@hostwebhook/node-types 1.73.0 → 1.75.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/esm/index.d.ts +2 -2
- package/dist/esm/index.js +1 -1
- package/dist/esm/shopify-operations.d.ts +112 -11
- package/dist/esm/shopify-operations.js +413 -9
- package/dist/esm/types.d.ts +51 -1
- package/dist/esm/ui.js +20 -2
- package/dist/index.d.ts +2 -2
- package/dist/index.js +7 -3
- package/dist/shopify-operations.d.ts +112 -11
- package/dist/shopify-operations.js +415 -10
- package/dist/types.d.ts +51 -1
- package/dist/ui.js +20 -2
- package/package.json +1 -1
|
@@ -3,18 +3,24 @@
|
|
|
3
3
|
* Shopify Admin API operations — single source of truth across the api, the
|
|
4
4
|
* dashboard and downstream consumers (MCP server).
|
|
5
5
|
*
|
|
6
|
-
* ##
|
|
6
|
+
* ## Ten, out of several hundred
|
|
7
7
|
*
|
|
8
|
-
* The Admin API has hundreds of mutations. This node exposes
|
|
8
|
+
* The Admin API has hundreds of mutations. This node exposes ten, and the
|
|
9
9
|
* choice is argued in `api/docs/ADR-0007-shopify.md`: a menu of everything is
|
|
10
|
-
* how a node becomes unusable
|
|
11
|
-
* automate — put a customer in the store, tag something, sync stock, and read
|
|
12
|
-
* back what the store already knows.
|
|
10
|
+
* how a node becomes unusable.
|
|
13
11
|
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
12
|
+
* The first four cover what people automate on day one — put a customer in the
|
|
13
|
+
* store, tag something, sync stock, and read back what the store already
|
|
14
|
+
* knows. The six added on 2026-09-08 cover what they ask for on day two: the
|
|
15
|
+
* order lifecycle (draft → complete → fulfil → cancel), custom data
|
|
16
|
+
* (metafields) and putting a product in the catalogue.
|
|
17
|
+
*
|
|
18
|
+
* ⚠️ **Every entry below carries the OAuth scope it needs**, in
|
|
19
|
+
* `SHOPIFY_OPERATION_SCOPES`. That is not documentation: a scope missing from
|
|
20
|
+
* the credential answers HTTP 403 on a call that looks perfectly formed, and
|
|
21
|
+
* on Shopify a scope is granted at INSTALL time — adding one to the app means
|
|
22
|
+
* every existing credential has to be reconnected before it can use the new
|
|
23
|
+
* operation.
|
|
18
24
|
*
|
|
19
25
|
* ## GraphQL only, and the version is not ours to drift on
|
|
20
26
|
*
|
|
@@ -55,15 +61,49 @@
|
|
|
55
61
|
* `inventoryAdjustQuantities` must be sent with the `@idempotent` directive
|
|
56
62
|
* and an idempotency key. A stock adjustment is the one operation here where a
|
|
57
63
|
* silent retry is a real inventory error, so this is not boilerplate.
|
|
64
|
+
*
|
|
65
|
+
* ## What was verified for the six added on 2026-09-08
|
|
66
|
+
*
|
|
67
|
+
* Read off the Admin GraphQL reference for the current version, not recalled.
|
|
68
|
+
* The pages, and the one fact from each that a from-memory version gets wrong:
|
|
69
|
+
*
|
|
70
|
+
* - `draftOrderCreate(input: DraftOrderInput!)` — `lineItems` is the only
|
|
71
|
+
* required field of the input, and each item is `{ variantId, quantity }`
|
|
72
|
+
* OR `{ title, originalUnitPrice, quantity }` for a custom line.
|
|
73
|
+
* - `draftOrderComplete(id: ID!, …)` — the id is a **sibling argument**, not
|
|
74
|
+
* inside an input. `paymentPending` is deprecated and is not offered here.
|
|
75
|
+
* - `fulfillmentCreate(fulfillment: FulfillmentInput!)` — takes
|
|
76
|
+
* `lineItemsByFulfillmentOrder`, NOT an order id. There is no mutation that
|
|
77
|
+
* fulfils "an order": fulfilment hangs off FulfillmentOrder, so the
|
|
78
|
+
* executor has to look them up first. That indirection is the whole reason
|
|
79
|
+
* ADR-0007 left this out of v1.
|
|
80
|
+
* - `orderCancel(orderId:, reason:, restock:, …)` — `reason` and `restock` are
|
|
81
|
+
* **required arguments**, and the payload's errors arrive in
|
|
82
|
+
* `orderCancelUserErrors`; plain `userErrors` is deprecated there.
|
|
83
|
+
* - `metafieldsSet(metafields: [MetafieldsSetInput!]!)` — takes a LIST, and
|
|
84
|
+
* each entry needs all of `ownerId`, `namespace`, `key`, `type`, `value`.
