Make store auth session reuse opt-in per theme command - #8183
Merged
Conversation
Store auth session reuse was added to the shared ThemeCommand base class, so every theme command with a password flag inherited it, while only theme pull and theme push declare the scopes they require. The base storeAuthScopes() returned [], and requiredScopes.every() on an empty array is always true, so commands like theme dev adopted any cached store auth session, including ones without theme scopes, causing 401s and missing-scope errors that could not be fixed via auth logout. Commands now opt in to store auth session reuse by returning the scopes they require from storeAuthScopes(); the default (undefined) opts the command out entirely, so only theme pull and theme push reuse stored store auth sessions. Assisted-By: devx/60503589-d48c-43b2-8fba-b0df1e076f15
Contributor
Author
This was referenced Jul 28, 2026
Contributor
|
I think some other commands should still apply, like |
alfonso-noriega
marked this pull request as ready for review
July 28, 2026 14:56
isaacroldan
approved these changes
Jul 28, 2026
graygilmore
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
Regression from #7783 (
4.4.0), reported by Enterprise Support (Slack thread) and in the dev community forum.Store-auth session reuse was added to the shared
ThemeCommand.createSession, so every theme command with apasswordflag inherited it — while #7783 only intended it fortheme pullandtheme push. The basestoreAuthScopes()returned[], and[].every(...)is alwaystrue, so commands liketheme devadopted any cachedstore authsession, including ones without theme scopes. The resulting401 Invalid API key or access token/missing read_themes access scopeerrors were terminal, andshopify auth logoutcouldn't fix them (store-auth sessions live in a separateshopify-cli-storestorage bucket).WHAT is this pull request doing?
storeAuthScopes()contract tostring[] | undefined: returningundefined(the default) opts the command out of store-auth session reuse entirely; commands opt in by declaring the scopes they require.theme pull(read_themes) andtheme push(read_themes,write_themes) opt in — matching Use store auth sessions for theme commands #7783's stated intent.theme devand all other theme commands authenticate normally again.this.How to test your changes?
shopify store auth --store <store> --scopes read_products(a session without theme scopes)shopify theme dev --store <store>— before: fails withmissing read_themes access scopeor 401; after: authenticates through the normal theme flow.shopify theme pull --store <store>aftershopify store auth --store <store> --scopes read_themes,write_themes— still reuses the stored session (no login prompt).Measuring impact