shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-remix/src/server/__tests__/override-logger.test.ts

@@ -0,0 +1,101 @@
+import '@shopify/shopify-api/adapters/web-api';
+import '../adapters/node';
+
+import {
+  ConfigParams,
+  LATEST_API_VERSION,
+  LogSeverity,
+  shopifyApi,
+} from '@shopify/shopify-api';
+
+import {overrideLogger} from '../override-logger';
+import {SHOPIFY_REMIX_LIBRARY_VERSION} from '../version';
+
+const LOG_FN = jest.fn();
+const VALID_API_CONFIG: ConfigParams = {
+  apiKey: 'test-key',
+  apiSecretKey: 'test-secret',
+  scopes: ['test-scope'],
+  apiVersion: LATEST_API_VERSION,
+  hostName: 'test-host',
+  isEmbeddedApp: true,
+  logger: {log: LOG_FN, level: LogSeverity.Debug},
+};
+
+describe('override logger', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
+  it('overrides the package name in log messages', () => {
+    // GIVEN
+    const logger = overrideLogger(shopifyApi(VALID_API_CONFIG).logger);
+
+    // WHEN
+    logger.log(LogSeverity.Info, 'Test message');
+
+    // THEN
+    expect(LOG_FN).toHaveBeenCalledWith(
+      LogSeverity.Info,
+      '[shopify-app/INFO] Test message',
+    );
+  });
+
+  it('deprecate allows future versions to go through', () => {
+    // GIVEN
+    const logger = overrideLogger(shopifyApi(VALID_API_CONFIG).logger);
+
+    // WHEN
+    logger.deprecated('9999.0.0', 'Test deprecation message');
+
+    // THEN
+    expect(LOG_FN).toHaveBeenCalledWith(
+      LogSeverity.Warning,
+      '[shopify-app/WARNING] [Deprecated | 9999.0.0] Test deprecation message',
+    );
+  });
+
+  it('deprecate fails on the current version', () => {
+    // GIVEN
+    const logger = overrideLogger(shopifyApi(VALID_API_CONFIG).logger);
+
+    // THEN
+    expect(() =>
+      logger.deprecated(
+        SHOPIFY_REMIX_LIBRARY_VERSION,
+        'Test deprecation message',
+      ),
+    ).toThrowError(
+      `Feature was deprecated in version ${SHOPIFY_REMIX_LIBRARY_VERSION}`,
+    );
+  });
+
+  it.each([
+    LogSeverity.Debug,
+    LogSeverity.Info,
+    LogSeverity.Warning,
+    LogSeverity.Error,
+  ])('logs messages normally at level %s', (level) => {
+    // GIVEN
+    const logger = overrideLogger(shopifyApi(VALID_API_CONFIG).logger);
+
+    // WHEN
+    switch (level) {
+      case LogSeverity.Debug:
+        logger.debug('Test debug message');
+        break;
+      case LogSeverity.Info:
+        logger.info('Test info message');
+        break;
+      case LogSeverity.Warning:
+        logger.warning('Test warning message');
+        break;
+      case LogSeverity.Error:
+        logger.error('Test error message');
+        break;
+    }
+
+    // THEN
+    expect(LOG_FN).toHaveBeenCalledWith(level, expect.anything());
+  });
+});

