shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-session-storage-mysql/src/__tests__/mysql.test.ts

@@ -0,0 +1,137 @@
+import * as child_process from 'child_process';
+import {promisify} from 'util';
+
+import {
+  batteryOfTests,
+  poll,
+} from '@shopify/shopify-app-session-storage-test-utils';
+import mysql2 from 'mysql2/promise';
+import {Session} from '@shopify/shopify-api';
+
+import {MySQLSessionStorage} from '../mysql';
+
+const exec = promisify(child_process.exec);
+
+const dbConfig = {
+  host: 'localhost',
+  user: 'root',
+  password: 'passify#$',
+  database: 'shop&test',
+};
+const dbURL = new URL(
+  `mysql://${encodeURIComponent('shop&fy')}:${encodeURIComponent(
+    'passify#$',
+  )}@localhost/${encodeURIComponent('shop&test')}`,
+);
+const dbURL2 = new URL(
+  `mysql://${encodeURIComponent('shop&fy')}:${encodeURIComponent(
+    'passify#$',
+  )}@localhost/${encodeURIComponent('shop&test2')}`,
+);
+
+describe('MySQLSessionStorage', () => {
+  let storage: MySQLSessionStorage;
+  let storage2: MySQLSessionStorage;
+
+  let containerId: string;
+  beforeAll(async () => {
+    const runCommand = await exec(
+      "podman run -d -e MYSQL_DATABASE='shop&test' -e MYSQL_USER='shop&fy' -e MYSQL_PASSWORD='passify#$' -e MYSQL_ROOT_PASSWORD='passify#$' -p 3306:3306 mysql:8-oracle",
+      {encoding: 'utf8'},
+    );
+    containerId = runCommand.stdout.trim();
+
+    await poll(
+      async () => {
+        try {
+          const connection = await mysql2.createConnection(dbConfig);
+
+          await connection.execute(`CREATE DATABASE \`shop&test2\`;`);
+          await connection.execute(
+            `GRANT ALL ON \`shop&test2\`.* TO \`shop&fy\`@\`%\`;`,
+          );
+
+          await connection.end();
+        } catch (_error) {
+          // console.error(_error);
+          return false;
+        }
+        return true;
+      },
+      {interval: 500, timeout: 20000},
+    );
+
+    storage = new MySQLSessionStorage(dbURL);
+    storage2 = new MySQLSessionStorage(dbURL2);
+
+    await storage.ready;
+    await storage2.ready;
+  });
+
+  afterAll(async () => {
+    await storage.disconnect();
+    await storage2.disconnect();
+
+    await exec(`podman rm -f ${containerId}`);
+  });
+
+  const tests = [
+    {dbName: 'shopitest', sessionStorage: async () => storage},
+    {dbName: 'shopitest2', sessionStorage: async () => storage2},
+  ];
+
+  for (const {dbName, sessionStorage} of tests) {
+    describe(`with ${dbName}`, () => {
+      batteryOfTests(sessionStorage);
+    });
+  }
+
+  it(`one-time initialisation like migrations and table creations are run only once`, async () => {
+    const storageClone1 = new MySQLSessionStorage(dbURL);
+    await storageClone1.ready;
+
+    const storageClone2 = new MySQLSessionStorage(dbURL);
+    await storageClone2.ready;
+
+    storageClone1.disconnect();
+    storageClone2.disconnect();
+  });
+
+  it(`can disconnect and reconnect to make queries with the pooling clients`, async () => {
+    const storage = new MySQLSessionStorage(dbURL);
+    await storage.ready;
+    const sessionId = '123';
+    const session = new Session({
+      id: sessionId,
+      shop: 'test-shop.myshopify.com',
+      state: 'test-state',
+      isOnline: false,
+      scope: 'fake_scope',
+    });
+
+    expect(await storage.storeSession(session)).toBeTruthy();
+    await storage.disconnect();
+
+    const loadedSession = await storage.loadSession(sessionId);
+    expect(loadedSession).toEqual(session);
+    await storage.disconnect();
+
+    expect(await storage.deleteSession(sessionId)).toBeTruthy();
+    await storage.disconnect();
+  });
+
+  it(`can successfully connect with a url string instead of a URL object`, async () => {
+    const storage = new MySQLSessionStorage(dbURL.toString());
+    await storage.ready;
+    const session = new Session({
+      id: '456',
+      shop: 'test-shop.myshopify.com',
+      state: 'test-state',
+      isOnline: false,
+      scope: 'fake_scope',
+    });
+
+    expect(await storage.storeSession(session)).toBeTruthy();
+    await storage.disconnect();
+  });
+});

package/packages/shopify-app-session-storage-mysql/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-session-storage-mysql/src/migrations.ts

