[object Object]

← back to Designerwallcoverings

osborne-onboard: golive uses SHOPIFY_FULL_ACCESS_TOKEN for write_inventory (TK-11046)

d99146d9db06563cc78a0e54e7777991361bf2a5 · 2026-09-02 09:51:27 -0700 · Steve Abrams

The narrow custom-app ADMIN token (…7d19) lacks write_inventory, so golive's inventory
mutations (inventoryItemUpdate/inventoryActivate/inventorySetQuantities in go-live.mjs)
died at the permission wall. Repoint ONLY the golive branch of run.sh to
SHOPIFY_FULL_ACCESS_TOKEN (…2ea5, which carries write_inventory); enrich/payloads/create
stay on the least-privilege ADMIN token. Falls back to ADMIN if FULL is unset.
Mirrors the sanderson fix (9cbce45). Verified golive resolves to …2ea5, create to …7d19.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLAwoaNSg3benrUyFxHzLh

Files touched

Diff

commit d99146d9db06563cc78a0e54e7777991361bf2a5
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Sep 2 09:51:27 2026 -0700

    osborne-onboard: golive uses SHOPIFY_FULL_ACCESS_TOKEN for write_inventory (TK-11046)
    
    The narrow custom-app ADMIN token (…7d19) lacks write_inventory, so golive's inventory
    mutations (inventoryItemUpdate/inventoryActivate/inventorySetQuantities in go-live.mjs)
    died at the permission wall. Repoint ONLY the golive branch of run.sh to
    SHOPIFY_FULL_ACCESS_TOKEN (…2ea5, which carries write_inventory); enrich/payloads/create
    stay on the least-privilege ADMIN token. Falls back to ADMIN if FULL is unset.
    Mirrors the sanderson fix (9cbce45). Verified golive resolves to …2ea5, create to …7d19.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01QLAwoaNSg3benrUyFxHzLh
---
 scripts/osborne-onboard/run.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/osborne-onboard/run.sh b/scripts/osborne-onboard/run.sh
index f4d9d2c..530bb07 100755
--- a/scripts/osborne-onboard/run.sh
+++ b/scripts/osborne-onboard/run.sh
@@ -15,13 +15,19 @@ NODE="$(command -v node || true)"
 SEC="$HOME/Projects/secrets-manager/.env"
 export SHOPIFY_STORE="designer-laboratory-sandbox.myshopify.com"
 export SHOPIFY_ADMIN_TOKEN="$(grep -hiE '^SHOPIFY_ADMIN_TOKEN=' "$SEC" | head -1 | cut -d= -f2- | tr -d '"'"'"' ')"
+# golive does inventory mutations (inventoryItemUpdate/inventoryActivate/inventorySetQuantities)
+# which require write_inventory — a scope the narrow custom-app ADMIN token (…7d19) lacks. So ONLY
+# the golive branch below uses SHOPIFY_FULL_ACCESS_TOKEN (…2ea5, which carries write_inventory);
+# create/enrich/payloads stay on the least-privilege ADMIN token. Falls back to ADMIN if FULL unset.
+export SHOPIFY_FULL_ACCESS_TOKEN="$(grep -hiE '^SHOPIFY_FULL_ACCESS_TOKEN=' "$SEC" | head -1 | cut -d= -f2- | tr -d '"'"'"' ')"
 export GEMINI_API_KEY="$(grep -hiE '^GEMINI_API_KEY=' "$SEC" | head -1 | cut -d= -f2- | tr -d '"'"'"' ')"
 step="${1:-}"; shift || true
 case "$step" in
   enrich)   exec "$NODE" enrich-gemini.mjs "$@";;
   payloads) exec "$NODE" build-payloads.mjs "$@";;
   create)   [ -z "${SHOPIFY_ADMIN_TOKEN:-}" ] && { echo "no shopify token"; exit 1; }; exec "$NODE" create-drafts.mjs "$@";;
-  golive)   [ -z "${SHOPIFY_ADMIN_TOKEN:-}" ] && { echo "no shopify token"; exit 1; }; exec "$NODE" go-live.mjs "$@";;
+  golive)   SHOPIFY_ADMIN_TOKEN="${SHOPIFY_FULL_ACCESS_TOKEN:-$SHOPIFY_ADMIN_TOKEN}"; export SHOPIFY_ADMIN_TOKEN
+            [ -z "${SHOPIFY_ADMIN_TOKEN:-}" ] && { echo "no shopify token"; exit 1; }; exec "$NODE" go-live.mjs "$@";;
   canary)   exec "$NODE" batch-canary.mjs "$@";;
   *) echo "usage: bash run.sh {enrich|payloads|create|golive} [args]"; exit 1;;
 esac

← 26fad31 sanderson TK-11046: real daily verify canary (green) — read-  ·  back to Designerwallcoverings  ·  artmura-onboard: golive resolves SHOPIFY_FULL_ACCESS_TOKEN f 8068bd7 →