[object Object]

← back to Designerwallcoverings

tres-tintas-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOKEN for write_inventory (TK-11046)

94be31419571755a6f46993afb21e37144eb9023 · 2026-09-02 09:54:45 -0700 · Steve Abrams

go-live-tres-tintas.js (CommonJS, own local gql) read TOKEN from the narrow ADMIN token
(…7d19), which lacks write_inventory, so its inventoryItemUpdate/inventoryActivate/
inventorySetQuantities died at the permission wall. env.sh exports only the narrow token,
so read the FULL token (…2ea5) directly from the secrets file (preferring it, falling back
to ADMIN) — mirrors lib/shopify.mjs. SHOP assignment preserved. Create path
(push-tres-tintas-live.js) untouched, stays least-privilege. Verified golive resolves to …2ea5.
Code-only token-read change; touches no tres-tintas catalog data (per tres-tintas-recover a2a note).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLAwoaNSg3benrUyFxHzLh

Files touched

Diff

commit 94be31419571755a6f46993afb21e37144eb9023
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Sep 2 09:54:45 2026 -0700

    tres-tintas-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOKEN for write_inventory (TK-11046)
    
    go-live-tres-tintas.js (CommonJS, own local gql) read TOKEN from the narrow ADMIN token
    (…7d19), which lacks write_inventory, so its inventoryItemUpdate/inventoryActivate/
    inventorySetQuantities died at the permission wall. env.sh exports only the narrow token,
    so read the FULL token (…2ea5) directly from the secrets file (preferring it, falling back
    to ADMIN) — mirrors lib/shopify.mjs. SHOP assignment preserved. Create path
    (push-tres-tintas-live.js) untouched, stays least-privilege. Verified golive resolves to …2ea5.
    Code-only token-read change; touches no tres-tintas catalog data (per tres-tintas-recover a2a note).
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01QLAwoaNSg3benrUyFxHzLh
---
 scripts/tres-tintas-onboard/go-live-tres-tintas.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/tres-tintas-onboard/go-live-tres-tintas.js b/scripts/tres-tintas-onboard/go-live-tres-tintas.js
index c0943e4..2447fd0 100644
--- a/scripts/tres-tintas-onboard/go-live-tres-tintas.js
+++ b/scripts/tres-tintas-onboard/go-live-tres-tintas.js
@@ -14,7 +14,14 @@
  */
 const fs = require('fs');
 const path = require('path');
-const SHOP = process.env.SHOPIFY_STORE, TOKEN = process.env.SHOPIFY_ADMIN_TOKEN;
+const SHOP = process.env.SHOPIFY_STORE;
+// TK-11046: golive does write_inventory mutations (inventoryItemUpdate/inventoryActivate/
+// inventorySetQuantities below) — a scope the narrow custom-app ADMIN token (…7d19) LACKS.
+// env.sh exports only the narrow token, so prefer the FULL token (…2ea5, carries
+// write_inventory) read directly from the secrets file; fall back to ADMIN. (mirrors lib/shopify.mjs)
+const _SEC = (() => { try { return fs.readFileSync(process.env.HOME + '/Projects/secrets-manager/.env', 'utf8'); } catch { return ''; } })();
+const _tok = (k) => { const v = (process.env[k] || (_SEC.match(new RegExp('^' + k + '=(.+)$', 'm')) || [])[1] || '').trim(); return v.replace(/^['"]|['"]$/g, ''); };
+const TOKEN = _tok('SHOPIFY_FULL_ACCESS_TOKEN') || _tok('SHOPIFY_ADMIN_TOKEN');
 const API = '2024-10', EP = `https://${SHOP}/admin/api/${API}/graphql.json`;
 const APPLY = process.argv.includes('--apply');
 const LIMIT = parseInt((process.argv.find(a => a.startsWith('--limit=')) || '').split('=')[1] || '0', 10);

← d17c5f2 fallingstar-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOK  ·  back to Designerwallcoverings  ·  auto-data-snapshot: 2026-09-02T10:09:29 (3 data files) — scr e27a790 →