Adding APP_UNINSTALLED webhook

app/Http/Middleware/VerifyCsrfToken.php

@@ -11,7 +11,8 @@ class VerifyCsrfToken extends Middleware
      *
      * @var array
      */
-    protected $except = ['graphql'
-        //
+    protected $except = [
+        'graphql',
+        'webhooks',
     ];
 }

app/Lib/Handlers/AppUninstalled.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Lib\Handlers;
+
+use Illuminate\Support\Facades\Log;
+use Shopify\Webhooks\Handler;
+use App\Models\Session;
+
+class AppUninstalled implements Handler
+{
+    public function handle(string $topic, string $shop, array $body): void
+    {
+        Log::debug("App was uninstalled from $shop - removing all sessions");
+        Session::where('shop', $shop)->delete();
+    }
+}

app/Providers/AppServiceProvider.php

@@ -3,9 +3,12 @@
 namespace App\Providers;
 
 use App\Lib\DbSessionStorage;
+use App\Lib\Handlers\AppUninstalled;
 use Illuminate\Support\ServiceProvider;
-use Shopify\Context;
 use Illuminate\Support\Facades\URL;
+use Shopify\Context;
+use Shopify\Webhooks\Registry;
+use Shopify\Webhooks\Topics;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -36,5 +39,7 @@ public function boot()
         );
 
         URL::forceScheme('https');
+
+        Registry::addHandler(Topics::APP_UNINSTALLED, new AppUninstalled());
     }
 }

routes/web.php

@@ -7,8 +7,11 @@
 use Illuminate\Support\Facades\Cookie;
 use Illuminate\Support\Facades\Log;
 use Shopify\Context;
-use Shopify\Auth\OAuth;
 use Shopify\Utils;
+use Shopify\Auth\OAuth;
+use Shopify\Clients\HttpHeaders;
+use Shopify\Webhooks\Registry;
+use Shopify\Webhooks\Topics;
 
 /*
 |--------------------------------------------------------------------------
@@ -82,17 +85,45 @@ function(Shopify\Auth\OAuthCookie $cookie) {
 });
 
 Route::get('/auth/callback', function (Request $request) {
-    Log::info($request->cookie(OAuth::SESSION_ID_COOKIE_NAME));
-    OAuth::callback(
-        [OAuth::SESSION_ID_COOKIE_NAME => $request->cookie(OAuth::SESSION_ID_COOKIE_NAME)],
-        $request->query()
-    );
+    $session = OAuth::callback($request->cookie(), $request->query());
+
     $host = $request->query('host');
     $shop = Utils::sanitizeShopDomain($request->query('shop'));
+
+    $response = Registry::register(
+        path: '/webhooks',
+        topic: Topics::APP_UNINSTALLED,
+        shop: $shop,
+        accessToken: $session->getAccessToken(),
+    );
+    if ($response->isSuccess()) {
+        Log::debug("Registered APP_UNINSTALLED webhook for shop $shop");
+    } else {
+        Log::error(
+            "Failed to register APP_UNINSTALLED webhook for shop $shop with response body: " .
+            print_r($response->getBody(), true)
+        );
+    }
+
     return redirect("?" . http_build_query(['host' => $host, 'shop' => $shop]));
 });
 
 Route::post('/graphql', function (Request $request) {
     $result = Utils::graphqlProxy($request->header(), $request->cookie(), $request->getContent());
     return response($result->getDecodedBody())->withHeaders($result->getHeaders());
 });
+
+Route::post('/webhooks', function (Request $request) {
+    try {
+        $topic = $request->header(HttpHeaders::X_SHOPIFY_TOPIC, '');
+
+        $response = Registry::process($request->header(), $request->getContent());
+        if (!$response->isSuccess()) {
+            Log::error("Failed to process '$topic' webhook: {$response->getErrorMessage()}");
+            return response()->json(['message' => "Failed to process '$topic' webhook"], 500);
+        }
+    } catch (\Exception $e) {
+        Log::error("Got an exception when handling '$topic' webhook: {$e->getMessage()}");
+        return response()->json(['message' => "Got an exception when handling '$topic' webhook"], 500);
+    }
+});

tests/Feature/CallbackTest.php

@@ -37,6 +37,14 @@ class CallbackTest extends BaseTestCase
         ],
     ];
 
+    private array $webhookCheckEmpty = [
+        'data' => [
+            'webhookSubscriptions' => [
+                'edges' => [],
+            ],
+        ],
+    ];
+
     public function testCallBackForOfflineSession()
     {
         $offlineSession = new Session(
@@ -49,22 +57,21 @@ public function testCallBackForOfflineSession()
         // Session is already stored in the OAuth::begin
         Context::$SESSION_STORAGE->storeSession($offlineSession);
 
