@shopify/shopify-app-remix 2.8.0 → 2.8.2

package/build/cjs/server/authenticate/admin/strategies/token-exchange.js

@@ -1,155 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var shopifyApi = require('@shopify/shopify-api');
-var respondToInvalidSessionToken = require('../../helpers/respond-to-invalid-session-token.js');
-require('isbot');
-require('@remix-run/server-runtime');
-var handleClientError = require('../helpers/handle-client-error.js');
-var triggerAfterAuthHook = require('../helpers/trigger-after-auth-hook.js');
-
-class TokenExchangeStrategy {
-  constructor({
-    api,
-    config,
-    logger
-  }) {
-    this.api = void 0;
-    this.config = void 0;
-    this.logger = void 0;
-    this.api = api;
-    this.config = config;
-    this.logger = logger;
-  }
-  async respondToOAuthRequests(_request) {}
-  async authenticate(request, sessionContext) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    const {
-      shop,
-      session,
-      sessionToken
-    } = sessionContext;
-    if (!sessionToken) throw new shopifyApi.InvalidJwtError();
-    if (!session || session.isExpired()) {
-      logger.info('No valid session found');
-      logger.info('Requesting offline access token');
-      const {
-        session: offlineSession
-      } = await this.exchangeToken({
-        request,
-        sessionToken,
-        shop,
-        requestedTokenType: shopifyApi.RequestedTokenType.OfflineAccessToken
-      });
-      await config.sessionStorage.storeSession(offlineSession);
-      let newSession = offlineSession;
-      if (config.useOnlineTokens) {
-        logger.info('Requesting online access token');
-        const {
-          session: onlineSession
-        } = await this.exchangeToken({
-          request,
-          sessionToken,
-          shop,
-          requestedTokenType: shopifyApi.RequestedTokenType.OnlineAccessToken
-        });
-        await config.sessionStorage.storeSession(onlineSession);
-        newSession = onlineSession;
-      }
-      try {
-        await this.handleAfterAuthHook({
-          api,
-          config,
-          logger
-        }, newSession, request, sessionToken);
-      } catch (error) {
-        throw new Response(undefined, {
-          status: 500,
-          statusText: 'Internal Server Error'
-        });
-      }
-      return newSession;
-    }
-    return session;
-  }
-  handleClientError(request) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    return handleClientError.handleClientErrorFactory({
-      request,
-      onError: async ({
-        session,
-        error
-      }) => {
-        if (error.response.code === 401) {
-          config.sessionStorage.deleteSession(session.id);
-          respondToInvalidSessionToken.respondToInvalidSessionToken({
-            params: {
-              config,
-              api,
-              logger
-            },
-            request
-          });
-        }
-      }
-    });
-  }
-  async exchangeToken({
-    request,
-    shop,
-    sessionToken,
-    requestedTokenType
-  }) {
-    const {
-      api,
-      config,
-      logger
-    } = this;
-    try {
-      return await api.auth.tokenExchange({
-        sessionToken,
-        shop,
-        requestedTokenType
-      });
-    } catch (error) {
-      var _error$response$body;
-      if (error instanceof shopifyApi.InvalidJwtError || error instanceof shopifyApi.HttpResponseError && error.response.code === 400 && ((_error$response$body = error.response.body) === null || _error$response$body === void 0 ? void 0 : _error$response$body.error) === 'invalid_subject_token') {
-        throw respondToInvalidSessionToken.respondToInvalidSessionToken({
-          params: {
-            api,
-            config,
-            logger
-          },
-          request,
-          retryRequest: true
-        });
-      }
-      throw new Response(undefined, {
-        status: 500,
-        statusText: 'Internal Server Error'
-      });
-    }
-  }
-  async handleAfterAuthHook(params, session, request, sessionToken) {
-    const {
-      config
-    } = params;
-    await config.idempotentPromiseHandler.handlePromise({
-      promiseFunction: () => {
-        return triggerAfterAuthHook.triggerAfterAuthHook(params, session, request, this);
-      },
-      identifier: sessionToken
-    });
-  }
-}
-
-exports.TokenExchangeStrategy = TokenExchangeStrategy;

