shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-session-storage-redis/src/redis.ts

@@ -0,0 +1,167 @@
+import {RedisClientOptions} from 'redis';
+import {Session} from '@shopify/shopify-api';
+import {
+  SessionStorage,
+  SessionStorageMigratorOptions,
+  SessionStorageMigrator,
+} from '@shopify/shopify-app-session-storage';
+
+import {migrationList} from './migrations';
+import {RedisConnection} from './redis-connection';
+import {RedisSessionStorageMigrator} from './redis-migrator';
+
+export interface RedisSessionStorageOptions extends RedisClientOptions {
+  sessionKeyPrefix: string;
+  onError?: (...args: any[]) => void;
+  migratorOptions?: SessionStorageMigratorOptions;
+}
+const defaultRedisSessionStorageOptions: RedisSessionStorageOptions = {
+  sessionKeyPrefix: 'shopify_sessions',
+  migratorOptions: {
+    migrationDBIdentifier: 'migrations',
+  },
+};
+
+export class RedisSessionStorage implements SessionStorage {
+  static withCredentials(
+    host: string,
+    db: number,
+    username: string,
+    password: string,
+    opts: Partial<RedisSessionStorageOptions>,
+  ) {
+    return new RedisSessionStorage(
+      new URL(
+        `redis://${encodeURIComponent(username)}:${encodeURIComponent(
+          password,
+        )}@${host}/${db}`,
+      ),
+      opts,
+    );
+  }
+
+  public readonly ready: Promise<void>;
+  private internalInit: Promise<void>;
+  private options: RedisSessionStorageOptions;
+  private client: RedisConnection;
+  private migrator: SessionStorageMigrator;
+
+  constructor(
+    dbUrl: URL | string,
+    opts: Partial<RedisSessionStorageOptions> = {},
+  ) {
+    this.options = {...defaultRedisSessionStorageOptions, ...opts};
+    this.internalInit = this.init(
+      typeof dbUrl === 'string' ? dbUrl : dbUrl.toString(),
+    );
+    this.migrator = new RedisSessionStorageMigrator(
+      this.client,
+      this.options.migratorOptions,
+      migrationList,
+    );
+    this.ready = this.migrator.applyMigrations(this.internalInit);
+  }
+
+  public async storeSession(session: Session): Promise<boolean> {
+    await this.ready;
+
+    await this.client.set(
+      session.id,
+      JSON.stringify(session.toPropertyArray()),
+    );
+    await this.addKeyToShopList(session);
+    return true;
+  }
+
+  public async loadSession(id: string): Promise<Session | undefined> {
+    await this.ready;
+
+    let rawResult: any = await this.client.get(id);
+
+    if (!rawResult) return undefined;
+    rawResult = JSON.parse(rawResult);
+
+    return Session.fromPropertyArray(rawResult);
+  }
+
+  public async deleteSession(id: string): Promise<boolean> {
+    await this.ready;
+    const session = await this.loadSession(id);
+    if (session) {
+      await this.removeKeyFromShopList(session.shop, id);
+      await this.client.del(id);
+    }
+    return true;
+  }
+
+  public async deleteSessions(ids: string[]): Promise<boolean> {
+    await this.ready;
+    await Promise.all(ids.map((id) => this.deleteSession(id)));
+    return true;
+  }
+
+  public async findSessionsByShop(shop: string): Promise<Session[]> {
+    await this.ready;
+
+    const idKeysArrayString = await this.client.get(shop);
+    if (!idKeysArrayString) return [];
+
+    const idKeysArray = JSON.parse(idKeysArrayString);
+    const results: Session[] = [];
+    for (const idKey of idKeysArray) {
+      const rawResult = await this.client.get(idKey, false);
+      if (!rawResult) continue;
+
+      const session = Session.fromPropertyArray(JSON.parse(rawResult));
+      results.push(session);
+    }
+
+    return results;
+  }
+
+  public async disconnect(): Promise<void> {
+    await this.client.disconnect();
+  }
+
+  private async addKeyToShopList(session: Session) {
+    const shopKey = session.shop;
+    const idKey = this.client.generateFullKey(session.id);
+    const idKeysArrayString = await this.client.get(shopKey);
+
+    if (idKeysArrayString) {
+      const idKeysArray = JSON.parse(idKeysArrayString);
+
+      if (!idKeysArray.includes(idKey)) {
+        idKeysArray.push(idKey);
+        await this.client.set(shopKey, JSON.stringify(idKeysArray));
+      }
+    } else {
+      await this.client.set(shopKey, JSON.stringify([idKey]));
+    }
+  }
+
+  private async removeKeyFromShopList(shop: string, id: string) {
+    const shopKey = shop;
+    const idKey = this.client.generateFullKey(id);
+    const idKeysArrayString = await this.client.get(shopKey);
+
+    if (idKeysArrayString) {
+      const idKeysArray = JSON.parse(idKeysArrayString);
+      const index = idKeysArray.indexOf(idKey);
+
+      if (index > -1) {
+        idKeysArray.splice(index, 1);
+        await this.client.set(shopKey, JSON.stringify(idKeysArray));
+      }
+    }
+  }
+
+  private async init(dbUrl: string) {
+    this.client = new RedisConnection(
+      dbUrl,
+      this.options,
+      this.options.sessionKeyPrefix,
+    );
+    await this.client.connect();
+  }
+}

