jh dZddlZddlZddlZddlZddlZddlmZddlZddl m Z ddl m Z ejeZdZdZdZd eeeffd Zej,d Zd edzd efd Zdedzd edzfdZd efdZd eded efdZdZded efdZded efdZ ded efdZ!dZ"Gdde#Z$Gdde#Z%ejLdZ'ddd ed ed!ejPdzd efd"Z)ddd ed#ed!ejPdzd efd$Z*y)%zPure functions for the Shopify OAuth authorization code grant. No database access and no global state, so every security control here is unit-testable without infrastructure. N) urlencode)settings)get_platform_configz2026-07zread_products,read_inventoryshopifyreturnc tt}|r,|j dr|j dr |d|dfSt jt jfS#t$rtj ddd}YrwxYw)aClient credentials from platform_configs, falling back to the environment. platform_configs is where the other thirteen providers keep theirs, and rotating a secret in one place every service reads beats rotating a copy per service. The fallback exists so a missing row -- or an unreachable master database -- cannot break a working connector; do not delete it as dead code. z=platform_configs lookup failed; using environment credentialsT)exc_infoN client_id client_secret) rPLATFORM ExceptionloggerwarninggetrSHOPIFY_CLIENT_IDSHOPIFY_CLIENT_SECRET)cfgs F/var/www/html/strategist-ai/app/services/integrations/shopify_oauth.pyshopify_credentialsrs!(+  sww{#(@;_!555  % %x'E'E EE %/3  5sA"BBz,\A[a-zA-Z0-9][a-zA-Z0-9-]*\.myshopify\.com\ZshopcV|rt|tsytj|duS)z:True only for a well-formed .myshopify.com domain.FN) isinstancestrSHOP_REmatch)rs ris_valid_shop_domainr4s% z$, == d **rawc |rt|tsy|jj}t j dd|}|j dd}|sy|jds|d}t|r|SdS)aTurn what a merchant typed into a valid shop domain, or None. Merchants routinely enter their custom domain or a full admin URL. A bare handle gets the suffix appended; anything that still fails validation returns None rather than a guess. Nz ^https?:///rz.myshopify.com) rrstriplowerresubsplitendswithr)rdomains rnormalise_shop_domainr);s} jc* YY[   F VVM2v .F \\# q !F  ??+ ,8>*)&16;t;rcFtjjddS)z=The callback URL registered with Shopify. Must match exactly.r!z/api/shopify/callback)rPUBLIC_BASE_URLrstriprr redirect_urir.Ns"&&--c2 33H IIrstatecdt\}}|tt|d}d|dt|S)zAuthorize URL for the offline-token authorization code grant. grant_options[] is deliberately omitted: including it as "per-user" yields an online token that dies with the merchant's admin session. )r scoper.r/https://z/admin/oauth/authorize?)rSHOPIFY_SCOPESr.r)rr/r _paramss rbuild_authorize_urlr6SsA '(LIq$ F dV29V3D2E FFr)hmac signaturevaluecxt|jddjddjddS)N%z%25&z%26=z%3D)rreplace)r9s r_escaper?fs4 E e  e  e  rr5c t|jDcgc]&\}}|tvrt|dt|(}}}dj |Scc}}w)zDCanonical message Shopify signs: sorted key=value pairs joined by &.r=r<)sorteditems_HMAC_EXCLUDEDr?join)r5kvpairss rbuild_hmac_messagerHqs`6<<>*  Aq N " 1:,a |$ E  88E?  s+AcP|jd}|syt\}}tj|j dt |j dt jj} tj||S#ttf$rYywxYw)zFTiming-safe verification of Shopify's signature over the query params.r7Fzutf-8) rrr7newencoderHhashlibsha256 hexdigestcompare_digest TypeError ValueError)r5receivedr4r digests r verify_hmacrT{szz&!H *,A} XXW%6"))'2ik  ""6844 z "s=BB%$B%z4{ shop { name currencyCode primaryDomain { url } } }ceZdZdZy)TokenExchangeErrorz?Shopify refused to exchange the authorization code for a token.N__name__ __module__ __qualname____doc__r-rrrVrVsIrrVceZdZdZy)ShopQueryErrorz6The new token could not perform a real Admin API call.NrWr-rrr]r]s@rr]cK||ytjd4d{}|dddd{y77#1d{7swYyxYww)z??!DHHWb,A BB/        sWDC;D"DC=D DC?B&D=D?DDD DDrucKt|4d{}|jd|dtd|dddtid{}dddd{jd k7r9t j d ||jtd |j|j}|jd r1t j d ||d tt|d |jdxsijdxsi}|s td|jd|jd|jdxsijddS7Z7-7 #1d{7swY1xYww)zProve the token works, and collect what the catalog sync will need. Currency and primary domain are required later for price normalisation and product URL construction, and are free to fetch at install time. Nr2z /admin/api/z /graphql.jsonrh)zX-Shopify-Access-Tokenrgqueryrirlz!Shop query failed for %s: HTTP %srmerrorsz-Shop query returned GraphQL errors for %s: %srtrzempty shop nodename currencyCode primaryDomainurl)rz currency_codeprimary_domain) rdroSHOPIFY_API_VERSION _SHOP_QUERYrprrqr]rkrr)rrurbrrrsbody shop_nodes rfetch_shop_infors| V}  VVtfK(;' +Sh011&!'R,,V4:I .// f%"~6$==9?RDDUK 1      sWF E,F ,E5E/E5 F E2DF /E52F 5F;E> <FF )+r[ contextlibrLr7loggingr$ urllib.parserr`app.core.configr"app.services.integrations.platformr getLoggerrXrrr3r tuplerrcompilerboolrr)r.r6rCr?dictrHrTrr rVr]asynccontextmanagerrdrarvrr-rrrs   " $B   8 $ / FU38_F* "**D E+sTz+d+