From 8a3a0ca3b75d81a433fff8682e3b705d417b215d Mon Sep 17 00:00:00 2001
From: enmaboya <vita-dubov@yandex.ru>
Date: Sun, 10 Nov 2024 05:06:42 +0400
Subject: [PATCH 1/9] remove old config parameters

---
 src/Traits/AuthController.php        |  1 -
 src/resources/config/shopify-app.php | 33 ----------------------------
 2 files changed, 34 deletions(-)

diff --git a/src/Traits/AuthController.php b/src/Traits/AuthController.php
index ab443566..3e9ee209 100644
--- a/src/Traits/AuthController.php
+++ b/src/Traits/AuthController.php
@@ -64,7 +64,6 @@ public function authenticate(Request $request, AuthenticateShop $authShop)
                 'shopify-app::auth.fullpage_redirect',
                 [
                     'apiKey' => Util::getShopifyConfig('api_key', $shopOrigin),
-                    'appBridgeVersion' => Util::getShopifyConfig('appbridge_version') ? '@'.config('shopify-app.appbridge_version') : '',
                     'authUrl' => $result['url'],
                     'host' => $request->get('host'),
                     'shopDomain' => $shopDomain,
diff --git a/src/resources/config/shopify-app.php b/src/resources/config/shopify-app.php
index 6acbfd7a..34770d10 100644
--- a/src/resources/config/shopify-app.php
+++ b/src/resources/config/shopify-app.php
@@ -37,7 +37,6 @@
     */
 
     'domain' => env('SHOPIFY_DOMAIN'),
-    
     /*
     |--------------------------------------------------------------------------
     | Manual routes
@@ -138,26 +137,6 @@
 
     'prefix' => env('SHOPIFY_APP_PREFIX', ''),
 
-    /*
-    |--------------------------------------------------------------------------
-    | AppBridge Mode
-    |--------------------------------------------------------------------------
-    |
-    | AppBridge (embedded apps) are enabled by default. Set to false to use legacy
-    | mode and host the app inside your own container.
-    |
-    */
-
-    'appbridge_enabled' => (bool) env('SHOPIFY_APPBRIDGE_ENABLED', true),
-
-    // Use semver range to link to a major or minor version number.
-    // Leaving empty will use the latest version - not recommended in production.
-    'appbridge_version' => env('SHOPIFY_APPBRIDGE_VERSION', 'latest'),
-
-    // Set a new CDN URL if you want to host the AppBridge JS yourself or unpkg goes down.
-    // DO NOT include a trailing slash.
-    'appbridge_cdn_url' => env('SHOPIFY_APPBRIDGE_CDN_URL', 'https://unpkg.com'),
-
     /*
     |--------------------------------------------------------------------------
     | Shopify App Name
@@ -513,18 +492,6 @@
 
     'config_api_callback' => null,
 
-    /*
-    |--------------------------------------------------------------------------
-    | Enable Turbolinks or Hotwire Turbo
-    |--------------------------------------------------------------------------
-    |
-    | If you use Turbolinks/Turbo and Livewire, turn on this setting to get
-    | the token assigned automatically.
-    |
-    */
-
-    'turbo_enabled' => (bool) env('SHOPIFY_TURBO_ENABLED', false),
-
     /*
     |--------------------------------------------------------------------------
     | Customize Models and Table Name

From 023c9514f39b116787c27da111b62f791e309080 Mon Sep 17 00:00:00 2001
From: enmaboya <vita-dubov@yandex.ru>
Date: Sun, 10 Nov 2024 05:07:08 +0400
Subject: [PATCH 2/9] use shopify global object from app bridge cdn

---
 .../views/auth/fullpage_redirect.blade.php    | 23 +++----------
 src/resources/views/auth/token.blade.php      | 13 ++++---
 .../views/billing/fullpage_redirect.blade.php | 23 ++++++-------
 src/resources/views/home/index.blade.php      | 16 +++------
 src/resources/views/layouts/default.blade.php | 23 ++-----------
 .../views/partials/flash_messages.blade.php   | 22 ------------
 .../views/partials/token_handler.blade.php    | 34 +++++++------------
 7 files changed, 42 insertions(+), 112 deletions(-)
 delete mode 100644 src/resources/views/partials/flash_messages.blade.php

diff --git a/src/resources/views/auth/fullpage_redirect.blade.php b/src/resources/views/auth/fullpage_redirect.blade.php
index 8ed3435d..0c911ca4 100644
--- a/src/resources/views/auth/fullpage_redirect.blade.php
+++ b/src/resources/views/auth/fullpage_redirect.blade.php
@@ -3,32 +3,19 @@
     <head>
         <meta charset="utf-8">
         <base target="_top">
+        <meta name="shopify-api-key" content="{{ config('shopify-app.api_key') }}" />
+        <script src="https://cdn.shopify.com/shopifycloud/app-bridge.js"></script>
 
