shopify-api-js Session's "isActive()" method is lost when custom storage is used like Redis

Hey,

I recently started playing with Shopify app looking at the in progress example in "Shopify App Node" repo. I noticed it in "verifyRequest" here which doesn't work (throws error) if used with Redis store.

Issue summary

When custom session storage is used like Redis in the example in storeCallback we're stringifying the session which removes the "isActive" method as it's not valid json.

It works with MemorySessionStorage as we're storing objects.

Steps to reproduce the problem

const session = new Shopify.Auth.Session(...);
console.log(session.isActive()) // boolean

const session2 = JSON.parse(JSON.stringify(session));
console.log(session2.isActive())) // error: is not a function

Checklist

[x] I have described this issue in a way that is actionable (if possible)

Solution

Maybe move it inside Utils? Something like:

Shopify.Utils.isSessionActive(session) // boolean

If it's me doing something wrong, apologies.

Feb 23 '22 20:02 rkumorek

Yep I had the same problem when saving the session into my MongoDB store, because I didn't realize until later that methods aren't serialized into the database. I second this request!

Mar 05 '22 04:03 limeforadime

Just incase it's of any use to anyone. I'm doing this for now:

class RedisStore {
  constructor () {
    this.client = new Redis(process.env.REDIS_URL)
  }

  async storeCallback (session) {
    try {
      return await this.client.set(session.id, JSON.stringify(session))
    } catch (err) {
      throw new Error(err)
    }
  }

  async loadCallback (id) {
    try {
      const reply = await this.client.get(id)

      if (reply) {
        return JSON.parse(reply)
      } else {
        return undefined
      }
    } catch (error) {
      throw new Error(error)
    }
  }

  async deleteCallback (id) {
    try {
      return await this.client.del(id)
    } catch (error) {
      throw new Error(error)
    }
  }

  isActive (session) {
    return (
      Shopify.Context.SCOPES.equals(session.scope) &&
      session.accessToken &&
      (!session.expires || session.expires >= new Date())
    )
  }
}

export const sessionStorage = new RedisStore()

const session = await Shopify.Utils.loadCurrentSession(req, res, isOnline)

if (sessionStorage.isActive(session)) {
  ..
}

Not ideal but emulates what is there

Mar 05 '22 11:03 dan-gamble

See #333 for another workaround that's a bit cleaner (imo) as well as the exact line of code that causes this bug.

Mar 18 '22 00:03 staadecker

Yep I had the same problem when saving the session into my MongoDB store, because I didn't realize until later that methods aren't serialized into the database. I second this request!

@limeforadime David THANK YOU for posting your solution in the comments here and helping me get auth working!: https://jsrepos.com/lib/TheSecurityDev-simple-koa-shopify-auth

May 17 '22 03:05 buildpath-ian

Yep I had the same problem when saving the session into my MongoDB store, because I didn't realize until later that methods aren't serialized into the database. I second this request!

@limeforadime David THANK YOU for posting your solution in the comments here and helping me get auth working!: https://jsrepos.com/lib/TheSecurityDev-simple-koa-shopify-auth

Np 👍

May 17 '22 04:05 limeforadime

Besides isActive() function gone, I've also encountered an issue with session.expires. session.expires is a Date but it will get returned by Redis as a String.

Here is my workaround but it has to be something more elegant:

class RedisStore {
  constructor() {
    ...
    async loadCallback(id) {
      try {
        const reply = await this.client.get(id);
  
        if (reply) {
          var session = JSON.parse(reply);
          session.expires = new Date(session.expires);
  
          session.isActive = function() {
            const scopesUnchanged = Shopify.Context.SCOPES.equals(session.scope);
  
            if (
              scopesUnchanged && 
              session.accessToken && 
              (!session.expires || session.expires >= new Date())) {
              return true;
            }
            return false;
          }
  
          return session;
        } else {
          return undefined;
        }
      } catch (err) {
        throw new Error(err);
      }
    }

    ...
  }
}

There are some session utils and https://github.com/Shopify/shopify-node-api/blob/e69a4ab3a7e35645b7109977d97dee30b99d3dc6/src/auth/session/session-utils.ts and a Redis implementation https://github.com/Shopify/shopify-node-api/blob/e69a4ab3a7e35645b7109977d97dee30b99d3dc6/src/auth/session/storage/redis.ts. This may provide a better solution

May 19 '22 18:05 mirceapiturca

@mirceapiturca Yeah I'm doing the exact same thing, converting it into a new Date() first. Works just fine after that.

