/shopify/install → redirects to Shopify OAuth
/shopify/callback → exchanges code for access token and displays it
To be removed after token is captured.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Log clear hint for 403 (IP whitelist), 401, 429, 5xx.
Commands exit with failure and print error when API returns no data.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Caddyfile: disable auto_https and admin, listen on :80 only
- docker-compose: bind port only on 127.0.0.1 to avoid public exposure
- bootstrap/app.php: trust all proxies so Laravel generates correct URLs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Caddy still listens on :80 inside the container, but only port 5000 is
exposed to the host. Removes 443/HTTPS ports and Caddy cert volumes —
TLS is handled by the upstream reverse proxy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Busybox ash does not support brace expansion, so
storage/framework/{sessions,views,cache} was created as a literal
directory name instead of three separate ones. Split into explicit paths.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Composer's post-autoload-dump hook runs php artisan package:discover,
which requires bootstrap/cache and storage/framework subdirs to exist.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
