@tollwyn/baukasten 0.0.2 → 1.2.2

package/dist/testing/shopify-connection.js

@@ -0,0 +1,313 @@
+// The connection test of a Shopify app, which its e2e/baukasten.spec.ts (a stub) runs against the
+// built app with the doubles of Shopify and the mail relay. It speaks HTTP as the admin and Shopify
+// would: what App Bridge does in the browser, only a store at Shopify shows. The app's own variables
+// come from the environment of the test run.
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { SHOPIFY_BOUNCE_PATH } from '../shopify/constants.js';
+import { SHOPIFY_TEXTS } from '../shopify/texts.js';
+import { APP_TOML, appToml } from '../shopify/toml.js';
+import { spawnNode, startApp } from './app.js';
+import { createTestDatabase } from './database.js';
+import { startShopify } from './shopify.js';
+import { startSmtp } from './smtp.js';
+const MIGRATE = fileURLToPath(new URL('../bin/migrate.js', import.meta.url));
+/** What the delivery service sets in production, as far as the test sets it itself. */
+const STANDARD = {
+    NODE_ENV: 'production',
+    MAIL_FROM: 'hello@example.com',
+    MAIL_FROM_NAME: 'Connection Test',
+    OPERATOR_NAME: 'Connection Test Operator',
+    OPERATOR_ADDRESS: 'Street 1, 5400 Baden',
+    HOSTING_LOCATION: 'Example Hosting, Nuremberg',
+    VERTRIEB_TOKEN: 'v'.repeat(64)
+};
+const SHOP = 'connection-test.myshopify.com';
+const DEVELOPMENT = 'connection-test-dev.myshopify.com';
+/**
+ * A path no app has: past the baukasten it gets the app's page for a missing one, whatever the app's
+ * own pages would ask of Shopify, which the double cannot answer for every app.
+ */
+const NOWHERE = '/baukasten-connection-test';
+/** The app's own variables from the environment of the test run; loud on a required one missing. */
+function ownVariables(env) {
+    const given = {};
+    const lacking = [];
+    for (const [name, schema] of Object.entries(env)) {
+        const value = process.env[name];
+        if (value !== undefined)
+            given[name] = value;
+        else if (!schema.safeParse(undefined).success)
+            lacking.push(name);
+    }
+    if (lacking.length > 0) {
+        throw new Error(`the connection test takes the app's own variables from the environment of the test run, which lacks ${lacking.join(', ')}: set them in playwright.config.ts`);
+    }
+    return given;
+}
+/** The scopes the app asks for in its shopify.app.toml, which the double grants. */
+function scopesOfApp() {
+    const toml = appToml(readFileSync(APP_TOML, 'utf8'));
+    if (toml.kind === 'problems')
+        throw new Error(toml.problems.join('; '));
+    return toml.toml.scopes;
+}
+/** Registers the connection test of `app` with the test and expect of the app's Playwright. */
+export function shopifyConnectionTest(app, playwright) {
+    const { test, expect } = playwright;
+    const paid = app.plans.find((plan) => plan.paid);
+    if (paid === undefined)
+        throw new Error('the app names no paid plan');
+    test.describe('the connection of the baukasten', () => {
+        test.describe.configure({ mode: 'serial' });
+        let database;
+        let smtp;
+        let shopify;
+        let running;
+        const undo = [];
+        /**
+         * A page as the admin opens it, with the shop, embedded=1 and a fresh ID token of `shop`; the
+         * address may name another shop (`named`), as a forged one would.
+         */
+        const inAdmin = (shop, extra = '', path = '/', named = shop) => {
+            const host = Buffer.from(`admin.shopify.com/store/${named}`).toString('base64url');
+            return `${running.url}${path}?embedded=1&shop=${named}&host=${host}&id_token=${shopify.idToken(shop)}${extra}`;
+        };
+        const noCookie = (response) => expect(response.headers()['set-cookie'], 'a Shopify app sets no cookie').toBeUndefined();
+        test.beforeAll(async () => {
+            const own = ownVariables(app.env);
+            database = await createTestDatabase({ migrate: false });
+            undo.push(() => database.drop());
+            smtp = await startSmtp();
+            undo.push(() => smtp.stop());
+            shopify = await startShopify({ scopes: scopesOfApp() });
+            undo.push(() => shopify.stop());
+            const migrate = spawnNode([MIGRATE, 'shopify'], {
+                ...STANDARD,
+                ...own,
+                ...shopify.env(),
+                DATABASE_URL: database.url,
+                PUBLIC_ORIGIN: 'http://127.0.0.1:9',
+                PORT: '9',
+                SMTP_HOST: smtp.host,
+                SMTP_PORT: String(smtp.port)
+            });
+            expect(await migrate.exited, JSON.stringify(migrate.logs)).toBe(0);
+            running = await startApp({
+                env: { ...STANDARD, ...own, ...shopify.env(), DATABASE_URL: database.url },
+                smtp
+            });
+            undo.push(() => running.stop());
+            shopify.addShop(SHOP);
+            shopify.addShop(DEVELOPMENT, { development: true });
+        });
+        test.afterAll(async () => {
+            // Every step, though one before it failed: the test database goes in any case.
