shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-remix/src/server/__test-helpers/expect-admin-api-client.ts

@@ -0,0 +1,119 @@
+import {Session} from '@shopify/shopify-api';
+
+import {LATEST_API_VERSION} from '..';
+import type {AdminApiContext} from '../clients';
+
+import {mockExternalRequest} from './request-mock';
+import {TEST_SHOP} from './const';
+
+const REQUEST_URL = `https://${TEST_SHOP}/admin/api/${LATEST_API_VERSION}/customers.json`;
+
+export function expectAdminApiClient(
+  factory: () => Promise<{
+    admin: AdminApiContext;
+    expectedSession: Session;
+    actualSession: Session;
+  }>,
+) {
+  it('REST client can perform GET requests', async () => {
+    // GIVEN
+    const {admin} = await factory();
+    await mockExternalRequest({
+      request: new Request(REQUEST_URL),
+      response: new Response(JSON.stringify({customers: []})),
+    });
+
+    // WHEN
+    const response = await admin.rest.get({path: 'customers'});
+
+    // THEN
+    expect(response.status).toEqual(200);
+    expect(await response.json()).toEqual({customers: []});
+  });
+
+  it('REST client can perform POST requests', async () => {
+    // GIVEN
+    const {admin} = await factory();
+    await mockExternalRequest({
+      request: new Request(REQUEST_URL, {method: 'POST'}),
+      response: new Response(JSON.stringify({customers: []})),
+    });
+
+    // WHEN
+    const response = await admin.rest.post({
+      path: '/customers.json',
+      data: '',
+    });
+
+    // THEN
+    expect(response.status).toEqual(200);
+    expect(await response.json()).toEqual({customers: []});
+  });
+
+  it('REST client can perform PUT requests', async () => {
+    // GIVEN
+    const {admin} = await factory();
+    await mockExternalRequest({
+      request: new Request(REQUEST_URL, {method: 'PUT'}),
+      response: new Response(JSON.stringify({customers: []})),
+    });
+
+    // WHEN
+    const response = await admin.rest.put({
+      path: '/customers.json',
+      data: '',
+    });
+
+    // THEN
+    expect(response.status).toEqual(200);
+    expect(await response.json()).toEqual({customers: []});
+  });
+
+  it('REST client can perform DELETE requests', async () => {
+    // GIVEN
+    const {admin} = await factory();
+    await mockExternalRequest({
+      request: new Request(REQUEST_URL, {method: 'DELETE'}),
+      response: new Response(JSON.stringify({customers: []})),
+    });
+
+    // WHEN
+    const response = await admin.rest.delete({path: '/customers.json'});
+
+    // THEN
+    expect(response.status).toEqual(200);
+    expect(await response.json()).toEqual({customers: []});
+  });
+
+  it('GraphQL client can perform requests', async () => {
+    // GIVEN
+    const {admin, actualSession} = await factory();
+    await mockExternalRequest({
+      request: new Request(
+        `https://${TEST_SHOP}/admin/api/${LATEST_API_VERSION}/graphql.json`,
+        {
+          method: 'POST',
+          headers: {'X-Shopify-Access-Token': actualSession.accessToken!},
+        },
+      ),
+      response: new Response(
+        JSON.stringify({data: {shop: {name: 'Test shop'}}}),
+      ),
+    });
+
+    // WHEN
+    const response = await admin.graphql('{ shop { name } }');
+
+    // THEN
+    expect(response.status).toEqual(200);
+    expect(await response.json()).toEqual({data: {shop: {name: 'Test shop'}}});
+  });
+
+  it('returns a session object as part of the context', async () => {
+    // GIVEN
+    const {expectedSession, actualSession} = await factory();
+
+    // THEN
+    expect(expectedSession).toEqual(actualSession);
+  });
+}

package/packages/shopify-app-remix/src/server/__test-helpers/expect-begin-auth-redirect.ts

@@ -0,0 +1,22 @@
+import {TEST_SHOP} from './const';
+import {testConfig} from './test-config';
+
+export function expectBeginAuthRedirect(
+  config: ReturnType<typeof testConfig>,
+  response: Response,
+) {
+  expect(response.status).toEqual(302);
+
+  const {hostname, pathname, searchParams} = new URL(
+    response.headers.get('location')!,
+  );
+
+  expect(hostname).toBe(TEST_SHOP);
+  expect(pathname).toBe('/admin/oauth/authorize');
+  expect(searchParams.get('client_id')).toBe(config.apiKey);
+  expect(searchParams.get('scope')).toBe(config.scopes!.toString());
+  expect(searchParams.get('redirect_uri')).toBe(
+    `${config.appUrl}/auth/callback`,
+  );
+  expect(searchParams.get('state')).toStrictEqual(expect.any(String));
+}

package/packages/shopify-app-remix/src/server/__test-helpers/expect-document-request-headers.ts

