What area(s) will this request affect?
App
What type of change do you want to see?
New feature
Overview
Currently, in order to request access to protected customer data, the app developer must use the form in the app settings in the partners website. For apps used only in development shops, there is no requirement to submit the request for review, but it is still a manual process to enable the required access using that form. In order to have a fully capable Continuous-Integration development flow, It is desirable to deploy new apps fully programmatically, for example to test a new feature separately from other developments. Allowing only manual entry to specify the protected customer data access an app requires blocks this sort of CI.
Suggestion: Allow developers to specify their requirements in the shopify.app.toml for an app, along with any explanations to prepare for review.
[protected_customer_data]
request_access = true
reasons = ["customer_service", "app_functionality"]
[protected_customer_data.email]
request_access = true
reasons = ["customer_service", "other"]
other_reason="Spam prevention"
Extra thought: in many ways, these permissions are similar to the oauth scopes. Could the intent behind the scopes be recorded in the config instead, simplifying the permission system down to only one way to request access?
Note: This feature request regards the automatic entry of the data access requirements, not submitting request for review.
Motivation
We are in the process of making a Shopify App to provide fulfillment services with our customers. We use GitLab CI, and follow their recommendation to deploy each feature development branch for review. This would mean setting up a new app for each development.
What area(s) will this request affect?
App
What type of change do you want to see?
New feature
Overview
Currently, in order to request access to protected customer data, the app developer must use the form in the app settings in the partners website. For apps used only in development shops, there is no requirement to submit the request for review, but it is still a manual process to enable the required access using that form. In order to have a fully capable Continuous-Integration development flow, It is desirable to deploy new apps fully programmatically, for example to test a new feature separately from other developments. Allowing only manual entry to specify the protected customer data access an app requires blocks this sort of CI.
Suggestion: Allow developers to specify their requirements in the shopify.app.toml for an app, along with any explanations to prepare for review.
Extra thought: in many ways, these permissions are similar to the oauth scopes. Could the intent behind the scopes be recorded in the config instead, simplifying the permission system down to only one way to request access?
Note: This feature request regards the automatic entry of the data access requirements, not submitting request for review.
Motivation
We are in the process of making a Shopify App to provide fulfillment services with our customers. We use GitLab CI, and follow their recommendation to deploy each feature development branch for review. This would mean setting up a new app for each development.