shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-express/src/auth/__tests__/auth.test.ts

@@ -0,0 +1,303 @@
+import request from 'supertest';
+import express from 'express';
+import {
+  BotActivityDetected,
+  CookieNotFound,
+  DeliveryMethod,
+  InvalidOAuthError,
+  LogSeverity,
+  Session,
+} from '@shopify/shopify-api';
+
+import {BASE64_HOST, shopify, SHOPIFY_HOST} from '../../__tests__/test-helper';
+
+const TEST_SHOP = 'my-shop.myshopify.io';
+
+describe('auth', () => {
+  let app: express.Express;
+  beforeEach(async () => {
+    app = express();
+    app.get('/auth', shopify.auth.begin());
+    app.get(
+      '/auth/callback',
+      shopify.auth.callback(),
+      shopify.redirectToShopifyOrAppRoot(),
+    );
+  });
+
+  describe('begin', () => {
+    it('triggers library auth start', async () => {
+      const beginMock = jest.spyOn(shopify.api.auth, 'begin');
+      beginMock.mockImplementationOnce(async ({rawResponse}) => {
+        rawResponse.redirect('https://oauth-url');
+      });
+
+      const response = await request(app)
+        .get(`/auth?shop=${TEST_SHOP}`)
+        .expect(302);
+
+      expect(beginMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          callbackPath: '/auth/callback',
+          isOnline: shopify.config.useOnlineTokens,
+          shop: TEST_SHOP,
+        }),
+      );
+      expect(response.header.location).toBe('https://oauth-url');
+    });
+  });
+
+  describe('callback', () => {
+    let callbackMock: jest.SpyInstance;
+    let session: Session;
+    beforeEach(async () => {
+      session = new Session({
+        id: 'test-session',
+        isOnline: shopify.config.useOnlineTokens,
+        shop: TEST_SHOP,
+        state: '1234',
+        accessToken: 'test-access-token',
+      });
+
+      callbackMock = jest.spyOn(shopify.api.auth, 'callback');
+    });
+
+    describe('when successful', () => {
+      beforeEach(() => {
+        callbackMock.mockResolvedValueOnce({session, headers: undefined});
+      });
+
+      it('redirects to app', async () => {
+        jest.spyOn(shopify.api.webhooks, 'register').mockResolvedValueOnce({});
+
+        const response = await request(app)
+          .get(`/auth/callback?host=${BASE64_HOST}`)
+          .expect(302);
+
+        const url = new URL(response.header.location);
+        expect(url.host).toBe(SHOPIFY_HOST);
+        expect(url.pathname).toBe(`/apps/${shopify.api.config.apiKey}`);
+      });
+
+      describe('with webhooks', () => {
+        let registerMock: jest.SpyInstance;
+        beforeEach(() => {
+          shopify.api.webhooks.addHandlers({
+            TEST_TOPIC: {
+              deliveryMethod: DeliveryMethod.Http,
+              callbackUrl: '/webhooks',
+              callback: async () => {},
+            },
+          });
+
+          registerMock = jest.spyOn(shopify.api.webhooks, 'register');
+        });
+
+        it('registers webhooks', async () => {
+          registerMock.mockResolvedValueOnce({
+            TEST_TOPIC: [
+              {
+                success: true,
+                result: {},
+              },
+            ],
+          });
+
+          await request(app)
+            .get(`/auth/callback?host=${BASE64_HOST}`)
+            .expect(302);
+
+          expect(registerMock).toHaveBeenCalledWith({
+            session: expect.objectContaining({
+              shop: TEST_SHOP,
+              accessToken: 'test-access-token',
+            }),
+          });
+        });
+
+        it('logs when registration fails', async () => {
+          const errorMessage = 'Test result errors';
+          registerMock.mockResolvedValueOnce({
+            TEST_TOPIC: [
+              {
+                success: false,
+                result: {errors: [{message: errorMessage}]},
+              },
+            ],
+          });
+
+          await request(app)
+            .get(`/auth/callback?host=${BASE64_HOST}`)
+            .expect(302);
+
+          expect(
+            shopify.api.config.logger.log as jest.Mock,
+          ).toHaveBeenCalledWith(
+            LogSeverity.Error,
+            expect.stringContaining(errorMessage),
+          );
+
+          // Reset the callback mock
+          callbackMock.mockResolvedValueOnce({session, headers: undefined});
+          registerMock.mockResolvedValueOnce({
+            TEST_TOPIC: [
+              {
+                success: false,
+                result: {data: {message: errorMessage}},
+              },
+            ],
+          });
+
+          await request(app)
+            .get(`/auth/callback?host=${BASE64_HOST}`)
+            .expect(302);
+
+          expect(
+            shopify.api.config.logger.log as jest.Mock,
+          ).toHaveBeenCalledWith(
+            LogSeverity.Error,