         <title>Redirecting...</title>
 
-        <script src="{{config('shopify-app.appbridge_cdn_url') ?? 'https://unpkg.com'}}/@shopify/app-bridge{!! $appBridgeVersion !!}"></script>
         <script type="text/javascript">
             document.addEventListener('DOMContentLoaded', function () {
-                var redirectUrl = "{!! $authUrl !!}";
-                var normalizedLink;
+                let redirectUrl = "{!! $authUrl !!}";
+
                 if (window.top === window.self) {
-                    // If the current window is the 'parent', change the URL by setting location.href
                     window.top.location.href = redirectUrl;
                 } else {
-                    // If the current window is the 'child', change the parent's URL with postMessage
-                    normalizedLink = document.createElement('a');
-                    normalizedLink.href = redirectUrl;
-
-                    var AppBridge = window['app-bridge'];
-                    var createApp = AppBridge.default;
-                    var Redirect = AppBridge.actions.Redirect;
-                    var app = createApp({
-                        apiKey: "{{ $apiKey }}",
-                        host: "{{ $host }}",
-                    });
-
-                    var redirect = Redirect.create(app);
-                    redirect.dispatch(Redirect.Action.REMOTE, normalizedLink.href);
+                    open(redirectUrl, '_top');
                 }
             });
         </script>
diff --git a/src/resources/views/auth/token.blade.php b/src/resources/views/auth/token.blade.php
index 8433d57f..b021b5e6 100644
--- a/src/resources/views/auth/token.blade.php
+++ b/src/resources/views/auth/token.blade.php
@@ -35,12 +35,15 @@
 @section('scripts')
     @parent
 
-    @if(config('shopify-app.appbridge_enabled'))
         <script>
-            const host = new URLSearchParams(location.search).get("host")
-            utils.getSessionToken(app).then((token) => {
-                window.location.href = `{!! $target !!}{!! Str::contains($target, '?') ? '&' : '?' !!}token=${token}{{ Str::contains($target, 'host')? '' : '&host=${host}'}}`;
+            shopify.idToken().then((token) => {
+                const host = new URLSearchParams(location.search).get("host");
+                const url = new URL(`{!! $target !!}`, window.location.origin);
+
+                url.searchParams.set('token', token);
+                url.searchParams.set('host', host);
+
+                open(url.toString(), "_self");
             });
         </script>
-    @endif
 @endsection
diff --git a/src/resources/views/billing/fullpage_redirect.blade.php b/src/resources/views/billing/fullpage_redirect.blade.php
index 300d96d4..0c911ca4 100644
--- a/src/resources/views/billing/fullpage_redirect.blade.php
+++ b/src/resources/views/billing/fullpage_redirect.blade.php
@@ -3,24 +3,21 @@
     <head>
         <meta charset="utf-8">
         <base target="_top">
+        <meta name="shopify-api-key" content="{{ config('shopify-app.api_key') }}" />
+        <script src="https://cdn.shopify.com/shopifycloud/app-bridge.js"></script>
 
         <title>Redirecting...</title>
-        <script src="{{config('shopify-app.appbridge_cdn_url') ?? 'https://unpkg.com'}}/@shopify/app-bridge{{ \Osiset\ShopifyApp\Util::getShopifyConfig('appbridge_version') ? '@'.config('shopify-app.appbridge_version') : '' }}"></script>
+
         <script type="text/javascript">
-            const redirectUrl = "{!! $url !!}";
+            document.addEventListener('DOMContentLoaded', function () {
+                let redirectUrl = "{!! $authUrl !!}";
 
