From 632109c063a01a662b873cb3fdad2e4dce119d96 Mon Sep 17 00:00:00 2001 From: Ajay Yadav Date: Tue, 6 Oct 2026 05:57:06 +0530 Subject: [PATCH 1/2] feat(app): admin module signs the shop in; install finishes like OAuth (1.1.0) Adds and pointing at https://app.tackquote.com/shopware/app. Shopware signs the module URL with the per-shop secret (QuerySigner::signUri); TackQuote verifies it at POST /v1/shopware-app/bridge and opens the shop's workspace, created on the registration confirmation. No TackQuote sign-up and no claim-by-shop-id step. Parent sw-extension verified in Shopware v6.6.10.0 sw-extension/index.js. Manifest validated with bin/validate-manifest.py (XSD + runtime checks). 1.0.0 installs stay compatible with the API. Co-Authored-By: Claude Opus 5.5 --- TackQuoteApp/README.md | 25 ++++++++++++++++++++++--- TackQuoteApp/manifest.xml | 22 +++++++++++++++++++++- 2 files changed, 43 insertions(+), 4 deletions(-) diff --git a/TackQuoteApp/README.md b/TackQuoteApp/README.md index cbd88fe..7a0493e 100644 --- a/TackQuoteApp/README.md +++ b/TackQuoteApp/README.md @@ -233,6 +233,28 @@ TackQuote reads the catalog through the Admin API credentials the shop hands ove at registration confirmation. No write scopes are requested, because the app does not write back to Shopware yet — see below. +## Admin module: install finishes like OAuth (1.1.0) + +`` (and ``, the "Open app" button) load +`https://app.tackquote.com/shopware/app` inside the Shopware Administration. +Shopware signs that iframe URL with the per-shop secret +(`shopware-shop-signature`, HMAC-SHA256 of the query), and that signature is the +sign-in: + +1. Install the app. Registration and confirmation run against the TackQuote API, + which creates the shop's own TackQuote workspace on the confirmation. +2. Open **TackQuote** in the Administration. The module verifies the signed + query, proves the shop owns the Admin API credentials it handed over (a + token request at the shop's own URL), and offers **Open TackQuote**, which + opens the workspace signed in, in its own tab. + +There is no TackQuote sign-up, password or "claim this shop by id" step. Adding +a login email, or moving the shop into an existing TackQuote workspace, are +optional actions in TackQuote under Settings > Security. + +Older installs (1.0.0, no ``) keep working: the API side is compatible +with them; they get the module after updating the app. + ## Webhooks | name | event | @@ -249,9 +271,6 @@ its body is parsed, and compared in constant time. Stated plainly rather than implied by the manifest: -- **No admin module.** There is no `` section, so the app adds no UI - inside the Shopware administration. A merchant links their store to a - TackQuote tenant from the TackQuote seller portal, not from Shopware. - **No storefront "Request a Quote" button.** That is template work, and an app cannot ship Twig overrides the way `../TackQuote` does. Storefront quoting on Cloud needs an App Script or a theme-level change and is not built here. diff --git a/TackQuoteApp/manifest.xml b/TackQuoteApp/manifest.xml index a5df913..861866e 100644 --- a/TackQuoteApp/manifest.xml +++ b/TackQuoteApp/manifest.xml @@ -11,7 +11,7 @@ Ergaenzt Ihren Storefront um B2B-Angebotsanfragen und synchronisiert Katalog, Kunden und Auftraege mit TackQuote. TackQuote (c) TackQuote - 1.0.0 + 1.1.0 MIT >=6.6.0 https://tackquote.com/privacy @@ -43,6 +43,26 @@ signature against. --> + + + + + + + + + + app.tackquote.com