create-shopify-firebase-app 2.0.6 → 2.1.0

package/templates/js/functions/src/auth.js

@@ -2,6 +2,18 @@ const crypto = require("crypto");
 const { getConfig } = require("./config");
 const { db } = require("./firebase");
 
+// Shop domains are always <handle>.myshopify.com. Anything else is rejected —
+// the value ends up in a redirect Location header and in Firestore doc IDs,
+// so an unvalidated `shop` is an open redirect.
+const SHOP_DOMAIN_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9-]*\.myshopify\.com$/;
+
+// The state nonce is 16 random bytes hex-encoded (see handleStart).
+const NONCE_PATTERN = /^[a-f0-9]{32}$/;
+
+function isValidShopDomain(shop) {
+  return typeof shop === "string" && SHOP_DOMAIN_PATTERN.test(shop);
+}
+
 /**
  * Standalone OAuth handler — no Express, no middleware overhead.
  *
@@ -20,16 +32,16 @@ async function authHandler(req, res) {
   if (urlPath === "/auth/callback") {
     await handleCallback(req, res);
   } else {
-    handleStart(req, res);
+    await handleStart(req, res);
   }
 }
 
 // ─── Step 1: Start OAuth ─────────────────────────────────────────────────
 // Merchant clicks "Install" -> redirect to Shopify consent screen.
-function handleStart(req, res) {
+async function handleStart(req, res) {
   const { shop } = req.query;
-  if (!shop || typeof shop !== "string") {
-    res.status(400).send("Missing shop parameter");
+  if (!isValidShopDomain(shop)) {
+    res.status(400).send("Invalid shop parameter");
     return;
   }
 
@@ -37,11 +49,18 @@ function handleStart(req, res) {
   const nonce = crypto.randomBytes(16).toString("hex");
   const redirectUri = `${config.appUrl}/auth/callback`;
 
-  // Store nonce for CSRF protection
-  db.collection("authNonces").doc(nonce).set({
-    shop,
-    createdAt: new Date().toISOString(),
-  });
+  // Store nonce for CSRF protection. Must be awaited — Cloud Functions may
+  // freeze the instance once the response is sent, dropping in-flight writes.
+  try {
+    await db.collection("authNonces").doc(nonce).set({
+      shop,
+      createdAt: new Date().toISOString(),
+    });
+  } catch (err) {
+    console.error("Failed to store auth nonce:", err);
+    res.status(500).send("Failed to start OAuth");
+    return;
+  }
 
   const authUrl =
     `https://${shop}/admin/oauth/authorize` +
@@ -63,6 +82,11 @@ async function handleCallback(req, res) {
     return;
   }
 
+  if (!isValidShopDomain(shop)) {
+    res.status(400).send("Invalid shop parameter");
+    return;
+  }
+
   const config = getConfig();
 
   // Verify HMAC (timing-safe comparison)
@@ -88,11 +112,19 @@ async function handleCallback(req, res) {
     return;
   }
 
-  // Clean up nonce
-  if (state) {
-    const nonceDoc = await db.collection("authNonces").doc(state).get();
-    if (nonceDoc.exists) await nonceDoc.ref.delete();
+  // Verify and consume the CSRF nonce. A missing or unknown state means this
+  // callback did not come from a flow we started, so it must be rejected.
+  if (typeof state !== "string" || !NONCE_PATTERN.test(state)) {
+    res.status(403).send("Missing or malformed state parameter");
+    return;
+  }
+
+  const nonceDoc = await db.collection("authNonces").doc(state).get();
+  if (!nonceDoc.exists || nonceDoc.data()?.shop !== shop) {
+    res.status(403).send("Invalid state parameter");
+    return;
   }
+  await nonceDoc.ref.delete();
 
   // Exchange code for access token
   try {

package/templates/js/functions/src/firebase.js

@@ -1,12 +1,14 @@
-const admin = require("firebase-admin");
+const { initializeApp, getApps } = require("firebase-admin/app");
+const { getFirestore } = require("firebase-admin/firestore");
 
