Repository navigation
fix(plugins): check a store connection against the store itself - #905
Merged
Merged
Conversation
probeActionFor prefers an identity read matching IDENTITY_ACTION, else the first safe read alphabetically. For Shopify that was SHOPIFY_COUNT_BLOGS, which needs the read_content scope a store app with only order and product scopes lacks, so a working key was reported as rejected. A store's own details are the identity: _GET_SHOP_DETAILS now counts. Co-authored-by: Saim Shafique <128062316+sx4im@users.noreply.github.com>
sx4im
requested review from
MikeRyanDev,
davidmckayv,
dustywusty,
guidovizoso,
mxmzb,
samjulien and
tylerslaton
as code owners
October 30, 2026 15:20
Resolve CHANGELOG.md Unreleased entry collision: keep upstream's entries and the PR's store-connection entry (mechanical merge).
9 tasks done
…-probe # Conflicts: # CHANGELOG.md
…-probe # Conflicts: # CHANGELOG.md
davidmckayv
approved these changes
Nov 2, 2026
davidmckayv
left a comment
davidmckayv
left a comment
Contributor
There was a problem hiding this comment.
Thanks. Checked together with the other fixes on one tree with the full test suite, and merging.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
After connecting a Shopify key, OpenBot checked it with
SHOPIFY_COUNT_BLOGS, the first safe read alphabetically, which needs theread_contentscope a store app with only order and product scopes does not have. The 403 made a working key look rejected. A store's own details are the identity, so_GET_SHOP_DETAILSnow counts as an identity read and the check uses it instead.Where it runs
No new state, no listeners, no schedules. The chooser is a pure function of the app's published actions; every replica picks the same probe.
Boundary and audit
Changelog
CHANGELOG.mdunderUnreleased.Proof
New pure unit test
server/tests/plugin-store-identity-action.test.ts: 3 pass. It fails without the fix (SHOPIFY_GET_SHOP_DETAILSnot recognised) and passes with it; the existing identity suffixes still match and non-identity actions (SHOPIFY_COUNT_BLOGS,SLACK_PROFILE_SET) still do not.tsc --noEmitclean on server. The DB-backed probe suites need TEST_DATABASE_URL, not available here.Refs #886 (this fixes the identity probe; the 403 scope and verified:false halves stay open)