fix(shopify): preserve privacy obligations and recoverable connections

Author: waleedlatif1

apps/sim/app/oauth/shopify/connect/connection-form.tsx

@@ -2,6 +2,7 @@
 
 import { useState } from 'react'
 import { Chip, ChipInput, ChipSelect, pageHeadingClassName } from '@sim/emcn'
+import { permissionSatisfies } from '@sim/platform-authz/predicates'
 import { useCompleteShopifyInstall } from '@/hooks/queries/shopify-install'
 import { useCreateWorkspace, useWorkspacesWithMetadata } from '@/hooks/queries/workspace'
 
@@ -17,7 +18,12 @@ export function ConnectionForm({ attemptId, shopDomain }: ConnectionFormProps) {
   const [workspaceId, setWorkspaceId] = useState('')
   const [displayName, setDisplayName] = useState(shopDomain)
   const [workspaceName, setWorkspaceName] = useState('')
-  const available = workspaces.data?.workspaces ?? []
+  const available = (workspaces.data?.workspaces ?? []).filter((workspace) =>
+    permissionSatisfies(workspace.permissions, 'write')
+  )
+  const selectedWorkspaceId = available.some((workspace) => workspace.id === workspaceId)
+    ? workspaceId
+    : ''
   const error = complete.error ?? createWorkspace.error ?? workspaces.error
   const busy = complete.isPending || createWorkspace.isPending
 
@@ -26,9 +32,9 @@ export function ConnectionForm({ attemptId, shopDomain }: ConnectionFormProps) {
       className='flex w-full max-w-sm flex-col gap-5'
       onSubmit={(event) => {
         event.preventDefault()
-        if (!workspaceId) return
+        if (busy || !selectedWorkspaceId || !displayName.trim()) return
         complete.mutate(
-          { attemptId, workspaceId, displayName },
+          { attemptId, workspaceId: selectedWorkspaceId, displayName },
           {
             onSuccess: (result) =>
               window.location.assign(
@@ -56,7 +62,7 @@ export function ConnectionForm({ attemptId, shopDomain }: ConnectionFormProps) {
         <span className='text-[var(--text-muted)] text-small'>Workspace</span>
         <ChipSelect
           aria-label='Workspace'
-          value={workspaceId}
+          value={selectedWorkspaceId}
           onChange={setWorkspaceId}
           options={available.map((workspace) => ({ value: workspace.id, label: workspace.name }))}
           placeholder={workspaces.isPending ? 'Loading workspaces…' : 'Choose a workspace'}
@@ -99,7 +105,11 @@ export function ConnectionForm({ attemptId, shopDomain }: ConnectionFormProps) {
           {error.message}
         </p>
       )}
-      <Chip type='submit' variant='primary' disabled={busy || !workspaceId || !displayName.trim()}>
+      <Chip
+        type='submit'
+        variant='primary'
+        disabled={busy || !selectedWorkspaceId || !displayName.trim()}
+      >
         {complete.isPending ? 'Connecting…' : 'Connect Shopify'}
       </Chip>
     </form>

apps/sim/lib/billing/organizations/member-limits.test.ts

@@ -30,6 +30,7 @@ afterAll(() => {
 
 describe('getOrgMemberUsageForBillingPeriod', () => {
   it('counts immutable new rows plus bounded legacy rows exactly once', async () => {
+    vi.spyOn(Date, 'now').mockReturnValue(Date.now())
     const billingPeriod = {
       start: new Date('2026-06-01T00:00:00.000Z'),
       end: new Date('2026-07-01T00:00:00.000Z'),

apps/sim/lib/core/outbox/processor.test.ts

@@ -5,6 +5,7 @@ const mocks = vi.hoisted(() => ({
   recover: vi.fn(),
   reap: vi.fn(),
   prune: vi.fn(),
+  privacy: vi.fn(),
 }))
 vi.mock('@/lib/core/outbox/service', () => outboxServiceMock)
 vi.mock('@/lib/core/outbox/retention', () => ({ pruneCompletedOutboxEvents: mocks.prune }))
@@ -18,6 +19,7 @@ vi.mock('@/lib/knowledge/connectors/connector-error', () => ({
   getConnectorFailureDiagnostic: () => undefined,
 }))
 vi.mock('@/lib/core/outbox/handlers', () => ({ OUTBOX_HANDLER_GROUPS: [] }))
+vi.mock('@/lib/shopify/privacy/outbox', () => ({ maintainShopifyPrivacy: mocks.privacy }))
 
 import { runOutboxProcessor } from '@/lib/core/outbox/processor'
 
