shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-remix/src/server/authenticate/admin/strategies/__tests__/auth-code-flow/ensure-installed-on-shop.test.ts

@@ -0,0 +1,234 @@
+import {LogSeverity, SESSION_COOKIE_NAME} from '@shopify/shopify-api';
+
+import {shopifyApp} from '../../../../..';
+import {
+  API_KEY,
+  APP_URL,
+  BASE64_HOST,
+  GRAPHQL_URL,
+  SHOPIFY_HOST,
+  TEST_SHOP,
+  expectBeginAuthRedirect,
+  expectExitIframeRedirect,
+  getJwt,
+  getThrownResponse,
+  setUpValidSession,
+  signRequestCookie,
+  mockExternalRequest,
+  testConfig,
+} from '../../../../../__test-helpers';
+
+describe('authorize.admin doc request path', () => {
+  describe('errors', () => {
+    it('redirects to auth when not embedded and there is no offline session', async () => {
+      // GIVEN
+      const config = testConfig({isEmbeddedApp: false});
+      const shopify = shopifyApp(config);
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(`${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`),
+      );
+
+      // THEN
+      expectBeginAuthRedirect(config, response);
+    });
+
+    it('redirects to exit-iframe when embedded and there is no offline session', async () => {
+      // GIVEN
+      const shopify = shopifyApp(
+        testConfig({
+          future: {unstable_newEmbeddedAuthStrategy: false},
+          isEmbeddedApp: true,
+        }),
+      );
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(
+          `${APP_URL}?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}`,
+        ),
+      );
+
+      // THEN
+      expectExitIframeRedirect(response);
+    });
+
+    it('redirects to auth when not embedded on an embedded app, and the API token is invalid', async () => {
+      // GIVEN
+      const config = testConfig({
+        future: {unstable_newEmbeddedAuthStrategy: false},
+        isEmbeddedApp: true,
+      });
+      const shopify = shopifyApp(config);
+      await setUpValidSession(shopify.sessionStorage);
+
+      await mockExternalRequest({
+        request: new Request(GRAPHQL_URL, {method: 'POST'}),
+        response: new Response(undefined, {status: 401}),
+      });
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(`${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`),
+      );
+
+      // THEN
+      expectBeginAuthRedirect(config, response);
+    });
+
+    it('returns non-401 codes when not embedded on an embedded app and the request fails', async () => {
+      // GIVEN
+      const config = testConfig({
+        future: {unstable_newEmbeddedAuthStrategy: false},
+        isEmbeddedApp: true,
+      });
+      const shopify = shopifyApp(config);
+      await setUpValidSession(shopify.sessionStorage);
+
+      await mockExternalRequest({
+        request: new Request(GRAPHQL_URL, {method: 'POST'}),
+        response: new Response('', {
+          status: 500,
+          statusText: 'Internal Server Error',
+        }),
+      });
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(`${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`),
+      );
+
+      // THEN
+      expect(response.status).toBe(500);
+      expect(config.logger?.log).toHaveBeenCalledWith(
+        LogSeverity.Error,
+        expect.stringContaining('Internal Server Error'),
+      );
+    });
+
+    it('returns a 500 when not embedded on an embedded app and the request fails', async () => {
+      // GIVEN
+      const config = testConfig({
+        future: {unstable_newEmbeddedAuthStrategy: false},
+        isEmbeddedApp: true,
+      });
+      const shopify = shopifyApp(config);
+      await setUpValidSession(shopify.sessionStorage);
+
+      await mockExternalRequest({
+        request: new Request(GRAPHQL_URL, {method: 'POST'}),
+        response: new Response(
+          JSON.stringify({errors: [{message: 'Something went wrong!'}]}),
+        ),
+      });
+
+      // WHEN
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(`${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`),
+      );
+
+      // THEN
+      expect(response.status).toBe(500);
+      expect(config.logger!.log).toHaveBeenCalledWith(
+        LogSeverity.Error,
+        expect.stringContaining('Something went wrong!'),
+      );
+    });
+
+    it('redirects to exit-iframe if app is embedded and there is no session for the id_token when embedded', async () => {
+      // GIVEN
+      const shopify = shopifyApp(
+        testConfig({
+          future: {unstable_newEmbeddedAuthStrategy: false},
+          isEmbeddedApp: true,
+        }),
+      );
+      await setUpValidSession(shopify.sessionStorage);
+      const otherShopDomain = 'other-shop.myshopify.io';
+
+      // WHEN
+      const {token} = getJwt({dest: `https://${otherShopDomain}`});
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        new Request(
+          `${APP_URL}?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}&id_token=${token}`,
+        ),
+      );
+
+      // THEN
+      expectExitIframeRedirect(response, {shop: otherShopDomain});
+    });
+
+    it('redirects to auth if there is no session cookie for non-embedded apps when at the top level', async () => {
+      // GIVEN
+      const config = testConfig({
+        isEmbeddedApp: false,
+      });
+      const shopify = shopifyApp(config);
+      await setUpValidSession(shopify.sessionStorage);
+
+      // WHEN
+      const request = new Request(
+        `${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`,
+      );
+
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        request,
+      );
+
+      // THEN
+      expectBeginAuthRedirect(config, response);
+    });
+
+    it('redirects to auth if there is no session for non-embedded apps when at the top level', async () => {
+      // GIVEN
+      const config = testConfig({isEmbeddedApp: false});
+      const shopify = shopifyApp(config);
+      await setUpValidSession(shopify.sessionStorage);
+
+      // WHEN
+      const request = new Request(
+        `${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`,
+      );
+      signRequestCookie({
+        request,
+        cookieName: SESSION_COOKIE_NAME,
+        cookieValue: 'other-session-id',
+      });
+
+      const response = await getThrownResponse(
+        shopify.authenticate.admin,
+        request,
+      );
+
+      // THEN
+      expectBeginAuthRedirect(config, response);
+    });
+  });
+
+  it('loads a session from the cookie from a request with no search params when not embedded', async () => {
+    // GIVEN
+    const shopify = shopifyApp(testConfig({isEmbeddedApp: false}));
+    const testSession = await setUpValidSession(shopify.sessionStorage);
+
+    // WHEN
+    const request = new Request(APP_URL);
+    signRequestCookie({
+      request,
+      cookieName: SESSION_COOKIE_NAME,
+      cookieValue: testSession.id,
+    });
+
+    const {session} = await shopify.authenticate.admin(request);
+
+    // THEN
+    expect(session).toBe(testSession);
+  });
+});

