shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-express/src/__tests__/integration/webhooks.test.ts

@@ -0,0 +1,208 @@
+import request from 'supertest';
+import express, {Express} from 'express';
+import {LATEST_API_VERSION, LogSeverity} from '@shopify/shopify-api';
+
+import {AppInstallations} from '../../app-installations';
+import {
+  MockBody,
+  mockShopifyResponses,
+  shopify,
+  TEST_SHOP,
+  TEST_WEBHOOK_ID,
+  validWebhookHeaders,
+} from '../test-helper';
+
+import {AppUninstalledTestCase} from './types';
+import * as mockResponses from './responses';
+import {
+  convertBeginResponseToCallbackInfo,
+  EVENT_BRIDGE_HANDLER,
+  httpHandlerMock,
+  HTTP_HANDLER,
+  PUBSUB_HANDLER,
+} from './utils';
+
+const APP_UNINSTALLED_TEST_CASES: AppUninstalledTestCase[] = [
+  {
+    handler: {...HTTP_HANDLER, callbackUrl: '/test/webhooks'},
+    expectWrap: true,
+    mockResponse: mockResponses.HTTP_WEBHOOK_CREATE_RESPONSE,
+    expectedQuery: 'webhookSubscriptionCreate(\n      topic: APP_UNINSTALLED',
+  },
+  {
+    handler: {...EVENT_BRIDGE_HANDLER},
+    expectWrap: false,
+    mockResponse: mockResponses.EVENT_BRIDGE_WEBHOOK_CREATE_RESPONSE,
+    expectedQuery:
+      'eventBridgeWebhookSubscriptionCreate(\n      topic: APP_UNINSTALLED',
+  },
+  {
+    handler: {...PUBSUB_HANDLER},
+    expectWrap: false,
+    mockResponse: mockResponses.PUBSUB_WEBHOOK_CREATE_RESPONSE,
+    expectedQuery:
+      'pubSubWebhookSubscriptionCreate(\n      topic: APP_UNINSTALLED',
+  },
+];
+
+describe('webhook integration', () => {
+  describe('APP_UNINSTALLED wrapping', () => {
+    APP_UNINSTALLED_TEST_CASES.forEach((config) => {
+      describe(`test ${JSON.stringify(config)}`, () => {
+        let app: Express;
+
+        beforeEach(() => {
+          shopify.config.webhooks.path = '/test/webhooks';
+
+          app = express();
+
+          // Use a short timeout since everything here should be pretty quick. If you see a `socket hang up` error,
+          // it's probably because the timeout is too short.
+          app.use('*', (_req, res, next) => {
+            res.setTimeout(100);
+            next();
+          });
+
+          app.get('/test/auth', shopify.auth.begin());
+          app.get(
+            '/test/auth/callback',
+            shopify.auth.callback(),
+            shopify.redirectToShopifyOrAppRoot(),
+          );
+          app.post(
+            '/test/webhooks',
+            shopify.processWebhooks({
+              webhookHandlers: {APP_UNINSTALLED: config.handler},
+            }),
+          );
+        });
+
+        afterEach(() => {
+          httpHandlerMock.mockReset();
+        });
+
+        it('registers and triggers as expected', async () => {
+          const responses: [MockBody][] = [
+            [mockResponses.OFFLINE_ACCESS_TOKEN_RESPONSE],
+            [mockResponses.EMPTY_WEBHOOK_RESPONSE],
+          ];
+
+          if (config.expectWrap) {
+            expect(
+              shopify.api.config.logger.log as jest.Mock,
+            ).toHaveBeenCalledWith(
+              LogSeverity.Info,
+              expect.stringContaining(
+                "Detected multiple handlers for 'APP_UNINSTALLED', webhooks.process will call them sequentially",
+              ),
+            );
+          } else {
+            expect(
+              shopify.api.config.logger.log as jest.Mock,
+            ).not.toHaveBeenCalledWith(
+              LogSeverity.Info,
+              expect.stringContaining(
+                "Detected multiple handlers for 'APP_UNINSTALLED', webhooks.process will call them sequentially",
+              ),
+            );
+
+            responses.push([config.mockResponse]);
+          }
+
+          responses.push([mockResponses.HTTP_WEBHOOK_CREATE_RESPONSE]);
+
+          mockShopifyResponses(...responses);
+
+          await performOAuth(app);
+
+          const webhookQueries = ['webhookSubscriptions('];
+          if (!config.expectWrap) {
+            webhookQueries.push(config.expectedQuery);
+          }
+          webhookQueries.push(
+            'webhookSubscriptionCreate(\n      topic: APP_UNINSTALLED',
+          );
+
+          webhookQueries.forEach((query) =>
+            expect({
+              method: 'POST',
+              url: `https://${TEST_SHOP}/admin/api/${LATEST_API_VERSION}/graphql.json`,
+              body: expect.objectContaining({
+                query: expect.stringContaining(query),
+              }),
+            }).toMatchMadeHttpRequest(),
+          );
+
+          const appInstallations = new AppInstallations(shopify.config);
+          expect(await appInstallations.includes(TEST_SHOP)).toBe(true);
+
+          await triggerWebhook(app);
+
+          expect(
+            shopify.api.config.logger.log as jest.Mock,
+          ).toHaveBeenCalledWith(
+            LogSeverity.Info,
+            expect.stringContaining(
+              'Webhook processed, returned status code 200',
+            ),
+          );
+
+          expect(await appInstallations.includes(TEST_SHOP)).toBe(false);
+
+          if (config.expectWrap) {
+            expect(httpHandlerMock).toHaveBeenCalledWith(
+              'APP_UNINSTALLED',
+              TEST_SHOP,
+              '{}',
+              TEST_WEBHOOK_ID,
+              LATEST_API_VERSION,
+            );
+          }
+        });
+      });
+    });
+  });
+});
+
+async function performOAuth(app: Express) {
+  const beginResponse = await request(app)
+    .get(`/test/auth?shop=${TEST_SHOP}`)
+    .expect(302);
+
+  const callbackInfo = convertBeginResponseToCallbackInfo(
+    beginResponse,
+    shopify.api.config.apiSecretKey,
+    TEST_SHOP,
+  );
+
+  await request(app)
+    .get(`/test/auth/callback?${callbackInfo.params.toString()}`)
+    .set('Cookie', callbackInfo.cookies)
+    .expect(302);
+
+  expect({
+    method: 'POST',
+    url: `https://${TEST_SHOP}/admin/oauth/access_token`,
+    body: {
+      client_id: shopify.api.config.apiKey,
+      client_secret: shopify.api.config.apiSecretKey,
+      code: callbackInfo.params.get('code'),
+    },
+  }).toMatchMadeHttpRequest();
+}
+
+async function triggerWebhook(app: Express) {
+  const body = JSON.stringify({});
+
+  await request(app)
+    .post('/test/webhooks')
+    .set(
+      validWebhookHeaders(
+        'APP_UNINSTALLED',
+        body,
+        shopify.api.config.apiSecretKey,
+      ),
+    )
+    .send(body)
+    .expect(200);
+}