@@ -40,6 +42,7 @@ describe('outbox processor recovery', () => {
     mocks.recover.mockResolvedValue(2)
     mocks.reap.mockResolvedValue(3)
     mocks.prune.mockResolvedValue(4)
+    mocks.privacy.mockResolvedValue(undefined)
   })
   afterEach(() => vi.useRealTimers())
 
@@ -73,6 +76,16 @@ describe('outbox processor recovery', () => {
     })
   })
 
+  it('retains completed delivery results when privacy maintenance fails', async () => {
+    mocks.privacy.mockRejectedValueOnce(new Error('privacy database unavailable'))
+    await expect(runOutboxProcessor()).resolves.toEqual({
+      result,
+      recoveredDocuments: 2,
+      reapedBackgroundWork: 3,
+      prunedEvents: 4,
+    })
+  })
+
   it('skips document recovery after the processing budget is exhausted', async () => {
     mockProcessOutboxEvents.mockImplementationOnce(async () => {
       vi.advanceTimersByTime(770_000)

apps/sim/lib/core/outbox/processor.ts

@@ -64,14 +64,19 @@ export async function runOutboxProcessor(): Promise<OutboxProcessorResult> {
     logger.error('Completed outbox pruning failed', { error: toError(error).message })
   }
 
+  try {
+    await maintainShopifyPrivacy()
+  } catch {
+    logger.error('Shopify privacy maintenance failed')
+  }
+
   const summary = {
     ...result,
     reapedBackgroundWork,
     recoveredDocuments,
     prunedEvents,
     durationMs: Date.now() - startedAt,
   }
-  await maintainShopifyPrivacy()
   /** Fail the run so a broken handler module stays as visible as the crash its static import caused. */
   if (result.unloadedEventTypes.length > 0) {
     const message = `Outbox handler modules failed to load; left pending: ${result.unloadedEventTypes.join(', ')}`

apps/sim/lib/credentials/application/complete-shopify-install.ts

@@ -6,6 +6,7 @@ import { credentialOperations } from '@/lib/credentials/application/operations'
 import { resumeConnectorsAfterCredentialReconnect } from '@/lib/knowledge/connectors/credential-recovery'
 import { clearOAuthRefreshDeadFlag } from '@/lib/oauth/refresh-coordination'
 import { claimShopifyInstall } from '@/lib/oauth/shopify-handoff'
+import { getShopifyRefreshScope } from '@/lib/oauth/shopify-installation'
 import { resolveActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/workspace-context'
 
 const logger = createLogger('CompleteShopifyInstall')
@@ -48,7 +49,7 @@ export const completeShopifyInstall = defineAuthorizedWorkspaceUseCase({
   afterSuccess: async ({ result }) => {
     if (!result.changed) return
     try {
-      await clearOAuthRefreshDeadFlag(result.accountId)
+      await clearOAuthRefreshDeadFlag(getShopifyRefreshScope(result.shopDomain))
       if (!result.created)
         await resumeConnectorsAfterCredentialReconnect(result.accountId, new Date())
     } catch {

apps/sim/lib/credentials/draft-hooks.ts

@@ -9,6 +9,7 @@ import { deleteOrphanedOAuthAccount } from '@/lib/credentials/deletion'
 import { resumeConnectorsAfterCredentialReconnect } from '@/lib/knowledge/connectors/credential-recovery'
 import { clearOAuthRefreshDeadFlag } from '@/lib/oauth/refresh-coordination'
 import { captureServerEvent } from '@/lib/posthog/server'
+import { rememberShopifyCredentialScope } from '@/lib/shopify/privacy/installation-scopes'
 
 const logger = createLogger('CredentialDraftHooks')
 
@@ -26,17 +27,32 @@ export async function handleCreateCredentialFromDraft(params: {
   const credentialId = generateId()
 
