shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-session-storage-redis/loom.config.ts

@@ -0,0 +1,27 @@
+import {createPackage, createProjectPlugin} from '@shopify/loom';
+import {buildLibrary} from '@shopify/loom-plugin-build-library';
+
+export default createPackage((pkg) => {
+  pkg.entry({root: './src/redis.ts'});
+  pkg.use(
+    buildLibrary({
+      // Required. A browserslist string for specifying your target output.
+      // Use browser targets (e.g. `'defaults'`) if your package targets the browser,
+      // node targets (e.g. `'node 12.22'`) if your package targets node
+      // or both (e.g.`'defaults, node 12.22'`) if your package targets both
+      targets: 'node 16',
+      // Optional. Defaults to false. Defines if commonjs outputs should be generated.
+      commonjs: true,
+      // Optional. Defaults to false. Defines if esmodules outputs should be generated.
+      esmodules: false,
+      // Optional. Defaults to false. Defines if esnext outputs should be generated.
+      esnext: false,
+      // Optional. Defaults to true. Defines if entrypoints should be written at
+      // the root of the repository. You can disable this if you have a single
+      // entrypoint or if your package uses the `exports` key in package.json
+      rootEntrypoints: false,
+      // Optional. Defaults to 'node'. Defines if the jest environment should be 'node' or 'jsdom'.
+      jestTestEnvironment: 'node',
+    }),
+  );
+});

package/packages/shopify-app-session-storage-redis/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@shopify/shopify-app-session-storage-redis",
+  "version": "3.0.1",
+  "description": "Shopify App Session Storage for Redis",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/shopify-app-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Shopify/shopify-app-js/issues"
+  },
+  "homepage": "https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage-redis",
+  "author": "Shopify Inc.",
+  "license": "MIT",
+  "main": "./build/cjs/redis.js",
+  "types": "./build/ts/redis.d.ts",
+  "scripts": {},
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "shopify",
+    "node",
+    "app",
+    "graphql",
+    "rest",
+    "webhook",
+    "Admin API",
+    "Storefront API",
+    "session storage",
+    "redis",
+    "Redis"
+  ],
+  "dependencies": {
+    "redis": "^4.6.12"
+  },
+  "peerDependencies": {
+    "@shopify/shopify-api": "^9.3.2",
+    "@shopify/shopify-app-session-storage": "^2.1.1"
+  },
+  "devDependencies": {
+    "@shopify/shopify-app-session-storage-test-utils": "^2.0.1"
+  },
+  "files": [
+    "build/*",
+    "!bundle/*",
+    "!tsconfig.tsbuildinfo",
+    "!node_modules"
+  ]
+}

package/packages/shopify-app-session-storage-redis/src/__tests__/migration-test-data.ts

@@ -0,0 +1,46 @@
+import {Session} from '@shopify/shopify-api';
+
+const expiryDate = new Date();
+expiryDate.setMilliseconds(0);
+expiryDate.setMinutes(expiryDate.getMinutes() + 60);
+
+const testScopes = ['test_scope'];
+
+export const v1_0_0SessionData = [
+  new Session({
+    id: 'abcde-12345',
+    shop: 'shop1.myshopify.com',
+    state: 'state',
+    isOnline: false,
+    scope: testScopes.toString(),
+    accessToken: 'abcde-12345-123',
+  }),
+  new Session({
+    id: 'abcde-67890',
+    shop: 'shop1.myshopify.com',
+    state: 'state',
+    isOnline: true,
+    expires: expiryDate,
+    onlineAccessInfo: {associated_user: {id: 67890}} as any,
+    scope: testScopes.toString(),
+    accessToken: 'abcde-67890-678',
+  }),
+  new Session({
+    id: 'vwxyz-12345',
+    shop: 'shop2.myshopify.com',
+    state: 'state',
+    isOnline: false,
+    scope: testScopes.toString(),
+    accessToken: 'vwxyz-12345-123',
+  }),
+  new Session({
+    id: 'vwxyz-67890',
+    shop: 'shop2.myshopify.com',
+    state: 'state',
+    isOnline: true,
+    expires: expiryDate,
+    onlineAccessInfo: {associated_user: {id: 67890}} as any,
+    scope: testScopes.toString(),
+    accessToken: 'vwxyz-67890-678',
+  }),
+];