+            const failed = [];
+            for (const step of undo.reverse()) {
+                try {
+                    await step();
+                }
+                catch (error) {
+                    failed.push(error);
+                }
+            }
+            if (failed.length > 0) {
+                throw new AggregateError(failed, 'cleaning up after the connection test failed');
+            }
+        });
+        test('it is healthy, with its database, the relay and the Partner API', async ({ request }) => {
+            expect((await request.get(`${running.url}/health`)).status()).toBe(200);
+            const deep = await request.get(`${running.url}/health/deep`);
+            expect(await deep.json()).toEqual({
+                status: 'ok',
+                checks: expect.objectContaining({ database: 'ok', mail: 'ok', shopify: 'ok' })
+            });
+        });
+        test('outside the admin it says where it runs, and no frame may hold it', async ({ request }) => {
+            const page = await request.get(`${running.url}/`, { maxRedirects: 0 });
+            expect(page.status()).toBe(200);
+            expect(page.headers()['content-security-policy']).toContain("frame-ancestors 'none'");
+            expect(await page.text()).toContain(SHOPIFY_TEXTS[app.language].outside.privacy);
+            noCookie(page);
+            const shop = await request.get(`${running.url}/?shop=${SHOP}`, { maxRedirects: 0 });
+            expect(shop.status()).toBe(302);
+            expect(shop.headers().location).toMatch(/^https:\/\/admin\.shopify\.com\/store\/connection-test\/apps\/[a-z0-9-]+$/);
+        });
+        test('a page of the admin without an ID token goes to the bounce page and comes back', async ({ request }) => {
+            const page = await request.get(`${running.url}/?embedded=1&shop=${SHOP}&host=x`, {
+                maxRedirects: 0
+            });
+            expect(page.status()).toBe(302);
+            const bounce = new URL(page.headers().location ?? '', running.url);
+            expect(bounce.pathname).toBe(SHOPIFY_BOUNCE_PATH);
+            expect(bounce.searchParams.get('shopify-reload')).toContain('embedded=1');
+            const app = await request.get(bounce.toString());
+            expect(app.status()).toBe(200);
+            expect(await app.text()).toContain(`content="${shopify.clientId}"`);
+            expect(app.headers()['content-security-policy']).toContain(`frame-ancestors https://${SHOP} https://admin.shopify.com`);
+            // App Bridge would open another address with a fresh ID token: no bounce page for it.
+            const foreign = new URL(bounce);
+            foreign.searchParams.set('shopify-reload', 'https://attacker.example/steal');
+            const refused = await request.get(foreign.toString());
+            expect(await refused.text()).not.toContain('app-bridge.js');
+            expect(refused.headers()['content-security-policy']).toContain("frame-ancestors 'none'");
+        });
+        test('the first page installs the shop and leads it to the plans of Shopify', async ({ request }) => {
+            const page = await request.get(inAdmin(SHOP), { maxRedirects: 0 });
+            expect(page.status()).toBe(200);
+            expect(await page.text()).toContain('https://admin.shopify.com/store/connection-test/charges/');
+            expect(shopify.calls).toContain(`exchange ${SHOP}`);
+            noCookie(page);
+        });
+        test('with a plan the app opens, framed only by the admin of its shop', async ({ request }) => {
+            shopify.subscribe(SHOP, [paid.handle]);
+            // A path the app has not: the page of the app answers, whatever its own pages ask Shopify.
