shopify-app-js 0.0.1-security → 1.0.1

package/packages/shopify-app-express/src/middlewares/ensure-installed-on-shop.ts

@@ -0,0 +1,176 @@
+import {Request, Response, NextFunction} from 'express';
+import {Session, Shopify} from '@shopify/shopify-api';
+
+import {redirectToAuth} from '../redirect-to-auth';
+import {AppConfigInterface} from '../config-types';
+import {ApiAndConfigParams} from '../types';
+import {AppInstallations} from '../app-installations';
+
+import {EnsureInstalledMiddleware} from './types';
+import {addCSPHeader} from './csp-headers';
+import {validateAuthenticatedSession} from './validate-authenticated-session';
+import {hasValidAccessToken} from './has-valid-access-token';
+
+interface EnsureInstalledParams extends ApiAndConfigParams {}
+
+export function ensureInstalled({
+  api,
+  config,
+}: EnsureInstalledParams): EnsureInstalledMiddleware {
+  return function ensureInstalledOnShop() {
+    return async (req: Request, res: Response, next: NextFunction) => {
+      config.logger.info('Running ensureInstalledOnShop');
+
+      if (!api.config.isEmbeddedApp) {
+        config.logger.warning(
+          'ensureInstalledOnShop() should only be used in embedded apps; calling validateAuthenticatedSession() instead',
+        );
+
+        return validateAuthenticatedSession({api, config})()(req, res, next);
+      }
+
+      const shop = getRequestShop(api, config, req, res);
+      if (!shop) {
+        return undefined;
+      }
+
+      config.logger.debug('Checking if shop has installed the app', {shop});
+
+      const sessionId = api.session.getOfflineId(shop);
+      const session = await config.sessionStorage.loadSession(sessionId);
+
+      const exitIframeRE = new RegExp(`^${config.exitIframePath}`, 'i');
+      if (!session && !req.originalUrl.match(exitIframeRE)) {
+        config.logger.debug(
+          'App installation was not found for shop, redirecting to auth',
+          {shop},
+        );
+
+        return redirectToAuth({req, res, api, config});
+      }
+
+      if (api.config.isEmbeddedApp && req.query.embedded !== '1') {
+        if (await sessionHasValidAccessToken(api, config, session)) {
+          await embedAppIntoShopify(api, config, req, res, shop);
+          return undefined;
+        } else {
+          config.logger.info(
+            'Found a session, but it is not valid. Redirecting to auth',
+            {shop},
+          );
+
+          return redirectToAuth({req, res, api, config});
+        }
+      }
+
+      addCSPHeader(api, req, res);
+
+      config.logger.info('App is installed and ready to load', {shop});
+
+      return next();
+    };
+  };
+}
+
+export function deleteAppInstallationHandler(
+  appInstallations: AppInstallations,
+  config: AppConfigInterface,
+) {
+  return async function (
+    _topic: string,
+    shop: string,
+    _body: any,
+    _webhookId: string,
+  ) {
+    config.logger.debug('Deleting shop sessions', {shop});
+
+    await appInstallations.delete(shop);
+  };
+}
+
+function getRequestShop(
+  api: Shopify,
+  config: AppConfigInterface,
+  req: Request,
+  res: Response,
+): string | undefined {
+  if (typeof req.query.shop !== 'string') {
+    config.logger.error(
+      'ensureInstalledOnShop did not receive a shop query argument',
+      {shop: req.query.shop},
+    );
+
+    res.status(400);
+    res.send('No shop provided');
+    return undefined;
+  }
+
+  const shop = api.utils.sanitizeShop(req.query.shop);
+
+  if (!shop) {
+    config.logger.error(
+      'ensureInstalledOnShop did not receive a valid shop query argument',
+      {shop: req.query.shop},
+    );
+
+    res.status(422);
+    res.send('Invalid shop provided');
+    return undefined;
+  }
+
+  return shop;
+}
+
+async function sessionHasValidAccessToken(
+  api: Shopify,
+  config: AppConfigInterface,
+  session: Session | undefined,
+): Promise<boolean> {
+  if (!session) {
+    return false;
+  }
+
+  try {
+    return (
+      session.isActive(api.config.scopes) &&
+      (await hasValidAccessToken(api, session))
+    );
+  } catch (error) {
+    config.logger.error(`Could not check if session was valid: ${error}`, {
+      shop: session.shop,
+    });
+    return false;
+  }
+}
+
+async function embedAppIntoShopify(
+  api: Shopify,
+  config: AppConfigInterface,
+  req: Request,
+  res: Response,
+  shop: string,
+): Promise<void> {
+  let embeddedUrl: string;
+  try {
+    embeddedUrl = await api.auth.getEmbeddedAppUrl({
+      rawRequest: req,
+      rawResponse: res,
+    });
+  } catch (error) {
+    config.logger.error(
+      `ensureInstalledOnShop did not receive a host query argument`,
+      {shop},
+    );
+
+    res.status(400);
+    res.send('No host provided');
+    return;
+  }
+
+  config.logger.debug(
+    `Request is not embedded but app is. Redirecting to ${embeddedUrl} to embed the app`,
+    {shop},
+  );
+
+  res.redirect(embeddedUrl + req.path);
+}