 // Initialize Firebase Admin SDK once.
 // Credentials are auto-detected on Firebase infrastructure.
 // For local dev, use `firebase emulators:start`.
-if (!admin.apps.length) {
-  admin.initializeApp();
+// firebase-admin v14 is modular-only — the old `admin.*` namespace was removed.
+if (!getApps().length) {
+  initializeApp();
 }
 
-const db = admin.firestore();
+const db = getFirestore();
 
 module.exports = { db };

package/templates/js/functions/src/index.js

@@ -47,6 +47,14 @@ apiApp.use(cors({ origin: true }));
 apiApp.use(express.json());
 apiApp.use("/api", adminApiRouter);
 
+// Express 5 forwards rejected promises from async handlers here, so one
+// error middleware covers every route. Must keep all four arguments.
+// eslint-disable-next-line no-unused-vars
+apiApp.use((err, req, res, next) => {
+  console.error("Unhandled API error:", err);
+  res.status(500).json({ error: "Internal server error" });
+});
+
 exports.api = onRequest(
   { memory: "256MiB", timeoutSeconds: 60, invoker: "public" },
   apiApp,
@@ -68,6 +76,12 @@ proxyApp.use(cors({ origin: true }));
 proxyApp.use(express.json());
 proxyApp.use("/proxy", proxyRouter);
 
+// eslint-disable-next-line no-unused-vars
+proxyApp.use((err, req, res, next) => {
+  console.error("Unhandled proxy error:", err);
+  res.status(500).json({ error: "Internal server error" });
+});
+
 exports.proxy = onRequest(
   { memory: "256MiB", timeoutSeconds: 30, invoker: "public" },
   proxyApp,

package/templates/shared/extensions/theme-block/blocks/app-block.liquid

@@ -27,7 +27,7 @@
   {% endif %}
 </div>
 
-{{ 'app-block.js' | asset_url | script_tag }}
+<script src="{{ 'app-block.js' | asset_url }}" defer></script>
 
 {% schema %}
 {

package/templates/shared/extensions/theme-block/shopify.extension.toml

@@ -1,4 +1,4 @@
-api_version = "2025-04"
+api_version = "2026-07"
 
 [[extensions]]
 name = "App Block"

package/templates/shared/firebase.json

@@ -18,7 +18,7 @@
     {
       "source": "functions",
       "codebase": "default",
-      "runtime": "nodejs20"
+      "runtime": "nodejs22"
     }
   ],
   "firestore": {

package/templates/shared/firestore.rules

@@ -1,8 +1,16 @@
 rules_version = '2';
 service cloud.firestore {
   match /databases/{database}/documents {
-    // All access goes through Cloud Functions (admin SDK).
-    // No direct client-side access — the backend is the single trusted entry point.
+    // Deny-all by default. Every read/write goes through Cloud Functions using
+    // the firebase-admin SDK, which bypasses these rules entirely — so denying
+    // all client access costs the app nothing and is the safest posture.
+    //
+    // This matters: `shopSessions` holds Shopify offline access tokens and
+    // `authNonces` holds OAuth state nonces. Either one leaking to a browser
+    // client would let an attacker impersonate the app against a merchant's
+    // shop or forge an OAuth callback. Do not add per-collection `allow` rules
+    // here — if the frontend needs data, expose it through an authenticated
+    // Cloud Functions endpoint instead.
     match /{document=**} {
       allow read, write: if false;
     }

package/templates/shopify.app.toml

@@ -15,7 +15,7 @@ redirect_urls = [
 ]
 
 [webhooks]
-api_version = "2026-01"
+api_version = "2026-07"
 
