAAA,UAAU,EAAE,OAAO;AACpB,SAAA,CAAC,CAAC;AAEH,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;AACjB,YAAA,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAC,CAAC,CAAC;AAE1E,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAEpC,QAAA,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;YACpE,IAAI,EAAE,OAAO,CAAC,cAAc;AAC7B,SAAA,CAAC,CAAC;AAEH,QAAA,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC,OAAO,EAAE;AACZ,YAAA,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBACjD,IAAI,EAAE,OAAO,CAAC,cAAc;AAC7B,aAAA,CAAC,CAAC;AACH,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAC,CAAC,CAAC;QAE3E,OAAO;YACL,OAAO;YACP,OAAO;YACP,KAAK,EAAEA,0BAAkB,CAAY,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;SACxD,CAAC;AACJ,KAAC,CAAC;AACJ;;;;"}

package/dist/cjs/server/authenticate/fulfillment-service/authenticate.js

@@ -0,0 +1,59 @@
+'use strict';
+
+var shopifyApi = require('@shopify/shopify-api');
+var factory = require('../../clients/admin/factory.js');
+
+function authenticateFulfillmentServiceFactory(params) {
+    const { api, config, logger } = params;
+    return async function authenticate(request) {
+        logger.info('Authenticating fulfillment service request');
+        if (request.method !== 'POST') {
+            logger.debug('Received a non-POST request for fulfillment service. Only POST requests are allowed.', { url: request.url, method: request.method });
+            throw new Response(undefined, {
+                status: 405,
+                statusText: 'Method not allowed',
+            });
+        }
+        const rawBody = await request.text();
+        const result = await api.fulfillmentService.validate({
+            rawBody,
+            rawRequest: request,
+        });
+        if (!result.valid) {
+            logger.error('Received an invalid fulfillment service request', {
+                reason: result.reason,
+            });
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        const payload = JSON.parse(rawBody);
+        const shop = request.headers.get(shopifyApi.ShopifyHeader.Domain) || '';
+        logger.debug('Fulfillment service request is valid, looking for an offline session', {
+            shop,
+        });
+        const sessionId = api.session.getOfflineId(shop);
+        const session = await config.sessionStorage.loadSession(sessionId);
+        if (!session) {
+            logger.info('Fulfillment service request could not find session', {
+                shop,
+            });
+            throw new Response(undefined, {
+                status: 400,
+                statusText: 'Bad Request',
+            });
+        }
+        logger.debug('Found a session for the fulfillment service request', {
+            shop,
+        });
+        return {
+            session,
+            payload,
+            admin: factory.adminClientFactory({ params, session }),
+        };
+    };
+}
+
+exports.authenticateFulfillmentServiceFactory = authenticateFulfillmentServiceFactory;
+//# sourceMappingURL=authenticate.js.map

package/dist/cjs/server/authenticate/fulfillment-service/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sources":["../../../../../../src/server/authenticate/fulfillment-service/authenticate.ts"],"sourcesContent":[null],"names":["ShopifyHeader","adminClientFactory"],"mappings":";;;;;AAUM,SAAU,qCAAqC,CAEnD,MAAmB,EAAA;IACnB,MAAM,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;AAErC,IAAA,OAAO,eAAe,YAAY,CAChC,OAAgB,EAAA;AAEhB,QAAA,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;AAE1D,QAAA,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE;AAC7B,YAAA,MAAM,CAAC,KAAK,CACV,sFAAsF,EACtF,EAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAC,CAC3C,CAAC;AACF,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,oBAAoB;AACjC,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YACnD,OAAO;AACP,YAAA,UAAU,EAAE,OAAO;AACpB,SAAA,CAAC,CAAC;AAEH,QAAA,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;AACjB,YAAA,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;gBAC9D,MAAM,EAAE,MAAM,CAAC,MAAM;AACtB,aAAA,CAAC,CAAC;AAEH,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpC,QAAA,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAACA,wBAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAE7D,QAAA,MAAM,CAAC,KAAK,CACV,sEAAsE,EACtE;YACE,IAAI;AACL,SAAA,CACF,CAAC;QAEF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC,OAAO,EAAE;AACZ,YAAA,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBAChE,IAAI;AACL,aAAA,CAAC,CAAC;AACH,YAAA,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE;AAC5B,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,UAAU,EAAE,aAAa;AAC1B,aAAA,CAAC,CAAC;SACJ;AAED,QAAA,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE;YAClE,IAAI;AACL,SAAA,CAAC,CAAC;QAEH,OAAO;YACL,OAAO;YACP,OAAO;YACP,KAAK,EAAEC,0BAAkB,CAAY,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;SACxD,CAAC;AACJ,KAAC,CAAC;AACJ;;;;"}