@@ -0,0 +1,25 @@
+import {APP_BRIDGE_URL} from '../authenticate/const';
+
+import {TEST_SHOP} from './const';
+
+export function expectDocumentRequestHeaders(
+  response: Response,
+  isEmbeddedApp = true,
+) {
+  const headers = response.headers;
+
+  if (isEmbeddedApp) {
+    expect(headers.get('Content-Security-Policy')).toEqual(
+      `frame-ancestors https://${encodeURIComponent(
+        TEST_SHOP,
+      )} https://admin.shopify.com https://*.spin.dev;`,
+    );
+    expect(headers.get('Link')).toEqual(
+      `<${APP_BRIDGE_URL}>; rel="preload"; as="script";`,
+    );
+  } else {
+    expect(headers.get('Content-Security-Policy')).toEqual(
+      `frame-ancestors 'none';`,
+    );
+  }
+}

package/packages/shopify-app-remix/src/server/__test-helpers/expect-exit-iframe.ts

@@ -0,0 +1,37 @@
+import {APP_URL, BASE64_HOST, TEST_SHOP} from './const';
+
+interface ExpectExitIframeRedirectOptions {
+  shop?: string;
+  host?: string | null;
+  destination?: string;
+  addHostToExitIframePath?: boolean;
+}
+
+export function expectExitIframeRedirect(
+  response: Response,
+  {
+    shop = TEST_SHOP,
+    host = BASE64_HOST,
+    destination = `/auth?shop=${shop}`,
+    addHostToExitIframePath = true,
+  }: ExpectExitIframeRedirectOptions = {},
+) {
+  expect(response.status).toBe(302);
+
+  const {pathname, searchParams} = new URL(
+    response.headers.get('location')!,
+    APP_URL,
+  );
+  expect(pathname).toBe('/auth/exit-iframe');
+
+  expect(searchParams.get('shop')).toBe(shop);
+
+  let expectedDestination = destination;
+  if (host) {
+    expect(searchParams.get('host')).toBe(host);
+    if (addHostToExitIframePath) {
+      expectedDestination = destination.concat(`&host=${host}`);
+    }
+  }
+  expect(searchParams.get('exitIframe')).toBe(expectedDestination);
+}

package/packages/shopify-app-remix/src/server/__test-helpers/expect-login-redirect.ts

@@ -0,0 +1,8 @@
+import {APP_URL} from './const';
+
+export function expectLoginRedirect(response: Response) {
+  expect(response.status).toBe(302);
+
+  const {pathname} = new URL(response.headers.get('location')!, APP_URL);
+  expect(pathname).toBe('/auth/login');
+}

package/packages/shopify-app-remix/src/server/__test-helpers/expect-storefront-api-client.ts

@@ -0,0 +1,50 @@
+import {Session} from '@shopify/shopify-api';
+
+import {LATEST_API_VERSION} from '..';
+import type {StorefrontContext} from '../clients';
+
+import {mockExternalRequest} from './request-mock';
+import {TEST_SHOP} from './const';
+
+export function expectStorefrontApiClient(
+  factory: () => Promise<{
+    storefront: StorefrontContext;
+    expectedSession: Session;
+    actualSession: Session;
+  }>,
+) {
+  it('Storefront client can perform GraphQL Requests', async () => {
+    // GIVEN
+    const {storefront, actualSession} = await factory();
+    const apiResponse = {data: {blogs: {nodes: [{id: 1}]}}};
+    await mockExternalRequest({
+      request: new Request(
+        `https://${TEST_SHOP}/api/${LATEST_API_VERSION}/graphql.json`,
+        {
+          method: 'POST',
+          headers: {
+            'Shopify-Storefront-Private-Token': actualSession.accessToken!,
+          },
+        },
+      ),
+      response: new Response(JSON.stringify(apiResponse)),
+    });
+
+    // WHEN
+    const response = await storefront.graphql(
+      'blogs(first: 1) { nodes { id }}',
+    );
+
+    // THEN
+    expect(response.status).toEqual(200);
+    expect(await response.json()).toEqual(apiResponse);
+  });
+
+  it('Storefront client uses the correct session', async () => {
+    // GIVEN
+    const {expectedSession, actualSession} = await factory();
+
+    // THEN
+    expect(expectedSession).toEqual(actualSession);
+  });
+}

