shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-session-storage-mongodb/README.md

@@ -0,0 +1,30 @@
+# Session Storage Adapter for MongoDB
+
+This package implements the `SessionStorage` interface that works with an instance of [MongoDB](https://www.mongodb.com/home).
+
+```js
+import {shopifyApp} from '@shopify/shopify-app-express';
+import {MongoDBSessionStorage} from '@shopify/shopify-app-session-storage-mongodb';
+
+const shopify = shopifyApp({
+  sessionStorage: new MongoDBSessionStorage(
+    'mongodb://username:password@host/',
+    'database',
+  ),
+  // ...
+});
+
+// OR
+
+const shopify = shopifyApp({
+  sessionStorage: MongoDBSessionStorage.withCredentials(
+    'host.com',
+    'thedatabase',
+    'username',
+    'password',
+  ),
+  // ...
+});
+```
+
+If you prefer to use your own implementation of a session storage mechanism that is compatible with the `@shopify/shopify-app-express` package, see the [implementing session storage guide](https://github.com/Shopify/shopify-app-js/blob/main/packages/shopify-app-session-storage/implementing-session-storage.md).

package/packages/shopify-app-session-storage-mongodb/loom.config.ts

@@ -0,0 +1,27 @@
+import {createPackage, createProjectPlugin} from '@shopify/loom';
+import {buildLibrary} from '@shopify/loom-plugin-build-library';
+
+export default createPackage((pkg) => {
+  pkg.entry({root: './src/mongodb.ts'});
+  pkg.use(
+    buildLibrary({
+      // Required. A browserslist string for specifying your target output.
+      // Use browser targets (e.g. `'defaults'`) if your package targets the browser,
+      // node targets (e.g. `'node 12.22'`) if your package targets node
+      // or both (e.g.`'defaults, node 12.22'`) if your package targets both
+      targets: 'node 16',
+      // Optional. Defaults to false. Defines if commonjs outputs should be generated.
+      commonjs: true,
+      // Optional. Defaults to false. Defines if esmodules outputs should be generated.
+      esmodules: false,
+      // Optional. Defaults to false. Defines if esnext outputs should be generated.
+      esnext: false,
+      // Optional. Defaults to true. Defines if entrypoints should be written at
+      // the root of the repository. You can disable this if you have a single
+      // entrypoint or if your package uses the `exports` key in package.json
+      rootEntrypoints: false,
+      // Optional. Defaults to 'node'. Defines if the jest environment should be 'node' or 'jsdom'.
+      jestTestEnvironment: 'node',
+    }),
+  );
+});

package/packages/shopify-app-session-storage-mongodb/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@shopify/shopify-app-session-storage-mongodb",
+  "version": "3.0.1",
+  "description": "Shopify App Session Storage for MongoDB",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/shopify-app-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Shopify/shopify-app-js/issues"
+  },
+  "homepage": "https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage-mongodb",
+  "author": "Shopify Inc.",
+  "license": "MIT",
+  "main": "./build/cjs/mongodb.js",
+  "types": "./build/ts/mongodb.d.ts",
+  "scripts": {},
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "shopify",
+    "node",
+    "app",
+    "graphql",
+    "rest",
+    "webhook",
+    "Admin API",
+    "Storefront API",
+    "MongoDB",
+    "session storage"
+  ],
+  "dependencies": {
+    "mongodb": "^6.3.0"
+  },
+  "peerDependencies": {
+    "@shopify/shopify-api": "^9.3.2",
+    "@shopify/shopify-app-session-storage": "^2.1.1"
+  },
+  "devDependencies": {
+    "@shopify/shopify-app-session-storage-test-utils": "^2.0.1"
+  },
+  "files": [
+    "build/*",
+    "!bundle/*",
+    "!tsconfig.tsbuildinfo",
+    "!node_modules"
+  ]
+}

package/packages/shopify-app-session-storage-mongodb/src/__tests__/mongodb.test.ts

