Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

use online tokens when available #1566

Merged
merged 1 commit into from
Nov 7, 2022
Merged

use online tokens when available #1566

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
Unreleased
----------
* Fixes a bug with `EnsureAuthenticatedLinks` causing deep links to not work [#1549](https://github.com/Shopify/shopify_app/pull/1549)
* Ensure online token is properly used when using `current_shopify_session` [#1566](https://github.com/Shopify/shopify_app/pull/1566)

21.2.0 (Oct 25, 2022)
----------
Expand Down
8 changes: 6 additions & 2 deletions lib/shopify_app/controller_concerns/login_protection.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ def current_shopify_session
ShopifyAPI::Utils::SessionUtils.load_current_session(
auth_header: request.headers["HTTP_AUTHORIZATION"],
cookies: { cookie_name => cookies.encrypted[cookie_name] },
is_online: user_session_expected?,
is_online: online_token_configured?,
)
rescue ShopifyAPI::Errors::CookieNotFoundError
nil
Expand Down Expand Up @@ -232,11 +232,15 @@ def shop_session
ShopifyApp::SessionRepository.retrieve_shop_session_by_shopify_domain(sanitize_shop_param(params))
end

def online_token_configured?
!ShopifyApp.configuration.user_session_repository.blank? && ShopifyApp::SessionRepository.user_storage.present?
end

def user_session_expected?
return false if shop_session.nil?
Copy link
Collaborator Author

@teddyhwang teddyhwang Nov 3, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shop_session here would only be available during OAuth since it does a shop look up by the shop parameter which is only sent during the beginning of OAuth. this would always return false since subsequent proxy API requests would not have the shop query parameter required to do this look up

return false if ShopifyApp.configuration.shop_access_scopes_strategy.update_access_scopes?(shop_session.shop)

!ShopifyApp.configuration.user_session_repository.blank? && ShopifyApp::SessionRepository.user_storage.present?
online_token_configured?
end
end
end
12 changes: 4 additions & 8 deletions test/shopify_app/controller_concerns/login_protection_test.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,10 +79,6 @@ class LoginProtectionControllerTest < ActionController::TestCase
end

test "#current_shopify_session loads online session if user session expected" do
ShopifyApp::SessionRepository.shop_storage.stubs(:retrieve_by_shopify_domain)
.with(@shop)
.returns(mock_session(shop: @shop))

request.headers["HTTP_AUTHORIZATION"] = "Bearer token"

ShopifyAPI::Utils::SessionUtils.expects(:load_current_session)
Expand Down Expand Up @@ -116,15 +112,15 @@ class LoginProtectionControllerTest < ActionController::TestCase
end
end

test "#current_shopify_session loads offline session if token is signed with new secret" do
teddyhwang marked this conversation as resolved.
Show resolved Hide resolved
test "#current_shopify_session loads session if token is signed with new secret" do
token = mock_jwt_token(ShopifyApp.configuration.secret)
request.headers["HTTP_AUTHORIZATION"] = "Bearer #{token}"

ShopifyAPI::Utils::SessionUtils.expects(:load_current_session)
.with(
auth_header: "Bearer #{token}",
cookies: { ShopifyAPI::Auth::Oauth::SessionCookie::SESSION_COOKIE_NAME => nil },
is_online: false,
is_online: true,
)
.returns(@session)

Expand All @@ -134,15 +130,15 @@ class LoginProtectionControllerTest < ActionController::TestCase
end
end

test "#current_shopify_session loads offline session if token is signed with old secret" do
test "#current_shopify_session loads session if token is signed with old secret" do
token = mock_jwt_token(ShopifyApp.configuration.old_secret)
request.headers["HTTP_AUTHORIZATION"] = "Bearer #{token}"

ShopifyAPI::Utils::SessionUtils.expects(:load_current_session)
.with(
auth_header: "Bearer #{token}",
cookies: { ShopifyAPI::Auth::Oauth::SessionCookie::SESSION_COOKIE_NAME => nil },
is_online: false,
is_online: true,
)
.returns(@session)

Expand Down