Theme Access token fails to fetch products.json

[gab-umich]

Using a setup like this:

# .github/workflows/lighthouse-ci.yml
name: Shopify Lighthouse CI
on: [push]
jobs:
  lhci:
    name: Lighthouse
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Lighthouse
      uses: shopify/lighthouse-ci-action@v1.2.2
      with:
        access_token: ${{ secrets.LIGHTHOUSE_PROFILE_SHOPIFY_CLI_THEME_TOKEN }}
        store: ${{ vars.LIGHTHOUSE_PROFILE_THEME_STORE }}
        password: ${{ secrets.LIGHTHOUSE_PROFILE_SHOPIFY_PASSWORD }}
        lhci_github_app_token: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}
        lhci_min_score_performance: 0.9
        lhci_min_score_accessibility: 0.9

I ended up with curl: (22) The requested URL returned error: 401. Testing locally, the following using CLI worked without any issues:

shopify theme pull \
--store yomu-lighthouse-profile-shop.myshopify.com
--password shptka_***

Looking into this, the issue originated from the curl step in the entry point script that should fetch products.json with GraphQL. It just fails silently without much verbose output. So I repro'ed this locally with:

curl -sX GET \
"https://yomu-lighthouse-profile-shop.myshopify.com/admin/api/2021-04/products.json?published_status=published&limit=1" \
-H "X-Shopify-Access-Token: shptka_***"

and that also failed silently.

Is the shptka token generation borked somehow in the current Theme Access build? I was able to fetch the products.json with my own token generated from a custom app, when I configured it to have read_products access.

[graygilmore]

That makes sense. Theme Access tokens don't have read_products. You'll note that the README explains that a custom app must be used for authentication: https://github.com/Shopify/lighthouse-ci-action?tab=readme-ov-file#authentication

With custom apps now being considered legacy we'll need to update that documentation!

[racoleman]

@graygilmore Since it is no longer possible to create legacy custom apps, does that mean this action cannot currently be used on new projects?

[graygilmore]

As-is, correct. I'm going to see if I can make it work with the new Dev Dashboard apps.

[gab-umich]

From these proposed lines in #100 it seems Theme Access token will be the way to go in future. Adding read_products access to it seems to be a reasonable next step. Wondering if this issue should be forwarded to that team somehow.

[graygilmore]

That was a PR proposed by somebody that doesn't work at Shopify

Wondering if this issue should be forwarded to that team somehow

I am on that team 😄

You can also provide a product_handle argument to the action to skip the need to have read_products. That would allow you to use a Theme Access token.

[graygilmore]

Probably would also need collection_handle.

[gab-umich]

Oh I see now 🙂 glad this issue is in the right hands.

Reference to the product_handle and collection_handle usage will surely be helpful in the README for someone starting out on this.

I wonder if there are longer term plans to authenticate after Custom App gets completely sunset. I've tried authenticating using a Dev Dashboard App myself but the token yielded access denial consistently (and with OAuth, there's little I can trace from my end as to where it failed.)

A unified Shopify App like Theme Access makes lots of sense to me. It just needs more fine grained control 😄 Though that's an entire new scope, oh well.