App proxy utils

[hillairet]

Let's add the necessary tooling to handle Shopify's app proxy calls.
As far as I know the only thing really needed is the HMAC validation of the signature.
What I don't know is if it is the same as the HMAC validation for oauth and webhooks? Are oauth and webhooks even using the same HMAC format????

Also it would be good to provide a function that could be used as Dependency injection in the FastAPI endpoints. Again I don't know if this should be specific to the service (app proxy, oauth, webhook) or if we can have a generic one for all services.

[Nathan-Nesbitt]

Just a quick search, the implementation of the proxy request hmac appears to follow the same logic of Oauth. Assuming that the gist is also correct, we should be able to share these methods between oauth and proxy.

Apparently webhooks do not use the same type of HMAC verification.

[Nathan-Nesbitt]

Also @hillairet depending on the use case we could also write middleware instead which would simply run and validate before running any functions? Let me know and I will write up either one.

[hillairet]

Not sure we have to do one or the other actually. All we need to do is make a function for the Depends interface and one for the middleware interface. These two functions would then call the function that actually processing of the session token.
I guess for the middleware the user will have to do:

from spylib import session_token_middleware

app.middleware('http')(session_token_middleware)

If it's not clear why this call, well you can ask more at the next BKS where I'm gonna talk about decorators.

[hillairet]

Oh actually one reason to do one or the other could be the OpenAPI docs generated by FastAPI. Not sure how they compare between Depends and Middleware ...

[Nathan-Nesbitt]

Just been trying to figure this out, we need the client secret to check the signature on the response. Should we provide all the checking and parsing as a function and leave it at that and force the user to decide on the implementation?

Just can't think of a nice way of formatting this for either the middleware or the dependencies. Or maybe I'm just overlooking something!

[hillairet]

How about you make a quick test with the dependency, with a basic function that always return the same thing and see how it looks in OpenAPI?
I'm thinking that dependencies may actually generate useful docs. Or maybe middleware ... I don't know ... 😣

[qw-in]

See discussion in #111