package/packages/shopify-app-express/src/middlewares/has-valid-access-token.ts

@@ -0,0 +1,25 @@
+import {HttpResponseError, Session, Shopify} from '@shopify/shopify-api';
+
+const TEST_GRAPHQL_QUERY = `query shopifyAppShopName {
+  shop {
+    name
+  }
+}`;
+
+export async function hasValidAccessToken(
+  api: Shopify,
+  session: Session,
+): Promise<boolean> {
+  try {
+    const client = new api.clients.Graphql({session});
+    await client.request(TEST_GRAPHQL_QUERY);
+    return true;
+  } catch (error) {
+    if (error instanceof HttpResponseError && error.response.code === 401) {
+      // Re-authenticate if we get a 401 response
+      return false;
+    } else {
+      throw error;
+    }
+  }
+}

package/packages/shopify-app-express/src/middlewares/index.ts

@@ -0,0 +1,15 @@
+import {validateAuthenticatedSession} from './validate-authenticated-session';
+import {
+  deleteAppInstallationHandler,
+  ensureInstalled,
+} from './ensure-installed-on-shop';
+import {cspHeaders} from './csp-headers';
+import {redirectToShopifyOrAppRoot} from './redirect-to-shopify-or-app-root';
+
+export {
+  validateAuthenticatedSession,
+  deleteAppInstallationHandler,
+  cspHeaders,
+  ensureInstalled,
+  redirectToShopifyOrAppRoot,
+};

package/packages/shopify-app-express/src/middlewares/redirect-to-shopify-or-app-root.ts

@@ -0,0 +1,39 @@
+import {Request, Response} from 'express';
+
+import {ApiAndConfigParams} from '../types';
+
+import {RedirectToShopifyOrAppRootMiddleware} from './types';
+
+export function redirectToShopifyOrAppRoot({
+  api,
+  config,
+}: ApiAndConfigParams): RedirectToShopifyOrAppRootMiddleware {
+  return function () {
+    return async function (req: Request, res: Response) {
+      if (res.headersSent) {
+        config.logger.info(
+          'Response headers have already been sent, skipping redirection to host',
+          {shop: res.locals.shopify?.session?.shop},
+        );
+
+        return;
+      }
+
+      const host = api.utils.sanitizeHost(req.query.host as string)!;
+      const redirectUrl = api.config.isEmbeddedApp
+        ? await api.auth.getEmbeddedAppUrl({
+            rawRequest: req,
+            rawResponse: res,
+          })
+        : `/?shop=${res.locals.shopify.session.shop}&host=${encodeURIComponent(
+            host,
+          )}`;
+
+      config.logger.debug(`Redirecting to host at ${redirectUrl}`, {
+        shop: res.locals.shopify.session.shop,
+      });
+
+      res.redirect(redirectUrl);
+    };
+  };
+}

package/packages/shopify-app-express/src/middlewares/types.ts

@@ -0,0 +1,6 @@
+import {RequestHandler} from 'express';
+
+export type ValidateAuthenticatedSessionMiddleware = () => RequestHandler;
+export type EnsureInstalledMiddleware = () => RequestHandler;
+export type CspHeadersMiddleware = () => RequestHandler;
+export type RedirectToShopifyOrAppRootMiddleware = () => RequestHandler;

package/packages/shopify-app-express/src/middlewares/validate-authenticated-session.ts

