shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-remix/src/server/unauthenticated/admin/unauthenticated.admin.doc.ts

@@ -0,0 +1,40 @@
+import {ReferenceEntityTemplateSchema} from '@shopify/generate-docs';
+
+const data: ReferenceEntityTemplateSchema = {
+  name: 'Unauthenticated admin',
+  description: `Allows interacting with the Admin API when working outside of Shopify requests.
+This enables apps to integrate with 3rd party services and perform background tasks.
+
+> Caution:
+> This function doesn't perform **any** validation and shouldn't rely on raw user input.
+
+When using this function, consider the following:
+
+#### Background tasks
+
+Apps should ensure that the shop domain is authenticated when enqueueing jobs.
+
+#### 3rd party service requests
+
+Apps must obtain the shop domain from the 3rd party service in a secure way.`,
+  category: 'Unauthenticated',
+  type: 'object',
+  isVisualComponent: false,
+  definitions: [
+    {
+      title: 'unauthenticated.admin',
+      description: 'Creates an unauthenticated Admin context.',
+      type: 'GetUnauthenticatedAdminContext',
+    },
+  ],
+  jsDocTypeExamples: ['UnauthenticatedAdminContext'],
+  related: [
+    {
+      name: 'API context',
+      subtitle: 'Interact with the Admin API.',
+      url: '/docs/api/shopify-app-remix/apis/admin-api',
+    },
+  ],
+};
+
+export default data;

package/packages/shopify-app-remix/src/server/unauthenticated/helpers/get-offline-session.ts

@@ -0,0 +1,13 @@
+import {Session} from '@shopify/shopify-api';
+
+import {BasicParams} from '../../types';
+
+export async function getOfflineSession(
+  shop: string,
+  {api, config}: BasicParams,
+): Promise<Session | undefined> {
+  const offlineSessionId = api.session.getOfflineId(shop);
+  const session = await config.sessionStorage.loadSession(offlineSessionId);
+
+  return session;
+}

package/packages/shopify-app-remix/src/server/unauthenticated/helpers/index.ts

@@ -0,0 +1 @@
+export * from './get-offline-session';

package/packages/shopify-app-remix/src/server/unauthenticated/storefront/__tests__/factory.test.ts

@@ -0,0 +1,30 @@
+import {shopifyApp} from '../../../index';
+import {
+  TEST_SHOP,
+  setUpValidSession,
+  testConfig,
+  expectStorefrontApiClient,
+} from '../../../__test-helpers';
+
+describe('unauthenticated storefront context', () => {
+  it('throws an error if there is no offline session for the shop', async () => {
+    // GIVEN
+    const shopify = shopifyApp(testConfig());
+
+    // EXPECT
+    await expect(
+      shopify.unauthenticated.storefront(TEST_SHOP),
+    ).rejects.toThrow();
+  });
+
+  expectStorefrontApiClient(async () => {
+    const shopify = shopifyApp(testConfig());
+    const expectedSession = await setUpValidSession(shopify.sessionStorage, {
+      isOnline: false,
+    });
+    const {storefront, session: actualSession} =
+      await shopify.unauthenticated.storefront(TEST_SHOP);
+
+    return {storefront, expectedSession, actualSession};
+  });
+});

package/packages/shopify-app-remix/src/server/unauthenticated/storefront/factory.ts

@@ -0,0 +1,28 @@
+import {SessionNotFoundError} from '../../errors';
+import {BasicParams} from '../../types';
+import {storefrontClientFactory} from '../../clients/storefront';
+import {getOfflineSession} from '../helpers';
+
+import {
+  UnauthenticatedStorefrontContext,
+  GetUnauthenticatedStorefrontContext,
+} from './types';
+
+export function unauthenticatedStorefrontContextFactory(
+  params: BasicParams,
+): GetUnauthenticatedStorefrontContext {
+  return async (shop: string): Promise<UnauthenticatedStorefrontContext> => {
+    const session = await getOfflineSession(shop, params);
+
+    if (!session) {
+      throw new SessionNotFoundError(
+        `Could not find a session for shop ${shop} when creating unauthenticated storefront context`,
+      );
+    }
+
+    return {
+      session,
+      storefront: storefrontClientFactory({params, session}),
+    };
+  };
+}

package/packages/shopify-app-remix/src/server/unauthenticated/storefront/index.ts