   # App lifecycle
   [[webhooks.subscriptions]]

package/templates/ts/functions/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "main": "lib/index.js",
   "engines": {
-    "node": "20"
+    "node": "22"
   },
   "scripts": {
     "build": "tsc",
@@ -16,16 +16,16 @@
     "deploy:all": "firebase deploy"
   },
   "dependencies": {
-    "cors": "^2.8.5",
-    "express": "^4.21.0",
-    "firebase-admin": "^13.0.0",
-    "firebase-functions": "^6.3.0",
-    "jsonwebtoken": "^9.0.2"
+    "cors": "^2.8.6",
+    "express": "^5.2.1",
+    "firebase-admin": "^14.2.0",
+    "firebase-functions": "^7.3.2",
+    "jsonwebtoken": "^9.0.3"
   },
   "devDependencies": {
-    "@types/cors": "^2.8.17",
-    "@types/express": "^4.17.21",
-    "@types/jsonwebtoken": "^9.0.7",
-    "typescript": "^5.6.3"
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.6",
+    "@types/jsonwebtoken": "^9.0.10",
+    "typescript": "^7.0.2"
   }
 }

package/templates/ts/functions/src/admin-api.ts

@@ -9,8 +9,9 @@ export const adminApiRouter = Router();
 adminApiRouter.use(verifySessionToken);
 
 // Shopify API version — update when Shopify releases new versions
+// (quarterly: January, April, July, October)
 // Docs: https://shopify.dev/docs/api/usage/versioning
-const API_VERSION = "2026-01";
+const API_VERSION = "2026-07";
 
 // Default app settings — returned when no settings are saved yet
 const DEFAULT_SETTINGS = {
@@ -145,7 +146,9 @@ adminApiRouter.get("/products/:id", async (req: Request, res: Response) => {
     return;
   }
 
-  const productId = req.params.id;
+  // Express 5 types params as string | string[] (repeatable params);
+  // a single ":id" segment is always a string.
+  const productId = req.params.id as string;
   // Support both raw numeric IDs and full GID format
   const gid = productId.startsWith("gid://")
     ? productId

package/templates/ts/functions/src/auth.ts

@@ -1,8 +1,22 @@
 import crypto from "crypto";
 import { getConfig } from "./config";
 import { db } from "./firebase";
+import { Timestamp } from "firebase-admin/firestore";
 import type { Request } from "firebase-functions/v2/https";
 
+// ─── Shop domain validation ──────────────────────────────────────────────
+// The shop param is attacker-controlled and ends up in a redirect Location
+// and in outbound API URLs. Shopify shop domains are always
+// "<store-handle>.myshopify.com" — reject anything else outright.
+const SHOP_DOMAIN_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9-]*\.myshopify\.com$/;
+
+function isValidShopDomain(shop: unknown): shop is string {
+  return typeof shop === "string" && SHOP_DOMAIN_PATTERN.test(shop);
+}
+
+// OAuth state nonces are single-use and short-lived.
+const NONCE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+
 /**
  * Standalone OAuth handler — no Express, no middleware overhead.
  *
@@ -21,16 +35,16 @@ export async function authHandler(req: Request, res: any): Promise<void> {
   if (urlPath === "/auth/callback") {
     await handleCallback(req, res);
   } else {
-    handleStart(req, res);
+    await handleStart(req, res);
   }
 }
 
 // ─── Step 1: Start OAuth ─────────────────────────────────────────────────
 // Merchant clicks "Install" → redirect to Shopify consent screen.
-function handleStart(req: Request, res: any): void {
+async function handleStart(req: Request, res: any): Promise<void> {
   const { shop } = req.query;
-  if (!shop || typeof shop !== "string") {
-    res.status(400).send("Missing shop parameter");
+  if (!isValidShopDomain(shop)) {
+    res.status(400).send("Invalid or missing shop parameter");
     return;
   }
 
@@ -38,11 +52,19 @@ function handleStart(req: Request, res: any): void {
   const nonce = crypto.randomBytes(16).toString("hex");
   const redirectUri = `${config.appUrl}/auth/callback`;
 