package/packages/shopify-app-session-storage-redis/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "outDir": "./build/ts",
+    "rootDir": "src"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["**/*.test.ts", "**/*.test.tsx", "**/test/*", "**/__tests__/*"]
+}

package/packages/shopify-app-session-storage-sqlite/CHANGELOG.md

@@ -0,0 +1,202 @@
+# @shopify/shopify-app-session-storage-sqlite
+
+## 3.0.1
+
+### Patch Changes
+
+- 02a8341: Updated dependency on `@shopify/shopify-api` to 9.3.1
+- 321d6a4: Update @shopify/shopify-api to 9.3.2
+- Updated dependencies [02a8341]
+- Updated dependencies [321d6a4]
+  - @shopify/shopify-app-session-storage@2.1.1
+
+## 3.0.0
+
+### Minor Changes
+
+- 64e0246: Update shopify-api version to 9.2.0
+
+### Patch Changes
+
+- 042182c: Updated `sqlite3` dependency to v5.1.7
+- f5742c1: Updated dependency on `@shopify/shopify-api`
+- Updated dependencies [f5742c1]
+- Updated dependencies [64e0246]
+  - @shopify/shopify-app-session-storage@2.1.0
+
+## 2.0.4
+
+### Patch Changes
+
+- b4eeb24: Improved and simplified package.json dependencies
+- b998c30: Bump shopify-api version from 9.0.1 to 9.0.2
+- Updated dependencies [b4eeb24]
+- Updated dependencies [b998c30]
+  - @shopify/shopify-app-session-storage@2.0.4
+
+## 2.0.3
+
+### Patch Changes
+
+- d3e4b5e: Updated the dependency on `@shopify/shopify-api`
+- Updated dependencies [d3e4b5e]
+  - @shopify/shopify-app-session-storage@2.0.3
+
+## 2.0.2
+
+### Patch Changes
+
+- 3685bd4: Bump shopify-api to ^8.1.1
+- Updated dependencies [3685bd4]
+  - @shopify/shopify-app-session-storage@2.0.2
+
+## 2.0.1
+
+### Patch Changes
+
+- 6d12840: Updating dependencies on @shopify/shopify-api
+- Updated dependencies [6d12840]
+  - @shopify/shopify-app-session-storage@2.0.1
+
+## 2.0.0
+
+### Major Changes
+
+- f837060: **Removed support for Node 14**
+
+  Node 14 has reached its [EOL](https://endoflife.date/nodejs), and dependencies to this package no longer work on Node 14.
+  Because of that, we can no longer support that version.
+
+  If your app is running on Node 14, you'll need to update to a more recent version before upgrading this package.
+
+  This upgrade does not require any code changes.
+
+### Patch Changes
+
+- a69d6fc: Updating dependency on @shopify/shopify-api to v.8.0.1
+- Updated dependencies [f837060]
+- Updated dependencies [a69d6fc]
+  - @shopify/shopify-app-session-storage@2.0.0
+
+## 1.2.9
+
+### Patch Changes
+
+- 616388d: Updating dependency on @shopify/shopify-api to 7.7.0
+- Updated dependencies [616388d]
+  - @shopify/shopify-app-session-storage@1.1.10
+
+## 1.2.8
+
+### Patch Changes
+
+- 5b862fe: Upgraded shopify-api dependency to 7.6.0
+- Updated dependencies [5b862fe]
+  - @shopify/shopify-app-session-storage@1.1.9
+
+## 1.2.7
+
+### Patch Changes
+
+- 346b623: Updating dependency on @shopify/shopify-api
+- Updated dependencies [346b623]
+  - @shopify/shopify-app-session-storage@1.1.8
+
+## 1.2.6
+
+### Patch Changes
+
+- 13b9048: Updating @shopify/shopify-api dependency to the latest version
+- Updated dependencies [13b9048]
+  - @shopify/shopify-app-session-storage@1.1.7
+
+## 1.2.5
+
+### Patch Changes
+
+- 32296d7: Update @shopify/shopify-api dependency to 7.5.0
+- Updated dependencies [32296d7]
+  - @shopify/shopify-app-session-storage@1.1.6
+
+## 1.2.4
+
+### Patch Changes
+
+- 93e9126: Updating @shopify/shopify-api dependency
+- Updated dependencies [93e9126]
+  - @shopify/shopify-app-session-storage@1.1.5
+
+## 1.2.3
+
+### Patch Changes
+
+- b3453ff: Bumping @shopify/shopify-api dependency to latest version
+- Updated dependencies [b3453ff]
+  - @shopify/shopify-app-session-storage@1.1.4
+
+## 1.2.2
+
+### Patch Changes
+
