Skip to content

Restore usage of custom app passwords to theme commands #6626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
graygilmore merged 2 commits into from
Nov 24, 2025
Merged

Restore usage of custom app passwords to theme commands #6626

graygilmore merged 2 commits into from
Nov 24, 2025

Conversation

@graygilmore
Copy link
Contributor

@graygilmore graygilmore commented Nov 14, 2025 •
edited
Loading

WHY are these changes introduced?

This was previously stripped away but theme developers are still using this flow and are forced to pin to older versions. I'm returning the functionality in this PR but calling out the specific places where it doesn't work:

  • dev does not support hot module reloading
  • console and profile commands do not work at all

I tested on all of the theme commands:

check - ✅
console - ❌
delete - ✅
dev - 🟡 
duplicate - ✅
info - ✅
init - ✅
language-server - ✅
list - ✅
open - ✅
package - ✅
profile - ❌
publish - ✅
pull - ✅
push - ✅
rename - ✅
share - ✅

For console and profile we now throw an AbortError. For dev we render a warning.

How to test your changes?

  1. Install the snapped version npm i -g --@shopify:registry=https://registry.npmjs.org @shopify/[email protected]
  2. Run through as many of the commands as you'd like to test

@graygilmore graygilmore force-pushed the gg-allow-custom-app-passwords branch 2 times, most recently from 366d8b4 to fb207c2 Compare November 14, 2025 23:13
@github-actions
Copy link
Contributor

github-actions bot commented Nov 14, 2025 •
edited
Loading

Coverage report

St.❔
 Category Percentage Covered / Total
🟡 Statements
79.2% (-0.02% 🔻)
 13647/17230
🟡 Branches
73.05% (-0.05% 🔻)
 6648/9100
🟡 Functions
79.36% (-0.01% 🔻)
 3518/4433
🟡 Lines
79.57% (-0.02% 🔻)
 12892/16203
Show new covered files 🐣
St.❔
 File Statements Branches Functions Lines
🟢
... / bulk-operation-run-mutation.ts
 100% 100% 100% 100%
🟢
... / bulk-operation-run-query.ts
 100% 100% 100% 100%
🟢
... / staged-uploads-create.ts
 100% 100% 100% 100%
🟢
... / execute-bulk-operation.ts
 95.24% 85.71% 100% 95%
🟢
... / run-mutation.ts
 100% 100% 100% 100%
🟢
... / run-query.ts
 100% 100% 100% 100%
🟡
... / stage-file.ts
 74.29% 53.33% 85.71% 73.53%
Show files with reduced coverage 🔻
St.❔
 File Statements Branches Functions Lines
🟢
... / ConcurrentOutput.tsx
98.36% (-1.64% 🔻)
92% (-4% 🔻)
 100%
98.33% (-1.67% 🔻)
🔴
... / ui.tsx
50.82% (-0.79% 🔻)
42.86% (-5.53% 🔻)
54.55% (+1.42% 🔼)
50% (-0.82% 🔻)
🟢
... / console.ts
81.82% (+15.15% 🔼)
75% (-25% 🔻)
100% (+33.33% 🔼)
81.82% (+15.15% 🔼)
🔴
... / dev.ts
12.77% (-0.57% 🔻)
2.78% (-0.16% 🔻)
 57.14%
12.77% (-0.57% 🔻)
🟡
... / theme-environment.ts
69.57% (-1.86% 🔻)
 50%
55.56% (-3.27% 🔻)
69.57% (-1.86% 🔻)

Test suite run success

3365 tests passing in 1377 suites.

Report generated by 🧪jest coverage report action from 56c08f7

@graygilmore
Copy link
Contributor Author

graygilmore commented Nov 14, 2025

/snapit

@github-actions
Copy link
Contributor

github-actions bot commented Nov 14, 2025

🫰✨ Thanks @graygilmore! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

npm i -g --@shopify:registry=https://registry.npmjs.org @shopify/[email protected]

Caution

After installing, validate the version by running just shopify in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

@graygilmore graygilmore marked this pull request as ready for review November 14, 2025 23:25
@graygilmore graygilmore requested review from a team as code owners November 14, 2025 23:25
@Shopify Shopify deleted a comment from github-actions bot Nov 14, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Nov 14, 2025

We detected some changes at packages/*/src and there are no updates in the .changeset.
If the changes are user-facing, run pnpm changeset add to track your changes and include them in the next release CHANGELOG.

Caution

DO NOT create changesets for features which you do not wish to be included in the public changelog of the next CLI release.

EvilGenius13
EvilGenius13 reviewed Nov 17, 2025
View reviewed changes
packages/theme/src/cli/services/dev.ts Outdated
if (options.password?.startsWith('shpat_')) {
renderWarning({
headline: 'Admin API token missing features:',
body: 'Directly using an Admin API token will result in some missing features like hot module reloading. We recommend generating a password from the Theme Access app or authenticating directly.',
Copy link
Contributor

@EvilGenius13 EvilGenius13 Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you think about matching up the wording for console and dev a bit? I wouldn't mind seeing something closer to console/profile with the Alternatively, you can authenticate normally by not passing the --password flag.

Copy link
Contributor Author

@graygilmore graygilmore Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushed up a change!
image

@graygilmore graygilmore force-pushed the gg-allow-custom-app-passwords branch 2 times, most recently from f729a75 to 6fc48ee Compare November 21, 2025 00:29
@graygilmore
Allow custom app tokens for theme commands
56c08f7 
This was previously stripped away but theme developers are still using
this flow and are forced to pin to older versions. I'm returning the
functionality in this PR but calling out the specific places where it
doesn't work:

- `dev` does not support hot module reloading
- `console` and `profile` commands do not work at all
@graygilmore graygilmore force-pushed the gg-allow-custom-app-passwords branch from 6fc48ee to 56c08f7 Compare November 21, 2025 23:15
@graygilmore
Copy link
Contributor Author

graygilmore commented Nov 21, 2025 •
edited
Loading

Force Push Patch Notes

  • Updated to note that password protected storefronts also don't work

Thanks to both @dejmedus and @EvilGenius13 for the tophatting 😄

dejmedus
dejmedus approved these changes Nov 21, 2025
View reviewed changes
Copy link
Contributor

@dejmedus dejmedus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The commands I tried all worked as expected and the warnings look good!

🎩 Image above with store password set, below without Image

EvilGenius13
EvilGenius13 approved these changes Nov 24, 2025
View reviewed changes
Copy link
Contributor

@EvilGenius13 EvilGenius13 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎩 went well and the warnings look good!

@graygilmore graygilmore added this pull request to the merge queue Nov 24, 2025
Merged via the queue into main with commit 6a48d49 Nov 24, 2025
25 checks passed
@graygilmore graygilmore deleted the gg-allow-custom-app-passwords branch November 24, 2025 19:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dejmedus dejmedus dejmedus approved these changes

@EvilGenius13 EvilGenius13 EvilGenius13 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: Cannot provide a custom app access token to --password flag

3 participants

@graygilmore @dejmedus @EvilGenius13