[8.0] Drop Shopify SDK usage

[nfourtythree]

No description provided.

[Copilot]

Pull request overview

This PR removes the shopify/shopify-api PHP SDK dependency and replaces its OAuth, GraphQL, and webhook utilities with first-party equivalents inside the plugin for the 8.0 release line.

Changes:

• Replaced Shopify SDK GraphQL client + exception types with craft\shopify\clients\GraphqlClient and craft\shopify\exceptions\ShopifyApiException*.
• Replaced Shopify SDK OAuth + HMAC helpers with craft\shopify\auth\OAuthFlow and craft\shopify\helpers\ShopifyHelper.
• Replaced Shopify SDK webhook registry with craft\shopify\webhooks\WebhookRegistry + internal WebhookTopics enum.

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/webhooks/WebhookRegistry.php	Adds internal webhook handler registry + HMAC validation/dispatch.
src/services/BulkOperations.php	Switches exception handling from Shopify SDK exceptions to plugin exceptions.
src/services/Api.php	Reworks API service to use internal OAuth/token + GraphQL client, removes SDK context/session usage.
src/Plugin.php	Registers webhook handlers via new internal registry and uses connect() for “has session” checks.
src/models/Settings.php	Replaces SDK API version/constants + domain sanitation with internal enums/helpers.
src/helpers/ShopifyHelper.php	Introduces internal shop-domain sanitation + query-param HMAC validation helpers.
src/handlers/Webhook.php	Switches webhook handler to WebhookTopics enum + match dispatch, adds inventory webhook support.
src/exceptions/ShopifyApiException.php	Adds plugin-owned API exception base class.
src/exceptions/ShopifyApiCommunicationException.php	Adds transport-failure exception type for API calls.
src/exceptions/InvalidOAuthException.php	Adds plugin-owned OAuth exception.
src/events/DefineContextConfigEvent.php	Removes SDK context customization event.
src/enums/WebhookTopics.php	Adds enum for webhook topics + conversion to GraphQL enum string.
src/enums/ApiVersion.php	Adds enum for supported Shopify Admin API versions.
src/controllers/WebhooksController.php	Updates webhook admin UI logic to use internal topics + exceptions.
src/controllers/WebhookController.php	Updates inbound webhook endpoint to use internal registry/validation.
src/controllers/SettingsController.php	Uses connect() to determine authorization state in settings UI.
src/controllers/AuthController.php	Migrates OAuth flow from SDK to internal implementation.
src/console/controllers/ApiController.php	Updates console query command to catch plugin API exceptions.
src/clients/GraphqlClient.php	Adds internal Guzzle-based Shopify Admin GraphQL client.
src/auth/OAuthFlow.php	Adds internal OAuth “begin” flow (state cookies + authorization URL).
README.md	Documents removal of Shopify SDK and how to update custom code.
composer.json	Drops shopify/shopify-api and adds direct Guzzle requirement.
composer.lock	Updates lockfile to remove Shopify SDK and refresh dependency versions.
CHANGELOG-WIP.md	Notes new internal APIs, added API versions, and dependency removal.

Comments suppressed due to low confidence (1)

src/controllers/AuthController.php:146

• The signed state cookie comparison uses a normal string equality check. Since this value gates OAuth callback validity, use hash_equals() to avoid timing attacks and to match the constant-time comparison used elsewhere for HMAC validation.

        if ($signature && $cookieId) {
            $expectedSignature = hash_hmac('sha256', (string)$cookieId, Plugin::getInstance()->getSettings()->getClientSecret());

            if ($signature === $expectedSignature) {
                $cookieState = $cookieId;
            }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.