package/packages/shopify-app-session-storage-redis/src/__tests__/redis.conf

@@ -0,0 +1,2 @@
+user 'shop&fy' on +@all allkeys  >'passify#$'
+timeout 2

package/packages/shopify-app-session-storage-redis/src/__tests__/redis.test.ts

@@ -0,0 +1,236 @@
+import * as child_process from 'child_process';
+import {promisify} from 'util';
+import {resolve} from 'path';
+
+import {createClient} from 'redis';
+import {
+  batteryOfTests,
+  wait,
+} from '@shopify/shopify-app-session-storage-test-utils';
+import {Session} from '@shopify/shopify-api';
+
+import {RedisSessionStorage} from '../redis';
+
+import {v1_0_0SessionData} from './migration-test-data';
+
+const exec = promisify(child_process.exec);
+
+const dbURL = new URL(
+  `redis://${encodeURIComponent('shop&fy')}:${encodeURIComponent(
+    'passify#$',
+  )}@localhost/1`,
+);
+
+type RedisClient = ReturnType<typeof createClient>;
+
+describe('RedisSessionStorage', () => {
+  let containerId: string | undefined;
+  let client: RedisClient;
+
+  beforeAll(async () => {
+    const configPath = resolve(__dirname, './redis.conf');
+    const runCommand = await exec(
+      `podman run -d -p 6379:6379 -v ${configPath}:/redis.conf redis:6 redis-server /redis.conf`,
+      {encoding: 'utf8'},
+    );
+    containerId = runCommand.stdout.trim();
+
+    // Give the container a lot of time to set up since polling is ineffective with podman
+    await wait(10000);
+
+    client = createClient({url: dbURL.toString()});
+    client.on('error', (err) => {});
+    client.on('connect', () => {});
+    client.on('reconnecting', () => {});
+    client.on('ready', () => {});
+    await client.connect();
+  });
+
+  afterAll(async () => {
+    await client.disconnect();
+    if (containerId) await exec(`podman rm -f ${containerId}`);
+  });
+
+  describe('batteryOfTests', () => {
+    let storage: RedisSessionStorage | undefined;
+    beforeAll(async () => {
+      // flush the DB
+      await client.flushDb();
+      await initWithNonSessionData(client);
+
+      storage = new RedisSessionStorage(dbURL);
+      await storage.ready;
+    });
+
+    afterAll(async () => {
+      await storage?.disconnect();
+    });
+
+    batteryOfTests(async () => storage!);
+  });
+
+  describe('migrateAddShopKeyToTrackSessionsByShop tests', () => {
+    let storage: RedisSessionStorage | undefined;
+    beforeAll(async () => {
+      // flush the DB
+      await client.flushDb();
+      await initWithNonSessionData(client);
+      await initWithVersion1_0_0Data(client);
+    });
+
+    afterEach(async () => {
+      await storage?.disconnect();
+    });
+
+    it('initially satisfies pre-migrateAddShopKeyToTrackSessionsByShop conditions', async () => {
+      const shop1SessionIds = await client.get(
+        'shopify_sessions_shop1.myshopify.com',
+      );
+      expect(shop1SessionIds).toBeNull();
+
+      const shop2SessionIds = await client.get(
+        'shopify_sessions_shop2.myshopify.com',
+      );
+      expect(shop2SessionIds).toBeNull();
+    });
+
+    it('migrates previous data to migrateAddShopKeyToTrackSessionsByShop', async () => {
+      storage = new RedisSessionStorage(dbURL);
+      await storage.ready;
+
+      const shop1SessionIds = await client.get(
+        'shopify_sessions_shop1.myshopify.com',
+      );
+      expect(shop1SessionIds).toBeDefined();
+      const shop1SessionIdsArray = JSON.parse(shop1SessionIds as string);
+      expect(shop1SessionIdsArray).toContain('shopify_sessions_abcde-12345');
+      expect(shop1SessionIdsArray).toContain('shopify_sessions_abcde-67890');
+
+      const shop2SessionIds = await client.get(
+        'shopify_sessions_shop2.myshopify.com',
+      );
+      expect(shop2SessionIds).toBeDefined();
+      const shop2SessionIdsArray = JSON.parse(shop2SessionIds as string);
+      expect(shop2SessionIdsArray).toContain('shopify_sessions_vwxyz-12345');
+      expect(shop2SessionIdsArray).toContain('shopify_sessions_vwxyz-67890');
+    });
+
+    it('manipulates migrateAddShopKeyToTrackSessionsByShop data structures correctly', async () => {
+      storage = new RedisSessionStorage(dbURL);
+      await storage.ready;
+
+      await storage.deleteSession('abcde-12345');
+      const shop1SessionIds = await client.get(
+        'shopify_sessions_shop1.myshopify.com',
+      );
+      expect(shop1SessionIds).toBeDefined();
+      const shop1SessionIdsArray = JSON.parse(shop1SessionIds as string);
+      expect(shop1SessionIdsArray).not.toContain(
+        'shopify_sessions_abcde-12345',
+      );
+      expect(shop1SessionIdsArray).toContain('shopify_sessions_abcde-67890');
+      const shop1Sessions = await storage.findSessionsByShop(
+        'shop1.myshopify.com',
+      );
+      expect(shop1Sessions).toHaveLength(1);
+      expect(shop1Sessions[0].id).toBe('abcde-67890');
+
+      const newSession = new Session({
+        id: 'vwxyz-abcde',
+        shop: 'shop2.myshopify.com',
+        state: 'state',
+        isOnline: false,
+        scope: ['test_scope2'].toString(),
+        accessToken: 'vwxyz-abcde-678',
+      });
+      await storage.storeSession(newSession);
+      const shop2SessionIds = await client.get(
+        'shopify_sessions_shop2.myshopify.com',
+      );
+      expect(shop2SessionIds).toBeDefined();
+      const shop2SessionIdsArray = JSON.parse(shop2SessionIds as string);
+      expect(shop2SessionIdsArray).toContain('shopify_sessions_vwxyz-12345');
+      expect(shop2SessionIdsArray).toContain('shopify_sessions_vwxyz-67890');
+      expect(shop2SessionIdsArray).toContain('shopify_sessions_vwxyz-abcde');
+      const shop2Sessions = await storage.findSessionsByShop(
+        'shop2.myshopify.com',
+      );
+      expect(shop2Sessions).toHaveLength(3);
+    });
+  });
+
+  it(`one-time initialisation like migrations and table creations are run only once`, async () => {
+    const storageClone1 = new RedisSessionStorage(dbURL);
+    await storageClone1.ready;
+
+    const storageClone2 = new RedisSessionStorage(dbURL);
+    await storageClone2.ready;
+
+    storageClone1.disconnect();
+    storageClone2.disconnect();
+  });
+
+  it(`reconnects after a timeout`, async () => {
+    const storage = new RedisSessionStorage(dbURL);
+    await storage.ready;
+
+    const sessionId = 'timeout_connection_test';
+    const session = new Session({
+      id: sessionId,
+      shop: 'shop1.myshopify.com',
+      state: 'state',
+      isOnline: false,
+      scope: ['test_scope'].toString(),
+      accessToken: 'abcde-12345-123',
+    });
+
+    await storage.storeSession(session);
+
+    // Wait for the redis client to disconnect
+    await wait(2500);
+
+    const storedSession = await storage.loadSession(sessionId);
+    expect(storedSession).toBeDefined();
+    expect(storedSession?.id).toBe(sessionId);
+
+    await storage.disconnect();
+  });
+
+  it(`can successfully connect with a url string instead of a URL object`, async () => {
+    const storage = new RedisSessionStorage(dbURL.toString());
+    await storage.ready;
+    const session = new Session({
+      id: '456',
+      shop: 'test-shop.myshopify.com',
+      state: 'test-state',
+      isOnline: false,
+      scope: 'fake_scope',
+    });
+
+    expect(await storage.storeSession(session)).toBeTruthy();
+    await storage.disconnect();
+  });
+});
+
+async function initWithNonSessionData(client: RedisClient) {
+  // Json type different from json array contrary to what is expected by Session.fromPropertyArray
+  await client.set(
+    'this_is_not_a_session_id',
+    JSON.stringify('{"key": "with a random value"}'),
+  );
+
+  // Type json array as expected by the the Session.fromPropertyArray but does not contain session data
+  await client.set('12563', '["Ford", "BMW", "Fiat"]');
+
+  // Not a json value
+  await client.set('256647', 'any random value really');
+}
+
+async function initWithVersion1_0_0Data(client: RedisClient) {
+  for (const session of v1_0_0SessionData) {
+    await client.set(
+      `shopify_sessions_${session.id}`,
+      JSON.stringify(session.toPropertyArray()),
+    );
+  }
+}