@@ -0,0 +1,142 @@
+import {Session, Shopify, InvalidJwtError} from '@shopify/shopify-api';
+import {Request, Response, NextFunction} from 'express';
+
+import {redirectToAuth} from '../redirect-to-auth';
+import {ApiAndConfigParams} from '../types';
+import {redirectOutOfApp} from '../redirect-out-of-app';
+
+import {ValidateAuthenticatedSessionMiddleware} from './types';
+import {hasValidAccessToken} from './has-valid-access-token';
+
+interface validateAuthenticatedSessionParams extends ApiAndConfigParams {}
+
+export function validateAuthenticatedSession({
+  api,
+  config,
+}: validateAuthenticatedSessionParams): ValidateAuthenticatedSessionMiddleware {
+  return function validateAuthenticatedSession() {
+    return async (req: Request, res: Response, next: NextFunction) => {
+      config.logger.info('Running validateAuthenticatedSession');
+
+      let sessionId: string | undefined;
+      try {
+        sessionId = await api.session.getCurrentId({
+          isOnline: config.useOnlineTokens,
+          rawRequest: req,
+          rawResponse: res,
+        });
+      } catch (error) {
+        config.logger.error(
+          `Error when loading session from storage: ${error}`,
+        );
+
+        handleSessionError(req, res, error);
+        return undefined;
+      }
+
+      let session: Session | undefined;
+      if (sessionId) {
+        try {
+          session = await config.sessionStorage.loadSession(sessionId);
+        } catch (error) {
+          config.logger.error(
+            `Error when loading session from storage: ${error}`,
+          );
+
+          res.status(500);
+          res.send(error.message);
+          return undefined;
+        }
+      }
+
+      let shop =
+        api.utils.sanitizeShop(req.query.shop as string) || session?.shop;
+
+      if (session && shop && session.shop !== shop) {
+        config.logger.debug(
+          'Found a session for a different shop in the request',
+          {currentShop: session.shop, requestShop: shop},
+        );
+
+        return redirectToAuth({req, res, api, config});
+      }
+
+      if (session) {
+        config.logger.debug('Request session found and loaded', {
+          shop: session.shop,
+        });
+
+        if (session.isActive(api.config.scopes)) {
+          config.logger.debug('Request session exists and is active', {
+            shop: session.shop,
+          });
+
+          if (await hasValidAccessToken(api, session)) {
+            config.logger.info('Request session has a valid access token', {
+              shop: session.shop,
+            });
+
+            res.locals.shopify = {
+              ...res.locals.shopify,
+              session,
+            };
+            return next();
+          }
+        }
+      }
+
+      const bearerPresent = req.headers.authorization?.match(/Bearer (.*)/);
+      if (bearerPresent) {
+        if (!shop) {
+          shop = await setShopFromSessionOrToken(
+            api,
+            session,
+            bearerPresent[1],
+          );
+        }
+      }
+
+      const redirectUri = `${config.auth.path}?shop=${shop}`;
+      config.logger.info(
+        `Session was not valid. Redirecting to ${redirectUri}`,
+        {shop},
+      );
+
+      return redirectOutOfApp({api, config})({
+        req,
+        res,
+        redirectUri,
+        shop: shop!,
+      });
+    };
+  };
+}
+
+function handleSessionError(_req: Request, res: Response, error: Error) {
+  switch (true) {
+    case error instanceof InvalidJwtError:
+      res.status(401);
+      res.send(error.message);
+      break;
+    default:
+      res.status(500);
+      res.send(error.message);
+      break;
+  }
+}
+
+async function setShopFromSessionOrToken(
+  api: Shopify,
+  session: Session | undefined,
+  token: string,
+): Promise<string | undefined> {
+  let shop: string | undefined;
+
+  if (session) {
+    shop = session.shop;
+  } else if (api.config.isEmbeddedApp) {
+    const payload = await api.session.decodeSessionToken(token);
+    shop = payload.dest.replace('https://', '');
+  }
+  return shop;
+}

