From 0538980eb5cf05bec92f108e8441cd30609aa32e Mon Sep 17 00:00:00 2001 From: metatroncubeswdev Date: Sun, 23 Aug 2026 23:25:10 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20drop=20unused=20read=5Fcustomers=20scope?= =?UTF-8?q?=20=E2=80=94=20likely=20the=20real=20GDPR=20gate=20trigger?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commenting out the 3 compliance-topic webhook subscriptions (previous commit) didn't clear the "not approved to subscribe to webhook topics containing protected customer data" error — same 3 errors, same wording, even with those blocks fully removed from shopify.app.toml. That means the gate isn't about our webhook declarations at all; it's much more likely triggered by the `read_customers` OAuth scope itself; Shopify's Protected Customer Data Access requirement applies to the scope, and the CLI's error message just reuses the same generic wording for the whole policy category regardless of which part of the config triggered it. Removed read_customers from shopify.app.toml, .env, and .env.example. This is also independently correct per CLAUDE.md's "request the minimum OAuth scopes needed" — nothing in the codebase actually calls the Customers API; Booking.customerEmail/customerPhone come straight off the orders/create webhook payload, which read_orders already covers. Add it back only when a feature that genuinely needs it exists, and expect to need Protected Customer Data Access granted at that point regardless. Co-Authored-By: Claude Sonnet 5 --- .env.example | 2 +- shopify.app.toml | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.env.example b/.env.example index d9f1f0f..916b740 100644 --- a/.env.example +++ b/.env.example @@ -2,7 +2,7 @@ # Never commit the real .env — this file is the template only. SHOPIFY_API_KEY= SHOPIFY_API_SECRET= -SCOPES=read_products,read_customers,read_orders,write_orders,read_locations,read_metaobjects,write_metaobjects,write_cart_transforms,write_delivery_customizations,write_payment_customizations,read_markets,read_locales +SCOPES=read_products,read_orders,write_orders,read_locations,read_metaobjects,write_metaobjects,write_cart_transforms,write_delivery_customizations,write_payment_customizations,read_markets,read_locales SHOPIFY_APP_URL=https://replace-with-your-tunnel-url.example.com SHOP_CUSTOM_DOMAIN= diff --git a/shopify.app.toml b/shopify.app.toml index 74ce3ce..737ac9e 100644 --- a/shopify.app.toml +++ b/shopify.app.toml @@ -7,7 +7,14 @@ embedded = true [access_scopes] # Learn more at https://shopify.dev/docs/apps/tools/cli/configuration#access_scopes -scopes = "read_customers,read_locales,read_locations,read_markets,read_metaobjects,read_orders,read_products,write_cart_transforms,write_delivery_customizations,write_metaobjects,write_orders,write_payment_customizations" +# read_customers deliberately omitted: no feature currently calls the +# Customers API (Booking.customerEmail/customerPhone come straight off the +# orders/create webhook payload, covered by read_orders) — requesting it +# unused would also gate this app behind Shopify's Protected Customer Data +# Access approval for no reason. Add it back only when a feature (e.g. the +# "recognize returning customers" parity item) actually needs it, and +# expect to need that approval granted at that point. +scopes = "read_locales,read_locations,read_markets,read_metaobjects,read_orders,read_products,write_cart_transforms,write_delivery_customizations,write_metaobjects,write_orders,write_payment_customizations" [auth] redirect_urls = [ "https://shopify.dev/apps/default-app-home/api/auth" ]