package/packages/shopify-app-express/src/__tests__/redirect-to-auth.test.ts

@@ -0,0 +1,103 @@
+import express from 'express';
+import request from 'supertest';
+
+import {redirectToAuth} from '../redirect-to-auth';
+
+import {BASE64_HOST, shopify, TEST_SHOP} from './test-helper';
+
+describe('redirectToAuth', () => {
+  let app: express.Express;
+
+  let beginMock: jest.SpyInstance;
+  beforeEach(() => {
+    app = express();
+    app.get('/redirect-to-auth', async (req, res) => {
+      await redirectToAuth({
+        req,
+        res,
+        api: shopify.api,
+        config: shopify.config,
+      });
+    });
+
+    beginMock = jest.spyOn(shopify.api.auth, 'begin');
+    beginMock.mockImplementationOnce(async ({rawResponse}) => {
+      rawResponse.redirect('https://oauth-url');
+    });
+  });
+
+  afterEach(() => {
+    beginMock.mockReset();
+  });
+
+  it('triggers a server-side redirect with no params', async () => {
+    const response = await request(app)
+      .get(`/redirect-to-auth?shop=${TEST_SHOP}`)
+      .expect(302);
+
+    expect(beginMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        callbackPath: '/auth/callback',
+        isOnline: shopify.config.useOnlineTokens,
+        shop: TEST_SHOP,
+      }),
+    );
+    expect(response.header.location).toBe('https://oauth-url');
+  });
+
+  it('triggers a server-side redirect when embedded is not 1', async () => {
+    const response = await request(app)
+      .get(`/redirect-to-auth?shop=${TEST_SHOP}&embedded=0`)
+      .expect(302);
+
+    expect(beginMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        callbackPath: '/auth/callback',
+        isOnline: shopify.config.useOnlineTokens,
+        shop: TEST_SHOP,
+      }),
+    );
+    expect(response.header.location).toBe('https://oauth-url');
+  });
+
+  it('triggers a client-side redirect when embedded is 1', async () => {
+    const expectedParams = new URLSearchParams({
+      shop: TEST_SHOP,
+      host: BASE64_HOST,
+      embedded: '1',
+      redirectUri: `https://${shopify.api.config.hostName}/auth?shop=${TEST_SHOP}&host=${BASE64_HOST}`,
+    });
+    const response = await request(app)
+      .get(`/redirect-to-auth?${expectedParams.toString()}`)
+      .expect(302);
+
+    const url = new URL(
+      response.header.location,
+      'http://not-a-real-host.myshopify.io',
+    );
+
+    expect(url.host).toBe('not-a-real-host.myshopify.io');
+    expect(url.pathname).toBe('/exitiframe');
+    expect(url.searchParams.toString()).toEqual(expectedParams.toString());
+  });
+
+  it('fails with invalid shop', async () => {
+    const response = await request(app)
+      .get(`/redirect-to-auth?shop=invalid-shop`)
+      .expect(500);
+
+    expect(response.error).toBeDefined();
+  });
+
+  it('fails with invalid host', async () => {
+    const expectedParams = new URLSearchParams({
+      shop: TEST_SHOP,
+      embedded: '1',
+    });
+    const response = await request(app)
+      .get(`/redirect-to-auth?${expectedParams.toString()}`)
+      .expect(500);
+
+    expect(response.error).toBeDefined();
+  });
+});

