shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-remix/src/server/clients/admin/types.ts

@@ -0,0 +1,178 @@
+import {Session, ShopifyRestResources} from '@shopify/shopify-api';
+import {AdminOperations} from '@shopify/admin-api-client';
+
+import {BasicParams} from '../../types';
+import {GraphQLClient} from '../types';
+
+import type {RestClientWithResources} from './rest';
+
+export interface AdminClientOptions {
+  params: BasicParams;
+  session: Session;
+  handleClientError?: HandleAdminClientError;
+}
+
+export type HandleAdminClientError = (arg: {
+  error: any;
+  params: BasicParams;
+  session: Session;
+}) => Promise<void>;
+
+export interface AdminApiContext<
+  Resources extends ShopifyRestResources = ShopifyRestResources,
+> {
+  /**
+   * Methods for interacting with the Shopify Admin REST API
+   *
+   * There are methods for interacting with individual REST resources. You can also make `GET`, `POST`, `PUT` and `DELETE` requests should the REST resources not meet your needs.
+   *
+   * {@link https://shopify.dev/docs/api/admin-rest}
+   *
+   * @example
+   * <caption>Using REST resources.</caption>
+   * <description>Getting the number of orders in a store using REST resources. Visit the [Admin REST API references](/docs/api/admin-rest) for examples on using each resource. </description>
+   *
+   * ```ts
+   * // /app/routes/**\/*.ts
+   * import { LoaderFunctionArgs, json } from "@remix-run/node";
+   * import { authenticate } from "../shopify.server";
+   *
+   * export const loader = async ({ request }: LoaderFunctionArgs) => {
+   *   const { admin, session } = await authenticate.admin(request);
+   *   return json(admin.rest.resources.Order.count({ session }));
+   * };
+   * ```
+   *
+   *
+   * ```ts
+   * // /app/shopify.server.ts
+   * import { shopifyApp } from "@shopify/shopify-app-remix/server";
+   * import { restResources } from "@shopify/shopify-api/rest/admin/2023-07";
+   *
+   * const shopify = shopifyApp({
+   *   restResources,
+   *   // ...etc
+   * });
+   * export default shopify;
+   * export const authenticate = shopify.authenticate;
+   * ```
+   *
+   *
+   * @example
+   * <caption>Performing a GET request to the REST API.</caption>
+   * <description>Use `admin.rest.get` to make custom requests to make a request to to the `customer/count` endpoint</description>
+   *
+   * ```ts
+   * // /app/routes/**\/*.ts
+   * import { LoaderFunctionArgs, json } from "@remix-run/node";
+   * import { authenticate } from "../shopify.server";
+   *
+   * export const loader = async ({ request }: LoaderFunctionArgs) => {
+   *   const { admin, session } = await authenticate.admin(request);
+   *   const response = await admin.rest.get({ path: "/customers/count.json" });
+   *   const customers = await response.json();
+   *   return json({ customers });
+   * };
+   * ```
+   *
+   * ```ts
+   * // /app/shopify.server.ts
+   * import { shopifyApp } from "@shopify/shopify-app-remix/server";
+   * import { restResources } from "@shopify/shopify-api/rest/admin/2023-04";
+   *
+   * const shopify = shopifyApp({
+   *   restResources,
+   *   // ...etc
+   * });
+   * export default shopify;
+   * export const authenticate = shopify.authenticate;
+   * ```
+   * @example
+   * <caption>Performing a POST request to the REST API.</caption>
+   * <description>Use `admin.rest.post` to make custom requests to make a request to to the `customers.json` endpoint to send a welcome email</description>
+   * ```ts
+   * // /app/routes/**\/*.ts
+   * import { LoaderFunctionArgs, json } from "@remix-run/node";
+   * import { authenticate } from "../shopify.server";
+   *
+   * export const loader = async ({ request }: LoaderFunctionArgs) => {
+   *   const { admin, session } = await authenticate.admin(request);
+   *   const response = admin.rest.post({
+   *     path: "customers/7392136888625/send_invite.json",
+   *     body: {
+   *       customer_invite: {
+   *         to: "new_test_email@shopify.com",
+   *         from: "j.limited@example.com",
+   *         bcc: ["j.limited@example.com"],
+   *         subject: "Welcome to my new shop",
+   *         custom_message: "My awesome new store",
+   *       },
+   *     },
+   * });
+   *   const customerInvite = await response.json();
+   *   return json({ customerInvite });
+   * };
+   * ```
+   *
+   * ```ts
+   * // /app/shopify.server.ts
+   * import { shopifyApp } from "@shopify/shopify-app-remix/server";
+   * import { restResources } from "@shopify/shopify-api/rest/admin/2023-04";
+   *
+   * const shopify = shopifyApp({
+   *   restResources,
+   *   // ...etc
+   * });
+   * export default shopify;
+   * export const authenticate = shopify.authenticate;
+   * ```
+   */
+  rest: RestClientWithResources<Resources>;
+
+  /**
+   * Methods for interacting with the Shopify Admin GraphQL API
+   *
+   * {@link https://shopify.dev/docs/api/admin-graphql}
+   * {@link https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/docs/reference/clients/Graphql.md}
+   *
+   * @example
+   * <caption>Querying the GraphQL API.</caption>
+   * <description>Use `admin.graphql` to make query / mutation requests.</description>
+   * ```ts
+   * import { ActionFunctionArgs } from "@remix-run/node";
+   * import { authenticate } from "../shopify.server";
+   *
+   * export async function action({ request }: ActionFunctionArgs) {
+   *   const { admin } = await authenticate.admin(request);
+   *
+   *   const response = await admin.graphql(
+   *     `#graphql
+   *     mutation populateProduct($input: ProductInput!) {
+   *       productCreate(input: $input) {
+   *         product {
+   *           id
+   *         }
+   *       }
+   *     }`,
+   *     { variables: { input: { title: "Product Name" } } }
+   *   );
+   *
+   *   const productData = await response.json();
+   *   return json({ data: productData.data });
+   * }
+   * ```
+   *
+   * ```ts
+   * // /app/shopify.server.ts
+   * import { shopifyApp } from "@shopify/shopify-app-remix/server";
+   *
+   * const shopify = shopifyApp({
+   *   restResources,
+   *   // ...etc
+   * });
+   * export default shopify;
+   * export const unauthenticated = shopify.unauthenticated;
+   * ```
+   */
+  graphql: GraphQLClient<AdminOperations>;
+}