+- e1d4f4f: Add @shopify/shopify-api as a peerDependencies entry for each session-storage package, to avoid API library conflicts (e.g., scopesArray.map error). Should help avoid issues like #93
+- 1d007e8: Bumps [@shopify/shopify-api](https://github.com/Shopify/shopify-api-js) from 7.0.0 to 7.1.0. See `@shopify/shopify-api`'s [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for more details.
+- Updated dependencies [e1d4f4f]
+- Updated dependencies [1d007e8]
+  - @shopify/shopify-app-session-storage@1.1.3
+
+## 1.2.1
+
+### Patch Changes
+
+- e4f3415: Bump @shopify/shopify-api from 6.2.0 to 7.0.0. See [changelog](https://github.com/Shopify/shopify-api-js/blob/main/packages/shopify-api/CHANGELOG.md) for details.
+- 9ebfdf1: Bump sqlite3 from 5.1.4 to 5.1.6. See sqlite3 [release notes](https://github.com/TryGhost/node-sqlite3/releases) for details.
+- Updated dependencies [e4f3415]
+  - @shopify/shopify-app-session-storage@1.1.2
+
+## 1.2.0
+
+### Minor Changes
+
+- 7e55407: Allow sqlite3.Database object as argument for SQLiteSessionStorage constructor
+
+### Patch Changes
+
+- 97346b3: Fix #132: mysql migrator was unable to detect already applied migrations
+- Updated dependencies [97346b3]
+  - @shopify/shopify-app-session-storage@1.1.1
+
+## 1.1.0
+
+### Minor Changes
+
+- becc305: Migrations capabilities that can handle persistence changes for all session storage implementations
+
+### Patch Changes
+
+- 8f5749f: Increase size of 'scope' column to 1024 for session storage implementation for RDBMS
+- b6501b0: Bump typescript to 4.9.5
+- Updated dependencies [b6501b0]
+- Updated dependencies [becc305]
+  - @shopify/shopify-app-session-storage@1.1.0
+
+## 1.0.2
+
+### Patch Changes
+
+- 222b755: Updating @shopify/shopify-api to v6.1.0
+- Updated dependencies [222b755]
+  - @shopify/shopify-app-session-storage@1.0.2
+
+## 1.0.1
+
+### Patch Changes
+
+- 866b50c: Update dependencies on shopify-api v6.0.2
+- Updated dependencies [866b50c]
+  - @shopify/shopify-app-session-storage@1.0.1
+
+## 1.0.0
+
+### Major Changes
+
+- Initial public release of @shopify/shopify-app-session-storage-sqlite

package/packages/shopify-app-session-storage-sqlite/LICENSE.md

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2022-present, Shopify Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/packages/shopify-app-session-storage-sqlite/README.md

@@ -0,0 +1,25 @@
+# Session Storage Adapter for SQLite
+
+This package implements the `SessionStorage` interface that works with an instance of SQLite.
+
+```js
+import {shopifyApp} from '@shopify/shopify-app-express';
+import {SQLiteSessionStorage} from '@shopify/shopify-app-session-storage-sqlite';
+import sqlite3 from 'sqlite3';
+
+// You can construct using either a filename...
+const storage = new SQLiteSessionStorage('/path/to/your.db');
+
+// or an existing sqlite3.Database
+const database = new sqlite3.Database('/path/to/your.db');
+const storage = new SQLiteSessionStorage(database);
+
+const shopify = shopifyApp({
+  sessionStorage: storage,
+  // ...
+});
+```
+
+> **Note**: [SQLite](https://sqlite.com) is a local, file-based SQL database. It persists all tables to a single file on your local disk. As such, it’s simple to set up and is a great choice for getting started with Shopify App development. However, it won’t work when your app getting scaled across multiple instances because they would each create their own database.
+
+If you prefer to use your own implementation of a session storage mechanism that is compatible with the `@shopify/shopify-app-express` package, see the [implementing session storage guide](https://github.com/Shopify/shopify-app-js/blob/main/packages/shopify-app-session-storage/implementing-session-storage.md).