|
|
85
|
+
* `type` is not guessable from the value: `single_line_text_field` and
|
|
86
|
+
* `number_integer` are different metafields.
|
|
87
|
+
* - `productCreate(product: ProductCreateInput!)` — the argument is `product`,
|
|
88
|
+
* not `input`; `input: ProductInput` is the deprecated spelling. It creates
|
|
89
|
+
* ONE default variant; more variants are `productVariantsBulkCreate`, which
|
|
90
|
+
* is a surface of its own and is not offered here.
|
|
58
91
|
*/
|
|
59
92
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
60
|
-
exports.SHOPIFY_OPERATION_SPECS = exports.SHOPIFY_SEARCHABLE_RESOURCES = exports.SHOPIFY_TAGGABLE_RESOURCES = exports.SHOPIFY_OPERATIONS = void 0;
|
|
93
|
+
exports.SHOPIFY_OPERATION_SCOPES = exports.SHOPIFY_OPERATION_SPECS = exports.SHOPIFY_PRODUCT_STATUSES = exports.SHOPIFY_CANCEL_REASONS = exports.SHOPIFY_SEARCHABLE_RESOURCES = exports.SHOPIFY_TAGGABLE_RESOURCES = exports.SHOPIFY_OPERATIONS = void 0;
|
|
61
94
|
exports.isShopifyOperation = isShopifyOperation;
|
|
95
|
+
exports.scopesQueFaltanEnShopify = scopesQueFaltanEnShopify;
|
|
62
96
|
exports.SHOPIFY_OPERATIONS = [
|
|
63
97
|
'upsertCustomer',
|
|
64
98
|
'setTags',
|
|
65
99
|
'adjustInventory',
|
|
66
100
|
'findRecords',
|
|
101
|
+
'createDraftOrder',
|
|
102
|
+
'completeDraftOrder',
|
|
103
|
+
'fulfillOrder',
|
|
104
|
+
'cancelOrder',
|
|
105
|
+
'setMetafield',
|
|
106
|
+
'createProduct',
|
|
67
107
|
];
|
|
68
108
|
/** Type guard — for DTOs and AI tool calls, where the input is untrusted. */
|
|
69
109
|
function isShopifyOperation(value) {
|
|
@@ -90,6 +130,27 @@ exports.SHOPIFY_SEARCHABLE_RESOURCES = [
|
|
|
90
130
|
'customers',
|
|
91
131
|
'products',
|
|
92
132
|
];
|
|
133
|
+
/**
|
|
134
|
+
* `OrderCancelReason`, the whole enum, in Shopify's own spelling.
|
|
135
|
+
*
|
|
136
|
+
* A dropdown and not free text — and that is the opposite of the call made for
|
|
137
|
+
* `adjustInventory`'s `reason`, on purpose. The difference is not taste: the
|
|
138
|
+
* inventory vocabulary was NOT verifiable from the reference (see the note
|
|
139
|
+
* above), so a dropdown there would have been a list of invented values. This
|
|
140
|
+
* one IS the enumeration, read off `enums/OrderCancelReason`, and an argument
|
|
141
|
+
* of type `OrderCancelReason!` rejects anything outside it — so free text here
|
|
142
|
+
* would only mean the user finds out by failing.
|
|
143
|
+
*/
|
|
144
|
+
exports.SHOPIFY_CANCEL_REASONS = [
|
|
145
|
+
'CUSTOMER',
|
|
146
|
+
'DECLINED',
|
|
147
|
+
'FRAUD',
|
|
148
|
+
'INVENTORY',
|
|
149
|
+
'OTHER',
|
|
150
|
+
'STAFF',
|
|
151
|
+
];
|
|
152
|
+
/** `ProductStatus`, the whole enum. Same reasoning as the cancel reasons. */
|
|
153
|
+
exports.SHOPIFY_PRODUCT_STATUSES = ['ACTIVE', 'DRAFT', 'ARCHIVED'];
|
|
93
154
|
exports.SHOPIFY_OPERATION_SPECS = {
|
|
94
155
|
upsertCustomer: {
|
|
95
156
|
label: 'Add or update customer',
|
|
@@ -260,4 +321,348 @@ exports.SHOPIFY_OPERATION_SPECS = {
|
|
|
260
321
|
},
|
|
261
322
|
],
|
|
262
323
|
},
|
|
324
|
+
createDraftOrder: {
|
|
325
|
+
label: 'Create draft order',
|
|
326
|
+
description: 'Build an order the merchant can review, invoice or complete. This is the supported way to put an order into a store from outside — it does not charge anybody by itself.',
|
|
327
|
+
apiRoute: 'mutation draftOrderCreate',
|
|
328
|
+
params: [
|
|
329
|
+
{
|
|
330
|
+
name: 'lineItems',
|
|
331
|
+
label: 'Line items',
|
|
332
|
+
type: 'json',
|
|
333
|
+
required: true,
|
|
334
|
+
description: 'A JSON array. Each entry is either {"variantId":"gid://shopify/ProductVariant/…","quantity":1} for something in the catalogue, or {"title":"…","originalUnitPrice":"10.00","quantity":1} for a custom line. An empty array is refused by Shopify, not by us.',