-            const AppBridge = window['app-bridge'];
-            const createApp = AppBridge.default;
-            const Redirect = AppBridge.actions.Redirect;
-            const app = createApp({
-                apiKey: "{{ $apiKey }}",
-                host: "{{ $host }}",
+                if (window.top === window.self) {
+                    window.top.location.href = redirectUrl;
+                } else {
+                    open(redirectUrl, '_top');
+                }
             });
-
-            console.log( 'app', app );
-
-            const redirect = Redirect.create(app);
-            redirect.dispatch(Redirect.Action.REMOTE, redirectUrl);
         </script>
     </head>
     <body>
diff --git a/src/resources/views/home/index.blade.php b/src/resources/views/home/index.blade.php
index 633a6b3d..5ab6e32b 100644
--- a/src/resources/views/home/index.blade.php
+++ b/src/resources/views/home/index.blade.php
@@ -5,6 +5,8 @@
 @endsection
 
 @section('content')
+    <ui-title-bar title="Welcome"></ui-title-bar>
+
     <div class="flex-center position-ref full-height">
         <div class="content">
             <div class="title m-b-md">
@@ -17,20 +19,10 @@
             <p>&nbsp;</p>
 
             <div class="links">
-                <a href="https://github.com/osiset/laravel-shopify" target="_blank">Package</a>
+                <a href="https://github.com/Kyon147/laravel-shopify" target="_blank">Package</a>
                 <a href="https://laravel.com" target="_blank">Laravel</a>
-                <a href="https://github.com/osiset/laravel-shopify" target="_blank">GitHub</a>
+                <a href="https://github.com/Kyon147/laravel-shopify" target="_blank">GitHub</a>
             </div>
         </div>
     </div>
 @endsection
-
-@section('scripts')
-    @parent
-
-    @if(config('shopify-app.appbridge_enabled'))
-        <script>
-            actions.TitleBar.create(app, { title: 'Welcome' });
-        </script>
-    @endif
-@endsection
diff --git a/src/resources/views/layouts/default.blade.php b/src/resources/views/layouts/default.blade.php
index 313e2bfd..fb66892c 100644
--- a/src/resources/views/layouts/default.blade.php
+++ b/src/resources/views/layouts/default.blade.php
@@ -3,6 +3,8 @@
     <head>
         <meta charset="utf-8">
         <meta name="csrf-token" content="{{ csrf_token() }}">
+        <meta name="shopify-api-key" content="{{ config('shopify-app.api_key') }}" />
+        <script src="https://cdn.shopify.com/shopifycloud/app-bridge.js"></script>
 
         <title>{{ \Osiset\ShopifyApp\Util::getShopifyConfig('app_name') }}</title>
         @yield('styles')
@@ -17,28 +19,9 @@
             </div>
         </div>
 
