sessions_controller.rb

class SessionsController < ApplicationController
  include ShopifyApp::SessionsController
  before_filter :check_allowed_shops, only: :new

  private

  # Checks that the shop attempting to login (starting OAuth flow) is allowed
  def check_allowed_shops
    if params[:shop].present?
      if allowed_shops.include?(params[:shop].gsub(".myshopify.com",""))
        return true # Allowed
      else
        redirect_to login_path
        return false
      end
    end
  end

  # Domains of shops to allow.
  #
  # The myshopify.com subdomain without the myshopify.com part
  def allowed_shops
    ["shop1","shop2","shop3"]
  end
end