fix(plugins): check a store connection against the store itself

CHANGELOG.md

@@ -78,6 +78,14 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
   `COMPUTER_MEMORY_HIGH_PERCENT=0` and `COMPUTER_TAB_IDLE_MS=0` (Helm: `computers.memoryHighPercent`
   and `computers.tabIdleMs`) keep the old behaviour.
 
+### A store connection is checked against the store itself
+
+After connecting a key, OpenBot checks it with one argument-free read, preferring an identity read
+and otherwise taking the first safe read alphabetically. For Shopify that was `SHOPIFY_COUNT_BLOGS`,
+which needs the `read_content` scope a store app with only order and product scopes does not have,
+so a working key was reported as rejected. A store's own details now count as an identity read, so
+the check calls `SHOPIFY_GET_SHOP_DETAILS` instead.
+
 ### A computer closes browsers nobody is using when its memory runs high
 
 A computer runs one browser for each Bot that is browsing, and the only limits were a count and half

server/src/plugins/plugin-store/model.ts

@@ -1114,7 +1114,7 @@ export const CLIENT_REREGISTRATION_BACKOFF_MS = 5 * 60_000;
  * `LINEAR_GET_ME` — and an unanchored match would take `SLACK_PROFILE_SET` for an identity read.
  */
 export const IDENTITY_ACTION =
-  /(_GET_ME|_PROFILE|_CURRENT_USER|_USER_INFO|_WHOAMI)$/;
+  /(_GET_ME|_PROFILE|_CURRENT_USER|_USER_INFO|_WHOAMI|_GET_SHOP_DETAILS)$/;
 
 /**
  * Every broker's id namespace, reserved together. See {@link BROKERED_PROFILE} in `./access` for

server/tests/plugin-store-identity-action.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, test } from "bun:test";
+import { IDENTITY_ACTION } from "../src/plugins/plugin-store/model";
+
+describe("IDENTITY_ACTION", () => {
+  test("recognises a store's own details as an identity read", () => {
+    // For a store, its own details are the identity: probing these needs no
+    // extra scope, unlike e.g. SHOPIFY_COUNT_BLOGS which needs read_content
+    // and 403s on a store app with only order and product scopes.
+    expect(IDENTITY_ACTION.test("SHOPIFY_GET_SHOP_DETAILS")).toBe(true);
+  });
+
+  test("still recognises the existing identity reads", () => {
+    for (const name of [
+      "STRIPE_GET_ME",
+      "SLACK_GET_PROFILE",
+      "LINEAR_GET_CURRENT_USER",
+      "GITHUB_GET_USER_INFO",
+      "NOTION_WHOAMI",
+    ]) {
+      expect(IDENTITY_ACTION.test(name)).toBe(true);
+    }
+  });
+
+  test("does not match non-identity actions", () => {
+    for (const name of [
+      "SHOPIFY_COUNT_BLOGS",
+      "SHOPIFY_UPDATE_ORDER",
+      "SLACK_PROFILE_SET",
+      "GITHUB_WHOAMI_STATS",
+    ]) {
+      expect(IDENTITY_ACTION.test(name)).toBe(false);
+    }
+  });
+});