App Bridge Resource Picker: Permission Issue with Staff Roles and App Scopes

App Bridge
1

I have a question regarding this use case:

  • Our app has the write_products scope.
  • A staff account without any product permissions (view, create, edit) is using the app.

We are using the Resource Picker from App Bridge, but when the staff member attempts to open the Resource Picker modal, they are unable to do so. There is no error feedback for them—only an error log in the console. It can only be used when the staff have the view products permissions

Is this the expected behavior in Shopify? Since our app has the write_products scope, we could technically build a custom Resource Picker that allows the staff to view products. Would that be a valid approach?

2

Yes, this is expected. The Resource Picker will only work if the logged-in user has the necessary permissions, regardless of your app’s permissions. This is because the Resource Picker uses the logged-in user’s authentication to fetch products, not your app’s token.

Yes, you can build a custom Resource Picker and use your app’s offline token to fetch products and it will work fine for all users.

You can read more about this here, Resource picker is not working on some stores · Issue #422 · Shopify/shopify-app-bridge · GitHub

2 Likes