From 913b414a3798c6687d051310c9ea84e259d28b55 Mon Sep 17 00:00:00 2001 From: Jonas WebDev Date: Fri, 26 May 2023 20:59:44 -0300 Subject: [PATCH 1/8] Fix Get Current Session ID process from Post Purchase Extension Token --- src/Auth/OAuth.php | 11 ++++++++++- src/Exception/InvalidJwtPayloadException.php | 9 +++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 src/Exception/InvalidJwtPayloadException.php diff --git a/src/Auth/OAuth.php b/src/Auth/OAuth.php index 8ee417a3..07c26cdd 100644 --- a/src/Auth/OAuth.php +++ b/src/Auth/OAuth.php @@ -12,6 +12,7 @@ use Shopify\Exception\CookieSetException; use Shopify\Exception\HttpRequestException; use Shopify\Exception\InvalidArgumentException; +use Shopify\Exception\InvalidJwtPayloadException; use Shopify\Exception\InvalidOAuthException; use Shopify\Exception\MissingArgumentException; use Shopify\Exception\OAuthSessionNotFoundException; @@ -232,7 +233,15 @@ public static function getCurrentSessionId(array $rawHeaders, array $cookies, bo } $jwtPayload = Utils::decodeSessionToken($matches[1]); - $shop = preg_replace('/^https:\/\//', '', $jwtPayload['dest']); + + if (!empty($jwtPayload['dest'])) { + $shop = preg_replace('/^https:\/\//', '', $jwtPayload['dest']); + } elseif (!empty($jwtPayload['input_data']->shop->domain)) { + $shop = preg_replace('/^https:\/\//', '', $jwtPayload['input_data']->shop->domain); + } else { + throw new InvalidJwtPayloadException('Missing shop value in JWT payload'); + } + if ($isOnline) { $currentSessionId = self::getJwtSessionId($shop, $jwtPayload['sub']); } else { diff --git a/src/Exception/InvalidJwtPayloadException.php b/src/Exception/InvalidJwtPayloadException.php new file mode 100644 index 00000000..2fa398f7 --- /dev/null +++ b/src/Exception/InvalidJwtPayloadException.php @@ -0,0 +1,9 @@ + Date: Mon, 29 May 2023 16:19:29 -0300 Subject: [PATCH 2/8] Tests for Fix the issue "Get Current Session ID process from Post Purchase Extension Token --- tests/Auth/OAuthTest.php | 57 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/tests/Auth/OAuthTest.php b/tests/Auth/OAuthTest.php index b105f6b0..326f3f0b 100644 --- a/tests/Auth/OAuthTest.php +++ b/tests/Auth/OAuthTest.php @@ -13,6 +13,7 @@ use Shopify\Exception\CookieSetException; use Shopify\Exception\HttpRequestException; use Shopify\Exception\InvalidArgumentException; +use Shopify\Exception\InvalidJwtPayloadException; use Shopify\Exception\InvalidOAuthException; use Shopify\Exception\MissingArgumentException; use Shopify\Exception\OAuthSessionNotFoundException; @@ -672,4 +673,60 @@ private function encodeJwtPayload(): string ]; return JWT::encode($payload, Context::$API_SECRET_KEY, 'HS256'); } + + + private function encodeJwtPayloadFromPostPurchaseExtension(): string + { + $shop = new stdClass(); + $shop->domain = "https://exampleshop.myshopify.com"; + $inputData = new stdClass(); + $inputData->shop = $shop; + + $payload = [ + "iss" => "https://exampleshop.myshopify.com/admin", + "sub" => "42", + "input_data" => $inputData, + "iat" => 1591764998, + ]; + + return JWT::encode($payload, Context::$API_SECRET_KEY, 'HS256'); + } + + private function encodeInvalidJwtPayloadFromPostPurchaseExtension(): string + { + $payload = [ + "iss" => "https://exampleshop.myshopify.com/admin", + "sub" => "42", + "iat" => 1591764998, + ]; + + return JWT::encode($payload, Context::$API_SECRET_KEY, 'HS256'); + } + + + public function testGetCurrentSessionIdFromPostPurchaseTokenForOnlineShop() + { + $token = $this->encodeJwtPayloadFromPostPurchaseExtension(); + + $currentSessionId = OAuth::getCurrentSessionId(['Authorization' => "Bearer $token"], [], true); + $this->assertEquals('exampleshop.myshopify.com_42', $currentSessionId); + } + + public function testGetCurrentSessionIdFromPostPurchaseTokenForOfflineShop() + { + $token = $this->encodeJwtPayloadFromPostPurchaseExtension(); + + $currentSessionId = OAuth::getCurrentSessionId(['Authorization' => "Bearer $token"], [], false); + $this->assertEquals('offline_exampleshop.myshopify.com', $currentSessionId); + } + + public function