Repository navigation
Renew Shopify app tokens and report missing scopes - #4
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR: Stores owned by the same Shopify organization as their app can connect with a client ID and secret; Inventoros renews their expiring access tokens automatically. Connection tests also name missing API scopes.
Adds an optional authentication mode while preserving manually supplied tokens. Tokens and expiry stay in the existing encrypted credentials; a row lock serializes renewal and tokens renew two minutes before expiry before API requests, including later pages of a running sync. The existing API secret key doubles as the app client secret. Credential rotation clears cached tokens and retests the connection. Credentials/client IDs are write-only and excluded from validation-session old input; exchange errors never echo provider bodies.
This is Shopify's client-credentials grant for an app and stores in the same Shopify organization, not an OAuth redirect flow for unrelated merchants. Grant failures explain that constraint.
Stacked on #3; merge #3 first. Validation: all 133 plugin tests pass (771 assertions), including encrypted storage, reuse/renewal, missing scopes, settings changes and failed-validation input protection. Runtime UI builds. Provider requests are faked; no live store was changed.
Reference: https://shopify.dev/docs/apps/build/authentication-authorization/client-credentials-grant
GitHub-hosted CI currently cannot start: GitHub reports failed account payments or a spending-limit restriction. No build steps ran; local validation above passed.