package/packages/shopify-app-remix/src/server/__tests__/shopify-app.test.ts

@@ -0,0 +1,119 @@
+import {ShopifyError} from '@shopify/shopify-api';
+import * as shopifyApiPackage from '@shopify/shopify-api';
+
+import {
+  shopifyApp,
+  LATEST_API_VERSION as APP_LATEST_API_VERSION,
+  LogSeverity,
+  DeliveryMethod,
+  BillingInterval,
+  AppDistribution,
+  ApiVersion,
+} from '../index';
+import {testConfig} from '../__test-helpers';
+
+describe('shopifyApp', () => {
+  /* eslint-disable no-process-env */
+  const oldEnv = process.env;
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = {...oldEnv};
+  });
+
+  afterAll(() => {
+    process.env = oldEnv;
+  });
+  /* eslint-enable no-process-env */
+
+  it('can create shopify object', () => {
+    // GIVEN
+    const shopify = shopifyApp(testConfig());
+
+    // THEN
+    expect(shopify).toBeDefined();
+  });
+
+  it('has login function when distribution is not ShopifyAdmin', () => {
+    // GIVEN
+    const shopify = shopifyApp(testConfig());
+
+    // THEN
+    expect(shopify.login).toBeDefined();
+  });
+
+  it('does not have login function when distribution is ShopifyAdmin', () => {
+    // GIVEN
+    const shopify = shopifyApp(
+      testConfig({
+        distribution: AppDistribution.ShopifyAdmin,
+        adminApiAccessToken: 'dummy_token',
+      }),
+    );
+
+    // THEN
+    expect(shopify).not.toHaveProperty('login');
+  });
+
+  it('fails with an invalid config', () => {
+    expect(() => shopifyApp({} as any)).toThrowError(ShopifyError);
+  });
+
+  it("fixes the port if it's not set", () => {
+    // GIVEN
+    jest.spyOn(shopifyApiPackage, 'shopifyApi');
+    // eslint-disable-next-line no-process-env
+    process.env.PORT = '1234';
+
+    // WHEN
+    shopifyApp(testConfig({appUrl: 'http://localhost'}));
+
+    // THEN
+    expect(shopifyApiPackage.shopifyApi).toHaveBeenCalledWith(
+      expect.objectContaining({
+        appUrl: 'http://localhost:1234',
+      }),
+    );
+  });
+
+  it('applies user agent prefix', () => {
+    // GIVEN
+    jest.spyOn(shopifyApiPackage, 'shopifyApi');
+    const config = testConfig({
+      userAgentPrefix: 'test',
+    });
+
+    // WHEN
+    shopifyApp(config);
+
+    // THEN
+    const {userAgentPrefix} = (shopifyApiPackage.shopifyApi as any).mock
+      .calls[1][0];
+
+    expect(userAgentPrefix).toMatch(
+      /^test \| Shopify Remix Library v[0-9]+\.[0-9]+\.[0-9]+(-rc.[0-9]+)?$/,
+    );
+  });
+
+  it('properly re-exports required @shopify/shopify-api imports', () => {
+    // This test doesn't actually test anything, but it's here to make sure that we're actually importing the values
+    const imports = [
+      APP_LATEST_API_VERSION,
+      LogSeverity,
+      DeliveryMethod,
+      BillingInterval,
+      ApiVersion,
+    ];
+
+    expect(imports).not.toContain(undefined);
+  });
+
+  it('fails if no session storage is given', () => {
+    // GIVEN
+    const config = testConfig({sessionStorage: undefined});
+    delete (config as any).sessionStorage;
+
+    // THEN
+    expect(() => shopifyApp(config as any)).toThrowError(ShopifyError);
+  });
+});

package/packages/shopify-app-remix/src/server/adapters/__tests__/node-app-bridge-url.test.ts

@@ -0,0 +1,18 @@
+import {APP_BRIDGE_URL} from '../../authenticate/const';
+import {appBridgeUrl} from '../../authenticate/helpers';
+
+describe('node setup import', () => {
+  /* eslint-disable no-process-env */
+  it('overwrites the App Bridge URL from the env var when present', async () => {
+    // GIVEN
+    expect(appBridgeUrl()).toEqual(APP_BRIDGE_URL);
+    process.env.APP_BRIDGE_URL = 'http://localhost:9876/app-bridge.js';
+
+    // WHEN
+    await require('../node/index');
+
+    // THEN
+    expect(appBridgeUrl()).toEqual(process.env.APP_BRIDGE_URL);
+  });
+  /* eslint-enable no-process-env */
+});

package/packages/shopify-app-remix/src/server/adapters/__tests__/node.test.ts

@@ -0,0 +1,28 @@
+import {setCrypto} from '@shopify/shopify-api/runtime';
+
+describe('node setup import', () => {
+  let previousCrypto: any;
+
+  beforeAll(() => {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    previousCrypto = require('@shopify/shopify-api/runtime').crypto;
+    setCrypto(undefined as any);
+  });
+
+  afterAll(() => {
+    setCrypto(previousCrypto);
+  });
+
+  it('sets up the crypto library only when the import is called', async () => {
+    // GIVEN
+    const cryptoBefore = (await require('@shopify/shopify-api/runtime')).crypto;
+    expect(cryptoBefore).toBeUndefined();
+
+    // WHEN
+    await require('../node');
+
+    // THEN
+    const cryptoAfter = (await require('@shopify/shopify-api/runtime')).crypto;
+    expect(cryptoAfter).toBeDefined();
+  });
+});

package/packages/shopify-app-remix/src/server/adapters/node/__tests__/setup-jest.ts

