[object Object]

← back to Designerwallcoverings

artmura-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOKEN for write_inventory (TK-11046)

8068bd7d0562fd7b69f3925c6e53e1b5fd1bb83b · 2026-09-02 09:52:27 -0700 · Steve Abrams

go-live-artmura.js (CommonJS, own local gql) read TOKEN from the narrow ADMIN token
(…7d19), which lacks write_inventory, so its inventoryItemUpdate/inventoryActivate/
inventorySetQuantities died at the permission wall. The env wrappers export only the
narrow token, so a pure env-chain would still resolve narrow; instead read the FULL token
(…2ea5) directly from the secrets file (preferring it, falling back to ADMIN) — mirrors
lib/shopify.mjs. Create path (push-artmura-live.js) untouched, stays least-privilege.
Verified golive resolves to …2ea5.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLAwoaNSg3benrUyFxHzLh

Files touched

Diff

commit 8068bd7d0562fd7b69f3925c6e53e1b5fd1bb83b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Sep 2 09:52:27 2026 -0700

    artmura-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOKEN for write_inventory (TK-11046)
    
    go-live-artmura.js (CommonJS, own local gql) read TOKEN from the narrow ADMIN token
    (…7d19), which lacks write_inventory, so its inventoryItemUpdate/inventoryActivate/
    inventorySetQuantities died at the permission wall. The env wrappers export only the
    narrow token, so a pure env-chain would still resolve narrow; instead read the FULL token
    (…2ea5) directly from the secrets file (preferring it, falling back to ADMIN) — mirrors
    lib/shopify.mjs. Create path (push-artmura-live.js) untouched, stays least-privilege.
    Verified golive resolves to …2ea5.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01QLAwoaNSg3benrUyFxHzLh
---
 scripts/artmura-onboard/go-live-artmura.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/artmura-onboard/go-live-artmura.js b/scripts/artmura-onboard/go-live-artmura.js
index 8cfa0fa..7c22056 100644
--- a/scripts/artmura-onboard/go-live-artmura.js
+++ b/scripts/artmura-onboard/go-live-artmura.js
@@ -16,7 +16,14 @@ const fs = require('fs');
 const { Pool } = require('pg');
 
 const SHOP = process.env.SHOPIFY_STORE || 'designer-laboratory-sandbox.myshopify.com';
-const TOKEN = process.env.SHOPIFY_ADMIN_TOKEN;
+// TK-11046: golive does write_inventory mutations (inventoryItemUpdate/inventoryActivate/
+// inventorySetQuantities below) — a scope the narrow custom-app ADMIN token (…7d19) LACKS.
+// Prefer the FULL token (…2ea5, carries write_inventory) from env OR the secrets file; fall
+// back to the narrow ADMIN token. (Env wrappers here export only ADMIN, so the file read is
+// required to actually resolve FULL — mirrors lib/shopify.mjs.)
+const _SEC = (() => { try { return fs.readFileSync(process.env.HOME + '/Projects/secrets-manager/.env', 'utf8'); } catch { return ''; } })();
+const _tok = (k) => { const v = (process.env[k] || (_SEC.match(new RegExp('^' + k + '=(.+)$', 'm')) || [])[1] || '').trim(); return v.replace(/^['"]|['"]$/g, ''); };
+const TOKEN = _tok('SHOPIFY_FULL_ACCESS_TOKEN') || _tok('SHOPIFY_ADMIN_TOKEN');
 const API = '2024-10';
 const EP = `https://${SHOP}/admin/api/${API}/graphql.json`;
 const DB = process.env.DATABASE_URL || 'postgresql:///dw_unified?host=/tmp';

← d99146d osborne-onboard: golive uses SHOPIFY_FULL_ACCESS_TOKEN for w  ·  back to Designerwallcoverings  ·  fallingstar-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOK d17c5f2 →