shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-session-storage-dynamodb/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@shopify/shopify-app-session-storage-dynamodb",
+  "version": "3.0.1",
+  "description": "Shopify App Session Storage for DynamoDB",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/shopify-app-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Shopify/shopify-app-js/issues"
+  },
+  "homepage": "https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage-dynamodb",
+  "author": "Shopify Inc.",
+  "license": "MIT",
+  "main": "./build/cjs/dynamodb.js",
+  "types": "./build/ts/dynamodb.d.ts",
+  "scripts": {},
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "shopify",
+    "node",
+    "app",
+    "graphql",
+    "rest",
+    "webhook",
+    "Admin API",
+    "Storefront API",
+    "session storage",
+    "DynamoDB",
+    "AWS"
+  ],
+  "dependencies": {
+    "@aws-sdk/client-dynamodb": "^3.504.0",
+    "@aws-sdk/util-dynamodb": "^3.499.0"
+  },
+  "peerDependencies": {
+    "@shopify/shopify-api": "^9.3.2",
+    "@shopify/shopify-app-session-storage": "^2.1.1"
+  },
+  "devDependencies": {
+    "@shopify/shopify-app-session-storage-test-utils": "^2.0.1"
+  },
+  "files": [
+    "build/*",
+    "!bundle/*",
+    "!tsconfig.tsbuildinfo",
+    "!node_modules"
+  ]
+}

package/packages/shopify-app-session-storage-dynamodb/src/__tests__/dynamodb.test.ts

@@ -0,0 +1,93 @@
+import * as child_process from 'child_process';
+import {promisify} from 'util';
+
+import {
+  CreateTableCommand,
+  DynamoDBClient,
+  waitUntilTableExists,
+} from '@aws-sdk/client-dynamodb';
+import {
+  batteryOfTests,
+  poll,
+} from '@shopify/shopify-app-session-storage-test-utils';
+
+import {DynamoDBSessionStorage} from '../dynamodb';
+
+const exec = promisify(child_process.exec);
+
+describe('DynamoDBSessionStorage', () => {
+  const sessionTableName = 'sessionTable';
+  const shopIndexName = 'shopIndex';
+  let storage: DynamoDBSessionStorage;
+
+  let containerId: string;
+  beforeAll(async () => {
+    const dynamoDBClientConfig = {
+      endpoint: 'http://localhost:8000',
+      region: 'us-west-2',
+      credentials: {
+        accessKeyId: 'shopify',
+        secretAccessKey: 'passify',
+      },
+    };
+    const runCommand = await exec(
+      'podman run -d -e AWS_ACCESS_KEY_ID=shopify -e AWS_SECRET_ACCESS_KEY=passify -p 8000:8000 amazon/dynamodb-local',
+      {encoding: 'utf8'},
+    );
+    containerId = runCommand.stdout.trim();
+
+    await poll(
+      async () => {
+        try {
+          const client = new DynamoDBClient(dynamoDBClientConfig);
+          await client.send(
+            new CreateTableCommand({
+              TableName: sessionTableName,
+              AttributeDefinitions: [
+                {AttributeName: 'id', AttributeType: 'S'},
+                {AttributeName: 'shop', AttributeType: 'S'},
+              ],
+              KeySchema: [{AttributeName: 'id', KeyType: 'HASH'}],
+              GlobalSecondaryIndexes: [
+                {
+                  IndexName: shopIndexName,
+                  KeySchema: [{AttributeName: 'shop', KeyType: 'HASH'}],
+                  Projection: {ProjectionType: 'KEYS_ONLY'},
+                  ProvisionedThroughput: {
+                    ReadCapacityUnits: 1,
+                    WriteCapacityUnits: 1,
+                  },
+                },
+              ],
+              ProvisionedThroughput: {
+                ReadCapacityUnits: 1,
+                WriteCapacityUnits: 1,
+              },
+            }),
+          );
+          await waitUntilTableExists(
+            {client, maxWaitTime: 120},
+            {TableName: sessionTableName},
+          );
+        } catch (error) {
+          // console.error(error);  // uncomment to see error for debugging tests
+          return false;
+        }
+        return true;
+      },
+      {interval: 500, timeout: 20000},
+    );
+
+    storage = new DynamoDBSessionStorage({
+      sessionTableName,
+      shopIndexName,
+      config: dynamoDBClientConfig,
+    });
+  });
+
+  afterAll(async () => {
+    await exec(`podman rm -f ${containerId}`);
+  });
+
+  batteryOfTests(async () => storage);
+});

package/packages/shopify-app-session-storage-dynamodb/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-session-storage-dynamodb/src/dynamodb.ts

