feat(shopify): add app installation and privacy request handling by waleedlatif1 · Pull Request #8841 · simstudioai/sim

waleedlatif1 · 2026-10-09T06:04:18Z

Summary

Complete Shopify-initiated OAuth before Sim login, then attach the browser-bound installation to an authorized workspace while preserving credential identities and rotating tokens.
Record signed mandatory privacy webhooks with atomic outbox delivery, ownership history, deadline escalation, and administrator review with encrypted evidence and audit history.
Add three tables and bounded cleanup for expired installation handoffs. Existing service-account and manual OAuth paths remain supported.
Preserve independent privacy obligations, atomically save credential ownership history, restore shop-scoped refresh, and offer only writable workspace destinations.

Privacy fulfillment remains operator-driven: receiving a webhook does not export or erase customer data. The runbook documents deployment, subscription registration, ownership backfill, and retention prerequisites.

Type of Change

Bug fix
New feature

Testing

70 real PostgreSQL/Redis/HTTP integration cases passed using the migration provisioning path, including 44 OAuth and 26 privacy cases.
Demonstrated failures before fixes for stale installation tokens, refresh recovery, ownership-history persistence across pages and provider isolation, account recovery across workspaces, duplicate launch parameters and delivery obligations, expired bans, and maintenance failure isolation; all pass after the fixes.
53 focused review-fix tests, 58 audits, 26 workspace type checks, lint, migration safety and schema synchronization, docs manifest, block registry, and pinned actionlint passed.
Full repository tests passed on the final branch: 409 script tests and 39,209 workspace tests.
Revalidated 28 Shopify operations against the official API schema, including 349 request scenarios, output metadata, and block input wiring.
Live installation and workflow execution still require verification after deployment.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-09T06:04:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 9, 2026 7:21am UTC

cubic-dev-ai

All reported issues were addressed across 44 files

_{Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-10-09T06:13:50Z

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; no new blocking issue was found.

Summary

Adds Shopify installation before Sim login, browser-bound workspace connection, and signed privacy requests with administrator review.

The latest changes restore connector schedules when a claim creates another credential for an existing account.
Ownership-history capture now commits all pages together or rolls them all back.
The three earlier review threads are fixed: the picker offers writable workspaces, credential saves retain ownership history, and the deadline index matches its query.
No new actionable issues were found. Privacy exports and erasure remain operator-driven.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Signed Shopify launch] --> B[Shopify OAuth]
  B --> C[Browser-bound handoff]
  C --> D[Sim login]
  D --> E[Authorized workspace claim]
  E --> F[Save credential and ownership history]
  F --> G[Restore affected connector schedules]
  H[Signed privacy webhook] --> I[Save encrypted request and outbox event together]
  I --> J[Administrator review]
  J --> K[Record fulfillment evidence]
  K --> L[Complete request]

_{Reviews (3) · Last reviewed commit: "fix(shopify): recover accounts and captu..." · Reviewed by Greptile}

waleedlatif1 · 2026-10-09T06:31:23Z

@greptile

waleedlatif1 · 2026-10-09T06:31:24Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-09T06:31:32Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 48 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-09T06:52:09Z

@greptile

waleedlatif1 · 2026-10-09T06:52:10Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-09T06:52:17Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 48 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

feat(shopify): add app installation and privacy request handling

d9f53b2

cubic-dev-ai Bot reviewed Oct 9, 2026

View reviewed changes

vercel Bot deployed to Preview October 9, 2026 06:10 View deployment

greptile-apps Bot reviewed Oct 9, 2026

View reviewed changes

Comment thread apps/sim/app/oauth/shopify/connect/connection-form.tsx

Comment thread apps/sim/lib/oauth/shopify.ts Outdated

Comment thread apps/sim/lib/shopify/privacy/outbox.ts

fix(shopify): preserve privacy obligations and recoverable connections

3948df0

cubic-dev-ai Bot reviewed Oct 9, 2026

View reviewed changes

Comment thread apps/sim/lib/oauth/shopify.integration.ts Outdated

Comment thread apps/sim/lib/credentials/application/complete-shopify-install.ts Outdated

Comment thread apps/sim/lib/oauth/shopify.ts

vercel Bot deployed to Preview October 9, 2026 06:35 View deployment

fix(shopify): recover accounts and capture all ownership history

57bc872

vercel Bot temporarily deployed to Preview October 9, 2026 06:51 Inactive

cubic-dev-ai Bot reviewed Oct 9, 2026

View reviewed changes

Comment thread apps/sim/lib/shopify/privacy/installation-scopes.ts

fix(shopify): scope ownership backfill to Shopify credentials

27d9bc3

vercel Bot temporarily deployed to Preview October 9, 2026 07:21 Inactive

Conversation

waleedlatif1 commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 9, 2026

Uh oh!

waleedlatif1 commented Oct 9, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 9, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 9, 2026

Uh oh!

waleedlatif1 commented Oct 9, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 9, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Oct 9, 2026 •

edited

Loading

vercel Bot commented Oct 9, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 9, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading