Cannot set Koajs' ctx.status and ctx.body when using request-promise

Question

I'm currently coding the manual setup of authenticating a Shopify app, similar to how they set it up in NodeJS and Express. For the application, I'm using NodeJS and the Koa framework. I'm also using @koa/router for routing and attempting to use request-promises for making external HTTP requests. I can't use Shopify's Koa Authentication middleware since it doesn't work with routers and I need to have the codebase support other e-commerce platforms (BigCommerce, Magento, etc.) in the future.

When I get the access token or an error message, I'm unable to change Koa's ctx.status and ctx.body within the promise's .then() and .catch() methods. It's as if it's just ignored.

I have the following set up for getting the access token:

const KoaRouter = require('@koa/router'),
const nonce = require('nonce')();
const querystring = require('querystring');
const crypto = require('crypto');
const dotenv = require('dotenv').config();
const request = require('request-promise');
const koaRequest = require('koa-http-request');

// Get Shopify information from the .env file
const apiKey = process.env.SHOPIFY_API_KEY;
const apiSecret = process.env.SHOPIFY_API_SECRET;
const scopes = process.env.SHOPIFY_SCOPE;

const router = new KoaRouter();

const getInstallURL = (shop) => {
  const state = nonce();
  const forwardingAddress = 'https://aecd64c2.ngrok.io'
  const redirectUri = forwardingAddress + '/shopify/auth/callback';
  return {
    "url": 'https://' + shop +
    '/admin/oauth/authorize?client_id=' + apiKey +
    '&scope=' + scopes +
    '&state=' + state +
    '&redirect_uri=' + redirectUri,
    "state": state
  };
}

const verifyHMAC = (query, hmac) => {
  const map = Object.assign({}, query);
  delete map['hmac'];
  const message = querystring.stringify(map);
  const providedHmac = Buffer.from(hmac, 'utf-8');
  const generatedHash = Buffer.from(
    crypto
      .createHmac('sha256', apiSecret)
      .update(message)
      .digest('hex'),
      'utf-8'
    );
  let hashEquals = false;
  // timingSafeEqual will prevent any timing attacks. Arguments must be buffers
  try {
    hashEquals = crypto.timingSafeEqual(generatedHash, providedHmac)
  // timingSafeEqual will return an error if the input buffers are not the same length.
  } catch (e) {
    hashEquals = false;
  };

  return hashEquals;
};

const requestAccessToken = (shop, code) => {
  const accessTokenRequestUrl = 'https://' + shop + '/admin/oauth/access_token';
  const accessTokenPayload = {
    client_id: apiKey,
    client_secret: apiSecret,
    code,
  };

  console.log('Requesting accessToken for ' + shop + "!");
  return request.post(accessTokenRequestUrl, { json: accessTokenPayload });
};

router.get('/shopify/auth', async (ctx, next) => {
  const shop = ctx.request.query.shop;
  console.log(shop);
  if (shop) {
    const ret = getInstallURL(shop);
    console.log(ret)
    ctx.cookies.set('state', ret['state']);
    ctx.redirect(ret['url']);
  } else {
    ctx.status=400;
    ctx.body='Missing shop parameter. Please add ?shop=your-development-shop.myshopify.com to your request';
  }
});

router.get('/shopify/auth/callback', async (ctx, next) => {
  const { shop, hmac, code, state } = ctx.request.query;
  const stateCookie = ctx.cookies.get('state');

  console.log(ctx.request.query);
  console.log(stateCookie);

  if (state !== stateCookie) {
    ctx.status = 403;
    ctx.body='Request origin cannot be verified';
  }

  if (shop && hmac && code) {
    if (!verifyHMAC(ctx.request.query, hmac)) {
      ctx.status = 400;
      ctx.body='HMAC validation failed';
    }

    console.log('Verified HMAC.  Now need to get access token');

    requestAccessToken(shop, code).then(
      (accessTokenResponse) => {
        const accessToken = accessTokenResponse.access_token;
        console.log('Access Token = ' + accessToken);

        ctx.status= 200;
        ctx.body= "Got an access token, let's do something with it";
      }
    ).catch(
      (error) => {
        console.log('An error has occurred!');
        console.log(error.statusCode);
        console.log(error.error.error_description);
        console.log(ctx.status);
        ctx.status = error.statusCode;
        ctx.body= error.error.error_description;
        console.log(ctx.status);
      }
    )

  } else {
    ctx.status = 400;
    ctx.body='Required parameters missing';
  }
});

module.exports = router;

How can I get Koa's context variable to work within a Promise?

Answer 1

Can you edit your requestAccessToken function as below. You can't use .then() method, if function is not defined as async.

const requestAccessToken = async (shop, code) => {
  const accessTokenRequestUrl = 'https://' + shop + '/admin/oauth/access_token';
  const accessTokenPayload = {
    client_id: apiKey,
    client_secret: apiSecret,
    code,
  };

  console.log('Requesting accessToken for ' + shop + "!");
  return await request.post(accessTokenRequestUrl, { json: accessTokenPayload });
};