@@ -0,0 +1,54 @@
+import * as child_process from 'child_process';
+import {promisify} from 'util';
+
+import {
+  batteryOfTests,
+  poll,
+} from '@shopify/shopify-app-session-storage-test-utils';
+import * as mongodb from 'mongodb';
+
+import {MongoDBSessionStorage} from '../mongodb';
+
+const exec = promisify(child_process.exec);
+
+const dbURL = new URL(
+  `mongodb://${encodeURIComponent('shop&fy')}:${encodeURIComponent(
+    'passify$#',
+  )}@localhost`,
+);
+const dbName = 'shopitest';
+
+describe('MongoDBSessionStorage', () => {
+  let storage: MongoDBSessionStorage;
+  let containerId: string;
+  beforeAll(async () => {
+    const runCommand = await exec(
+      "podman run -d -e MONGO_INITDB_DATABASE=shopitest -e MONGO_INITDB_ROOT_USERNAME='shop&fy' -e MONGO_INITDB_ROOT_PASSWORD='passify$#' -p 27017:27017 mongo:5",
+      {encoding: 'utf8'},
+    );
+    containerId = runCommand.stdout.trim();
+
+    await poll(
+      async () => {
+        try {
+          const client = new (mongodb as any).MongoClient(dbURL.toString());
+          await client.connect();
+          await client.db().command({ping: 1});
+          client.close();
+        } catch {
+          return false;
+        }
+        return true;
+      },
+      {interval: 500, timeout: 20000},
+    );
+    storage = new MongoDBSessionStorage(dbURL, dbName);
+  });
+
+  afterAll(async () => {
+    await storage.disconnect();
+    await exec(`podman rm -f ${containerId}`);
+  });
+
+  batteryOfTests(async () => storage);
+});

package/packages/shopify-app-session-storage-mongodb/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-session-storage-mongodb/src/mongodb.ts

@@ -0,0 +1,120 @@
+import * as mongodb from 'mongodb';
+import {Session} from '@shopify/shopify-api';
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+
+export interface MongoDBSessionStorageOptions {
+  sessionCollectionName: string;
+}
+const defaultMongoDBSessionStorageOptions: MongoDBSessionStorageOptions = {
+  sessionCollectionName: 'shopify_sessions',
+};
+
+export class MongoDBSessionStorage implements SessionStorage {
+  static withCredentials(
+    host: string,
+    dbName: string,
+    username: string,
+    password: string,
+    opts: Partial<MongoDBSessionStorageOptions>,
+  ) {
+    return new MongoDBSessionStorage(
+      new URL(
+        `mongodb://${encodeURIComponent(username)}:${encodeURIComponent(
+          password,
+        )}@${host}/`,
+      ),
+      dbName,
+      opts,
+    );
+  }
+
+  public readonly ready: Promise<void>;
+  private options: MongoDBSessionStorageOptions;
+  // `mongodb` has no types for `MongoClient`???!
+  private client: any;
+
+  constructor(
+    private dbUrl: URL,
+    private dbName: string,
+    opts: Partial<MongoDBSessionStorageOptions> = {},
+  ) {
+    if (typeof this.dbUrl === 'string') {
+      this.dbUrl = new URL(this.dbUrl);
+    }
+    this.options = {...defaultMongoDBSessionStorageOptions, ...opts};
+    this.ready = this.init();
+  }
+
+  public async storeSession(session: Session): Promise<boolean> {
+    await this.ready;
+
+    await this.collection.findOneAndReplace(
+      {id: session.id},
+      session.toObject(),
+      {
+        upsert: true,
+      },
+    );
+    return true;
+  }
+
+  public async loadSession(id: string): Promise<Session | undefined> {
+    await this.ready;
+
+    const result = await this.collection.findOne({id});
+
+    return result ? new Session(result) : undefined;
+  }
+
+  public async deleteSession(id: string): Promise<boolean> {
+    await this.ready;
+    await this.collection.deleteOne({id});
+    return true;
+  }
+
+  public async deleteSessions(ids: string[]): Promise<boolean> {
+    await this.ready;
+    await this.collection.deleteMany({id: {$in: ids}});
+    return true;
+  }
+
+  public async findSessionsByShop(shop: string): Promise<Session[]> {
+    await this.ready;
+
+    const rawResults = await this.collection.find({shop}).toArray();
+    if (!rawResults || rawResults?.length === 0) return [];
+
+    return rawResults.map((rawResult: any) => new Session(rawResult));
+  }
+
+  public async disconnect(): Promise<void> {
+    await this.client.close();
+  }
+
+  private get collection() {
+    return this.client
+      .db(this.dbName)
+      .collection(this.options.sessionCollectionName);
+  }
+
+  private async init() {
+    this.client = new (mongodb as any).MongoClient(this.dbUrl.toString());
+    await this.client.connect();
+    await this.client.db().command({ping: 1});
+    await this.createCollection();
+  }
+
+  private async hasSessionCollection(): Promise<boolean> {
+    const collections = await this.client.db().collections();
+    return collections
+      .map((collection: any) => collection.collectionName)
+      .includes(this.options.sessionCollectionName);
+  }
+
+  private async createCollection() {
+    const hasSessionCollection = await this.hasSessionCollection();
+    if (!hasSessionCollection) {
+      await this.client.db().collection(this.options.sessionCollectionName);
+    }
+  }
+}

