fix(credentials): bind shopify completion to oauth state

Author: TheodoreSpeaks

apps/sim/app/api/auth/oauth2/callback/shopify/route.test.ts

@@ -0,0 +1,97 @@
+/**
+ * @vitest-environment node
+ */
+import { hmacSha256Hex } from '@sim/security/hmac'
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockCompleteShopifyOAuthConnection, mockGetSession, mockRequireConfiguredOAuthClient } =
+  vi.hoisted(() => ({
+    mockCompleteShopifyOAuthConnection: vi.fn(),
+    mockGetSession: vi.fn(),
+    mockRequireConfiguredOAuthClient: vi.fn(),
+  }))
+
+vi.mock('@/lib/auth', () => ({ getSession: mockGetSession }))
+vi.mock('@/lib/core/config/env-capabilities.server', () => ({
+  requireConfiguredOAuthClient: mockRequireConfiguredOAuthClient,
+}))
+vi.mock('@/lib/core/utils/urls', () => ({ getBaseUrl: () => 'https://sim.test' }))
+vi.mock('@/lib/oauth/shopify', () => ({
+  completeShopifyOAuthConnection: mockCompleteShopifyOAuthConnection,
+}))
+
+import { createShopifyOAuthState } from '@/lib/oauth/shopify-state'
+import { GET } from '@/app/api/auth/oauth2/callback/shopify/route'
+
+const CLIENT_SECRET = 'shopify-client-secret'
+const SHOP_DOMAIN = 'example.myshopify.com'
+
+function callbackRequest(state: string) {
+  const searchParams = new URLSearchParams({
+    code: 'authorization-code',
+    shop: SHOP_DOMAIN,
+    state,
+  })
+  const message = [...searchParams.entries()]
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, value]) => `${key}=${value}`)
+    .join('&')
+  searchParams.set('hmac', hmacSha256Hex(message, CLIENT_SECRET))
+
+  return createMockRequest(
+    'GET',
+    undefined,
+    {
+      cookie:
+        'shopify_credential_draft_id=draft-from-shared-cookie; shopify_return_url=https%3A%2F%2Fsim.test%2Foauth%2Fcredential-connected%3Fresult%3Dconnected',
+    },
+    `https://sim.test/api/auth/oauth2/callback/shopify?${searchParams.toString()}`
+  )
+}
+
+describe('Shopify OAuth callback', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockRequireConfiguredOAuthClient.mockReturnValue({
+      values: {
+        SHOPIFY_CLIENT_ID: 'shopify-client-id',
+        SHOPIFY_CLIENT_SECRET: CLIENT_SECRET,
+      },
+    })
+    mockCompleteShopifyOAuthConnection.mockResolvedValue(undefined)
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue(
+        new Response(JSON.stringify({ access_token: 'shopify-token', scope: 'read_products' }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      )
+    )
+  })
+
+  it('completes the credential draft carried by signed state instead of a shared cookie', async () => {
+    const state = createShopifyOAuthState({
+      userId: 'user-1',
+      shopDomain: SHOP_DOMAIN,
+      draftId: 'draft-from-state',
+      clientSecret: CLIENT_SECRET,
+    })
+
+    const response = await GET(callbackRequest(state))
+
+    expect(mockCompleteShopifyOAuthConnection).toHaveBeenCalledWith({
+      accessToken: 'shopify-token',
+      shopDomain: SHOP_DOMAIN,
+      scope: 'read_products',
+      userId: 'user-1',
+      draftId: 'draft-from-state',
+      signal: expect.any(AbortSignal),
+    })
+    expect(response.headers.get('location')).toBe(
+      'https://sim.test/oauth/credential-connected?result=connected&shopify_connected=true'
+    )
+  })
+})

apps/sim/app/api/auth/oauth2/callback/shopify/route.ts

@@ -10,12 +10,26 @@ import { getSession } from '@/lib/auth'
 import { EnvCapabilityConfigurationError } from '@/lib/core/config/env-capabilities'
 import { requireConfiguredOAuthClient } from '@/lib/core/config/env-capabilities.server'
 import { getBaseUrl } from '@/lib/core/utils/urls'
+import { isSameOrigin } from '@/lib/core/utils/validation'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { completeShopifyOAuthConnection } from '@/lib/oauth/shopify'
+import { parseShopifyOAuthState } from '@/lib/oauth/shopify-state'
 
 const logger = createLogger('ShopifyCallback')
 
 export const dynamic = 'force-dynamic'
 