package/packages/shopify-app-express/src/__tests__/setup-jest.ts

@@ -0,0 +1,8 @@
+import fetchMock from 'jest-fetch-mock';
+
+// Globally disable fetch requests so we don't risk making real ones
+fetchMock.enableMocks();
+
+beforeEach(() => {
+  fetchMock.mockReset();
+});

package/packages/shopify-app-express/src/__tests__/test-helper.ts

@@ -0,0 +1,204 @@
+import crypto from 'crypto';
+
+import semver from 'semver';
+import fetchMock, {MockParams} from 'jest-fetch-mock';
+import {LATEST_API_VERSION, ShopifyRestResources} from '@shopify/shopify-api';
+import {MemorySessionStorage} from '@shopify/shopify-app-session-storage-memory';
+
+import {shopifyApp, ShopifyApp} from '../index';
+import {AppConfigParams} from '../config-types';
+import {SHOPIFY_EXPRESS_LIBRARY_VERSION} from '../version';
+
+// eslint-disable-next-line import/no-mutable-exports
+export let testConfig: AppConfigParams<
+  ShopifyRestResources,
+  MemorySessionStorage
+> & {
+  api: {
+    apiKey: string;
+    apiSecretKey: string;
+    scopes: string[];
+    apiVersion: string;
+  };
+};
+// eslint-disable-next-line import/no-mutable-exports
+export let shopify: ShopifyApp;
+
+export const SHOPIFY_HOST = 'totally-real-host.myshopify.io';
+export const BASE64_HOST = Buffer.from(SHOPIFY_HOST).toString('base64');
+export const TEST_SHOP = 'test-shop.myshopify.io';
+export const TEST_WEBHOOK_ID = '1234567890';
+
+let currentCall: number;
+beforeEach(() => {
+  testConfig = {
+    auth: {
+      path: '/auth',
+      callbackPath: '/auth/callback',
+    },
+    webhooks: {
+      path: '/webhooks',
+    },
+    sessionStorage: new MemorySessionStorage(),
+    api: {
+      apiKey: 'testApiKey',
+      apiSecretKey: 'testApiSecretKey',
+      scopes: ['testScope'],
+      apiVersion: LATEST_API_VERSION,
+      hostName: 'my-test-app.myshopify.io',
+      logger: {
+        log: jest.fn(),
+      },
+    },
+  };
+
+  shopify = shopifyApp(testConfig);
+
+  currentCall = 0;
+});
+
+export type MockBody = string | Record<string, any>;
+
+interface AssertHttpRequestParams {
+  method: string;
+  url: string | URL;
+  body?: MockBody;
+  headers?: (string | [string, string])[];
+}
+
+export function mockShopifyResponse(body: MockBody, init?: MockParams) {
+  fetchMock.mockResponse(
+    typeof body === 'string' ? body : JSON.stringify(body),
+    mockResponseInit(init),
+  );
+}
+
+export function mockShopifyResponses(
+  ...responses: ([MockBody] | [MockBody, MockParams])[]
+) {
+  const parsedResponses: [string, MockParams][] = responses.map(
+    ([body, init]) => {
+      const bodyString = typeof body === 'string' ? body : JSON.stringify(body);
+
+      return [bodyString, mockResponseInit(init)];
+    },
+  );
+
+  fetchMock.mockResponses(...parsedResponses);
+}
+
+function mockResponseInit(init?: MockParams): MockParams {
+  const initObj = init ?? {};
+
+  return {
+    ...initObj,
+    headers: {'Content-Type': 'application/json', ...initObj.headers},
+  };
+}
+
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace jest {
+    interface Matchers<R> {
+      toMatchMadeHttpRequest(): R;
+      toBeWithinDeprecationSchedule(): R;
+    }
+  }
+}
+
+expect.extend({
+  toMatchMadeHttpRequest({
+    method,
+    url,
+    headers = expect.arrayContaining([]),
+    body = expect.objectContaining({}),
+  }: AssertHttpRequestParams) {
+    const index = currentCall++;
+
+    if (!fetchMock.mock.calls[index]) {
+      return {
+        pass: false,
+        message: () => `Expected a request to be made but none were`,
+      };
+    }
+
+    const expectedUrl = typeof url === 'string' ? new URL(url) : url;
