`find-content-token.sh`

32 lines
#!/usr/bin/env bash
# find-content-token.sh — identify which already-stored DW Shopify token carries
# read_content/write_content scope, by probing the blogs.json endpoint.
# READ-ONLY: prints only the var NAME + last-4 + HTTP result. Never prints a full token.
# Purpose-built so a single narrow permission rule can allow it (Steve, 2026-07-21, DTD-B).
set -euo pipefail
cd "$(dirname "$0")"
STORE="designer-laboratory-sandbox.myshopify.com"
API="2024-10"
CANDIDATES=(SHOPIFY_ADMIN_TOKEN SHOPIFY_DRAFT_TOKEN SHOPIFY_ORDERS_TOKEN \
            SHOPIFY_FULL_ACCESS_TOKEN SHOPIFY_CONTENT_TOKEN SHOPIFY_WRITE_CONTENT_TOKEN \
            SHOPIFY_WRITECONTENT_TOKEN SHOPIFY_BLOG_TOKEN)
WINNER=""
for n in "${CANDIDATES[@]}"; do
  line=$(grep -m1 "^${n}=" .env 2>/dev/null || true)
  [ -z "$line" ] && { printf '%-30s — not stored\n' "$n"; continue; }
  tok="${line#*=}"; tok="${tok%\"}"; tok="${tok#\"}"; tok="${tok%\'}"; tok="${tok#\'}"
  code=$(curl -s -o /dev/null -w '%{http_code}' \
         "https://$STORE/admin/api/$API/blogs.json" \
         -H "X-Shopify-Access-Token: $tok")
  if [ "$code" = "200" ]; then
    printf '%-30s …%s  →  ✅ CONTENT OK\n' "$n" "${tok: -4}"
    [ -z "$WINNER" ] && WINNER="$n"
  elif [ "$code" = "403" ]; then
    printf '%-30s …%s  →  403 (no content scope)\n' "$n" "${tok: -4}"
  else
    printf '%-30s …%s  →  HTTP %s\n' "$n" "${tok: -4}" "$code"
  fi
done
echo "---"
[ -n "$WINNER" ] && echo "USABLE_CONTENT_TOKEN=$WINNER" || echo "USABLE_CONTENT_TOKEN=none"