package/packages/shopify-app-session-storage-redis/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-session-storage-redis/src/migrations.ts

@@ -0,0 +1,36 @@
+import {Session} from '@shopify/shopify-api';
+import {MigrationOperation} from '@shopify/shopify-app-session-storage';
+
+import {RedisConnection} from './redis-connection';
+
+export const migrationList = [
+  new MigrationOperation(
+    // This migration name cannot be changed as it has already been released
+    'migrateToVersion1_0_1',
+    migrateAddShopKeyToTrackSessionsByShop,
+  ),
+];
+
+// need to add shop keys with list of associated session keys to support
+// the new findSessionsByShop in v2.x.x
+export async function migrateAddShopKeyToTrackSessionsByShop(
+  connection: RedisConnection,
+): Promise<void> {
+  const shopsAndSessions: Record<string, string[]> = {};
+  const keys = await connection.keys('*');
+  for (const key of keys) {
+    if (key.startsWith(connection.sessionStorageIdentifier)) {
+      const session = Session.fromPropertyArray(
+        JSON.parse((await connection.get(key, false)) as string),
+      );
+      if (!shopsAndSessions[session.shop]) {
+        shopsAndSessions[session.shop] = [];
+      }
+      shopsAndSessions[session.shop].push(key);
+    }
+  }
+  // eslint-disable-next-line guard-for-in
+  for (const shop in shopsAndSessions) {
+    await connection.set(shop, JSON.stringify(shopsAndSessions[shop]));
+  }
+}