@@ -0,0 +1,18 @@
+import {MigrationOperation} from '@shopify/shopify-app-session-storage';
+
+import {MySqlConnection} from './mysql-connection';
+
+export const migrationList = [
+  new MigrationOperation(
+    'migrateScopeFieldToVarchar1024',
+    migrateScopeFieldToVarchar1024,
+  ),
+];
+
+// need change the sizr of the scope column from 255 to 1024 char
+export async function migrateScopeFieldToVarchar1024(
+  connection: MySqlConnection,
+): Promise<void> {
+  await connection.query(`ALTER TABLE ${connection.sessionStorageIdentifier} 
+      MODIFY COLUMN scope varchar(1024)`);
+}

package/packages/shopify-app-session-storage-mysql/src/mysql-connection.ts

@@ -0,0 +1,108 @@
+import mysql from 'mysql2/promise';
+import {RdbmsConnection} from '@shopify/shopify-app-session-storage';
+
+export class MySqlConnection implements RdbmsConnection {
+  sessionStorageIdentifier: string;
+  private ready: Promise<void>;
+  private dbUrl: URL;
+  private connectionPoolLimit: number;
+  private pool: mysql.Pool;
+
+  constructor(
+    dbUrl: URL,
+    sessionStorageIdentifier: string,
+    connectionPoolLimit: number,
+  ) {
+    this.dbUrl = dbUrl;
+    this.connectionPoolLimit = connectionPoolLimit;
+    this.ready = this.init();
+    this.sessionStorageIdentifier = sessionStorageIdentifier;
+  }
+
+  async query(query: string, params: any[] = []): Promise<any[]> {
+    await this.ready;
+    return this.pool.query(query, params);
+  }
+
+  /**
+   * Runs a series of queries in a transaction.
+   *
+   * @param queries an array of SQL queries to execute in a transaction
+   */
+  async transaction(queries: string[]): Promise<void> {
+    await this.ready;
+
+    // check if the first and last queries are BEGIN and COMMIT, if they are, ignore them
+    // mysql2
+    if (queries[0] === 'BEGIN') {
+      queries.shift();
+    }
+    if (queries[queries.length - 1] === 'COMMIT') {
+      queries.pop();
+    }
+    const client = await this.pool.getConnection();
+    try {
+      await client.beginTransaction();
+      for (const query of queries) {
+        await client.query(query);
+      }
+      await client.commit();
+    } catch (error) {
+      // rollback if any of the queries fail
+      await client.rollback();
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+
+  async connect(): Promise<void> {
+    await this.ready;
+
+    // Nothing else to do here
+    return Promise.resolve();
+  }
+
+  async disconnect(): Promise<void> {
+    await this.ready;
+    await this.pool.end();
+    this.ready = this.init();
+  }
+
+  getDatabase(): string | undefined {
+    return decodeURIComponent(this.dbUrl.pathname.slice(1));
+  }
+
+  async hasTable(tablename: string): Promise<boolean> {
+    await this.ready;
+
+    const query = `
+      SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
+        WHERE TABLE_NAME = ${this.getArgumentPlaceholder()}
+          AND TABLE_SCHEMA = ${this.getArgumentPlaceholder()};
+    `;
+
+    // Allow multiple apps to be on the same host with separate DB and querying the right
+    // DB for the session table existence
+    const [rows] = await this.pool.query(query, [
+      tablename,
+      this.getDatabase(),
+    ]);
+    return Array.isArray(rows) && rows.length === 1;
+  }
+
+  getArgumentPlaceholder(_?: number): string {
+    return `?`;
+  }
+
+  private async init(): Promise<void> {
+    this.pool = await mysql.createPool({
+      connectionLimit: this.connectionPoolLimit,
+      host: this.dbUrl.hostname,
+      user: decodeURIComponent(this.dbUrl.username),
+      password: decodeURIComponent(this.dbUrl.password),
+      database: this.getDatabase(),
+      port: Number(this.dbUrl.port),
+    });
+  }
+}