@@ -0,0 +1,10 @@
+import fetchMock from 'jest-fetch-mock';
+import '@shopify/shopify-api/adapters/web-api';
+import '..';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-remix/src/server/adapters/node/index.ts

@@ -0,0 +1,20 @@
+import crypto from 'crypto';
+
+import {
+  setAbstractRuntimeString,
+  setCrypto,
+} from '@shopify/shopify-api/runtime';
+
+import {setAppBridgeUrlOverride} from '../../authenticate/helpers';
+
+setCrypto(crypto as any);
+
+setAbstractRuntimeString(() => {
+  return `Remix (Node)`;
+});
+
+/* eslint-disable no-process-env */
+if (process.env.APP_BRIDGE_URL) {
+  setAppBridgeUrlOverride(process.env.APP_BRIDGE_URL);
+}
+/* eslint-enable no-process-env */

package/packages/shopify-app-remix/src/server/adapters/vercel/__tests__/setup-jest.ts

@@ -0,0 +1,12 @@
+import fetchMock from 'jest-fetch-mock';
+import '@shopify/shopify-api/adapters/web-api';
+import '..';
+import {setAbstractFetchFunc} from '@shopify/shopify-api/runtime';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});
+setAbstractFetchFunc(fetch);

package/packages/shopify-app-remix/src/server/adapters/vercel/index.ts

@@ -0,0 +1,13 @@
+import {setAbstractFetchFunc} from '@shopify/shopify-api/runtime';
+import {installGlobals} from '@remix-run/node';
+
+import '../node';
+
+installGlobals();
+
+const fetchFunc = fetch;
+setAbstractFetchFunc(async (...args) => {
+  const response = await fetchFunc.apply(this, args);
+
+  return response;
+});

package/packages/shopify-app-remix/src/server/authenticate/admin/__tests__/admin-client.test.ts

