@shopify/shopify-app-remix 2.8.0 → 2.8.2

package/build/cjs/server/authenticate/admin/helpers/redirect-to-auth-page.js

@@ -1,27 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var beginAuth = require('./begin-auth.js');
-var redirectWithExitiframe = require('./redirect-with-exitiframe.js');
-var redirectWithAppBridgeHeaders = require('./redirect-with-app-bridge-headers.js');
-
-async function redirectToAuthPage(params, request, shop, isOnline = false) {
-  const {
-    config
-  } = params;
-  const url = new URL(request.url);
-  const isEmbeddedRequest = url.searchParams.get('embedded') === '1';
-  const isXhrRequest = request.headers.get('authorization');
-  if (isXhrRequest) {
-    const redirectUri = new URL(config.auth.path, config.appUrl);
-    redirectUri.searchParams.set('shop', shop);
-    redirectWithAppBridgeHeaders.redirectWithAppBridgeHeaders(redirectUri.toString());
-  } else if (isEmbeddedRequest) {
-    redirectWithExitiframe.redirectWithExitIframe(params, request, shop);
-  } else {
-    throw await beginAuth.beginAuth(params, request, isOnline, shop);
-  }
-}
-
-exports.redirectToAuthPage = redirectToAuthPage;

package/build/cjs/server/authenticate/admin/helpers/redirect-to-bounce-page.js

@@ -1,24 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var serverRuntime = require('@remix-run/server-runtime');
-
-const redirectToBouncePage = (params, url) => {
-  const {
-    config
-  } = params;
-
-  // Make sure we always point to the configured app URL so it also works behind reverse proxies (that alter the Host
-  // header).
-  const searchParams = url.searchParams;
-  searchParams.delete('id_token');
-  searchParams.set('shopify-reload', `${config.appUrl}${url.pathname}?${searchParams.toString()}`);
-
-  // eslint-disable-next-line no-warning-comments
-  // TODO Make sure this works on chrome without a tunnel (weird HTTPS redirect issue)
-  // https://github.com/orgs/Shopify/projects/6899/views/1?pane=issue&itemId=28376650
-  throw serverRuntime.redirect(`${config.auth.patchSessionTokenPath}?${searchParams.toString()}`);
-};
-
-exports.redirectToBouncePage = redirectToBouncePage;

package/build/cjs/server/authenticate/admin/helpers/redirect-to-shopify-or-app-root.js

@@ -1,22 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var serverRuntime = require('@remix-run/server-runtime');
-
-async function redirectToShopifyOrAppRoot(request, params, responseHeaders) {
-  const {
-    api
-  } = params;
-  const url = new URL(request.url);
-  const host = api.utils.sanitizeHost(url.searchParams.get('host'));
-  const shop = api.utils.sanitizeShop(url.searchParams.get('shop'));
-  const redirectUrl = api.config.isEmbeddedApp ? await api.auth.getEmbeddedAppUrl({
-    rawRequest: request
-  }) : `/?shop=${shop}&host=${encodeURIComponent(host)}`;
-  throw serverRuntime.redirect(redirectUrl, {
-    headers: responseHeaders
-  });
-}
-
-exports.redirectToShopifyOrAppRoot = redirectToShopifyOrAppRoot;

package/build/cjs/server/authenticate/admin/helpers/redirect-with-app-bridge-headers.js

@@ -1,21 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var _const = require('../../const.js');
-
-function redirectWithAppBridgeHeaders(redirectUri) {
-  throw new Response(undefined, {
-    status: 401,
-    statusText: 'Unauthorized',
-    headers: getAppBridgeHeaders(redirectUri)
-  });
-}
-function getAppBridgeHeaders(url) {
-  return new Headers({
-    [_const.REAUTH_URL_HEADER]: url
-  });
-}
-
-exports.getAppBridgeHeaders = getAppBridgeHeaders;
-exports.redirectWithAppBridgeHeaders = redirectWithAppBridgeHeaders;

