[Bug]: Migrating to App-specific Webhook Subscriptions with Legacy Install flow enabled causes deploy error

[pnmcosta]

Please confirm that you have:

• Searched existing issues to see if your issue is a duplicate. (If you’ve found a duplicate issue, feel free to add additional information in a comment on it.)
• Reproduced the issue in the latest CLI version.

In which of these areas are you experiencing a problem?

App

Expected behavior

Running npm run deploy after migrating the toml config to App-specific Webhook Subscriptions:

[webhooks]
api_version = "2024-07"

[[webhooks.subscriptions]]
topics = [ "app_subscriptions/update", "app/uninstalled", "orders/paid", "shop/update" ]
uri = "webhooks"
compliance_topics = [ "customers/data_request", "customers/redact", "shop/redact" ]

should not produce an error if legacy install flow is enabled and the scope has always been included:

[access_scopes]
# Learn more at https://shopify.dev/docs/apps/tools/cli/configuration#access_scopes
scopes = "read_all_orders,read_customers,read_discounts,read_orders,read_price_rules,read_script_tags,write_customers,write_discounts,write_price_rules,write_script_tags"
use_legacy_install_flow = true

Actual behavior

I'm getting the following error even thought read_orders and read_all_orders are in the scopes, and have been before the migration;

│
│  Version couldn't be created.   
│
│  Missing scope for webhook topic: orders/paid (read_orders or read_marketplace_orders) 
│

Verbose output

Not really comfortable sharing the whole verbose output, but happy to for any specifics portions required.

Reproduction steps

1. Have an app with include_config_on_deploy = true and read_orders in scope using the shop-specific webhook subscriptions
2. Migrate to the new app-specific webhook subscriptions as per https://shopify.dev/docs/apps/build/webhooks/subscribe#app-specific-subscriptions
3. Run npm run deploy

Operating System

Fedora 18 on WSL

Shopify CLI version (check your project's package.json if you're not sure)

3.66.1

Shell

zsh

Node version (run node -v if you're not sure)

v20.14.0

What language and version are you using in your application?

No response

[pnmcosta]

Hi, is there an update on this? ty.

[isaacroldan]

Hi @pnmcosta, if you set use_legacy_install_flow = true you can't use declarative scopes in your toml config.

Check the documentation on how this property affects the scopes:
https://shopify.dev/docs/apps/build/cli-for-apps/app-configuration#access_scopes

[pnmcosta]

Hi @isaacroldan,

I started development of the app when the login flow was not legacy - roughly 1 year and few months ago - scopes has always been an option to include in the configuration, otherwise it would not have been included.

Regardless, how/why is the login flow option (legacy or not) have an impact on the scopes required for the webhooks? As I clearly pointed out, all the published versions of the app have the required scopes for the webhooks I've always been receiving and subscribe on a per shop basis.

If the reason for this is that app-specific webhook subscription rely on declarative scopes on the configuration file only, and use_legacy_install_flow =true prevents it, I don't think the documentation on either the link you posted of the app-specific webhook subscriptions is clear enough to indicate this.

[pnmcosta]

Hi @isaacroldan

The template i used initially was https://github.com/Shopify/shopify-app-template-node/ and as you see here scopes have always been declared on the configuration file.

[8bitmatt]

Experiencing the same problem. I also believe this is a bug.

Version couldn't be created. Missing scope for webhook topic: orders/create (read_orders or read_marketplace_orders)

My app also uses use_legacy_install_flow = true
In production SCOPES are from env, but for local dev they need to be defined in the toml file

using latest cli 3.71.3

[wisnshaftler]

same here

[sebastianpisula]

same here

[8bitmatt]

@isaacroldan can we get some more clarification or reopen this issue?
see my above comment #4417 (comment)

I have new app functionality that depends on webhooks that I need to release soon and would really like to avoid all the extra work to manage webhooks in code.