|
|
335
|
+
placeholder: '[{"variantId":"gid://shopify/ProductVariant/1234","quantity":1}]',
|
|
336
|
+
},
|
|
337
|
+
{
|
|
338
|
+
name: 'email',
|
|
339
|
+
label: 'Customer email',
|
|
340
|
+
type: 'email',
|
|
341
|
+
description: 'Who the draft is for, when you do not already have their Shopify id. Ignored if you set a customer id.',
|
|
342
|
+
placeholder: '{{payload.email}}',
|
|
343
|
+
},
|
|
344
|
+
{
|
|
345
|
+
name: 'customerId',
|
|
346
|
+
label: 'Customer id',
|
|
347
|
+
type: 'gid',
|
|
348
|
+
description: 'gid://shopify/Customer/1234. Wins over the email — with both set, Shopify attaches the draft to this customer.',
|
|
349
|
+
placeholder: '{{payload.customerId}}',
|
|
350
|
+
},
|
|
351
|
+
{
|
|
352
|
+
name: 'note',
|
|
353
|
+
label: 'Note',
|
|
354
|
+
type: 'string',
|
|
355
|
+
description: 'Internal note, visible to staff in the Shopify admin.',
|
|
356
|
+
},
|
|
357
|
+
{
|
|
358
|
+
name: 'tags',
|
|
359
|
+
label: 'Tags',
|
|
360
|
+
type: 'tags',
|
|
361
|
+
description: 'Tags to put on the draft order.',
|
|
362
|
+
},
|
|
363
|
+
{
|
|
364
|
+
name: 'shippingAddress',
|
|
365
|
+
label: 'Shipping address',
|
|
366
|
+
type: 'json',
|
|
367
|
+
description: 'A JSON object: {"address1":"…","city":"…","province":"…","country":"…","zip":"…"}. Leave empty to let the merchant fill it in.',
|
|
368
|
+
},
|
|
369
|
+
],
|
|
370
|
+
},
|
|
371
|
+
completeDraftOrder: {
|
|
372
|
+
label: 'Complete draft order',
|
|
373
|
+
description: 'Turn a draft order into a real order. This is the step that reserves stock and can charge — it is not undone by running it again.',
|
|
374
|
+
apiRoute: 'mutation draftOrderComplete',
|
|
375
|
+
params: [
|
|
376
|
+
{
|
|
377
|
+
name: 'draftOrderId',
|
|
378
|
+
label: 'Draft order id',
|
|
379
|
+
type: 'gid',
|
|
380
|
+
required: true,
|
|
381
|
+
description: 'gid://shopify/DraftOrder/1234. The create-draft operation puts one in its output, so the usual shape is one node feeding the next.',
|
|
382
|
+
placeholder: '{{payload.id}}',
|
|
383
|
+
},
|
|
384
|
+
{
|
|
385
|
+
name: 'paymentGatewayId',
|
|
386
|
+
label: 'Payment gateway id',
|
|
387
|
+
type: 'gid',
|
|
388
|
+
description: 'Which gateway processes it. Leave empty to complete the order as pending payment, which is what most automations want.',
|
|
389
|
+
},
|
|
390
|
+
{
|
|
391
|
+
name: 'sourceName',
|
|
392
|
+
label: 'Source name',
|
|
393
|
+
type: 'string',
|
|
394
|
+
description: 'A sales-channel handle, for attribution in the store\'s reports.',
|
|
395
|
+
},
|
|
396
|
+
],
|
|
397
|
+
},
|
|
398
|
+
fulfillOrder: {
|
|
399
|
+
label: 'Fulfil order',
|
|
400
|
+
description: "Mark an order shipped, optionally with tracking. Fulfils every one of the order's open fulfilment orders.",
|
|
401
|
+
apiRoute: 'query order.fulfillmentOrders, then mutation fulfillmentCreate (one call per order, all its fulfilment orders in one)',
|
|
402
|
+
params: [
|
|
403
|
+
{
|
|
404
|
+
name: 'orderId',
|
|
405
|
+
label: 'Order id',
|
|
406
|
+
type: 'gid',
|
|
407
|
+
required: true,
|
|
408
|
+
description: 'gid://shopify/Order/1234. NOT a fulfilment order id — those are looked up from this one, because Shopify has no "fulfil this order" mutation.',
|
|
409
|
+
placeholder: '{{payload.admin_graphql_api_id}}',
|
|
410
|
+
},
|
|
411
|
+
{
|
|
412
|
+
name: 'trackingNumber',
|
|
413
|
+
label: 'Tracking number',
|
|
414
|
+
type: 'string',
|
|
415
|
+
description: 'Optional. With a number and no carrier, Shopify tries to guess the carrier from the number.',
|
|
416
|
+