package/packages/shopify-app-express/src/redirect-out-of-app.ts

@@ -0,0 +1,80 @@
+import {Request, Response} from 'express';
+
+import {AppConfigInterface} from './config-types';
+import {RedirectOutOfAppFunction, ApiAndConfigParams} from './types';
+
+export function redirectOutOfApp({
+  api,
+  config,
+}: ApiAndConfigParams): RedirectOutOfAppFunction {
+  return function redirectOutOfApp({req, res, redirectUri, shop}): void {
+    if (
+      (!api.config.isEmbeddedApp && isFetchRequest(req)) ||
+      req.headers.authorization?.match(/Bearer (.*)/)
+    ) {
+      appBridgeHeaderRedirect(config, res, redirectUri);
+    } else if (req.query.embedded === '1') {
+      exitIframeRedirect(config, req, res, redirectUri, shop);
+    } else {
+      serverSideRedirect(config, res, redirectUri, shop);
+    }
+  };
+}
+
+function appBridgeHeaderRedirect(
+  config: AppConfigInterface,
+  res: Response,
+  redirectUri: string,
+) {
+  config.logger.debug(
+    `Redirecting: request has bearer token, returning headers to ${redirectUri}`,
+  );
+
+  res.status(403);
+  res.append('Access-Control-Expose-Headers', [
+    'X-Shopify-Api-Request-Failure-Reauthorize',
+    'X-Shopify-Api-Request-Failure-Reauthorize-Url',
+  ]);
+  res.header('X-Shopify-API-Request-Failure-Reauthorize', '1');
+  res.header('X-Shopify-API-Request-Failure-Reauthorize-Url', redirectUri);
+  res.end();
+}
+
+function exitIframeRedirect(
+  config: AppConfigInterface,
+  req: Request,
+  res: Response,
+  redirectUri: string,
+  shop: string,
+): void {
+  config.logger.debug(
+    `Redirecting: request is embedded, using exitiframe path to ${redirectUri}`,
+    {shop},
+  );
+
+  const queryParams = new URLSearchParams({
+    ...req.query,
+    shop,
+    redirectUri,
+  }).toString();
+
+  res.redirect(`${config.exitIframePath}?${queryParams}`);
+}
+
+function serverSideRedirect(
+  config: AppConfigInterface,
+  res: Response,
+  redirectUri: string,
+  shop: string,
+): void {
+  config.logger.debug(
+    `Redirecting: request is at top level, going to ${redirectUri} `,
+    {shop},
+  );
+
+  res.redirect(redirectUri);
+}
+
+function isFetchRequest(req: Request) {
+  return req.xhr || req.headers['sec-fetch-dest'] === 'empty';
+}

package/packages/shopify-app-express/src/redirect-to-auth.ts

@@ -0,0 +1,70 @@
+import {Shopify} from '@shopify/shopify-api';
+import {Request, Response} from 'express';
+
+import {RedirectToAuthParams} from './types';
+import {redirectOutOfApp} from './redirect-out-of-app';
+import {AppConfigInterface} from './config-types';
+
+export async function redirectToAuth({
+  req,
+  res,
+  api,
+  config,
+  isOnline = false,
+}: RedirectToAuthParams) {
+  const shop = api.utils.sanitizeShop(req.query.shop as string);
+  if (!shop) {
+    config.logger.error('No shop provided to redirect to auth');
+    res.status(500);
+    res.send('No shop provided');
+    return;
+  }
+
+  if (req.query.embedded === '1') {
+    clientSideRedirect(api, config, req, res, shop);
+  } else {
+    await serverSideRedirect(api, config, req, res, shop, isOnline);
+  }
+}
+
+function clientSideRedirect(
+  api: Shopify,
+  config: AppConfigInterface,
+  req: Request,
+  res: Response,
+  shop: string,
+): void {
+  const host = api.utils.sanitizeHost(req.query.host as string);
+  if (!host) {
+    res.status(500);
+    res.send('No host provided');
+    return;
+  }
+
+  const redirectUriParams = new URLSearchParams({shop, host}).toString();
+  const redirectUri = `${api.config.hostScheme}://${api.config.hostName}${config.auth.path}?${redirectUriParams}`;
+
+  redirectOutOfApp({config, api})({req, res, redirectUri, shop});
+}
+
+async function serverSideRedirect(
+  api: Shopify,
+  config: AppConfigInterface,
+  req: Request,
+  res: Response,
+  shop: string,
+  isOnline: boolean,
+): Promise<void> {
+  config.logger.debug(
+    `Redirecting to auth at ${config.auth.path}, with callback ${config.auth.callbackPath}`,
+    {shop, isOnline},
+  );
+
+  await api.auth.begin({
+    callbackPath: config.auth.callbackPath,
+    shop,
+    isOnline,
+    rawRequest: req,
+    rawResponse: res,
+  });
+}

package/packages/shopify-app-express/src/types.ts

@@ -0,0 +1,26 @@
+import {Request, Response} from 'express';
+import {Shopify} from '@shopify/shopify-api';
+
+import {AppConfigInterface} from './config-types';
+
+export interface ApiAndConfigParams {
+  api: Shopify;
+  config: AppConfigInterface;
+}
+
+export interface RedirectToAuthParams extends ApiAndConfigParams {
+  req: Request;
+  res: Response;
+  isOnline?: boolean;
+}
+
+export interface RedirectOutOfAppInnerParams {
+  req: Request;
+  res: Response;
+  redirectUri: string;
+  shop: string;
+}
+
+export type RedirectOutOfAppFunction = (
+  params: RedirectOutOfAppInnerParams,
+) => void;

package/packages/shopify-app-express/src/version.ts

@@ -0,0 +1 @@
+export const SHOPIFY_EXPRESS_LIBRARY_VERSION = '4.1.2';