OAuth and webhooks when using Shopify CLI #81

NexPB · 2025-03-19T11:47:28Z

These days Shopify is pushing the CLI hard esp. when you follow their dev guides. These changes allow you get get going with the CLI more quickly when using shopifex. (PR is in draft as I would like to get some feedback)

Key changes

Optional webhook topic config: when using the CLI webhooks are managed out of the box
OAuth flow: Shopify assumes the app to have a route at /auth/callback (when using automatically_update_urls_on_dev)

I had trouble with the app not rendering (upon install) after the oauth flow had finished, I assume because it was embedded and required the app bridge redirect flow so I've made changes to account for that.

NexPB · 2025-03-19T11:48:23Z

lib/shopifex/oauth.ex

+    # https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens/authorization-code-grant#check-for-and-escape-the-iframe-embedded-apps-only
+    if Map.get(conn.params, "embedded") == "1" do
+      conn
+      |> Phoenix.Controller.put_layout(html: {ShopifexWeb.LayoutView, :app})


Using phoenix 1.7 syntax here as my app was complaining about not using this. Not sure how todo backwards compat here.

NexPB · 2025-03-19T11:49:22Z

lib/shopifex/plug.ex


-  def current_shopify_host(_), do: nil
+  def current_shopify_host(conn) do
+    Map.get(conn.params, "host")


This will allow the app bridge to render during install redirect as host is required

NexPB · 2025-03-19T11:49:45Z

lib/shopifex/plug/shopify_session.ex

      nil ->
-        redirect_to_install(conn, shop_url)
+        conn
+        |> redirect(to: "/initialize-installation?#{conn.query_string}")


Hardcoding this redirect doesn't feel quite right

ericdude4 · 2025-03-19T12:12:24Z

Looks really interesting at first glance. I will test it out in my own Shopify apps to see if there are any compatibility issues coming up. What was the rest of your setup in regards to using Shopify CLI alongside Shopifex?

lib/shopifex/oauth.ex

NexPB · 2025-03-19T13:13:56Z

What was the rest of your setup in regards to using Shopify CLI alongside Shopifex?

My folder structure basically is as seen here https://github.com/NexPB/phx-shopify-app-example
Important files are the Shopify cli config files generated by shopify app init:

https://github.com/NexPB/phx-shopify-app-example/blob/master/shopify/shopify.app.toml
https://github.com/NexPB/phx-shopify-app-example/blob/master/shopify/web/shopify.web.toml <- slightly modified to start a phoenix server

Afterwards I start the my local env using shopify app dev, does some Shopify stuff like setting up a cloudflare proxy and starting the phoenix app. The cli sets certain env vars which make it easy to configure your phoenix app using runtime.exs.

Hope that answers your question.

ericdude4 · 2025-03-19T17:51:52Z

That's really interesting! So you have your dev server running with shopify app dev and it takes care of updating the tunnel URLs on your development app and starts the phoenix dev server? This is a lot cleaner than what I've been doing all these years. To be honest I haven't looked at the Shopify CLI much since I figured it wouldn't work with my Phoenix stack.

I will review this more thoroughly soon, but this will definitely justify an update to the readme for this library.

NexPB · 2025-03-20T12:27:51Z

That's really interesting! So you have your dev server running with shopify app dev and it takes care of updating the tunnel URLs on your development app and starts the phoenix dev server?

Yeah makes things pretty seamless

but this will definitely justify an update to the readme for this library

I'll try adding that to the PR this weekend

NexPB · 2025-03-26T13:15:29Z

@ericdude4 I've added a section for the Shopify CLI at the end of the README

README.md

lib/shopifex/oauth.ex

lib/shopifex_web/controllers/auth_controller.ex

ericdude4

This looks really good. A few nit picky comments. I tried to review as thoroughly as possible without having used the CLI before. I really appreciate this contribution!!! I look forward to testing this out.

NexPB · 2025-04-01T11:23:59Z

lib/shopifex_web/routes.ex

+  ## Options
+
+  - `:cli` - If true, the callback route will be `/auth/callback` instead of `/auth/install`.


Seeing this option again I wonder if we can make this backwards compatible without needing an option at all 🤔
Since the install and update are pretty much the same as the callback apart from the different after_* callbacks.

Maybe just:

get "/install", unquote(controller), :callback get "/update", unquote(controller), :callback

is /auth/callback only used during development?

is /auth/callback only used during development?

I've replied below, but tldr it's used for all envs when using the CLI.

ericdude4 · 2025-04-01T11:50:09Z

lib/shopifex_web/routes.ex

+  - `:cli` - If true, the callback route will be `/auth/callback` instead of `/auth/install`.
+
+  """
+  defmacro auth_routes(controller \\ ShopifexWeb.AuthController, opts \\ []) do


I wonder if we could include this specification for ShopifexWeb.AuthController in the shopifex config. Then, it would simplify the usage of this macro in the router and we wouldn't have to hardcode the /initialize-installation route on https://github.com/ericdude4/shopifex/pull/81/files#r2003145269?

Do you mean something like config :shopifex, cli: true ?

I was thinking about something like config :shopifex, auth_controller: ShopifexWeb.AuthController. Then it could be overridden with ShopifexWeb.Routes.auth_routes(auth_controller: FooWeb.AuthController) if that's needed for some reason. This approach seems in line with what i see in other libraries.

Might be worthwhile to introduce a Shopifex.Config module which takes care of loading all the config and managing defaults, etc.

With this defined in a global config, then it would be easier to use something like a RouteHelper to generate the /initialize-installation route which is currently being harcoded.

ericdude4 · 2025-04-01T11:52:26Z

lib/shopifex_web/routes.ex

+        scope "/auth" do
+          pipe_through [:shopifex_browser, :validate_install_hmac]
+
+          get "/callback", unquote(controller), :callback


I'm curious about the difference between /auth/callback and /auth/install/update. Is one used during development by the Shopify CLI and the other is used in production?