package/build/cjs/server/authenticate/flow/authenticate.js

@@ -1,68 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var factory = require('../../clients/admin/factory.js');
-
-function authenticateFlowFactory(params) {
-  const {
-    api,
-    config,
-    logger
-  } = params;
-  return async function authenticate(request) {
-    logger.info('Authenticating flow request');
-    if (request.method !== 'POST') {
-      logger.debug('Received a non-POST request for flow. Only POST requests are allowed.', {
-        url: request.url,
-        method: request.method
-      });
-      throw new Response(undefined, {
-        status: 405,
-        statusText: 'Method not allowed'
-      });
-    }
-    const rawBody = await request.text();
-    const result = await api.flow.validate({
-      rawBody,
-      rawRequest: request
-    });
-    if (!result.valid) {
-      logger.error('Received an invalid flow request', {
-        reason: result.reason
-      });
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    const payload = JSON.parse(rawBody);
-    logger.debug('Flow request is valid, looking for an offline session', {
-      shop: payload.shopify_domain
-    });
-    const sessionId = api.session.getOfflineId(payload.shopify_domain);
-    const session = await config.sessionStorage.loadSession(sessionId);
-    if (!session) {
-      logger.info('Flow request could not find session', {
-        shop: payload.shopify_domain
-      });
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    logger.debug('Found a session for the flow request', {
-      shop: session.shop
-    });
-    return {
-      session,
-      payload,
-      admin: factory.adminClientFactory({
-        params,
-        session
-      })
-    };
-  };
-}
-
-exports.authenticateFlowFactory = authenticateFlowFactory;

package/build/cjs/server/authenticate/fulfillment-service/authenticate.js

@@ -1,70 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var shopifyApi = require('@shopify/shopify-api');
-var factory = require('../../clients/admin/factory.js');
-
-function authenticateFulfillmentServiceFactory(params) {
-  const {
-    api,
-    config,
-    logger
-  } = params;
-  return async function authenticate(request) {
-    logger.info('Authenticating fulfillment service request');
-    if (request.method !== 'POST') {
-      logger.debug('Received a non-POST request for fulfillment service. Only POST requests are allowed.', {
-        url: request.url,
-        method: request.method
-      });
-      throw new Response(undefined, {
-        status: 405,
-        statusText: 'Method not allowed'
-      });
-    }
-    const rawBody = await request.text();
-    const result = await api.fulfillmentService.validate({
-      rawBody,
-      rawRequest: request
-    });
-    if (!result.valid) {
-      logger.error('Received an invalid fulfillment service request', {
-        reason: result.reason
-      });
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    const payload = JSON.parse(rawBody);
-    const shop = request.headers.get(shopifyApi.ShopifyHeader.Domain) || '';
-    logger.debug('Fulfillment service request is valid, looking for an offline session', {
-      shop
-    });
-    const sessionId = api.session.getOfflineId(shop);
-    const session = await config.sessionStorage.loadSession(sessionId);
-    if (!session) {
-      logger.info('Fulfillment service request could not find session', {
-        shop
-      });
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    logger.debug('Found a session for the fulfillment service request', {
-      shop
-    });
-    return {
-      session,
-      payload,
-      admin: factory.adminClientFactory({
-        params,
-        session
-      })
-    };
-  };
-}
-
-exports.authenticateFulfillmentServiceFactory = authenticateFulfillmentServiceFactory;

package/build/cjs/server/authenticate/helpers/add-response-headers.js

@@ -1,32 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-function addDocumentResponseHeadersFactory(params) {
-  const {
-    api,
-    config
-  } = params;
-  return function (request, headers) {
-    const {
-      searchParams
-    } = new URL(request.url);
-    const shop = api.utils.sanitizeShop(searchParams.get('shop'));
-    addDocumentResponseHeaders(headers, config.isEmbeddedApp, shop);
-  };
-}
-function addDocumentResponseHeaders(headers, isEmbeddedApp, shop) {
-  if (shop) {
-    headers.set('Link', '<https://cdn.shopify.com/shopifycloud/app-bridge.js>; rel="preload"; as="script";');
-  }
-  if (isEmbeddedApp) {
-    if (shop) {
-      headers.set('Content-Security-Policy', `frame-ancestors https://${shop} https://admin.shopify.com https://*.spin.dev;`);
-    }
-  } else {
-    headers.set('Content-Security-Policy', `frame-ancestors 'none';`);
-  }
-}
-
-exports.addDocumentResponseHeaders = addDocumentResponseHeaders;
-exports.addDocumentResponseHeadersFactory = addDocumentResponseHeadersFactory;

