
Security News
pnpm 10.12 Introduces Global Virtual Store and Expanded Version Catalogs
pnpm 10.12.1 introduces a global virtual store for faster installs and new options for managing dependencies with version catalogs.
io.github.blackmo18:kotlin-shopify-authentication-jvm
Advanced tools
Csv File to Kotlin Data Class Parser
#Kotlin-Shopify Authentication
Simple Straightforward Authentication Library for Shopify Application Setup in Kotlin
##Features
implementation("io.github.blackmo18:kotlin-shopify-authentication-jvm:0.1.0")
<dependency>
<groupId>io.github.blackmo18</groupId>
<artifactId>kotlin-shopify-authentication-jvm</artifactId>
<version>0.1.0</version>
</dependency>
val SHOPIFY_CONTEXT = authenticationSetup {
apiKey = "your_app_key"
apiSecret = "your_app_api_secret_key"
host = "your_server_host_url"
scopes = listOf( // declare your access scopes here
"read_products",
"write_products",
"read_customers",
"read_orders",
"write_orders",
"read_fulfillments",
"read_checkouts",
"read_locations",
"read_draft_orders",
"read_shopify_payments_disputes",
"read_script_tags",
"write_script_tags"
)
accessType="offline" // declare you access whether online or offline
}
val WEBHOOK_SETUP = webhookInstallationSetup(SHOPIFY_CONTEXT) {
topics = listOf(
"carts/create",
"carts/update"
...
)
}
a.) authenticateInstall(callingURL: String)
validates incoming request from shopify and exposes a callback function that determines whether the request is valid.
isValid
flag wether the call is validredirect
should be returned if the call is validb.) onInstallRedirect(callingURL: String)
validates incoming request from shopify on app install, determines whether the request is valid.
isValid
redirect
should be returned if the call is valid or override redirect urlc.) registerHooks(shopAccessToken: String, shopDomain: String)
register all webhook topics declared in Webhook Setup
a.) note that when a webhook is created, it will register the endpoint to the following format to shopify
{your url HOST}/api/webhook/{webhook_topic}
so you must CAREFULLY match your endpoint to the latter format
b.) ShopifyAuthUtils.validateWebhookCall(payload: String, apiSecret: String, hmac: String)
validates whether the incoming webhook call actually came from shopify
routing {
get("/") {
SHOPIFY_CONTEXT.authenticateInstall(call.request.uri) { isValid, redirect ->
when {
isValid -> call.respondRedirect(redirect!!)
else -> call.response.status(HttpStatusCode.Unauthorized)
}
}
}
get("/auth/callback") {
val response = SHOPIFY_CONTEXT.onInstallRedirect(call.request.uri) {
isAuthenticated, redirect ->
when {
isAuthenticated -> call.respondRedirect(redirect!!)
else -> call.response.status(HttpStatusCode.Unauthorized)
}
}
when (response.code) {
ResponseStatus.SUCCESS -> {
response.data?.run { WEBHOOK_SETUP.registerHooks(access_token, shop) }
}
else -> {
TODO("nothing")
}
}
}
post("/api/webhook/carts/create") {
val hmac = call.request.headers["x-shopify-hmac-sha256"]
val payload = call.receiveText()
val validated = ShopifyAuthUtils.validateWebhookCall(payload, SHOPIFY_CONTEXT.apiSecret, hmac!!)
when {
validated -> {
call.respond("ok")
println("validated carts/create api call")
}
else -> {
call.response.status(HttpStatusCode.Unauthorized)
println("invalidated carts/create api call")
}
}
}
}
FAQs
Unknown package
We found that io.github.blackmo18:kotlin-shopify-authentication-jvm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10.12.1 introduces a global virtual store for faster installs and new options for managing dependencies with version catalogs.
Security News
Amaro 1.0 lays the groundwork for stable TypeScript support in Node.js, bringing official .ts loading closer to reality.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.