@@ -0,0 +1 @@
+export * from './factory';

package/packages/shopify-app-remix/src/server/unauthenticated/storefront/types.ts

@@ -0,0 +1,39 @@
+import {Session} from '@shopify/shopify-api';
+
+import type {StorefrontContext} from '../../clients';
+
+export interface UnauthenticatedStorefrontContext {
+  /**
+   * The session for the given shop.
+   *
+   * This comes from the session storage which `shopifyApp` uses to store sessions in your database of choice.
+   *
+   * This will always be an offline session. You can use this to get shop specific data.
+   *
+   * @example
+   * <caption>Using the offline session.</caption>
+   * <description>Get your app's shop-specific data using the returned offline `session` object.</description>
+   * ```ts
+   * // app/routes/**\/.ts
+   * import { LoaderFunctionArgs, json } from "@remix-run/node";
+   * import { unauthenticated } from "../shopify.server";
+   * import { getMyAppData } from "~/db/model.server";
+   *
+   * export const loader = async ({ request }: LoaderFunctionArgs) => {
+   *   const shop = getShopFromExternalRequest(request);
+   *   const { session } = await unauthenticated.storefront(shop);
+   *   return json(await getMyAppData({shop: session.shop));
+   * };
+   * ```
+   */
+  session: Session;
+
+  /**
+   * Method for interacting with the Shopify GraphQL Storefront API for the given store.
+   */
+  storefront: StorefrontContext;
+}
+
+export type GetUnauthenticatedStorefrontContext = (
+  shop: string,
+) => Promise<UnauthenticatedStorefrontContext>;

package/packages/shopify-app-remix/src/server/unauthenticated/storefront/unauthenticated.storefront.doc.ts

@@ -0,0 +1,40 @@
+import {ReferenceEntityTemplateSchema} from '@shopify/generate-docs';
+
+const data: ReferenceEntityTemplateSchema = {
+  name: 'Unauthenticated storefront',
+  description: `Allows interacting with the Storefront API when working outside of Shopify requests.
+This enables apps to integrate with 3rd party services and perform background tasks.
+
+> Caution:
+> This function doesn't perform **any** validation and shouldn't rely on raw user input.
+
+When using this function, consider the following:
+
+#### Background tasks
+
+Apps should ensure that the shop domain is authenticated when enqueueing jobs.
+
+#### 3rd party service requests
+
+Apps must obtain the shop domain from the 3rd party service in a secure way.`,
+  category: 'Unauthenticated',
+  type: 'object',
+  isVisualComponent: false,
+  definitions: [
+    {
+      title: 'unauthenticated.storefront',
+      description: 'Creates an unauthenticated Storefront context.',
+      type: 'GetUnauthenticatedStorefrontContext',
+    },
+  ],
+  jsDocTypeExamples: ['UnauthenticatedStorefrontContext', 'StorefrontContext'],
+  related: [
+    {
+      name: 'API context',
+      subtitle: 'Interact with the Storefront API.',
+      url: '/docs/api/shopify-app-remix/apis/storefront-api',
+    },
+  ],
+};
+
+export default data;