package/build/cjs/server/authenticate/helpers/ensure-cors-headers.js

@@ -1,25 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var _const = require('../const.js');
-
-function ensureCORSHeadersFactory(params, request, corsHeaders = []) {
-  const {
-    logger,
-    config
-  } = params;
-  return function ensureCORSHeaders(response) {
-    const origin = request.headers.get('Origin');
-    if (origin && origin !== config.appUrl) {
-      logger.debug('Request comes from a different origin, adding CORS headers');
-      const corsHeadersSet = new Set(['Authorization', 'Content-Type', ...corsHeaders]);
-      response.headers.set('Access-Control-Allow-Origin', '*');
-      response.headers.set('Access-Control-Allow-Headers', [...corsHeadersSet].join(', '));
-      response.headers.set('Access-Control-Expose-Headers', _const.REAUTH_URL_HEADER);
-    }
-    return response;
-  };
-}
-
-exports.ensureCORSHeadersFactory = ensureCORSHeadersFactory;

package/build/cjs/server/authenticate/helpers/get-session-token-header.js

@@ -1,16 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-const SESSION_TOKEN_PARAM = 'id_token';
-function getSessionTokenHeader(request) {
-  var _request$headers$get;
-  return (_request$headers$get = request.headers.get('authorization')) === null || _request$headers$get === void 0 ? void 0 : _request$headers$get.replace('Bearer ', '');
-}
-function getSessionTokenFromUrlParam(request) {
-  const url = new URL(request.url);
-  return url.searchParams.get(SESSION_TOKEN_PARAM);
-}
-
-exports.getSessionTokenFromUrlParam = getSessionTokenFromUrlParam;
-exports.getSessionTokenHeader = getSessionTokenHeader;

package/build/cjs/server/authenticate/helpers/idempotent-promise-handler.js

@@ -1,40 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-const IDENTIFIER_TTL_MS = 60000;
-class IdempotentPromiseHandler {
-  constructor() {
-    this.identifiers = void 0;
-    this.identifiers = new Map();
-  }
-  async handlePromise({
-    promiseFunction,
-    identifier
-  }) {
-    try {
-      if (this.isPromiseRunnable(identifier)) {
-        await promiseFunction();
-      }
-    } finally {
-      this.clearStaleIdentifiers();
-    }
-    return Promise.resolve();
-  }
-  isPromiseRunnable(identifier) {
-    if (!this.identifiers.has(identifier)) {
-      this.identifiers.set(identifier, Date.now());
-      return true;
-    }
-    return false;
-  }
-  async clearStaleIdentifiers() {
-    this.identifiers.forEach((date, identifier, map) => {
-      if (Date.now() - date > IDENTIFIER_TTL_MS) {
-        map.delete(identifier);
-      }
-    });
-  }
-}
-
-exports.IdempotentPromiseHandler = IdempotentPromiseHandler;

package/build/cjs/server/authenticate/helpers/reject-bot-request.js

@@ -1,23 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var isbot = require('isbot');
-
-function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
-
-var isbot__default = /*#__PURE__*/_interopDefaultLegacy(isbot);
-
-function respondToBotRequest({
-  logger
-}, request) {
-  if (isbot__default["default"](request.headers.get('User-Agent'))) {
-    logger.debug('Request is from a bot, skipping auth');
-    throw new Response(undefined, {
-      status: 410,
-      statusText: 'Gone'
-    });
-  }
-}
-
-exports.respondToBotRequest = respondToBotRequest;

package/build/cjs/server/authenticate/helpers/respond-to-invalid-session-token.js