+            expect.stringContaining(errorMessage),
+          );
+        });
+      });
+    });
+
+    describe('fails', () => {
+      it('restarts OAuth if CookieNotFound', async () => {
+        const errorMessage = 'Test no cookie found';
+        callbackMock.mockRejectedValueOnce(new CookieNotFound(errorMessage));
+
+        const beginMock = jest.spyOn(shopify.api.auth, 'begin');
+        beginMock.mockImplementationOnce(async ({rawResponse}) => {
+          rawResponse.redirect('https://oauth-url');
+        });
+
+        const response = await request(app)
+          .get(`/auth/callback?shop=${TEST_SHOP}&host=${BASE64_HOST}`)
+          .expect(302);
+
+        // We begin a new OAuth flow, so the outcome is a successful OAuth begin flow...
+        expect(beginMock).toHaveBeenCalledWith(
+          expect.objectContaining({
+            callbackPath: '/auth/callback',
+            isOnline: shopify.config.useOnlineTokens,
+            shop: TEST_SHOP,
+          }),
+        );
+        expect(response.header.location).toBe('https://oauth-url');
+
+        expect(shopify.api.config.logger.log as jest.Mock).toHaveBeenCalledWith(
+          LogSeverity.Error,
+          expect.stringContaining(errorMessage),
+        );
+      });
+
+      it('fails if the request is invalid', async () => {
+        const errorMessage = 'Test invalid auth';
+        callbackMock.mockRejectedValueOnce(new InvalidOAuthError(errorMessage));
+
+        await request(app)
+          .get(`/auth/callback?shop=${TEST_SHOP}&host=${BASE64_HOST}`)
+          .expect(400)
+          .expect(errorMessage);
+
+        expect(shopify.api.config.logger.log as jest.Mock).toHaveBeenCalledWith(
+          LogSeverity.Error,
+          expect.stringContaining(errorMessage),
+        );
+      });
+
+      it('fails if the request is detected as a bot', async () => {
+        const errorMessage = 'Test bot detected';
+        callbackMock.mockRejectedValueOnce(
+          new BotActivityDetected(errorMessage),
+        );
+
+        await request(app)
+          .get(`/auth/callback?shop=${TEST_SHOP}&host=${BASE64_HOST}`)
+          .expect(410)
+          .expect(errorMessage);
+
+        expect(shopify.api.config.logger.log as jest.Mock).toHaveBeenCalledWith(
+          LogSeverity.Error,
+          expect.stringContaining(errorMessage),
+        );
+      });
+
+      it('borks on unknown errors', async () => {
+        const errorMessage = 'Unknown error';
+        callbackMock.mockRejectedValueOnce(new Error(errorMessage));
+
+        await request(app)
+          .get(`/auth/callback?shop=${TEST_SHOP}&host=${BASE64_HOST}`)
+          .expect(500)
+          .expect(errorMessage);
+
+        expect(shopify.api.config.logger.log as jest.Mock).toHaveBeenCalledWith(
+          LogSeverity.Error,
+          expect.stringContaining(errorMessage),
+        );
+      });
+    });
+  });
+});
+
+describe('auth with action after callback', () => {
+  const afterAuth = jest.fn();
+
+  let app: express.Express;
+  beforeEach(async () => {
+    app = express();
+    app.get('/auth', shopify.auth.begin());
+    app.get('/auth/callback', shopify.auth.callback(), afterAuth);
+  });
+
+  let session: Session;
+  beforeEach(async () => {
+    session = new Session({
+      id: 'test-session',
+      isOnline: shopify.config.useOnlineTokens,
+      shop: TEST_SHOP,
+      state: '1234',
+      accessToken: 'test-access-token',
+    });
+
+    jest
+      .spyOn(shopify.api.auth, 'callback')
+      .mockResolvedValueOnce({session, headers: undefined});
+    jest.spyOn(shopify.api.webhooks, 'register').mockResolvedValueOnce({});
+  });
+
+  afterEach(() => {
+    afterAuth.mockReset();
+  });
+
+  it('triggers callback', async () => {
+    afterAuth.mockImplementation(async (req, res) => {
+      expect(res.locals.shopify.session).toEqual(session);
+      await shopify.redirectToShopifyOrAppRoot()(req, res);
+    });
+
+    const response = await request(app)
+      .get(`/auth/callback?shop=${TEST_SHOP}&host=${BASE64_HOST}`)
+      .expect(302);
+
+    const url = new URL(response.header.location);
+    expect(url.host).toBe(SHOPIFY_HOST);
+    expect(url.pathname).toBe(`/apps/${shopify.api.config.apiKey}`);
+    expect(afterAuth).toHaveBeenCalled();
+  });
+
+  it('allows redirecting to arbitrary addresses', async () => {
+    afterAuth.mockImplementation(({res}: {res: express.Response}) => {
+      res.redirect('https://example.com');
+    });
+
+    const response = await request(app)
+      .get(`/auth/callback?shop=${TEST_SHOP}&host=${BASE64_HOST}`)
+      .expect(302);
+
+    expect(response.header.location).toEqual('https://example.com');
+    expect(afterAuth).toHaveBeenCalled();
+  });
+});

