Token exchange not triggered after app reinstall

[kirillplatonov]

I'm using token exchange auth and managed installs.

When I install the app for the first time - the new Shop record is created and ShopifyApp::Auth::TokenExchange is called.

When I re-install the app - the Shop record is already present in DB and ShopifyApp::Auth::TokenExchange not called automatically so shopify_token is not updated and post_authenticate_jobs are not called.

Expected behavior

ShopifyApp::Auth::TokenExchange should be called after app re-install.

Actual behavior

ShopifyApp::Auth::TokenExchange not called after re-install.

Demo

CleanShot.2024-07-26.at.15.45.07.mp4

[Arkham]

Hey Kirill,

thanks for reporting this issue, I've tagged the team working on this!

[kirillplatonov]

Current workaround

To fix this issue in my app I end up adding controller callback that triggers token exchange on the first app loading from admin using pretty complex condition:

class AuthenticatedController < ApplicationController
  before_action :perform_token_exchange

  def perform_token_exchange
    return if params[:embedded] != "1" || params[:id_token].blank?
    return unless request.path == "/home"

    new_session = ShopifyApp::Auth::TokenExchange.perform(shopify_id_token)
    current_shopify_session.copy_attributes_from(new_session)
  end
end

And I now have to trigger AfterAuthenticateJob manually from Shop model to be sure it will fire only after install/re-install, when shopify_token is updated:

class Shop < ActiveRecord::Base
  after_save_commit :check_shopify_token_change

  def check_shopify_token_change
    return unless shopify_token_previously_changed?

    AfterAuthenticateJob.perform_now(shop_domain: shopify_domain)
  end
end

It works well but it's a pretty hacky solution.

Proper fix

To properly fix the issue, we need to have some indication from ShopifyAdmin/AppBridge that the request is coming to the app after managed installation. Right now there's no difference in regular app visit and app installation. The best fix would be providing a parameter (eg installed=1) to the first app visit after managed installation. This way we could trigger token exchange when we detect this parameter.

[zzooeeyy]

Hey @kirillplatonov, I'll bring this up to the team to see how we'd like to proceed for this. We didn't have a way to handle this because our template app defaults to destroying the record upon uninstallation. In the mean time, I've seen apps implement this in a less hacky way:

1. New column in Shop table for uninstalled
2. Upon receiving uninstalled webhook, set Shop.uninstalled = true
3. In AuthenticatedController perform token exchange if uninstalled, and set uninstalled=false

I hope this helps in the meantime. Thanks!

[kirillplatonov]

Destroying Shop is not suitable for production apps, unfortunately. We need to keep data during grace period until fully erasing them. And even after erasing app data, we still need to keep Shop record without personal data to track possible app reinstalls in the future and offer support. We need a better default for handling uninstalls in shopify_app template.

Regarding suggested workaround with uninstalled column. In my apps I'm using uninstalled_at column to detect uninstalls too. However, this solely relies on webhooks and it won't work in cases when the app re-installed right away after uninstall. This is not common among case among merchants, but this is specific case that Shopify App Store review team check apps for. So we have to handle it properly just to pass regular app review. And we can't solely rely on webhooks - we need to perform exchange properly after each app reinstall automatically.

[uurcank]

@kirillplatonov @zzooeeyy i have this workaround which might be good for reinstallation

1. upon uninstall replace shop token with 'na' (also override model validations to enable this)
2. override construct_session in shop model to return early if token is 'na'

def self.def self.construct_session(shop)
    return unless shop
    return if shop.token == "na"

    ShopifyAPI::Auth::Session.new(
      shop: shop.shopify_domain,
      access_token: shop.shopify_token,
      scope: shop.access_scopes || ShopifyApp.configuration.scope
    )
  end 

this forces a token exchange from what i see so you would not need to override the controller.

[remy727]

@kirillplatonov, I have the same issue.
Your hack solution worked for me. 👍
But I noticed AfterAuthenticateJob is being running twice.

Any thoughts?

[kirillplatonov]

@remy727 you have to disable it in ShopifyApp config to avoid duplication:

ShopifyApp.configure do |config|
  # Moved to Shop model because shopify_app doesn't trigger after_authenticate after reinstall
  # config.after_authenticate_job = {job: "PlatmartApp::AfterAuthenticateJob", inline: true}
end

[zernie]

oh my, this looks exactly like the issue we're having. I will test @kirillplatonov's fix and report tomorrow (EDIT: it didn't help)

[zernie]

@uurcank the issue with your solution is that the webhook cannot be relied upon since there is a delay.

[zernie]

here's what I had to do to fix it:

   # application_controller.rb:

    # After a Shopify login, we are redirected to a page that looks like this:
    # https://example.com/?hmac=xxx&host=yyy&shop=test-auth.myshopify.com&timestamp=1733832446
    def logging_in_through_shopify?
      params[:shop].present? && request.path == '/' && logged_in_through_shopify?
    end

    def logged_in_through_shopify?
      current_shopify_session.present?
    end

    def activate_shopify_session(&)
      if logging_in_through_shopify?
        Rails.logger.info("Logging in through Shopify for #{params[:shop]}")
        # When logging via Shopify, we need to clear the session to ensure that the re-installation flow works
        # @see https://github.com/Shopify/shopify_app/issues/1886
        clear_shopify_session
        super(&)
      else
        # all good, we are in the Shopify flow
        super(&)
      end
    end

[zernie]

hey @zzooeeyy! this issue is super important since it might cause an app to be delisted during the Shopify review. I'd be happy to help fix it in any way.

[pavel-alexeichik]

Having the same issue, please help

[netwire88]

We will wait for Token Exchange via shopify_app to be less buggy before migrating to it. It still seems buggy even for core features.

[resistorsoftware]

Nearly two months have passed on this issue, and while the robots have yet to inform us it is closed due to inactivity, it would be nice to know if there is any activity in this reasonably interesting case. Is there anything new to report?