56 lines
3.6 KiB
OpenEdge ABL
56 lines
3.6 KiB
OpenEdge ABL
/**
|
|
* ─────────────────────────────────────────────────────────────────────────────────────────────────┐
|
|
* This web service class handle the custom respons which we send while authenticate user
|
|
* Insert the user refresh token into the configuration custom settings.
|
|
* Saved refresh token into installer User's org.
|
|
* Shopify API Documentation: https://shopify.dev/docs/admin-api/rest/reference
|
|
* Create Shopify Store: https://www.shopify.com/signup?itcat=identity&itterm=create-new-store
|
|
* Shopify API Release 2020: https://www.shopify.in/partners/blog/shopify-api-release-january-2020
|
|
* What is Person Account in Salesforce ? https://help.salesforce.com/articleView?id=account_person.htm&type=5
|
|
* ──────────────────────────────────────────────────────────────────────────────────────────────────
|
|
* @author Sumit <sumit@hicShopify.com>
|
|
* ──────────────────────────────────────────────────────────────────────────────────────────────────
|
|
*/
|
|
@RestResource(UrlMapping='/UpdateRefreshToken/*')
|
|
global with sharing class UpdateRefreshToken
|
|
{
|
|
/**
|
|
* Rotated-token write-back endpoint (the second of two; the other is
|
|
* AuthenticateAllApexClass?objectname=UpdateRefreshToken). Both now share ONE implementation —
|
|
* AuthenticateAllApexClass.persistRotatedToken — so they cannot drift apart or disagree about whether
|
|
* a token was stored.
|
|
*
|
|
* What was wrong here: the write sat behind a chain of Schema/CheckAccessibility permission gates and
|
|
* a CheckAccessibility-built dynamic SOQL string. This endpoint is reachable through the public Site
|
|
* as the Guest User, for whom CheckAccessibility.isAccessible() returns an EMPTY STRING
|
|
* (CheckAccessibility.cls:94-113). Any gate evaluating false, or the collapsed query, skipped the
|
|
* write entirely — and because the method returned void with a swallowed catch, the caller still got
|
|
* HTTP 200. Under mandatory Refresh Token Rotation the caller has already consumed the old token at
|
|
* that point, so a dropped write silently strands the org on a superseded token.
|
|
*/
|
|
@HTTPPost
|
|
global static void updatetoken(){
|
|
Restrequest request = restContext.request;
|
|
Restresponse response = restContext.response;
|
|
String JSONResponseBody = (request != null && request.requestBody != null)
|
|
? request.requestBody.toString().trim()
|
|
: null;
|
|
|
|
if (String.isBlank(JSONResponseBody)) {
|
|
if (response != null) response.statusCode = 400;
|
|
return;
|
|
}
|
|
|
|
Boolean stored = AuthenticateAllApexClass.persistRotatedToken(JSONResponseBody);
|
|
|
|
if (response != null) {
|
|
// Fail LOUD so the caller retries while its freshly rotated token is still the live one.
|
|
response.statusCode = stored ? 200 : 500;
|
|
response.addHeader('Content-Type', 'application/json');
|
|
response.responseBody = Blob.valueOf(stored
|
|
? '{"status":"ok"}'
|
|
: '{"error":"token_not_stored","error_description":"rotated refresh token could not be persisted"}');
|
|
}
|
|
}
|
|
|
|
} |