package/packages/shopify-app-express/src/auth/auth-callback.ts

@@ -0,0 +1,131 @@
+import {Request, Response} from 'express';
+import {
+  BotActivityDetected,
+  CookieNotFound,
+  privacyTopics,
+  InvalidOAuthError,
+  Session,
+  Shopify,
+} from '@shopify/shopify-api';
+
+import {AppConfigInterface} from '../config-types';
+import {redirectToAuth} from '../redirect-to-auth';
+
+import {AuthCallbackParams} from './types';
+
+export async function authCallback({
+  req,
+  res,
+  api,
+  config,
+}: AuthCallbackParams): Promise<boolean> {
+  try {
+    const callbackResponse = await api.auth.callback({
+      rawRequest: req,
+      rawResponse: res,
+    });
+
+    config.logger.debug('Callback is valid, storing session', {
+      shop: callbackResponse.session.shop,
+      isOnline: callbackResponse.session.isOnline,
+    });
+
+    await config.sessionStorage.storeSession(callbackResponse.session);
+
+    // If this is an offline OAuth process, register webhooks
+    if (!callbackResponse.session.isOnline) {
+      await registerWebhooks(config, api, callbackResponse.session);
+    }
+
+    // If we're completing an offline OAuth process, immediately kick off the online one
+    if (config.useOnlineTokens && !callbackResponse.session.isOnline) {
+      config.logger.debug(
+        'Completing offline token OAuth, redirecting to online token OAuth',
+        {shop: callbackResponse.session.shop},
+      );
+
+      await redirectToAuth({req, res, api, config, isOnline: true});
+      return false;
+    }
+
+    res.locals.shopify = {
+      ...res.locals.shopify,
+      session: callbackResponse.session,
+    };
+
+    config.logger.debug('Completed OAuth callback', {
+      shop: callbackResponse.session.shop,
+      isOnline: callbackResponse.session.isOnline,
+    });
+
+    return true;
+  } catch (error) {
+    config.logger.error(`Failed to complete OAuth with error: ${error}`);
+
+    await handleCallbackError(req, res, api, config, error);
+  }
+
+  return false;
+}
+
+async function registerWebhooks(
+  config: AppConfigInterface,
+  api: Shopify,
+  session: Session,
+) {
+  config.logger.debug('Registering webhooks', {shop: session.shop});
+
+  const responsesByTopic = await api.webhooks.register({session});
+
+  for (const topic in responsesByTopic) {
+    if (!Object.prototype.hasOwnProperty.call(responsesByTopic, topic)) {
+      continue;
+    }
+
+    for (const response of responsesByTopic[topic]) {
+      if (!response.success && !privacyTopics.includes(topic)) {
+        const result: any = response.result;
+
+        if (result.errors) {
+          config.logger.error(
+            `Failed to register ${topic} webhook: ${result.errors[0].message}`,
+            {shop: session.shop},
+          );
+        } else {
+          config.logger.error(
+            `Failed to register ${topic} webhook: ${JSON.stringify(
+              result.data,
+            )}`,
+            {shop: session.shop},
+          );
+        }
+      }
+    }
+  }
+}
+
+async function handleCallbackError(
+  req: Request,
+  res: Response,
+  api: Shopify,
+  config: AppConfigInterface,
+  error: Error,
+) {
+  switch (true) {
+    case error instanceof InvalidOAuthError:
+      res.status(400);
+      res.send(error.message);
+      break;
+    case error instanceof CookieNotFound:
+      await redirectToAuth({req, res, api, config});
+      break;
+    case error instanceof BotActivityDetected:
+      res.status(410);
+      res.send(error.message);
+      break;
+    default:
+      res.status(500);
+      res.send(error.message);
+      break;
+  }
+}