package/packages/shopify-app-remix/src/server/clients/index.ts

@@ -0,0 +1,2 @@
+export * from './admin';
+export * from './storefront';

package/packages/shopify-app-remix/src/server/clients/storefront/authenticate.storefront.api.doc.ts

@@ -0,0 +1,34 @@
+import {ReferenceEntityTemplateSchema} from '@shopify/generate-docs';
+
+const data: ReferenceEntityTemplateSchema = {
+  name: 'Storefront API',
+  description:
+    'Contains objects used to interact with the Storefront API.' +
+    '\n\nThis object is returned as part of different contexts, such as [`appProxy`](/docs/api/shopify-app-remix/authenticate/public/app-proxy), and [`unauthenticated.storefront`](/docs/api/shopify-app-remix/unauthenticated/unauthenticated-storefront).',
+  category: 'APIs',
+  type: 'object',
+  isVisualComponent: false,
+  definitions: [
+    {
+      title: 'storefront',
+      description:
+        'Provides utilities that apps can use to make requests to the Storefront API.',
+      type: 'StorefrontContext',
+    },
+  ],
+  jsDocTypeExamples: ['StorefrontContext'],
+  related: [
+    {
+      name: 'App proxy context',
+      subtitle: 'Authenticate requests from Shopify app proxies.',
+      url: '/docs/api/shopify-app-remix/authenticate/public/app-proxy',
+    },
+    {
+      name: 'Unauthenticated context',
+      subtitle: 'Interact with the Storefront API on non-Shopify requests.',
+      url: '/docs/api/shopify-app-remix/unauthenticated/unauthenticated-storefront',
+    },
+  ],
+};
+
+export default data;