-        $client = $this->mockClient();
-
+        $oauthTokenUrl = "https://test-shop.myshopify.io/admin/oauth/access_token";
+        $graphqlUrl = "https://test-shop.myshopify.io/admin/api/unstable/graphql.json";
 
-        $client->expects($this->exactly(1))
+        $client = $this->mockClient();
+        $client->expects($this->exactly(3))
             ->method('sendRequest')
-            ->with(
-                $this->callback(
-                    fn($request) => $request->getUri() == "https://test-shop.myshopify.io/admin/oauth/access_token"
-                )
+            ->withConsecutive(
+                [$this->callback(fn($request) => $request->getUri() == $oauthTokenUrl)],
+                [$this->callback(fn($request) => $request->getUri() == $graphqlUrl)],
+                [$this->callback(fn($request) => $request->getUri() == $graphqlUrl)],
             )
-            ->willReturn(
-                new Response(
-                    status: 200,
-                    headers: [],
-                    body: json_encode($this->offlineResponse)
-                )
+            ->willReturnOnConsecutiveCalls(
+                new Response(status: 200, headers: [], body: json_encode($this->onlineResponse)),
+                new Response(status: 200, headers: [], body: json_encode($this->webhookCheckEmpty)),
+                new Response(status: 200, headers: [], body: '[]'),
             );
 
         $query = $this->requestQueryParameters();
@@ -107,21 +114,21 @@ public function testCallBackForOnlineSession()
 
         Context::$SESSION_STORAGE->storeSession($onlineSession);
 
-        $client = $this->mockClient();
+        $oauthTokenUrl = "https://test-shop.myshopify.io/admin/oauth/access_token";
+        $graphqlUrl = "https://test-shop.myshopify.io/admin/api/unstable/graphql.json";
 
-        $client->expects($this->exactly(1))
+        $client = $this->mockClient();
+        $client->expects($this->exactly(3))
             ->method('sendRequest')
-            ->with(
-                $this->callback(
-                    fn($request) => $request->getUri() == "https://test-shop.myshopify.io/admin/oauth/access_token"
-                )
+            ->withConsecutive(
+                [$this->callback(fn($request) => $request->getUri() == $oauthTokenUrl)],
+                [$this->callback(fn($request) => $request->getUri() == $graphqlUrl)],
+                [$this->callback(fn($request) => $request->getUri() == $graphqlUrl)],
             )
-            ->willReturn(
-                new Response(
-                    status: 200,
-                    headers: [],
-                    body: json_encode($this->onlineResponse)
-                )
+            ->willReturnOnConsecutiveCalls(
+                new Response(status: 200, headers: [], body: json_encode($this->onlineResponse)),
+                new Response(status: 200, headers: [], body: json_encode($this->webhookCheckEmpty)),
+                new Response(status: 200, headers: [], body: '[]'),
             );
 
         $query = $this->requestQueryParameters();

tests/Feature/WebhookTest.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use PHPUnit\Framework\MockObject\MockObject;
+use Shopify\Clients\HttpHeaders;
+use Shopify\Context;
+use Shopify\Webhooks\Handler;
+use Shopify\Webhooks\Registry;
+use Shopify\Webhooks\Topics;
+
+class WebhookTest extends BaseTestCase
+{
+    use RefreshDatabase;
+
+    private string $domain = "test-shop.myshopify.io";
+
+    public function testWebhookIsProcessed()
+    {
+        $shop = $this->domain;
+        $topic = Topics::APP_UNINSTALLED;
+        $body = ['dummy' => 'data'];
+
+        /** @var MockObject|Handler */
+        $mock = $this->getMockBuilder(Handler::class)
+            ->getMock();
+        $mock->expects($this->once())
+            ->method('handle')
+            ->with($topic, $shop, $body);
+
+        Registry::addHandler($topic, $mock);
+
+        $hmac = base64_encode(hash_hmac('sha256', json_encode($body), Context::$API_SECRET_KEY, true));
+        $response = $this
+            ->json(
+                method: 'POST',
+                uri: "/webhooks",
+                data: $body,
+                headers: [
+                    HttpHeaders::X_SHOPIFY_TOPIC => $topic,
+                    HttpHeaders::X_SHOPIFY_DOMAIN => $shop,
+                    HttpHeaders::X_SHOPIFY_HMAC => $hmac,
+                ],
+            );
+
+        $response->assertStatus(200);
+    }
+}