+            const page = await request.get(inAdmin(SHOP, `&plan_handle=${paid.handle}`, NOWHERE), {
+                maxRedirects: 0
+            });
+            expect(page.status()).toBe(404);
+            expect(page.headers()['content-type']).toContain('text/html');
+            const policy = page.headers()['content-security-policy'] ?? '';
+            expect(policy.split(';').map((directive) => directive.trim())).toContain(`frame-ancestors https://${SHOP} https://admin.shopify.com`);
+            expect(policy).toContain('https://cdn.shopify.com');
+            // The frame belongs to the shop of the ID token, whatever shop the address names.
+            const named = await request.get(inAdmin(SHOP, '', NOWHERE, DEVELOPMENT), {
+                maxRedirects: 0
+            });
+            expect(named.headers()['content-security-policy']).toContain(`frame-ancestors https://${SHOP} https://admin.shopify.com`);
+            expect(named.headers()['content-security-policy']).not.toContain(DEVELOPMENT);
+            expect(page.headers()['x-frame-options']).toBeUndefined();
+            expect(page.headers()).toMatchObject({
+                'x-content-type-options': 'nosniff',
+                'referrer-policy': 'strict-origin-when-cross-origin'
+            });
+            const html = await page.text();
+            expect(html).toContain(`<meta name="shopify-api-key" content="${shopify.clientId}" />`);
+            // App Bridge is the first script of the page, as the App Store wants.
+            expect(html.indexOf('<script')).toBe(html.indexOf('<script src="https://cdn.shopify.com/shopifycloud/app-bridge.js">'));
+            noCookie(page);
+        });
+        test('a request from the admin carries the ID token as a bearer token, from the origin of the app', async ({ request }) => {
+            const data = `${running.url}${NOWHERE}/__data.json`;
+            const exchanges = shopify.calls.filter((call) => call.startsWith('exchange')).length;
+            const valid = await request.get(data, {
+                headers: { authorization: `Bearer ${shopify.idToken(SHOP)}` }
+            });
+            // An installed shop gets in with the tokens it has.
+            expect(shopify.calls.filter((call) => call.startsWith('exchange'))).toHaveLength(exchanges);
+            // Past the baukasten, to the app, which has no such page.
+            expect(valid.status()).toBe(404);
+            const stale = await request.get(data, {
+                headers: { authorization: `Bearer ${shopify.idToken(SHOP, { seconds: -60 })}` }
+            });
+            expect(stale.status()).toBe(401);
+            expect(stale.headers()['x-shopify-retry-invalid-session-request']).toBe('1');
+            const foreign = await request.get(data, {
+                headers: { authorization: `Bearer ${shopify.idToken(SHOP, { secret: 'another' })}` }
+            });
+            expect(foreign.status()).toBe(401);
+            // A form posts from the app's own page; from another origin, even with a valid token, not.
+            const elsewhere = await request.post(`${running.url}${NOWHERE}`, {
+                headers: {
+                    authorization: `Bearer ${shopify.idToken(SHOP)}`,
+                    origin: 'https://elsewhere.example'
+                },
+                maxRedirects: 0
+            });
+            expect(elsewhere.status()).toBe(403);
+            expect(elsewhere.headers()['x-content-type-options']).toBe('nosniff');
+        });
+        test('webhooks count only with the signature of the app, each once, applied after their answer', async () => {
+            expect(await shopify.webhook(running.url, 'customers/redact', SHOP, {}, { signed: false })).toBe(401);
+            const request = {
+                shop_domain: SHOP,
+                customer: { id: 7, email: 'customer@example.com', phone: null },
+                orders_requested: [11]
+            };
+            expect(await shopify.webhook(running.url, 'customers/data_request', SHOP, request)).toBe(200);
+            const mail = await smtp.next(`owner@${SHOP}`);
+            expect(mail.text).toContain('customer@example.com');
+            const redact = {
+                shop_domain: SHOP,
+                customer: { id: 7, email: 'customer@example.com', phone: null },
+                orders_to_redact: [11]
+            };
+            const id = 'connection-test-redact';
+            expect(await shopify.webhook(running.url, 'customers/redact', SHOP, redact, { id })).toBe(200);
+            expect(await shopify.webhook(running.url, 'customers/redact', SHOP, redact, { id })).toBe(200);
+            // A request about a customer of a shop the app never saw has nothing to answer with.
