*_merchant_managed_fulfillment_orders permissions disappear from app

[EmiliaSC]

I am adding these permissions through /admin/request_granular_access_scopes.json

write_merchant_managed_fulfillment_orders and read_merchant_managed_fulfillment_orders, then i confirm through /admin/oauth/access_scopes.json they were applied

i am able to see data about fulfillment_orders 

/admin/api/2023-04/orders/{order_id}/fulfillment_orders.json

{
    "fulfillment_orders": [
        {
            "id": 662xxxxxxx,
            "shop_id": 650xxxxxxx,
            "order_id": 560xxxxxxx,
        }
    ]
}

The expected behavior is that write_merchant_managed_fulfillment_orders and read_merchant_managed_fulfillment_orders should stay in the list of access scopes

Instead they are disappearing after a day or two and are being replaced with read_assigned_fulfillment_orders, but this permission does not allow me to read fulfillment orders

/admin/api/2023-04/orders/{order_id}/fulfillment_orders.json

{
"fulfillment_orders": []
}

I wrote to support@shopify.com and they are suggesting to turn to being a Fulfillment service apps, but this is not my requirement, i need to be an Order management app

Why are they disappearing?

[Shayne]

Hi Emilia!

There may be some code in your app that's validating and updating your access scopes. Most of the libraries in the ecosystem will have some kind of logic that does this, so if you're manually updating the scopes outside of your app config, you're likely running into one of these "overwriting scopes" situation when the app reinitializes. It's hard to know based on the context that you're sharing here, but scopes are never changed without intervention of the app, so your app is updating the scopes somewhere.

Hope this helps, feel free to respond with more context!

[EmiliaSC]

Great advice, there was an outdated permissions array in the controller that handles the App URL. I updated the array and i'll check later if the problem still persists.