package/packages/shopify-app-remix/src/server/clients/storefront/factory.ts

@@ -0,0 +1,32 @@
+import {Session} from '@shopify/shopify-api';
+
+import {BasicParams} from '../../types';
+
+import type {StorefrontContext} from '.';
+
+export function storefrontClientFactory({
+  params,
+  session,
+}: {
+  params: BasicParams;
+  session: Session;
+}): StorefrontContext {
+  const {api} = params;
+
+  return {
+    graphql: async (query, options = {}) => {
+      const client = new api.clients.Storefront({
+        session,
+        apiVersion: options.apiVersion,
+      });
+
+      const apiResponse = await client.request(query, {
+        variables: options?.variables,
+        retries: options?.tries ? options.tries - 1 : 0,
+        headers: options?.headers,
+      });
+
+      return new Response(JSON.stringify(apiResponse));
+    },
+  };
+}

package/packages/shopify-app-remix/src/server/clients/storefront/index.ts

@@ -0,0 +1,2 @@
+export * from './factory';
+export * from './types';

package/packages/shopify-app-remix/src/server/clients/storefront/types.ts

@@ -0,0 +1,31 @@
+import {StorefrontOperations} from '@shopify/storefront-api-client';
+
+import {GraphQLClient} from '../types';
+
+export interface StorefrontContext {
+  /**
+   * Method for interacting with the Shopify Storefront GraphQL API
+   *
+   * If you're getting incorrect type hints in the Shopify template, follow [these instructions](https://github.com/Shopify/shopify-app-template-remix/tree/main#incorrect-graphql-hints).
+   *
+   * {@link https://shopify.dev/docs/api/storefront}
+   *
+   * @example
+   * <caption>Querying the GraphQL API.</caption>
+   * <description>Use `storefront.graphql` to make query / mutation requests.</description>
+   * ```ts
+   * // app/routes/**\/.ts
+   * import { json } from "@remix-run/node";
+   * import { authenticate } from "../shopify.server";
+   *
+   * export async function action({ request }: ActionFunctionArgs) {
+   *   const { storefront } = await authenticate.public.appProxy(request);
+   *
+   *   const response = await storefront.graphql(`{blogs(first: 10) { edges { node { id } } } }`);
+   *
+   *   return json(await response.json());
+   * }
+   * ```
+   */
+  graphql: GraphQLClient<StorefrontOperations>;
+}

package/packages/shopify-app-remix/src/server/clients/types.ts

@@ -0,0 +1,27 @@
+import type {
+  AllOperations,
+  ReturnData,
+  FetchResponseBody,
+  ApiClientRequestOptions,
+  ResponseWithType,
+} from '@shopify/admin-api-client';
+import {ApiVersion} from '@shopify/shopify-api';
+
+export interface GraphQLQueryOptions<
+  Operation extends keyof Operations,
+  Operations extends AllOperations,
+> {
+  variables?: ApiClientRequestOptions<Operation, Operations>['variables'];
+  apiVersion?: ApiVersion;
+  headers?: Record<string, any>;
+  tries?: number;
+}
+
+export type GraphQLClient<Operations extends AllOperations> = <
+  Operation extends keyof Operations,
+>(
+  query: Operation,
+  options?: GraphQLQueryOptions<Operation, Operations>,
+) => Promise<
+  ResponseWithType<FetchResponseBody<ReturnData<Operation, Operations>>>
+>;

