Skip to content

Conversation

@nickwesselman
Copy link
Contributor

@nickwesselman nickwesselman commented Dec 5, 2025

WHY are these changes introduced?

This PR adds support for executing GraphQL operations on production stores, while maintaining safety by restricting mutations to development stores only.

WHAT is this pull request doing?

  • Adds validation to prevent mutations on non-development stores
  • Updates the executeBulkOperation and executeOperation services to accept a store object instead of just the FQDN
  • Adds a new GraphQL query for fetching stores by domain that includes store type information
  • Modifies the store context to optionally include all store types, not just development stores
  • Updates the storeByDomain method to support retrieving all store types
  • Adds tests for the new validation logic

How to test your changes?

  1. Try executing a query on a production store:

    shopify app execute --store=your-production-store.myshopify.com --query "{ shop { name } }"
    

    This should succeed.

  2. Try executing a mutation on a production store:

    shopify app execute --store=your-production-store.myshopify.com --query "mutation { productUpdate(input: {}) { product { id } } }"
    

    This should fail with an error message indicating mutations can only be executed on Dev Stores.

  3. Try executing a mutation on a development store:

    shopify app execute --store=your-dev-store.myshopify.com --query  "mutation { productUpdate(input: {}) { product { id } } }"
    

    This should succeed.

Measuring impact

How do we know this change was effective? Please choose one:

  • n/a - this doesn't need measurement, e.g. a linting rule or a bug-fix

Checklist

  • I've considered possible cross-platform impacts (Mac, Linux, Windows)
  • I've considered possible documentation changes

Copy link
Contributor Author

nickwesselman commented Dec 5, 2025

@nickwesselman nickwesselman changed the title initial implementation of allowing graphql queries on non-dev stores Add support for executing GraphQL queries on non-dev stores Dec 5, 2025
@nickwesselman nickwesselman force-pushed the allow_graphql_queries_on_prod_stores branch from 1c51daa to 7a95eed Compare December 5, 2025 19:36
Base automatically changed from shopify_app_execute to main December 5, 2025 23:19
@nickwesselman nickwesselman force-pushed the allow_graphql_queries_on_prod_stores branch from 7a95eed to c867e4d Compare December 10, 2025 15:54
@nickwesselman nickwesselman changed the base branch from main to graphite-base/6689 December 10, 2025 16:10
@nickwesselman nickwesselman force-pushed the allow_graphql_queries_on_prod_stores branch from c867e4d to e531736 Compare December 10, 2025 16:10
@nickwesselman nickwesselman changed the base branch from graphite-base/6689 to bulk_operation_error_message December 10, 2025 16:10
@github-actions
Copy link
Contributor

github-actions bot commented Dec 10, 2025

Coverage report

St.
Category Percentage Covered / Total
🟡 Statements
79.23% (+0% 🔼)
13935/17588
🟡 Branches
73.17% (-0.04% 🔻)
6806/9302
🟡 Functions
79.36% (+0% 🔼)
3569/4497
🟡 Lines
79.58% (+0% 🔼)
13164/16541
Show new covered files 🐣
St.
File Statements Branches Functions Lines
🟢
... / fetch_store_by_domain.ts
100% 100% 100% 100%
Show files with reduced coverage 🔻
St.
File Statements Branches Functions Lines
🟢
... / store-context.ts
100%
80% (-3.33% 🔻)
100% 100%
🟢
... / execute-bulk-operation.ts
92.45% (-0.4% 🔻)
84.38% (-0.92% 🔻)
100%
92.45% (-0.27% 🔻)
🟢
... / fetch.ts
83.78% (+0.45% 🔼)
80% (-3.33% 🔻)
75%
84.85% (+0.47% 🔼)
🔴
... / app-management-client.ts
53.85%
46.58% (-0.88% 🔻)
50.45% 52.7%
🔴
... / partners-client.ts
26.47%
28.57% (-0.6% 🔻)
20.31% 26.38%
🟢
... / ConcurrentOutput.tsx
98.36% (-1.64% 🔻)
92% (-4% 🔻)
100%
98.33% (-1.67% 🔻)

Test suite run success

3509 tests passing in 1411 suites.

Report generated by 🧪jest coverage report action from 6b3de7d

* @throws AbortError if attempting to run a mutation on a non-dev store.
*/
export function validateMutationStore(graphqlOperation: string, store: OrganizationStore): void {
if (isMutation(graphqlOperation) && store.storeType !== 'APP_DEVELOPMENT') {
Copy link
Contributor

@ericlee878 ericlee878 Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do all stores have a storeType? Worried that if the storeType is undefined this could be a problem? But maybe if the storeType is undefined we shouldn't allow mutations.

@nickwesselman nickwesselman changed the base branch from bulk_operation_error_message to graphite-base/6689 December 12, 2025 15:55
@nickwesselman nickwesselman force-pushed the allow_graphql_queries_on_prod_stores branch from 6b3de7d to 422c255 Compare December 12, 2025 20:17
@nickwesselman nickwesselman changed the base branch from graphite-base/6689 to bulk_operation_error_message December 12, 2025 20:17
@nickwesselman nickwesselman force-pushed the allow_graphql_queries_on_prod_stores branch from 422c255 to 42fc35c Compare December 12, 2025 20:20
@nickwesselman nickwesselman force-pushed the allow_graphql_queries_on_prod_stores branch from 42fc35c to 99d6e3d Compare December 12, 2025 20:44
@github-actions
Copy link
Contributor

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

  • Some seemingly private modules might be re-exported through public modules.
  • If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/node/api/admin.d.ts
@@ -41,6 +41,14 @@ export declare function adminRequestDoc<TResult, TVariables extends Variables>(o
  * @returns - An array of supported API versions.
  */
 export declare function supportedApiVersions(session: AdminSession, preferredBehaviour?: RequestModeInput): Promise<string[]>;
+/**
+ * GraphQL query to retrieve all API versions.
+ *
+ * @param session - Shopify admin session including token and Store FQDN.
+ * @param preferredBehaviour - Custom request behaviour for retries and timeouts.
+ * @returns - An array of supported and unsupported API versions.
+ */
+export declare function fetchApiVersions(session: AdminSession, preferredBehaviour?: RequestModeInput): Promise<ApiVersion[]>;
 /**
  * Returns the Admin API URL for the given store and version.
  *
@@ -50,6 +58,10 @@ export declare function supportedApiVersions(session: AdminSession, preferredBeh
  * @returns - Admin API URL.
  */
 export declare function adminUrl(store: string, version: string | undefined, session?: AdminSession): string;
+interface ApiVersion {
+    handle: string;
+    supported: boolean;
+}
 /**
  * Executes a REST request against the Admin API.
  *
@@ -82,4 +94,5 @@ export interface RestResponse {
     headers: {
         [key: string]: string[];
     };
-}
\ No newline at end of file
+}
+export {};
\ No newline at end of file

Base automatically changed from bulk_operation_error_message to main December 12, 2025 21:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants