[Feature]: added support client credentials in shopify-api-js

[fwaadahmad1]

WHY are these changes introduced?

• Resolves https://github.com/Shopify/develop-app-access/issues/617
• Resolves https://github.com/Shopify/develop-app-access/issues/608

WHAT is this pull request doing?

• No UI/UX Changes
• Added support for expiry for offline tokens. (Still works for Offline Tokens with no expiry)
• Introduces Client credentials token acquisition flow to shopify-api library.

What should the reviewers focus on?

• Existing token_exchage and oauth flows both use create_session file, see that changes do not affect the current behaviour of the library.
• create_session now supports expiration for both online and offline tokens.

Setup Instructions

1. Setup a Spin instance with constellation partners:dev
   • Run spin up partners:dev --wait
2. clone the client-creds-tophat app

Tophatting

Video

Tophatting Client Credentials token acquisition flow

• if video is not enough, we can pair on tophatting together

Instructions

1. Make sure the future flag in appConfig in shopify.server.js file looks like this

...
future: {
    unstable_newEmbeddedAuthStrategy: false,
    removeRest: true,
  },
...

2. Install the app to your store, and check the database for an access_token with no expiry.
3. Click the button initiate background job, in your app
   • This button will trigger a background job on the remix server that will initiate the client_credentials flow from shopify-api library and then save it to the database.
   • The logs for this api call can be seen in the app's console
4. check the database for an access_token with expiry.
5. Change the future flag in appConfig in shopify.server.js file as follows
   • No need to run shopify app dev again, the app hot reloads

...
future: {
    unstable_newEmbeddedAuthStrategy: true,
    removeRest: true,
  },
...

7. Delete the token record from the database
8. Click Generate a Product button in the app to trigger a server action which will in turn trigger the token acquisition flow as token is missing from db.
   • this flow will follow auth_code flow as config was updated as such
9. Check the database for an access_token with no expiry.

Type of change

• Patch: Bug (non-breaking change which fixes an issue)
• Minor: New feature (non-breaking change which adds functionality)
• Major: Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• I have used pnpm changeset to create a draft changelog entry (do NOT update the CHANGELOG.md files manually)
• I have added/updated tests for this change
• I have documented new APIs/updated the documentation for modified APIs (for public APIs)

[rezaansyed]

🎩 'd with Fwaad. LGTM! Would love to get the opinion of folks from Learn

[lizkenyon]

In general looks good! ⭐

Next step will be to add some documentation to the guides and references.