+            const unknown = 'never-opened.myshopify.com';
+            expect(await shopify.webhook(running.url, 'customers/data_request', unknown, {
+                ...request,
+                shop_domain: unknown
+            })).toBe(200);
+            await expect
+                .poll(() => database.query('SELECT count(*)::int AS waiting FROM baukasten.shopify_webhooks WHERE applied_at IS NULL'))
+                .toEqual([{ waiting: 0 }]);
+        });
+        test('the numbers for sales count shops, not development stores', async ({ request }) => {
+            expect((await request.get(inAdmin(DEVELOPMENT))).status()).toBe(200);
+            expect((await request.get(`${running.url}/vertrieb/zahlen`)).status()).toBe(401);
+            const numbers = await request.get(`${running.url}/vertrieb/zahlen`, {
+                headers: { authorization: `Bearer ${STANDARD.VERTRIEB_TOKEN}` }
+            });
+            expect(await numbers.json()).toEqual({
+                stand: expect.any(String),
+                je_kennung: [
+                    {
+                        kennung: 'ohne',
+                        werte: [
+                            { name: 'Konten', wert: 1 },
+                            { name: 'Zahlende', wert: 1 }
+                        ],
+                        umsatz: null
+                    }
+                ]
+            });
+        });
+        test('removed, the shop is out; back, it installs again; redacted, it is gone', async ({ request }) => {
+            shopify.uninstall(SHOP);
+            const removed = { id: 1, myshopify_domain: SHOP };
+            expect(await shopify.webhook(running.url, 'app/uninstalled', SHOP, removed)).toBe(200);
+            const data = () => request.get(`${running.url}${NOWHERE}/__data.json`, {
+                headers: { authorization: `Bearer ${shopify.idToken(SHOP)}` }
+            });
+            // Back without a plan: the shop installs again, and a request of data finds no plan.
+            await expect.poll(async () => (await data()).status()).toBe(402);
+            const exchanges = () => shopify.calls.filter((call) => call === `exchange ${SHOP}`).length;
+            const before = exchanges();
+            expect(await shopify.webhook(running.url, 'shop/redact', SHOP, { shop_domain: SHOP })).toBe(200);
+            await expect
+                .poll(() => database.query('SELECT count(*)::int AS shops FROM baukasten.shops WHERE domain = $1', [
+                SHOP
+            ]))
+                .toEqual([{ shops: 0 }]);
+            // Gone, the shop gets in only with a new token exchange.
+            await data();
+            expect(exchanges()).toBe(before + 1);
+        });
+        test('the privacy text names the operator, in the language of the app', async ({ request }) => {
+            const page = await request.get(`${running.url}/privacy`);
+            expect(page.status()).toBe(200);
+            const html = await page.text();
+            expect(html).toContain(STANDARD.OPERATOR_NAME);
+            expect(html).toContain(`<html lang="${app.language}">`);
+            expect(html).not.toMatch(/undefined|null/);
+        });
+        test('it writes JSON lines only, and no token into its log', () => {
+            expect(running.stderr()).toBe('');
+            expect(running.logs.filter((line) => 'notJson' in line)).toEqual([]);
+            // Every ID token starts with the same header, so any of them in the log would show it.
+            const [header = ''] = shopify.idToken(SHOP).split('.');
+            expect(header).not.toBe('');
+            const log = JSON.stringify(running.logs);
+            for (const token of [header, 'shpat_', 'shprt_', shopify.secret]) {
+                expect(log).not.toContain(token);
+            }
+            // The request of a shop that got in names it (SvelteKit gives a request of data the path of
+            // its page).
