God Matters Commerce Manager — Manual Authenticated QA

Use this checklist only on a Shopify development/client-transfer test store or another store explicitly designated for QA. Do not use a real customer store for destructive tests.

A. Shopify install and permissions

  • Install/open Commerce Manager from Shopify Admin.
  • Confirm App Bridge loads inside Admin.
  • Confirm current requested scopes are displayed correctly.
  • Reauthorize when new scopes are requested.
  • Confirm refusing authorization leaves the store unchanged.
  • Confirm uninstall removes future app access.

B. Merchant isolation

  • Test with two separate Shopify development stores.
  • Store A cannot read Store B package, supplier status, jobs, products, billing, or credentials.
  • Store B cannot read Store A state.
  • Queue processing for one store never processes another store's interactive job.

C. Store packages

  • Launch = up to 20 products / $79 total.
  • Grow = up to 50 products / $149 total.
  • Business = up to 100 products / $249 total.
  • Scale = up to 200 products / $399 total.
  • Plus Growth = $999 service / up to 200 products; Shopify Plus fees separate.
  • Changing package updates the correct merchant only.

D. Core store provisioning

  • Prepare My Store creates/reuses Featured, New Arrivals, Best Sellers.
  • About Us, FAQ, Shipping & Returns are created/reused.
  • Main/footer navigation updates without duplicates.
  • Re-running core setup is idempotent.
  • Existing merchant content is not silently deleted.

E. Supplier connection

  • Connect a QA CJdropshipping account using the secure embedded form.
  • API key field clears after submission.
  • Raw API key is not returned in UI/API/log output.
  • Supplier token is isolated to the current Shopify store.
  • Disconnect/error state is clear and recoverable.
  • U.S.-warehouse/source filters behave as expected for the intended U.S. catalog path.

F. Product import and automatic build

Start with 1–3 QA products, never 200 at once.

  • Product title/description/images match supplier data.
  • Variants and inventory map correctly.
  • Calculated selling price matches configured target margin logic.
  • Online Store publication occurs only after required permissions.
  • New Arrivals assignment works.
  • Featured assignment behaves as intended.
  • Re-import does not create duplicate gm-cj-* products.
  • Package product-count limit is enforced.
  • Out-of-stock/unavailable supplier products are skipped safely.
  • Failed supplier API call leaves a recoverable job state.

G. Queue and worker

  • Starting automatic build creates one persistent job for the merchant.
  • Job status survives refresh/reopen.
  • Worker advances the oldest eligible queued work.
  • Interactive process-next is restricted to the authenticated shop.
  • Retry/idle/error state is visible and does not loop endlessly.
  • Completed jobs stop creating products.

H. $19 reservation funnel

Use Stripe test/sandbox capability if available; do not generate fake live customer charges.

  • Checkout clearly states the $19 is a credit, not the full store price.
  • Successful payment is recorded once.
  • Duplicate webhook delivery is idempotent.
  • Post-payment /start flow recognizes the reservation.
  • Package selection and Shopify-store status save correctly.
  • First qualifying $19 gross sale claims the one-time Shopify-registration funding trigger only once.
  • Later $19 reservations do not re-trigger the first-sale event.
  • Invalid Stripe signatures are rejected.

I. Shopify billing / AI plan

On a Shopify development store with test billing only.

  • Starter $4.99, Growth $9.99, Pro $19.99 display correctly.
  • 14-day trial wording is accurate.
  • Billing approval is performed by Shopify, not silently by the app.
  • Cancelled/declined approval does not unlock paid access.
  • Approved test subscription reflects in billing status.

J. Security and resilience

  • Anonymous merchant endpoints return 4xx.
  • Invalid Shopify HMAC is rejected.
  • Invalid Stripe signature is rejected.
  • Secrets/tokens never appear in health/public capability responses.
  • Oversized/invalid JSON requests are rejected.
  • Refresh, back button, double click, and duplicate submissions do not duplicate paid/build actions.
  • Mobile Shopify Admin view remains usable.

Release rule

Do not call a release fully verified until automated QA is green and all applicable authenticated/manual checks above are PASS or explicitly BLOCKED by a third-party protected step.