shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-session-storage-prisma/README.md

@@ -0,0 +1,68 @@
+# Session Storage Adapter for Prisma
+
+This package implements the `SessionStorage` interface that works with an instance of Prisma.
+
+Session storage for prisma requires a `schema.prisma` with a Session table with at-least the following columns:
+
+```prisma
+model Session {
+  id          String    @id
+  shop        String
+  state       String
+  isOnline    Boolean   @default(false)
+  scope       String?
+  expires     DateTime?
+  accessToken String
+  userId      BigInt?
+}
+```
+
+You can then instantiate and use `PrismaSessionStorage` like so:
+
+```js
+import {shopifyApp} from '@shopify/shopify-app-express';
+import {PrismaSessionStorage} from '@shopify/shopify-app-session-storage-prisma';
+import {PrismaClient} from '@prisma/client';
+
+const prisma = new PrismaClient();
+const storage = new PrismaSessionStorage(prisma);
+
+const shopify = shopifyApp({
+  sessionStorage: storage,
+  // ...
+});
+```
+
+> **Note**: If you use [SQLite](https://sqlite.com) with Prisma note that sqlite is a local, file-based SQL database. It persists all tables to a single file on your local disk. As such, it’s simple to set up and is a great choice for getting started with Shopify App development. However, it won’t work when your app getting scaled across multiple instances because they would each create their own database.
+
+If you prefer to use your own implementation of a session storage mechanism that is compatible with the `@shopify/shopify-app-express` package, see the [implementing session storage guide](https://github.com/Shopify/shopify-app-js/blob/main/packages/shopify-app-session-storage/implementing-session-storage.md).
+
+## Options
+
+You can also pass in some optional flags to tweak the behavior of the adapter.
+
+### Custom table name
+
+You can pass in the `tableName` option if you want to use a different table name in your schema.
+For example:
+
+```ts
+const storage = new PrismaSessionStorage(prisma, {
+  tableName: 'MyCustomSession',
+});
+```
+
+## Troubleshooting
+
+If there is an issue with your schema that prevents it from finding the `Session` table, this package will throw a `MissingSessionTableError`.
+Some common reasons for that are:
+
+1. The database was not migrated.
+1. The `Session` table above was not added to the schema.
+1. The table is in the schema, but isn't named `Session`.
+
+Here are some possible solutions for this issue:
+
+1. Ensure you've run [the `migrate` command](https://www.prisma.io/docs/reference/api-reference/command-reference#prisma-migrate) to apply the schema.
+1. Ensure you've copied the schema above into your `prisma.schema` file.
+1. If you've made changes to the table, make sure it's still called `Session`.

package/packages/shopify-app-session-storage-prisma/loom.config.ts

@@ -0,0 +1,27 @@
+import {createPackage, createProjectPlugin} from '@shopify/loom';
+import {buildLibrary} from '@shopify/loom-plugin-build-library';
+
+export default createPackage((pkg) => {
+  pkg.entry({root: './src/prisma.ts'});
+  pkg.use(
+    buildLibrary({
+      // Required. A browserslist string for specifying your target output.
+      // Use browser targets (e.g. `'defaults'`) if your package targets the browser,
+      // node targets (e.g. `'node 12.22'`) if your package targets node
+      // or both (e.g.`'defaults, node 12.22'`) if your package targets both
+      targets: 'node 16',
+      // Optional. Defaults to false. Defines if commonjs outputs should be generated.
+      commonjs: true,
+      // Optional. Defaults to false. Defines if esmodules outputs should be generated.
+      esmodules: false,
+      // Optional. Defaults to false. Defines if esnext outputs should be generated.
+      esnext: false,
+      // Optional. Defaults to true. Defines if entrypoints should be written at
+      // the root of the repository. You can disable this if you have a single
+      // entrypoint or if your package uses the `exports` key in package.json
+      rootEntrypoints: false,
+      // Optional. Defaults to 'node'. Defines if the jest environment should be 'node' or 'jsdom'.
+      jestTestEnvironment: 'node',
+    }),
+  );
+});

