feat(shopify): Shopify order/refund feed into the transactions inbox (#1474)

* feat(shopify): Shopify order/refund feed into the transactions inbox

New extensions/general/shopify feed extension, modeled on the WooCommerce
feed: connect a Shopify store with Dev Dashboard custom-app client
credentials (client credentials grant, ~24h tokens, never stored), then a
nightly cron + manual sync imports paid orders and refunds via the GraphQL
Admin API (pinned 2026-07) into the transactions inbox on clearing account
1584. Feed-only: nothing auto-books. Zero PII fields are queried, keeping
the app outside Shopify's protected customer data program.

- shopify_connections migration (RLS, revoke-never-delete, encrypted
  client id/secret) + shopify_sync capability and bank_sync-mirrored
  backfill
- frozen external_id scheme shopify_{shop_domain}_order|refund_{id},
  scoped on the shop domain so reconnects never re-import
- cursor sync on updated_at windows with 24h overlap, lock-date drop at
  map time, ingest-failure cursor floor, deadline stop-and-resume,
  revoked-credential flip
- /import card + settings panel, sv/en i18n, cron 03:15 in vercel.json +
  regenerated Docker crontabs, logo, events, panel registry
- 65 unit tests + pg-real RLS test; extensions.schema.json enum also
  gains the missing stripe entry (pre-existing drift)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(shopify): review findings from PR 1474

- token exchange: a 429 that survives every retry is throttling, not a
  credential failure; stop remapping retryable 4xx to 401 so sustained
  throttling can no longer flip the connection to revoked and delete the
  stored credentials (CodeRabbit critical)
- order sync: advance a scanned-through watermark (run start, capped by
  the failure floor) after a fully-listed window, so empty first runs and
  quiet stores rotate to the back of the cron's oldest-first selection
  instead of permanently occupying the 50-connection batch (CodeRabbit
  major, starvation)
- add handler-level tests for the orders cron route (auth 401, disabled
  503, unconfigured no-op, query failure, capability skip, happy path,
  per-connection failure isolation, revoked marking)
- add 401 tests for /sync, /transaction-sync and /disconnect; pin the
  cursor floor rule with a two-order page; stub the encryption key via
  vi.stubEnv
- note in the panel description (sv/en) that orders can mix VAT rates and
  must be split at booking (Swedish review advisory)
- DECISIONS.md: wrap underscore identifiers in backticks (MD037)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/entitlements/keys.ts

@@ -32,6 +32,8 @@ export const CAPABILITY = {
   stripe_payments: 'stripe_payments',
   /** WooCommerce store sync: orders/refunds imported as a transaction feed. */
   woocommerce_sync: 'woocommerce_sync',
+  /** Shopify store sync: orders/refunds imported as a transaction feed. */
+  shopify_sync: 'shopify_sync',
 } as const
 
 export type CapabilityKey = (typeof CAPABILITY)[keyof typeof CAPABILITY]
@@ -58,6 +60,7 @@ export const PAID_CAPABILITIES: readonly CapabilityKey[] = [
   CAPABILITY.email_send,
   CAPABILITY.stripe_payments,
   CAPABILITY.woocommerce_sync,
+  CAPABILITY.shopify_sync,
 ] as const
 
 /**

lib/events/types.ts

@@ -82,6 +82,9 @@ export type CoreEvent =
   // party's API credentials are granted/dropped).
   | { type: 'woocommerce.connected'; payload: { connectionId: string; storeUrl: string; userId: string; companyId: string } }
   | { type: 'woocommerce.disconnected'; payload: { connectionId: string; storeUrl: string | null; reason: 'user' | 'revoked_upstream'; userId: string; companyId: string } }
+  // Shopify store lifecycle: same audit doctrine as stripe.*/woocommerce.*.
+  | { type: 'shopify.connected'; payload: { connectionId: string; shopDomain: string; userId: string; companyId: string } }
+  | { type: 'shopify.disconnected'; payload: { connectionId: string; shopDomain: string | null; reason: 'user' | 'revoked_upstream'; userId: string; companyId: string } }
   // Periods
   | { type: 'period.locked'; payload: { period: FiscalPeriod; userId: string; companyId: string } }
   | { type: 'period.unlocked'; payload: { period: FiscalPeriod; userId: string; companyId: string } }

lib/extensions/__tests__/sectors.test.ts

@@ -48,8 +48,8 @@ describe('sectors registry', () => {
     expect(SECTORS.length).toBe(1)
   })
 