-        @if(\Osiset\ShopifyApp\Util::getShopifyConfig('appbridge_enabled') && \Osiset\ShopifyApp\Util::useNativeAppBridge())
-            <script src="{{config('shopify-app.appbridge_cdn_url') ?? 'https://unpkg.com'}}/@shopify/app-bridge{{ \Osiset\ShopifyApp\Util::getShopifyConfig('appbridge_version') ? '@'.config('shopify-app.appbridge_version') : '' }}"></script>
-            <script
-                @if(\Osiset\ShopifyApp\Util::getShopifyConfig('turbo_enabled'))
-                    data-turbolinks-eval="false"
-                @endif
-            >
-                var AppBridge = window['app-bridge'];
-                var actions = AppBridge.actions;
-                var utils = AppBridge.utilities;
-                var createApp = AppBridge.default;
-                var app = createApp({
-                    apiKey: "{{ \Osiset\ShopifyApp\Util::getShopifyConfig('api_key', $shopDomain ?? Auth::user()->name ) }}",
-                    host: "{{ \Request::get('host') }}",
-                    forceRedirect: true,
-                });
-            </script>
-
+        @if(\Osiset\ShopifyApp\Util::useNativeAppBridge())
             @include('shopify-app::partials.token_handler')
-            @include('shopify-app::partials.flash_messages')
         @endif
-
         @yield('scripts')
     </body>
 </html>
diff --git a/src/resources/views/partials/flash_messages.blade.php b/src/resources/views/partials/flash_messages.blade.php
deleted file mode 100644
index 5298a344..00000000
--- a/src/resources/views/partials/flash_messages.blade.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<script type="text/javascript">
-    document.addEventListener('DOMContentLoaded', function () {
-        var Toast = actions.Toast;
-
-        @if (isset($flashNotice) || request()->has('notice'))
-            var toastNotice = Toast.create(app, {
-                message: "{{ request()->get('notice', $flashNotice ?? null) }}",
-                duration: 3000,
-            });
-            toastNotice.dispatch(Toast.Action.SHOW);
-        @endif
-
-        @if (isset($flashError) || request()->has('error'))
-            var toastNotice = Toast.create(app, {
-                message: "{{ request()->get('error', $flashError ?? null) }}",
-                duration: 3000,
-                isError: true,
-            });
-            toastNotice.dispatch(Toast.Action.SHOW);
-        @endif
-    });
-</script>
diff --git a/src/resources/views/partials/token_handler.blade.php b/src/resources/views/partials/token_handler.blade.php
index a13efaf6..e8fced08 100644
--- a/src/resources/views/partials/token_handler.blade.php
+++ b/src/resources/views/partials/token_handler.blade.php
@@ -1,18 +1,14 @@
-<script data-turbolinks-eval="false">
-    var SESSION_TOKEN_REFRESH_INTERVAL = {{ \Osiset\ShopifyApp\Util::getShopifyConfig('session_token_refresh_interval') }};
-    var LOAD_EVENT = '{{ \Osiset\ShopifyApp\Util::getShopifyConfig('turbo_enabled') ? 'turbolinks:load' : 'DOMContentLoaded' }}';
-
-    // Token updates
-    document.addEventListener(LOAD_EVENT, () => {
-        retrieveToken(app);
-        keepRetrievingToken(app);
+<script>
+    let SESSION_TOKEN_REFRESH_INTERVAL = {{ \Osiset\ShopifyApp\Util::getShopifyConfig('session_token_refresh_interval') }};
+
+    document.addEventListener('DOMContentLoaded', () => {
+        retrieveToken();
+        keepRetrievingToken();
     });
 
-    // Retrieve session token
-    async function retrieveToken(app) {
-        window.sessionToken = await utils.getSessionToken(app);
+    async function retrieveToken() {
+        window.sessionToken = await shopify.idToken();
 
-        // Update everything with the session-token class
         Array.from(document.getElementsByClassName('session-token')).forEach((el) => {
             if (el.hasAttribute('value')) {
                 el.value = window.sessionToken;
@@ -23,8 +19,8 @@
         });
 
         const bearer = `Bearer ${window.sessionToken}`;
+
         if (window.jQuery) {
-            // jQuery
             if (window.jQuery.ajaxSettings.headers) {
                 window.jQuery.ajaxSettings.headers['Authorization'] = bearer;
             } else {
@@ -33,6 +29,7 @@
         }
 
         if (window.Livewire) {
+            // Works only with Livewire 2
             window.Livewire.hook('request', ({options}) => {
                 options.headers['Authorization'] = `Bearer ${window.sessionToken}`;
                 options.headers['Content-Type'] = 'application/json';
@@ -41,20 +38,13 @@
         }
 
         if (window.axios) {
-            // Axios
             window.axios.defaults.headers.common['Authorization'] = bearer;
         }
     }
 
-    // Keep retrieving a session token periodically
-    function keepRetrievingToken(app) {
+    function keepRetrievingToken() {
         setInterval(() => {
-            retrieveToken(app);
+            retrieveToken();
         }, SESSION_TOKEN_REFRESH_INTERVAL);
     }
-
-    document.addEventListener('turbolinks:request-start', (event) => {
-        var xhr = event.data.xhr;
-        xhr.setRequestHeader('Authorization', `Bearer ${window.sessionToken}`);
-    });
 </script>

From 41e641d444325d97f955d8b7c31a6e4e680b5054 Mon Sep 17 00:00:00 2001
From: enmaboya <vita-dubov@yandex.ru>
Date: Sun, 10 Nov 2024 05:07:33 +0400
Subject: [PATCH 3/9] remove unsupported turbolinks