package/build/cjs/server/authenticate/admin/helpers/redirect-with-exitiframe.js

@@ -1,25 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var serverRuntime = require('@remix-run/server-runtime');
-
-function redirectWithExitIframe(params, request, shop) {
-  const {
-    api,
-    config
-  } = params;
-  const url = new URL(request.url);
-  const queryParams = url.searchParams;
-  const host = api.utils.sanitizeHost(queryParams.get('host'));
-  queryParams.set('shop', shop);
-  let destination = `${config.auth.path}?shop=${shop}`;
-  if (host) {
-    queryParams.set('host', host);
-    destination = `${destination}&host=${host}`;
-  }
-  queryParams.set('exitIframe', destination);
-  throw serverRuntime.redirect(`${config.auth.exitIframePath}?${queryParams.toString()}`);
-}
-
-exports.redirectWithExitIframe = redirectWithExitIframe;

package/build/cjs/server/authenticate/admin/helpers/redirect.js

@@ -1,63 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var serverRuntime = require('@remix-run/server-runtime');
-var getSessionTokenHeader = require('../../helpers/get-session-token-header.js');
-var renderAppBridge = require('./render-app-bridge.js');
-var redirectWithAppBridgeHeaders = require('./redirect-with-app-bridge-headers.js');
-
-function redirectFactory(params, request) {
-  const {
-    config
-  } = params;
-  return function redirect(url, init) {
-    const {
-      searchParams
-    } = new URL(request.url);
-    const parsedUrl = new URL(url, config.appUrl);
-    const isSameOrigin = parsedUrl.origin === config.appUrl;
-    if (isSameOrigin || url.startsWith('/')) {
-      searchParams.forEach((value, key) => {
-        if (!parsedUrl.searchParams.has(key)) {
-          parsedUrl.searchParams.set(key, value);
-        }
-      });
-    }
-    const target = typeof init !== 'number' && (init === null || init === void 0 ? void 0 : init.target) || '_self';
-    if (target === '_self') {
-      if (isBounceRequest(request)) {
-        throw renderAppBridge.renderAppBridge(params, request, {
-          url: parsedUrl.toString(),
-          target
-        });
-      } else {
-        return serverRuntime.redirect(parsedUrl.toString(), init);
-      }
-    } else if (isDataRequest(request)) {
-      throw redirectWithAppBridgeHeaders.redirectWithAppBridgeHeaders(parsedUrl.toString());
-    } else if (isEmbeddedRequest(request)) {
-      throw renderAppBridge.renderAppBridge(params, request, {
-        url: parsedUrl.toString(),
-        target
-      });
-    }
-    return serverRuntime.redirect(url, init);
-  };
-}
-function isBounceRequest(request) {
-  return Boolean(getSessionTokenHeader.getSessionTokenHeader(request)) && request.headers.has('X-Shopify-Bounce');
-}
-function isDataRequest(request) {
-  const isGet = request.method === 'GET';
-  const sessionTokenHeader = Boolean(getSessionTokenHeader.getSessionTokenHeader(request));
-  return sessionTokenHeader && !isBounceRequest(request) && (!isEmbeddedRequest(request) || !isGet);
-}
-function isEmbeddedRequest(request) {
-  const {
-    searchParams
-  } = new URL(request.url);
-  return searchParams.get('embedded') === '1';
-}
-
-exports.redirectFactory = redirectFactory;

package/build/cjs/server/authenticate/admin/helpers/render-app-bridge.js

@@ -1,31 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var appBridgeUrl = require('../../helpers/app-bridge-url.js');
-var addResponseHeaders = require('../../helpers/add-response-headers.js');
-var validateRedirectUrl = require('./validate-redirect-url.js');
-
-function renderAppBridge({
-  config
-}, request, redirectTo) {
-  let redirectToScript = '';
-  if (redirectTo) {
-    var _redirectTo$target;
-    const destination = validateRedirectUrl.sanitizeRedirectUrl(config.appUrl, redirectTo.url);
-    const target = (_redirectTo$target = redirectTo.target) !== null && _redirectTo$target !== void 0 ? _redirectTo$target : '_top';
-    redirectToScript = `<script>window.open(${JSON.stringify(destination.toString())}, ${JSON.stringify(target)})</script>`;
-  }
-  const responseHeaders = new Headers({
-    'content-type': 'text/html;charset=utf-8'
-  });
-  addResponseHeaders.addDocumentResponseHeaders(responseHeaders, config.isEmbeddedApp, new URL(request.url).searchParams.get('shop'));
-  throw new Response(`
-      <script data-api-key="${config.apiKey}" src="${appBridgeUrl.appBridgeUrl()}"></script>
-      ${redirectToScript}
-    `, {
-    headers: responseHeaders
-  });
-}
-
-exports.renderAppBridge = renderAppBridge;

package/build/cjs/server/authenticate/admin/helpers/trigger-after-auth-hook.js

@@ -1,21 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var createAdminApiContext = require('./create-admin-api-context.js');
-
-async function triggerAfterAuthHook(params, session, request, authStrategy) {
-  const {
-    config,
-    logger
-  } = params;
-  if (config.hooks.afterAuth) {
-    logger.info('Running afterAuth hook');
-    await config.hooks.afterAuth({
-      session,
-      admin: createAdminApiContext.createAdminApiContext(session, params, authStrategy.handleClientError(request))
-    });
-  }
-}
-
-exports.triggerAfterAuthHook = triggerAfterAuthHook;

package/build/cjs/server/authenticate/admin/helpers/validate-redirect-url.js

@@ -1,45 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var shopifyApi = require('@shopify/shopify-api');
-
-const FILE_URI_MATCH = /\/\/\//;
-const INVALID_RELATIVE_URL = /[/\\][/\\]/;
-const WHITESPACE_CHARACTER = /\s/;
-const VALID_PROTOCOLS = ['https:', 'http:'];
-function isSafe(domain, redirectUrl, requireSSL = true) {
-  if (typeof redirectUrl !== 'string') {
-    return false;
-  }
-  if (FILE_URI_MATCH.test(redirectUrl) || WHITESPACE_CHARACTER.test(redirectUrl)) {
-    return false;
-  }
-  let url;
-  try {
-    url = new URL(redirectUrl, domain);
-  } catch (error) {
-    return false;
-  }
-  if (INVALID_RELATIVE_URL.test(url.pathname)) {
-    return false;
-  }
-  if (!VALID_PROTOCOLS.includes(url.protocol)) {
-    return false;
-  }
-  if (requireSSL && url.protocol !== 'https:') {
-    return false;
-  }
-  return true;
-}
-function sanitizeRedirectUrl(domain, redirectUrl, options = {}) {
-  if (isSafe(domain, redirectUrl, options.requireSSL)) {
-    return new URL(redirectUrl, domain);
-  } else if (options.throwOnInvalid === false) {
-    return undefined;
-  } else {
-    throw new shopifyApi.ShopifyError('Invalid URL. Refusing to redirect');
-  }
-}
-
-exports.sanitizeRedirectUrl = sanitizeRedirectUrl;

package/build/cjs/server/authenticate/admin/helpers/validate-shop-and-host-params.js

@@ -1,32 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var serverRuntime = require('@remix-run/server-runtime');
-
-function validateShopAndHostParams(params, request) {
-  const {
-    api,
-    config,
-    logger
-  } = params;
-  if (config.isEmbeddedApp) {
-    const url = new URL(request.url);
-    const shop = api.utils.sanitizeShop(url.searchParams.get('shop'));
-    if (!shop) {
-      logger.debug('Missing or invalid shop, redirecting to login path', {
-        shop
-      });
-      throw serverRuntime.redirect(config.auth.loginPath);
-    }
-    const host = api.utils.sanitizeHost(url.searchParams.get('host'));
-    if (!host) {
-      logger.debug('Invalid host, redirecting to login path', {
-        host: url.searchParams.get('host')
-      });
-      throw serverRuntime.redirect(config.auth.loginPath);
-    }
-  }
-}
-
-exports.validateShopAndHostParams = validateShopAndHostParams;

