Fix/installation path with admin auth plug

CHANGELOG.md

@@ -1,5 +1,7 @@
 ## Unreleased
 
+- Fix: 0.16.2 broke the installation path when no JWT was passed along
+
 ## 0.16.2
 
 - BREAKING: Reworked Plugs.AdminAuthenticator to use the new JWT Session functions, this breaks the old redirect for exchanging sessions on install

lib/shopify_api/config.ex

@@ -3,4 +3,11 @@ defmodule ShopifyAPI.Config do
 
   def lookup(key), do: Application.get_env(:shopify_api, key)
   def lookup(key, subkey), do: Application.get_env(:shopify_api, key)[subkey]
+
+  @spec app_name() :: String.t() | nil
+  @spec app_name(Plug.Conn.t(), keyword()) :: String.t() | nil
+  def app_name, do: lookup(:app_name)
+
+  def app_name(%Plug.Conn{path_info: path_info}, opts \\ []),
+    do: Keyword.get(opts, :app_name) || app_name() || List.last(path_info)
 end

lib/shopify_api/plugs/admin_authenticator.ex

@@ -48,9 +48,9 @@ defmodule ShopifyAPI.Plugs.AdminAuthenticator do
     end
   end
 
-  defp do_authentication(conn, _options) do
-    token = conn.params["id_token"]
-
+  # User auth
+  defp do_authentication(%{params: %{"id_token" => token}} = conn, _options)
+       when is_binary(token) do
     with {:ok, app} <- JWTSessionToken.app(token),
          {true, jwt, _jws} <- JWTSessionToken.verify(token, app.client_secret),
          :ok <- validate_hmac(app, conn.query_params),
@@ -76,6 +76,38 @@ defmodule ShopifyAPI.Plugs.AdminAuthenticator do
     end
   end
 
+  # Offline token auth OR new install
+  defp do_authentication(conn, options) do
+    myshopify_domain = conn.params["shop"]
+    app_name = ShopifyAPI.Config.app_name(conn, options)
+    {:ok, app} = ShopifyAPI.AppServer.get(app_name)
+
+    with :ok <- validate_hmac(app, conn.query_params),
+         {:ok, shop} <- ShopifyAPI.ShopServer.get_or_create(myshopify_domain, true),
+         {:ok, auth_token} <- ShopifyAPI.AuthTokenServer.get(myshopify_domain, app_name) do
+      conn
+      |> assign_app(app)
+      |> assign_shop(shop)
+      |> assign_auth_token(auth_token)
+    else
+      {:error, :invalid_hmac} ->
+        Logger.info("#{__MODULE__} failed hmac validation")
+
+        conn
+        |> Conn.resp(401, "Not Authorized.")
+        |> Conn.halt()
+
+      _err ->
+        oauth_url = ShopifyAPI.shopify_oauth_url(app, myshopify_domain)
+        Logger.info("redirecting to Shop oauth url: #{oauth_url}")
+
+        conn
+        |> Conn.put_resp_header("location", oauth_url)
+        |> Conn.resp(unquote(302), "You are being redirected.")
+        |> Conn.halt()
+    end
+  end
+
   defp should_do_authentication?(conn), do: has_hmac(conn.query_params) == :ok
 
   defp assign_app(conn, app), do: Conn.assign(conn, :app, app)