@@ -0,0 +1,181 @@
+import {
+  ApiVersion,
+  HttpMaxRetriesError,
+  LATEST_API_VERSION,
+  SESSION_COOKIE_NAME,
+  Session,
+} from '@shopify/shopify-api';
+import {restResources} from '@shopify/shopify-api/rest/admin/2023-04';
+
+import {
+  APP_URL,
+  BASE64_HOST,
+  TEST_SHOP,
+  getJwt,
+  getThrownResponse,
+  setUpValidSession,
+  signRequestCookie,
+  testConfig,
+  mockExternalRequest,
+  expectAdminApiClient,
+} from '../../../__test-helpers';
+import {shopifyApp} from '../../..';
+import {AdminApiContext} from '../../../clients';
+
+describe('admin.authenticate context', () => {
+  expectAdminApiClient(async () => {
+    const {
+      admin,
+      expectedSession,
+      session: actualSession,
+    } = await setUpEmbeddedFlow();
+
+    return {admin, expectedSession, actualSession};
+  });
+
+  it('re-throws errors other than HttpResponseErrors on GraphQL requests', async () => {
+    // GIVEN
+    const {admin} = await setUpEmbeddedFlow();
+
+    // WHEN
+    await mockGraphqlRequest()(429);
+    await mockGraphqlRequest()(429);
+
+    // THEN
+    await expect(async () =>
+      admin.graphql(
+        'mutation myMutation($ID: String!) { shop(ID: $ID) { name } }',
+        {variables: {ID: '123'}, tries: 2},
+      ),
+    ).rejects.toThrowError(HttpMaxRetriesError);
+  });
+
+  it('re-throws errors other than HttpResponseErrors on REST requests', async () => {
+    // GIVEN
+    const {admin} = await setUpEmbeddedFlow();
+
+    // WHEN
+    await mockRestRequest(429);
+    await mockRestRequest(429);
+
+    // THEN
+    await expect(async () =>
+      admin.rest.get({path: '/customers.json', tries: 2}),
+    ).rejects.toThrowError(HttpMaxRetriesError);
+  });
+
+  describe.each([
+    {
+      testGroup: 'REST client',
+      mockRequest: mockRestRequest,
+      action: async (admin: AdminApiContext, _session: Session) =>
+        admin.rest.get({path: '/customers.json'}),
+    },
+    {
+      testGroup: 'REST resources',
+      mockRequest: mockRestRequest,
+      action: async (admin: AdminApiContext, session: Session) =>
+        admin.rest.resources.Customer.all({session}),
+    },
+    {
+      testGroup: 'GraphQL client',
+      mockRequest: mockGraphqlRequest(),
+      action: async (admin: AdminApiContext, _session: Session) =>
+        admin.graphql('{ shop { name } }'),
+    },
+    {
+      testGroup: 'GraphQL client with options',
+      mockRequest: mockGraphqlRequest('2021-01' as ApiVersion),
+      action: async (admin: AdminApiContext, _session: Session) =>
+        admin.graphql(
+          'mutation myMutation($ID: String!) { shop(ID: $ID) { name } }',
+          {
+            variables: {ID: '123'},
+            apiVersion: '2021-01' as ApiVersion,
+            headers: {custom: 'header'},
+            tries: 2,
+          },
+        ),
+    },
+  ])(
+    '$testGroup re-authentication',
+    ({testGroup: _testGroup, mockRequest, action}) => {
+      it('throws a response when request receives a non-401 response and not embedded', async () => {
+        // GIVEN
+        const {admin, session} = await setUpNonEmbeddedFlow();
+        const requestMock = await mockRequest(403);
+
+        // WHEN
+        const response = await getThrownResponse(
+          async () => action(admin, session),
+          requestMock,
+        );
+
+        // THEN
+        expect(response.status).toEqual(403);
+      });
+    },
+  );
+});
+
+async function setUpEmbeddedFlow() {
+  const shopify = shopifyApp(testConfig({restResources}));
+  const expectedSession = await setUpValidSession(shopify.sessionStorage);
+
+  const {token} = getJwt();
+  const request = new Request(
+    `${APP_URL}?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}&id_token=${token}`,
+  );
+
+  return {
+    shopify,
+    expectedSession,
+    ...(await shopify.authenticate.admin(request)),
+  };
+}
+
+async function setUpNonEmbeddedFlow() {
+  const shopify = shopifyApp(testConfig({restResources, isEmbeddedApp: false}));
+  const session = await setUpValidSession(shopify.sessionStorage);
+
+  const request = new Request(`${APP_URL}?shop=${TEST_SHOP}`);
+  signRequestCookie({
+    request,
+    cookieName: SESSION_COOKIE_NAME,
+    cookieValue: session.id,
+  });
+
+  return {
+    shopify,
+    ...(await shopify.authenticate.admin(request)),
+  };
+}
+
+async function mockRestRequest(status) {
+  const requestMock = new Request(
+    `https://${TEST_SHOP}/admin/api/${LATEST_API_VERSION}/customers.json`,
+  );
+
+  await mockExternalRequest({
+    request: requestMock,
+    response: new Response('{}', {status}),
+  });
+
+  return requestMock;
+}
+
+function mockGraphqlRequest(apiVersion = LATEST_API_VERSION) {
+  return async function (status) {
+    const requestMock = new Request(
+      `https://${TEST_SHOP}/admin/api/${apiVersion}/graphql.json`,
+      {method: 'POST'},
+    );
+
+    await mockExternalRequest({
+      request: requestMock,
+      response: new Response(undefined, {status}),
+    });
+
+    return requestMock;
+  };
+}

package/packages/shopify-app-remix/src/server/authenticate/admin/__tests__/doc-request-path.test.ts

