Page Comparison

...

Requirement Gathering:
- Plugin Dashboard Repo - Local Dev Setup & Research.
  - Develop overview of system.
  - Define system purpose.
- Shopify Dashboard & Research.
  - Develop overview of Shopify system.
  - Define Shopify requirements.
Planning & Design:
The plugin is broken down into components, namely:
1. Shopify Admin App Setup
2. DB Schema
3. App install
4. App uninstall
5. App Configuration

Implementation:

Plugin Dashboard Repo - Local Dev Setup & Research.

Setup environment to develop - environment specifics needed for the repo to work.

RabbitMQ : Add settings.

Docker-Compose file:

Code Block

  rabbitmq:
    image: rabbitmq:3.8
    container_name: plugindashboard_rabbitmq
    ports:
      - "5672:5672"
      - "15672:15672"
    healthcheck:
      test: ["CMD", "rabbitmqctl", "status"]
      interval: 30s
    restart: unless-stopped
    volumes:
      - ../shared-data/rabbitmq:/var/lib/rabbitmq

Docker-Compose and Parameters file need to have the App’s Client Id & Client Secret added.
Both are Hex value strings.

Docker-Compose file:

Code Block
NETCOMM_API_KEY: 2de2b028c0c30db8de8e44c5bacfd5ed NETCOMM_API_SECRET: c3c5932fa8aeb97b80eddf132bc11abf

Parameters file:

Code Block
netcomm_api_key: '%env(NETCOMM_API_KEY)%' netcomm_api_secret: '%env(NETCOMM_API_SECRET)%'

So based upon our tech stack it seems like we actually just use the PHP library / dependancy to intergrate the app with Shopify.
1. Composerr.json → "phpclassic/php-shopify": "~1.0",
  https://github.com/phpclassic/php-shopify.git

Shopify Dashboard & Research.

Learn what Shopify requires and how to do development with them.
Shopify PHP - https://github.com/Shopify/shopify-api-php
https://shopify.dev/docs/apps/launch/app-requirements-checklist
https://shopify.dev/docs/api/app-bridge

Shopify app authentication and authorization.
https://shopify.dev/docs/apps/build/authentication-authorization
https://shopify.dev/docs/apps/build/authentication-authorization/set-embedded-app-authorization?extension=javascript

Authentication is the process of verifying the identity of the user or the app. To keep transactions on Shopify’s platform safe and secure, all apps connecting with Shopify APIs must authenticate when making API requests.
Authorization is the process of giving permissions to apps. When an app user installs a Shopify app they authorize the app, enabling the app to acquire an access token. For example, an app might be authorized to access orders and product data in a store.
Outline of the Shopify Auth process:
1. Create a route for starting the OAuth method such as /installAction.
2. In this route, the Shopify\Auth\OAuth::begin method will be used.
3. The begin method returns a URL that will be used for redirecting the user to the Shopify Authentication screen to complete the OAuth process, your app needs to validate the callback request made by Shopify after the merchant authorizes your app to access their store data.
4. To do that, you can call the Shopify\Auth\OAuth::callbackAction method in the endpoint defined in the redirectPath argument of the begin method.
In the Shopify App Dashboard Configuration Settings these must be added for installation and authentication (The callback verification):
1. App URL
2. Preferences URL (optional)
3. Allowed redirection URL(s)
Compliance Webhooks that Shopify requires to be registered.
Every app that's distributed through the Shopify App Store must subscribe to the following compliance webhook topics in the Partner Dashboard:
1. Customer data request endpoint - customers/data_request - Requests to view stored customer data.
2. Customer data erasure endpoint - customers/redact - Requests to delete customer data.
3. Shop data erasure endpoint - shop/redact - Requests to delete shop data.
  When you receive one of the compliance webhooks, you need to take the following actions:
  - Confirm that you've received the request by responding with a 200 series status code.
  - Complete the action within 30 days of receiving the request. However, if you're unable to comply with a redaction request because you're legally required to retain data, then you shouldn't complete the action.

Security requirements:
Security header to only allow iframes to work in the provided domains.

Code Block
// Setting this directive guarantees that your app can be framed only within the shop admin. header("Content-Security-Policy: frame-ancestors " . $secureShopUrl . " https://admin.shopify.com;");

Shopify - Ngrok.
In the Shopify ecosystem, embedded apps run in an iframe in a production environment. In order to test the functionality of your app within that context in development, you’re going to want to tunnel what you have running locally to an accessible URL.
1. https://ngrok.com/
2. Setup Ngrok for local development with Shopify platform.
  1. Set the Ngrok URL as the URL for your webhook call backs in Shopify Admin.
  2. Customer data request endpoint → https://a80d-41-193-138-209.ngrok-free.app/netcomm/customers/data_request

DB Schema
Create Table: netcomm_configuration
Advised to have the user_id and other fields as they will probably part of a plan or future relationship.

Install - Process definition:

Install requires registration as an app provider.
1. Checks by the Shopify shop URL if it exists, if not then proceeds with installation.
  "shopUrl": "uextension.myshopify.com",
  "secureShopUrl": "https:\\/\\/uextension.myshopify.com",
Authentication process and Token exchange.
1. Retrieves the hmac & host & timestamp GET variable fields to prepare for authentication.
  "hmac": "67265c0683abeab279465c633ccb98ed86bebe456cf396189e6283c61665b78d",
  "host": "YWRtaW4uc2hvcGlmeS5jb20vc3RvcmUvdWV4dGVuc2lvbg",
  "timestamp": "1720782483"

The app registers within Shopify and Customer’s shop.
Creates the App’s auth package with the new shop URL and a new Auth request.

Code Block

// Shopify Netcomm App ID & Key & URL
$appConfig = $this->getNetcommAppConfig($secureShopUrl);
            
// Creates static configuration for Shopify
$shopifySdk = ShopifySDK::config($appConfig);

// Auth calls static ShopifySDK config set earlier. This should redirect after the auth request is approved.
AuthHelper::createAuthRequest(self::APP_SCOPES, $redirectUrl);

The auth request goes to Shopify which verifies and redirects the user to login and then passes the request to the call back callback method which will receive the Access Token and register the necessary webhooks with shopify retrieving a ID for each.

Privilege establishment.
Privileges are requested during authentication the result is a a install modal from Shopify asking user to approve the App’s privilege request.

Persists to DB.
Once Install is clicked then the Shopify shop details will be stored in the DB, and the user redirected to the Netcomm & eKomi Configuration Page to complete installation.
After the user has clicked the install button then Shopify sends a request to our callbackAction to register all the webhooks through a Curl request.
Important header information:

Code Block
curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'X-Shopify-Access-Token: ' . $accessToken, 'Accept: application/json', 'Content-Type: application/json' ]);

Uninstall
1. Authentication process and Token exchange.
2. The app un-registers within Shopify and Customer shop.
3. Deletes from DB.
  Link to Uninstall process flowThe same process as the install but in reverse order.
Configuration CRUD
1. Configuration settings. App requires configuring.
  Options are provided to be either an eKomi client or Netcomm or both.
  1. eKomi Client settings:
    1. ShopId
    2. Shop Interface Password
  2. Netcomm Client settings:
    1. NetcommId
2. App configuration will be persisted in the DB.
  CRUD functionality.
  Link to Configuration process flow.
Refactor / Testing Phase.
Identify issues and refactor
Documentation / Commenting.
1. Document Shopify requirements for apps.
2. Explain where app meets requirements.
3. Comment functions and classes.

...

Versions Compared

Old Version 30

New Version 31

Key