FlexiBar — BFS Badge Re-Submission Audit

Date: 2026-05-16
Auditor: Antigravity (Claude Opus 4.6)
App: FlexiBar (Announcement Bar)
Stack: Remix v2 + React + Polaris v12 + Theme App Extension
Score: 74/100

BFS Readiness Scorecard

Area	Score	Blocking Issues
App Store Review (Task 1)	14/20	REST API usage (2.2.4), storefront LCP blocking, `shop/redact` incomplete
Polaris / UI (Task 2)	21/25	Custom table instead of IndexTable, hardcoded badge colors
Liquid / Theme (Task 3)	12/20	No presets, no LiquidDoc, deprecated `script_tag` filter, sync font loading
GraphQL API (Task 4)	12/15	REST API calls must be migrated
App Listing (Task 5)	5/10	Most items need Partner Dashboard verification
Onboarding (Task 6)	10/10	Excellent — 3-step walkthrough with deep links
TOTAL	74/100

TASK 1 — App Store Review Audit

1A — Core BFS Requirements

#	Requirement	Status	Notes
1.1.1	Session token auth	✅ PASS	Uses `@shopify/shopify-app-remix` with `unstable_newEmbeddedAuthStrategy: true`, `removeRest: true`.
1.1.2	Use Shopify checkout	✅ PASS	N/A — app does not handle checkout.
1.1.4	Factual information only	✅ PASS	No fake reviews/notifications.
2.2.1	Uses Shopify APIs	✅ PASS	GraphQL Admin API for metafields, themes, shop info, subscriptions.
2.2.3	Latest App Bridge	✅ PASS	`@shopify/app-bridge-react@^4.1.6`.
2.2.4	GraphQL Admin API	❌ FAIL	REST calls at `shopify.server.js:32` and `shop.server.js:188` fetch `/admin/api/2025-07/shop.json`.
2.3.1–2.3.4	Install/Auth flow	✅ PASS	Proper OAuth, redirect to app home, reinstall handled.
1.2.1–1.2.3	Billing	✅ PASS	Heymantle + Shopify Billing, plan changes via Shopify charges page.
3.1.1	TLS/SSL	⚠️ REVIEW	Production URL uses HTTPS. Verify cert validity.

1B — Announcement Bar Specific

Check	Status	Notes
Uses Theme App Extension	✅ PASS	`type = "theme_app_extension"`. No ScriptTag API.
5.1.1 Theme app extensions only	⚠️ REVIEW	`script_tag` Liquid filter used (line 79) — generates sync `<script>`.
5.1.3 Onboarding for TAE	✅ PASS	Deep link + Walkthrough + FlexibarEmbedStatus.
CLS < 0.1	⚠️ REVIEW	JS adjusts body padding post-render. `display=swap` fonts cause FOUT.
Does not block LCP	❌ FAIL	Google Fonts `<link>` is render-blocking (6 families). `script_tag` loads JS sync.
JS loaded async/deferred	❌ FAIL	Inline `<script>` blocks are synchronous. External trackers use `async`.
Works with OS 2.0 themes	✅ PASS	Uses app embed block targeting `body`.

GDPR Webhooks

Webhook	Status	Notes
`customers/redact`	✅ PASS	Handler exists, returns 200.
`customers/data_request`	✅ PASS	Handler exists, returns 200.
`shop/redact`	⚠️ REVIEW	Returns 200 but does not delete data.
`app/uninstalled`	✅ PASS	Full cleanup + session delete + email.

TASK 2 — Polaris & Admin UI Compliance

Check	Status	Notes
Button variants	✅ PASS	Standard Polaris variants.
Typography	✅ PASS	Polaris `Text` component.
Background	✅ PASS	Polaris tokens used.
Spacing	⚠️ REVIEW	Mix of Polaris tokens and inline px in DraggableBarRow.
Icons	✅ PASS	Consistent Polaris icons.
Color roles	✅ PASS	`tone="critical"` for destructive only.
Text contrast	⚠️ REVIEW	Custom badge in FlexibarEmbedStatus uses hardcoded colors.
NavMenu	✅ PASS	App Bridge NavMenu.
Index page pattern	⚠️ REVIEW	Custom div table instead of Polaris IndexTable for drag-sort.
Empty state	✅ PASS	EmptyBarState with CTA.
Setup flow	✅ PASS	3-step Walkthrough.

TASK 3 — Liquid & Theme Extension Validation

Check	Status	Notes
`shopify.extension.toml` valid	✅ PASS	Correct type, name, handle, target.
Schema settings	⚠️ REVIEW	Empty settings array — reads from metafield instead.
Deprecated `script_tag` filter	❌ FAIL	Line 79: must use `<script src="..." defer>`.
Presets defined	❌ FAIL	No presets — merchants can't add from theme editor.
LiquidDoc headers	❌ FAIL	No `{% doc %}` tag.
Font loading	❌ FAIL	6 Google Font families loaded synchronously.
OS 2.0 compatible	✅ PASS	App embed block targeting body.

TASK 4 — Admin GraphQL API Compliance

Check	Status	Notes
Latest API version	✅ PASS	`ApiVersion.July25`, webhook `2025-07`.
No deprecated fields	✅ PASS	Current GraphQL fields.
Error handling	✅ PASS	`userErrors` checked in mutations.
Webhooks via TOML	✅ PASS	All declared in TOML.
GDPR format	✅ PASS	`compliance_topics` in production TOML.
REST API usage	❌ FAIL	Two REST calls must migrate to GraphQL.

TASK 5 — App Listing Review

Most items require Partner Dashboard verification. Codebase confirms: free plan exists, Chatwoot support integrated, billing via Shopify, support email support@shopiment.io.

TASK 6 — Install & Onboarding Flow

All items ✅ PASS. Excellent 3-step walkthrough with deep links, progress indicators, embed status detection, and success confirmation.

Prioritized Fix List

🔴 P0 — BFS Blockers

P0-1: Migrate REST /admin/api/2025-07/shop.json to GraphQL in shopify.server.js:32 and shop.server.js:188
P0-2: Fix storefront font loading — load only selected font with display=optional, non-blocking
P0-3: Replace {{ 'countdown-templates.js' | asset_url | script_tag }} with <script src="..." defer>
P0-4: Add "presets": [{ "name": "Flexibar" }] to Liquid schema block
P0-5: Implement actual data deletion in webhooks.shop.redact.jsx

🟡 P1 — High Risk

P1-1: Add {% doc %} tag to Liquid block
P1-2: Replace custom embed status badge with Polaris Badge
P1-3: Improve custom table to align with Polaris patterns
P1-4: Fix console.log prefix consistency in webhook handlers
P1-5: CLS mitigation — CSS-only initial height reservation

🟢 P2 — Polish

Extract inline Liquid JS into separate asset file with defer
Reduce z-index: 999999 to 9999
Conditional preconnect for Google Fonts
Review read_products scope necessity
Add error handling for getShopGid in metafield service

Resubmission Plan

Estimated fix time: 4-6 days
Recommended resubmit date: 2026-05-23
Skills that flagged issues: shopify-app-store-review, shopify-liquid, shopify-admin, shopify-polaris-admin-extensions

abidkhan484/opus-analysis.md

Select an option

No results found