shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-session-storage/loom.config.ts

@@ -0,0 +1,45 @@
+import {createPackage, createProjectPlugin} from '@shopify/loom';
+import {buildLibrary} from '@shopify/loom-plugin-build-library';
+
+export default createPackage((pkg) => {
+  pkg.entry({root: './src/index.ts'});
+  pkg.use(
+    buildLibrary({
+      // Required. A browserslist string for specifying your target output.
+      // Use browser targets (e.g. `'defaults'`) if your package targets the browser,
+      // node targets (e.g. `'node 12.22'`) if your package targets node
+      // or both (e.g.`'defaults, node 12.22'`) if your package targets both
+      targets: 'node 16',
+      // Optional. Defaults to false. Defines if commonjs outputs should be generated.
+      commonjs: true,
+      // Optional. Defaults to false. Defines if esmodules outputs should be generated.
+      esmodules: false,
+      // Optional. Defaults to false. Defines if esnext outputs should be generated.
+      esnext: false,
+      // Optional. Defaults to true. Defines if entrypoints should be written at
+      // the root of the repository. You can disable this if you have a single
+      // entrypoint or if your package uses the `exports` key in package.json
+      rootEntrypoints: false,
+      // Optional. Defaults to 'node'. Defines if the jest environment should be 'node' or 'jsdom'.
+      jestTestEnvironment: 'node',
+    }),
+    jestConfigPlugin(),
+  );
+});
+
+function jestConfigPlugin() {
+  return createProjectPlugin(
+    'sessionStorageJestAdjustments',
+    ({tasks: {test}}) => {
+      test.hook(({hooks}) => {
+        hooks.configure.hook((configure) => {
+          // If no tests, pass the suite
+          configure.jestConfig?.hook((config) => ({
+            ...config,
+            passWithNoTests: true,
+          }));
+        });
+      });
+    },
+  );
+}

package/packages/shopify-app-session-storage/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@shopify/shopify-app-session-storage",
+  "version": "2.1.1",
+  "description": "Shopify App Session Storage - abstract class",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/shopify-app-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Shopify/shopify-app-js/issues"
+  },
+  "homepage": "https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage",
+  "author": "Shopify Inc.",
+  "license": "MIT",
+  "main": "./build/cjs/index.js",
+  "types": "./build/ts/index.d.ts",
+  "scripts": {},
+  "publishConfig": {
+    "access": "public",
+    "@shopify:registry": "https://registry.npmjs.org"
+  },
+  "keywords": [
+    "shopify",
+    "node",
+    "app",
+    "graphql",
+    "rest",
+    "webhook",
+    "Admin API",
+    "Storefront API",
+    "session storage"
+  ],
+  "dependencies": {},
+  "peerDependencies": {
+    "@shopify/shopify-api": "^9.3.2"
+  },
+  "devDependencies": {},
+  "files": [
+    "build/*",
+    "!bundle/*",
+    "!tsconfig.tsbuildinfo",
+    "!node_modules"
+  ]
+}

package/packages/shopify-app-session-storage/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-session-storage/src/abstract-migration-engine.ts

@@ -0,0 +1,53 @@
+import {
+  MigrationOperation,
+  SessionStorageMigrator,
+  SessionStorageMigratorOptions,
+  defaultSessionStorageMigratorOptions,
+  DBConnection,
+} from './types';
+
+export abstract class AbstractMigrationEngine<
+  ConnectionType extends DBConnection,
+  MigratorOptionType extends SessionStorageMigratorOptions,
+> implements SessionStorageMigrator
+{
+  protected options: SessionStorageMigratorOptions;
+  protected connection: ConnectionType;
+  protected ready: Promise<void>;
+  protected migrations: MigrationOperation[];
+
+  constructor(
+    db: ConnectionType,
+    opts: Partial<MigratorOptionType> = {},
+    migrations: MigrationOperation[],
+  ) {
+    this.options = {...defaultSessionStorageMigratorOptions, ...opts};
+    this.connection = db;
+    this.migrations = migrations;
+
+    this.ready = this.initMigrationPersistence();
+  }
+
+  async applyMigrations(databaseReady: Promise<void>): Promise<void> {
+    await databaseReady;
+    await this.ready;
+
+    for (const {migrationName, migrationFunction} of this.getMigrationList()) {
+      const migrationApplied =
+        await this.hasMigrationBeenApplied(migrationName);
+      if (!migrationApplied) {
+        await migrationFunction(this.connection);
+        await this.saveAppliedMigration(migrationName);
+      }
+    }
+    return Promise.resolve();
+  }
+
+  getMigrationList(): MigrationOperation[] {
+    return this.migrations;
+  }
+
+  abstract initMigrationPersistence(): Promise<void>;
+  abstract hasMigrationBeenApplied(migrationName: string): Promise<boolean>;
+  abstract saveAppliedMigration(migrationName: string): Promise<void>;
+}