---
 src/Http/Middleware/VerifyShopify.php | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/src/Http/Middleware/VerifyShopify.php b/src/Http/Middleware/VerifyShopify.php
index f2f29cd7..4818e5cb 100644
--- a/src/Http/Middleware/VerifyShopify.php
+++ b/src/Http/Middleware/VerifyShopify.php
@@ -377,20 +377,9 @@ protected function getHmacFromRequest(Request $request): array
      */
     protected function getAccessTokenFromRequest(Request $request): ?string
     {
-        if (Util::getShopifyConfig('turbo_enabled')) {
-            if ($request->bearerToken()) {
-                // Bearer tokens collect.
-                // Turbo does not refresh the page, values are attached to the same header.
-                $bearerTokens = Collection::make(explode(',', $request->header('Authorization', '')));
-                $newestToken = Str::substr(trim($bearerTokens->last()), 7);
-
-                return $newestToken;
-            }
-
-            return $request->get('token');
-        }
-
-        return $this->isApiRequest($request) ? $request->bearerToken() : $request->get('token');
+        return $this->isApiRequest($request)
+            ? $request->bearerToken()
+            : $request->get('token');
     }
 
     /**

From 78aaa4fb0a9099738cbec5430a5883e931e15573 Mon Sep 17 00:00:00 2001
From: enmaboya <vita-dubov@yandex.ru>
Date: Mon, 11 Nov 2024 17:53:32 +0400
Subject: [PATCH 4/9] update tests

---
 src/Traits/AuthController.php                           | 2 +-
 src/resources/views/auth/fullpage_redirect.blade.php    | 2 +-
 src/resources/views/billing/fullpage_redirect.blade.php | 2 +-
 src/resources/views/layouts/default.blade.php           | 2 +-
 src/resources/views/partials/token_handler.blade.php    | 6 +++---
 tests/Traits/AuthControllerTest.php                     | 2 +-
 tests/Traits/BillingControllerTest.php                  | 1 +
 tests/Traits/HomeControllerTest.php                     | 9 +++------
 8 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/src/Traits/AuthController.php b/src/Traits/AuthController.php
index 3e9ee209..4d034079 100644
--- a/src/Traits/AuthController.php
+++ b/src/Traits/AuthController.php
@@ -64,7 +64,7 @@ public function authenticate(Request $request, AuthenticateShop $authShop)
                 'shopify-app::auth.fullpage_redirect',
                 [
                     'apiKey' => Util::getShopifyConfig('api_key', $shopOrigin),
-                    'authUrl' => $result['url'],
+                    'url' => $result['url'],
                     'host' => $request->get('host'),
                     'shopDomain' => $shopDomain,
                     'locale' => $request->get('locale'),
diff --git a/src/resources/views/auth/fullpage_redirect.blade.php b/src/resources/views/auth/fullpage_redirect.blade.php
index 0c911ca4..e14175f0 100644
--- a/src/resources/views/auth/fullpage_redirect.blade.php
+++ b/src/resources/views/auth/fullpage_redirect.blade.php
@@ -10,7 +10,7 @@
 
         <script type="text/javascript">
             document.addEventListener('DOMContentLoaded', function () {
-                let redirectUrl = "{!! $authUrl !!}";
+                let redirectUrl = "{!! $url !!}";
 
                 if (window.top === window.self) {
                     window.top.location.href = redirectUrl;
diff --git a/src/resources/views/billing/fullpage_redirect.blade.php b/src/resources/views/billing/fullpage_redirect.blade.php
index 0c911ca4..e14175f0 100644
--- a/src/resources/views/billing/fullpage_redirect.blade.php
+++ b/src/resources/views/billing/fullpage_redirect.blade.php
@@ -10,7 +10,7 @@
 
         <script type="text/javascript">
             document.addEventListener('DOMContentLoaded', function () {
-                let redirectUrl = "{!! $authUrl !!}";
+                let redirectUrl = "{!! $url !!}";
 
                 if (window.top === window.self) {
                     window.top.location.href = redirectUrl;
diff --git a/src/resources/views/layouts/default.blade.php b/src/resources/views/layouts/default.blade.php
index fb66892c..b75afaa6 100644
--- a/src/resources/views/layouts/default.blade.php
+++ b/src/resources/views/layouts/default.blade.php
@@ -6,7 +6,7 @@
         <meta name="shopify-api-key" content="{{ config('shopify-app.api_key') }}" />
         <script src="https://cdn.shopify.com/shopifycloud/app-bridge.js"></script>
 