-  it('should have 16 total extensions', () => {
-    expect(getAllExtensions().length).toBe(16)
+  it('should have 17 total extensions', () => {
+    expect(getAllExtensions().length).toBe(17)
   })
 
   it('should have unique slugs within each sector', () => {
@@ -94,7 +94,7 @@ describe('sectors registry', () => {
 
   it('getExtensionsBySector returns extensions for a sector', () => {
     const extensions = getExtensionsBySector('general')
-    expect(extensions.length).toBe(16)
+    expect(extensions.length).toBe(17)
   })
 
   it('all extensions have required fields', () => {

lib/extensions/_generated/enabled-extensions.ts

@@ -13,4 +13,5 @@ export const ENABLED_EXTENSION_IDS: ReadonlySet<string> = new Set([
   'stripe',
   'whatsapp-inbox',
   'woocommerce',
+  'shopify',
 ])

lib/extensions/_generated/extension-list.ts

@@ -12,6 +12,7 @@ import { documentExtractionExtension } from '@/extensions/general/document-extra
 import { stripeExtension } from '@/extensions/general/stripe'
 import { whatsappInboxExtension } from '@/extensions/general/whatsapp-inbox'
 import { woocommerceExtension } from '@/extensions/general/woocommerce'
+import { shopifyExtension } from '@/extensions/general/shopify'
 
 export const FIRST_PARTY_EXTENSIONS: Extension[] = [
   enableBankingExtension,
@@ -26,4 +27,5 @@ export const FIRST_PARTY_EXTENSIONS: Extension[] = [
   stripeExtension,
   whatsappInboxExtension,
   woocommerceExtension,
+  shopifyExtension,
 ]

lib/extensions/_generated/sector-definitions.ts

@@ -158,5 +158,16 @@ export const EXTENSION_DEFINITIONS: Record<string, ExtensionDefinition[]> = {
           "longDescription": "Anslut din WooCommerce-butik så hämtas betalda ordrar och återbetalningar automatiskt varje natt till transaktionsinkorgen, som ett bankflöde för butiken. Inget bokförs automatiskt: du bokför raderna själv precis som vanliga banktransaktioner.",
           "hasOwnData": true
     },
+    {
+          "slug": "shopify",
+          "name": "Shopify",
+          "sector": "general",
+          "category": "import",
+          "icon": "ShoppingBag",
+          "dataPattern": "manual",
+          "description": "Hämta betalda ordrar och återbetalningar från din Shopify-butik till transaktionsinkorgen",
+          "longDescription": "Anslut din Shopify-butik så hämtas betalda ordrar och återbetalningar automatiskt varje natt till transaktionsinkorgen, som ett bankflöde för butiken. Inget bokförs automatiskt: du bokför raderna själv precis som vanliga banktransaktioner.",
+          "hasOwnData": true
+    },
   ],
 }

lib/extensions/settings-panel-registry.tsx

@@ -22,6 +22,9 @@ const SETTINGS_PANELS: Record<string, ComponentType> = {
   woocommerce: dynamic(
     () => import('@/extensions/general/woocommerce/components/WooCommerceSettingsPanel')
   ),
+  shopify: dynamic(
+    () => import('@/extensions/general/shopify/components/ShopifySettingsPanel')
+  ),
 }
 
 /**

lib/reports/full-archive-export.ts

@@ -1019,6 +1019,7 @@ export const ARCHIVE_EXCLUDED_TABLES: Record<string, string> = {
     'WhatsApp bot conversation state (company_id is only a which-company pin); receipts live in document_attachments',
   webhooks: 'automation config with signing secrets',
   woocommerce_connections: 'WooCommerce connection state (encrypted API secrets)',
+  shopify_connections: 'Shopify connection state (encrypted API secrets)',
 }
 
 /** Max parent ids per `IN (...)` chunk: keeps the PostgREST URL well under limits. */

lib/stripe/__tests__/subscription-sync.test.ts

@@ -115,7 +115,7 @@ describe('applySubscriptionState', () => {
     const grantUpsert = calls.find((c) => c.table === 'capability_grants')
     expect(grantUpsert?.op).toBe('upsert')
     const rows = grantUpsert?.payload as Array<{ capability_key: string; source: string }>
-    expect(rows.map((r) => r.capability_key).sort()).toEqual(['ai', 'bank_sync', 'email_send', 'skatteverket', 'stripe_payments', 'woocommerce_sync'])
+    expect(rows.map((r) => r.capability_key).sort()).toEqual(['ai', 'bank_sync', 'email_send', 'shopify_sync', 'skatteverket', 'stripe_payments', 'woocommerce_sync'])
     expect(rows.every((r) => r.source === 'stripe')).toBe(true)
   })