placeholder: '{{payload.tracking_number}}',
|
|
417
|
+
},
|
|
418
|
+
{
|
|
419
|
+
name: 'trackingCompany',
|
|
420
|
+
label: 'Carrier',
|
|
421
|
+
type: 'string',
|
|
422
|
+
description: 'Optional. Shopify builds the tracking link itself for carriers it knows by name.',
|
|
423
|
+
placeholder: 'DHL Express',
|
|
424
|
+
},
|
|
425
|
+
{
|
|
426
|
+
name: 'trackingUrl',
|
|
427
|
+
label: 'Tracking URL',
|
|
428
|
+
type: 'string',
|
|
429
|
+
description: 'Optional. Only needed for a carrier Shopify does not know — otherwise the number is enough.',
|
|
430
|
+
},
|
|
431
|
+
{
|
|
432
|
+
name: 'notifyCustomer',
|
|
433
|
+
label: 'Email the customer',
|
|
434
|
+
type: 'boolean',
|
|
435
|
+
description: 'Off by default. On sends the shipping confirmation, which is a real email to a real person — the one field here with a consequence outside the store.',
|
|
436
|
+
},
|
|
437
|
+
],
|
|
438
|
+
},
|
|
439
|
+
cancelOrder: {
|
|
440
|
+
label: 'Cancel order',
|
|
441
|
+
description: 'Cancel an order, optionally restocking it and refunding. Shopify runs this as a background job, so success means "accepted", not "already done".',
|
|
442
|
+
apiRoute: 'mutation orderCancel',
|
|
443
|
+
params: [
|
|
444
|
+
{
|
|
445
|
+
name: 'orderId',
|
|
446
|
+
label: 'Order id',
|
|
447
|
+
type: 'gid',
|
|
448
|
+
required: true,
|
|
449
|
+
description: 'gid://shopify/Order/1234.',
|
|
450
|
+
placeholder: '{{payload.admin_graphql_api_id}}',
|
|
451
|
+
},
|
|
452
|
+
{
|
|
453
|
+
name: 'reason',
|
|
454
|
+
label: 'Reason',
|
|
455
|
+
type: 'cancelReason',
|
|
456
|
+
required: true,
|
|
457
|
+
description: "Required by Shopify, not by us, and it lands on the order where the merchant reads it. OTHER is the honest answer when none of the others fit.",
|
|
458
|
+
},
|
|
459
|
+
{
|
|
460
|
+
name: 'restock',
|
|
461
|
+
label: 'Put the stock back',
|
|
462
|
+
type: 'boolean',
|
|
463
|
+
description: 'Off by default, which is the safe side: restocking something that never left is how a shelf count goes wrong. Turn it on when the goods really are still there.',
|
|
464
|
+
},
|
|
465
|
+
{
|
|
466
|
+
name: 'notifyCustomer',
|
|
467
|
+
label: 'Email the customer',
|
|
468
|
+
type: 'boolean',
|
|
469
|
+
description: 'Off by default. On sends the cancellation email.',
|
|
470
|
+
},
|
|
471
|
+
{
|
|
472
|
+
name: 'staffNote',
|
|
473
|
+
label: 'Staff note',
|
|
474
|
+
type: 'string',
|
|
475
|
+
description: 'Internal note on the cancellation, for whoever reads it later.',
|
|
476
|
+
},
|
|
477
|
+
],
|
|
478
|
+
},
|
|
479
|
+
setMetafield: {
|
|
480
|
+
label: 'Set a metafield',
|
|
481
|
+
description: 'Write one piece of custom data onto an order, a customer, a product or a variant — the general way to keep a foreign id or a computed value on a Shopify record.',
|
|
482
|
+
apiRoute: 'mutation metafieldsSet',
|
|
483
|
+
params: [
|
|
484
|
+
{
|
|
485
|
+
name: 'ownerId',
|
|
486
|
+
label: 'Owner id',
|
|
487
|
+
type: 'gid',
|
|
488
|
+
required: true,
|
|
489
|
+
description: 'What the metafield hangs off, as a global id — an order, a customer, a product, a variant. A Shopify trigger gives you one in the payload.',
|
|
490
|
+
placeholder: '{{payload.admin_graphql_api_id}}',
|
|
491
|
+
},
|
|
492
|
+
{
|
|
493
|
+
name: 'namespace',
|
|
494
|
+
label: 'Namespace',
|
|
495
|
+
type: 'string',
|
|
496
|
+
required: true,
|
|
497
|
+
description: '"custom" is the namespace the Shopify admin shows merchants; anything else is only visible through the API unless a definition exists for it.',
|
|
498
|
+
placeholder: 'custom',
|
|
499
|
+
},
|
|
500
|
+
{
|
|
501
|
+
name: 'key',
|
|
502
|
+
label: 'Key',
|
|
503
|
+