-        <title>{{ \Osiset\ShopifyApp\Util::getShopifyConfig('app_name') }}</title>
+        <title>{{ config('shopify-app.app_name') }}</title>
         @yield('styles')
     </head>
 
diff --git a/src/resources/views/partials/token_handler.blade.php b/src/resources/views/partials/token_handler.blade.php
index e8fced08..a9194b2d 100644
--- a/src/resources/views/partials/token_handler.blade.php
+++ b/src/resources/views/partials/token_handler.blade.php
@@ -1,7 +1,8 @@
 <script>
-    let SESSION_TOKEN_REFRESH_INTERVAL = {{ \Osiset\ShopifyApp\Util::getShopifyConfig('session_token_refresh_interval') }};
+    var SESSION_TOKEN_REFRESH_INTERVAL = {{ config('shopify-app.session_token_refresh_interval') }};
+    var LOAD_EVENT = 'DOMContentLoaded'
 
-    document.addEventListener('DOMContentLoaded', () => {
+    document.addEventListener(LOAD_EVENT, () => {
         retrieveToken();
         keepRetrievingToken();
     });
@@ -29,7 +30,6 @@
         }
 
         if (window.Livewire) {
-            // Works only with Livewire 2
             window.Livewire.hook('request', ({options}) => {
                 options.headers['Authorization'] = `Bearer ${window.sessionToken}`;
                 options.headers['Content-Type'] = 'application/json';
diff --git a/tests/Traits/AuthControllerTest.php b/tests/Traits/AuthControllerTest.php
index a435c7c9..23167a23 100644
--- a/tests/Traits/AuthControllerTest.php
+++ b/tests/Traits/AuthControllerTest.php
@@ -30,7 +30,7 @@ public function testAuthRedirectsToShopifyWhenNoCode(): void
         // Check the redirect happens and location is set properly in the header.
         $response->assertViewHas('shopDomain', 'example.myshopify.com');
         $response->assertViewHas(
-            'authUrl',
+            'url',
             'https://example.myshopify.com/admin/oauth/authorize?client_id='.Util::getShopifyConfig('api_key').'&scope=read_products%2Cwrite_products%2Cread_themes&redirect_uri=https%3A%2F%2Flocalhost%2Fauthenticate'
         );
 
diff --git a/tests/Traits/BillingControllerTest.php b/tests/Traits/BillingControllerTest.php
index c3011fc9..1ddb89f3 100644
--- a/tests/Traits/BillingControllerTest.php
+++ b/tests/Traits/BillingControllerTest.php
@@ -45,6 +45,7 @@ public function testSendsShopToBillingScreen(): void
 
         // Run the call
         $response = $this->call('get', '/billing', ['shop' => $shop->getDomain()->toNative()]);
+
         $response->assertViewHas(
             'url',
             'https://example.myshopify.com/admin/charges/1029266947/confirm_recurring_application_charge?signature=BAhpBANeWT0%3D--64de8739eb1e63a8f848382bb757b20343eb414f'
diff --git a/tests/Traits/HomeControllerTest.php b/tests/Traits/HomeControllerTest.php
index 934c3b18..2b928412 100644
--- a/tests/Traits/HomeControllerTest.php
+++ b/tests/Traits/HomeControllerTest.php
@@ -4,7 +4,6 @@
 
 use Illuminate\Auth\AuthManager;
 use Osiset\ShopifyApp\Test\TestCase;
-use Osiset\ShopifyApp\Util;
 
 class HomeControllerTest extends TestCase
 {
@@ -27,18 +26,16 @@ public function testHomeRoute(): void
         $host = base64_encode($shop->getDomain()->toNative().'/admin');
         $this->call('get', '/', ['token' => $this->buildToken(), 'host' => $host])
             ->assertOk()
-            ->assertSee('apiKey: "'.Util::getShopifyConfig('api_key').'"', false)
-            ->assertSee("host: \"{$host}\"", false);
+            ->assertSee("https://cdn.shopify.com/shopifycloud/app-bridge.js");
     }
 
     public function testHomeRouteHostAdmin(): void
     {
-        $shop = factory($this->model)->create(['name' => 'shop-name.myshopify.com']);
+        factory($this->model)->create(['name' => 'shop-name.myshopify.com']);
 