@@ -1,33 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var redirectToBouncePage = require('../admin/helpers/redirect-to-bounce-page.js');
-var _const = require('../const.js');
-
-function respondToInvalidSessionToken({
-  params,
-  request,
-  retryRequest = false
-}) {
-  const {
-    api,
-    logger,
-    config
-  } = params;
-  const isDocumentRequest = !request.headers.get('authorization');
-  if (isDocumentRequest) {
-    return redirectToBouncePage.redirectToBouncePage({
-      api,
-      logger,
-      config
-    }, new URL(request.url));
-  }
-  throw new Response(undefined, {
-    status: 401,
-    statusText: 'Unauthorized',
-    headers: retryRequest ? _const.RETRY_INVALID_SESSION_HEADER : {}
-  });
-}
-
-exports.respondToInvalidSessionToken = respondToInvalidSessionToken;

package/build/cjs/server/authenticate/helpers/respond-to-options-request.js

@@ -1,19 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var ensureCorsHeaders = require('./ensure-cors-headers.js');
-
-function respondToOptionsRequest(params, request, corsHeaders) {
-  if (request.method === 'OPTIONS') {
-    const ensureCORSHeaders = ensureCorsHeaders.ensureCORSHeadersFactory(params, request, corsHeaders);
-    throw ensureCORSHeaders(new Response(null, {
-      status: 204,
-      headers: {
-        'Access-Control-Max-Age': '7200'
-      }
-    }));
-  }
-}
-
-exports.respondToOptionsRequest = respondToOptionsRequest;

package/build/cjs/server/authenticate/helpers/validate-session-token.js

@@ -1,33 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var respondToInvalidSessionToken = require('./respond-to-invalid-session-token.js');
-
-async function validateSessionToken(params, request, token, {
-  checkAudience = true
-} = {}) {
-  const {
-    api,
-    logger
-  } = params;
-  logger.debug('Validating session token');
-  try {
-    const payload = await api.session.decodeSessionToken(token, {
-      checkAudience
-    });
-    logger.debug('Session token is valid', {
-      payload: JSON.stringify(payload)
-    });
-    return payload;
-  } catch (error) {
-    logger.debug(`Failed to validate session token: ${error.message}`);
-    throw respondToInvalidSessionToken.respondToInvalidSessionToken({
-      params,
-      request,
-      retryRequest: true
-    });
-  }
-}
-
-exports.validateSessionToken = validateSessionToken;

package/build/cjs/server/authenticate/login/login.js

@@ -1,52 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var serverRuntime = require('@remix-run/server-runtime');
-var types = require('../../types.js');
-
-function loginFactory(params) {
-  const {
-    api,
-    config,
-    logger
-  } = params;
-  return async function login(request) {
-    const url = new URL(request.url);
-    const shopParam = url.searchParams.get('shop');
-    if (request.method === 'GET' && !shopParam) {
-      return {};
-    }
-    const shop = shopParam || (await request.formData()).get('shop');
-    if (!shop) {
-      logger.debug('Missing shop parameter', {
-        shop
-      });
-      return {
-        shop: types.LoginErrorType.MissingShop
-      };
-    }
-    const shopWithoutProtocol = shop.replace(/^https?:\/\//, '').replace(/\/$/, '');
-    const shopWithDomain = (shop === null || shop === void 0 ? void 0 : shop.indexOf('.')) === -1 ? `${shopWithoutProtocol}.myshopify.com` : shopWithoutProtocol;
-    const sanitizedShop = api.utils.sanitizeShop(shopWithDomain);
-    if (!sanitizedShop) {
-      logger.debug('Invalid shop parameter', {
-        shop
-      });
-      return {
-        shop: types.LoginErrorType.InvalidShop
-      };
-    }
-    const authPath = `${config.appUrl}${config.auth.path}?shop=${sanitizedShop}`;
-    const adminPath = api.utils.legacyUrlToShopAdminUrl(sanitizedShop);
-    const installPath = `https://${adminPath}/oauth/install?client_id=${config.apiKey}`;
-    const shouldInstall = config.isEmbeddedApp && config.future.unstable_newEmbeddedAuthStrategy;
-    const redirectUrl = shouldInstall ? installPath : authPath;
-    logger.info(`Redirecting login request to ${redirectUrl}`, {
-      shop: sanitizedShop
-    });
-    throw serverRuntime.redirect(redirectUrl);
-  };
-}
-
-exports.loginFactory = loginFactory;