package/packages/shopify-app-session-storage-prisma/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@shopify/shopify-app-session-storage-prisma",
+  "version": "4.0.1",
+  "description": "Shopify App Session Storage for Prisma",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/shopify-app-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Shopify/shopify-app-js/issues"
+  },
+  "homepage": "https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage-prisma",
+  "author": "Shopify Inc.",
+  "license": "MIT",
+  "main": "./build/cjs/prisma.js",
+  "types": "./build/ts/prisma.d.ts",
+  "scripts": {},
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "shopify",
+    "node",
+    "app",
+    "graphql",
+    "rest",
+    "webhook",
+    "Admin API",
+    "Storefront API",
+    "session storage",
+    "Prisma"
+  ],
+  "dependencies": {},
+  "peerDependencies": {
+    "@prisma/client": "^5.9.1",
+    "@shopify/shopify-api": "^9.3.2",
+    "@shopify/shopify-app-session-storage": "^2.1.1",
+    "prisma": "^5.8.1"
+  },
+  "devDependencies": {
+    "@prisma/client": "^5.9.1",
+    "@shopify/shopify-app-session-storage-test-utils": "^2.0.1",
+    "prisma": "^5.8.1"
+  },
+  "files": [
+    "build/*",
+    "!bundle/*",
+    "!tsconfig.tsbuildinfo",
+    "!node_modules"
+  ]
+}

package/packages/shopify-app-session-storage-prisma/prisma/migrations/20230425184828_init/migration.sql

@@ -0,0 +1,11 @@
+-- CreateTable
+CREATE TABLE "Session" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "shop" TEXT NOT NULL,
+    "state" TEXT NOT NULL,
+    "isOnline" BOOLEAN NOT NULL DEFAULT false,
+    "scope" TEXT,
+    "expires" DATETIME,
+    "accessToken" TEXT NOT NULL,
+    "userId" BIGINT
+);

package/packages/shopify-app-session-storage-prisma/prisma/migrations/20230906155758_mySession/migration.sql

@@ -0,0 +1,11 @@
+-- CreateTable
+CREATE TABLE "MySession" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "shop" TEXT NOT NULL,
+    "state" TEXT NOT NULL,
+    "isOnline" BOOLEAN NOT NULL DEFAULT false,
+    "scope" TEXT,
+    "expires" DATETIME,
+    "accessToken" TEXT NOT NULL,
+    "userId" BIGINT
+);

package/packages/shopify-app-session-storage-prisma/prisma/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (i.e. Git)
+provider = "sqlite"

package/packages/shopify-app-session-storage-prisma/prisma/schema.prisma

@@ -0,0 +1,30 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "sqlite"
+  url      = "file:test.db"
+}
+
+model Session {
+  id          String    @id
+  shop        String
+  state       String
+  isOnline    Boolean   @default(false)
+  scope       String?
+  expires     DateTime?
+  accessToken String
+  userId      BigInt?
+}
+
+model MySession {
+  id          String    @id
+  shop        String
+  state       String
+  isOnline    Boolean   @default(false)
+  scope       String?
+  expires     DateTime?
+  accessToken String
+  userId      BigInt?
+}

package/packages/shopify-app-session-storage-prisma/src/__tests__/prisma.test.ts

@@ -0,0 +1,66 @@
+import fs from 'fs';
+import {execSync} from 'child_process';
+
+import {batteryOfTests} from '@shopify/shopify-app-session-storage-test-utils';
+import {PrismaClient} from '@prisma/client';
+
+import {MissingSessionTableError, PrismaSessionStorage} from '../prisma';
+
+describe('PrismaSessionStorage', () => {
+  let prisma: PrismaClient;
+
+  beforeAll(async () => {
+    // Reset the database prior to the tests
+    clearTestDatabase();
+
+    execSync('npx prisma migrate dev --name init --preview-feature');
+
+    prisma = new PrismaClient();
+  });
+
+  afterAll(async () => {
+    await prisma.session.deleteMany();
+    await prisma.mySession.deleteMany();
+  });
+
+  // Using the default table name
+  batteryOfTests(async () => new PrismaSessionStorage<PrismaClient>(prisma));
+
+  // Using a custom table name
+  batteryOfTests(
+    async () =>
+      new PrismaSessionStorage<PrismaClient>(prisma, {tableName: 'mySession'}),
+  );
+});
+
+describe('PrismaSessionStorage when with no database set up', () => {
+  beforeAll(async () => {
+    clearTestDatabase();
+  });
+
+  it('throws an appropriate error when Prisma migrations were not run', async () => {
+    const prisma = new PrismaClient();
+    const storage = new PrismaSessionStorage<PrismaClient>(prisma);
+
+    try {
+      await storage.findSessionsByShop('shop.myshopify.com');
+
+      // This should never be reached
+      expect(true).toBe(false);
+    } catch (error) {
+      expect(error).toBeInstanceOf(MissingSessionTableError);
+
+      const {cause} = error;
+      expect(cause.message).toContain(
+        'The table `main.Session` does not exist in the current database.',
+      );
+    }
+  });
+});
+
+function clearTestDatabase() {
+  const testDbPath = `${__dirname}/../../prisma/test.db`;
+  if (fs.existsSync(testDbPath)) {
+    fs.unlinkSync(testDbPath);
+  }
+}

