TK-11400: inventory sweep prefers the full-access credential (needs write_inventory scope); the narrow one silently failed writes and the old code masked it as success

55c6546fe8ab95ca92666760360705803677eddb · 2026-09-10 13:41:26 -0700 · Steve

Files touched

M shopify/scripts/inventory-set-2026-newest.mjs

Diff

commit 55c6546fe8ab95ca92666760360705803677eddb
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Sep 10 13:41:26 2026 -0700

    TK-11400: inventory sweep prefers the full-access credential (needs write_inventory scope); the narrow one silently failed writes and the old code masked it as success
---
 shopify/scripts/inventory-set-2026-newest.mjs | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/shopify/scripts/inventory-set-2026-newest.mjs b/shopify/scripts/inventory-set-2026-newest.mjs
index 328b45b2..f2036001 100644
--- a/shopify/scripts/inventory-set-2026-newest.mjs
+++ b/shopify/scripts/inventory-set-2026-newest.mjs
@@ -23,13 +23,20 @@ import { fileURLToPath } from 'url';
 
 const __dir = path.dirname(fileURLToPath(import.meta.url));
 const ENV_PATH = path.resolve(__dir, '../../.env');     // repo root .env
-// Prefer a token already exported in the environment (run-cadence-hourly.sh exports the
-// canonical secrets-manager SHOPIFY_ADMIN_TOKEN); fall back to the repo-root .env.
-let TOKEN = process.env.SHOPIFY_ADMIN_TOKEN;
-if (!TOKEN) {
-  const env = fs.readFileSync(ENV_PATH, 'utf8');
-  TOKEN = (env.match(/^SHOPIFY_ADMIN_TOKEN=(.*)$/m) || [])[1]?.replace(/['"]/g, '').trim();
-}
+// This script performs inventory WRITES (inventoryActivate + inventorySetQuantities) which
+// REQUIRE the write_inventory scope. The narrow SHOPIFY_ADMIN_TOKEN (…7d19) lacks it — writes
+// come back "Access denied … Required access: write_inventory", which the old code silently
+// counted as success (TK-11400). run-cadence-hourly.sh only exports the narrow token, so we
+// must prefer SHOPIFY_FULL_ACCESS_TOKEN and load it from the repo .env even when the narrow
+// token is already in the environment. Matches the blessed dw-golive-token-guard per-script
+// pattern (prefer FULL for inventory mutations; keep the wrapper least-privilege).
+let ENV_TXT = null;
+const readEnvVar = (key) => {
+  if (ENV_TXT === null) { try { ENV_TXT = fs.readFileSync(ENV_PATH, 'utf8'); } catch { ENV_TXT = ''; } }
+  return (ENV_TXT.match(new RegExp('^' + key + '=(.*)$', 'm')) || [])[1]?.replace(/['"]/g, '').trim();
+};
+let TOKEN = process.env.SHOPIFY_FULL_ACCESS_TOKEN || readEnvVar('SHOPIFY_FULL_ACCESS_TOKEN')
+         || process.env.SHOPIFY_ADMIN_TOKEN || readEnvVar('SHOPIFY_ADMIN_TOKEN');
 const STORE = 'designer-laboratory-sandbox.myshopify.com';   // active DW store the cadence writes to
 const API = '2024-10';
 const LOC = 'gid://shopify/Location/5795643504';             // 15442 Ventura Blvd. (matches cadence-import.js)

← 020aa93c TK-11418: stamp shopify_product_id by primary key, not by am · back to Designer Wallcoverings · auto-data-snapshot: 2026-09-10T14:47:21 (1 data files) — DW- 187b165f →