   try {
-    await db.insert(schema.credential).values({
-      id: credentialId,
-      workspaceId: draft.workspaceId,
-      type: 'oauth',
-      displayName: draft.displayName,
-      description: draft.description ?? null,
-      providerId,
-      accountId,
-      createdBy: userId,
-      createdAt: now,
-      updatedAt: now,
+    await db.transaction(async (tx) => {
+      await tx.insert(schema.credential).values({
+        id: credentialId,
+        workspaceId: draft.workspaceId,
+        type: 'oauth',
+        displayName: draft.displayName,
+        description: draft.description ?? null,
+        providerId,
+        accountId,
+        createdBy: userId,
+        createdAt: now,
+        updatedAt: now,
+      })
+      await tx.insert(schema.credentialMember).values({
+        id: generateId(),
+        credentialId,
+        userId,
+        role: 'admin',
+        status: 'active',
+        joinedAt: now,
+        invitedBy: userId,
+        createdAt: now,
+        updatedAt: now,
+      })
+      if (providerId === 'shopify')
+        await rememberShopifyCredentialScope(accountId, credentialId, tx)
     })
   } catch (insertError: unknown) {
     if (
@@ -70,10 +86,14 @@ export async function handleCreateCredentialFromDraft(params: {
       accountId,
     })
 
-    await db
-      .update(schema.credential)
-      .set({ updatedAt: now })
-      .where(eq(schema.credential.id, existingCredential.id))
+    await db.transaction(async (tx) => {
+      await tx
+        .update(schema.credential)
+        .set({ updatedAt: now })
+        .where(eq(schema.credential.id, existingCredential.id))
+      if (providerId === 'shopify')
+        await rememberShopifyCredentialScope(accountId, existingCredential.id, tx)
+    })
 
     await clearOAuthRefreshDeadFlag(accountId)
     await resumeConnectorsAfterCredentialReconnect(accountId, now)
@@ -91,18 +111,6 @@ export async function handleCreateCredentialFromDraft(params: {
     return
   }
 
-  await db.insert(schema.credentialMember).values({
-    id: generateId(),
-    credentialId,
-    userId,
-    role: 'admin',
-    status: 'active',
-    joinedAt: now,
-    invitedBy: userId,
-    createdAt: now,
-    updatedAt: now,
-  })
-
   logger.info('Created credential from draft', {
     credentialId,
     displayName: draft.displayName,
@@ -161,6 +169,7 @@ export async function handleReconnectCredential(params: {
       id: schema.credential.id,
       accountId: schema.credential.accountId,
       displayName: schema.credential.displayName,
+      providerId: schema.credential.providerId,
     })
     .from(schema.credential)
     .where(eq(schema.credential.id, draft.credentialId))
@@ -194,10 +203,14 @@ export async function handleReconnectCredential(params: {
     }
   }
 
-  await db
-    .update(schema.credential)
-    .set({ accountId: newAccountId, updatedAt: now })
-    .where(eq(schema.credential.id, draft.credentialId))
+  await db.transaction(async (tx) => {
+    await tx
+      .update(schema.credential)
+      .set({ accountId: newAccountId, updatedAt: now })
+      .where(eq(schema.credential.id, existingCredential.id))
+    if (existingCredential.providerId === 'shopify')
+      await rememberShopifyCredentialScope(newAccountId, existingCredential.id, tx)
+  })
 
   logger.info(
     accountChanged

apps/sim/lib/credentials/organization-draft.ts

@@ -10,6 +10,7 @@ import { deleteOrphanedOAuthAccount } from '@/lib/credentials/deletion'
 import { getCredentialCreationOrganizationContext } from '@/lib/credentials/organization'
 import { resumeConnectorsAfterCredentialReconnect } from '@/lib/knowledge/connectors/credential-recovery'
 import { clearOAuthRefreshDeadFlag } from '@/lib/oauth/refresh-coordination'
+import { rememberShopifyCredentialScope } from '@/lib/shopify/privacy/installation-scopes'
 
 /** Completes the exact draft bound to the authenticated provider callback, rechecking current ownership under membership locks. */
 export async function completeOrganizationCredentialDraft(input: {
@@ -116,6 +117,9 @@ export async function completeOrganizationCredentialDraft(input: {
         updatedAt: now,
       })
     }
+    if (input.providerId === 'shopify') {
+      await rememberShopifyCredentialScope(input.accountId, credentialId, tx)
+    }
     await tx.delete(pendingCredentialDraft).where(eq(pendingCredentialDraft.id, draft.id))
     return {
       credentialId,

apps/sim/lib/oauth/shopify-handoff.ts

@@ -181,6 +181,7 @@ export async function claimShopifyInstall(params: {
         workspaceId: params.workspaceId,
         created: false,
         changed: false,
+        shopDomain: attempt.shopDomain,
       }
     }
     if (
@@ -305,6 +306,7 @@ export async function claimShopifyInstall(params: {
       workspaceId: params.workspaceId,
       created: !existingCredential,
       changed: true,
+      shopDomain: attempt.shopDomain,
     }
   })
 }