package/packages/shopify-app-session-storage/src/index.ts

@@ -0,0 +1,3 @@
+export * from './types';
+export * from './rdbms-session-storage-migrator';
+export * from './abstract-migration-engine';

package/packages/shopify-app-session-storage/src/rdbms-session-storage-migrator.ts

@@ -0,0 +1,59 @@
+import {AbstractMigrationEngine} from './abstract-migration-engine';
+import {
+  RdbmsSessionStorageMigratorOptions,
+  defaultRdbmsSessionStorageMigratorOptions,
+  RdbmsConnection,
+  MigrationOperation,
+} from './types';
+
+export abstract class RdbmsSessionStorageMigrator extends AbstractMigrationEngine<
+  RdbmsConnection,
+  RdbmsSessionStorageMigratorOptions
+> {
+  constructor(
+    dbConnection: RdbmsConnection,
+    opts: Partial<RdbmsSessionStorageMigratorOptions> = {},
+    migrations: MigrationOperation[],
+  ) {
+    super(
+      dbConnection,
+      {
+        ...defaultRdbmsSessionStorageMigratorOptions,
+        ...opts,
+      },
+      migrations,
+    );
+  }
+
+  async hasMigrationBeenApplied(migrationName: string): Promise<boolean> {
+    await this.ready;
+
+    const query = `
+      SELECT * FROM ${this.options.migrationDBIdentifier}
+      WHERE ${this.getOptions().migrationNameColumnName} =
+        ${this.connection.getArgumentPlaceholder(1)};
+    `;
+
+    const rows = await this.connection.query(query, [migrationName]);
+    return rows.length === 1;
+  }
+
+  async saveAppliedMigration(migrationName: string): Promise<void> {
+    await this.ready;
+
+    const insert = `
+          INSERT INTO ${this.options.migrationDBIdentifier} (${
+            this.getOptions().migrationNameColumnName
+          })
+          VALUES(${this.connection.getArgumentPlaceholder(1)});
+        `;
+
+    await this.connection.query(insert, [migrationName]);
+  }
+
+  public getOptions(): RdbmsSessionStorageMigratorOptions {
+    return this.options as RdbmsSessionStorageMigratorOptions;
+  }
+
+  abstract initMigrationPersistence(): Promise<void>;
+}