package/packages/shopify-app-session-storage-mysql/src/mysql-migrator.ts

@@ -0,0 +1,53 @@
+import {
+  RdbmsSessionStorageMigrator,
+  RdbmsSessionStorageMigratorOptions,
+  MigrationOperation,
+} from '@shopify/shopify-app-session-storage';
+
+import {MySqlConnection} from './mysql-connection';
+
+export class MySqlSessionStorageMigrator extends RdbmsSessionStorageMigrator {
+  constructor(
+    dbConnection: MySqlConnection,
+    opts: Partial<RdbmsSessionStorageMigratorOptions> = {},
+    migrations: MigrationOperation[],
+  ) {
+    super(dbConnection, opts, migrations);
+  }
+
+  async initMigrationPersistence(): Promise<void> {
+    const discardCreateTable = await this.connection.hasTable(
+      this.options.migrationDBIdentifier,
+    );
+
+    if (!discardCreateTable) {
+      const migration = `
+      CREATE TABLE ${this.options.migrationDBIdentifier} (
+        ${
+          this.getOptions().migrationNameColumnName
+        } varchar(255) NOT NULL PRIMARY KEY
+    );`;
+
+      await this.connection.query(migration, []);
+    }
+  }
+
+  /**
+   * This is overriden from the abstract class has the result type is different for mysql
+   * @param migrationName - the migration name we want to check in the table
+   * @returns true if the 'migrationName' has been found in the migrations table, false otherwise
+   */
+  async hasMigrationBeenApplied(migrationName: string): Promise<boolean> {
+    await this.ready;
+
+    const query = `
+      SELECT * FROM ${this.options.migrationDBIdentifier}
+      WHERE ${this.getOptions().migrationNameColumnName} = 
+        ${this.connection.getArgumentPlaceholder(1)};
+    `;
+
+    const [rows] = await this.connection.query(query, [migrationName]);
+
+    return Array.isArray(rows) && rows.length === 1;
+  }
+}