package/packages/shopify-app-session-storage-prisma/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-session-storage-prisma/src/prisma.ts

@@ -0,0 +1,145 @@
+import {Session} from '@shopify/shopify-api';
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+import type {PrismaClient, Session as Row} from '@prisma/client';
+
+interface PrismaSessionStorageOptions {
+  tableName?: string;
+}
+
+export class PrismaSessionStorage<T extends PrismaClient>
+  implements SessionStorage
+{
+  private ready: Promise<any>;
+  private readonly tableName: string = 'session';
+
+  constructor(
+    private prisma: T,
+    {tableName}: PrismaSessionStorageOptions = {},
+  ) {
+    if (tableName) {
+      this.tableName = tableName;
+    }
+
+    if (this.getSessionTable() === undefined) {
+      throw new Error(`PrismaClient does not have a ${this.tableName} table`);
+    }
+    this.ready = this.getSessionTable()
+      .count()
+      .catch((cause) => {
+        throw new MissingSessionTableError(
+          `Prisma ${this.tableName} table does not exist. This could happen for a few reasons, see https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage-prisma#troubleshooting for more information`,
+          {cause},
+        );
+      });
+  }
+
+  public async storeSession(session: Session): Promise<boolean> {
+    await this.ready;
+
+    const data = this.sessionToRow(session);
+
+    await this.getSessionTable().upsert({
+      where: {id: session.id},
+      update: data,
+      create: data,
+    });
+
+    return true;
+  }
+
+  public async loadSession(id: string): Promise<Session | undefined> {
+    await this.ready;
+
+    const row = await this.getSessionTable().findUnique({
+      where: {id},
+    });
+
+    if (!row) {
+      return undefined;
+    }
+
+    return this.rowToSession(row);
+  }
+
+  public async deleteSession(id: string): Promise<boolean> {
+    await this.ready;
+
+    try {
+      await this.getSessionTable().delete({where: {id}});
+    } catch {
+      return true;
+    }
+
+    return true;
+  }
+
+  public async deleteSessions(ids: string[]): Promise<boolean> {
+    await this.ready;
+
+    await this.getSessionTable().deleteMany({where: {id: {in: ids}}});
+
+    return true;
+  }
+
+  public async findSessionsByShop(shop: string): Promise<Session[]> {
+    await this.ready;
+
+    const sessions = await this.getSessionTable().findMany({
+      where: {shop},
+      take: 25,
+      orderBy: [{expires: 'desc'}],
+    });
+
+    return sessions.map((session) => this.rowToSession(session));
+  }
+
+  private sessionToRow(session: Session): Row {
+    const sessionParams = session.toObject();
+
+    return {
+      id: session.id,
+      shop: session.shop,
+      state: session.state,
+      isOnline: session.isOnline,
+      scope: session.scope || null,
+      expires: session.expires || null,
+      accessToken: session.accessToken || '',
+      userId:
+        (sessionParams.onlineAccessInfo?.associated_user
+          .id as unknown as bigint) || null,
+    };
+  }
+
+  private rowToSession(row: Row): Session {
+    const sessionParams: Record<string, boolean | string | number> = {
+      id: row.id,
+      shop: row.shop,
+      state: row.state,
+      isOnline: row.isOnline,
+    };
+
+    if (row.expires) {
+      sessionParams.expires = row.expires.getTime();
+    }
+
+    if (row.scope) {
+      sessionParams.scope = row.scope;
+    }
+
+    if (row.accessToken) {
+      sessionParams.accessToken = row.accessToken;
+    }
+
+    if (row.userId) {
+      sessionParams.onlineAccessInfo = String(row.userId);
+    }
+
+    return Session.fromPropertyArray(Object.entries(sessionParams));
+  }
+
+  private getSessionTable(): T['session'] {
+    return (this.prisma as any)[this.tableName];
+  }
+}
+
+export class MissingSessionTableError extends Error {}