package/packages/shopify-app-remix/src/server/authenticate/admin/strategies/__tests__/auth-code-flow/session-token-header-path.test.ts

@@ -0,0 +1,79 @@
+import {SESSION_COOKIE_NAME, Session} from '@shopify/shopify-api';
+
+import {shopifyApp} from '../../../../..';
+import {
+  APP_URL,
+  BASE64_HOST,
+  TEST_SHOP,
+  getJwt,
+  getThrownResponse,
+  setUpValidSession,
+  testConfig,
+} from '../../../../../__test-helpers';
+import {REAUTH_URL_HEADER} from '../../../../const';
+
+describe('authorize.session token header path', () => {
+  describe('errors', () => {
+    describe.each([true, false])('when isOnline: %s', (isOnline) => {
+      it(`returns app bridge redirection headers if there is no session`, async () => {
+        // GIVEN
+        const shopify = shopifyApp(
+          testConfig({
+            useOnlineTokens: isOnline,
+            future: {unstable_newEmbeddedAuthStrategy: false},
+          }),
+        );
+
+        // WHEN
+        const {token} = getJwt();
+        const response = await getThrownResponse(
+          shopify.authenticate.admin,
+          new Request(`${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`, {
+            headers: {Authorization: `Bearer ${token}`},
+          }),
+        );
+
+        // THEN
+        const {origin, pathname, searchParams} = new URL(
+          response.headers.get(REAUTH_URL_HEADER)!,
+        );
+
+        expect(response.status).toBe(401);
+        expect(origin).toBe(APP_URL);
+        expect(pathname).toBe('/auth');
+        expect(searchParams.get('shop')).toBe(TEST_SHOP);
+      });
+
+      it(`returns app bridge redirection headers if the session is no longer valid`, async () => {
+        // GIVEN
+        const shopify = shopifyApp(
+          testConfig({
+            useOnlineTokens: isOnline,
+            scopes: ['otherTestScope'],
+            future: {unstable_newEmbeddedAuthStrategy: false},
+          }),
+        );
+        // The session scopes don't match the configured scopes, so it needs to be reset
+        await setUpValidSession(shopify.sessionStorage, {isOnline});
+
+        // WHEN
+        const {token} = getJwt();
+        const response = await getThrownResponse(
+          shopify.authenticate.admin,
+          new Request(`${APP_URL}?shop=${TEST_SHOP}&host=${BASE64_HOST}`, {
+            headers: {Authorization: `Bearer ${token}`},
+          }),
+        );
+
+        // THEN
+        const {origin, pathname, searchParams} = new URL(
+          response.headers.get(REAUTH_URL_HEADER)!,
+        );
+        expect(response.status).toBe(401);
+        expect(origin).toBe(APP_URL);
+        expect(pathname).toBe('/auth');
+        expect(searchParams.get('shop')).toBe(TEST_SHOP);
+      });
+    });
+  });
+});

package/packages/shopify-app-remix/src/server/authenticate/admin/strategies/__tests__/token-exchange/admin-client.test.ts

