metatrondelivery/shopify.app.toml
metatroncubeswdev cc3303d318 fix: disable GDPR compliance webhooks pending Protected Customer Data access
shopify app dev refused to push the 3 mandatory compliance-topic webhooks
(customers/data_request, customers/redact, shop/redact) with "This app is
not approved to subscribe to webhook topics containing protected customer
data" — subscribing to these requires the org to first request and be
granted Protected Customer Data Access in the Partner Dashboard, a manual
approval step outside the CLI/config entirely.

Commented out the three subscription blocks in shopify.app.toml (handlers
are untouched and still fully wired) so dev can proceed now. README.md
gets a new "Before public launch" section as the reminder to re-enable
them once access is granted — this is a hard requirement for BfS/public
submission per CLAUDE.md, not something to forget once dev is unblocked.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-23 23:19:26 -04:00

81 lines
3.1 KiB
TOML

# Learn more about configuring your app at https://shopify.dev/docs/apps/tools/cli/configuration
client_id = "890f611da9f31c1a8e3183b5300b2f53"
name = "Metatron-delivery"
application_url = "https://shopify.dev/apps/default-app-home"
embedded = true
[access_scopes]
# Learn more at https://shopify.dev/docs/apps/tools/cli/configuration#access_scopes
scopes = "read_customers,read_locales,read_locations,read_markets,read_metaobjects,read_orders,read_products,write_cart_transforms,write_delivery_customizations,write_metaobjects,write_orders,write_payment_customizations"
[auth]
redirect_urls = [ "https://shopify.dev/apps/default-app-home/api/auth" ]
[webhooks]
api_version = "2026-10"
# Handled by: app/routes/webhooks.app.uninstalled.tsx
[[webhooks.subscriptions]]
uri = "/webhooks/app/uninstalled"
topics = ["app/uninstalled"]
# Handled by: app/routes/webhooks.app.scopes_update.tsx
[[webhooks.subscriptions]]
uri = "/webhooks/app/scopes_update"
topics = ["app/scopes_update"]
# Handled by: app/routes/webhooks.orders.create.tsx
[[webhooks.subscriptions]]
uri = "/webhooks/orders/create"
topics = ["orders/create"]
# Handled by: app/routes/webhooks.orders.updated.tsx
[[webhooks.subscriptions]]
uri = "/webhooks/orders/updated"
topics = ["orders/updated"]
# Handled by: app/routes/webhooks.orders.cancelled.tsx
[[webhooks.subscriptions]]
uri = "/webhooks/orders/cancelled"
topics = ["orders/cancelled"]
# Mandatory GDPR compliance topics — required for Built-for-Shopify /
# public app review. TEMPORARILY DISABLED: `shopify app dev`/`deploy`
# refuses to push these until the org has requested and been granted
# "Protected customer data access" in the Partner Dashboard (Apps ->
# this app -> API access -> Protected customer data) — that's a manual
# questionnaire/approval step, not something the CLI or config can
# bypass. RE-ENABLE these three blocks (handlers already exist and are
# wired: app/routes/webhooks.customers.data_request.tsx,
# webhooks.customers.redact.tsx, webhooks.shop.redact.tsx) once that
# access is granted, and before any public launch/BfS submission.
# [[webhooks.subscriptions]]
# uri = "/webhooks/customers/data_request"
# compliance_topics = ["customers/data_request"]
# [[webhooks.subscriptions]]
# uri = "/webhooks/customers/redact"
# compliance_topics = ["customers/redact"]
# [[webhooks.subscriptions]]
# uri = "/webhooks/shop/redact"
# compliance_topics = ["shop/redact"]
# App proxy so the storefront Theme App Extension can call our backend
# without CORS issues (see IMPLEMENTATION_PLAN.md §5.3). `shopify app dev`
# points this at your dev tunnel automatically when
# automatically_update_urls_on_dev is true (see [build] below); if it
# doesn't, set it manually to `<your-tunnel-url>/apps/scheduling` — the
# Remix routes it forwards to (apps.scheduling.*.tsx) assume that exact
# prefix.
[app_proxy]
url = "https://replace-with-your-tunnel-url.example.com/apps/scheduling"
subpath = "scheduling"
prefix = "apps"
[build]
include_config_on_deploy = true
automatically_update_urls_on_dev = true