package/packages/shopify-app-remix/src/server/config-types.ts

@@ -0,0 +1,293 @@
+import {
+  ConfigParams as ApiConfigArg,
+  ConfigInterface as ApiConfig,
+  ShopifyRestResources,
+  Session,
+  ApiVersion,
+  WebhookHandler,
+} from '@shopify/shopify-api';
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+
+import type {
+  ApiFutureFlags,
+  FutureFlagOptions,
+  FutureFlags,
+} from './future/flags';
+import type {AppDistribution} from './types';
+import type {AdminApiContext} from './clients';
+import {IdempotentPromiseHandler} from './authenticate/helpers/idempotent-promise-handler';
+
+export interface AppConfigArg<
+  Resources extends ShopifyRestResources = ShopifyRestResources,
+  Storage extends SessionStorage = SessionStorage,
+  Future extends FutureFlagOptions = FutureFlagOptions,
+> extends Omit<
+    ApiConfigArg<Resources, ApiFutureFlags<Future>>,
+    | 'hostName'
+    | 'hostScheme'
+    | 'isEmbeddedApp'
+    | 'apiVersion'
+    | 'isCustomStoreApp'
+    | 'future'
+  > {
+  /**
+   * The URL your app is running on.
+   *
+   * The `@shopify/cli` provides this URL as `process.env.SHOPIFY_APP_URL`.  For development this is probably a tunnel URL that points to your local machine.  If this is a production app, this is your production URL.
+   */
+  appUrl: string;
+
+  /**
+   * An adaptor for storing sessions in your database of choice.
+   *
+   * Shopify provides multiple session storage adaptors and you can create your own.
+   *
+   * {@link https://github.com/Shopify/shopify-app-js/blob/main/README.md#session-storage-options}
+   *
+   * @example
+   * <caption>Storing sessions with Prisma.</caption>
+   * <description>Add the `@shopify/shopify-app-session-storage-prisma` package to use the Prisma session storage.</description>
+   * ```ts
+   * import { shopifyApp } from "@shopify/shopify-app-remix/server";
+   * import { PrismaSessionStorage } from "@shopify/shopify-app-session-storage-prisma";
+   *
+   * import prisma from "~/db.server";
+   *
+   * const shopify = shopifyApp({
+   *   // ... etc
+   *   sessionStorage: new PrismaSessionStorage(prisma),
+   * });
+   * export default shopify;
+   * ```
+   */
+  sessionStorage: Storage;
+
+  /**
+   * Whether your app use online or offline tokens.
+   *
+   * If your app uses online tokens, then both online and offline tokens will be saved to your database.  This ensures your app can perform background jobs.
+   *
+   * {@link https://shopify.dev/docs/apps/auth/oauth/access-modes}
+   *
+   * @defaultValue `false`
+   */
+  useOnlineTokens?: boolean;
+
+  /**
+   * The config for the webhook topics your app would like to subscribe to.
+   *
+   * {@link https://shopify.dev/docs/apps/webhooks}
+   *
+   * This can be in used in conjunction with the afterAuth hook to register webhook topics when a user installs your app.  Or you can use this function in other processes such as background jobs.
+   *
+   * @example
+   * <caption>Registering for a webhook when a merchant uninstalls your app.</caption>
+   * ```ts
+   * // /app/shopify.server.ts
+   * import { DeliveryMethod, shopifyApp } from "@shopify/shopify-app-remix/server";
+   *
+   * const shopify = shopifyApp({
+   *   webhooks: {
+   *     APP_UNINSTALLED: {
+   *       deliveryMethod: DeliveryMethod.Http,
+   *        callbackUrl: "/webhooks",
+   *     },
+   *   },
+   *   hooks: {
+   *     afterAuth: async ({ session }) => {
+   *       shopify.registerWebhooks({ session });
+   *     }
+   *   },
+   *   // ...etc
+   * });
+   * export default shopify;
+   * export const authenticate = shopify.authenticate;
+   *
+   * // /app/routes/webhooks.jsx
+   * import { ActionFunctionArgs } from "@remix-run/node";
+   *
+   * import { authenticate } from "../shopify.server";
+   * import db from "../db.server";
+   *
+   * export const action = async ({ request }: ActionFunctionArgs) => {
+   *   const { topic, shop } = await authenticate.webhook(request);
+   *
+   *   switch (topic) {
+   *     case "APP_UNINSTALLED":
+   *       await db.session.deleteMany({ where: { shop } });
+   *       break;
+   *     case "CUSTOMERS_DATA_REQUEST":
+   *     case "CUSTOMERS_REDACT":
+   *     case "SHOP_REDACT":
+   *     default:
+   *       throw new Response("Unhandled webhook topic", { status: 404 });
+   *   }
+   *   throw new Response();
+   * };
+   * ```
+   */
+  webhooks?: WebhookConfig;
+
+  /**
+   * Functions to call at key places during your apps lifecycle.
+   *
+   * These functions are called in the context of the request that triggered them.  This means you can access the session.
+   *
+   * @example