package/packages/shopify-app-session-storage-mongodb/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "outDir": "./build/ts",
+    "rootDir": "src"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["**/*.test.ts", "**/*.test.tsx", "**/test/*", "**/__tests__/*"]
+}

package/packages/shopify-app-session-storage-mysql/CHANGELOG.md

@@ -0,0 +1,220 @@
+# @shopify/shopify-app-session-storage-mysql
+
+## 3.0.1
+
+### Patch Changes
+
+- 02a8341: Updated dependency on `@shopify/shopify-api` to 9.3.1
+- 321d6a4: Update @shopify/shopify-api to 9.3.2
+- Updated dependencies [02a8341]
+- Updated dependencies [321d6a4]
+  - @shopify/shopify-app-session-storage@2.1.1
+
+## 3.0.0
+
+### Minor Changes
+
+- 64e0246: Update shopify-api version to 9.2.0
+
+### Patch Changes
+
+- f5742c1: Updated dependency on `@shopify/shopify-api`
+- Updated dependencies [f5742c1]
+- Updated dependencies [64e0246]
+  - @shopify/shopify-app-session-storage@2.1.0
+
+## 2.0.4
+
+### Patch Changes
+
+- b4eeb24: Improved and simplified package.json dependencies
+- b998c30: Bump shopify-api version from 9.0.1 to 9.0.2
+- Updated dependencies [b4eeb24]
+- Updated dependencies [b998c30]
+  - @shopify/shopify-app-session-storage@2.0.4
+
+## 2.0.3
+
+### Patch Changes
+
+- d3e4b5e: Updated the dependency on `@shopify/shopify-api`
+- Updated dependencies [d3e4b5e]
+  - @shopify/shopify-app-session-storage@2.0.3
+
+## 2.0.2
+
+### Patch Changes
+
+- 3685bd4: Bump shopify-api to ^8.1.1
+- Updated dependencies [3685bd4]
+  - @shopify/shopify-app-session-storage@2.0.2
+
+## 2.0.1
+
+### Patch Changes
+
+- 6d12840: Updating dependencies on @shopify/shopify-api
+- Updated dependencies [6d12840]
+  - @shopify/shopify-app-session-storage@2.0.1
+
+## 2.0.0
+
+### Major Changes
+
+- f837060: **Removed support for Node 14**
+
+  Node 14 has reached its [EOL](https://endoflife.date/nodejs), and dependencies to this package no longer work on Node 14.
+  Because of that, we can no longer support that version.
+
+  If your app is running on Node 14, you'll need to update to a more recent version before upgrading this package.
+
+  This upgrade does not require any code changes.
+
+### Patch Changes
+
+- a69d6fc: Updating dependency on @shopify/shopify-api to v.8.0.1
+- Updated dependencies [f837060]
+- Updated dependencies [a69d6fc]
+  - @shopify/shopify-app-session-storage@2.0.0
+
+## 1.1.13
+
+### Patch Changes
+
+- 616388d: Updating dependency on @shopify/shopify-api to 7.7.0
+- Updated dependencies [616388d]
+  - @shopify/shopify-app-session-storage@1.1.10
+
+## 1.1.12
+
+### Patch Changes
+
+- 5b862fe: Upgraded shopify-api dependency to 7.6.0
+- Updated dependencies [5b862fe]
+  - @shopify/shopify-app-session-storage@1.1.9
+
+## 1.1.11
+
+### Patch Changes
+
+- 346b623: Updating dependency on @shopify/shopify-api
+- Updated dependencies [346b623]
+  - @shopify/shopify-app-session-storage@1.1.8
+
+## 1.1.10
+
+### Patch Changes
+
+- 13b9048: Updating @shopify/shopify-api dependency to the latest version
+- Updated dependencies [13b9048]
+  - @shopify/shopify-app-session-storage@1.1.7
+
+## 1.1.9
+
+### Patch Changes
+
+- 32296d7: Update @shopify/shopify-api dependency to 7.5.0
+- Updated dependencies [32296d7]
+  - @shopify/shopify-app-session-storage@1.1.6
+
+## 1.1.8
+
+### Patch Changes
+
+- 93e9126: Updating @shopify/shopify-api dependency
+- Updated dependencies [93e9126]
+  - @shopify/shopify-app-session-storage@1.1.5
+
+## 1.1.7
+
+### Patch Changes
+
+- b3453ff: Bumping @shopify/shopify-api dependency to latest version