package/packages/shopify-app-express/src/auth/index.ts

@@ -0,0 +1,32 @@
+import {NextFunction, Request, RequestHandler, Response} from 'express';
+
+import {ApiAndConfigParams} from '../types';
+import {redirectToAuth} from '../redirect-to-auth';
+
+import {authCallback} from './auth-callback';
+import {AuthMiddleware} from './types';
+
+export function auth({api, config}: ApiAndConfigParams): AuthMiddleware {
+  return {
+    begin(): RequestHandler {
+      return async (req: Request, res: Response) =>
+        redirectToAuth({req, res, api, config});
+    },
+    callback(): RequestHandler {
+      return async (req: Request, res: Response, next: NextFunction) => {
+        config.logger.info('Handling request to complete OAuth process');
+
+        const oauthCompleted = await authCallback({
+          req,
+          res,
+          api,
+          config,
+        });
+
+        if (oauthCompleted) {
+          next();
+        }
+      };
+    },
+  };
+}

package/packages/shopify-app-express/src/auth/types.ts

@@ -0,0 +1,13 @@
+import {Request, RequestHandler, Response} from 'express';
+
+import {ApiAndConfigParams} from '../types';
+
+export interface AuthMiddleware {
+  begin: () => RequestHandler;
+  callback: () => RequestHandler;
+}
+
+export interface AuthCallbackParams extends ApiAndConfigParams {
+  req: Request;
+  res: Response;
+}

package/packages/shopify-app-express/src/config-types.ts

@@ -0,0 +1,38 @@
+import {
+  ConfigParams as ApiConfigParams,
+  Shopify,
+  ShopifyRestResources,
+} from '@shopify/shopify-api';
+import {SessionStorage} from '@shopify/shopify-app-session-storage';
+
+export interface AppConfigParams<
+  Resources extends ShopifyRestResources = ShopifyRestResources,
+  Storage extends SessionStorage = SessionStorage,
+> {
+  auth: AuthConfigInterface;
+  webhooks: WebhooksConfigInterface;
+  api?: Partial<ApiConfigParams<Resources>>;
+  useOnlineTokens?: boolean;
+  exitIframePath?: string;
+  sessionStorage?: Storage;
+}
+
+export interface AppConfigInterface<
+  Resources extends ShopifyRestResources = ShopifyRestResources,
+  Storage extends SessionStorage = SessionStorage,
+> extends Omit<AppConfigParams<Resources, Storage>, 'api'> {
+  logger: Shopify['logger'];
+  useOnlineTokens: boolean;
+  exitIframePath: string;
+  sessionStorage: Storage;
+}
+
+export interface AuthConfigInterface {
+  path: string;
+  callbackPath: string;
+  checkBillingPlans?: string[];
+}
+
+export interface WebhooksConfigInterface {
+  path: string;
+}

