From d20fee07799cd2a784354f90101dcb4891529541 Mon Sep 17 00:00:00 2001 From: Melanie Wang Date: Tue, 16 Mar 2021 10:52:01 -0400 Subject: [PATCH] Update method to use grant_options --- README.md | 2 +- lib/shopify_api/session.rb | 1 + test/session_test.rb | 16 ++++++++++++++++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 125fbb05b..e35cffcce 100644 --- a/README.md +++ b/README.md @@ -149,7 +149,7 @@ Under the hood, the `create_permission_url` method is preparing the app to make * ``scope`` – Required – The list of required scopes (explained here: https://shopify.dev/tutorials/authenticate-with-oauth#scopes) * ``redirect_uri`` – Required – The URL where you want to redirect the users after they authorize the client. The complete URL specified here must be identical to one of the Application Redirect URLs set in the app's section of the Partners dashboard. * ``state`` – Optional – A randomly selected value provided by your application, which is unique for each authorization request. During the OAuth callback phase, your application must check that this value matches the one you provided during authorization. [This mechanism is essential for the security of your application](https://tools.ietf.org/html/rfc6819#section-3.6). - * ``grant_options[]`` - Optional - Set this parameter to `per-user` to receive an access token that respects the user's permission level when making API requests (called online access). We strongly recommend using this parameter for embedded apps. + * ``grant_options`` - Optional - Set this parameter to `per-user` to receive an access token that respects the user's permission level when making API requests (called online access). We strongly recommend using this parameter for embedded apps. ### 4) Trading your `code` for an access token. diff --git a/lib/shopify_api/session.rb b/lib/shopify_api/session.rb index 61206a4d0..3a62995f6 100644 --- a/lib/shopify_api/session.rb +++ b/lib/shopify_api/session.rb @@ -103,6 +103,7 @@ def initialize(domain:, token:, access_scopes: nil, api_version: ShopifyAPI::Bas def create_permission_url(scope, redirect_uri, options = {}) params = { client_id: api_key, scope: ShopifyAPI::ApiAccess.new(scope).to_s, redirect_uri: redirect_uri } params[:state] = options[:state] if options[:state] + params["grant_options[]".to_sym] = options[:grant_options] if options[:grant_options] construct_oauth_url("authorize", params) end diff --git a/test/session_test.rb b/test/session_test.rb index 204bc142e..aa31ac7f2 100644 --- a/test/session_test.rb +++ b/test/session_test.rb @@ -338,6 +338,22 @@ def setup ) end + test "create_permission_url returns correct url with grant_options[]" do + ShopifyAPI::Session.setup(api_key: "My_test_key", secret: "My test secret") + session = ShopifyAPI::Session.new( + domain: 'http://localhost.myshopify.com', + token: 'any-token', + api_version: any_api_version + ) + scope = [] + permission_url = session.create_permission_url(scope, "http://my_redirect_uri.com", grant_options: "per-user") + assert_equal( + "https://localhost.myshopify.com/admin/oauth/authorize?client_id=My_test_key&" \ + "scope=&redirect_uri=http://my_redirect_uri.com&grant_options[]=per-user", + permission_url + ) + end + test "raise exception if code invalid in request token" do ShopifyAPI::Session.setup(api_key: "My test key", secret: "My test secret") session = ShopifyAPI::Session.new(