TK-11055: lib/shopify.mjs prefer SHOPIFY_FULL_ACCESS_TOKEN for write_inventory scope

7cf5e6ac87a45ed34cafedb1b1ed5e4bb12b3963 · 2026-09-01 04:03:46 -0700 · Steve Abrams

Onboarders calling inventoryItemUpdate via lib/shopify.mjs were failing with
'Access denied for inventoryItemUpdate field. Required access: write_inventory'
because the narrow SHOPIFY_ADMIN_TOKEN (4 scopes) doesn't include write_inventory.
SHOPIFY_FULL_ACCESS_TOKEN (139 scopes) covers all those operations.

Falls back to SHOPIFY_ADMIN_TOKEN so the narrow token still works if the full
one isn't set. Affected: knoll, maharam, muralsource, stroheim, stout go-live scripts.

Files touched

M scripts/lib/shopify.mjs

Diff

commit 7cf5e6ac87a45ed34cafedb1b1ed5e4bb12b3963
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Sep 1 04:03:46 2026 -0700

    TK-11055: lib/shopify.mjs prefer SHOPIFY_FULL_ACCESS_TOKEN for write_inventory scope
    
    Onboarders calling inventoryItemUpdate via lib/shopify.mjs were failing with
    'Access denied for inventoryItemUpdate field. Required access: write_inventory'
    because the narrow SHOPIFY_ADMIN_TOKEN (4 scopes) doesn't include write_inventory.
    SHOPIFY_FULL_ACCESS_TOKEN (139 scopes) covers all those operations.
    
    Falls back to SHOPIFY_ADMIN_TOKEN so the narrow token still works if the full
    one isn't set. Affected: knoll, maharam, muralsource, stroheim, stout go-live scripts.
---
 scripts/lib/shopify.mjs | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/scripts/lib/shopify.mjs b/scripts/lib/shopify.mjs
index 267920b..15f1908 100644
--- a/scripts/lib/shopify.mjs
+++ b/scripts/lib/shopify.mjs
@@ -20,11 +20,14 @@ import fs from 'node:fs';
 
 export const SHOP = 'designer-laboratory-sandbox.myshopify.com';
 export const VER = '2024-10';
+const _env = fs.readFileSync(process.env.HOME + '/Projects/secrets-manager/.env', 'utf8');
+// Prefer the full-scope token (write_inventory + all others); fall back to the narrow custom-app token.
+// TK-11055: onboarders that call inventoryItemUpdate need write_inventory scope, which the narrow
+// SHOPIFY_ADMIN_TOKEN (…7d19, 4 scopes) lacks. SHOPIFY_FULL_ACCESS_TOKEN has 139 scopes.
 export const TOKEN = (
-  fs.readFileSync(process.env.HOME + '/Projects/secrets-manager/.env', 'utf8')
-    .match(/^SHOPIFY_ADMIN_TOKEN=(.+)$/m) || []
+  _env.match(/^SHOPIFY_FULL_ACCESS_TOKEN=(.+)$/m) || _env.match(/^SHOPIFY_ADMIN_TOKEN=(.+)$/m) || []
 )[1]?.trim();
-if (!TOKEN) { console.error('no SHOPIFY_ADMIN_TOKEN in ~/Projects/secrets-manager/.env'); process.exit(1); }
+if (!TOKEN) { console.error('no SHOPIFY_FULL_ACCESS_TOKEN or SHOPIFY_ADMIN_TOKEN in ~/Projects/secrets-manager/.env'); process.exit(1); }
 
 export const ENDPOINT = `https://${SHOP}/admin/api/${VER}`;
 const GQL_URL = `${ENDPOINT}/graphql.json`;

← 8a770d7 auto-data-snapshot: 2026-09-01T01:01:38 (7 data files) — scr · back to Designerwallcoverings · auto-data-snapshot: 2026-09-01T05:58:40 (1 data files) — dat aa004bd →