package/packages/shopify-app-session-storage-prisma/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "outDir": "./build/ts",
+    "rootDir": "src"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["**/*.test.ts", "**/*.test.tsx", "**/test/*", "**/__tests__/*"]
+}

package/packages/shopify-app-session-storage-redis/CHANGELOG.md

@@ -0,0 +1,200 @@
+# @shopify/shopify-app-session-storage-redis
+
+## 3.0.1
+
+### Patch Changes
+
+- 02a8341: Updated dependency on `@shopify/shopify-api` to 9.3.1
+- 321d6a4: Update @shopify/shopify-api to 9.3.2
+- Updated dependencies [02a8341]
+- Updated dependencies [321d6a4]
+  - @shopify/shopify-app-session-storage@2.1.1
+
+## 3.0.0
+
+### Minor Changes
+
+- 64e0246: Update shopify-api version to 9.2.0
+
+### Patch Changes
+
+- 106d459: Updates redis from 4.6.11 to 4.6.12.
+- f5742c1: Updated dependency on `@shopify/shopify-api`
+- Updated dependencies [f5742c1]
+- Updated dependencies [64e0246]
+  - @shopify/shopify-app-session-storage@2.1.0
+
+## 2.0.4
+
+### Patch Changes
+
+- b4eeb24: Improved and simplified package.json dependencies
+- b998c30: Bump shopify-api version from 9.0.1 to 9.0.2
+- Updated dependencies [b4eeb24]
+- Updated dependencies [b998c30]
+  - @shopify/shopify-app-session-storage@2.0.4
+
+## 2.0.3
+
+### Patch Changes
+
+- d3e4b5e: Updated the dependency on `@shopify/shopify-api`
+- Updated dependencies [d3e4b5e]
+  - @shopify/shopify-app-session-storage@2.0.3
+
+## 2.0.2
+
+### Patch Changes
+
+- 3685bd4: Bump shopify-api to ^8.1.1
+- Updated dependencies [3685bd4]
+  - @shopify/shopify-app-session-storage@2.0.2
+
+## 2.0.1
+
+### Patch Changes
+
+- 6d12840: Updating dependencies on @shopify/shopify-api
+- Updated dependencies [6d12840]
+  - @shopify/shopify-app-session-storage@2.0.1
+
+## 2.0.0
+
+### Major Changes
+
+- f837060: **Removed support for Node 14**
+
+  Node 14 has reached its [EOL](https://endoflife.date/nodejs), and dependencies to this package no longer work on Node 14.
+  Because of that, we can no longer support that version.
+
+  If your app is running on Node 14, you'll need to update to a more recent version before upgrading this package.
+
+  This upgrade does not require any code changes.
+
+### Patch Changes
+
+- a69d6fc: Updating dependency on @shopify/shopify-api to v.8.0.1
+- Updated dependencies [f837060]
+- Updated dependencies [a69d6fc]
+  - @shopify/shopify-app-session-storage@2.0.0
+
+## 1.1.10
+
+### Patch Changes
+
+- 616388d: Updating dependency on @shopify/shopify-api to 7.7.0
+- Updated dependencies [616388d]
+  - @shopify/shopify-app-session-storage@1.1.10
+
+## 1.1.9
+
+### Patch Changes
+
+- 5b862fe: Upgraded shopify-api dependency to 7.6.0
+- Updated dependencies [5b862fe]
+  - @shopify/shopify-app-session-storage@1.1.9
+
+## 1.1.8
+
+### Patch Changes
+
+- 346b623: Updating dependency on @shopify/shopify-api
+- Updated dependencies [346b623]
+  - @shopify/shopify-app-session-storage@1.1.8
+
+## 1.1.7
+
+### Patch Changes
+
+- 13b9048: Updating @shopify/shopify-api dependency to the latest version
+- Updated dependencies [13b9048]
+  - @shopify/shopify-app-session-storage@1.1.7
+
+## 1.1.6
+
+### Patch Changes
+
+- 32296d7: Update @shopify/shopify-api dependency to 7.5.0
+- Updated dependencies [32296d7]
+  - @shopify/shopify-app-session-storage@1.1.6
+
+## 1.1.5
+
+### Patch Changes
+
+- 93e9126: Updating @shopify/shopify-api dependency
+- Updated dependencies [93e9126]
+  - @shopify/shopify-app-session-storage@1.1.5
+
+## 1.1.4
+
+### Patch Changes
+
+- b3453ff: Bumping @shopify/shopify-api dependency to latest version
+- Updated dependencies [b3453ff]
+  - @shopify/shopify-app-session-storage@1.1.4
+
+## 1.1.3
+
+### Patch Changes
+
+- e1d4f4f: Add @shopify/shopify-api as a peerDependencies entry for each session-storage package, to avoid API library conflicts (e.g., scopesArray.map error). Should help avoid issues like #93
+- de5fa79: Bumps [redis](https://github.com/redis/node-redis) from 4.6.5 to 4.6.6. See redis' [release](https://github.com/redis/node-redis/releases/tag/redis@4.6.6) for more details.
+- 1d007e8: Bumps [@shopify/shopify-api](https://github.com/Shopify/shopify-api-js) from 7.0.0 to 7.1.0. See `@shopify/shopify-api`'s [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for more details.
+- Updated dependencies [e1d4f4f]
+- Updated dependencies [1d007e8]
+  - @shopify/shopify-app-session-storage@1.1.3
+
+## 1.1.2
+
+### Patch Changes
+
+- c9804ae: Bump redis from 4.6.4 to 4.6.5. See redis [release note](https://github.com/redis/node-redis/releases/tag/redis@4.6.5) for more details.
+- e4f3415: Bump @shopify/shopify-api from 6.2.0 to 7.0.0. See [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for details.
+- 27467d8: Add event handlers to redis client to prevent crashing on disconnect event. Fixes #129, #160 (Thanks to @davidhollenbeckx for linking to issue and solution.)
+- Updated dependencies [e4f3415]
+  - @shopify/shopify-app-session-storage@1.1.2
+
+## 1.1.1
+
+### Patch Changes
+
+- 97346b3: Fix #132: mysql migrator was unable to detect already applied migrations
+- Updated dependencies [97346b3]
+  - @shopify/shopify-app-session-storage@1.1.1
+
+## 1.1.0
+
+### Minor Changes
+
+- becc305: Migrations capabilities that can handle persistence changes for all session storage implementations
+
+### Patch Changes
+
+- b6501b0: Bump typescript to 4.9.5
+- Updated dependencies [b6501b0]
+- Updated dependencies [becc305]
+  - @shopify/shopify-app-session-storage@1.1.0
+
+## 1.0.2
+
+### Patch Changes
+
+- 222b755: Updating @shopify/shopify-api to v6.1.0
+- Updated dependencies [222b755]
+  - @shopify/shopify-app-session-storage@1.0.2
+
+## 1.0.1
+
+### Patch Changes
+
+- 1eccbd6: Optimize findSessionsByShop with additional shop-based key, listing array of corresponding session ids
+- 866b50c: Update dependencies on shopify-api v6.0.2
+- Updated dependencies [866b50c]
+  - @shopify/shopify-app-session-storage@1.0.1
+
+## 1.0.0
+
+### Major Changes
+
+- Initial public release of @shopify/shopify-app-session-storage-redis

