shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-express/src/webhooks/__tests__/process.test.ts

@@ -0,0 +1,138 @@
+import request from 'supertest';
+import express from 'express';
+import {
+  DeliveryMethod,
+  LATEST_API_VERSION,
+  LogSeverity,
+} from '@shopify/shopify-api';
+
+import {
+  shopify,
+  TEST_SHOP,
+  TEST_WEBHOOK_ID,
+  validWebhookHeaders,
+} from '../../__tests__/test-helper';
+import {process} from '../process';
+
+describe('process', () => {
+  const app = express();
+  app.post('/webhooks', express.text({type: '*/*'}), async (req, res) => {
+    await process({req, res, api: shopify.api, config: shopify.config});
+  });
+
+  const mockHandler = jest.fn();
+
+  beforeEach(() => {
+    shopify.api.webhooks.addHandlers({
+      TEST_TOPIC: {
+        deliveryMethod: DeliveryMethod.Http,
+        callbackUrl: '/webhooks',
+        callback: mockHandler,
+      },
+    });
+
+    mockHandler.mockReset();
+  });
+
+  it('triggers the handler', async () => {
+    const body = JSON.stringify({'test-body-received': true});
+
+    await request(app)
+      .post('/webhooks')
+      .set(
+        validWebhookHeaders(
+          'TEST_TOPIC',
+          body,
+          shopify.api.config.apiSecretKey,
+        ),
+      )
+      .send(body)
+      .expect(200);
+
+    expect(mockHandler).toHaveBeenCalledWith(
+      'TEST_TOPIC',
+      TEST_SHOP,
+      body,
+      TEST_WEBHOOK_ID,
+      LATEST_API_VERSION,
+    );
+
+    expect(shopify.api.config.logger.log as jest.Mock).toHaveBeenCalledWith(
+      LogSeverity.Info,
+      expect.stringContaining('Webhook processed, returned status code 200'),
+    );
+  });
+
+  it('fails gracefully if there is no handler', async () => {
+    const body = JSON.stringify({'test-body-received': true});
+
+    await request(app)
+      .post('/webhooks')
+      .set(
+        validWebhookHeaders(
+          'UNKNOWN_TOPIC',
+          body,
+          shopify.api.config.apiSecretKey,
+        ),
+      )
+      .send(body)
+      .expect(404);
+
+    expect(shopify.api.config.logger.log as jest.Mock).toHaveBeenCalledWith(
+      LogSeverity.Error,
+      expect.stringContaining(
+        'No HTTP webhooks registered for topic UNKNOWN_TOPIC',
+      ),
+    );
+  });
+
+  it('returns 401 on faulty webhook requests', async () => {
+    const body = JSON.stringify({'test-body-received': true});
+
+    const headers = {
+      ...validWebhookHeaders(
+        'TEST_TOPIC',
+        body,
+        shopify.api.config.apiSecretKey,
+      ),
+      'X-Shopify-Hmac-Sha256': 'invalid-hmac',
+    };
+
+    await request(app).post('/webhooks').set(headers).send(body).expect(401);
+
+    expect(shopify.api.config.logger.log as jest.Mock).toHaveBeenCalledWith(
+      LogSeverity.Error,
+      expect.stringContaining('Could not validate request HMAC'),
+    );
+  });
+
+  it('returns a 500 if the handler fails', async () => {
+    mockHandler.mockRejectedValueOnce(new Error('test-error'));
+
+    const body = JSON.stringify({'test-body-received': true});
+
+    await request(app)
+      .post('/webhooks')
+      .set(
+        validWebhookHeaders(
+          'TEST_TOPIC',
+          body,
+          shopify.api.config.apiSecretKey,
+        ),
+      )
+      .send(body)
+      .expect(500);
+
+    expect(mockHandler).toHaveBeenCalledWith(
+      'TEST_TOPIC',
+      TEST_SHOP,
+      body,
+      TEST_WEBHOOK_ID,
+      LATEST_API_VERSION,
+    );
+    expect(shopify.api.config.logger.log as jest.Mock).toHaveBeenCalledWith(
+      LogSeverity.Error,
+      expect.stringContaining('test-error'),
+    );
+  });
+});