For the CLI only /auth/callback is required generally only one route is used for both install and update. Hence those routes not really being used when using the CLI, thus being omited by the cli option but it does "complicate" the setup of shopifex as it would be easy to forget to add the option.

ericdude4 · 2025-04-01T11:54:40Z

There are a few places in the codebase where we mention deprecating things when updating to version 3.x. I wonder if we take this opportunity to release a new 3.x version of shopifex as a release candidate. I happen to be just starting to build a new app with Shopifex, so it would be a great way to test too.

NexPB · 2025-04-06T05:41:10Z

There are a few places in the codebase where we mention deprecating things when updating to version 3.x. I wonder if we take this opportunity to release a new 3.x version of shopifex as a release candidate. I happen to be just starting to build a new app with Shopifex, so it would be a great way to test too.

I did notice some changes that would benefit a 3.x release such as using some newer http libraries (I'm quite fond of tesla myself) instead of httpoison, I also noticed we pull in the neuron dep for a single graphql call I think this dep could ship with it's own simple client.

ericdude4 · 2025-04-07T12:54:01Z

There are a few places in the codebase where we mention deprecating things when updating to version 3.x. I wonder if we take this opportunity to release a new 3.x version of shopifex as a release candidate. I happen to be just starting to build a new app with Shopifex, so it would be a great way to test too.

I did notice some changes that would benefit a 3.x release such as using some newer http libraries (I'm quite fond of tesla myself) instead of httpoison, I also noticed we pull in the neuron dep for a single graphql call I think this dep could ship with it's own simple client.

@NexPB I think a 3.x release is a fantastic idea. I really appreciate your willingness to help with this!

I wonder if we create a Shopifex.HTTPClientBehaviour (get, post, delete, etc) then ship the library with a tesla implementation Shopifex.HTTPClient.Tesla. This would allow it to be mocked with mox more easily also allow someone to create another implementation with their own HTTP client library-of-choice. Have you seen this pattern in practice before?

Do you have discord? Maybe we can continue the conversation there?

NexPB · 2025-04-08T00:02:25Z

Do you have discord?

Yeah, my discord username is nexpb

jeffreyguenther · 2025-07-16T22:42:29Z

Following these changes. @NexPB your sample repo is quite helpful!

Has anyone been using things with the Phoenix 1.8 RCs?

NexPB · 2025-08-18T00:27:38Z

Has anyone been using things with the Phoenix 1.8 RCs?

Have only been using this with 1.7

pepicrft · 2025-09-21T16:21:06Z

What's the state of this? Will it get merged?

NexPB added 10 commits March 16, 2025 09:48

feat: optional webhook topics

a5cbaa6

feat: single callback url

45aea48

fix: params to atom keys

d208305

fix: use recommended redirect

8debd4a

fix: args rename

3b9ce3a

refactor: if else before quote

143571d

fix: 143571d

c3f040f

fix: use the correct plug in callback

e627aef

feat: redirect using shopify app bridge

638534a

refactor: oauth flow

05338df

NexPB commented Mar 19, 2025

View reviewed changes

ericdude4 reviewed Mar 19, 2025

View reviewed changes

lib/shopifex/oauth.ex Outdated Show resolved Hide resolved

refactor: pr feedback - move web-layer fns

20992c7

chore: readme shopify cli setup

8d3da88

ericdude4 reviewed Mar 26, 2025

View reviewed changes

README.md Show resolved Hide resolved

ericdude4 reviewed Mar 26, 2025

View reviewed changes

lib/shopifex/oauth.ex Outdated Show resolved Hide resolved

ericdude4 reviewed Mar 26, 2025

View reviewed changes

lib/shopifex_web/controllers/auth_controller.ex Outdated Show resolved Hide resolved

ericdude4 reviewed Mar 26, 2025

View reviewed changes

NexPB added 2 commits April 1, 2025 20:13

refactor: rename fn to exchange_code_for_access_token

f53ce4c

refactor: rename param to shop_url

7f89f07

NexPB commented Apr 1, 2025

View reviewed changes

docs: readme referrence shopify cli

a44da25

ericdude4 reviewed Apr 1, 2025

View reviewed changes

ericdude4 changed the base branch from master to v3 April 10, 2025 12:56

ericdude4 marked this pull request as ready for review April 11, 2025 20:10

		## Options

		- `:cli` - If true, the callback route will be `/auth/callback` instead of `/auth/install`.

OAuth and webhooks when using Shopify CLI #81

Are you sure you want to change the base?

OAuth and webhooks when using Shopify CLI #81

Uh oh!

Conversation

NexPB commented Mar 19, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NexPB Mar 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ericdude4 commented Mar 19, 2025

Uh oh!

Uh oh!

NexPB commented Mar 19, 2025

Uh oh!

ericdude4 commented Mar 19, 2025

Uh oh!

NexPB commented Mar 20, 2025

Uh oh!

NexPB commented Mar 26, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ericdude4 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NexPB Apr 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ericdude4 commented Apr 1, 2025

Uh oh!

NexPB commented Apr 6, 2025

Uh oh!

ericdude4 commented Apr 7, 2025

Uh oh!

NexPB commented Apr 8, 2025

Uh oh!

jeffreyguenther commented Jul 16, 2025

Uh oh!

NexPB commented Aug 18, 2025

Uh oh!

pepicrft commented Sep 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

NexPB Mar 19, 2025 •

edited

Loading

NexPB Apr 6, 2025 •

edited

Loading