Glad it helps. However, this way does not cover all, since afterAuth wasn’t invoked all the time (follow Shopify tutorial). My final solution is to attach a middleware to check if shopOrigin exists and update one if needed. I am not sure if this way is the right answer, but it works for me.
server.use(async (ctx, next) => {
const got = ctx.cookies.get("shopOrigin");
if (!got && ctx.request.query) {
const { hmac, shop } = ctx.request.query;
if (hmac && shop) {
const valid = validateHMAC(
hmac,
SHOPIFY_API_SECRET_KEY,
ctx.request.query
);
if (valid) {
ctx.cookies.set("shopOrigin", shop, {
httpOnly: false,
secure: true,
sign: true,
sameSite: "none"
});
ctx.redirect(
`https://${shop}/admin/apps/${SHOPIFY_API_KEY}`
);
}
}
}
await next();
});