package/build/cjs/server/authenticate/public/appProxy/authenticate.js

@@ -1,117 +0,0 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var factory = require('../../../clients/admin/factory.js');
-var factory$1 = require('../../../clients/storefront/factory.js');
-
-function authenticateAppProxyFactory(params) {
-  const {
-    api,
-    config,
-    logger
-  } = params;
-  return async function authenticate(request) {
-    logger.info('Authenticating app proxy request');
-    const url = new URL(request.url);
-    if (!(await validateAppProxyHmac(params, url))) {
-      logger.info('App proxy request has invalid signature');
-      throw new Response(undefined, {
-        status: 400,
-        statusText: 'Bad Request'
-      });
-    }
-    const shop = url.searchParams.get('shop');
-    const sessionId = api.session.getOfflineId(shop);
-    const session = await config.sessionStorage.loadSession(sessionId);
-    if (!session) {
-      const context = {
-        liquid,
-        session: undefined,
-        admin: undefined,
-        storefront: undefined
-      };
-      return context;
-    }
-    const context = {
-      liquid,
-      session,
-      admin: factory.adminClientFactory({
-        params,
-        session
-      }),
-      storefront: factory$1.storefrontClientFactory({
-        params,
-        session
-      })
-    };
-    return context;
-  };
-}
-const liquid = (body, initAndOptions) => {
-  const processedBody = processLiquidBody(body);
-  if (typeof initAndOptions !== 'object') {
-    return new Response(processedBody, {
-      status: initAndOptions || 200,
-      headers: {
-        'Content-Type': 'application/liquid'
-      }
-    });
-  }
-  const {
-    layout,
-    ...responseInit
-  } = initAndOptions || {};
-  const responseBody = layout === false ? `{% layout none %} ${processedBody}` : processedBody;
-  const headers = new Headers(responseInit.headers);
-  headers.set('Content-Type', 'application/liquid');
-  return new Response(responseBody, {
-    ...responseInit,
-    headers
-  });
-};
-async function validateAppProxyHmac(params, url) {
-  const {
-    api,
-    logger
-  } = params;
-  try {
-    let searchParams = new URLSearchParams(url.search);
-    if (!searchParams.get('index')) {
-      searchParams.delete('index');
-    }
-    let isValid = await api.utils.validateHmac(Object.fromEntries(searchParams.entries()), {
-      signator: 'appProxy'
-    });
-    if (!isValid) {
-      const cleanPath = url.pathname.replace(/^\//, '').replace(/\/$/, '').replaceAll('/', '.');
-      const data = `routes%2F${cleanPath}`;
-      searchParams = new URLSearchParams(`?_data=${data}&${searchParams.toString().replace(/^\?/, '')}`);
-      isValid = await api.utils.validateHmac(Object.fromEntries(searchParams.entries()), {
-        signator: 'appProxy'
-      });
-      if (!isValid) {
-        const searchParams = new URLSearchParams(`?_data=${data}._index&${url.search.replace(/^\?/, '')}`);
-        isValid = await api.utils.validateHmac(Object.fromEntries(searchParams.entries()), {
-          signator: 'appProxy'
-        });
-      }
-    }
-    return isValid;
-  } catch (error) {
-    logger.info(error.message);
-    throw new Response(undefined, {
-      status: 400,
-      statusText: 'Bad Request'
-    });
-  }
-}
-function processLiquidBody(body) {
-  return body
-  // Add trailing slashes to relative form action URLs
-  .replaceAll(/<(form[^>]+)action="(\/[^"?]+)(\?[^"]+)?">/g, '<$1action="$2/$3">')
-  // Add trailing slashes to relative link href URLs
-  .replaceAll(/<(a[^>]+)href="(\/[^"?]+)(\?[^"]+)?">/g, '<$1href="$2/$3">');
-}
-
-exports.authenticateAppProxyFactory = authenticateAppProxyFactory;