+- Updated dependencies [b3453ff]
+  - @shopify/shopify-app-session-storage@1.1.4
+
+## 1.1.6
+
+### Patch Changes
+
+- f5bb9f1: Bumps [mysql2](https://github.com/sidorares/node-mysql2) from 3.3.0 to 3.3.1. See mysql2's [changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) for more details.
+
+## 1.1.5
+
+### Patch Changes
+
+- e1d4f4f: Add @shopify/shopify-api as a peerDependencies entry for each session-storage package, to avoid API library conflicts (e.g., scopesArray.map error). Should help avoid issues like #93
+- 2dd9ba5: Bumps [mysql2](Bumps mysql2 from 3.2.1 to 3.2.4.) from 3.2.1 to 3.2.4. See mysql2 [changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) for more details.
+- 1d007e8: Bumps [@shopify/shopify-api](https://github.com/Shopify/shopify-api-js) from 7.0.0 to 7.1.0. See `@shopify/shopify-api`'s [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for more details.
+- 9aaf402: Bumps [mysql2](https://github.com/sidorares/node-mysql2) from 3.2.4 to 3.3.0. See mysql2's [changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) for more details.
+- Updated dependencies [e1d4f4f]
+- Updated dependencies [1d007e8]
+  - @shopify/shopify-app-session-storage@1.1.3
+
+## 1.1.4
+
+### Patch Changes
+
+- d6171e2: Bump mysql2 from 3.2.0 to 3.2.1. See [mysql2 changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md#321-2023-04-13) for details.
+- 9a65092: In 1.0.2 of MySQLSessionStorage, the constructor could accept either a URL object or a URL string. The string option was accidentally removed, starting 1.1.0. This patch adds it back in. Fixes #204
+
+## 1.1.3
+
+### Patch Changes
+
+- 335c8df: MySQL session storage to use a connection pool instead of a single client connection. Fixes #150, #185
+- 502b4c7: Bumps mysql2 from 3.1.2 to 3.2.0.
+- e4f3415: Bump @shopify/shopify-api from 6.2.0 to 7.0.0. See [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for details.
+- 3969855: Use decodeURIComponent on password, user, database name fields prior to calling underlying MySQL connection. Fixes #163. Also applied to postgresql adapter.
+- Updated dependencies [e4f3415]
+  - @shopify/shopify-app-session-storage@1.1.2
+
+## 1.1.2
+
+### Patch Changes
+
+- 97346b3: Fix #132: mysql migrator was unable to detect already applied migrations
+- Updated dependencies [97346b3]
+  - @shopify/shopify-app-session-storage@1.1.1
+
+## 1.1.1
+
+### Patch Changes
+
+- a37f9db: Bump mysql2 to 3.1.2
+
+## 1.1.0
+
+### Minor Changes
+
+- becc305: Migrations capabilities that can handle persistence changes for all session storage implementations
+
+### Patch Changes
+
+- 8f5749f: Increase size of 'scope' column to 1024 for session storage implementation for RDBMS
+- b6501b0: Bump typescript to 4.9.5
+- Updated dependencies [b6501b0]
+- Updated dependencies [becc305]
+  - @shopify/shopify-app-session-storage@1.1.0
+
+## 1.0.2
+
+### Patch Changes
+
+- 222b755: Updating @shopify/shopify-api to v6.1.0
+- Updated dependencies [222b755]
+  - @shopify/shopify-app-session-storage@1.0.2
+
+## 1.0.1
+
+### Patch Changes
+
+- 866b50c: Update dependencies on shopify-api v6.0.2
+- Updated dependencies [866b50c]
+  - @shopify/shopify-app-session-storage@1.0.1
+
+## 1.0.0
+
+### Major Changes
+
+- Initial public release of @shopify/shopify-app-session-storage-mysql

package/packages/shopify-app-session-storage-mysql/LICENSE.md

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2022-present, Shopify Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/packages/shopify-app-session-storage-mysql/README.md