package/dist/cjs/server/authenticate/helpers/add-response-headers.js

@@ -0,0 +1,27 @@
+'use strict';
+
+function addDocumentResponseHeadersFactory(params) {
+    const { api, config } = params;
+    return function (request, headers) {
+        const { searchParams } = new URL(request.url);
+        const shop = api.utils.sanitizeShop(searchParams.get('shop'));
+        addDocumentResponseHeaders(headers, config.isEmbeddedApp, shop);
+    };
+}
+function addDocumentResponseHeaders(headers, isEmbeddedApp, shop) {
+    if (shop) {
+        headers.set('Link', '<https://cdn.shopify.com/shopifycloud/app-bridge.js>; rel="preload"; as="script";');
+    }
+    if (isEmbeddedApp) {
+        if (shop) {
+            headers.set('Content-Security-Policy', `frame-ancestors https://${shop} https://admin.shopify.com https://*.spin.dev;`);
+        }
+    }
+    else {
+        headers.set('Content-Security-Policy', `frame-ancestors 'none';`);
+    }
+}
+
+exports.addDocumentResponseHeaders = addDocumentResponseHeaders;
+exports.addDocumentResponseHeadersFactory = addDocumentResponseHeadersFactory;
+//# sourceMappingURL=add-response-headers.js.map

package/dist/cjs/server/authenticate/helpers/add-response-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-response-headers.js","sources":["../../../../../../src/server/authenticate/helpers/add-response-headers.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAOM,SAAU,iCAAiC,CAC/C,MAAmB,EAAA;AAEnB,IAAA,MAAM,EAAC,GAAG,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;IAE7B,OAAO,UAAU,OAAgB,EAAE,OAAgB,EAAA;QACjD,MAAM,EAAC,YAAY,EAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC5C,QAAA,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC;QAE/D,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAClE,KAAC,CAAC;AACJ,CAAC;SAEe,0BAA0B,CACxC,OAAgB,EAChB,aAAsB,EACtB,IAA+B,EAAA;IAE/B,IAAI,IAAI,EAAE;AACR,QAAA,OAAO,CAAC,GAAG,CACT,MAAM,EACN,mFAAmF,CACpF,CAAC;KACH;IAED,IAAI,aAAa,EAAE;QACjB,IAAI,IAAI,EAAE;YACR,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,CAA2B,wBAAA,EAAA,IAAI,CAAgD,8CAAA,CAAA,CAChF,CAAC;SACH;KACF;SAAM;AACL,QAAA,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAA,uBAAA,CAAyB,CAAC,CAAC;KACnE;AACH;;;;;"}

package/{build → dist}/cjs/server/authenticate/helpers/app-bridge-url.js

@@ -1,16 +1,15 @@
 'use strict';
 
-Object.defineProperty(exports, '__esModule', { value: true });
-
 var _const = require('../const.js');
 
 let appBridgeUrlOverride;
 function setAppBridgeUrlOverride(url) {
-  appBridgeUrlOverride = url;
+    appBridgeUrlOverride = url;
 }
 function appBridgeUrl() {
-  return appBridgeUrlOverride || _const.APP_BRIDGE_URL;
+    return appBridgeUrlOverride || _const.APP_BRIDGE_URL;
 }
 
 exports.appBridgeUrl = appBridgeUrl;
 exports.setAppBridgeUrlOverride = setAppBridgeUrlOverride;
+//# sourceMappingURL=app-bridge-url.js.map

package/dist/cjs/server/authenticate/helpers/app-bridge-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-bridge-url.js","sources":["../../../../../../src/server/authenticate/helpers/app-bridge-url.ts"],"sourcesContent":[null],"names":["APP_BRIDGE_URL"],"mappings":";;;;AAEA,IAAI,oBAAwC,CAAC;AACvC,SAAU,uBAAuB,CAAC,GAAW,EAAA;IACjD,oBAAoB,GAAG,GAAG,CAAC;AAC7B,CAAC;SAEe,YAAY,GAAA;IAC1B,OAAO,oBAAoB,IAAIA,qBAAc,CAAC;AAChD;;;;;"}