type: 'string',
|
|
504
|
+
required: true,
|
|
505
|
+
description: 'The field name inside the namespace.',
|
|
506
|
+
placeholder: 'external_id',
|
|
507
|
+
},
|
|
508
|
+
{
|
|
509
|
+
name: 'type',
|
|
510
|
+
label: 'Type',
|
|
511
|
+
type: 'string',
|
|
512
|
+
required: true,
|
|
513
|
+
description: 'The metafield type, e.g. single_line_text_field, number_integer, boolean, json, date. It is NOT inferred from the value — the wrong type is rejected, which is better than silently storing a number as text.',
|
|
514
|
+
placeholder: 'single_line_text_field',
|
|
515
|
+
},
|
|
516
|
+
{
|
|
517
|
+
name: 'value',
|
|
518
|
+
label: 'Value',
|
|
519
|
+
type: 'string',
|
|
520
|
+
required: true,
|
|
521
|
+
description: 'Always sent as a string, whatever the type says: Shopify parses it against the type on its side. Setting it again REPLACES what was there.',
|
|
522
|
+
placeholder: '{{payload.id}}',
|
|
523
|
+
},
|
|
524
|
+
],
|
|
525
|
+
},
|
|
526
|
+
createProduct: {
|
|
527
|
+
label: 'Create product',
|
|
528
|
+
description: 'Put a product in the catalogue. Creates the product and its one default variant; several variants, prices and media are separate mutations and are not offered here.',
|
|
529
|
+
apiRoute: 'mutation productCreate',
|
|
530
|
+
params: [
|
|
531
|
+
{
|
|
532
|
+
name: 'title',
|
|
533
|
+
label: 'Title',
|
|
534
|
+
type: 'string',
|
|
535
|
+
required: true,
|
|
536
|
+
description: 'The only field Shopify insists on.',
|
|
537
|
+
placeholder: '{{payload.title}}',
|
|
538
|
+
},
|
|
539
|
+
{
|
|
540
|
+
name: 'descriptionHtml',
|
|
541
|
+
label: 'Description',
|
|
542
|
+
type: 'string',
|
|
543
|
+
description: 'HTML, not plain text — line breaks typed here do not survive as line breaks in the storefront.',
|
|
544
|
+
},
|
|
545
|
+
{
|
|
546
|
+
name: 'vendor',
|
|
547
|
+
label: 'Vendor',
|
|
548
|
+
type: 'string',
|
|
549
|
+
description: 'Free text; Shopify does not check it against anything.',
|
|
550
|
+
},
|
|
551
|
+
{
|
|
552
|
+
name: 'productType',
|
|
553
|
+
label: 'Product type',
|
|
554
|
+
type: 'string',
|
|
555
|
+
description: 'Free text, and separate from the store\'s collections.',
|
|
556
|
+
},
|
|
557
|
+
{
|
|
558
|
+
name: 'tags',
|
|
559
|
+
label: 'Tags',
|
|
560
|
+
type: 'tags',
|
|
561
|
+
description: 'Tags to put on the product.',
|
|
562
|
+
},
|
|
563
|
+
{
|
|
564
|
+
name: 'status',
|
|
565
|
+
label: 'Status',
|
|
566
|
+
type: 'productStatus',
|
|
567
|
+
description: 'Left empty, Shopify makes it ACTIVE — visible to shoppers the moment it is created. Pick DRAFT when a person should look at it first.',
|
|
568
|
+
},
|
|
569
|
+
{
|
|
570
|
+
name: 'handle',
|
|
571
|
+
label: 'Handle',
|
|
572
|
+
type: 'string',
|
|
573
|
+
description: 'The URL slug. Left empty, Shopify builds one from the title; set it and a collision fails the whole mutation.',
|
|
574
|
+
},
|
|
575
|
+
],
|
|
576
|
+
},
|
|
263
577
|
};
|
|
578
|
+
/**
|
|
579
|
+
* The OAuth scope each operation needs, so a missing one is named BEFORE the
|
|
580
|
+
* call instead of arriving as an HTTP 403 on a request that looks fine.
|
|
581
|
+
*
|
|
582
|
+
* ## The list is "any one of", not "all of"
|
|
583
|
+
*
|
|
584
|
+
* That is `fulfillOrder`'s doing and it is not a generalisation for its own
|
|
585
|
+
* sake: which fulfilment-order scope applies depends on where the order is
|
|
586
|
+
* fulfilled from — the merchant's own locations, a third-party service, or the
|
|
587
|
+
* app itself acting as one. Shopify accepts the mutation if the token carries
|
|
588
|
+
* ANY of the three. Requiring all three would refuse a store that is correctly
|
|
589
|
+
* set up.