testGetCurrentSessionIdFromPostPurchaseTokenInvalidJwtPayloadException() + { + $token = $this->encodeInvalidJwtPayloadFromPostPurchaseExtension(); + + $this->expectException(InvalidJwtPayloadException::class); + $this->expectExceptionMessage('Missing shop value in JWT payload'); + $currentSessionId = OAuth::getCurrentSessionId(['Authorization' => "Bearer $token"], [], true); + } + } From b2a2ab321b6104e383bf7cf35aebd2656ff91311 Mon Sep 17 00:00:00 2001 From: Jonas WebDev Date: Mon, 29 May 2023 16:19:51 -0300 Subject: [PATCH 3/8] Changelog update --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f3dcb952..0206d783 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html). ## Unreleased +- Fix the issue "Get Current Session ID process from Post Purchase Extension Token" [bugfix] ## v5.0.0 - 2023-05-10 From 1b6c7c1e02f4dc4aa76e274df9745a65f2763f91 Mon Sep 17 00:00:00 2001 From: Jonas WebDev Date: Mon, 29 May 2023 16:23:58 -0300 Subject: [PATCH 4/8] Changelog update --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0206d783..78355d8f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html). ## Unreleased -- Fix the issue "Get Current Session ID process from Post Purchase Extension Token" [bugfix] +- PATCH: Fix the issue "Get Current Session ID process from Post Purchase Extension Token" ## v5.0.0 - 2023-05-10 From 1ab26d82d2a21a8585a2fb6788fb3bf018565909 Mon Sep 17 00:00:00 2001 From: Jonas WebDev Date: Fri, 16 Jun 2023 16:08:35 -0300 Subject: [PATCH 5/8] Preapre to publish on packagist.org --- composer.json | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/composer.json b/composer.json index c0f85e8d..54b24c5b 100644 --- a/composer.json +++ b/composer.json @@ -1,5 +1,5 @@ { - "name": "shopify/shopify-api", + "name": "jonaswebdev/shopify-api", "description": "Shopify API Library for PHP", "license": "MIT", "type": "library", @@ -18,7 +18,12 @@ { "name": "Shopify Inc.", "email": "dev-tools-education@shopify.com" - } + }, + { + "name": "Jonas Rosado", + "email": "jonaswebdev@gmail.com" + }, + ], "require": { "php": "~8.0.0 || ~8.1.0 || ~8.2.0", From f78565a9bc7008940d98821fa55fbcec0b1ebc1f Mon Sep 17 00:00:00 2001 From: Jonas WebDev Date: Fri, 16 Jun 2023 16:10:22 -0300 Subject: [PATCH 6/8] Preparation to publish on packagist.org --- composer.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/composer.json b/composer.json index 54b24c5b..688aa163 100644 --- a/composer.json +++ b/composer.json @@ -22,8 +22,7 @@ { "name": "Jonas Rosado", "email": "jonaswebdev@gmail.com" - }, - + } ], "require": { "php": "~8.0.0 || ~8.1.0 || ~8.2.0", From ae0c26aa1d003c933f9f36c1d74aef3f7b100a5f Mon Sep 17 00:00:00 2001 From: Jonas WebDev Date: Fri, 16 Jun 2023 16:13:14 -0300 Subject: [PATCH 7/8] Preparation to publish on packagist.org - description --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 688aa163..500158db 100644 --- a/composer.json +++ b/composer.json @@ -1,6 +1,6 @@ { "name": "jonaswebdev/shopify-api", - "description": "Shopify API Library for PHP", + "description": "Shopify API Library for PHP, include the fix to authentication from Post-purchase Extension requests.", "license": "MIT", "type": "library", "keywords": [ From a5983237f67892c4580fe661f84613647fa62c3f Mon Sep 17 00:00:00 2001 From: Jonas WebDev Date: Mon, 19 Jun 2023 17:07:15 -0300 Subject: [PATCH 8/8] Rollback of "Preparation to publish on packagist.org" --- composer.json | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/composer.json b/composer.json index 500158db..c0f85e8d 100644 --- a/composer.json +++ b/composer.json @@ -1,6 +1,6 @@ { - "name": "jonaswebdev/shopify-api", - "description": "Shopify API Library for PHP, include the fix to authentication from Post-purchase Extension requests.", + "name": "shopify/shopify-api", + "description": "Shopify API Library for PHP", "license": "MIT", "type": "library", "keywords": [ @@ -18,10 +18,6 @@ { "name": "Shopify Inc.", "email": "dev-tools-education@shopify.com" - }, - { - "name": "Jonas Rosado", - "email": "jonaswebdev@gmail.com" } ], "require": {