+   * <caption>Seeding your database custom data when a merchant installs your app.</caption>
+   * ```ts
+   * import { DeliveryMethod, shopifyApp } from "@shopify/shopify-app-remix/server";
+   * import { seedStoreData } from "~/db/seeds"
+   *
+   * const shopify = shopifyApp({
+   *   hooks: {
+   *     afterAuth: async ({ session }) => {
+   *       seedStoreData({session})
+   *     }
+   *   },
+   *   // ...etc
+   * });
+   * ```
+   */
+  hooks?: HooksConfig;
+
+  /**
+   * Does your app render embedded inside the Shopify Admin or on its own.
+   *
+   * Unless you have very specific needs, this should be true.
+   *
+   * @defaultValue `true`
+   */
+  isEmbeddedApp?: boolean;
+
+  /**
+   * How your app is distributed. Default is `AppDistribution.AppStore`.
+   *
+   * {@link https://shopify.dev/docs/apps/distribution}
+   */
+  distribution?: AppDistribution;
+
+  /**
+   * What version of Shopify's Admin API's would you like to use.
+   *
+   * {@link https://shopify.dev/docs/api/}
+   *
+   * @defaultValue `LATEST_API_VERSION` from `@shopify/shopify-app-remix`
+   *
+   * @example
+   * <caption>Using the latest API Version (Recommended)</caption>
+   * ```ts
+   * import { LATEST_API_VERSION, shopifyApp } from "@shopify/shopify-app-remix/server";
+   *
+   * const shopify = shopifyApp({
+   *   // ...etc
+   *   apiVersion: LATEST_API_VERSION,
+   * });
+   * ```
+   */
+  apiVersion?: ApiVersion;
+
+  /**
+   * A path that Shopify can reserve for auth related endpoints.
+   *
+   * This must match a $ route in your Remix app.  That route must export a loader function that calls `shopify.authenticate.admin(request)`.
+   *
+   * @default `"/auth"`
+   *
+   * @example
+   * <caption>Using the latest API Version (Recommended)</caption>
+   * ```ts
+   * // /app/shopify.server.ts
+   * import { LATEST_API_VERSION, shopifyApp } from "@shopify/shopify-app-remix/server";
+   *
+   * const shopify = shopifyApp({
+   *   // ...etc
+   *   apiVersion: LATEST_API_VERSION,
+   * });
+   * export default shopify;
+   * export const authenticate = shopify.authenticate;
+   *
+   * // /app/routes/auth/$.jsx
+   * import { LoaderFunctionArgs } from "@remix-run/node";
+   * import { authenticate } from "../../shopify.server";
+   *
+   * export async function loader({ request }: LoaderFunctionArgs) {
+   *   await authenticate.admin(request);
+   *
+   *   return null
+   * }
+   * ```
+   */
+  authPathPrefix?: string;
+
+  /**
+   * Features that will be introduced in future releases of this package.
+   *
+   * You can opt in to these features by setting the corresponding flags. By doing so, you can prepare for future
+   * releases in advance and provide feedback on the new features.
+   */
+  future?: Future;
+}
+
+export interface AppConfig<Storage extends SessionStorage = SessionStorage>
+  extends Omit<ApiConfig, 'future'> {
+  canUseLoginForm: boolean;
+  appUrl: string;
+  auth: AuthConfig;
+  sessionStorage: Storage;
+  useOnlineTokens: boolean;
+  hooks: HooksConfig;
+  future: FutureFlags;
+  idempotentPromiseHandler: IdempotentPromiseHandler;
+}
+
+export interface AuthConfig {
+  path: string;
+  callbackPath: string;
+  exitIframePath: string;
+  patchSessionTokenPath: string;
+  loginPath: string;
+}
+
+export type WebhookConfig = Record<string, WebhookHandler | WebhookHandler[]>;
+
+interface HooksConfig {
+  /**
+   * A function to call after a merchant installs your app
+   *
+   * @param context - An object with context about the request that triggered the hook.
+   * @param context.session - The session of the merchant that installed your app. This is the output of sessionStorage.loadSession in case people want to load their own.
+   * @param context.admin - An object with access to the Shopify Admin API's.
+   *
+   * @example
+   * <caption>Registering webhooks and seeding data when a merchant installs your app.</caption>
+   * ```ts
+   * import { DeliveryMethod, shopifyApp } from "@shopify/shopify-app-remix/server";
+   * import { seedStoreData } from "~/db/seeds"
+   *
+   * const shopify = shopifyApp({
+   *   hooks: {
+   *     afterAuth: async ({ session }) => {
+   *       shopify.registerWebhooks({ session });
+   *       seedStoreData({session})
+   *     }
+   *   },
+   *   webhooks: {
+   *     APP_UNINSTALLED: {
+   *       deliveryMethod: DeliveryMethod.Http,
+   *        callbackUrl: "/webhooks",
+   *     },
+   *   },
+   *   // ...etc
+   * });
+   * ```
+   */
+  afterAuth?: (options: AfterAuthOptions) => void | Promise<void>;
+}
+
+export interface AfterAuthOptions<
+  R extends ShopifyRestResources = ShopifyRestResources,
+> {
+  session: Session;
+  admin: AdminApiContext<R>;
+}