|
|
590
|
+
*
|
|
591
|
+
* ## An empty list means "not checkable from the operation alone"
|
|
592
|
+
*
|
|
593
|
+
* `setTags` tags an order, a customer or a product through the same mutation,
|
|
594
|
+
* and `setMetafield` writes onto whichever resource the owner id points at —
|
|
595
|
+
* so the scope depends on a FIELD, not on the operation. Guessing would be
|
|
596
|
+
* worse than not checking: a wrong guess blocks a call Shopify would have
|
|
597
|
+
* accepted, and a pre-flight check that produces false refusals gets deleted.
|
|
598
|
+
* Those fall through to Shopify's own 403, which `describeShopifyError`
|
|
599
|
+
* already explains.
|
|
600
|
+
*
|
|
601
|
+
* ⚠️ Read against `shopify.dev/docs/api/usage/access-scopes` and each
|
|
602
|
+
* mutation's own "Access requirements". Two things follow from that page and
|
|
603
|
+
* are relied on by `scopesQueFaltanEnShopify`:
|
|
604
|
+
*
|
|
605
|
+
* - **A write scope includes read.** `write_orders` grants `read_orders`, so
|
|
606
|
+
* a required `read_x` is satisfied by a granted `write_x`.
|
|
607
|
+
* - **Scopes are granted at install.** Adding one to the app does not give
|
|
608
|
+
* it to credentials that already exist; those have to be reconnected.
|
|
609
|
+
*/
|
|
610
|
+
exports.SHOPIFY_OPERATION_SCOPES = {
|
|
611
|
+
upsertCustomer: ['write_customers'],
|
|
612
|
+
/* Depende del recurso elegido, no de la operación. Ver la cabecera. */
|
|
613
|
+
setTags: [],
|
|
614
|
+
adjustInventory: ['write_inventory'],
|
|
615
|
+
/* `findRecords` lee tres colecciones distintas según el recurso. Igual. */
|
|
616
|
+
findRecords: [],
|
|
617
|
+
createDraftOrder: ['write_draft_orders'],
|
|
618
|
+
completeDraftOrder: ['write_draft_orders'],
|
|
619
|
+
fulfillOrder: [
|
|
620
|
+
'write_merchant_managed_fulfillment_orders',
|
|
621
|
+
'write_third_party_fulfillment_orders',
|
|
622
|
+
'write_assigned_fulfillment_orders',
|
|
623
|
+
],
|
|
624
|
+
cancelOrder: ['write_orders'],
|
|
625
|
+
/* Depende del dueño al que apunte `ownerId`. Ver la cabecera. */
|
|
626
|
+
setMetafield: [],
|
|
627
|
+
createProduct: ['write_products'],
|
|
628
|
+
};
|
|
629
|
+
/**
|
|
630
|
+
* Which of an operation's scopes the credential does NOT have.
|
|
631
|
+
*
|
|
632
|
+
* Empty means "nothing to say" — and it says that in three different
|
|
633
|
+
* situations, all of which have to fail OPEN:
|
|
634
|
+
*
|
|
635
|
+
* 1. The operation declares no scope (the resource-dependent ones).
|
|
636
|
+
* 2. The credential has a scope string and it covers one of the alternatives.
|
|
637
|
+
* 3. **The credential has no scope string at all.** Shopify returns the
|
|
638
|
+
* granted scopes on the token exchange, but a credential stored before
|
|
639
|
+
* that was read, or one whose metadata was pruned, has an empty string —
|
|
640
|
+
* and refusing to run a node because we cannot see its permissions would
|
|
641
|
+
* break working flows to prevent a maybe. Shopify is the authority here;
|
|
642
|
+
* this check only saves the round trip when it can prove the answer.
|
|
643
|
+
*
|
|
644
|
+
* @param concedidos what Shopify granted, as it sends it: a comma-separated
|
|
645
|
+
* string, or the already-split list.
|
|
646
|
+
*/
|
|
647
|
+
function scopesQueFaltanEnShopify(concedidos, requeridos) {
|
|
648
|
+
if (requeridos.length === 0)
|
|
649
|
+
return [];
|
|
650
|
+
const lista = (typeof concedidos === 'string'
|
|
651
|
+
? concedidos.split(',')
|
|
652
|
+
: Array.isArray(concedidos)
|
|
653
|
+
? concedidos
|
|
654
|
+
: [])
|
|
655
|
+
.map((s) => String(s).trim())
|
|
656
|
+
.filter(Boolean);
|
|
657
|
+
// Fail open: sin scopes a la vista no se puede probar que falte ninguno.
|
|
658
|
+
if (lista.length === 0)
|
|
659
|
+
return [];
|
|
660
|
+
const tiene = new Set(lista);
|
|
661
|
+
const cubierto = (scope) => tiene.has(scope) ||
|
|
662
|
+
// `write_x` incluye `read_x`, y ésa es la única implicación que existe.