package/packages/shopify-app-remix/src/server/__test-helpers/get-hmac.ts

@@ -0,0 +1,10 @@
+import crypto from 'crypto';
+
+import {API_SECRET_KEY} from './const';
+
+export function getHmac(body: string): string {
+  return crypto
+    .createHmac('sha256', API_SECRET_KEY)
+    .update(body, 'utf8')
+    .digest('base64');
+}

package/packages/shopify-app-remix/src/server/__test-helpers/get-jwt.ts

@@ -0,0 +1,31 @@
+import {JwtPayload} from '@shopify/shopify-api';
+import jwt from 'jsonwebtoken';
+
+import {API_KEY, API_SECRET_KEY, TEST_SHOP, USER_ID} from './const';
+
+interface TestJwt {
+  token: string;
+  payload: JwtPayload;
+}
+
+export function getJwt(overrides: Partial<JwtPayload> = {}): TestJwt {
+  const date = new Date();
+  const payload = {
+    iss: `${TEST_SHOP}/admin`,
+    dest: `https://${TEST_SHOP}`,
+    aud: API_KEY,
+    sub: `${USER_ID}`,
+    exp: date.getTime() / 1000 + 3600,
+    nbf: date.getTime() / 1000 - 3600,
+    iat: date.getTime() / 1000 - 3600,
+    jti: '1234567890',
+    sid: '0987654321',
+    ...overrides,
+  };
+
+  const token = jwt.sign(payload, API_SECRET_KEY, {
+    algorithm: 'HS256',
+  });
+
+  return {token, payload};
+}

package/packages/shopify-app-remix/src/server/__test-helpers/get-thrown-response.ts

@@ -0,0 +1,17 @@
+export async function getThrownResponse(
+  callback: (request: Request) => Promise<any>,
+  request: Request,
+): Promise<Response> {
+  try {
+    await callback(request);
+  } catch (response) {
+    if (!(response instanceof Response)) {
+      throw new Error(
+        `${request.method} request to ${request.url} threw an error instead of a response: ${response}`,
+      );
+    }
+    return response;
+  }
+
+  throw new Error(`${request.method} request to ${request.url} did not throw`);
+}

package/packages/shopify-app-remix/src/server/__test-helpers/index.ts

@@ -0,0 +1,14 @@
+export * from './const';
+export * from './expect-admin-api-client';
+export * from './expect-begin-auth-redirect';
+export * from './expect-document-request-headers';
+export * from './expect-exit-iframe';
+export * from './expect-login-redirect';
+export * from './expect-storefront-api-client';
+export * from './get-hmac';
+export * from './get-jwt';
+export * from './get-thrown-response';
+export * from './request-mock';
+export * from './setup-valid-session';
+export * from './sign-request-cookie';
+export * from './test-config';

