$ show Shopify/shopify_app
Shopify/shopify_app is a Ruby on Rails engine gem (v23.0.3, MIT) that provides the foundational integration layer for building Shopify Apps. It handles OAuth 2.0 authentication with both legacy and new embedded-API token exchange flows, session management (online/offline with access scopes), webhook registration and verification, script tag management, billing, and App Bridge support. The gem ships with dozens of Rails generators to scaffold models, controllers, jobs, views, and routes tailored to embedded and non-embedded app patterns. Architecture is a mounted engine with mixin-based controller concerns (e.g., LoginProtection, EnsureHasSession, WebhookVerification) and configurable session storage backends (default ActiveRecord via host app models, with in-memory stores for development). Key data flows: the app directs users through Shopify OAuth, stores session tokens (with automatic refresh for expiring tokens), then uses the Shopify API (via shopify_api gem) for authenticated calls. The codebase demonstrates disciplined Rails engine design, robust security practices (HMAC verification, CSP, CSRF protection, sanitized redirects), and strong test coverage with 300+ test files. Notable craftsmanship includes the session storage mixins (ShopSessionStorage, UserSessionStorage) that separate concerns via method injection, the access-scope verification strategies, and the full-page redirect pattern for embedded apps. Maintenance is active—despite some doc-coverage inconsistencies (e.g., deprecated modules still tested) and two coexisting auth strategies that add conditional complexity, the gem tracks modern Shopify API versions and Ruby/Rails requirements (>= 3.2 / >= 7.1). The large generator surface and i18n support (20 locales) show attention to developer experience.
The LLM identified 3 files worth highlighting for reuse:
Implements HMAC-SHA256 verification for incoming Shopify webhooks, supporting both old and new secrets for seamless credential rotation. The concern is includable in any controller handling Shopify webhook payloads—it extracts the HMAC from the X-Shopify-Hmac-SHA256 header, hashes the request body with the configured shared secret, and compares using a constant-time comparison (ActiveSupport::SecurityUtils.secure_compare). It also handles the case where the webhook may be verified upstream (e.g., by a proxy) via config.skip_before_action. The pattern is reusable in any Rails app that processes Shopify webhooks, with minimal coupling to the gem's session infrastructure.
Defines the contract and default behavior for persisting shop sessions (offline and online). It provides methods store, retrieve, destroy_by_shopify_domain, with_shopify_session, and automatic token refresh when an offline session is about to expire. The module uses Ruby metaprogramming to check if the host model has certain attributes (e.g., expires_at, access_scopes) and conditionally includes columns. This allows a host app's Shop model to include the concern and automatically gain session persistence without duplicating logic. The pattern is a clean example of mixin-based storage abstraction that can be reused in any Rails app needing Shopify session storage.
A null-object strategy for access scope verification. It implements a minimal interface (any_scope_in_required_scopes? and update_required_scopes?) that always returns true or does nothing, effectively disabling scope-change detection. This is useful when an app does not care about scope changes, or for testing. The class demonstrates the strategy pattern cleanly—host apps can replace it with custom strategies (e.g., ShopStrategy, UserStrategy) without changing the verification flow. It is fully isolated, depends only on the gem's configuration, and can be extracted and reused in any app that needs to conditionally skip scope checking.