         $host = base64_encode('admin.shopify.com/store/shop-name');
         $this->call('get', '/', ['token' => $this->buildToken(), 'host' => $host])
             ->assertOk()
-            ->assertSee('apiKey: "'.Util::getShopifyConfig('api_key').'"', false)
-            ->assertSee("host: \"{$host}\"", false);
+            ->assertSee("https://cdn.shopify.com/shopifycloud/app-bridge.js");
     }
 }

From 91e505cafb65ff3d555a1fe95825a8b9394ac1fb Mon Sep 17 00:00:00 2001
From: Luke Walsh <kyon.rf@gmail.com>
Date: Tue, 12 Nov 2024 10:04:06 +0000
Subject: [PATCH 5/9] Update to use the utils helper.

Force https on the url if there is one from the origin. This can help with some ngrok issues when testing locally and stops mix matched requests.
---
 src/resources/views/auth/token.blade.php      | 20 +++++++++++--------
 src/resources/views/layouts/default.blade.php |  2 +-
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/resources/views/auth/token.blade.php b/src/resources/views/auth/token.blade.php
index b021b5e6..d27fef25 100644
--- a/src/resources/views/auth/token.blade.php
+++ b/src/resources/views/auth/token.blade.php
@@ -34,16 +34,20 @@
 
 @section('scripts')
     @parent
-
         <script>
-            shopify.idToken().then((token) => {
-                const host = new URLSearchParams(location.search).get("host");
-                const url = new URL(`{!! $target !!}`, window.location.origin);
+                shopify.idToken().then((token) => {
+                    const host = new URLSearchParams(location.search).get("host");
+                    let url = new URL(`{!! $target !!}`, window.location.origin);
+
+                    // Enforce HTTPS if the current page is using HTTPS
+                    if (window.location.protocol === 'https:') {
+                        url.protocol = 'https:';
+                    }
 
-                url.searchParams.set('token', token);
-                url.searchParams.set('host', host);
+                    url.searchParams.set('token', token);
+                    url.searchParams.set('host', host);
 
-                open(url.toString(), "_self");
-            });
+                    open(url.toString(), "_self");
+                });
         </script>
 @endsection
diff --git a/src/resources/views/layouts/default.blade.php b/src/resources/views/layouts/default.blade.php
index b75afaa6..854af9fd 100644
--- a/src/resources/views/layouts/default.blade.php
+++ b/src/resources/views/layouts/default.blade.php
@@ -3,7 +3,7 @@
     <head>
         <meta charset="utf-8">
         <meta name="csrf-token" content="{{ csrf_token() }}">
-        <meta name="shopify-api-key" content="{{ config('shopify-app.api_key') }}" />
+        <meta name="shopify-api-key" content="{{ \Osiset\ShopifyApp\Util::getShopifyConfig('api_key', $shopDomain ?? Auth::user()->name ) }}"/>
         <script src="https://cdn.shopify.com/shopifycloud/app-bridge.js"></script>
 
         <title>{{ config('shopify-app.app_name') }}</title>

From e1bf25c84c614b897b17e8e8515feab0622344d5 Mon Sep 17 00:00:00 2001
From: Luke Walsh <kyon.rf@gmail.com>
Date: Tue, 12 Nov 2024 10:08:12 +0000
Subject: [PATCH 6/9] Add some defensive checks to the token blade file

---
 src/resources/views/auth/token.blade.php | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/resources/views/auth/token.blade.php b/src/resources/views/auth/token.blade.php
index d27fef25..9914e5c4 100644
--- a/src/resources/views/auth/token.blade.php
+++ b/src/resources/views/auth/token.blade.php
@@ -35,10 +35,20 @@
 @section('scripts')
     @parent
         <script>
+                // If no host is found, we need to throw an error
+                const host = new URLSearchParams(location.search).get("host");
+                if (!host) {
+                    throw new Error('No host found in the URL');
+                }
+
+                // If shopify is not defined, then we are not in a Shopify context redirect to the homepage as it
+                if (typeof shopify === 'undefined') {
+                    open("{{ route('home') }}", "_self");
+                }
+
                 shopify.idToken().then((token) => {
-                    const host = new URLSearchParams(location.search).get("host");
-                    let url = new URL(`{!! $target !!}`, window.location.origin);
 
