From e8dc74ba9c1ce0a996c1251222b1510a80e7719f Mon Sep 17 00:00:00 2001 From: Alex Montague Date: Thu, 29 Oct 2026 14:58:31 -0400 Subject: [PATCH] Point service account access errors at organization settings, not a fixed admin path The errors for a service account token that lacks access named the admin page as "Settings > Users > Security". Service accounts have since moved to Organization settings > Security, and the page can move again. The errors now say "in your organization's settings in the Shopify admin", which stays true across admin layout changes. Both the Organizations API refusal in @shopify/organizations and the token exchange refusal in cli-kit are updated. No changeset: both messages are unreleased and already covered by pending changesets. --- packages/cli-kit/src/private/node/session/exchange.ts | 3 ++- .../organizations/src/cli/services/business-platform.test.ts | 2 +- packages/organizations/src/cli/services/business-platform.ts | 3 ++- packages/store/src/cli/commands/store/create/dev.test.ts | 2 +- packages/store/src/cli/commands/store/delete.test.ts | 2 +- 5 files changed, 7 insertions(+), 5 deletions(-) diff --git a/packages/cli-kit/src/private/node/session/exchange.ts b/packages/cli-kit/src/private/node/session/exchange.ts index 12e3f8fbe32..ea2c559b1e9 100644 --- a/packages/cli-kit/src/private/node/session/exchange.ts +++ b/packages/cli-kit/src/private/node/session/exchange.ts @@ -78,7 +78,8 @@ function automationTokenExchangeMessages( ): {message: string; tryMessage: TokenItem} { const prettyName = apiName.replace(/-/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase()) const variable = automationTokenVariable() ?? environmentVariables.serviceAccountToken - const admin: TokenItem = ['in the Shopify admin under', {subdued: 'Settings > Users > Security'}] + // Named loosely on purpose: the admin page that manages service accounts has moved before and can move again. + const admin: TokenItem = ["in your organization's settings in the Shopify admin"] switch (automationTokenExchangeFailure(cause)) { case 'missing_access': { diff --git a/packages/organizations/src/cli/services/business-platform.test.ts b/packages/organizations/src/cli/services/business-platform.test.ts index b5f3e5795e5..5ef5f38e454 100644 --- a/packages/organizations/src/cli/services/business-platform.test.ts +++ b/packages/organizations/src/cli/services/business-platform.test.ts @@ -61,7 +61,7 @@ describe('OrganizationStoreAccessError', () => { // The guidance lives in nextSteps, the field the store commands' --json output carries. expect(error.tryMessage).toBeNull() expect(error.nextSteps).toEqual([ - 'Give the service account Dev store management access in the Shopify admin under Settings > Users > Security.', + "Give the service account Dev store management access in your organization's settings in the Shopify admin.", 'Or use a token from a service account that has that access.', ]) }) diff --git a/packages/organizations/src/cli/services/business-platform.ts b/packages/organizations/src/cli/services/business-platform.ts index 763cc1c1a42..d918919f021 100644 --- a/packages/organizations/src/cli/services/business-platform.ts +++ b/packages/organizations/src/cli/services/business-platform.ts @@ -57,7 +57,8 @@ export function isOrganizationAccessError(error: unknown): boolean { export class OrganizationStoreAccessError extends AbortError { constructor(organization: OrganizationReference) { const name = organization.businessName ?? `organization ${organization.id}` - const where = 'in the Shopify admin under Settings > Users > Security' + // Named loosely on purpose: the admin page that manages service accounts has moved before and can move again. + const where = "in your organization's settings in the Shopify admin" if (isServiceAccountTokenSet()) { super(`This service account can't manage dev stores in ${name}.`, null, [ diff --git a/packages/store/src/cli/commands/store/create/dev.test.ts b/packages/store/src/cli/commands/store/create/dev.test.ts index 8969905c170..462a4b02b7f 100644 --- a/packages/store/src/cli/commands/store/create/dev.test.ts +++ b/packages/store/src/cli/commands/store/create/dev.test.ts @@ -295,7 +295,7 @@ describe('store create dev command', () => { error: true, message: "This service account can't manage dev stores in Test Org.", nextSteps: [ - 'Give the service account Dev store management access in the Shopify admin under Settings > Users > Security.', + "Give the service account Dev store management access in your organization's settings in the Shopify admin.", 'Or use a token from a service account that has that access.', ], exitCode: 1, diff --git a/packages/store/src/cli/commands/store/delete.test.ts b/packages/store/src/cli/commands/store/delete.test.ts index 1c08bf0ffba..37952b8b7a0 100644 --- a/packages/store/src/cli/commands/store/delete.test.ts +++ b/packages/store/src/cli/commands/store/delete.test.ts @@ -190,7 +190,7 @@ describe('store delete command', () => { error: true, message: "This service account can't manage dev stores in Test Org.", nextSteps: [ - 'Give the service account Dev store management access in the Shopify admin under Settings > Users > Security.', + "Give the service account Dev store management access in your organization's settings in the Shopify admin.", 'Or use a token from a service account that has that access.', ], exitCode: 1,