package/packages/shopify-app-remix/src/server/__test-helpers/request-mock.ts

@@ -0,0 +1,169 @@
+import fetchMock, {MockParams} from 'jest-fetch-mock';
+
+interface MockExternalRequestArg {
+  request?: Request;
+  response: Response;
+}
+
+interface ResponseParams {
+  body: string;
+  init: MockParams;
+}
+
+let requestMocks: MockExternalRequestArg[] = [];
+
+let skipMockChecksFlag = false;
+
+export async function mockExternalRequest({
+  request,
+  response,
+}: MockExternalRequestArg) {
+  requestMocks.push({request, response});
+
+  const {body, init} = await mockParams(response);
+  fetchMock.mockResponse(body, init);
+}
+
+export async function mockExternalRequests(...mocks: MockExternalRequestArg[]) {
+  const parsedResponses: [string, MockParams][] = [];
+  for (const mock of mocks) {
+    const {request, response} = mock;
+
+    requestMocks.push({request, response});
+
+    const {body, init} = await mockParams(response);
+    parsedResponses.push([body, init]);
+  }
+
+  fetchMock.mockResponses(...parsedResponses);
+}
+
+async function mockParams(response: Response): Promise<ResponseParams> {
+  return {
+    body: await response.text(),
+    init: {
+      status: response.status,
+      statusText: response.statusText,
+      url: response.url,
+      headers: {
+        ...Object.fromEntries(response.headers.entries()),
+        'content-type': 'application/json',
+      },
+    },
+  };
+}
+
+export async function validateMocks() {
+  if (requestMocks.length === 0 && fetchMock.mock.calls.length === 0) {
+    return;
+  }
+
+  let matchedRequests = 0;
+
+  for (const [index, requestMock] of requestMocks.entries()) {
+    const {request} = requestMock;
+
+    if (fetchMock.mock.calls.length === 0) {
+      continue;
+    }
+
+    matchedRequests++;
+    const [url, init] = fetchMock.mock.calls[index];
+
+    const expected: Record<string, any> = {};
+    const actual: Record<string, any> = {};
+
+    if (request?.url) {
+      expected.url = new URL(request.url);
+      actual.url = new URL(url as string);
+    }
+
+    if (request?.method) {
+      expected.method = request.method;
+      actual.method = init?.method || 'GET';
+    }
+
+    if (request?.body) {
+      const bodyBuffer = await stream2buffer(request.body);
+      const bodyString = new TextDecoder('utf-8').decode(bodyBuffer);
+
+      expected.body = expect.stringContaining(bodyString);
+      actual.body = init?.body?.toString();
+    }
+
+    if (request?.headers) {
+      expected.headers = {};
+      actual.headers = {};
+
+      // eslint-disable-next-line no-warning-comments
+      // TODO: we're currently not checking the headers properly. We should fix this.
+      Object.entries(request.headers).forEach(([key, value]) => {
+        expected.headers[key] = value;
+        actual.headers[key] = (init?.headers as any)[key];
+      });
+    }
+
+    try {
+      expect(actual).toEqual(expected);
+    } catch (error) {
+      error.message = `${init?.method} request made to ${url} does not match expectation:\n\n${error.message}`;
+      throw error;
+    }
+  }
+
+  if (requestMocks.length > matchedRequests) {
+    throw new Error(
+      `Expected ${
+        requestMocks.length
+      } request(s) to be made but they were not:\n\n${JSON.stringify(
+        requestMocks,
+        null,
+        2,
+      )}`,
+    );
+  }
+
+  if (fetchMock.mock.calls.length > matchedRequests) {
+    throw new Error(
+      `${
+        fetchMock.mock.calls.length
+      } unexpected request(s) were made, make sure to mock all expected requests:\n\n${JSON.stringify(
+        fetchMock.mock.calls,
+        null,
+        2,
+      )}`,
+    );
+  }
+}
+
+async function stream2buffer(
+  stream: ReadableStream<Uint8Array>,
+): Promise<Buffer> {
+  const buffers = [];
+
+  for await (const data of stream as any) {
+    if (typeof data === 'number') {
+      buffers.push(Uint8Array.from([data]));
+    } else {
+      buffers.push(data);
+    }
+  }
+
+  return Buffer.concat(buffers);
+}
+
+export function skipMockChecks(value: boolean) {
+  skipMockChecksFlag = value;
+}
+
+beforeEach(() => {
+  skipMockChecksFlag = false;
+  requestMocks = [];
+  fetchMock.resetMocks();
+});
+
+afterEach(async () => {
+  if (!skipMockChecksFlag) {
+    await validateMocks();
+  }
+});

package/packages/shopify-app-remix/src/server/__test-helpers/setup-valid-session.ts

@@ -0,0 +1,45 @@
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+import {Session} from '@shopify/shopify-api';
+
+import {TEST_SHOP, USER_ID} from './const';
+
+export async function setUpValidSession(
+  sessionStorage: SessionStorage,
+  sessionParams?: Partial<Session>,
+): Promise<Session> {
+  const overrides: Partial<Session> = {};
+  let id = `offline_${TEST_SHOP}`;
+  if (sessionParams?.isOnline) {
+    id = `${TEST_SHOP}_${USER_ID}`;
+    // Expires one day from now
+    overrides.expires =
+      sessionParams.expires || new Date(Date.now() + 1000 * 3600 * 24);
+    overrides.onlineAccessInfo = {
+      associated_user_scope: 'testScope',
+      expires_in: 3600 * 24,
+      associated_user: {
+        id: USER_ID,
+        account_owner: true,
+        collaborator: true,
+        email: 'test@test.test',
+        email_verified: true,
+        first_name: 'Test',
+        last_name: 'User',
+        locale: 'en-US',
+      },
+    };
+  }
+
+  const session = new Session({
+    id,
+    shop: TEST_SHOP,
+    isOnline: Boolean(sessionParams?.isOnline),
+    state: 'test',
+    accessToken: 'totally_real_token',
+    scope: 'testScope',
+    ...overrides,
+  });
+  await sessionStorage.storeSession(session);
+
+  return session;
+}

package/packages/shopify-app-remix/src/server/__test-helpers/sign-request-cookie.ts