package/packages/shopify-app-express/src/error.ts

@@ -0,0 +1,8 @@
+export class ShopifyAppError extends Error {
+  constructor(...args: any) {
+    super(...args);
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
+
+export class SessionStorageError extends ShopifyAppError {}

package/packages/shopify-app-express/src/index.ts

@@ -0,0 +1,171 @@
+import semver from 'semver';
+import '@shopify/shopify-api/adapters/node';
+import {
+  shopifyApi,
+  ConfigParams as ApiConfigParams,
+  LATEST_API_VERSION,
+  Shopify,
+  FeatureDeprecatedError,
+} from '@shopify/shopify-api';
+import {MemorySessionStorage} from '@shopify/shopify-app-session-storage-memory';
+
+import {SHOPIFY_EXPRESS_LIBRARY_VERSION} from './version';
+import {AppConfigInterface, AppConfigParams} from './config-types';
+import {
+  validateAuthenticatedSession,
+  cspHeaders,
+  ensureInstalled,
+  redirectToShopifyOrAppRoot,
+} from './middlewares/index';
+import {AuthMiddleware} from './auth/types';
+import {auth} from './auth/index';
+import {ProcessWebhooksMiddleware} from './webhooks/types';
+import {processWebhooks} from './webhooks/index';
+import {
+  ValidateAuthenticatedSessionMiddleware,
+  CspHeadersMiddleware,
+  EnsureInstalledMiddleware,
+  RedirectToShopifyOrAppRootMiddleware,
+} from './middlewares/types';
+import {redirectOutOfApp} from './redirect-out-of-app';
+import {RedirectOutOfAppFunction} from './types';
+
+export * from './types';
+export * from './auth/types';
+export * from './middlewares/types';
+export * from './webhooks/types';
+export type {AppConfigParams} from './config-types';
+
+type DefaultedConfigs<Params extends Partial<ApiConfigParams> | undefined> =
+  ApiConfigParams & Params;
+
+type ConfigInterfaceFromParams<Params extends AppConfigParams> =
+  AppConfigInterface<
+    NonNullable<DefaultedConfigs<Params['api']>['restResources']>,
+    Params['sessionStorage'] extends undefined
+      ? MemorySessionStorage
+      : NonNullable<Params['sessionStorage']>
+  >;
+
+export interface ShopifyApp<Params extends AppConfigParams = AppConfigParams> {
+  config: ConfigInterfaceFromParams<Params>;
+  api: Shopify<DefaultedConfigs<Params['api']>>;
+  auth: AuthMiddleware;
+  processWebhooks: ProcessWebhooksMiddleware;
+  validateAuthenticatedSession: ValidateAuthenticatedSessionMiddleware;
+  cspHeaders: CspHeadersMiddleware;
+  ensureInstalledOnShop: EnsureInstalledMiddleware;
+  redirectToShopifyOrAppRoot: RedirectToShopifyOrAppRootMiddleware;
+  redirectOutOfApp: RedirectOutOfAppFunction;
+}
+
+export function shopifyApp<Params extends AppConfigParams>(
+  config: Params,
+): ShopifyApp<Params> {
+  const {api: apiConfig, ...appConfig} = config;
+
+  const api = shopifyApi(apiConfigWithDefaults(apiConfig ?? {}));
+  const validatedConfig = validateAppConfig(appConfig, api);
+
+  return {
+    config: validatedConfig,
+    api: api as Shopify<DefaultedConfigs<Params['api']>>,
+    auth: auth({api, config: validatedConfig}),
+    processWebhooks: processWebhooks({api, config: validatedConfig}),
+    validateAuthenticatedSession: validateAuthenticatedSession({
+      api,
+      config: validatedConfig,
+    }),