+function clearShopifyOAuthCookies(response: NextResponse): NextResponse {
+  response.cookies.delete('shopify_oauth_state')
+  response.cookies.delete('shopify_shop_domain')
+  response.cookies.delete('shopify_credential_draft_id')
+  response.cookies.delete('shopify_pending_token')
+  response.cookies.delete('shopify_pending_shop')
+  response.cookies.delete('shopify_pending_scope')
+  response.cookies.delete('shopify_return_url')
+  return response
+}
+
 /**
  * Validates the HMAC signature from Shopify to ensure the request is authentic
  * @see https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/offline-access-tokens
@@ -59,9 +73,6 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       shop: searchParams.get('shop') || undefined,
     })
 
-    const storedState = request.cookies.get('shopify_oauth_state')?.value
-    const storedShop = request.cookies.get('shopify_shop_domain')?.value
-
     const {
       values: { SHOPIFY_CLIENT_ID: clientId, SHOPIFY_CLIENT_SECRET: clientSecret },
     } = requireConfiguredOAuthClient('shopify')
@@ -71,8 +82,8 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_hmac_invalid`)
     }
 
-    if (!state || state !== storedState) {
-      logger.error('State mismatch in Shopify OAuth callback')
+    if (!state) {
+      logger.error('Missing state in Shopify OAuth callback')
       return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_state_mismatch`)
     }
 
@@ -81,7 +92,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_no_code`)
     }
 
-    const shopDomain = shop || storedShop
+    const shopDomain = shop
     if (!shopDomain) {
       logger.error('No shop domain available')
       return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_no_shop`)
@@ -92,6 +103,13 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_invalid_shop`)
     }
 
+    const { draftId } = parseShopifyOAuthState({
+      state,
+      userId: session.user.id,
+      shopDomain,
+      clientSecret,
+    })
+
     const tokenResponse = await fetch(`https://${shopDomain}/admin/oauth/access_token`, {
       method: 'POST',
       headers: {
@@ -127,44 +145,30 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_no_token`)
     }
 
-    const storeUrl = new URL(`${baseUrl}/api/auth/oauth2/shopify/store`)
-
-    const response = NextResponse.redirect(storeUrl)
-
-    response.cookies.set('shopify_pending_token', accessToken, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === 'production',
-      sameSite: 'lax',
-      maxAge: 60,
-      path: '/',
-    })
-
-    response.cookies.set('shopify_pending_shop', shopDomain, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === 'production',
-      sameSite: 'lax',
-      maxAge: 60,
-      path: '/',
-    })
-
-    response.cookies.set('shopify_pending_scope', scope || '', {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === 'production',
-      sameSite: 'lax',
-      maxAge: 60,
-      path: '/',
+    await completeShopifyOAuthConnection({
+      accessToken,
+      shopDomain,
+      scope,
+      userId: session.user.id,
+      draftId,
+      signal: request.signal,
     })
 
-    response.cookies.delete('shopify_oauth_state')
-    response.cookies.delete('shopify_shop_domain')
+    const returnUrlCookie = request.cookies.get('shopify_return_url')?.value
+    const redirectUrl =
+      returnUrlCookie && isSameOrigin(returnUrlCookie) ? returnUrlCookie : `${baseUrl}/workspace`
+    const finalUrl = new URL(redirectUrl)
+    finalUrl.searchParams.set('shopify_connected', 'true')
 