package/packages/shopify-app-remix/src/server/unauthenticated/types.ts

@@ -0,0 +1,68 @@
+import type {ShopifyRestResources} from '@shopify/shopify-api';
+
+import type {GetUnauthenticatedAdminContext} from './admin/types';
+import type {GetUnauthenticatedStorefrontContext} from './storefront/types';
+
+export interface Unauthenticated<Resources extends ShopifyRestResources> {
+  /**
+   * Get an admin context by passing a shop
+   *
+   * **Warning** This should only be used for Requests that do not originate from Shopify.
+   * You must do your own authentication before using this method.
+   * This method throws an error if there is no session for the shop.
+   *
+   * @example
+   * <caption>Responding to a request not controlled by Shopify.</caption>
+   * ```ts
+   * // /app/shopify.server.ts
+   * import { LATEST_API_VERSION, shopifyApp } from "@shopify/shopify-app-remix/server";
+   * import { restResources } from "@shopify/shopify-api/rest/admin/2023-04";
+   *
+   * const shopify = shopifyApp({
+   *   restResources,
+   *   // ...etc
+   * });
+   * export default shopify;
+   * ```
+   * ```ts
+   * // /app/routes/**\/*.jsx
+   * import { LoaderFunctionArgs, json } from "@remix-run/node";
+   * import { authenticateExternal } from "~/helpers/authenticate"
+   * import shopify from "../../shopify.server";
+   *
+   * export async function loader({ request }: LoaderFunctionArgs) {
+   *   const shop = await authenticateExternal(request)
+   *   const {admin} = await shopify.unauthenticated.admin(shop);
+   *
+   *   return json(await admin.rest.resources.Product.count({ session }));
+   * }
+   * ```
+   */
+  admin: GetUnauthenticatedAdminContext<Resources>;
+
+  /**
+   * Get a storefront context by passing a shop
+   *
+   * **Warning** This should only be used for Requests that do not originate from Shopify.
+   * You must do your own authentication before using this method.
+   * This method throws an error if there is no session for the shop.
+   *
+   * @example
+   * <caption>Responding to a request not controlled by Shopify</caption>
+   * ```ts
+   * // /app/routes/**\/*.jsx
+   * import { LoaderFunctionArgs, json } from "@remix-run/node";
+   * import { authenticateExternal } from "~/helpers/authenticate"
+   * import shopify from "../../shopify.server";
+   *
+   * export async function loader({ request }: LoaderFunctionArgs) {
+   *   const shop = await authenticateExternal(request)
+   *   const {storefront} = await shopify.unauthenticated.storefront(shop);
+   *   const response = await storefront.graphql(`{blogs(first: 10) { edges { node { id } } } }`);
+   *
+   *   return json(await response.json());
+   * }
+   * ```
+   */
+  storefront: GetUnauthenticatedStorefrontContext;
+}

package/packages/shopify-app-remix/src/server/version.ts

@@ -0,0 +1 @@
+export const SHOPIFY_REMIX_LIBRARY_VERSION = '2.6.1';

package/packages/shopify-app-remix/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "outDir": "./build/ts",
+    "rootDir": "src",
+    "jsx": "react-jsx"
+  },
+  "include": ["src/**/*.ts", "src/**/*.tsx"],
+  "exclude": ["**/*.test.ts", "**/*.test.tsx", "**/test/*", "**/__tests__/*"]
+}

package/packages/shopify-app-session-storage/CHANGELOG.md