@@ -0,0 +1,151 @@
+import {LogSeverity, SESSION_COOKIE_NAME, Session} from '@shopify/shopify-api';
+
+import {shopifyApp} from '../../..';
+import {
+  API_KEY,
+  APP_URL,
+  BASE64_HOST,
+  GRAPHQL_URL,
+  SHOPIFY_HOST,
+  TEST_SHOP,
+  expectBeginAuthRedirect,
+  expectExitIframeRedirect,
+  getJwt,
+  getThrownResponse,
+  setUpValidSession,
+  testConfig,
+  signRequestCookie,
+  expectLoginRedirect,
+  mockExternalRequest,
+} from '../../../__test-helpers';
+
+describe('authorize.admin doc request path', () => {
+  describe('errors', () => {
+    it.each([
+      {shop: TEST_SHOP, host: undefined},
+      {shop: TEST_SHOP, host: 'invalid-domain.test'},
+      {shop: undefined, host: BASE64_HOST},
+      {shop: 'invalid', host: BASE64_HOST},
+    ])('throws when %s', async ({shop, host}) => {
+      // GIVEN
+      const shopify = shopifyApp(testConfig());
+      const searchParams = new URLSearchParams();
+      if (shop) searchParams.set('shop', shop);
+      if (host) searchParams.set('host', host);
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(`${APP_URL}?${searchParams.toString()}`),
+      );
+
+      // THEN
+      expectLoginRedirect(response);
+    });
+
+    it('redirects to the bounce page URL if id_token search param is missing', async () => {
+      // GIVEN
+      const shopify = shopifyApp(testConfig());
+      await setUpValidSession(shopify.sessionStorage);
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(
+          `${APP_URL}?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}`,
+        ),
+      );
+
+      // THEN
+      const {pathname, searchParams} = new URL(
+        response.headers.get('location')!,
+        APP_URL,
+      );
+
+      expect(response.status).toBe(302);
+      expect(pathname).toBe('/auth/session-token');
+      expect(searchParams.get('shop')).toBe(TEST_SHOP);
+      expect(searchParams.get('host')).toBe(BASE64_HOST);
+      expect(searchParams.get('shopify-reload')).toBe(
+        `${APP_URL}/?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}`,
+      );
+    });
+
+    it('always bounces to the app URL, regardless of request URL', async () => {
+      // GIVEN
+      const shopify = shopifyApp(testConfig());
+      await setUpValidSession(shopify.sessionStorage);
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(
+          `https://some-other-host.not.real?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}`,
+        ),
+      );
+
+      // THEN
+      const {searchParams} = new URL(
+        response.headers.get('location')!,
+        APP_URL,
+      );
+
+      expect(response.status).toBe(302);
+      expect(searchParams.get('shopify-reload')).toBe(
+        `${APP_URL}/?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}`,
+      );
+    });
+
+    it('throws a 401 if app is embedded and the id_token search param is invalid', async () => {
+      // GIVEN
+      const shopify = shopifyApp(testConfig());
+      await setUpValidSession(shopify.sessionStorage);
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(
+          `${APP_URL}?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}&id_token=invalid`,
+        ),
+      );
+
+      // THEN
+      expect(response.status).toBe(401);
+    });
+  });
+
+  it('returns a 400 response when no shop is available', async () => {
+    // GIVEN
+    const shopify = shopifyApp(testConfig({isEmbeddedApp: false}));
+    await setUpValidSession(shopify.sessionStorage);
+
+    // WHEN
+    const response = await getThrownResponse(
+      shopify.authenticate.admin,
+      new Request(APP_URL),
+    );
+
+    // THEN
+    expect(response.status).toBe(400);
+  });
+
+  it("redirects to the embedded app URL if the app isn't embedded yet", async () => {
+    // GIVEN
+    const config = testConfig();
+    const shopify = shopifyApp(config);
+    await setUpValidSession(shopify.sessionStorage);
+
+    // WHEN
+    const response = await getThrownResponse(
+      shopify.authenticate.admin,
+      new Request(`${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`),
+    );
+
+    // THEN
+    const {hostname, pathname} = new URL(response.headers.get('location')!);
+
+    expect(response.status).toBe(302);
+    expect(hostname).toBe(SHOPIFY_HOST);
+    expect(pathname).toBe(`/apps/${API_KEY}`);
+  });
+});