package/packages/shopify-app-session-storage-sqlite/loom.config.ts

@@ -0,0 +1,27 @@
+import {createPackage, createProjectPlugin} from '@shopify/loom';
+import {buildLibrary} from '@shopify/loom-plugin-build-library';
+
+export default createPackage((pkg) => {
+  pkg.entry({root: './src/sqlite.ts'});
+  pkg.use(
+    buildLibrary({
+      // Required. A browserslist string for specifying your target output.
+      // Use browser targets (e.g. `'defaults'`) if your package targets the browser,
+      // node targets (e.g. `'node 12.22'`) if your package targets node
+      // or both (e.g.`'defaults, node 12.22'`) if your package targets both
+      targets: 'node 16',
+      // Optional. Defaults to false. Defines if commonjs outputs should be generated.
+      commonjs: true,
+      // Optional. Defaults to false. Defines if esmodules outputs should be generated.
+      esmodules: false,
+      // Optional. Defaults to false. Defines if esnext outputs should be generated.
+      esnext: false,
+      // Optional. Defaults to true. Defines if entrypoints should be written at
+      // the root of the repository. You can disable this if you have a single
+      // entrypoint or if your package uses the `exports` key in package.json
+      rootEntrypoints: false,
+      // Optional. Defaults to 'node'. Defines if the jest environment should be 'node' or 'jsdom'.
+      jestTestEnvironment: 'node',
+    }),
+  );
+});

package/packages/shopify-app-session-storage-sqlite/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@shopify/shopify-app-session-storage-sqlite",
+  "version": "3.0.1",
+  "description": "Shopify App Session Storage for SQLite",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/shopify-app-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Shopify/shopify-app-js/issues"
+  },
+  "homepage": "https://github.com/Shopify/shopify-app-js/tree/main/packages/shopify-app-session-storage-sqlite",
+  "author": "Shopify Inc.",
+  "license": "MIT",
+  "main": "./build/cjs/sqlite.js",
+  "types": "./build/ts/sqlite.d.ts",
+  "scripts": {},
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "shopify",
+    "node",
+    "app",
+    "graphql",
+    "rest",
+    "webhook",
+    "Admin API",
+    "Storefront API",
+    "session storage",
+    "SQLite",
+    "sqlite"
+  ],
+  "dependencies": {
+    "sqlite3": "^5.1.7"
+  },
+  "peerDependencies": {
+    "@shopify/shopify-api": "^9.3.2",
+    "@shopify/shopify-app-session-storage": "^2.1.1"
+  },
+  "devDependencies": {
+    "@shopify/shopify-app-session-storage-test-utils": "^2.0.1",
+    "@types/sqlite3": "^3.1.8"
+  },
+  "files": [
+    "build/*",
+    "!bundle/*",
+    "!tsconfig.tsbuildinfo",
+    "!node_modules"
+  ]
+}

package/packages/shopify-app-session-storage-sqlite/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-session-storage-sqlite/src/__tests__/sqlite.test.ts

@@ -0,0 +1,44 @@
+import * as fs from 'fs/promises';
+
+import {Session} from '@shopify/shopify-api';
+import {batteryOfTests} from '@shopify/shopify-app-session-storage-test-utils';
+import sqlite3 from 'sqlite3';
+
+import {SQLiteSessionStorage} from '../sqlite';
+
+describe('SQLiteSessionStorage', () => {
+  const sqliteDbFile = './sqlite.testDb';
+  let storage: SQLiteSessionStorage;
+
+  beforeAll(async () => {
+    await fs.rm(sqliteDbFile, {force: true});
+  });
+
+  afterAll(async () => {
+    await fs.rm(sqliteDbFile, {force: true});
+  });
+
+  it(`one-time initialisation like migrations and table creations are run only once`, async () => {
+    const storageClone1 = new SQLiteSessionStorage(sqliteDbFile);
+    await storageClone1.ready;
+
+    const storageClone2 = new SQLiteSessionStorage(sqliteDbFile);
+    await storageClone2.ready;
+  });
+
+  describe('with string constructor', () => {
+    beforeEach(async () => {
+      storage = new SQLiteSessionStorage(sqliteDbFile);
+    });
+
+    batteryOfTests(async () => storage);
+  });
+
+  describe('with database constructor', () => {
+    beforeEach(async () => {
+      storage = new SQLiteSessionStorage(new sqlite3.Database(sqliteDbFile));
+    });
+
+    batteryOfTests(async () => storage);
+  });
+});

