Auth callback should throw 403 if CookieNotFound occured to handle OAuth retries

[kazukinagata]

Overview/summary

When validateAuthCallback called, shopify-api will throw a CookieNotFound error if sessionCookie has been expired.
In the scenario, koa should throw 403 instead of 500 to handle retrying OAuth process.

catch (e) {
        switch (true) {
          case (e instanceof Shopify.Errors.InvalidOAuthError):
            ctx.throw(400, e.message);
            break;
          case (e instanceof Shopify.Errors.SessionNotFound):
          case (e instanceof Shopify.Errors.CookieNotFound): // Add here
            ctx.throw(403, e.message);
            break;
          default:
            ctx.throw(500, e.message);
            break;
       }
}

koa-shopify-auth/src/auth/index.ts

Line 110 in ba16b83

case (e instanceof Shopify.Errors.SessionNotFound):

Motivation

You know the OAuth process has a limit of 60s to be completed, and it will expire the sessionCookie after that point.
Shopify testers sometimes wait 60s before continuing the OAuth process then cause Internal Server Error.
In order to pass the test, we need to handle OAuth retries, but with a 500 error, error handling is difficult.

Related issue: Shopify/shopify-api-js#130 (comment)

---

Checklist

• Please delete the labels section before submitting your issue
• I have described this enhancement in a way that is actionable (if possible)

[github-actions]

Note that this repo is no longer maintained and this issue will not be reviewed. Prefer the official JavaScript API library. If you still want to use Koa, see simple-koa-shopify-auth for a potential community solution.