shopify-enterprise-rbac

# Shopify Enterprise RBAC ## Overview Implement role-based access control for Shopify Plus apps using Shopify's staff member permissions, multi-location features, and Organization-level access. ## Prerequisites - Shopify Plus store (for Organization features) - Understanding of Shopify's staff permission model - `read_users` scope for querying staff permissions ## Instructions ### Step 1: Query Staff Member Permissions ```typescript // Query staff members and their permissions via GraphQL const STAFF_QUERY = `{ staffMembers(first: 50) { edges { node { id email firstName lastName isShopOwner active locale permissions: accessScopes { handle description } } } } }`; // Staff permissions match app access scopes: // "read_products", "write_products", "read_orders", etc. // A staff member can only use app features matching their store permissions ``` ### Step 2: App-Level Role Mapping Map Shopify staff permissions to your app's roles: ```typescript type AppRole = "admin" | "manager" | "viewer" | "fulfillment"; interface RoleMapping { role: AppRole; requiredScopes: string[]; allowedActions: string[]; } const ROLE_MAPPINGS: RoleMapping[] = [ { role: "admin", requiredScopes: ["write_products", "write_orders", "write_customers"], allowedActions: ["*"], }, { role: "manager", requiredScopes: ["write_products", "read_orders"], ...