The post-connect check can withdraw a working connection when its probe action needs a missing scope #886

What happens

After a key/fields connection, OpenBot checks it with one argument-free read action. probeActionFor (server/src/plugins/plugin-store/connections.ts) prefers an identity read matching IDENTITY_ACTION (plugin-store/model.ts), and otherwise takes the first safe read alphabetically. For Shopify that is SHOPIFY_COUNT_BLOGS, which needs read_content, a scope a store app with order and product scopes does not have. Shopify answers 403, and the connection, whose token was fine, is withdrawn:

shopify was connected, and the check this deployment then ran against it did not come back clean: Access forbidden. This usually means the API token doesn't have the required 'read_content' or 'write_content' scope ...

A row whose check failed can also be left behind as verified: false, so a later setup sees it as connected.

Suggested fix

• Recognise more identity reads. For a store, its own details are the identity: adding _GET_SHOP_DETAILS to IDENTITY_ACTION fixes Shopify (implemented and tested in a demo build):

  export const IDENTITY_ACTION =
    /(_GET_ME|_PROFILE|_CURRENT_USER|_USER_INFO|_WHOAMI|_GET_SHOP_DETAILS)$/;

• More generally, a 403 that names a missing scope says the credential works but lacks that one permission. Record the connection as connected and "unchecked" (or "checked, limited scope") rather than withdrawing it, and say which scope the probe needed.