@@ -0,0 +1,126 @@
+import {
+  AttributeValue,
+  DeleteItemCommand,
+  DynamoDBClient,
+  DynamoDBClientConfig,
+  GetItemCommand,
+  PutItemCommand,
+  QueryCommand,
+} from '@aws-sdk/client-dynamodb';
+import {marshall, unmarshall} from '@aws-sdk/util-dynamodb';
+import {Session, SessionParams} from '@shopify/shopify-api';
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+
+export interface DynamoDBSessionStorageOptions {
+  sessionTableName: string;
+  shopIndexName: string;
+  config?: DynamoDBClientConfig;
+}
+
+const defaultDynamoDBSessionStorageOptions: DynamoDBSessionStorageOptions = {
+  sessionTableName: 'shopify_sessions',
+  shopIndexName: 'shop_index',
+};
+
+export class DynamoDBSessionStorage implements SessionStorage {
+  private client: DynamoDBClient;
+  private options: DynamoDBSessionStorageOptions;
+
+  constructor(opts?: DynamoDBSessionStorageOptions) {
+    this.options = {...defaultDynamoDBSessionStorageOptions, ...opts};
+    this.client = new DynamoDBClient({...this.options.config});
+  }
+
+  public async storeSession(session: Session): Promise<boolean> {
+    await this.client.send(
+      new PutItemCommand({
+        TableName: this.options.sessionTableName,
+        Item: this.serializeSession(session),
+      }),
+    );
+
+    return true;
+  }
+
+  public async loadSession(id: string): Promise<Session | undefined> {
+    if (!id) return undefined;
+
+    const result = await this.client.send(
+      new GetItemCommand({
+        TableName: this.options.sessionTableName,
+        Key: this.serializeId(id),
+      }),
+    );
+
+    return result.Item ? this.deserializeSession(result.Item) : undefined;
+  }
+
+  public async deleteSession(id: string): Promise<boolean> {
+    await this.client.send(
+      new DeleteItemCommand({
+        TableName: this.options.sessionTableName,
+        Key: this.serializeId(id),
+      }),
+    );
+
+    return true;
+  }
+
+  public async deleteSessions(ids: string[]): Promise<boolean> {
+    await Promise.all(ids.map((id) => this.deleteSession(id)));
+    return true;
+  }
+
+  public async findSessionsByShop(shop: string): Promise<Session[]> {
+    const result = await this.client.send(
+      new QueryCommand({
+        TableName: this.options.sessionTableName,
+        IndexName: this.options.shopIndexName,
+        KeyConditionExpression: 'shop = :shop',
+        ExpressionAttributeValues: marshall({
+          ':shop': shop,
+        }),
+        ProjectionExpression: 'id, shop',
+      }),
+    );
+
+    const sessions = await Promise.all(
+      result.Items?.map((item) => this.loadSession(this.deserializeId(item))) ||
+        [],
+    );
+
+    return sessions.filter(
+      (session): session is Session => session !== undefined,
+    );
+  }
+
+  private serializeId(id: string): Record<string, AttributeValue> {
+    return marshall({id});
+  }
+
+  private deserializeId(id: Record<string, AttributeValue>): string {
+    return unmarshall(id).id;
+  }
+
+  private serializeSession(session: Session): Record<string, AttributeValue> {
+    // DynamoDB doesn't support Date objects, so we need to convert it to an ISO string
+    const rawSession = {
+      ...session.toObject(),
+      expires: session.expires?.toISOString(),
+    };
+
+    return marshall(rawSession, {
+      removeUndefinedValues: true,
+    });
+  }
+
+  private deserializeSession(session: Record<string, AttributeValue>): Session {
+    const rawSession = unmarshall(session) as SessionParams;
+
+    // Convert the ISO string back to a Date object
+    return new Session({
+      ...rawSession,
+      expires: rawSession.expires ? new Date(rawSession.expires) : undefined,
+    });
+  }
+}