+    cspHeaders: cspHeaders({api}),
+    ensureInstalledOnShop: ensureInstalled({
+      api,
+      config: validatedConfig,
+    }),
+    redirectToShopifyOrAppRoot: redirectToShopifyOrAppRoot({
+      api,
+      config: validatedConfig,
+    }),
+    redirectOutOfApp: redirectOutOfApp({api, config: validatedConfig}),
+  };
+}
+
+function apiConfigWithDefaults<Params extends Partial<ApiConfigParams>>(
+  apiConfig: Params,
+): DefaultedConfigs<Params> {
+  let userAgent = `Shopify Express Library v${SHOPIFY_EXPRESS_LIBRARY_VERSION}`;
+
+  if (apiConfig.userAgentPrefix) {
+    userAgent = `${apiConfig.userAgentPrefix} | ${userAgent}`;
+  }
+
+  /* eslint-disable no-process-env */
+  return {
+    apiKey: process.env.SHOPIFY_API_KEY!,
+    apiSecretKey: process.env.SHOPIFY_API_SECRET!,
+    scopes: process.env.SCOPES?.split(',')!,
+    hostScheme: (process.env.HOST?.split('://')[0] as 'http' | 'https')!,
+    hostName: process.env.HOST?.replace(/https?:\/\//, '')!,
+    isEmbeddedApp: true,
+    apiVersion: LATEST_API_VERSION,
+    ...(process.env.SHOP_CUSTOM_DOMAIN && {
+      customShopDomains: [process.env.SHOP_CUSTOM_DOMAIN],
+    }),
+    ...apiConfig,
+    userAgentPrefix: userAgent,
+  };
+  /* eslint-enable no-process-env */
+}
+
+function validateAppConfig<Params extends Omit<AppConfigParams, 'api'>>(
+  config: Params,
+  api: Shopify,
+): ConfigInterfaceFromParams<Params> {
+  const {sessionStorage, ...configWithoutSessionStorage} = config;
+
+  return {
+    // We override the API package's logger to add the right package context by default (and make the call simpler)
+    logger: overrideLoggerPackage(api.logger),
+    useOnlineTokens: false,
+    exitIframePath: '/exitiframe',
+    sessionStorage: (sessionStorage ??
+      new MemorySessionStorage()) as ConfigInterfaceFromParams<Params>['sessionStorage'],
+    ...configWithoutSessionStorage,
+    auth: config.auth,
+    webhooks: config.webhooks,
+  };
+}
+
+function overrideLoggerPackage(logger: Shopify['logger']): Shopify['logger'] {
+  const baseContext = {package: 'shopify-app'};
+
+  const warningFunction: Shopify['logger']['warning'] = (
+    message,
+    context = {},
+  ) => logger.warning(message, {...baseContext, ...context});
+
+  return {
+    ...logger,
+    log: (severity, message, context = {}) =>
+      logger.log(severity, message, {...baseContext, ...context}),
+    debug: (message, context = {}) =>
+      logger.debug(message, {...baseContext, ...context}),
+    info: (message, context = {}) =>
+      logger.info(message, {...baseContext, ...context}),
+    warning: warningFunction,
+    error: (message, context = {}) =>
+      logger.error(message, {...baseContext, ...context}),
+    deprecated: deprecated(warningFunction),
+  };
+}
+
+function deprecated(warningFunction: Shopify['logger']['warning']) {
+  return function (version: string, message: string): Promise<void> {
+    if (semver.gte(SHOPIFY_EXPRESS_LIBRARY_VERSION, version)) {
+      throw new FeatureDeprecatedError(
+        `Feature was deprecated in version ${version}`,
+      );
+    }
+
+    return warningFunction(`[Deprecated | ${version}] ${message}`);
+  };
+}