From ed332dd4efb9445a341fc8c44a27deaacf2bedb8 Mon Sep 17 00:00:00 2001 From: Alfonso Noriega Date: Tue, 28 Jul 2026 15:10:51 +0200 Subject: [PATCH] Require recorded scopes to reuse a store auth session in theme commands hasRequiredStoreAuthScopes treated a stored session with no recorded scopes as satisfying any requirement, so theme pull and theme push could adopt sessions whose actual grant is unknown. Both store auth and preview store creation always record scopes, so an empty scope list means we cannot verify the grant; fall back to normal theme authentication instead. Assisted-By: devx/60503589-d48c-43b2-8fba-b0df1e076f15 --- packages/theme/src/cli/utilities/theme-command.test.ts | 8 +++----- packages/theme/src/cli/utilities/theme-command.ts | 2 -- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/packages/theme/src/cli/utilities/theme-command.test.ts b/packages/theme/src/cli/utilities/theme-command.test.ts index 289eb330446..7af98289585 100644 --- a/packages/theme/src/cli/utilities/theme-command.test.ts +++ b/packages/theme/src/cli/utilities/theme-command.test.ts @@ -356,7 +356,7 @@ describe('ThemeCommand', () => { }) }) - test('uses a matching store auth cache session when stored scopes are empty', async () => { + test('falls back to theme authentication when the stored session has no recorded scopes', async () => { vi.mocked(getCurrentStoredStoreAppSession).mockReturnValue({ store: 'test-store.myshopify.com', clientId: 'store-auth-client-id', @@ -371,10 +371,8 @@ describe('ThemeCommand', () => { await command.run() - expect(ensureAuthenticatedThemes).not.toHaveBeenCalled() - expect(command.commandCalls[0]).toMatchObject({ - session: {token: 'shpat_preview_token', storeFqdn: 'test-store.myshopify.com'}, - }) + expect(ensureAuthenticatedThemes).toHaveBeenCalledWith('test-store.myshopify.com', undefined) + expect(command.commandCalls[0]).toMatchObject({session: mockSession}) }) test('falls back to theme authentication when matching store auth session lacks required scopes', async () => { diff --git a/packages/theme/src/cli/utilities/theme-command.ts b/packages/theme/src/cli/utilities/theme-command.ts index c31f79ca0ec..aebe3c48c89 100644 --- a/packages/theme/src/cli/utilities/theme-command.ts +++ b/packages/theme/src/cli/utilities/theme-command.ts @@ -447,8 +447,6 @@ export default abstract class ThemeCommand extends Command { } private hasRequiredStoreAuthScopes(sessionScopes: string[], requiredScopes: string[]): boolean { - if (sessionScopes.length === 0) return true - const expandedScopes = this.expandImpliedStoreAuthScopes(sessionScopes) return requiredScopes.every((scope) => expandedScopes.has(scope)) }