package/packages/shopify-app-session-storage-dynamodb/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "outDir": "./build/ts",
+    "rootDir": "src"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["**/*.test.ts", "**/*.test.tsx", "**/test/*", "**/__tests__/*"]
+}

package/packages/shopify-app-session-storage-kv/CHANGELOG.md

@@ -0,0 +1,204 @@
+# @shopify/shopify-app-session-storage-kv
+
+## 3.0.2
+
+### Patch Changes
+
+- 6deb1bd: Updated dependency on `semver`
+
+## 3.0.1
+
+### Patch Changes
+
+- 02a8341: Updated dependency on `@shopify/shopify-api` to 9.3.1
+- 321d6a4: Update @shopify/shopify-api to 9.3.2
+- Updated dependencies [02a8341]
+- Updated dependencies [321d6a4]
+  - @shopify/shopify-app-session-storage@2.1.1
+
+## 3.0.0
+
+### Minor Changes
+
+- 64e0246: Update shopify-api version to 9.2.0
+
+### Patch Changes
+
+- f5742c1: Updated dependency on `@shopify/shopify-api`
+- Updated dependencies [f5742c1]
+- Updated dependencies [64e0246]
+  - @shopify/shopify-app-session-storage@2.1.0
+
+## 2.0.4
+
+### Patch Changes
+
+- b4eeb24: Improved and simplified package.json dependencies
+- b998c30: Bump shopify-api version from 9.0.1 to 9.0.2
+- Updated dependencies [b4eeb24]
+- Updated dependencies [b998c30]
+  - @shopify/shopify-app-session-storage@2.0.4
+
+## 2.0.3
+
+### Patch Changes
+
+- d3e4b5e: Updated the dependency on `@shopify/shopify-api`
+- Updated dependencies [d3e4b5e]
+  - @shopify/shopify-app-session-storage@2.0.3
+
+## 2.0.2
+
+### Patch Changes
+
+- 3685bd4: Bump shopify-api to ^8.1.1
+- Updated dependencies [3685bd4]
+  - @shopify/shopify-app-session-storage@2.0.2
+
+## 2.0.1
+
+### Patch Changes
+
+- 6d12840: Updating dependencies on @shopify/shopify-api
+- Updated dependencies [6d12840]
+  - @shopify/shopify-app-session-storage@2.0.1
+
+## 2.0.0
+
+### Major Changes
+
+- f837060: **Removed support for Node 14**
+
+  Node 14 has reached its [EOL](https://endoflife.date/nodejs), and dependencies to this package no longer work on Node 14.
+  Because of that, we can no longer support that version.
+
+  If your app is running on Node 14, you'll need to update to a more recent version before upgrading this package.
+
+  This upgrade does not require any code changes.
+
+### Patch Changes
+
+- a69d6fc: Updating dependency on @shopify/shopify-api to v.8.0.1
+- Updated dependencies [f837060]
+- Updated dependencies [a69d6fc]
+  - @shopify/shopify-app-session-storage@2.0.0
+
+## 1.0.14
+
+### Patch Changes
+
+- 616388d: Updating dependency on @shopify/shopify-api to 7.7.0
+- Updated dependencies [616388d]
+  - @shopify/shopify-app-session-storage@1.1.10
+
+## 1.0.13
+
+### Patch Changes
+
+- 5b862fe: Upgraded shopify-api dependency to 7.6.0
+- Updated dependencies [5b862fe]
+  - @shopify/shopify-app-session-storage@1.1.9
+
+## 1.0.12
+
+### Patch Changes
+
+- 346b623: Updating dependency on @shopify/shopify-api
+- Updated dependencies [346b623]
+  - @shopify/shopify-app-session-storage@1.1.8
+
+## 1.0.11
+
+### Patch Changes
+
+- 13b9048: Updating @shopify/shopify-api dependency to the latest version
+- Updated dependencies [13b9048]
+  - @shopify/shopify-app-session-storage@1.1.7
+
+## 1.0.10
+
+### Patch Changes
+
+- 32296d7: Update @shopify/shopify-api dependency to 7.5.0
+- Updated dependencies [32296d7]
+  - @shopify/shopify-app-session-storage@1.1.6
+
+## 1.0.9
+
+### Patch Changes
+
+- 93e9126: Updating @shopify/shopify-api dependency
+- Updated dependencies [93e9126]
+  - @shopify/shopify-app-session-storage@1.1.5
+
+## 1.0.8
+
+### Patch Changes
+
+- b3453ff: Bumping @shopify/shopify-api dependency to latest version
+- Updated dependencies [b3453ff]
+  - @shopify/shopify-app-session-storage@1.1.4
+
+## 1.0.7
+
+### Patch Changes
+
+- 2f10cdd: Bumps [semver](https://github.com/npm/node-semver) from 7.5.0 to 7.5.1. See `semver`'s [release notes](https://github.com/npm/node-semver/releases) for more details.
+
+## 1.0.6
+
+### Patch Changes
+
+- e1d4f4f: Add @shopify/shopify-api as a peerDependencies entry for each session-storage package, to avoid API library conflicts (e.g., scopesArray.map error). Should help avoid issues like #93
+- f40fede: Bumps [semver](https://github.com/npm/node-semver) from 7.4.0 to 7.5.0. See semver [changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) for more details.
+- 1d007e8: Bumps [@shopify/shopify-api](https://github.com/Shopify/shopify-api-js) from 7.0.0 to 7.1.0. See `@shopify/shopify-api`'s [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for more details.
+- Updated dependencies [e1d4f4f]
+- Updated dependencies [1d007e8]
+  - @shopify/shopify-app-session-storage@1.1.3
+
+## 1.0.5
+
+### Patch Changes
+
+- e4f3415: Bump @shopify/shopify-api from 6.2.0 to 7.0.0. See [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for details.
+- 49cdf3f: Bump semver from 7.3.8 to 7.4.0. See [changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) for details.
+- Updated dependencies [e4f3415]
+  - @shopify/shopify-app-session-storage@1.1.2
+
+## 1.0.4
+
+### Patch Changes
+
+- Updated dependencies [97346b3]
+  - @shopify/shopify-app-session-storage@1.1.1
+
+## 1.0.3
+
+### Patch Changes
+
+- b6501b0: Bump typescript to 4.9.5
+- Updated dependencies [b6501b0]
+- Updated dependencies [becc305]
+  - @shopify/shopify-app-session-storage@1.1.0
+
+## 1.0.2
+
+### Patch Changes
+
+- 222b755: Updating @shopify/shopify-api to v6.1.0
+- Updated dependencies [222b755]
+  - @shopify/shopify-app-session-storage@1.0.2
+
+## 1.0.1
+
+### Patch Changes
+
+- 866b50c: Update dependencies on shopify-api v6.0.2
+- Updated dependencies [866b50c]
+  - @shopify/shopify-app-session-storage@1.0.1
+
+## 1.0.0
+
+### Major Changes
+
+- 8d27b9d: Initial public release of @shopify/shopify-app-session-storage-kv

