shopify-prod-checklist

# Shopify Production Checklist ## Overview Complete pre-launch checklist for deploying Shopify apps to production and submitting to the Shopify App Store. ## Prerequisites - Staging environment tested and verified - Shopify Partner account with app configured - All development and staging tests passing ## Instructions ### Step 1: API and Authentication - [ ] Using a stable API version (e.g., `2024-10`), not `unstable` - [ ] Access token stored in secure environment variables (never in code) - [ ] API secret stored securely for webhook HMAC verification - [ ] OAuth flow tested with a fresh install on a clean dev store - [ ] Session persistence implemented (database or Redis, not in-memory) - [ ] Token refresh/re-auth handled for expired sessions - [ ] `APP_UNINSTALLED` webhook handler cleans up sessions ### Step 2: Mandatory GDPR Compliance - [ ] `customers/data_request` webhook handler implemented - [ ] `customers/redact` webhook handler implemented - [ ] `shop/redact` webhook handler implemented (fires 48h after uninstall) - [ ] All three configured in `shopify.app.toml` - [ ] Handlers respond with HTTP 200 within 5 seconds - [ ] Customer data deletion actually works (test it!) ### Step 3: Webhook Security - [ ] All webhooks verify `X-Shopify-Hmac-Sha256` using HMAC-SHA256 - [ ] Using `crypto.timingSafeEqual()` for signature comparison - [ ] Webhook endpoints use raw body parsing (not JSON middleware) - [ ] Idempotency: duplicate webhook deliveries handled gracefu...