+                    let url = new URL(`{!! $target !!}`, window.location.origin);
                     // Enforce HTTPS if the current page is using HTTPS
                     if (window.location.protocol === 'https:') {
                         url.protocol = 'https:';

From ed72e3d262b14c248ae092bd2a7dc25440ab3a4b Mon Sep 17 00:00:00 2001
From: Luke Walsh <kyon.rf@gmail.com>
Date: Tue, 12 Nov 2024 10:11:56 +0000
Subject: [PATCH 7/9] need to write the url updates

---
 src/resources/views/auth/token.blade.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/resources/views/auth/token.blade.php b/src/resources/views/auth/token.blade.php
index 9914e5c4..797f5b8e 100644
--- a/src/resources/views/auth/token.blade.php
+++ b/src/resources/views/auth/token.blade.php
@@ -58,6 +58,7 @@
                     url.searchParams.set('host', host);
 
                     open(url.toString(), "_self");
+                    history.pushState(null, '', url.toString());
                 });
         </script>
 @endsection

From 8f7f81beeca88cccdaf43f90df016b3ab6079f5b Mon Sep 17 00:00:00 2001
From: Luke Walsh <kyon.rf@gmail.com>
Date: Tue, 12 Nov 2024 10:39:32 +0000
Subject: [PATCH 8/9] use the helper

---
 src/resources/views/auth/fullpage_redirect.blade.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/resources/views/auth/fullpage_redirect.blade.php b/src/resources/views/auth/fullpage_redirect.blade.php
index e14175f0..0811f501 100644
--- a/src/resources/views/auth/fullpage_redirect.blade.php
+++ b/src/resources/views/auth/fullpage_redirect.blade.php
@@ -3,7 +3,7 @@
     <head>
         <meta charset="utf-8">
         <base target="_top">
-        <meta name="shopify-api-key" content="{{ config('shopify-app.api_key') }}" />
+        <meta name="shopify-api-key" content="{{ \Osiset\ShopifyApp\Util::getShopifyConfig('api_key', $shopDomain ?? Auth::user()->name ) }}"/>
         <script src="https://cdn.shopify.com/shopifycloud/app-bridge.js"></script>
 
         <title>Redirecting...</title>

From 54b2813a5e872171b2d175c9ac46133ee444aeed Mon Sep 17 00:00:00 2001
From: Luke Walsh <kyon.rf@gmail.com>
Date: Tue, 12 Nov 2024 10:46:54 +0000
Subject: [PATCH 9/9] Update the test to still check for a correct api key

---
 tests/Traits/HomeControllerTest.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tests/Traits/HomeControllerTest.php b/tests/Traits/HomeControllerTest.php
index 2b928412..b34b5eb1 100644
--- a/tests/Traits/HomeControllerTest.php
+++ b/tests/Traits/HomeControllerTest.php
@@ -4,6 +4,7 @@
 
 use Illuminate\Auth\AuthManager;
 use Osiset\ShopifyApp\Test\TestCase;
+use Osiset\ShopifyApp\Util;
 
 class HomeControllerTest extends TestCase
 {
@@ -26,7 +27,8 @@ public function testHomeRoute(): void
         $host = base64_encode($shop->getDomain()->toNative().'/admin');
         $this->call('get', '/', ['token' => $this->buildToken(), 'host' => $host])
             ->assertOk()
-            ->assertSee("https://cdn.shopify.com/shopifycloud/app-bridge.js");
+            ->assertSee('name="shopify-api-key" content="'.Util::getShopifyConfig('api_key').'"', false)
+            ->assertSee('https://cdn.shopify.com/shopifycloud/app-bridge.js');
     }
 
     public function testHomeRouteHostAdmin(): void
@@ -36,6 +38,7 @@ public function testHomeRouteHostAdmin(): void
         $host = base64_encode('admin.shopify.com/store/shop-name');
         $this->call('get', '/', ['token' => $this->buildToken(), 'host' => $host])
             ->assertOk()
-            ->assertSee("https://cdn.shopify.com/shopifycloud/app-bridge.js");
+            ->assertSee('name="shopify-api-key" content="'.Util::getShopifyConfig('api_key').'"', false)
+            ->assertSee('https://cdn.shopify.com/shopifycloud/app-bridge.js');
     }
 }