+
+    const mockCall = fetchMock.mock.calls[index];
+    const requestUrl = new URL(mockCall[0] as string);
+
+    const mockBody = mockCall[1]!.body;
+
+    if (body) {
+      if (
+        typeof body === 'string' ||
+        body.constructor.name === 'StringContaining'
+      ) {
+        expect(mockBody).toEqual(body);
+      } else {
+        let requestBody = mockBody;
+        if (typeof mockBody === 'string') {
+          try {
+            requestBody = JSON.parse(mockBody);
+          } catch (error) {
+            // Not JSON, that's fine
+          }
+        }
+
+        if (typeof requestBody === 'string') {
+          expect(requestBody).toEqual(body);
+        } else {
+          expect(requestBody).toMatchObject(body);
+        }
+      }
+    } else {
+      expect(mockBody).toBeFalsy();
+    }
+
+    expect(requestUrl).toEqual(expectedUrl);
+    expect(mockCall[1]).toMatchObject({method, headers});
+
+    return {
+      message: () => `The expected HTTP requests have been seen`,
+      pass: true,
+    };
+  },
+  toBeWithinDeprecationSchedule(version: string) {
+    return {
+      message: () =>
+        `Found deprecation limited to version ${version}, please update or remove it.`,
+      pass: semver.lt(SHOPIFY_EXPRESS_LIBRARY_VERSION, version),
+    };
+  },
+});
+
+export function validWebhookHeaders(
+  topic: string,
+  body: string,
+  secretKey: string,
+): Record<string, string> {
+  const hmac = createTestHmac(secretKey, body);
+
+  return {
+    'X-Shopify-Topic': topic,
+    'X-Shopify-Shop-Domain': TEST_SHOP,
+    'X-Shopify-Hmac-Sha256': hmac,
+    'X-Shopify-Webhook-Id': TEST_WEBHOOK_ID,
+    'X-Shopify-Api-Version': LATEST_API_VERSION,
+  };
+}
+
+export function createTestHmac(secretKey: string, body: string): string {
+  return crypto
+    .createHmac('sha256', secretKey)
+    .update(body, 'utf8')
+    .digest('base64');
+}
+
+test('passes test deprecation checks', () => {
+  expect('9999.0.0').toBeWithinDeprecationSchedule();
+  expect(() => expect('0.0.0').toBeWithinDeprecationSchedule()).toThrow();
+  expect(() =>
+    expect(SHOPIFY_EXPRESS_LIBRARY_VERSION).toBeWithinDeprecationSchedule(),
+  ).toThrow();
+});

package/packages/shopify-app-express/src/app-installations.ts

@@ -0,0 +1,42 @@
+import {Session} from '@shopify/shopify-api';
+
+import {AppConfigInterface} from './config-types';
+
+export class AppInstallations {
+  private sessionStorage;
+
+  constructor(config: AppConfigInterface) {
+    if (!config.sessionStorage.findSessionsByShop) {
+      throw new Error(
+        'To use this Express package, you must provide a session storage manager that implements findSessionsByShop',
+      );
+    }
+    if (!config.sessionStorage.deleteSessions) {
+      throw new Error(
+        'To use this Express package, you must provide a session storage manager that implements deleteSessions',
+      );
+    }
+    this.sessionStorage = config.sessionStorage;
+  }
+
+  async includes(shopDomain: string): Promise<boolean> {
+    const shopSessions =
+      await this.sessionStorage.findSessionsByShop!(shopDomain);
+    if (shopSessions.length > 0) {
+      for (const session of shopSessions) {
+        if (session.accessToken) return true;
+      }
+    }
+    return false;
+  }
+
+  async delete(shopDomain: string): Promise<void> {
+    const shopSessions =
+      await this.sessionStorage.findSessionsByShop!(shopDomain);
+    if (shopSessions.length > 0) {
+      await this.sessionStorage.deleteSessions!(
+        shopSessions.map((session: Session) => session.id),
+      );
+    }
+  }
+}