package/packages/shopify-app-express/src/webhooks/index.ts

@@ -0,0 +1,54 @@
+import express, {Request, Response} from 'express';
+import {AddHandlersParams, DeliveryMethod, Shopify} from '@shopify/shopify-api';
+
+import {AppConfigInterface} from '../config-types';
+import {ApiAndConfigParams} from '../types';
+import {AppInstallations} from '../app-installations';
+import {deleteAppInstallationHandler} from '../middlewares';
+
+import {
+  ProcessWebhooksMiddleware,
+  ProcessWebhooksMiddlewareParams,
+  WebhookHandlersParam,
+} from './types';
+import {process} from './process';
+
+export function processWebhooks({
+  api,
+  config,
+}: ApiAndConfigParams): ProcessWebhooksMiddleware {
+  return function ({webhookHandlers}: ProcessWebhooksMiddlewareParams) {
+    mountWebhooks(api, config, webhookHandlers);
+
+    return [
+      express.text({type: '*/*', limit: '500kb'}),
+      async (req: Request, res: Response) => {
+        await process({
+          req,
+          res,
+          api,
+          config,
+        });
+      },
+    ];
+  };
+}
+
+function mountWebhooks(
+  api: Shopify,
+  config: AppConfigInterface,
+  handlers: WebhookHandlersParam,
+) {
+  api.webhooks.addHandlers(handlers as AddHandlersParams);
+
+  // Add our custom app uninstalled webhook
+  const appInstallations = new AppInstallations(config);
+
+  api.webhooks.addHandlers({
+    APP_UNINSTALLED: {
+      deliveryMethod: DeliveryMethod.Http,
+      callbackUrl: config.webhooks.path,
+      callback: deleteAppInstallationHandler(appInstallations, config),
+    },
+  });
+}

package/packages/shopify-app-express/src/webhooks/process.ts

@@ -0,0 +1,22 @@
+import {WebhookProcessParams} from './types';
+
+export async function process({
+  req,
+  res,
+  api,
+  config,
+}: WebhookProcessParams): Promise<void> {
+  try {
+    await api.webhooks.process({
+      rawBody: req.body,
+      rawRequest: req,
+      rawResponse: res,
+    });
+
+    config.logger.info('Webhook processed, returned status code 200');
+  } catch (error) {
+    config.logger.error(`Failed to process webhook: ${error}`);
+
+    // The library will respond even if the handler throws an error
+  }
+}

package/packages/shopify-app-express/src/webhooks/types.ts

@@ -0,0 +1,24 @@
+import {Request, RequestHandler, Response} from 'express';
+import {Shopify, WebhookHandler} from '@shopify/shopify-api';
+
+import {AppConfigInterface} from '../config-types';
+
+export type WebhookHandlersParam = Record<
+  string,
+  WebhookHandler | WebhookHandler[]
+>;
+
+export interface WebhookProcessParams {
+  req: Request;
+  res: Response;
+  api: Shopify;
+  config: AppConfigInterface;
+}
+
+export interface ProcessWebhooksMiddlewareParams {
+  webhookHandlers: WebhookHandlersParam;
+}
+
+export type ProcessWebhooksMiddleware = (
+  params: ProcessWebhooksMiddlewareParams,
+) => RequestHandler[];

package/packages/shopify-app-express/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "outDir": "./build/ts",
+    "rootDir": "src"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["**/*.test.ts", "**/*.test.tsx", "**/test/*", "**/__tests__/*"]
+}

package/packages/shopify-app-remix/.eslintrc.js

@@ -0,0 +1,3 @@
+module.exports = {
+  ignorePatterns: ['docs/', '**/*.example.tsx?'],
+};