+            expect(running.logs).toContainEqual(expect.objectContaining({ msg: 'request', path: NOWHERE, shop: SHOP }));
+        });
+    });
+}

package/dist/testing/shopify.d.ts

@@ -0,0 +1,71 @@
+export interface DoubleShop {
+    domain: string;
+    /** gid://shopify/Shop/… */
+    id: string;
+    email: string;
+    development: boolean;
+    /** The tokens Shopify gave the app for it and still takes. */
+    accessTokens: Map<string, number>;
+    refreshTokens: Set<string>;
+    /** The subscription the merchant chose: the handles of its items, and the end of its trial. */
+    subscription: {
+        handles: string[];
+        trialEndsAt: Date | null;
+    } | null;
+}
+/** The app's own queries of the Admin API: the data of a query, or errors, as the test says. */
+export type AdminAnswer = (request: {
+    shop: string;
+    query: string;
+    variables: Record<string, unknown>;
+}) => {
+    data: unknown;
+} | {
+    errors: {
+        message: string;
+        code?: string;
+    }[];
+};
+export interface ShopifyDouble {
+    url: string;
+    clientId: string;
+    secret: string;
+    partnerToken: string;
+    organization: string;
+    /** The app as Shopify knows it, gid://shopify/App/…. */
+    appId: string;
+    shops: Map<string, DoubleShop>;
+    /** What each call asked for, in order, like `exchange example.myshopify.com`. */
+    calls: string[];
+    /** The variables that send the app to the double; the key of its tokens comes with them. */
+    env(): Record<string, string>;
+    /** A shop that has the app, or will install it on its first page. */
+    addShop(domain: string, options?: {
+        development?: boolean;
+        email?: string;
+    }): DoubleShop;
+    /** An ID token for `shop` as App Bridge fetches it, valid for `seconds` (60 by default). */
+    idToken(shop: string, options?: {
+        seconds?: number;
+        secret?: string;
+        audience?: string;
+    }): string;
+    /** The merchant chose a plan; with `trialDays`, it starts as a trial. */
+    subscribe(shop: string, handles: string[], options?: {
+        trialDays?: number;
+    }): void;
+    /** The merchant removed the app: its tokens stop working, and its subscription ends. */
+    uninstall(shop: string): void;
+    /** Answers the app's own queries of the Admin API. */
+    answerAdmin(answer: AdminAnswer): void;
+    /** Sends a webhook of `topic` to the app, signed unless `signed` is false; the status of its answer. */
+    webhook(appUrl: string, topic: string, shop: string, payload: unknown, options?: {
+        id?: string;
+        signed?: boolean;
+    }): Promise<number>;
+    stop(): Promise<void>;
+}
+/** Starts the double; it grants the tokens `scopes`, those of the app's shopify.app.toml. */
+export declare function startShopify(options: {
+    scopes: string;
+}): Promise<ShopifyDouble>;

package/dist/testing/shopify.js

@@ -0,0 +1,278 @@
+// A double of Shopify on a free local port, for the tests of a Shopify app: the token endpoint and
+// the Admin API of each shop, and the Partner API. It needs nothing but Node, so no image of an app
+// carries a dependency for it.
+import { createHmac, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { SHOPIFY_API_VERSION, SHOPIFY_WEBHOOK_PATH } from '../shopify/constants.js';
+const HOUR_SECONDS = 3_600;
+const REFRESH_SECONDS = 90 * 24 * HOUR_SECONDS;
+function part(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function body(request) {
+    return new Promise((resolve, reject) => {
+        let text = '';
+        request.on('data', (chunk) => (text += chunk.toString()));
+        request.on('end', () => resolve(text === '' ? null : JSON.parse(text)));
+        request.on('error', reject);
+    });
+}
+function field(value, name) {
+    return typeof value === 'object' && value !== null ? Reflect.get(value, name) : undefined;
+}
+function text(value, name) {
+    const found = field(value, name);
+    return typeof found === 'string' ? found : null;
+}
+/** The claims of an ID token the double signed, or null. */
+function claims(token, secret) {
+    const [header, payload, signature] = token.split('.');
+    if (header === undefined || payload === undefined || signature === undefined)
+        return null;
+    const expected = createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url');
+    if (expected !== signature)
+        return null;
+    const value = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    return typeof value === 'object' && value !== null
+        ? Object.fromEntries(Object.entries(value))
+        : null;
+}
+/** Starts the double; it grants the tokens `scopes`, those of the app's shopify.app.toml. */
+export async function startShopify(options) {
+    const secret = `shpss_${randomBytes(16).toString('hex')}`;
+    const tokenKey = randomBytes(32).toString('hex');
+    let counter = 0;
+    let admin = () => ({
+        errors: [{ message: 'the double knows no answer to this query; answerAdmin gives it one' }]
+    });
+    const now = () => Math.floor(Date.now() / 1000);
+    function tokens(shop) {
+        counter += 1;
+        const access = `shpat_double${counter}`;
+        const refresh = `shprt_double${counter}`;
+        shop.accessTokens.set(access, now() + HOUR_SECONDS);
+        shop.refreshTokens.add(refresh);
+        return {
+            access_token: access,
+            scope: options.scopes,
+            expires_in: HOUR_SECONDS,
+            refresh_token: refresh,
+            refresh_token_expires_in: REFRESH_SECONDS
+        };
+    }
+    function grant(shop, request) {
+        if (text(request, 'client_id') !== double.clientId ||
+            text(request, 'client_secret') !== secret) {
+            return { status: 401, json: { error: 'invalid_client' } };
+        }
+        if (shop === undefined)
+            return { status: 404, json: { error: 'unknown shop' } };
+        const grantType = text(request, 'grant_type');
+        if (grantType === 'urn:ietf:params:oauth:grant-type:token-exchange') {
+            const found = claims(text(request, 'subject_token') ?? '', secret);
+            const exp = field(found, 'exp');
+            const valid = found !== null &&
+                typeof exp === 'number' &&
+                exp > now() &&
+                text(found, 'dest') === `https://${shop.domain}` &&
+                text(request, 'expiring') === '1';
+            return valid
+                ? { status: 200, json: tokens(shop) }
+                : { status: 400, json: { error: 'invalid_subject_token' } };
+        }
+        if (grantType === 'refresh_token') {
+            if (!shop.refreshTokens.delete(text(request, 'refresh_token') ?? '')) {
+                return { status: 400, json: { error: 'invalid_grant' } };
+            }
+            // A refresh ends the tokens before it.