@@ -0,0 +1,21 @@
+import {getHmac} from './get-hmac';
+
+export function signRequestCookie({
+  request,
+  cookieName,
+  cookieValue,
+}: {
+  request: Request;
+  cookieName: string;
+  cookieValue: string;
+}) {
+  const signedCookieValue = getHmac(cookieValue);
+
+  request.headers.set(
+    'Cookie',
+    [
+      `${cookieName}=${cookieValue}`,
+      `${cookieName}.sig=${signedCookieValue}`,
+    ].join(';'),
+  );
+}

package/packages/shopify-app-remix/src/server/__test-helpers/test-config.ts

@@ -0,0 +1,112 @@
+import {
+  LATEST_API_VERSION,
+  LogSeverity,
+  ShopifyRestResources,
+} from '@shopify/shopify-api';
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+import {MemorySessionStorage} from '@shopify/shopify-app-session-storage-memory';
+
+import type {AppConfigArg} from '../config-types';
+import type {FutureFlagOptions, FutureFlags} from '../future/flags';
+
+import {API_KEY, API_SECRET_KEY, APP_URL} from './const';
+
+/*
+ * This object mandates that all existing future flags be activated for tests. If a new flag is added, this object must
+ * be updated to include it, which will also cause all tests to use the new behaviour by default (and likely fail).
+ *
+ * This way, we'll always ensure our tests are covering all future flags. Please make sure to also have tests for the
+ * old behaviour.
+ */
+const TEST_FUTURE_FLAGS: Required<{[key in keyof FutureFlags]: true}> = {
+  v3_authenticatePublic: true,
+  v3_webhookAdminContext: true,
+  v3_lineItemBilling: true,
+  unstable_newEmbeddedAuthStrategy: true,
+} as const;
+
+const TEST_CONFIG = {
+  apiKey: API_KEY,
+  apiSecretKey: API_SECRET_KEY,
+  scopes: ['testScope'] as any,
+  apiVersion: LATEST_API_VERSION,
+  appUrl: APP_URL,
+  logger: {
+    log: jest.fn(),
+    level: LogSeverity.Debug,
+  },
+  isEmbeddedApp: true,
+  sessionStorage: new MemorySessionStorage(),
+  future: TEST_FUTURE_FLAGS,
+} as const;
+
+// Reset the config object before each test
+beforeEach(() => {
+  TEST_CONFIG.logger.log.mockReset();
+  (TEST_CONFIG as any).sessionStorage = new MemorySessionStorage();
+});
+
+export function testConfig<
+  Overrides extends TestOverridesArg<Future>,
+  Future extends FutureFlagOptions,
+>(
+  {future, ...overrides}: Overrides & {future?: Future} = {} as Overrides & {
+    future?: Future;
+  },
+): TestConfig<Overrides, Future> {
+  return {
+    ...TEST_CONFIG,
+    ...overrides,
+    logger: {
+      ...TEST_CONFIG.logger,
+      ...(overrides as NonNullable<Overrides>).logger,
+    },
+    future: {
+      ...TEST_CONFIG.future,
+      ...future,
+    },
+  } as any;
+}
+
+/*
+ * This type combines both passed in types, by ignoring any keys from Type1 that are present (and not undefined)
+ * in Type2, and then adding any keys from Type1 that are not present in Type2.
+ *
+ * This effectively enables us to create a type that is the const TEST_CONFIG below, plus any overrides passed in with
+ * the output being a const object.
+ */
+type Modify<Type1, Type2> = {
+  [key in keyof Type2 as Type2[key] extends undefined
+    ? never
+    : key]: Type2[key];
+} & {
+  [key in keyof Type1 as key extends keyof Type2 ? never : key]: Type1[key];
+};
+
+type DefaultedFutureFlags<Future> = Modify<typeof TEST_CONFIG.future, Future>;
+
+/*
+ * We omit the future prop and then redefine it with a partial of that object so we can pass the fully typed object in
+ * to AppConfigArg.
+ */
+type TestOverrides<Future> = Partial<
+  Omit<
+    AppConfigArg<
+      ShopifyRestResources,
+      SessionStorage,
+      DefaultedFutureFlags<Future>
+    >,
+    'future'
+  > & {
+    future: Partial<DefaultedFutureFlags<Future>>;
+  }
+>;
+
+type TestOverridesArg<Future> = undefined | TestOverrides<Future>;
+
+type TestConfig<Overrides extends TestOverridesArg<Future>, Future> = Modify<
+  typeof TEST_CONFIG,
+  Overrides
+> & {
+  future: Modify<typeof TEST_CONFIG.future, Future>;
+};