-    return response
+    return clearShopifyOAuthCookies(NextResponse.redirect(finalUrl))
   } catch (error) {
     logger.error('Error in Shopify OAuth callback:', error)
     const errorCode =
       error instanceof EnvCapabilityConfigurationError && error.capabilityId === 'oauth'
         ? 'shopify_config_error'
         : 'shopify_callback_error'
-    return NextResponse.redirect(`${baseUrl}/workspace?error=${errorCode}`)
+    return clearShopifyOAuthCookies(
+      NextResponse.redirect(`${baseUrl}/workspace?error=${errorCode}`)
+    )
   }
 })

apps/sim/app/api/auth/oauth2/shopify/store/route.ts

@@ -1,7 +1,4 @@
-import { db } from '@sim/db'
-import { account } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
   shopifyShopDomainSchema,
@@ -11,9 +8,7 @@ import { getSession } from '@/lib/auth'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { isSameOrigin } from '@/lib/core/utils/validation'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { processCredentialDraft } from '@/lib/credentials/draft-processor'
-import { safeAccountInsert } from '@/lib/oauth/credential-service'
-import { SHOPIFY_API_VERSION } from '@/tools/shopify/constants'
+import { completeShopifyOAuthConnection } from '@/lib/oauth/shopify'
 
 const logger = createLogger('ShopifyStore')
 
@@ -48,85 +43,13 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_invalid_domain`)
     }
 
-    const shopResponse = await fetch(
-      `https://${shopDomain}/admin/api/${SHOPIFY_API_VERSION}/shop.json`,
-      {
-        headers: {
-          'X-Shopify-Access-Token': accessToken,
-          'Content-Type': 'application/json',
-        },
-      }
-    )
-
-    if (!shopResponse.ok) {
-      const errorText = await shopResponse.text()
-      logger.error('Invalid Shopify token', {
-        status: shopResponse.status,
-        error: errorText,
-      })
-      return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_invalid_token`)
-    }
-
-    const shopData = await shopResponse.json()
-    const shopInfo = shopData.shop
-    const stableAccountId = shopInfo.id?.toString() || shopDomain
-
-    const existing = await db.query.account.findFirst({
-      where: and(
-        eq(account.userId, session.user.id),
-        eq(account.providerId, 'shopify'),
-        eq(account.accountId, stableAccountId)
-      ),
-    })
-
-    const now = new Date()
-
-    const accountData = {
-      accessToken: accessToken,
-      accountId: stableAccountId,
-      scope: scope || '',
-      updatedAt: now,
-      idToken: shopDomain,
-    }
-
-    if (existing) {
-      await db.update(account).set(accountData).where(eq(account.id, existing.id))
-      logger.info('Updated existing Shopify account', { accountId: existing.id })
-    } else {
-      await safeAccountInsert(
-        {
-          id: `shopify_${session.user.id}_${Date.now()}`,
-          userId: session.user.id,
-          providerId: 'shopify',
-          accountId: accountData.accountId,
-          accessToken: accountData.accessToken,
-          scope: accountData.scope,
-          idToken: accountData.idToken,
-          createdAt: now,
-          updatedAt: now,
-        },
-        { provider: 'Shopify', identifier: shopDomain }
-      )
-    }
-
-    const persisted =
-      existing ??
-      (await db.query.account.findFirst({
-        where: and(
-          eq(account.userId, session.user.id),
-          eq(account.providerId, 'shopify'),
-          eq(account.accountId, stableAccountId)
-        ),
-      }))
-
-    if (!persisted) {
-      throw new Error(`Shopify OAuth account ${stableAccountId} was not persisted`)
-    }
-    await processCredentialDraft({
-      draftId,
+    await completeShopifyOAuthConnection({
+      accessToken,
+      shopDomain,
+      scope,
       userId: session.user.id,
-      providerId: 'shopify',
-      accountId: persisted.id,
+      draftId,
+      signal: request.signal,
     })
 
     const redirectUrl = returnUrl && isSameOrigin(returnUrl) ? returnUrl : `${baseUrl}/workspace`