+            shop.accessTokens.clear();
+            return { status: 200, json: tokens(shop) };
+        }
+        return { status: 400, json: { error: 'unsupported_grant_type' } };
+    }
+    function adminQuery(shop, request) {
+        const query = text(request, 'query') ?? '';
+        const variables = field(request, 'variables');
+        if (query.includes('BaukastenShop')) {
+            return {
+                data: {
+                    shop: {
+                        id: shop.id,
+                        email: shop.email,
+                        plan: { partnerDevelopment: shop.development }
+                    },
+                    currentAppInstallation: { app: { id: double.appId } }
+                }
+            };
+        }
+        return admin({
+            shop: shop.domain,
+            query,
+            variables: typeof variables === 'object' && variables !== null
+                ? Object.fromEntries(Object.entries(variables))
+                : {}
+        });
+    }
+    function partnerQuery(request) {
+        const query = text(request, 'query') ?? '';
+        if (query.includes('BaukastenCheck')) {
+            return { data: { publicApiVersions: [{ handle: SHOPIFY_API_VERSION }] } };
+        }
+        if (query.includes('BaukastenSubscription')) {
+            const variables = field(request, 'variables');
+            const shopId = text(variables, 'shopId');
+            const appId = text(variables, 'appId');
+            const shop = [...double.shops.values()].find((s) => s.id === shopId);
+            const subscription = appId === double.appId ? (shop?.subscription ?? null) : null;
+            return {
+                data: {
+                    activeSubscription: subscription === null
+                        ? null
+                        : {
+                            trialEndsAt: subscription.trialEndsAt?.toISOString() ?? null,
+                            items: subscription.handles.map((handle) => ({ handle }))
+                        }
+                }
+            };
+        }
+        return { errors: [{ message: 'the double knows no such query of the Partner API' }] };
+    }
+    const server = createServer((request, response) => {
+        const answer = (status, json) => {
+            response.writeHead(status, { 'content-type': 'application/json' });
+            response.end(JSON.stringify(json));
+        };
+        void (async () => {
+            const url = new URL(request.url ?? '/', double.url);
+            const parsed = await body(request);
+            const token = /^\/shops\/([^/]+)\/admin\/oauth\/access_token$/.exec(url.pathname);
+            if (token?.[1] !== undefined) {
+                double.calls.push(`${text(parsed, 'grant_type') === 'refresh_token' ? 'refresh' : 'exchange'} ${token[1]}`);
+                const granted = grant(double.shops.get(token[1]), parsed);
+                return answer(granted.status, granted.json);
+            }
+            const graphql = new RegExp(`^/shops/([^/]+)/admin/api/${SHOPIFY_API_VERSION}/graphql\\.json$`).exec(url.pathname);
+            if (graphql?.[1] !== undefined) {
+                const shop = double.shops.get(graphql[1]);
+                const access = request.headers['x-shopify-access-token'];
+                const until = typeof access === 'string' ? shop?.accessTokens.get(access) : undefined;
+                if (shop === undefined || until === undefined || until <= now()) {
+                    return answer(401, { errors: '[API] Invalid API key or access token' });
+                }
+                double.calls.push(`admin ${shop.domain}`);
+                return answer(200, adminQuery(shop, parsed));
+            }
+            if (url.pathname === `/partners/${double.organization}/api/${SHOPIFY_API_VERSION}/graphql.json`) {
+                if (request.headers['x-shopify-access-token'] !== double.partnerToken) {
+                    return answer(401, { errors: 'Unauthorized' });
+                }
+                double.calls.push('partner');
+                return answer(200, partnerQuery(parsed));
+            }
+            return answer(404, { errors: 'Not Found' });
