Fix: Allow compliance webhooks with legacy install flow #6108
+121
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Coverage report
Show new covered files 🐣
Show files with reduced coverage 🔻
Test suite run success3032 tests passing in 1317 suites. Report generated by 🧪jest coverage report action from 7974965 |
isaacroldan
reviewed
Jul 15, 2025
| await expect(app.preDeployValidation()).resolves.not.toThrow() | ||
| }) | ||
|
|
||
| test('does not throw an error for subscription with only compliance_topics and no topics field', async () => { |
There was a problem hiding this comment.
isn't this test exactly the same as the first one? or am i missing something?
|
Do we need a patch release for this? |
isaacroldan
approved these changes
Jul 15, 2025
|
Hey folks - could this be extended to support other webhooks that don't require scopes? Our Fixed by this PR:
Not fixed by this PR, but don't seem to require additional scopes:
I can open a new issue for this if it's easier. Here's the relevant part of our configuration that was working in CLI version [access_scopes]
scopes = "read_content,write_content,read_customers,write_customers,read_orders,read_all_orders,read_products,write_products,read_price_rules,write_price_rules,read_discounts,write_discounts,write_gift_cards"
use_legacy_install_flow = true
[build]
include_config_on_deploy = true
[auth]
redirect_urls = [
"https://app.example.com/auth/shopify/offline/callback",
"https://app.example.com/auth/shopify/online/callback",
]
[webhooks]
api_version = "2025-01"
[[webhooks.subscriptions]]
uri = "https://example.com/shopify/webhooks/customers/data_request"
compliance_topics = ["customers/data_request"]
[[webhooks.subscriptions]]
uri = "https://example.com/shopify/webhooks/customers/redact"
compliance_topics = ["customers/redact"]
[[webhooks.subscriptions]]
uri = "https://example.com/shopify/webhooks/shop/redact"
compliance_topics = ["shop/redact"]
[[webhooks.subscriptions]]
topics = ["app/uninstalled"]
uri = "https://example.com/shopify/uninstall"
[[webhooks.subscriptions]]
uri = "https://example.com/shopify/webhooks/customer_account_settings/update"
topics = ["customer_account_settings/update"] |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
Fixes #6003 regression - After PR #6003, users reported that the CLI incorrectly prevents deployment when using only compliance webhooks with
use_legacy_install_flow = true.The validation treats ALL webhook subscriptions as app-specific, including compliance topics which are mandatory for public apps and should be allowed with legacy install flow.
User report: https://community.shopify.dev/t/compliance-topics-issue/18702
WHAT is this pull request doing?
This PR fixes the webhook validation logic to properly distinguish between app-specific webhooks and compliance webhooks:
topicsfield as app-specificThe fix allows compliance-only webhook configurations to work with legacy install flow, which is necessary because:
compliance_topicsfield, not thetopicsfieldHow to test your changes?
use_legacy_install_flow = trueshopify app deploy- it should now succeedtopics- deployment should fail as expectedPost-release steps
None required.
Measuring impact
How do we know this change was effective? Please choose one:
Checklist