@@ -0,0 +1,149 @@
+# @shopify/shopify-app-session-storage
+
+## 2.1.1
+
+### Patch Changes
+
+- 02a8341: Updated dependency on `@shopify/shopify-api` to 9.3.1
+- 321d6a4: Update @shopify/shopify-api to 9.3.2
+
+## 2.1.0
+
+### Minor Changes
+
+- 64e0246: Update shopify-api version to 9.2.0
+
+### Patch Changes
+
+- f5742c1: Updated dependency on `@shopify/shopify-api`
+
+## 2.0.4
+
+### Patch Changes
+
+- b4eeb24: Improved and simplified package.json dependencies
+- b998c30: Bump shopify-api version from 9.0.1 to 9.0.2
+
+## 2.0.3
+
+### Patch Changes
+
+- d3e4b5e: Updated the dependency on `@shopify/shopify-api`
+
+## 2.0.2
+
+### Patch Changes
+
+- 3685bd4: Bump shopify-api to ^8.1.1
+
+## 2.0.1
+
+### Patch Changes
+
+- 6d12840: Updating dependencies on @shopify/shopify-api
+
+## 2.0.0
+
+### Major Changes
+
+- f837060: **Removed support for Node 14**
+
+  Node 14 has reached its [EOL](https://endoflife.date/nodejs), and dependencies to this package no longer work on Node 14.
+  Because of that, we can no longer support that version.
+
+  If your app is running on Node 14, you'll need to update to a more recent version before upgrading this package.
+
+  This upgrade does not require any code changes.
+
+### Patch Changes
+
+- a69d6fc: Updating dependency on @shopify/shopify-api to v.8.0.1
+
+## 1.1.10
+
+### Patch Changes
+
+- 616388d: Updating dependency on @shopify/shopify-api to 7.7.0
+
+## 1.1.9
+
+### Patch Changes
+
+- 5b862fe: Upgraded shopify-api dependency to 7.6.0
+
+## 1.1.8
+
+### Patch Changes
+
+- 346b623: Updating dependency on @shopify/shopify-api
+
+## 1.1.7
+
+### Patch Changes
+
+- 13b9048: Updating @shopify/shopify-api dependency to the latest version
+
+## 1.1.6
+
+### Patch Changes
+
+- 32296d7: Update @shopify/shopify-api dependency to 7.5.0
+
+## 1.1.5
+
+### Patch Changes
+
+- 93e9126: Updating @shopify/shopify-api dependency
+
+## 1.1.4
+
+### Patch Changes
+
+- b3453ff: Bumping @shopify/shopify-api dependency to latest version
+
+## 1.1.3
+
+### Patch Changes
+
+- e1d4f4f: Add @shopify/shopify-api as a peerDependencies entry for each session-storage package, to avoid API library conflicts (e.g., scopesArray.map error). Should help avoid issues like #93
+- 1d007e8: Bumps [@shopify/shopify-api](https://github.com/Shopify/shopify-api-js) from 7.0.0 to 7.1.0. See `@shopify/shopify-api`'s [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for more details.
+
+## 1.1.2
+
+### Patch Changes
+
+- e4f3415: Bump @shopify/shopify-api from 6.2.0 to 7.0.0. See [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for details.
+
+## 1.1.1
+
+### Patch Changes
+
+- 97346b3: Fix #132: mysql migrator was unable to detect already applied migrations
+
+## 1.1.0
+
+### Minor Changes
+
+- becc305: Migrations capabilities that can handle persistence changes for all session storage implementations
+
+### Patch Changes
+
+- b6501b0: Bump typescript to 4.9.5
+
+## 1.0.2
+
+### Patch Changes
+
+- 222b755: Updating @shopify/shopify-api to v6.1.0
+
+## 1.0.1
+
+### Patch Changes
+
+- 866b50c: Update dependencies on shopify-api v6.0.2
+
+## 1.0.0
+
+### Major Changes
+
+- Initial public release of @shopify/shopify-app-session-storage