+        })().catch((error) => answer(500, { errors: String(error) }));
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const address = server.address();
+    if (address === null || typeof address === 'string') {
+        throw new Error('the Shopify double has no port');
+    }
+    const double = {
+        url: `http://127.0.0.1:${address.port}`,
+        clientId: `double${randomBytes(8).toString('hex')}`,
+        secret,
+        partnerToken: `prtapi_${randomBytes(16).toString('hex')}`,
+        organization: '4242',
+        appId: 'gid://shopify/App/4242',
+        shops: new Map(),
+        calls: [],
+        env: () => ({
+            SHOPIFY_API_BASE: double.url,
+            SHOPIFY_CLIENT_ID: double.clientId,
+            SHOPIFY_API_SECRET: secret,
+            SHOPIFY_TOKEN_KEY: tokenKey,
+            SHOPIFY_PARTNER_TOKEN: double.partnerToken,
+            SHOPIFY_PARTNER_ORG: double.organization
+        }),
+        addShop(domain, options = {}) {
+            counter += 1;
+            const shop = {
+                domain,
+                id: `gid://shopify/Shop/${counter}`,
+                email: options.email ?? `owner@${domain}`,
+                development: options.development ?? false,
+                accessTokens: new Map(),
+                refreshTokens: new Set(),
+                subscription: null
+            };
+            double.shops.set(domain, shop);
+            return shop;
+        },
+        idToken(shop, options = {}) {
+            const issued = now();
+            const payload = {
+                iss: `https://${shop}/admin`,
+                dest: `https://${shop}`,
+                aud: options.audience ?? double.clientId,
+                sub: '42',
+                exp: issued + (options.seconds ?? 60),
+                nbf: issued - 1,
+                iat: issued - 1,
+                jti: randomBytes(16).toString('hex'),
+                sid: randomBytes(16).toString('hex')
+            };
+            const unsigned = `${part({ alg: 'HS256', typ: 'JWT' })}.${part(payload)}`;
+            const signature = createHmac('sha256', options.secret ?? secret)
+                .update(unsigned)
+                .digest('base64url');
+            return `${unsigned}.${signature}`;
+        },
+        subscribe(shop, handles, options = {}) {
+            const found = double.shops.get(shop);
+            if (found === undefined)
+                throw new Error(`the double knows no shop ${shop}`);
+            found.subscription = {
+                handles,
+                trialEndsAt: options.trialDays === undefined
+                    ? null
+                    : new Date(Date.now() + options.trialDays * 24 * HOUR_SECONDS * 1000)
+            };
+        },
+        uninstall(shop) {
+            const found = double.shops.get(shop);
+            if (found === undefined)
+                throw new Error(`the double knows no shop ${shop}`);
+            found.accessTokens.clear();
+            found.refreshTokens.clear();
+            found.subscription = null;
+        },
+        answerAdmin(answer) {
+            admin = answer;
+        },
+        async webhook(appUrl, topic, shop, payload, options = {}) {
+            const raw = JSON.stringify(payload);
+            const hmac = createHmac('sha256', options.signed === false ? 'not-the-secret' : secret)
+                .update(raw)
+                .digest('base64');
+            const response = await fetch(`${appUrl}${SHOPIFY_WEBHOOK_PATH}`, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    'x-shopify-topic': topic,
+                    'x-shopify-shop-domain': shop,
+                    'x-shopify-hmac-sha256': hmac,
+                    'x-shopify-webhook-id': options.id ?? randomBytes(16).toString('hex'),
+                    'x-shopify-triggered-at': new Date().toISOString(),
+                    'x-shopify-api-version': SHOPIFY_API_VERSION
+                },
+                body: raw
+            });
+            await response.arrayBuffer();
+            return response.status;
+        },
+        stop: () => new Promise((resolve, reject) => {
+            server.close((error) => (error === undefined ? resolve() : reject(error)));
+        })
+    };
+    return double;
+}