-  // Store nonce for CSRF protection
-  db.collection("authNonces").doc(nonce).set({
-    shop,
-    createdAt: new Date().toISOString(),
-  });
+  // Store nonce for CSRF protection. This MUST be awaited — the function
+  // instance can be frozen the moment we respond, so a pending write may
+  // never land and the callback would have nothing to verify against.
+  // expiresAt is a Timestamp so you can attach a Firestore TTL policy to
+  // this collection and have stale nonces purged automatically.
+  await db
+    .collection("authNonces")
+    .doc(nonce)
+    .set({
+      shop,
+      createdAt: new Date().toISOString(),
+      expiresAt: Timestamp.fromMillis(Date.now() + NONCE_TTL_MS),
+    });
 
   const authUrl =
     `https://${shop}/admin/oauth/authorize` +
@@ -59,7 +81,12 @@ function handleStart(req: Request, res: any): void {
 async function handleCallback(req: Request, res: any): Promise<void> {
   const { shop, code, hmac, state } = req.query;
 
-  if (!shop || !code || !hmac) {
+  if (!isValidShopDomain(shop)) {
+    res.status(400).send("Invalid or missing shop parameter");
+    return;
+  }
+
+  if (!code || !hmac) {
     res.status(400).send("Missing required parameters");
     return;
   }
@@ -89,10 +116,37 @@ async function handleCallback(req: Request, res: any): Promise<void> {
     return;
   }
 
-  // Clean up nonce
-  if (state) {
-    const nonceDoc = await db.collection("authNonces").doc(state as string).get();
-    if (nonceDoc.exists) await nonceDoc.ref.delete();
+  // ─── Verify state nonce (CSRF) ─────────────────────────────────────────
+  // A callback we did not initiate has no matching nonce, so an absent or
+  // unknown state must be rejected — not merely skipped.
+  if (!state || typeof state !== "string") {
+    res.status(403).send("Missing state parameter");
+    return;
+  }
+
+  const nonceRef = db.collection("authNonces").doc(state);
+  const nonceDoc = await nonceRef.get();
+  if (!nonceDoc.exists) {
+    res.status(403).send("Invalid state parameter");
+    return;
+  }
+
+  // Burn the nonce before validating it so it can never be replayed,
+  // whatever the outcome below.
+  await nonceRef.delete();
+
+  const nonceData = nonceDoc.data() ?? {};
+  const expiresAt = nonceData.expiresAt as Timestamp | undefined;
+
+  // The nonce must still be fresh AND belong to the shop calling back,
+  // otherwise a nonce issued for one store could authorize another.
+  if (!expiresAt || expiresAt.toMillis() < Date.now()) {
+    res.status(403).send("Expired state parameter");
+    return;
+  }
+  if (nonceData.shop !== shop) {
+    res.status(403).send("State parameter does not match shop");
+    return;
   }
 
   // Exchange code for access token
@@ -125,7 +179,7 @@ async function handleCallback(req: Request, res: any): Promise<void> {
     // Store session in Firestore
     await db
       .collection("shopSessions")
-      .doc(shop as string)
+      .doc(shop)
       .set({
         shop,
         accessToken: tokenData.access_token,

package/templates/ts/functions/src/firebase.ts

@@ -1,10 +1,14 @@
-import * as admin from "firebase-admin";
+import { getApps, initializeApp } from "firebase-admin/app";
+import { getFirestore } from "firebase-admin/firestore";
 
 // Initialize Firebase Admin SDK once.
 // Credentials are auto-detected on Firebase infrastructure.
 // For local dev, use `firebase emulators:start`.
-if (!admin.apps.length) {
-  admin.initializeApp();
+//
+// firebase-admin v14 removed the legacy `admin.*` namespace — use the
+// modular entry points (firebase-admin/app, firebase-admin/firestore).
+if (!getApps().length) {
+  initializeApp();
 }
 
-export const db = admin.firestore();
+export const db = getFirestore();

package/templates/ts/functions/tsconfig.json

@@ -4,9 +4,10 @@
     "noImplicitReturns": true,
     "noUnusedLocals": false,
     "outDir": "lib",
+    "rootDir": "src",
     "sourceMap": true,
     "strict": true,
-    "target": "es2020",
+    "target": "es2023",
     "esModuleInterop": true,
     "resolveJsonModule": true
   },