package/packages/shopify-app-session-storage-kv/LICENSE.md

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2022-present, Shopify Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/packages/shopify-app-session-storage-kv/README.md

@@ -0,0 +1,41 @@
+# Session Storage Adapter for CloudFlare KV
+
+CloudFlare's [KV](https://www.cloudflare.com/products/workers-kv/) storage can be used on worker runtimes.
+Before using it, you'll need to set up a namespace for your sessions and pass in a `KVNamespace` object.
+You can do that either when creating an instance of `KVSessionStorage`, or by calling the `setNamespace` method.
+
+```js
+import {shopifyApp} from '@shopify/shopify-app-express';
+import {KVSessionStorage} from '@shopify/shopify-app-session-storage-kv';
+
+const shopify = shopifyApp({
+  sessionStorage: new KVSessionStorage(),
+  // ...
+});
+
+export default {
+  async fetch(
+    request: Request,
+    env: Env,
+    ctx: ExecutionContext,
+  ): Promise<Response> {
+    shopify.config.sessionStorage.setNamespace(env.MY_KV_NAMESPACE);
+    // Handle request
+  },
+};
+
+// OR
+
+import {Miniflare} from 'miniflare';
+const mf = new Miniflare({
+  kvNamespaces: ['MY_KV_NAMESPACE'],
+});
+const shopify = shopifyApp({
+  sessionStorage: new KVSessionStorage(
+    await mf.getKVNamespace('MY_KV_NAMESPACE'),
+  ),
+  // ...
+});
+```
+
+If you prefer to use your own implementation of a session storage mechanism that uses the `SessionStorage` interface, see the [implementing session storage guide](https://github.com/Shopify/shopify-app-js/blob/main/packages/shopify-app-session-storage/implementing-session-storage.md).

