├── .npmignore
├── .gitignore
├── package.json
├── README.md
└── multipassify.js
/.npmignore:
--------------------------------------------------------------------------------
1 | .DS_Store
2 | node_modules
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | lib-cov
2 | *.seed
3 | *.log
4 | *.csv
5 | *.dat
6 | *.out
7 | *.pid
8 | *.gz
9 |
10 | pids
11 | logs
12 | results
13 |
14 | npm-debug.log
15 | node_modules
16 | .idea
17 |
--------------------------------------------------------------------------------
/package.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "multipassify",
3 | "version": "1.0.2",
4 | "description": "Shopify Multipass module for Node.js",
5 | "homepage": "https://github.com/beaucoo/multipassify",
6 | "main": "./multipassify.js",
7 | "keywords": [
8 | "shopify",
9 | "multipass"
10 | ],
11 | "engines": [
12 | "node"
13 | ],
14 | "authors": [
15 | "Cory Smith, @Smixx"
16 | ],
17 | "contributors": [
18 | {
19 | "name": "BeauCoo",
20 | "email": "info@beaucoo.com",
21 | "url": "http://beaucoo.com/"
22 | },
23 | {
24 | "name": "Cory Smith",
25 | "email": "cory@beaucoo.com"
26 | }
27 | ],
28 | "bugs": {
29 | "url": "https://github.com/beaucoo/multipassify/issues"
30 | },
31 | "repository": {
32 | "type": "git",
33 | "url": "https://github.com/beaucoo/multipassify.git"
34 | },
35 | "dependencies": {
36 | "crypto": "0.0.3"
37 | },
38 | "readme": "",
39 | "readmeFilename": "README.md",
40 | "_id": "multipassify@1.0.0",
41 | "_from": "multipassify@1.0.0"
42 | }
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | multipassify
2 | ============
3 |
4 | Shopify Multipass module for Node.js
5 |
6 |
7 |
8 | [Shopify](http://shopify.com) provides a mechanism for single sign-on known as Multipass. Multipass uses an AES encrypted JSON hash and multipassify provides functions for generating tokens
9 |
10 | More details on Multipass with Shopify can be found [here](http://docs.shopify.com/api/tutorials/multipass-login).
11 |
12 | ## Installation
13 |
14 | npm install multipassify
15 |
16 |
17 | ## Usage
18 |
19 | To use Multipass an Enterprise / Plus plan is required. The Multipass secret can be found in your shop Admin (Settings > Checkout > Customer Accounts).
20 | Make sure "Accounts are required" or "Accounts are optional" is selected and Multipass is enabled.
21 |
22 | ``` js
23 | var Multipassify = require('multipassify');
24 |
25 | // Construct the Multipassify encoder
26 | var multipassify = new Multipassify("SHOPIFY MULTIPASS SECRET");
27 |
28 | // Create your customer data hash
29 | var customerData = { email: 'test@example.com', remote_ip:'USERS IP ADDRESS', return_to:"http://some.url"};
30 |
31 | // Encode a Multipass token
32 | var token = multipassify.encode(customerData);
33 |
34 | // Generate a Shopify multipass URL to your shop
35 | var url = multipassify.generateUrl(customerData, "yourstorename.myshopify.com");
36 |
37 | // Generates a URL like: https://yourstorename.myshopify.com/account/login/multipass/
38 | ```
--------------------------------------------------------------------------------
/multipassify.js:
--------------------------------------------------------------------------------
1 | var crypto = require('crypto');
2 |
3 | var BLOCK_SIZE = 16;
4 |
5 | var multipassify = module.exports = function(secret) {
6 | if (!(this instanceof multipassify)) return new multipassify(secret);
7 | if (!(typeof secret == 'string' && secret.length > 0)) throw new Error('Invalid Secret');
8 |
9 | // Use the Multipass secret to derive two cryptographic keys,
10 | // one for encryption, one for signing
11 | var hash = crypto.createHash("sha256").update(secret).digest();
12 | this._encryptionKey = hash.slice(0, BLOCK_SIZE);
13 | this._signingKey = hash.slice(BLOCK_SIZE, 32);
14 | return this;
15 | };
16 |
17 | multipassify.prototype.encode = function(obj) {
18 | if (!obj) return;
19 |
20 | // Store the current time in ISO8601 format.
21 | // The token will only be valid for a small timeframe around this timestamp.
22 | obj["created_at"] = new Date().toISOString();
23 |
24 | // Serialize the customer data to JSON and encrypt it
25 | var cipherText = this.encrypt(JSON.stringify(obj));
26 |
27 | // Create a signature (message authentication code) of the ciphertext
28 | // and encode everything using URL-safe Base64 (RFC 4648)
29 | var token = Buffer.concat([cipherText, this.sign(cipherText)]).toString('base64');
30 | token = token.replace(/\+/g, '-') // Replace + with -
31 | .replace(/\//g, '_'); // Replace / with _
32 |
33 | return token;
34 | };
35 |
36 | multipassify.prototype.generateUrl = function(obj, domain) {
37 | if(!domain) return;
38 | return "https://" + domain + "/account/login/multipass/" + this.encode(obj);
39 | };
40 |
41 | multipassify.prototype.sign = function (data) {
42 | var signed = crypto.createHmac("SHA256", this._signingKey).update(data).digest();
43 | return signed;
44 | }
45 |
46 | multipassify.prototype.encrypt = function(plaintext) {
47 | // Use a random IV
48 | var iv = crypto.randomBytes(BLOCK_SIZE);
49 | var cipher = crypto.createCipheriv('aes-128-cbc', this._encryptionKey,iv);
50 |
51 | // Use IV as first block of ciphertext
52 | var encrypted = Buffer.concat([iv, cipher.update(plaintext, 'utf8'), cipher.final()]);
53 | return encrypted;
54 | }
55 |
--------------------------------------------------------------------------------