package/packages/shopify-app-remix/src/server/errors.ts

@@ -0,0 +1,3 @@
+import {ShopifyError} from '@shopify/shopify-api';
+
+export class SessionNotFoundError extends ShopifyError {}

package/packages/shopify-app-remix/src/server/future/flags.ts

@@ -0,0 +1,57 @@
+// When adding new flags, you should also add them to the `TEST_FUTURE_FLAGS` object in `test-config.ts` to ensure that
+
+import type {ConfigParams, ShopifyRestResources} from '@shopify/shopify-api';
+
+// it doesn't cause regressions.
+export interface FutureFlags {
+  /**
+   * When enabled, returns the same `admin` context (`AdminApiContext`) from `authenticate.webhook` that is returned from `authenticate.admin`.
+   *
+   * @default false
+   */
+  v3_webhookAdminContext?: boolean;
+
+  /**
+   * When enabled authenticate.public() will not work.  Use authenticate.public.checkout() instead.
+   *
+   * @default false
+   */
+  v3_authenticatePublic?: boolean;
+
+  /**
+   * When enabled allows you to pass billing plans with line items when creating a new app subscriptions.
+   */
+  v3_lineItemBilling?: boolean;
+
+  /**
+   * When enabled, embedded apps will fetch access tokens via [token exchange](https://shopify.dev/docs/apps/auth/get-access-tokens/token-exchange).
+   * This assumes the app has scopes declared for [Shopify managing installation](https://shopify.dev/docs/apps/auth/installation#shopify-managed-installation).
+   *
+   * Learn more about this [new embedded app auth strategy](https://shopify.dev/docs/api/shopify-app-remix#embedded-auth-strategy).
+   *
+   * @default false
+   */
+  unstable_newEmbeddedAuthStrategy?: boolean;
+}
+
+// When adding new flags, use this format:
+// vX_myFutureFlag: Future extends FutureFlags ? Future['vX_myFutureFlag'] : false;
+export interface ApiFutureFlags<Future extends FutureFlagOptions> {
+  v10_lineItemBilling: Future extends FutureFlags
+    ? Future['v3_lineItemBilling']
+    : false;
+}
+
+export type ApiConfigWithFutureFlags<Future extends FutureFlagOptions> =
+  ConfigParams<ShopifyRestResources, ApiFutureFlags<Future>>;
+
+export type FutureFlagOptions = FutureFlags | undefined;
+
+export type FeatureEnabled<
+  Future extends FutureFlagOptions,
+  Flag extends keyof FutureFlags,
+> = Future extends FutureFlags
+  ? Future[Flag] extends true
+    ? true
+    : false
+  : false;

package/packages/shopify-app-remix/src/server/index.ts

@@ -0,0 +1,20 @@
+import '@shopify/shopify-api/adapters/web-api';
+import {setAbstractRuntimeString} from '@shopify/shopify-api/runtime';
+
+setAbstractRuntimeString(() => {
+  return `Remix`;
+});
+
+export {
+  LATEST_API_VERSION,
+  LogSeverity,
+  DeliveryMethod,
+  BillingInterval,
+  ApiVersion,
+} from '@shopify/shopify-api';
+
+export type {ShopifyApp, LoginError} from './types';
+export {LoginErrorType, AppDistribution} from './types';
+export {boundary} from './boundary';
+export {shopifyApp} from './shopify-app';
+export * from './errors';