package/packages/shopify-app-session-storage-redis/LICENSE.md

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2022-present, Shopify Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/packages/shopify-app-session-storage-redis/README.md

@@ -0,0 +1,38 @@
+# Session Storage Adapter for Redis
+
+This package implements the `SessionStorage` interface that works with an instance of [Redis](https://redis.io/).
+
+```js
+import {shopifyApp} from '@shopify/shopify-app-express';
+import {RedisSessionStorage} from '@shopify/shopify-app-session-storage-redis';
+
+const shopify = shopifyApp({
+  sessionStorage: new RedisSessionStorage(
+    'redis://username:password@host/database',
+  ),
+  // ...
+});
+
+// OR
+
+const shopify = shopifyApp({
+  sessionStorage: new RedisSessionStorage(
+    new URL('redis://username:password@host/database'),
+  ),
+  // ...
+});
+
+// OR
+
+const shopify = shopifyApp({
+  sessionStorage: RedisSessionStorage.withCredentials(
+    'host.com',
+    'thedatabase',
+    'username',
+    'password',
+  ),
+  // ...
+});
+```
+
+If you prefer to use your own implementation of a session storage mechanism that is compatible with the `@shopify/shopify-app-express` package, see the [implementing session storage guide](https://github.com/Shopify/shopify-app-js/blob/main/packages/shopify-app-session-storage/implementing-session-storage.md).