May 19 '22 23:05 limeforadime

Hello everyone, you know that I have the same problem as you, I am working with the most recent version of shopify cli, and when trying to work with new Shopify.Session.PostgreSQLSessionStorage() I am presented with two types of errors, the first is that when reloading the page for the first time gives me the error "TypeError: session?.isActive is not a function" I go to pgadmin and the table is created, I make some changes to try to solve the previous error and a new error message appears: relation '"shopify_sessions" already exists', to continue testing I must be deleting the table!!! I'm really very disoriented, and frustrated. I leave parts of my code to see can you help me...

is this all that is needed in index js?

Shopify.Context.initialize({ API_KEY: process.env.SHOPIFY_API_KEY, API_SECRET_KEY: process.env.SHOPIFY_API_SECRET, SCOPES: process.env.SCOPES.split(","), HOST_NAME: process.env.HOST.replace(/https:///, ""), API_VERSION: ApiVersion.April22, IS_EMBEDDED_APP: true, // This should be replaced with your preferred storage strategy SESSION_STORAGE: new Shopify.Session.PostgreSQLSessionStorage( new URL(process.env.DATABASE_URL), ), });

and this is the original postgresql.js file:

`"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.PostgreSQLSessionStorage = void 0; var tslib_1 = require("tslib"); var pg_1 = tslib_1.__importDefault(require("pg")); var session_utils_1 = require("../session-utils"); var defaultPostgreSQLSessionStorageOptions = { sessionTableName: 'shopify_sessions', port: 3211, };

May 20 '22 04:05 dto1902

I'm facing a similar problem where the server throws an error if the JWT token is expired.

It seems that there's no built in logic for redirecting the customer to the oAuth flow when that happens.

It just throws an error and eventually crashes my whole nodeJS server.

Jul 13 '22 07:07 daviareias

Eventually I found that this was only happening to me locally, and the expired JWT issue did not occur in production.

On Wed, Jul 13, 2022 at 2:57 AM daviareias @.***> wrote:

I'm facing a similar problem where the server throws an error if the JWT token is expired.

It seems that there's no built in logic for redirecting the customer to the oAuth flow when that happens.

It just throws an error and eventually crashes my whole nodeJS server.

— Reply to this email directly, view it on GitHub https://github.com/Shopify/shopify-api-node/issues/307#issuecomment-1182892454, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAEFIQNDHACYXRTGR6O37VLVTZZFRANCNFSM5PFOPCJQ . You are receiving this because you commented.Message ID: @.***>

Jul 13 '22 14:07 buildpath-ian

I think the example code is wrong. The loadCallback function is supposed to return an instance of SessionInterface, not just a parsed JSON object. (Not sure why TypeScript doesn't catch this.)

If you look at the "real" implementations of SessionStorage, like redis.ts, you can see that they use functions from session-utils.ts called sessionFromEntries and sessionEntries. I'm not sure if those functions can be imported by an application, but they appear to be the right way to serialize and deserialize SessionInterface.

#428 would help in situations like this...

Aug 01 '22 22:08 adelespinasse

This issue is stale because it has been open for 90 days with no activity. It will be closed if no further action occurs in 14 days.

Oct 06 '22 02:10 github-actions[bot]

We are closing this issue because it has been inactive for a few months. This probably means that it is not reproducible or it has been fixed in a newer version. If it’s an enhancement and hasn’t been taken on since it was submitted, then it seems other issues have taken priority.

If you still encounter this issue with the latest stable version, please reopen using the issue template. You can also contribute directly by submitting a pull request– see the CONTRIBUTING.md file for guidelines

Thank you!

Oct 20 '22 02:10 github-actions[bot]

shopify-api-js shopify-api-js copied to clipboard

Session's "isActive()" method is lost when custom storage is used like Redis

Issue summary

Steps to reproduce the problem

Checklist

Solution

shopify-api-js
shopify-api-js copied to clipboard