package/packages/shopify-app-session-storage-mysql/src/mysql.ts

@@ -0,0 +1,178 @@
+import {Session} from '@shopify/shopify-api';
+import {
+  SessionStorage,
+  RdbmsSessionStorageOptions,
+} from '@shopify/shopify-app-session-storage';
+
+import {migrationList} from './migrations';
+import {MySqlConnection} from './mysql-connection';
+import {MySqlSessionStorageMigrator} from './mysql-migrator';
+
+export interface MySQLSessionStorageOptions extends RdbmsSessionStorageOptions {
+  connectionPoolLimit: number;
+}
+
+const defaultMySQLSessionStorageOptions: MySQLSessionStorageOptions = {
+  connectionPoolLimit: 10,
+  sessionTableName: 'shopify_sessions',
+  migratorOptions: {
+    migrationDBIdentifier: 'shopify_sessions_migrations',
+    migrationNameColumnName: 'migration_name',
+  },
+};
+
+export class MySQLSessionStorage implements SessionStorage {
+  static withCredentials(
+    host: string,
+    dbName: string,
+    username: string,
+    password: string,
+    opts: Partial<MySQLSessionStorageOptions>,
+  ) {
+    return new MySQLSessionStorage(
+      new URL(
+        `mysql://${encodeURIComponent(username)}:${encodeURIComponent(
+          password,
+        )}@${host}/${encodeURIComponent(dbName)}`,
+      ),
+      opts,
+    );
+  }
+
+  public readonly ready: Promise<void>;
+  private internalInit: Promise<void>;
+  private options: MySQLSessionStorageOptions;
+  private connection: MySqlConnection;
+  private migrator: MySqlSessionStorageMigrator;
+
+  constructor(
+    dbUrl: URL | string,
+    opts: Partial<MySQLSessionStorageOptions> = {},
+  ) {
+    this.options = {...defaultMySQLSessionStorageOptions, ...opts};
+    this.internalInit = this.init(
+      typeof dbUrl === 'string' ? new URL(dbUrl) : dbUrl,
+    );
+    this.migrator = new MySqlSessionStorageMigrator(
+      this.connection,
+      this.options.migratorOptions,
+      migrationList,
+    );
+    this.ready = this.migrator.applyMigrations(this.internalInit);
+  }
+
+  public async storeSession(session: Session): Promise<boolean> {
+    await this.ready;
+
+    // Note milliseconds to seconds conversion for `expires` property
+    const entries = session
+      .toPropertyArray()
+      .map(([key, value]) =>
+        key === 'expires'
+          ? [key, Math.floor((value as number) / 1000)]
+          : [key, value],
+      );
+    const query = `
+      REPLACE INTO ${this.options.sessionTableName}
+      (${entries.map(([key]) => key).join(', ')})
+      VALUES (${entries
+        .map(() => `${this.connection.getArgumentPlaceholder()}`)
+        .join(', ')})
+    `;
+    await this.connection.query(
+      query,
+      entries.map(([_key, value]) => value),
+    );
+    return true;
+  }
+
+  public async loadSession(id: string): Promise<Session | undefined> {
+    await this.ready;
+    const query = `
+      SELECT * FROM \`${this.options.sessionTableName}\`
+      WHERE id = ${this.connection.getArgumentPlaceholder()};
+    `;
+    const [rows] = await this.connection.query(query, [id]);
+    if (!Array.isArray(rows) || rows?.length !== 1) return undefined;
+    const rawResult = rows[0] as any;
+    return this.databaseRowToSession(rawResult);
+  }
+
+  public async deleteSession(id: string): Promise<boolean> {
+    await this.ready;
+    const query = `
+      DELETE FROM ${this.options.sessionTableName}
+      WHERE id = ${this.connection.getArgumentPlaceholder()};
+    `;
+    await this.connection.query(query, [id]);
+    return true;
+  }
+
+  public async deleteSessions(ids: string[]): Promise<boolean> {
+    await this.ready;
+    const query = `
+      DELETE FROM ${this.options.sessionTableName}
+      WHERE id IN (${ids
+        .map(() => `${this.connection.getArgumentPlaceholder()}`)
+        .join(',')});
+    `;
+    await this.connection.query(query, ids);
+    return true;
+  }
+
+  public async findSessionsByShop(shop: string): Promise<Session[]> {
+    await this.ready;
+
+    const query = `
+      SELECT * FROM ${this.options.sessionTableName}
+      WHERE shop = ${this.connection.getArgumentPlaceholder()};
+    `;
+    const [rows] = await this.connection.query(query, [shop]);
+    if (!Array.isArray(rows) || rows?.length === 0) return [];
+
+    const results: Session[] = rows.map((row: any) => {
+      return this.databaseRowToSession(row);
+    });
+    return results;
+  }
+
+  public async disconnect(): Promise<void> {
+    await this.connection.disconnect();
+  }
+
+  private async init(dbUrl: URL) {
+    this.connection = new MySqlConnection(
+      dbUrl,
+      this.options.sessionTableName,
+      this.options.connectionPoolLimit,
+    );
+    await this.createTable();
+  }
+
+  private async createTable() {
+    const hasSessionTable = await this.connection.hasTable(
+      this.options.sessionTableName,
+    );
+    if (!hasSessionTable) {
+      const query = `
+        CREATE TABLE ${this.options.sessionTableName} (
+          id varchar(255) NOT NULL PRIMARY KEY,
+          shop varchar(255) NOT NULL,
+          state varchar(255) NOT NULL,
+          isOnline tinyint NOT NULL,
+          scope varchar(255),
+          expires integer,
+          onlineAccessInfo varchar(255),
+          accessToken varchar(255)
+        )
+      `;
+      await this.connection.query(query);
+    }
+  }
+
+  private databaseRowToSession(row: any): Session {
+    // convert seconds to milliseconds prior to creating Session object
+    if (row.expires) row.expires *= 1000;
+    return Session.fromPropertyArray(Object.entries(row));
+  }
+}

package/packages/shopify-app-session-storage-mysql/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "outDir": "./build/ts",
+    "rootDir": "src"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["**/*.test.ts", "**/*.test.tsx", "**/test/*", "**/__tests__/*"]
+}