package/packages/shopify-app-session-storage-sqlite/src/migrations.ts

@@ -0,0 +1,54 @@
+import {MigrationOperation} from '@shopify/shopify-app-session-storage';
+
+import {SqliteConnection} from './sqlite-connection';
+
+export const migrationList = [
+  new MigrationOperation(
+    'migrateScopeFieldToVarchar1024',
+    migrateScopeFieldToVarchar1024,
+  ),
+];
+
+// need to migrate exisiting scope from varchar 255 to varchar 1024
+async function migrateScopeFieldToVarchar1024(
+  connection: SqliteConnection,
+): Promise<void> {
+  const tempTableName = `${connection.sessionStorageIdentifier}_for_migrateScopeFieldToVarchar1024`;
+
+  await connection.executeRawQuery('BEGIN');
+
+  //  1. rename exisiting table
+  const rename = `
+    ALTER TABLE ${connection.sessionStorageIdentifier} RENAME TO ${tempTableName};
+  `;
+  await connection.query(rename);
+
+  // 2. Create new table with 1024 chars
+  const newTable = `
+        CREATE TABLE ${connection.sessionStorageIdentifier} (
+          id varchar(255) NOT NULL PRIMARY KEY,
+          shop varchar(255) NOT NULL,
+          state varchar(255) NOT NULL,
+          isOnline integer NOT NULL,
+          expires integer,
+          scope varchar(1024),
+          accessToken varchar(255),
+          onlineAccessInfo varchar(255)
+        );
+      `;
+  await connection.query(newTable);
+
+  // 3. copy all content from old table into new table
+  const insert = `
+    INSERT INTO ${connection.sessionStorageIdentifier} (id,shop,state,isOnline,expires,scope,accessToken,onlineAccessInfo)
+      SELECT id,shop,state,isOnline,expires,scope,accessToken,onlineAccessInfo
+      FROM ${tempTableName};
+  `;
+  await connection.query(insert);
+
+  // 4. Delete old renamed table
+  const drop = `DROP TABLE ${tempTableName};`;
+  await connection.query(drop);
+
+  await connection.executeRawQuery('COMMIT');
+}

package/packages/shopify-app-session-storage-sqlite/src/sqlite-connection.ts

@@ -0,0 +1,80 @@
+import sqlite3 from 'sqlite3';
+import {RdbmsConnection} from '@shopify/shopify-app-session-storage';
+
+export class SqliteConnection implements RdbmsConnection {
+  sessionStorageIdentifier: string;
+  private ready: Promise<void>;
+  private db: sqlite3.Database;
+
+  constructor(
+    database: string | sqlite3.Database,
+    sessionStorageIdentifier: string,
+  ) {
+    this.sessionStorageIdentifier = sessionStorageIdentifier;
+    this.ready = this.init(database);
+  }
+
+  async query(query: string, params: any[] = []): Promise<any[]> {
+    await this.ready;
+
+    return new Promise((resolve, reject) => {
+      this.db.all(query, params, (err, result) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        resolve(result);
+      });
+    });
+  }
+
+  async executeRawQuery(query: string): Promise<void> {
+    await this.ready;
+
+    return new Promise((resolve, reject) => {
+      this.db.exec(query, (err: Error) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        resolve();
+      });
+    });
+  }
+
+  async hasTable(tablename: string): Promise<boolean> {
+    await this.ready;
+
+    const query = `
+    SELECT name FROM sqlite_schema
+    WHERE
+      type = 'table' AND
+      name = ${this.getArgumentPlaceholder()};
+    `;
+    const rows = await this.query(query, [tablename]);
+    return rows.length === 1;
+  }
+
+  getArgumentPlaceholder(_?: number): string {
+    return `?`;
+  }
+
+  async connect(): Promise<void> {
+    await this.ready;
+
+    // Nothing to do here
+    return Promise.resolve();
+  }
+
+  async disconnect(): Promise<void> {
+    await this.ready;
+
+    // Nothing to do here
+    return Promise.resolve();
+  }
+
+  private async init(database: string | sqlite3.Database): Promise<void> {
+    this.db =
+      typeof database === 'string' ? new sqlite3.Database(database) : database;
+  }
+}