shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-remix/src/server/override-logger.ts

@@ -0,0 +1,42 @@
+import semver from 'semver';
+import {FeatureDeprecatedError, Shopify} from '@shopify/shopify-api';
+
+import {SHOPIFY_REMIX_LIBRARY_VERSION} from './version';
+
+// eslint-disable-next-line no-warning-comments
+// TODO This has been copied from shopify-app-express, it should be extracted into a shared package
+// https://github.com/orgs/Shopify/projects/6899/views/1?pane=issue&itemId=28358070
+export function overrideLogger(logger: Shopify['logger']): Shopify['logger'] {
+  const baseContext = {package: 'shopify-app'};
+
+  const warningFunction: Shopify['logger']['warning'] = (
+    message,
+    context = {},
+  ) => logger.warning(message, {...baseContext, ...context});
+
+  function deprecated(warningFunction: Shopify['logger']['warning']) {
+    return function (version: string, message: string): Promise<void> {
+      if (semver.gte(SHOPIFY_REMIX_LIBRARY_VERSION, version)) {
+        throw new FeatureDeprecatedError(
+          `Feature was deprecated in version ${version}`,
+        );
+      }
+
+      return warningFunction(`[Deprecated | ${version}] ${message}`);
+    };
+  }
+
+  return {
+    ...logger,
+    log: (severity, message, context = {}) =>
+      logger.log(severity, message, {...baseContext, ...context}),
+    debug: (message, context = {}) =>
+      logger.debug(message, {...baseContext, ...context}),
+    info: (message, context = {}) =>
+      logger.info(message, {...baseContext, ...context}),
+    warning: warningFunction,
+    error: (message, context = {}) =>
+      logger.error(message, {...baseContext, ...context}),
+    deprecated: deprecated(warningFunction),
+  };
+}

package/packages/shopify-app-remix/src/server/shopify-app.doc.ts

@@ -0,0 +1,45 @@
+import {ReferenceEntityTemplateSchema} from '@shopify/generate-docs';
+
+const data: ReferenceEntityTemplateSchema = {
+  name: 'shopifyApp',
+  description:
+    "Returns a set of functions that can be used by the app's backend to be able to respond to all Shopify requests." +
+    '\n\nThe shape of the returned object changes depending on the value of `distribution`. If it is `AppDistribution.ShopifyAdmin`, then only `ShopifyAppBase` objects are returned, otherwise `ShopifyAppLogin` objects are included.',
+  category: 'Entrypoints',
+  type: 'function',
+  isVisualComponent: false,
+  definitions: [
+    {
+      title: 'shopifyApp',
+      description: 'Function to create a new Shopify API object.',
+      type: 'ShopifyAppGeneratedType',
+    },
+    {
+      title: 'Future flags',
+      description:
+        'Set future flags using the `future` configuration field to opt in to upcoming breaking changes.' +
+        '\n\nWith this feature, you can prepare for major releases ahead of time, as well as try out new features before they are released.',
+      type: 'FutureFlags',
+      filePath: 'src/server/future/flags.ts',
+    },
+  ],
+  jsDocTypeExamples: [
+    'ShopifyAppGeneratedType',
+    'ShopifyAppBase',
+    'ShopifyAppLogin',
+  ],
+  related: [
+    {
+      name: 'Authenticated contexts',
+      subtitle: 'Authenticate requests coming from Shopify.',
+      url: '/docs/api/shopify-app-remix/authenticate',
+    },
+    {
+      name: 'Unauthenticated contexts',
+      subtitle: 'Interact with the API on non-Shopify requests.',
+      url: '/docs/api/shopify-app-remix/unauthenticated',
+    },
+  ],
+};
+
+export default data;

