Initial commit

Author: Jamie Dwyer

.gitignore

@@ -0,0 +1 @@
+.env

Gemfile

@@ -0,0 +1,6 @@
+source 'https://rubygems.org'
+
+gem 'sinatra'
+gem 'httparty'
+gem 'shopify_api', '~> 4.0.7'
+gem 'dotenv'

app.rb

@@ -0,0 +1,145 @@
+require 'shopify_api'
+require 'sinatra'
+require 'httparty'
+require 'dotenv'
+
+class GiftBasket < Sinatra::Base
+
+  def initialize
+    Dotenv.load
+    @key = ENV['API_KEY']
+    @secret = ENV['API_SECRET']
+    @app_url = "jamied.ngrok.io"
+    @tokens = {}
+    super
+  end
+
+  get '/giftbasket/install' do
+    shop = request.params['shop']
+    scopes = "read_orders,read_products,write_products"
+
+    # construct the installation URL and redirect the merchant
+    install_url = "http://#{shop}/admin/oauth/authorize?client_id=#{@key}"\
+                "&scope=#{scopes}&redirect_uri=https://#{@app_url}/giftbasket/auth"
+
+    redirect install_url
+  end
+
+  get '/giftbasket/auth' do
+    # extract shop data from request parameters
+    shop = request.params['shop']
+    code = request.params['code']
+    hmac = request.params['hmac']
+
+    # perform hmac validation to determine if the request is coming from Shopify
+    h = request.params.reject{|k,_| k == 'hmac' || k == 'signature'}
+    query = URI.escape(h.sort.collect{|k,v| "#{k}=#{v}"}.join('&'))
+    digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), @secret, query)
+
+    if not (hmac == digest)
+      return [403, "Authentication failed. Digest provided was: #{digest}"]
+    end
+
+    # if we don't have an access token for this particular shop,
+    # we'll post the OAuth request and receive the token in the response
+    if @tokens[shop].nil?
+      url = "https://#{shop}/admin/oauth/access_token"
+
+      payload = {
+        client_id: @key,
+        client_secret: @secret,
+        code: code}
+
+      response = HTTParty.post(url, body: payload)
+
+      # if the response is successful, obtain the token and store it in a hash
+      if response.code == 200
+        @tokens[shop] = response['access_token']
+      else
+        return [500, "Something went wrong."]
+      end
+    end
+
+    # now that we have the token, we can instantiate a session
+    session = ShopifyAPI::Session.new(shop, @tokens[shop])
+    ShopifyAPI::Base.activate_session(session)
+
+    # create webhook for order creation if it doesn't exist
+    if not ShopifyAPI::Webhook.find(:all).any?
+      webhook = {
+        topic: 'orders/create',
+        address: "https://#{@app_url}/giftbasket/webhook/order_create",
+        format: 'json'}
+
+      ShopifyAPI::Webhook.create(webhook)
+    end
+
+    # redirect the merchant to the bulk editor
+    bulk_edit_url = "https://www.shopify.com/admin/bulk"\
+                    "?resource_name=ProductVariant"\
+                    "&edit=metafields.test.ingredients:string"
+
+    redirect bulk_edit_url
+
+  end
+
+  helpers do
+    def verify_webhook(hmac, data)
+      digest = OpenSSL::Digest.new('sha256')
+      calculated_hmac = Base64.encode64(OpenSSL::HMAC.digest(digest, @secret, data)).strip
+
+      hmac == calculated_hmac
+    end
+  end
+
+  post '/giftbasket/webhook/order_create' do
+    # inspect hmac value in header and verify webhook
+    hmac = request.env['HTTP_X_SHOPIFY_HMAC_SHA256']
+
+    request.body.rewind
+    data = request.body.read
+    webhook_ok = verify_webhook(hmac, data)
+
+    if webhook_ok
+      shop = request.env['HTTP_X_SHOPIFY_SHOP_DOMAIN']
+      token = @tokens[shop]
+
+      if not token.nil?
+        session = ShopifyAPI::Session.new(shop, token)
+        ShopifyAPI::Base.activate_session(session)
+      else
+        return [403, "You're not authorized to perform this action."]
+      end
+    else
+      return [403, "You're not authorized to perform this action."]
+    end
+
+    # parse the request body as JSON data
+    json_data = JSON.parse data
+
+    line_items = json_data['line_items']
+
+    line_items.each do |line_item|
+      variant_id = line_item['variant_id']
+
+      variant = ShopifyAPI::Variant.find(variant_id)
+
+      variant.metafields.each do |field|
+        if field.key == 'ingredients'
+          items = field.value.split(',')
+
+          items.each do |item|
+            gift_item = ShopifyAPI::Variant.find(item)
+            gift_item.inventory_quantity = gift_item.inventory_quantity - 1
+            gift_item.save
+          end
+        end
+      end
+    end
+
+    return [200, "Webhook notification received successfully."]
+  end
+
+end
+
+run GiftBasket.run!