Remove non-embedded React Router app configuration#3265
Open
byrichardpowell wants to merge 3 commits into
Open
Remove non-embedded React Router app configuration#3265byrichardpowell wants to merge 3 commits into
byrichardpowell wants to merge 3 commits into
Conversation
… missing in embedded apps When an embedded app receives a document request without shop or host query parameters (e.g. after a full page reload during Vite HMR), the server would redirect to the login page. This is incorrect because the app is still running inside the Shopify admin iframe — it just lost the URL search params during navigation/reload. Instead of redirecting to login, we now render a minimal App Bridge page. App Bridge detects it's in the admin iframe, retrieves the session token from the parent frame, and re-authenticates the app seamlessly. This fixes the annoying workflow during local development where: 1. Navigate to a new URL (loses the id_token param) 2. Make a code change 3. Vite triggers a full page reload (not HMR) 4. Server sees no identifiers and incorrectly shows login Non-embedded apps (ShopifyAdmin distribution) are unaffected and still redirect to login as before.
9c75a09 to
8c17765
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
This PR is stacked on #3216. That PR removes the last package-driven redirect to
/auth/loginfor embedded Admin document requests with missingshop/hostparams by rendering the App Bridge recovery page instead.With that behavior in place, the React Router package should no longer expose public API surfaces that imply apps can opt into a non-embedded mode. The previously available knobs
<AppProvider embedded={false}>,shopifyApp({isEmbeddedApp: false}), and templateembedded = falseguidance are misleading and can lead to broken auth loops.What changed
embeddedprop from React RouterAppProvider.AppProviderrequireapiKeyand always render App Bridge alongside Polaris web components.shopifyApp({isEmbeddedApp: ...})with a clear error.NonEmbeddedAdminContexttype toMerchantCustomAdminContextto avoid implying general non-embedded app support.Migration notes
For app routes:
For login/Polaris-only pages, remove
AppProviderinstead of usingembedded={false}:Remove
isEmbeddedAppfrom React RoutershopifyAppconfig:const shopify = shopifyApp({ // ... - isEmbeddedApp: false, });For apps based on
shopify-app-template-react-router, the dedicated/auth/loginUI route can be removed. Move theshopify.login(request)call into the root route action and have the root login form post to itself instead of/auth/login:Validation
pnpm --filter @shopify/shopify-app-react-router lintpnpm --filter @shopify/shopify-app-react-router exec jest --runInBandpnpm --filter @shopify/shopify-app-react-router buildgit diff --checkNote: local commands emit the existing Node engine warning for
shopify-app-session-storage-mongodbbecause this machine is on Nodev20.10.0and that package requests>=20.19.0; the commands still pass.