package/packages/shopify-app-remix/src/server/shopify-app.ts

@@ -0,0 +1,198 @@
+import '@shopify/shopify-api/adapters/web-api';
+import {
+  ConfigInterface as ApiConfig,
+  LATEST_API_VERSION,
+  ShopifyError,
+  ShopifyRestResources,
+  shopifyApi,
+} from '@shopify/shopify-api';
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+
+import {type AppConfig, type AppConfigArg} from './config-types';
+import {
+  AppDistribution,
+  type BasicParams,
+  type MandatoryTopics,
+  type ShopifyApp,
+  type ShopifyAppBase,
+  type AdminApp,
+  type SingleMerchantApp,
+  type AppStoreApp,
+} from './types';
+import {SHOPIFY_REMIX_LIBRARY_VERSION} from './version';
+import {registerWebhooksFactory} from './authenticate/webhooks';
+import {authStrategyFactory} from './authenticate/admin/authenticate';
+import {authenticateWebhookFactory} from './authenticate/webhooks/authenticate';
+import {overrideLogger} from './override-logger';
+import {addDocumentResponseHeadersFactory} from './authenticate/helpers';
+import {loginFactory} from './authenticate/login/login';
+import {unauthenticatedAdminContextFactory} from './unauthenticated/admin';
+import {authenticatePublicFactory} from './authenticate/public';
+import {unauthenticatedStorefrontContextFactory} from './unauthenticated/storefront';
+import {AuthCodeFlowStrategy} from './authenticate/admin/strategies/auth-code-flow';
+import {TokenExchangeStrategy} from './authenticate/admin/strategies/token-exchange';
+import {IdempotentPromiseHandler} from './authenticate/helpers/idempotent-promise-handler';
+import {authenticateFlowFactory} from './authenticate/flow/authenticate';
+import {FutureFlagOptions} from './future/flags';
+
+/**
+ * Creates an object your app will use to interact with Shopify.
+ *
+ * @param appConfig Configuration options for your Shopify app, such as the scopes your app needs.
+ * @returns `ShopifyApp` An object constructed using your appConfig.  It has methods for interacting with Shopify.
+ *
+ * @example
+ * <caption>The minimum viable configuration</caption>
+ * ```ts
+ * // /shopify.server.ts
+ * import { shopifyApp } from "@shopify/shopify-app-remix/server";
+ *
+ * const shopify = shopifyApp({
+ *   apiKey: process.env.SHOPIFY_API_KEY!,
+ *   apiSecretKey: process.env.SHOPIFY_API_SECRET!,
+ *   scopes: process.env.SCOPES?.split(",")!,
+ *   appUrl: process.env.SHOPIFY_APP_URL!,
+ * });
+ * export default shopify;
+ * ```
+ */
+export function shopifyApp<
+  Config extends AppConfigArg<Resources, Storage, Future>,
+  Resources extends ShopifyRestResources,
+  Storage extends SessionStorage,
+  Future extends FutureFlagOptions = Config['future'],
+>(appConfig: Readonly<Config>): ShopifyApp<Config> {
+  const api = deriveApi(appConfig);
+  const config = deriveConfig<Storage>(appConfig, api.config);
+  const logger = overrideLogger(api.logger);
+
+  if (appConfig.webhooks) {
+    api.webhooks.addHandlers(appConfig.webhooks);
+  }
+
+  const params: BasicParams = {api, config, logger};
+  const authStrategy = authStrategyFactory<Config, Resources>({
+    ...params,
+    strategy:
+      config.future.unstable_newEmbeddedAuthStrategy && config.isEmbeddedApp
+        ? new TokenExchangeStrategy(params)
+        : new AuthCodeFlowStrategy(params),
+  });
+
+  // @ts-expect-error TODO: fix this
+  const shopify:
+    | AdminApp<Config>
+    | AppStoreApp<Config>
+    | SingleMerchantApp<Config> = {
+    sessionStorage: config.sessionStorage,
+    addDocumentResponseHeaders: addDocumentResponseHeadersFactory(params),