package/packages/shopify-app-session-storage-redis/src/redis-connection.ts

@@ -0,0 +1,64 @@
+import {createClient, RedisClientOptions} from 'redis';
+import {DBConnection} from '@shopify/shopify-app-session-storage';
+
+type RedisClient = ReturnType<typeof createClient>;
+
+export class RedisConnection implements DBConnection {
+  sessionStorageIdentifier: string;
+  private client: RedisClient;
+
+  constructor(dbUrl: string, options: RedisClientOptions, keyPrefix: string) {
+    this.init(dbUrl, options);
+    this.sessionStorageIdentifier = keyPrefix;
+  }
+
+  query(_query: string, _params: any[]): Promise<any[]> {
+    throw new Error('Method not implemented. Use get(string, boolean) instead');
+  }
+
+  async connect(): Promise<void> {
+    await this.client.connect();
+  }
+
+  async disconnect(): Promise<void> {
+    await this.client.quit();
+  }
+
+  async keys(name: string): Promise<any> {
+    return this.client.keys(name);
+  }
+
+  async set(baseKey: string, value: any, addKeyPrefix = true) {
+    await this.client.set(this.buildKey(baseKey, addKeyPrefix), value);
+  }
+
+  async del(baseKey: string, addKeyPrefix = true): Promise<any> {
+    return this.client.del(this.buildKey(baseKey, addKeyPrefix));
+  }
+
+  async get(baseKey: string, addKeyPrefix = true): Promise<any> {
+    return this.client.get(this.buildKey(baseKey, addKeyPrefix));
+  }
+
+  generateFullKey(name: string): string {
+    return `${this.sessionStorageIdentifier}_${name}`;
+  }
+
+  private buildKey(baseKey: string, addKeyPrefix: boolean): string {
+    return addKeyPrefix ? this.generateFullKey(baseKey) : baseKey;
+  }
+
+  private init(dbUrl: string, options: RedisClientOptions) {
+    this.client = createClient({
+      ...options,
+      url: dbUrl,
+    });
+
+    this.client.on('error', this.eventHandler);
+    this.client.on('connect', this.eventHandler);
+    this.client.on('reconnecting', this.eventHandler);
+    this.client.on('ready', this.eventHandler);
+  }
+
+  private eventHandler = (..._args: any[]) => {};
+}

package/packages/shopify-app-session-storage-redis/src/redis-migrator.ts

@@ -0,0 +1,58 @@
+import {
+  AbstractMigrationEngine,
+  SessionStorageMigratorOptions,
+  MigrationOperation,
+} from '@shopify/shopify-app-session-storage';
+
+import {RedisConnection} from './redis-connection';
+
+export class RedisSessionStorageMigrator extends AbstractMigrationEngine<
+  RedisConnection,
+  SessionStorageMigratorOptions
+> {
+  constructor(
+    dbConnection: RedisConnection,
+    opts: Partial<SessionStorageMigratorOptions> = {},
+    migrations: MigrationOperation[],
+  ) {
+    // The name has already been decided whith the last migration
+    opts.migrationDBIdentifier = 'migrations';
+    super(dbConnection, opts, migrations);
+  }
+
+  async initMigrationPersistence(): Promise<void> {
+    // nothing to do here
+    return Promise.resolve();
+  }
+
+  async hasMigrationBeenApplied(migrationName: string): Promise<boolean> {
+    const migrations = await this.getMigrationRecords();
+    const found = migrations.get(migrationName) ?? false;
+
+    return Promise.resolve(found);
+  }
+
+  async saveAppliedMigration(migrationName: string): Promise<void> {
+    const migrations = await this.getMigrationRecords();
+    migrations.set(migrationName, true);
+
+    this.connection.set(
+      this.options.migrationDBIdentifier,
+      JSON.stringify(Object.fromEntries(migrations)),
+    );
+
+    return Promise.resolve();
+  }
+
+  private async getMigrationRecords(): Promise<Map<string, boolean>> {
+    const migrationsRecord = await this.connection.get(
+      this.options.migrationDBIdentifier,
+    );
+    let migrations: Map<string, boolean> = new Map();
+    if (migrationsRecord) {
+      migrations = new Map(Object.entries(JSON.parse(migrationsRecord)));
+    }
+
+    return Promise.resolve(migrations);
+  }
+}