Module: ShopifyApp::LoginProtection

Extended by:
ActiveSupport::Concern
Includes:
Itp, SanitizedParams
Included in:
CallbackController, SessionsController
Defined in:
lib/shopify_app/controller_concerns/login_protection.rb

Defined Under Namespace

Classes: ShopifyDomainNotFound, ShopifyHostNotFound

Constant Summary collapse

ACCESS_TOKEN_REQUIRED_HEADER = 
"X-Shopify-API-Request-Failure-Unauthorized"

Instance Method Summary collapse

Instance Method Details

#activate_shopify_session ⇒ Object 



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
 
# File 'lib/shopify_app/controller_concerns/login_protection.rb', line 22

def activate_shopify_session
  if current_shopify_session.blank?
    signal_access_token_required
    return 
  end

  unless current_shopify_session.scope.to_a.empty? ||
      current_shopify_session.scope.covers?(ShopifyAPI::Context.scope)

    clear_shopify_session
    return 
  end

  begin
    ShopifyAPI::Context.activate_session(current_shopify_session)
    yield
  ensure
    ShopifyAPI::Context.deactivate_session
  end
end

#add_top_level_redirection_headers(url: nil, ignore_response_code: false) ⇒ Object 



76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
 
# File 'lib/shopify_app/controller_concerns/login_protection.rb', line 76

def add_top_level_redirection_headers(url: nil, ignore_response_code: false)
  if request.xhr? && (ignore_response_code || response.code.to_i == 401)
    # Make sure the shop is set in the redirection URL
    unless params[:shop]
      params[:shop] = if current_shopify_session
        current_shopify_session.shop
      elsif (matches = request.headers["HTTP_AUTHORIZATION"]&.match(/^Bearer (.+)$/))
        jwt_payload = ShopifyAPI::Auth::JwtPayload.new(T.must(matches[1]))
        jwt_payload.shop
      end
    end

    url ||= 

    response.set_header("X-Shopify-API-Request-Failure-Reauthorize", "1")
    response.set_header("X-Shopify-API-Request-Failure-Reauthorize-Url", url)
  end
end

#current_shopify_session ⇒ Object 



43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/shopify_app/controller_concerns/login_protection.rb', line 43

def current_shopify_session
  @current_shopify_session ||= begin
    cookie_name = ShopifyAPI::Auth::Oauth::SessionCookie::SESSION_COOKIE_NAME
    ShopifyAPI::Utils::SessionUtils.load_current_session(
      auth_header: request.headers["HTTP_AUTHORIZATION"],
      cookies: { cookie_name => cookies.encrypted[cookie_name] },
      is_online: user_session_expected?
    )
  rescue ShopifyAPI::Errors::CookieNotFoundError
    nil
  rescue ShopifyAPI::Errors::InvalidJwtTokenError
    nil
  end
end

#jwt_expire_at ⇒ Object 



69
70
71
72
73
74
 
# File 'lib/shopify_app/controller_concerns/login_protection.rb', line 69

def jwt_expire_at
  expire_at = request.env["jwt.expire_at"]
  return unless expire_at

  expire_at - 5.seconds # 5s gap to start fetching new token in advance
end

#login_again_if_different_user_or_shop ⇒ Object 



58
59
60
61
62
63
 
# File 'lib/shopify_app/controller_concerns/login_protection.rb', line 58

def 
  return unless session_id_conflicts_with_params || session_shop_conflicts_with_params

  clear_shopify_session
  
end

#signal_access_token_required ⇒ Object 



65
66
67
 
# File 'lib/shopify_app/controller_concerns/login_protection.rb', line 65

def signal_access_token_required
  response.set_header(ACCESS_TOKEN_REQUIRED_HEADER, "true")
end