|
|
663
|
+
(scope.startsWith('read_') && tiene.has(`write_${scope.slice(5)}`));
|
|
664
|
+
// «Cualquiera de» — con una basta, y entonces no falta nada.
|
|
665
|
+
if (requeridos.some(cubierto))
|
|
666
|
+
return [];
|
|
667
|
+
return [...requeridos];
|
|
668
|
+
}
|
package/dist/types.d.ts
CHANGED
|
@@ -38,7 +38,20 @@ export interface NodeUIConfig {
|
|
|
38
38
|
hasBranches?: boolean;
|
|
39
39
|
isTerminal?: boolean;
|
|
40
40
|
hasLoopBack?: boolean;
|
|
41
|
-
|
|
41
|
+
/**
|
|
42
|
+
* Aquí había también un `'rule'`, sólo para el router, y con él vivía en
|
|
43
|
+
* el lienzo un camino de conexión a medida: su propio modal, su propio
|
|
44
|
+
* `handleRuleSelect` y su propia puerta en `onConnect`. Dos mecanismos
|
|
45
|
+
* para lo mismo, y así es como uno se arregla y el otro no: el modal del
|
|
46
|
+
* router salía al ARRASTRAR y nunca al pulsar el `+`, porque ese segundo
|
|
47
|
+
* camino pasa por `outputGroups` — que el router no declaraba.
|
|
48
|
+
*
|
|
49
|
+
* El router ramifica igual que el conditional, el split y el clasificador,
|
|
50
|
+
* y su destino vive en el mismo sitio que el de ellos (`port: rule:<id>`),
|
|
51
|
+
* así que usa la misma maquinaria. Se quita del tipo para que no pueda
|
|
52
|
+
* volver a declararse sin que el compilador lo diga.
|
|
53
|
+
*/
|
|
54
|
+
connectModal?: 'branch' | 'output-group';
|
|
42
55
|
routerTargetLabel?: string;
|
|
43
56
|
/**
|
|
44
57
|
* Generic named output groups — used by connectModal: 'output-group'.
|
|
@@ -54,6 +67,20 @@ export interface NodeUIConfig {
|
|
|
54
67
|
nameField?: string;
|
|
55
68
|
/** Field within each group for summary/description (e.g. 'field', 'filterMode') */
|
|
56
69
|
summaryField?: string;
|
|
70
|
+
/**
|
|
71
|
+
* Varios campos del grupo, unidos por espacios, cuando el resumen que
|
|
72
|
+
* de verdad identifica al grupo no cabe en uno solo.
|
|
73
|
+
*
|
|
74
|
+
* Existe por las reglas del router: su condición son TRES campos
|
|
75
|
+
* (`field`, `operator`, `value`) y el modal a medida que se retiró las
|
|
76
|
+
* pintaba juntas — «status eq active». Con un único `summaryField` una
|
|
77
|
+
* regla sin `label` quedaba en «rule 1» y «status», que no dice a qué
|
|
78
|
+
* se está conectando uno.
|
|
79
|
+
*
|
|
80
|
+
* Los campos vacíos se saltan, para que una regla con operador
|
|
81
|
+
* `exists` no salga con un espacio colgando al final.
|
|
82
|
+
*/
|
|
83
|
+
summaryFields?: string[];
|
|
57
84
|
/** Label shown in the modal (e.g. 'output', 'branch') */
|
|
58
85
|
label: string;
|
|
59
86
|
/** Entity field for the fallback/else path (e.g. 'elseOutputNodes') */
|
|
@@ -80,6 +107,29 @@ export interface NodeUIConfig {
|
|
|
80
107
|
field: string;
|
|
81
108
|
value: unknown;
|
|
82
109
|
};
|
|
110
|
+
/**
|
|
111
|
+
* Qué es el puerto `main` de este nodo MIENTRAS su contenedor está
|
|
112
|
+
* vacío. Sin esto, conectar a un nodo que ramifica y todavía no tiene
|
|
113
|
+
* ninguna salida escribía una arista en `main` **en silencio**, y el
|
|
114
|
+
* usuario no tenía forma de saber qué había pasado con ella.
|
|
115
|
+
*
|
|
116
|
+
* No hay una respuesta única, y por eso es un dato y no una regla.
|
|
117
|
+
* Medido en `api/src/common/pipeline-run.service.ts`:
|
|
118
|
+
*
|
|
119
|
+
* 'passthrough' — router sin reglas: `rules.length === 0
|
|
120
|
+
* ? refsForPort(entity, MAIN_PORT) : []`. La
|
|
121
|
+
* arista SÍ dispara... hasta que se cree la
|
|
122
|
+
* primera regla, y entonces deja de hacerlo
|
|
123
|
+
* sin avisar.
|
|
124
|
+
* 'never-dispatched' — split: no tiene salida `main`, y el propio
|
|
125
|
+
* despachador registra un warning por cada
|
|
126
|
+
* arista que se quedó en ese puerto.