package/packages/shopify-app-session-storage-kv/loom.config.ts

@@ -0,0 +1,27 @@
+import {createPackage} from '@shopify/loom';
+import {buildLibrary} from '@shopify/loom-plugin-build-library';
+
+export default createPackage((pkg) => {
+  pkg.entry({root: './src/kv.ts'});
+  pkg.use(
+    buildLibrary({
+      // Required. A browserslist string for specifying your target output.
+      // Use browser targets (e.g. `'defaults'`) if your package targets the browser,
+      // node targets (e.g. `'node 12.22'`) if your package targets node
+      // or both (e.g.`'defaults, node 12.22'`) if your package targets both
+      targets: 'node 16',
+      // Optional. Defaults to false. Defines if commonjs outputs should be generated.
+      commonjs: true,
+      // Optional. Defaults to false. Defines if esmodules outputs should be generated.
+      esmodules: false,
+      // Optional. Defaults to false. Defines if esnext outputs should be generated.
+      esnext: false,
+      // Optional. Defaults to true. Defines if entrypoints should be written at
+      // the root of the repository. You can disable this if you have a single
+      // entrypoint or if your package uses the `exports` key in package.json
+      rootEntrypoints: false,
+      // Optional. Defaults to 'node'. Defines if the jest environment should be 'node' or 'jsdom'.
+      jestTestEnvironment: 'node',
+    }),
+  );
+});

package/packages/shopify-app-session-storage-kv/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@shopify/shopify-app-session-storage-kv",
+  "version": "3.0.2",
+  "description": "Shopify App Session Storage for KV",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/shopify-app-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Shopify/shopify-app-js/issues"
+  },
+  "homepage": "https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage-kv",
+  "author": "Shopify Inc.",
+  "license": "MIT",
+  "main": "./build/cjs/kv.js",
+  "types": "./build/ts/kv.d.ts",
+  "scripts": {},
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "shopify",
+    "node",
+    "app",
+    "graphql",
+    "rest",
+    "webhook",
+    "Admin API",
+    "Storefront API",
+    "session storage",
+    "KV",
+    "CloudFlare"
+  ],
+  "dependencies": {
+    "semver": "^7.6.0"
+  },
+  "peerDependencies": {
+    "@shopify/shopify-api": "^9.3.2",
+    "@shopify/shopify-app-session-storage": "^2.1.1"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20240208.0",
+    "@shopify/shopify-app-session-storage-test-utils": "^2.0.1",
+    "miniflare": "^3.20231218.3"
+  },
+  "files": [
+    "build/*",
+    "!bundle/*",
+    "!tsconfig.tsbuildinfo",
+    "!node_modules"
+  ]
+}

package/packages/shopify-app-session-storage-kv/src/__tests__/kv-namespace-dummy-worker.ts

@@ -0,0 +1,8 @@
+// Dummy script just so we can create a Miniflare instance for the KV namespace
+const dummyWorker = {
+  async fetch(_request, _env, _ctx) {
+    return new Response('Hello World!');
+  },
+};
+
+export default dummyWorker;

package/packages/shopify-app-session-storage-kv/src/__tests__/kv.test.ts

@@ -0,0 +1,22 @@
+import {Miniflare} from 'miniflare';
+import {batteryOfTests} from '@shopify/shopify-app-session-storage-test-utils';
+
+import {KVSessionStorage} from '../kv';
+
+describe('KVSessionStorage', () => {
+  let storage: KVSessionStorage | undefined;
+  beforeAll(async () => {
+    const mf = new Miniflare({
+      scriptPath:
+        'packages/shopify-app-session-storage-kv/src/__tests__/kv-namespace-dummy-worker.ts',
+      kvNamespaces: ['KV_TEST_NAMESPACE'],
+      modules: true,
+    });
+
+    storage = new KVSessionStorage(
+      await mf.getKVNamespace('KV_TEST_NAMESPACE'),
+    );
+  });
+
+  batteryOfTests(async () => storage!);
+});

package/packages/shopify-app-session-storage-kv/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});