+    registerWebhooks: registerWebhooksFactory(params),
+    authenticate: {
+      admin: authStrategy,
+      flow: authenticateFlowFactory<Resources>(params),
+      public: authenticatePublicFactory<Future, Resources>(params),
+      webhook: authenticateWebhookFactory<
+        Future,
+        Resources,
+        keyof Config['webhooks'] | MandatoryTopics
+      >(params),
+    },
+    unauthenticated: {
+      admin: unauthenticatedAdminContextFactory(params),
+      storefront: unauthenticatedStorefrontContextFactory(params),
+    },
+  };
+
+  if (
+    isAppStoreApp(shopify, appConfig) ||
+    isSingleMerchantApp(shopify, appConfig)
+  ) {
+    shopify.login = loginFactory(params);
+  }
+
+  shopify.logger = logger;
+
+  return shopify as ShopifyApp<Config>;
+}
+
+function isAppStoreApp<Config extends AppConfigArg>(
+  _shopify: ShopifyAppBase<Config>,
+  config: Config,
+): _shopify is AppStoreApp<Config> {
+  return config.distribution === AppDistribution.AppStore;
+}
+
+function isSingleMerchantApp<Config extends AppConfigArg>(
+  _shopify: ShopifyAppBase<Config>,
+  config: Config,
+): _shopify is SingleMerchantApp<Config> {
+  return config.distribution === AppDistribution.SingleMerchant;
+}
+
+function deriveApi(appConfig: AppConfigArg) {
+  let appUrl: URL;
+  try {
+    appUrl = new URL(appConfig.appUrl);
+  } catch (error) {
+    throw new ShopifyError(
+      'Invalid appUrl provided. Please provide a valid URL.',
+    );
+  }
+
+  /* eslint-disable no-process-env */
+  if (appUrl.hostname === 'localhost' && !appUrl.port && process.env.PORT) {
+    appUrl.port = process.env.PORT;
+  }
+  /* eslint-enable no-process-env */
+  appConfig.appUrl = appUrl.origin;
+
+  let userAgentPrefix = `Shopify Remix Library v${SHOPIFY_REMIX_LIBRARY_VERSION}`;
+  if (appConfig.userAgentPrefix) {
+    userAgentPrefix = `${appConfig.userAgentPrefix} | ${userAgentPrefix}`;
+  }
+
+  return shopifyApi({
+    ...appConfig,
+    hostName: appUrl.host,
+    hostScheme: appUrl.protocol.replace(':', '') as 'http' | 'https',
+    userAgentPrefix,
+    isEmbeddedApp: appConfig.isEmbeddedApp ?? true,
+    apiVersion: appConfig.apiVersion ?? LATEST_API_VERSION,
+    isCustomStoreApp: appConfig.distribution === AppDistribution.ShopifyAdmin,
+    future: {
+      v10_lineItemBilling: appConfig.future?.v3_lineItemBilling,
+    },
+  });
+}
+
+function deriveConfig<Storage extends SessionStorage>(
+  appConfig: AppConfigArg,
+  apiConfig: ApiConfig,
+): AppConfig<Storage> {
+  if (!appConfig.sessionStorage) {
+    throw new ShopifyError(
+      'Please provide a valid session storage. Refer to https://github.com/Shopify/shopify-app-js/blob/main/README.md#session-storage-options for options.',
+    );
+  }
+
+  const authPathPrefix = appConfig.authPathPrefix || '/auth';
+  appConfig.distribution = appConfig.distribution ?? AppDistribution.AppStore;
+
+  return {
+    ...appConfig,
+    ...apiConfig,
+    idempotentPromiseHandler: new IdempotentPromiseHandler(),
+    canUseLoginForm: appConfig.distribution !== AppDistribution.ShopifyAdmin,
+    useOnlineTokens: appConfig.useOnlineTokens ?? false,
+    hooks: appConfig.hooks ?? {},
+    sessionStorage: appConfig.sessionStorage as Storage,
+    future: appConfig.future ?? {},
+    auth: {
+      path: authPathPrefix,
+      callbackPath: `${authPathPrefix}/callback`,
+      patchSessionTokenPath: `${authPathPrefix}/session-token`,
+      exitIframePath: `${authPathPrefix}/exit-iframe`,
+      loginPath: `${authPathPrefix}/login`,
+    },
+  };
+}