|
|
127
|
+
*
|
|
128
|
+
* Se declara sólo donde se ha medido. Sin declarar, el lienzo se
|
|
129
|
+
* comporta como siempre: conecta por el camino universal y no dice
|
|
130
|
+
* nada, que es lo que hacía antes de existir este campo.
|
|
131
|
+
*/
|
|
132
|
+
emptyContainerMain?: 'passthrough' | 'never-dispatched';
|
|
83
133
|
};
|
|
84
134
|
/**
|
|
85
135
|
* Maps output fields to alternate payload fields on the source entity.
|
package/dist/ui.js
CHANGED
|
@@ -54,12 +54,30 @@ exports.NODE_UI = {
|
|
|
54
54
|
fileTransform: { fromNodes: true, toNodes: true },
|
|
55
55
|
limit: { fromNodes: true, toNodes: true, special: { loopBackAllowed: true } },
|
|
56
56
|
// ── Flow control nodes ──
|
|
57
|
-
|
|
57
|
+
// `emptyContainerMain: 'never-dispatched'` dice lo que el despachador ya
|
|
58
|
+
// registra como warning: un split NO tiene salida `main`, así que una arista
|
|
59
|
+
// que se quede ahí —la que se guardaba al conectar un split sin salidas— no
|
|
60
|
+
// se despacha nunca. Ver `pipeline-run.service.ts`, el bloque `nodeType ===
|
|
61
|
+
// 'split'`. El lienzo lo usa para avisar en vez de callarse.
|
|
62
|
+
split: { fromNodes: true, toNodes: true, outputHandles: ['right'], special: { connectModal: 'output-group', outputGroups: { field: 'outputs', nameField: 'name', summaryField: 'field', label: 'output', emptyContainerMain: 'never-dispatched' } } },
|
|
58
63
|
merge: { fromNodes: true, toNodes: true, inputHandles: ['left', 'top'] },
|
|
59
64
|
approval: { fromNodes: true, toNodes: true, outputHandles: ['right'], special: { connectModal: 'output-group', outputGroups: { fixedGroups: [{ name: 'Approve', field: 'outputNodes' }, { name: 'Reject', field: 'rejectionOutputNodes' }], label: 'action' } } },
|
|
60
65
|
loop: { fromNodes: true, toNodes: true, inputHandles: ['left'], outputHandles: ['right'], dotHandles: { input: ['left-in'], output: ['right-out-loop', 'right-in-loopback', 'right-out-done'] }, special: { hasLoopBack: true, alternatePayloads: { doneOutputNodes: 'lastDonePayload' } } },
|
|
61
66
|
// ── Routing nodes ──
|
|
62
|
-
|
|
67
|
+
// El router ramifica igual que el conditional, el split y el clasificador:
|
|
68
|
+
// sus salidas son un contenedor (`rules[]`) y el destino de cada una vive en
|
|
69
|
+
// la arista, en `port: rule:<id>`. Lo único que le faltaba era DECIRLO aquí.
|
|
70
|
+
//
|
|
71
|
+
// Mientras no lo decía, tenía en el lienzo un camino propio —`connectModal:
|
|
72
|
+
// 'rule'`, con su modal, su `handleRuleSelect` y su puerta en `onConnect`— y
|
|
73
|
+
// eso dejaba el `+` fuera: ese camino no pasa por `onConnect`, pregunta por
|
|
74
|
+
// `outputGroups`, y el router no tenía. Arrastrando salía el modal; pulsando
|
|
75
|
+
// el `+` la arista se guardaba en `main` sin preguntar nada.
|
|
76
|
+
//
|
|
77
|
+
// `nameField: 'label'` porque el `label` de una regla es opcional; cuando
|
|
78
|
+
// falta, el modal numera («rule 1») y el `summaryFields` de al lado pone la
|
|
79
|
+
// condición, que es lo que de verdad la identifica.
|
|
80
|
+
router: { fromNodes: true, toNodes: true, outputHandles: ['right'], dotHandles: { output: ['right-out'] }, special: { connectModal: 'output-group', outputGroups: { field: 'rules', nameField: 'label', summaryFields: ['field', 'operator', 'value'], label: 'rule', emptyContainerMain: 'passthrough' } } },
|
|
63
81
|
// ── Action nodes ──
|
|
64
82
|
emailAction: { fromNodes: true, toNodes: true, inputHandles: ['left', 'top'], outputHandles: ['right'], dotHandles: { input: ['left-in', 'top-in'], output: ['right-out'] }, special: { loopBackAllowed: true, routerTargetLabel: 'email' } },
|
|
65
83
|
gmailAction: { fromNodes: true, toNodes: true, inputHandles: ['left', 'top'], outputHandles: ['right'], dotHandles: { input: ['left-in', 'top-in'], output: ['right-out'] }, special: { loopBackAllowed: true, routerTargetLabel: 'gmail' } },
|
package/package.json
CHANGED