package/packages/shopify-app-session-storage/src/types.ts

@@ -0,0 +1,174 @@
+import {Session} from '@shopify/shopify-api';
+
+/**
+ * Defines the strategy to be used to store sessions for the Shopify App.
+ */
+export interface SessionStorage {
+  /**
+   * Creates or updates the given session in storage.
+   *
+   * @param session Session to store
+   */
+  storeSession(session: Session): Promise<boolean>;
+
+  /**
+   * Loads a session from storage.
+   *
+   * @param id Id of the session to load
+   */
+  loadSession(id: string): Promise<Session | undefined>;
+
+  /**
+   * Deletes a session from storage.
+   *
+   * @param id Id of the session to delete
+   */
+  deleteSession(id: string): Promise<boolean>;
+
+  /**
+   * Deletes an array of sessions from storage.
+   *
+   * @param ids Array of session id's to delete
+   */
+  deleteSessions(ids: string[]): Promise<boolean>;
+
+  /**
+   * Return an array of sessions for a given shop (or [] if none found).
+   *
+   * @param shop shop of the session(s) to return
+   */
+  findSessionsByShop(shop: string): Promise<Session[]>;
+}
+
+/**
+ * define the option required to instantiate an RDBMS session storage implementation
+ */
+export interface RdbmsSessionStorageOptions {
+  sessionTableName: string;
+  migratorOptions?: RdbmsSessionStorageMigratorOptions;
+}
+
+/**
+ * Define a common way for migrator to execute query on the underlying persistence layer
+ */
+export interface DBConnection {
+  /** the table used to store sessions */
+  sessionStorageIdentifier: string;
+
+  /**
+   * Initiate the actual connection to the underlying database
+   */
+  connect(): Promise<void>;
+
+  /**
+   * Disconnect from the underlying database
+   */
+  disconnect(): Promise<void>;
+}
+
+/**
+ * This is for the use cases of the RDBMS database where
+ */
+export interface RdbmsConnection extends DBConnection {
+  /**
+   * Make a query to the underlying DB
+   * @param query - the query to execute
+   * @param params - the parameters required by the query
+   */
+  query(query: string, params: any[]): Promise<any[]>;
+
+  /**
+   * Determine if a table exist
+   * @param tablename - the table to search
+   */
+  hasTable(tablename: string): Promise<boolean>;
+
+  /**
+   * Based on the the #sqlArgumentPlaceholder value and the underlying engine, return the place holder for a given position in a list of sql argument
+   * @param position the position of the given sql argument
+   */
+  getArgumentPlaceholder(position?: number): string;
+}
+
+/**
+ * Each migration 'migration_name' will be define the following way.
+ * Via a function that receive the engine in parameter.
+ */
+export type MigrationFunction = (engine: DBConnection) => Promise<void>;
+
+/**
+ * Defines what is needed for a migration to be execute
+ */
+export class MigrationOperation {
+  /** Name of the migration that will be used to uniquely identity it among all other migration */
+  migrationName: string;
+
+  /** The actual migration function that will modify the perisitence storage */
+  migrationFunction: MigrationFunction;
+
+  constructor(migrationName: string, migrationFunction: MigrationFunction) {
+    this.migrationName = migrationName;
+    this.migrationFunction = migrationFunction;
+  }
+}
+
+/**
+ * Defines how database migration will be handled.
+ */
+export interface SessionStorageMigrator {
+  /**
+   * Should ensure that the persistence 'table' is created if it does not exist yet.
+   */
+  initMigrationPersistence(): Promise<void>;
+
+  /**
+   * Returns true if the migrationName as already been applied and
+   * therefore the migrator should not apply it. if false,
+   * the migrator will run the associated migration
+   * @param migrationName the unique version name to look for in the migration table
+   */
+  hasMigrationBeenApplied(migrationName: string): Promise<boolean>;
+
+  /**
+   * Will persist that this migrationName has been applied in the migration table
+   * @param migrationName the version to persisited as applied
+   */
+  saveAppliedMigration(migrationName: string): Promise<void>;
+
+  /**
+   * Return a list MigrationOperation that needs to be executed
+   */
+  getMigrationList(): MigrationOperation[];
+
+  /**
+   * Will iterate over the map returned by #getmigrationList,
+   * for each entry call #hasMigrationBeenApplied, if it returns false
+   * it will execute execute the function and then call #saveAppliedMigration
+   * @param databaseReady - so that the migrator can wait for the database to fully up and running
+   * before starting its execution.
+   */
+  applyMigrations(databaseReady: Promise<void>): Promise<void>;
+}
+
+/**
+ * Use to initialise session storage migrators
+ */
+export interface SessionStorageMigratorOptions {
+  migrationDBIdentifier: string;
+}
+
+export const defaultSessionStorageMigratorOptions: SessionStorageMigratorOptions =
+  {
+    migrationDBIdentifier: 'shopify_sessions_migrations',
+  };
+
+export interface RdbmsSessionStorageMigratorOptions
+  extends SessionStorageMigratorOptions {
+  migrationNameColumnName: string;
+}
+
+export const defaultRdbmsSessionStorageMigratorOptions: RdbmsSessionStorageMigratorOptions =
+  {
+    migrationDBIdentifier: 'shopify_sessions_migrations',
+    migrationNameColumnName: 'migration_name',
+  };

package/packages/shopify-app-session-storage/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "outDir": "./build/ts",
+    "rootDir": "src"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["**/*.test.ts", "**/*.test.tsx", "**/test/*", "**/__tests__/*"]
+}

