Skip to content

Normalize store domains for app-admin authentication - #9044

Merged
madmath merged 3 commits into
Shopify:mainfrom
madmath:secfix/21-normalize-admin-store
Oct 30, 2026
Merged

madmath merged 3 commits into
Shopify:mainfrom
madmath:secfix/21-normalize-admin-store

Conversation

@madmath

@madmath madmath commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

WHY are these changes introduced?

App-admin authentication should use the same store-domain rules as other CLI Kit APIs.

WHAT is this pull request doing?

Apply the shared store normalizer in the public authentication helper.

Compatibility review needed: callers that use non-default ports or userinfo now receive validation errors, and the returned store domain is normalized. The changeset currently uses patch; maintainers should confirm the versioning and deprecation requirements before release.

Validation

Node 26.12.1, pnpm 10.11.1:

  • pnpm vitest run packages/cli-kit/src/public/node/session.test.ts packages/cli-kit/src/public/node/context/fqdn.test.ts — 77 passed. All five added cases failed before the fix; 40 existing session tests passed.
  • pnpm nx run-many --all --target=type-check — passed.
  • pnpm nx run-many --all --target=lint — passed.
  • pnpm refresh-code-documentation — passed, no generated changes.
  • git diff --check — passed.

The full unit suite, cross-platform matrix, and E2E tests were not run locally.

CI follow-up: f514706be2 gives the Windows PowerShell encoding test a separate startup budget and a shorter subprocess timeout, retaining its exit-code and UTF-8 assertions. The previously failing Windows/Node 26 job and all 12 unit-test matrix jobs now pass, along with the overall unit-test gate. Focused local verification: 102 tests passed, 2 Windows-only tests skipped on macOS; affected-file ESLint and app type checks passed.

Checklist

  • I've considered possible cross-platform impacts (Mac, Linux, Windows)
  • I've considered possible documentation changes
  • I've considered analytics changes to measure impact
  • The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

Use the shared store-domain normalizer so app-admin authentication follows the same input rules as other CLI Kit helpers. Keep the returned session and error messages consistent with the normalized domain.

Co-authored-by: River <river@shopify.com>
@madmath
madmath marked this pull request as ready for review October 29, 2026 15:15
@madmath
madmath requested a review from a team as a code owner October 29, 2026 15:15
@madmath

madmath commented Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

@stephanie-shopify could you review this change? Please see the description for compatibility questions and verification limitations.

Allow native PowerShell startup on shared Windows runners without applying the in-process unit-test deadline. Bound the subprocess at 25 seconds within a 30-second test budget, and report process errors while retaining the exit-code and UTF-8 assertions.
@madmath
madmath enabled auto-merge October 30, 2026 13:36

@dmerand dmerand left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making domain normalization more consistent 👍🏼

@madmath
madmath added this pull request to the merge queue Oct 30, 2026
Merged via the queue into Shopify:main with commit bd10dd0 Oct 30, 2026
28 checks passed
@madmath
madmath deleted the secfix/21-normalize-admin-store branch October 30, 2026 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants