[Hacktoberfest] Build a Shopify App Refund Guardrail

[uchibeke]

Complete production-ready Shopify app using APort to verify refund requests via webhooks.

Success Criteria

• Deployable app in /examples/shopify-guardrail using payments.refund.v1 policy
• Complete Shopify app with APort verification
• Refund processing with policy checks
• Comprehensive tests and documentation
• Example Shopify app setup

Technology Stack

• JavaScript, Shopify API, @aporthq/sdk-node

Acceptance Criteria

• Must include working example
• Must have proper error handling
• Must include documentation
• Must follow Shopify app development standards

Bounty

$50 USD

[redwing509]

/attempt #7

Implementation plan:

1. Analyze the existing codebase and understand the requirements
2. Implement the requested changes with clean, tested code
3. Add comprehensive tests covering the acceptance criteria
4. Submit PR with documentation updates if needed

Estimated delivery: within 24 hours.

[sureshchouksey8]

I'd like to work on this. I submitted #98 with a working Shopify refund guardrail example and tests.

• Suresh

[trungkien1992]

/attempt #7

I would like to work on this bounty with a stricter, review-friendly implementation that avoids duplicating the current open PRs.

Differentiated plan:

• Put the example at the exact requested path: /examples/shopify-guardrail.
• Build it as a minimal production-style Shopify webhook app, not only a generic Express sample.
• Verify Shopify refunds/create webhooks with HMAC before any policy call.
• Call APort verification with the payments.refund.v1 policy and a typed refund context.
• Fail closed on invalid signatures, malformed payloads, missing config, and APort deny/error responses.
• Include focused automated tests for allow, deny, invalid HMAC, missing config, and malformed webhook cases.
• Include concise setup docs, env example, and a local replay command so maintainers can validate without a real store first.

I noticed existing PRs use different example paths and appear to overlap this issue, so I will keep the PR easy to compare against the acceptance criteria and will only continue if this approach is still bounty-eligible.