package/dist/cjs/server/authenticate/helpers/ensure-cors-headers.js

@@ -0,0 +1,25 @@
+'use strict';
+
+var _const = require('../const.js');
+
+function ensureCORSHeadersFactory(params, request, corsHeaders = []) {
+    const { logger, config } = params;
+    return function ensureCORSHeaders(response) {
+        const origin = request.headers.get('Origin');
+        if (origin && origin !== config.appUrl) {
+            logger.debug('Request comes from a different origin, adding CORS headers');
+            const corsHeadersSet = new Set([
+                'Authorization',
+                'Content-Type',
+                ...corsHeaders,
+            ]);
+            response.headers.set('Access-Control-Allow-Origin', '*');
+            response.headers.set('Access-Control-Allow-Headers', [...corsHeadersSet].join(', '));
+            response.headers.set('Access-Control-Expose-Headers', _const.REAUTH_URL_HEADER);
+        }
+        return response;
+    };
+}
+
+exports.ensureCORSHeadersFactory = ensureCORSHeadersFactory;
+//# sourceMappingURL=ensure-cors-headers.js.map

package/dist/cjs/server/authenticate/helpers/ensure-cors-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-cors-headers.js","sources":["../../../../../../src/server/authenticate/helpers/ensure-cors-headers.ts"],"sourcesContent":[null],"names":["REAUTH_URL_HEADER"],"mappings":";;;;AAOM,SAAU,wBAAwB,CACtC,MAAmB,EACnB,OAAgB,EAChB,cAAwB,EAAE,EAAA;AAE1B,IAAA,MAAM,EAAC,MAAM,EAAE,MAAM,EAAC,GAAG,MAAM,CAAC;IAEhC,OAAO,SAAS,iBAAiB,CAAC,QAAQ,EAAA;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;AACtC,YAAA,MAAM,CAAC,KAAK,CACV,4DAA4D,CAC7D,CAAC;AAEF,YAAA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;gBAC7B,eAAe;gBACf,cAAc;AACd,gBAAA,GAAG,WAAW;AACf,aAAA,CAAC,CAAC;YAEH,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AACzD,YAAA,QAAQ,CAAC,OAAO,CAAC,GAAG,CAClB,8BAA8B,EAC9B,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/B,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAEA,wBAAiB,CAAC,CAAC;SAC1E;AAED,QAAA,OAAO,QAAQ,CAAC;AAClB,KAAC,CAAC;AACJ;;;;"}

package/dist/cjs/server/authenticate/helpers/get-session-token-header.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const SESSION_TOKEN_PARAM = 'id_token';
+function getSessionTokenHeader(request) {
+    return request.headers.get('authorization')?.replace('Bearer ', '');
+}
+function getSessionTokenFromUrlParam(request) {
+    const url = new URL(request.url);
+    return url.searchParams.get(SESSION_TOKEN_PARAM);
+}
+
+exports.getSessionTokenFromUrlParam = getSessionTokenFromUrlParam;
+exports.getSessionTokenHeader = getSessionTokenHeader;
+//# sourceMappingURL=get-session-token-header.js.map

package/dist/cjs/server/authenticate/helpers/get-session-token-header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-session-token-header.js","sources":["../../../../../../src/server/authenticate/helpers/get-session-token-header.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAEjC,SAAU,qBAAqB,CAAC,OAAgB,EAAA;AACpD,IAAA,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAEK,SAAU,2BAA2B,CAAC,OAAgB,EAAA;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACnD;;;;;"}

package/dist/cjs/server/authenticate/helpers/idempotent-promise-handler.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const IDENTIFIER_TTL_MS = 60000;
+class IdempotentPromiseHandler {
+    constructor() {
+        this.identifiers = new Map();
+    }
+    async handlePromise({ promiseFunction, identifier, }) {
+        try {
+            if (this.isPromiseRunnable(identifier)) {
+                await promiseFunction();
+            }
+        }
+        finally {
+            this.clearStaleIdentifiers();
+        }
+        return Promise.resolve();
+    }
+    isPromiseRunnable(identifier) {
+        if (!this.identifiers.has(identifier)) {
+            this.identifiers.set(identifier, Date.now());
+            return true;
+        }
+        return false;
+    }
+    async clearStaleIdentifiers() {
+        this.identifiers.forEach((date, identifier, map) => {
+            if (Date.now() - date > IDENTIFIER_TTL_MS) {
+                map.delete(identifier);
+            }
+        });
+    }
+}
+
+exports.IdempotentPromiseHandler = IdempotentPromiseHandler;
+//# sourceMappingURL=idempotent-promise-handler.js.map