shopify-enterprise-rbac

The code is ordinary role-based authorization logic and contains no evidence of malware or intentional supply-chain abuse. It has a meaningful access-control flaw: users who do not possess read_products, including users with no matching role, are assigned viewer and may receive viewer permissions. The fallback should deny access or return an explicit unauthenticated/unmapped role, and role precedence and GraphQL pagination should be validated.

No evidence of malicious behavior or intentional obfuscation is present. The offline-token branch is a significant authorization weakness because it unconditionally grants an admin role and bypasses per-user checks. Location authorization is structurally deny-by-default, but its security depends on callers supplying authenticated and correctly scoped user and location identifiers. The fragment should be reviewed before production use, especially the offline-session handling and identity binding.