[object Object]

← back to Designerwallcoverings

fallingstar-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOKEN for write_inventory (TK-11046)

d17c5f2fe58b2be0ed4f902399fbd2c3b0311db5 · 2026-09-02 09:53:56 -0700 · Steve Abrams

go-live-fallingstar.js (CommonJS, own local gql) read TOKEN from the narrow ADMIN token
(…7d19), which lacks write_inventory, so its inventoryItemUpdate/inventoryActivate/
inventorySetQuantities died at the permission wall. Env wrappers export only the narrow
token, so read the FULL token (…2ea5) directly from the secrets file (preferring it,
falling back to ADMIN) — mirrors lib/shopify.mjs. Create path (push-fallingstar-live.js)
untouched, stays least-privilege. Verified golive resolves to …2ea5.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLAwoaNSg3benrUyFxHzLh

Files touched

Diff

commit d17c5f2fe58b2be0ed4f902399fbd2c3b0311db5
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Sep 2 09:53:56 2026 -0700

    fallingstar-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOKEN for write_inventory (TK-11046)
    
    go-live-fallingstar.js (CommonJS, own local gql) read TOKEN from the narrow ADMIN token
    (…7d19), which lacks write_inventory, so its inventoryItemUpdate/inventoryActivate/
    inventorySetQuantities died at the permission wall. Env wrappers export only the narrow
    token, so read the FULL token (…2ea5) directly from the secrets file (preferring it,
    falling back to ADMIN) — mirrors lib/shopify.mjs. Create path (push-fallingstar-live.js)
    untouched, stays least-privilege. Verified golive resolves to …2ea5.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01QLAwoaNSg3benrUyFxHzLh
---
 scripts/fallingstar-onboard/go-live-fallingstar.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/fallingstar-onboard/go-live-fallingstar.js b/scripts/fallingstar-onboard/go-live-fallingstar.js
index 42bc104..a917242 100644
--- a/scripts/fallingstar-onboard/go-live-fallingstar.js
+++ b/scripts/fallingstar-onboard/go-live-fallingstar.js
@@ -12,7 +12,14 @@
  */
 const fs = require('fs');
 const path = require('path');
-const TOKEN = process.env.SHOPIFY_ADMIN_TOKEN;
+// TK-11046: golive does write_inventory mutations (inventoryItemUpdate/inventoryActivate/
+// inventorySetQuantities below) — a scope the narrow custom-app ADMIN token (…7d19) LACKS.
+// Prefer the FULL token (…2ea5, carries write_inventory) from env OR the secrets file; fall
+// back to the narrow ADMIN token. (Env wrappers here export only ADMIN, so the file read is
+// required to actually resolve FULL — mirrors lib/shopify.mjs.)
+const _SEC = (() => { try { return fs.readFileSync(process.env.HOME + '/Projects/secrets-manager/.env', 'utf8'); } catch { return ''; } })();
+const _tok = (k) => { const v = (process.env[k] || (_SEC.match(new RegExp('^' + k + '=(.+)$', 'm')) || [])[1] || '').trim(); return v.replace(/^['"]|['"]$/g, ''); };
+const TOKEN = _tok('SHOPIFY_FULL_ACCESS_TOKEN') || _tok('SHOPIFY_ADMIN_TOKEN');
 const STORE = process.env.SHOPIFY_STORE || 'designer-laboratory-sandbox.myshopify.com';
 const EP = `https://${STORE}/admin/api/2024-10/graphql.json`;
 const APPLY = process.argv.includes('--apply');

← 8068bd7 artmura-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOKEN f  ·  back to Designerwallcoverings  ·  tres-tintas-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOK 94be314 →