package/packages/shopify-app-session-storage-dynamodb/CHANGELOG.md

@@ -0,0 +1,150 @@
+# @shopify/shopify-app-session-storage-dynamodb
+
+## 3.0.1
+
+### Patch Changes
+
+- 02a8341: Updated dependency on `@shopify/shopify-api` to 9.3.1
+- 321d6a4: Update @shopify/shopify-api to 9.3.2
+- Updated dependencies [02a8341]
+- Updated dependencies [321d6a4]
+  - @shopify/shopify-app-session-storage@2.1.1
+
+## 3.0.0
+
+### Minor Changes
+
+- 64e0246: Update shopify-api version to 9.2.0
+
+### Patch Changes
+
+- 2b54692: Update @aws-sdk/client-dynamodb from 3.470.0 to 3.504.0.
+- e2a8fd8: Updated the `@aws-sdk/util-dynamodb` dependency to v3.499.0
+- f5742c1: Updated dependency on `@shopify/shopify-api`
+- Updated dependencies [f5742c1]
+- Updated dependencies [64e0246]
+  - @shopify/shopify-app-session-storage@2.1.0
+
+## 2.0.4
+
+### Patch Changes
+
+- b4eeb24: Improved and simplified package.json dependencies
+- b998c30: Bump shopify-api version from 9.0.1 to 9.0.2
+- Updated dependencies [b4eeb24]
+- Updated dependencies [b998c30]
+  - @shopify/shopify-app-session-storage@2.0.4
+
+## 2.0.3
+
+### Patch Changes
+
+- d3e4b5e: Updated the dependency on `@shopify/shopify-api`
+- Updated dependencies [d3e4b5e]
+  - @shopify/shopify-app-session-storage@2.0.3
+
+## 2.0.2
+
+### Patch Changes
+
+- 3685bd4: Bump shopify-api to ^8.1.1
+- Updated dependencies [3685bd4]
+  - @shopify/shopify-app-session-storage@2.0.2
+
+## 2.0.1
+
+### Patch Changes
+
+- 6d12840: Updating dependencies on @shopify/shopify-api
+- Updated dependencies [6d12840]
+  - @shopify/shopify-app-session-storage@2.0.1
+
+## 2.0.0
+
+### Major Changes
+
+- f837060: **Removed support for Node 14**
+
+  Node 14 has reached its [EOL](https://endoflife.date/nodejs), and dependencies to this package no longer work on Node 14.
+  Because of that, we can no longer support that version.
+
+  If your app is running on Node 14, you'll need to update to a more recent version before upgrading this package.
+
+  This upgrade does not require any code changes.
+
+### Patch Changes
+
+- a69d6fc: Updating dependency on @shopify/shopify-api to v.8.0.1
+- Updated dependencies [f837060]
+- Updated dependencies [a69d6fc]
+  - @shopify/shopify-app-session-storage@2.0.0
+
+## 1.0.8
+
+### Patch Changes
+
+- 616388d: Updating dependency on @shopify/shopify-api to 7.7.0
+- Updated dependencies [616388d]
+  - @shopify/shopify-app-session-storage@1.1.10
+
+## 1.0.7
+
+### Patch Changes
+
+- 5b862fe: Upgraded shopify-api dependency to 7.6.0
+- Updated dependencies [5b862fe]
+  - @shopify/shopify-app-session-storage@1.1.9
+
+## 1.0.6
+
+### Patch Changes
+
+- 346b623: Updating dependency on @shopify/shopify-api
+- Updated dependencies [346b623]
+  - @shopify/shopify-app-session-storage@1.1.8
+
+## 1.0.5
+
+### Patch Changes
+
+- 13b9048: Updating @shopify/shopify-api dependency to the latest version
+- Updated dependencies [13b9048]
+  - @shopify/shopify-app-session-storage@1.1.7
+
+## 1.0.4
+
+### Patch Changes
+
+- 32296d7: Update @shopify/shopify-api dependency to 7.5.0
+- Updated dependencies [32296d7]
+  - @shopify/shopify-app-session-storage@1.1.6
+
+## 1.0.3
+
+### Patch Changes
+
+- 93e9126: Updating @shopify/shopify-api dependency
+- Updated dependencies [93e9126]
+  - @shopify/shopify-app-session-storage@1.1.5
+
+## 1.0.2
+
+### Patch Changes
+
+- b3453ff: Bumping @shopify/shopify-api dependency to latest version
+- Updated dependencies [b3453ff]
+  - @shopify/shopify-app-session-storage@1.1.4
+
+## 1.0.1
+
+### Patch Changes
+
+- 1d260ea: Bumps [@aws-sdk/util-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/util-dynamodb) from 3.294.0 to 3.332.0.
+- 5e6cf36: Bumps [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) from 3.294.0 to 3.332.0.
+  - See `@aws-sdk`'s [release notes](https://github.com/aws/aws-sdk-js-v3/releases) for more details.
+
+## 1.0.0
+
+### Major Changes
+
+- 3d92b70: Implementation of @shopify/shopify-app-session-storage-dynamodb for AWS DynamoDB

package/packages/shopify-app-session-storage-dynamodb/LICENSE.md

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2022-present, Shopify Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/packages/shopify-app-session-storage-dynamodb/README.md

