[Bug]: shopify app deploy fails on token validation (non-interactive environment) (Simplified deployments)

[gregmaxin]

Please confirm that you have:

• Searched existing issues to see if your issue is a duplicate. (If you’ve found a duplicate issue, feel free to add additional information in a comment on it.)
• Reproduced the issue in the latest CLI version.

In which of these areas are you experiencing a problem?

App, Extension

Expected behavior

When running shopify app deploy -f --no-release in my github action it should create a new version

Actual behavior

An error is thrown on token validation

2023-09-08T21:48:19.609Z: Sending POST request to URL https://accounts.shopify.com/oauth/token?grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&client_id=**_XXXXX_**&scope=https%3A%2F%2Fapi.shopify.com%2Fauth%2Fpartners.app.cli.access&subject_token=****
With request headers:
 - User-Agent: Shopify CLI; v=3.49.2
 - Keep-Alive: timeout=30
 - Sec-CH-UA-PLATFORM: linux
 - Content-Type: application/json

2023-09-08T21:48:19.804Z: Request to https://accounts.shopify.com/oauth/token?grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&**_XXXXX_**scope=https%3A%2F%2Fapi.shopify.com%2Fauth%2Fpartners.app.cli.access&subject_token=**** completed in 182 ms
With response headers:
 - cache-control: no-cache, no-store, private, must-revalidate, max-age=0
 - content-type: application/json; charset=utf-8
 - x-request-id: 18dd138c-9a19-4e08-b25e-c578f98d444d
    
╭─ error ──────────────────────────────────────────────────────────────────────╮
│                                                                              │
│                                                                              │
│  To investigate the issue, examine this stack trace:                         │
│    at tokenRequestErrorHandler                                               │
│    (@shopify/cli-kit/src/private/node/session/exchange.ts:174)               │
│      return new InvalidRequestError()                                        │
│    at mapError (@shopify/cli-kit/src/public/node/result.ts:142)              │
│      return err(mapper(this.error))                                          │
│    at requestAppToken                                                        │
│    (@shopify/cli-kit/src/private/node/session/exchange.ts:1[53](https://github.com/beam-commerce/aftersell/actions/runs/6126709484/job/16631291618#step:13:54))               │
│      const value =                                                           │
│      tokenResult.mapError(tokenRequestErrorHandler).valueOrBug()             │
│    at processTicksAndRejections (node:internal/process/task_queues:95)       │
│    at async exchangeCustomPartnerToken                                       │
│    (@shopify/cli-kit/src/private/node/session/exchange.ts:92)                │
│      const newToken = await requestAppToken('partners', token,               │
│      ['https://api.shopify.com/auth/partners.app.cli.access'])               │
│    at async ensureAuthenticatedPartners                                      │
│    (@shopify/cli-kit/src/public/node/session.ts:32)                          │
│      return (await exchangeCustomPartnerToken(envToken)).accessToken         │
│    at async ensureDeployContext                                              │
│    (@shopify/app/src/cli/services/context.ts:329)                            │
│      const token = await ensureAuthenticatedPartners()                       │
│    at async deploy (@shopify/app/src/cli/services/deploy.ts:[64](https://github.com/beam-commerce/aftersell/actions/runs/6126709484/job/16631291618#step:13:65))              │
│      let {app, identifiers, partnersApp, token, deploymentMode} = await      │
│      ensureDeployContext(options)                                            │
│    at run (@shopify/app/src/cli/commands/app/deploy.ts:99)                   │
│      await deploy({                                                          │
│                                                                              │
╰──────────────────────────────────────────────────────────────────────────────╯

Reproduction steps

1. Create a github action with a workfile that has yarn deploy-force --no-release as a step in a job
2. Run the github action
3. Github action fails with the above logs.

Operating System

WSL 2 (Ubuntu 18)

Shopify CLI version (check your project's package.json if you're not sure)

3.49.2

Shell

wsl

Node version (run node -v if you're not sure)

18.16.1 (github action)

What language and version are you using in your application?

Node

[Arkham]

Hi there, can you check if the token has been generated with UI extensions and functions support? See this screenshot

[gregmaxin]

I believe the issue here was that the token expires after 6 months and this coincidentally happened the same day I switched to simplified deployments.

[alxwstn]

Hi! I know that this is closed, but wanted to voice that this issue got us today. I totally understand that it's our responsibility to manage rotating this key (we're going to improve our process around this!), but if y'all have the opportunity to add key expiration info to the error message I think that will help other folks who've blundered there way into this problem

[gupta-ji6]

hi folks, I bumped into the same error today while running shopify app deploy from Github Actions & couldn't figure out what's the issue. The stack trace wasn't helpful to me in figuring out the root cause.

Hi there, can you check if the token has been generated with UI extensions and functions support?

The suggestion mentioned above looks outdated. When I created a new token, it didn't ask me for any list of scopes (UI Extensions, Functions, etc) I would like the token to have. Instead, it directly created the token & gave it "Apps" access only. I cannot see any such UI which is shown here, I have owner access to partners dashboard.
cc: @Arkham

Stack Trace

> shopify app deploy --config staging -f --source-control-url https://github.com/razorpay/shopify-wallet/commit/30fd97bed93be93c7882d22370f10058ad09fffc

╭─ warning ────────────────────────────────────────────────────────────────────╮
│                                                                              │
│  The flag `api-key` has been deprecated in favor of `client-id`              │
│                                                                              │
╰──────────────────────────────────────────────────────────────────────────────╯

╭─ error ──────────────────────────────────────────────────────────────────────╮
│                                                                              │
│                                                                              │
│  To investigate the issue, examine this stack trace:                         │
│    at tokenRequestErrorHandler                                               │
│    (@shopify/cli-kit/src/private/node/session/exchange.ts:174)               │
│      return new InvalidRequestError()                                        │
│    at mapError (@shopify/cli-kit/src/public/node/result.ts:142)              │
│      return err(mapper(this.error))                                          │
│    at requestAppToken                                                        │
│    (@shopify/cli-kit/src/private/node/session/exchange.ts:153)               │
│      const value =                                                           │
│      tokenResult.mapError(tokenRequestErrorHandler).valueOrBug()             │
│    at processTicksAndRejections (node:internal/process/task_queues:95)       │
│    at async exchangeCustomPartnerToken                                       │
│    (@shopify/cli-kit/src/private/node/session/exchange.ts:92)                │
│      const newToken = await requestAppToken('partners', token,               │
│      ['https://api.shopify.com/auth/partners.app.cli.access'])               │
│    at async ensureAuthenticatedPartners                                      │
│    (@shopify/cli-kit/src/public/node/session.ts:41)                          │
│      return (await exchangeCustomPartnerToken(envToken)).accessToken         │
│    at async fetchPartnersSession                                             │
│    (@shopify/app/src/cli/services/context/partner-account-info.ts:39)        │
│      const token = await ensureAuthenticatedPartners()                       │
│    at async ensureDeployContext                                              │
│    (@shopify/app/src/cli/services/context.ts:[37](https://github.com/razorpay/shopify-wallet/actions/runs/8477754319/job/23229073506#step:6:38)0)                            │
│      const partnersSession = await fetchPartnersSession()                    │
│    at async deploy (@shopify/app/src/cli/services/deploy.ts:49)              │
│      let {app, identifiers, partnersApp, token, release} = await             │
│      ensureDeployContext(options)                                            │
│    at run (@shopify/app/src/cli/commands/app/deploy.ts:102)                  │
│      await deploy({                                                          │
│                                                                              │
╰──────────────────────────────────────────────────────────────────────────────╯


Error: Process completed with exit code 1.