@@ -0,0 +1,189 @@
+import {
+  ApiVersion,
+  HttpMaxRetriesError,
+  LATEST_API_VERSION,
+  SESSION_COOKIE_NAME,
+  Session,
+} from '@shopify/shopify-api';
+import {restResources} from '@shopify/shopify-api/rest/admin/2023-04';
+
+import {
+  APP_URL,
+  BASE64_HOST,
+  TEST_SHOP,
+  expectExitIframeRedirect,
+  getJwt,
+  getThrownResponse,
+  setUpValidSession,
+  signRequestCookie,
+  testConfig,
+  mockExternalRequest,
+  expectAdminApiClient,
+} from '../../../../../__test-helpers';
+import {shopifyApp} from '../../../../..';
+import {
+  REAUTH_URL_HEADER,
+  RETRY_INVALID_SESSION_HEADER,
+} from '../../../../const';
+import {AdminApiContext} from '../../../../../clients';
+
+describe('admin.authenticate context', () => {
+  expectAdminApiClient(async () => {
+    const {
+      admin,
+      expectedSession,
+      session: actualSession,
+    } = await setUpDocumentFlow();
+
+    return {admin, expectedSession, actualSession};
+  });
+  describe.each([
+    {
+      testGroup: 'REST client',
+      mockRequest: mockRestRequest,
+      action: async (admin: AdminApiContext, _session: Session) =>
+        admin.rest.get({path: '/customers.json'}),
+    },
+    {
+      testGroup: 'REST resources',
+      mockRequest: mockRestRequest,
+      action: async (admin: AdminApiContext, session: Session) =>
+        admin.rest.resources.Customer.all({session}),
+    },
+    {
+      testGroup: 'GraphQL client',
+      mockRequest: mockGraphqlRequest(),
+      action: async (admin: AdminApiContext, _session: Session) =>
+        admin.graphql('{ shop { name } }'),
+    },
+    {
+      testGroup: 'GraphQL client with options',
+      mockRequest: mockGraphqlRequest('2021-01' as ApiVersion),
+      action: async (admin: AdminApiContext, _session: Session) =>
+        admin.graphql(
+          'mutation myMutation($ID: String!) { shop(ID: $ID) { name } }',
+          {
+            variables: {ID: '123'},
+            apiVersion: '2021-01' as ApiVersion,
+            headers: {custom: 'header'},
+            tries: 2,
+          },
+        ),
+    },
+  ])(
+    '$testGroup re-authentication',
+    ({testGroup: _testGroup, mockRequest, action}) => {
+      it('redirects to exit bounce page when document request receives a 401 response', async () => {
+        // GIVEN
+        const {admin, session, shopify} = await setUpDocumentFlow();
+        const requestMock = await mockRequest();
+
+        // WHEN
+        const response = await getThrownResponse(
+          async () => action(admin, session),
+          requestMock,
+        );
+
+        // THEN
+        expect(response.status).toBe(302);
+
+        const {pathname} = new URL(response.headers.get('location')!, APP_URL);
+        expect(pathname).toBe('/auth/session-token');
+
+        expect(
+          await shopify.sessionStorage.loadSession(session.id),
+        ).toBeUndefined();
+      });
+
+      it('returns 401 when receives a 401 response on fetch requests', async () => {
+        // GIVEN
+        const {admin, session, shopify} = await setUpFetchFlow();
+        const requestMock = await mockRequest();
+
+        // WHEN
+        const response = await getThrownResponse(
+          async () => action(admin, session),
+          requestMock,
+        );
+
+        // THEN
+        expect(response.status).toEqual(401);
+        expect(
+          response.headers.get('X-Shopify-Retry-Invalid-Session-Request'),
+        ).toBeNull();
+
+        expect(
+          await shopify.sessionStorage.loadSession(session.id),
+        ).toBeUndefined();
+      });
+    },
+  );
+});
+
+async function setUpDocumentFlow() {
+  const shopify = shopifyApp(
+    testConfig({
+      restResources,
+    }),
+  );
+  const expectedSession = await setUpValidSession(shopify.sessionStorage);
+
+  const {token} = getJwt();
+  const request = new Request(
+    `${APP_URL}?embedded=1&shop=${TEST_SHOP}&host=${BASE64_HOST}&id_token=${token}`,
+  );
+
+  return {
+    shopify,
+    expectedSession,
+    ...(await shopify.authenticate.admin(request)),
+  };
+}
+
+async function setUpFetchFlow() {
+  const shopify = shopifyApp(
+    testConfig({
+      restResources,
+    }),
+  );
+  await setUpValidSession(shopify.sessionStorage);
+
+  const {token} = getJwt();
+  const request = new Request(APP_URL, {
+    headers: {Authorization: `Bearer ${token}`},
+  });
+
+  return {
+    shopify,
+    ...(await shopify.authenticate.admin(request)),
+  };
+}
+
+async function mockRestRequest(status = 401) {
+  const requestMock = new Request(
+    `https://${TEST_SHOP}/admin/api/${LATEST_API_VERSION}/customers.json`,
+  );
+
+  await mockExternalRequest({
+    request: requestMock,
+    response: new Response('{}', {status}),
+  });
+
+  return requestMock;
+}
+
+function mockGraphqlRequest(apiVersion = LATEST_API_VERSION) {
+  return async function (status = 401) {
+    const requestMock = new Request(
+      `https://${TEST_SHOP}/admin/api/${apiVersion}/graphql.json`,
+      {method: 'POST'},
+    );
+
+    await mockExternalRequest({
+      request: requestMock,
+      response: new Response(undefined, {status}),
+    });
+
+    return requestMock;
+  };
+}