shopify-adapter

Shopify commerce adapter: a plain Admin API client library plus read-model mappers, consumed by hep-ecommerce-service's outbound adapter layer. No Express app of its own — structured to mirror hep-observability (flat src/*.ts by concern, single index.ts barrel, published scoped npm package).

Callers pass siteName explicitly to every function — unlike the 5 legacy shp-* microservices, this library has no request-scoped site context of its own.

Self-contained — does not depend on @platform-x-shp/shp-auth-client. That package is scoped to the 5 legacy microservices; this stack is meant to be fully independent of them. Everything this package needs from it was ported in directly rather than taken as a dependency:

• tenant-config.ts + redis-connector.ts + config-provider.ts/hep-secret-provider.ts — Redis-cached tenant config, backed by GCP Secret Manager/env (via hep-secret-access, same as the legacy services)
• keycloak-auth.ts / platformx-auth.ts — the same Keycloak + PlatformX JWT verification hep-ecommerce-service's auth relies on
• client.ts — the resilient GraphQL wrapper (breaker/retry/timeout), now calling the locally-ported graphql-client.ts directly instead of an external resilientGraphqlRequest

Redis cache keys use their own shopify-adapter:* prefix (not shp-auth-client:*), so this package's cache never collides with the legacy services' — they're independent, even though both may point at the same Redis instance and read the same underlying secrets.

102 tests cover this, including the full ported shp-auth-client test suites for tenant-config/keycloak-auth/platformx-auth/config-provider/resilience — not just the Shopify-specific capabilities.

Status

Products (Admin API) and Cart (Storefront API) are implemented, as the first two vertical slices through the new hexagonal hep-ecommerce-service / shopify-adapter stack:

• fetchProducts(siteName, first?, after?), fetchProductById(siteName, productId), fetchProductByIdOrThrow(siteName, productId)

• createCart(siteName, lines?), getCart(siteName, cartId), addCartLines, updateCartLines, removeCartLines

• listOrders(siteName, opts?), getOrderById(siteName, orderId)

• getCustomerById(siteName, customerId), getCustomerByEmail(siteName, email)

• messaging.ts: typed event shapes (currently just CartCreatedEvent) and a Publish function type — no amqplib dependency here; hep-ecommerce-service owns the actual RabbitMQ connection and injects a publish function.

• Order webhooks: createShopifyWebhookRouter(onVerified) — an Express router handling Shopify's POST /shopify/:siteName callback (HMAC-SHA256 verified against the tenant's webhookHmacSecret, raw-body read manually since the signature covers the exact bytes Shopify sent). No event store or message-bus connection of its own — same "caller decides what to do" shape as messaging.ts: onVerified(event) is called once per verified webhook, with event.routingKey pre-mapped via shopifyTopicToRoutingKey (null for a non-order topic, still worth recording, just not forwarding). registerShopifyWebhooks({ siteNames, callbackUrlBase }) idempotently subscribes the order topics via the Admin API; whether/when to call it is the caller's deployment decision, not read from env here.

Cart is intentionally smaller than shp-cart-service's original: no buyerIdentity, discountCodes, attributes/note, deleteCart, or validateCheckout yet. Orders has no refunds/fulfillments/transactions yet. Customers has no signup/login/address mutations yet. Webhooks cover only the order topics (ORDER_WEBHOOK_TOPICS) — no product/customer/app topics yet. All extend their respective files the same way, following shp-order-service / shp-customer-service / shp-auth-service.

Scripts

• npm run build — compile to dist/
• npm test — run the Jest suite
• npm run lint — ESLint

Node

Targets Node 22 (current Active LTS) — see the scoping doc for why this doesn't match hep-api-gateway/hep-cx-delivery-api-service's current Node 18 pin.

Secrets / env

Reads the same shape of secrets/env vars the legacy services do (${SITENAME}_SHOPIFY_* via Secret Manager or .env, KEYCLOCK_HOST, REDIS_HOST/REDIS_PORT, SECRET_MODE, GOOGLE_PROJECT_ID in production) — this is a parallel reader of the same tenant config, not a new provisioning path. AUTH_TENANTS_INFO and the ${SITENAME}_SHOPIFY_PLATFORMX_* keys are shared secrets read by both this package and shp-auth-client.