@@ -0,0 +1,75 @@
+# Session Storage Adapter for AWS DynamoDB
+
+This package implements the `SessionStorage` interface that works with an AWS DynamoDB database.
+
+Contributed by [Chris](https://github.com/zirkelc) - thank you :clap:
+
+```js
+import {shopifyApp} from '@shopify/shopify-app-express';
+import {DynamoDBSessionStorage} from '@shopify/shopify-app-session-storage-dynamodb';
+
+// You can use the default options
+const storage = new DynamoDBSessionStorage();
+
+// or, if you want to use a different session table name and shop index name
+const storage = new DynamoDBSessionStorage({ sessionTableName: 'my-session-table', shopIndexName: 'my-shop-index' });
+
+// or, if you want to use a different region or credentials
+const storage = new DynamoDBSessionStorage({ config: { region: 'us-west-2', credentials: { ... } } });
+
+const shopify = shopifyApp({
+  sessionStorage: storage,
+  // ...
+});
+```
+
+## Table Schema
+
+```js
+{
+  TableName: sessionTableName,
+  AttributeDefinitions: [
+    {AttributeName: 'id', AttributeType: 'S'},
+    {AttributeName: 'shop', AttributeType: 'S'},
+  ],
+  KeySchema: [{AttributeName: 'id', KeyType: 'HASH'}],
+  GlobalSecondaryIndexes: [
+    {
+      IndexName: shopIndexName,
+      KeySchema: [{AttributeName: 'shop', KeyType: 'HASH'}],
+      Projection: {ProjectionType: 'KEYS_ONLY'},
+      ProvisionedThroughput: {
+        ReadCapacityUnits: 1,
+        WriteCapacityUnits: 1,
+      },
+    },
+  ],
+  ProvisionedThroughput: {ReadCapacityUnits: 1, WriteCapacityUnits: 1},
+}
+```
+
+### AWS Policy for DynamoDB
+
+This policy must be attached to a user -- `dynamodb:Query` does not work with inline policies.
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "Statement1",
+      "Effect": "Allow",
+      "Action": [
+        "dynamodb:GetItem",
+        "dynamodb:DeleteItem",
+        "dynamodb:PutItem",
+        "dynamodb:Query",
+        "dynamodb:DescribeTable"
+      ],
+      "Resource": ["arn:aws:dynamodb:<region>:<account-id>:table/<table-name>"]
+    }
+  ]
+}
+```
+
+If you prefer to use your own implementation of a session storage mechanism that uses the `SessionStorage` interface, see the [implementing session storage guide](https://github.com/Shopify/shopify-app-js/blob/main/packages/shopify-app-session-storage/implementing-session-storage.md).

package/packages/shopify-app-session-storage-dynamodb/loom.config.ts

@@ -0,0 +1,27 @@
+import {createPackage} from '@shopify/loom';
+import {buildLibrary} from '@shopify/loom-plugin-build-library';
+
+export default createPackage((pkg) => {
+  pkg.entry({root: './src/dynamodb.ts'});
+  pkg.use(
+    buildLibrary({
+      // Required. A browserslist string for specifying your target output.
+      // Use browser targets (e.g. `'defaults'`) if your package targets the browser,
+      // node targets (e.g. `'node 12.22'`) if your package targets node
+      // or both (e.g.`'defaults, node 12.22'`) if your package targets both
+      targets: 'node 16',
+      // Optional. Defaults to false. Defines if commonjs outputs should be generated.
+      commonjs: true,
+      // Optional. Defaults to false. Defines if esmodules outputs should be generated.
+      esmodules: false,
+      // Optional. Defaults to false. Defines if esnext outputs should be generated.
+      esnext: false,
+      // Optional. Defaults to true. Defines if entrypoints should be written at
+      // the root of the repository. You can disable this if you have a single
+      // entrypoint or if your package uses the `exports` key in package.json
+      rootEntrypoints: false,
+      // Optional. Defaults to 'node'. Defines if the jest environment should be 'node' or 'jsdom'.
+      jestTestEnvironment: 'node',
+    }),
+  );
+});