@code-nl/shopify-hmac/test/proxy_hmac.unit.test.js

Shopify HMAC lib to verify Shopify calls

const chai = require('chai');
const assert = chai.assert;

const { ShopifyAppProxyHMAC } = require("../index");

describe("HMAC App Proxy", () => {
  let apiSecret;

  before(() => {
    apiSecret = "hush";
  });

  after(() => {});

  it("is able to generate HMAC based on a query", (done) => {
    const request = {
      query: {
        test: "testing"
      }
    };

    const generatedHmac = ShopifyAppProxyHMAC.generate(request, apiSecret);
    const expectedHmac = "786192abc84d52c6799a5705486f1d3f2529f48e4a43b54b50efb9bde76a5011";

    assert.equal(generatedHmac, expectedHmac);
    done();
  });

  it("is able to generate HMAC based on a query and ignores the included HMAC as content", (done) => {
    const request = {
      query: {
        test: "testing",
        signature: "786192abc84d52c6799a5705486f1d3f2529f48e4a43b54b50efb9bde76a5011"
      }
    };

    const generatedHmac = ShopifyAppProxyHMAC.generate(request, apiSecret);

    assert.equal(generatedHmac, request.query.signature);
    done();
  });

  it("is able to verify a query with a valid HMAC", (done) => {
    const request = {
      query: {
        test: "testing",
        signature: "786192abc84d52c6799a5705486f1d3f2529f48e4a43b54b50efb9bde76a5011"
      }
    };

    const verified = ShopifyAppProxyHMAC.verify(request, apiSecret);

    assert.isTrue(verified);
    done();
  });

  it("is able to reject a query with an invalid HMAC", (done) => {
    const request = {
      query: {
        test: "testing",
        signature: "686192abc84d52c6799a5705486f1d3f2529f48e4a43b54b50efb9bde76a5011"
      }
    };

    const verified = ShopifyAppProxyHMAC.verify(request, apiSecret);

    assert.isFalse(verified);
    done();
  });

  it("is able to reject a query without any HMAC", (done) => {
    const request = {
      query: {
        test: "testing"
      }
    };

    const verified = ShopifyAppProxyHMAC.verify(request, apiSecret);

    assert.isFalse(verified);
    done();
  });
});