package/build/cjs/server/authenticate/admin/strategies/auth-code-flow.js

@@ -1,334 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var shopifyApi = require('@shopify/shopify-api');
-var beginAuth = require('../helpers/begin-auth.js');
-var redirectToShopifyOrAppRoot = require('../helpers/redirect-to-shopify-or-app-root.js');
-require('@remix-run/server-runtime');
-var handleClientError = require('../helpers/handle-client-error.js');
-var redirectToAuthPage = require('../helpers/redirect-to-auth-page.js');
-var redirectWithExitiframe = require('../helpers/redirect-with-exitiframe.js');
-var getSessionTokenHeader = require('../../helpers/get-session-token-header.js');
-var triggerAfterAuthHook = require('../helpers/trigger-after-auth-hook.js');
-var validateShopAndHostParams = require('../helpers/validate-shop-and-host-params.js');
-require('isbot');
-
-class AuthCodeFlowStrategy {
-  constructor({
-    api,
-    config,
-    logger
-  }) {
-    this.api = void 0;
-    this.config = void 0;
-    this.logger = void 0;
-    this.api = api;
-    this.config = config;
-    this.logger = logger;
-  }
-  async respondToOAuthRequests(request) {
-    const {
-      api,
-      config
-    } = this;
-    const url = new URL(request.url);
-    const isAuthRequest = url.pathname === config.auth.path;
-    const isAuthCallbackRequest = url.pathname === config.auth.callbackPath;
-    if (isAuthRequest || isAuthCallbackRequest) {
-      const shop = api.utils.sanitizeShop(url.searchParams.get('shop'));
-      if (!shop) throw new Response('Shop param is invalid', {
-        status: 400
-      });
-      if (isAuthRequest) {
-        throw await this.handleAuthBeginRequest(request, shop);
-      } else {
-        throw await this.handleAuthCallbackRequest(request, shop);
-      }
-    }
-    if (!getSessionTokenHeader.getSessionTokenHeader(request)) {
-      // This is a document request that doesn't contain a session token. We check if the app is installed.
-      // If the app isn't installed, we initiate the OAuth auth code flow.
-      // Requests with a header can only happen after the app is installed.
-      await this.ensureInstalledOnShop(request);
-    }
-  }
-  async authenticate(request, sessionContext) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    const {
-      shop,
-      session
-    } = sessionContext;
-    if (!session) {
-      logger.debug('No session found, redirecting to OAuth', {
-        shop
-      });
-      await redirectToAuthPage.redirectToAuthPage({
-        config,
-        logger,
-        api
-      }, request, shop);
-    } else if (!session.isActive(config.scopes)) {
-      logger.debug('Found a session, but it has expired, redirecting to OAuth', {
-        shop
-      });
-      await redirectToAuthPage.redirectToAuthPage({
-        config,
-        logger,
-        api
-      }, request, shop);
-    }
-    logger.debug('Found a valid session', {
-      shop
-    });
-    return session;
-  }
-  handleClientError(request) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    return handleClientError.handleClientErrorFactory({
-      request,
-      onError: async ({
-        session,
-        error
-      }) => {
-        if (error.response.code === 401) {
-          throw await redirectToAuthPage.redirectToAuthPage({
-            api,
-            config,
-            logger
-          }, request, session.shop);
-        }
-      }
-    });
-  }
-  async ensureInstalledOnShop(request) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    validateShopAndHostParams.validateShopAndHostParams({
-      api,
-      config,
-      logger
-    }, request);
-    const url = new URL(request.url);
-    let shop = url.searchParams.get('shop');
-
-    // Ensure app is installed
-    logger.debug('Ensuring app is installed on shop', {
-      shop
-    });
-    if (!(await this.hasValidOfflineId(request))) {
-      logger.info("Could not find a shop, can't authenticate request");
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    const offlineSession = await this.getOfflineSession(request);
-    const isEmbedded = url.searchParams.get('embedded') === '1';
-    if (!offlineSession) {
-      logger.info("Shop hasn't installed app yet, redirecting to OAuth", {
-        shop
-      });
-      if (isEmbedded) {
-        redirectWithExitiframe.redirectWithExitIframe({
-          api,
-          config,
-          logger
-        }, request, shop);
-      } else {
-        throw await beginAuth.beginAuth({
-          api,
-          config,
-          logger
-        }, request, false, shop);
-      }
-    }
-    shop = shop || offlineSession.shop;
-    if (config.isEmbeddedApp && !isEmbedded) {
-      try {
-        logger.debug('Ensuring offline session is valid before embedding', {
-          shop
-        });