package/packages/shopify-app-session-storage/LICENSE.md

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2022-present, Shopify Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/packages/shopify-app-session-storage/README.md

@@ -0,0 +1,5 @@
+# Session Storage
+
+This folder contains the `SessionStorage` interface that the individual [packages](../) for most common databases implement.
+
+See the [`session-storage.ts`](./src/types.ts) file for the methods that need to be implemented, the params they accept and values they return.

package/packages/shopify-app-session-storage/implementing-session-storage.md

@@ -0,0 +1,214 @@
+# Implementing session storage
+
+A custom implementaton of `SessionStorage` will need to implement the following methods, as documented by the abstract [`SessionStorage`](./src/types.ts) class:
+
+|        Method        | Parameter type |          Return value           | Description                                                                                                   |
+| :------------------: | :------------: | :-----------------------------: | ------------------------------------------------------------------------------------------------------------- |
+|    `storeSession`    |   `Session`    |       `Promise<boolean>`        | Creates or updates the given session in storage; returns `true` if successfully stored, `false` otherwise     |
+|    `loadSession`     |    `string`    | `Promise<Session \| undefined>` | Returns a `Session` matching the given session id from storage, or returns `undefined` if not found           |
+|   `deleteSession`    |    `string`    |       `Promise<boolean>`        | Deletes a session matching the given session id from storage; returns `true` if successful, `false` otherwise |
+|   `deleteSessions`   |   `string[]`   |       `Promise<boolean>`        | Deletes each of the given session ids (array) from storage; returns `true` if successful, `false` otherwise   |
+| `findSessionsByShop` |    `string`    |      `Promise<Session[]>`       | Returns an array of `Session`s for the given shop domain; returns an empty array of none found                |
+
+## Example
+
+As an example of an implementation, the following saves sessions to a text file, stored in CSV format.
+
+> **Note 1**: This is for the purposes of example only - this implementation would not be suitable for production as it would be too inefficient nor would it scale beyond a single app instance.
+
+> **Note 2**: The format of a line in the csv file is a list of property name/property value pairs, e.g.
+
+```csv
+id,this-is-a-session-id,shop,my-test-shop.myshopify.com,state,150801840581085,isOnline,true,...
+```
+
+```ts
+import fs from 'fs';
+import {Session} from '@shopify/shopify-api';
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+
+export class CsvSessionStorage implements SessionStorage {
+  constructor(private filename: string) {
+    super();
+
+    this.init();
+  }
+
+  public async storeSession(session: Session): Promise<boolean> {
+    try {
+      const lines = this.readLines();
+
+      let found = false;
+
+      // process each line
+      for (let i = 0; i < lines.length; i++) {
+        // split the line by comma into columns
+        const columns = lines[i].split(',');
+        // check if the id column matches (second column is value of 'id')
+        if (columns[1] === session.id) {
+          // if the session id already exists, update the line
+          lines[i] = session.toPropertyArray().join(',');
+          found = true;
+          break;
+        }
+      }
+
+      if (!found) {
+        // if the session id does not exist, add a new line
+        lines.push(session.toPropertyArray().join(','));
+      }
+
+      try {
+        this.writeLines(lines);
+        return true;
+      } catch (err) {
+        // error on write
+        return false;
+      }
+    } catch (err) {
+      // error on read
+      return false;
+    }
+  }
+
+  public async loadSession(id: string): Promise<Session | undefined> {
+    try {
+      const lines = this.readLines();
+
+      // process each line
+      for (const line of lines) {
+        // split the line by comma into columns
+        const columns = line.split(',');
+        // check if the id column matches (second column is value of 'id')
+        if (columns[1] === id) {
+          // if the session id already exists, convert to session and return
+          return Session.fromPropertyArray(
+            this.columnsToPropertyArray(columns),
+          );
+        }
+      }
+
+      return undefined;
+    } catch (err) {
+      // error on read
+      return undefined;
+    }
+  }
+
+  public async deleteSession(id: string): Promise<boolean> {
+    try {
+      const lines = this.readLines();
+
+      // process each line
+      for (let i = 0; i < lines.length; i++) {
+        // split the line by comma into columns
+        const columns = lines[i].split(',');
+        // check if the id column matches (second column is value of 'id')
+        if (columns[1] === id) {
+          // if the session id matches, remove the line
+          lines.splice(i, 1);
+          break;
+        }
+      }
+
+      try {
+        this.writeLines(lines);
+        return true;
+      } catch (err) {
+        // error on write
+        return false;
+      }
+    } catch (err) {
+      // error on read
+      return false;
+    }
+  }
+
+  public async deleteSessions(ids: string[]): Promise<boolean> {
+    try {
+      const lines = this.readLines();
+
+      // process each line
+      for (let i = 0; i < lines.length; i++) {
+        // split the line by comma into columns
+        const columns = lines[i].split(',');
+        // check if the id column matches (second column is value of 'id')
+        if (ids.includes(columns[1])) {
+          // if the session id already exists, remove the line
+          lines.splice(i, 1);
+        }
+      }
+
+      try {
+        this.writeLines(lines);
+        return true;
+      } catch (err) {
+        // error on write
+        return false;
+      }
+    } catch (err) {
+      // error on read
+      return false;
+    }
+  }
+
+  public async findSessionsByShop(shop: string): Promise<Session[]> {
+    try {
+      const lines = this.readLines();
+
+      const sessions: Session[] = [];
+
+      // process each line
+      for (const line of lines) {
+        // split the line by comma into columns
+        const columns = line.split(',');
+        // check if the shop column matches (fourth column is value of 'shop')
+        if (columns[3] === shop) {
+          // if the shop matches, convert to session and add to array
+          sessions.push(
+            Session.fromPropertyArray(this.columnsToPropertyArray(columns)),
+          );
+        }
+      }
+
+      return sessions;
+    } catch (err) {
+      // error on read
+      return [];
+    }
+  }
+
+  private init() {
+    if (!fs.existsSync(this.filename)) {
+      fs.writeFileSync(this.filename, '');
+    }
+  }
+
+  private readLines(): string[] {
+    // read contents of the file
+    const data = fs.readFileSync(this.filename, {
+      encoding: 'utf8',
+      flag: 'r',
+    });
+
+    // split the contents by new line
+    return data.split(/\r?\n/);
+  }
+
+  private writeLines(lines: string[]) {
+    // write the lines back to the file
+    fs.writeFileSync(this.filename, lines.join('\n'), {
+      encoding: 'utf8',
+      flag: 'w',
+    });
+  }
+
+  private columnsToPropertyArray(columns: string[]): [string, string][] {
+    const propertyArray: [string, string][] = [];
+    for (let i = 0; i < columns.length; i += 2) {
+      propertyArray.push([columns[i], columns[i + 1]]);
+    }
+    return propertyArray;
+  }
+}
+```