@@ -0,0 +1,41 @@
+# Session Storage Adapter for MySQL DB
+
+This package implements the `SessionStorage` interface that works with an instance of [MySQL](https://www.mysql.com), using the `mysql.Pool` as the underlying connection resource.
+
+```js
+import {shopifyApp} from '@shopify/shopify-app-express';
+import {MySQLSessionStorage} from '@shopify/shopify-app-session-storage-mysql';
+
+const shopify = shopifyApp({
+  sessionStorage: new MySQLSessionStorage(
+    'mysql://username:password@host/database',
+    {connectionPoolLimit: 10}, // optional
+  ),
+  // ...
+});
+
+// OR
+
+const shopify = shopifyApp({
+  sessionStorage: new MySQLSessionStorage(
+    new URL('mysql://username:password@host/database'),
+    {connectionPoolLimit: 10}, // optional
+  ),
+  // ...
+});
+
+// OR
+
+const shopify = shopifyApp({
+  sessionStorage: MySQLSessionStorage.withCredentials(
+    'host.com',
+    'thedatabase',
+    'username',
+    'password',
+    {connectionPoolLimit: 10}, // optional
+  ),
+  // ...
+});
+```
+
+If you prefer to use your own implementation of a session storage mechanism that is compatible with the `@shopify/shopify-app-express` package, see the [implementing session storage guide](https://github.com/Shopify/shopify-app-js/blob/main/packages/shopify-app-session-storage/implementing-session-storage.md).

package/packages/shopify-app-session-storage-mysql/loom.config.ts

@@ -0,0 +1,27 @@
+import {createPackage, createProjectPlugin} from '@shopify/loom';
+import {buildLibrary} from '@shopify/loom-plugin-build-library';
+
+export default createPackage((pkg) => {
+  pkg.entry({root: './src/mysql.ts'});
+  pkg.use(
+    buildLibrary({
+      // Required. A browserslist string for specifying your target output.
+      // Use browser targets (e.g. `'defaults'`) if your package targets the browser,
+      // node targets (e.g. `'node 12.22'`) if your package targets node
+      // or both (e.g.`'defaults, node 12.22'`) if your package targets both
+      targets: 'node 16',
+      // Optional. Defaults to false. Defines if commonjs outputs should be generated.
+      commonjs: true,
+      // Optional. Defaults to false. Defines if esmodules outputs should be generated.
+      esmodules: false,
+      // Optional. Defaults to false. Defines if esnext outputs should be generated.
+      esnext: false,
+      // Optional. Defaults to true. Defines if entrypoints should be written at
+      // the root of the repository. You can disable this if you have a single
+      // entrypoint or if your package uses the `exports` key in package.json
+      rootEntrypoints: false,
+      // Optional. Defaults to 'node'. Defines if the jest environment should be 'node' or 'jsdom'.
+      jestTestEnvironment: 'node',
+    }),
+  );
+});

package/packages/shopify-app-session-storage-mysql/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@shopify/shopify-app-session-storage-mysql",
+  "version": "3.0.1",
+  "description": "Shopify App Session Storage for MySQL",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/shopify-app-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Shopify/shopify-app-js/issues"
+  },
+  "homepage": "https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage-mysql",
+  "author": "Shopify Inc.",
+  "license": "MIT",
+  "main": "./build/cjs/mysql.js",
+  "types": "./build/ts/mysql.d.ts",
+  "scripts": {},
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "shopify",
+    "node",
+    "app",
+    "graphql",
+    "rest",
+    "webhook",
+    "Admin API",
+    "Storefront API",
+    "mysql",
+    "MySQL",
+    "session storage"
+  ],
+  "dependencies": {
+    "mysql2": "^3.3.1"
+  },
+  "peerDependencies": {
+    "@shopify/shopify-api": "^9.3.2",
+    "@shopify/shopify-app-session-storage": "^2.1.1"
+  },
+  "devDependencies": {
+    "@shopify/shopify-app-session-storage-test-utils": "^2.0.1"
+  },
+  "files": [
+    "build/*",
+    "!bundle/*",
+    "!tsconfig.tsbuildinfo",
+    "!node_modules"
+  ]
+}