-        await this.testSession(offlineSession);
-        logger.debug('Offline session is still valid, embedding app', {
-          shop
-        });
-      } catch (error) {
-        await this.handleInvalidOfflineSession(error, request, shop);
-      }
-    }
-  }
-  async handleAuthBeginRequest(request, shop) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    logger.info('Handling OAuth begin request', {
-      shop
-    });
-
-    // If we're loading from an iframe, we need to break out of it
-    if (config.isEmbeddedApp && request.headers.get('Sec-Fetch-Dest') === 'iframe') {
-      logger.debug('Auth request in iframe detected, exiting iframe', {
-        shop
-      });
-      throw redirectWithExitiframe.redirectWithExitIframe({
-        api,
-        config,
-        logger
-      }, request, shop);
-    } else {
-      throw await beginAuth.beginAuth({
-        api,
-        config,
-        logger
-      }, request, false, shop);
-    }
-  }
-  async handleAuthCallbackRequest(request, shop) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    logger.info('Handling OAuth callback request');
-    try {
-      const {
-        session,
-        headers: responseHeaders
-      } = await api.auth.callback({
-        rawRequest: request
-      });
-      await config.sessionStorage.storeSession(session);
-      if (config.useOnlineTokens && !session.isOnline) {
-        logger.info('Requesting online access token for offline session');
-        await beginAuth.beginAuth({
-          api,
-          config,
-          logger
-        }, request, true, shop);
-      }
-      await triggerAfterAuthHook.triggerAfterAuthHook({
-        api,
-        config,
-        logger
-      }, session, request, this);
-      throw await redirectToShopifyOrAppRoot.redirectToShopifyOrAppRoot(request, {
-        api,
-        config,
-        logger
-      }, responseHeaders);
-    } catch (error) {
-      if (error instanceof Response) throw error;
-      throw await this.oauthCallbackError(error, request, shop);
-    }
-  }
-  async getOfflineSession(request) {
-    const offlineId = await this.getOfflineSessionId(request);
-    return this.config.sessionStorage.loadSession(offlineId);
-  }
-  async hasValidOfflineId(request) {
-    return Boolean(await this.getOfflineSessionId(request));
-  }
-  async getOfflineSessionId(request) {
-    const {
-      api
-    } = this;
-    const url = new URL(request.url);
-    const shop = url.searchParams.get('shop');
-    return shop ? api.session.getOfflineId(shop) : api.session.getCurrentId({
-      isOnline: false,
-      rawRequest: request
-    });
-  }
-  async testSession(session) {
-    const {
-      api
-    } = this;
-    const client = new api.clients.Graphql({
-      session
-    });
-    await client.request(`#graphql
-      query shopifyAppShopName {
-        shop {
-          name
-        }
-      }
-    `);
-  }
-  async oauthCallbackError(error, request, shop) {
-    const {
-      logger
-    } = this;
-    logger.error('Error during OAuth callback', {
-      error: error.message
-    });
-    if (error instanceof shopifyApi.CookieNotFound) {
-      return this.handleAuthBeginRequest(request, shop);
-    }
-    if (error instanceof shopifyApi.InvalidHmacError || error instanceof shopifyApi.InvalidOAuthError) {
-      return new Response(undefined, {
-        status: 400,
-        statusText: 'Invalid OAuth Request'
-      });
-    }
-    return new Response(undefined, {
-      status: 500,
-      statusText: 'Internal Server Error'
-    });
-  }
-  async handleInvalidOfflineSession(error, request, shop) {
-    const {
-      api,
-      logger,
-      config
-    } = this;
-    if (error instanceof shopifyApi.HttpResponseError) {
-      if (error.response.code === 401) {
-        logger.info('Shop session is no longer valid, redirecting to OAuth', {
-          shop
-        });
-        throw await beginAuth.beginAuth({
-          api,
-          config,
-          logger
-        }, request, false, shop);
-      } else {
-        const message = JSON.stringify(error.response.body, null, 2);
-        logger.error(`Unexpected error during session validation: ${message}`, {
-          shop
-        });
-        throw new Response(undefined, {
-          status: error.response.code,
-          statusText: error.response.statusText
-        });
-      }
-    } else if (error instanceof shopifyApi.GraphqlQueryError) {
-      const context = {
-        shop
-      };
-      if (error.response) {
-        context.response = JSON.stringify(error.body);
-      }
-      logger.error(`Unexpected error during session validation: ${error.message}`, context);
-      throw new Response(undefined, {
-        status: 500,
-        statusText: 'Internal Server Error'
-      });
-    }
-  }
-}
-
-exports.AuthCodeFlowStrategy = AuthCodeFlowStrategy;