From 781c6dff8200b113adafad0580e22eeed46204d2 Mon Sep 17 00:00:00 2001
From: Melissa Luu <melissa.luu@shopify.com>
Date: Wed, 15 Apr 2026 10:54:10 -0400
Subject: [PATCH 1/2] Default allowed_domains to empty array when not
 configured in toml

---
 .../app/src/cli/services/dev/extension/payload/store.test.ts    | 2 +-
 packages/app/src/cli/services/dev/extension/payload/store.ts    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/app/src/cli/services/dev/extension/payload/store.test.ts b/packages/app/src/cli/services/dev/extension/payload/store.test.ts
index 44e83ec1a69..d7e9b989782 100644
--- a/packages/app/src/cli/services/dev/extension/payload/store.test.ts
+++ b/packages/app/src/cli/services/dev/extension/payload/store.test.ts
@@ -522,7 +522,7 @@ describe('ExtensionsPayloadStore()', () => {
       store.updateAdminConfigFromExtensionEvents([{extension: adminExt} as unknown as ExtensionEvent])
 
       // Then
-      expect(store.getRawPayload().app.allowedDomains).toBeUndefined()
+      expect(store.getRawPayload().app.allowedDomains).toStrictEqual([])
     })
 
     test('does nothing when no admin extension event is present', () => {
diff --git a/packages/app/src/cli/services/dev/extension/payload/store.ts b/packages/app/src/cli/services/dev/extension/payload/store.ts
index b009792fc9d..414b5cd8d80 100644
--- a/packages/app/src/cli/services/dev/extension/payload/store.ts
+++ b/packages/app/src/cli/services/dev/extension/payload/store.ts
@@ -24,7 +24,7 @@ function getAdminConfig(extensions: ExtensionInstance[]): AdminConfig | undefine
   if (!adminExtension) return undefined
   const admin = (adminExtension.configuration as AdminConfigType).admin
   return {
-    allowedDomains: admin?.allowed_domains,
+    allowedDomains: admin?.allowed_domains ?? [],
     staticRoot: admin?.static_root,
   }
 }

From 9f57ed80cf96b2fc1d45f5d4820bbc254ea46ecc Mon Sep 17 00:00:00 2001
From: Melissa Luu <melissa.luu@shopify.com>
Date: Wed, 15 Apr 2026 11:06:36 -0400
Subject: [PATCH 2/2] Address review: make AdminConfig.allowedDomains
 non-optional, add test for initial payload

---
 .../dev/extension/payload/store.test.ts       | 22 +++++++++++++++++++
 .../services/dev/extension/payload/store.ts   |  2 +-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/packages/app/src/cli/services/dev/extension/payload/store.test.ts b/packages/app/src/cli/services/dev/extension/payload/store.test.ts
index d7e9b989782..72f4fca9aec 100644
--- a/packages/app/src/cli/services/dev/extension/payload/store.test.ts
+++ b/packages/app/src/cli/services/dev/extension/payload/store.test.ts
@@ -142,6 +142,28 @@ describe('getExtensionsPayloadStoreRawPayload()', () => {
     expect(rawPayload.app.allowedDomains).toStrictEqual(['https://cdn.example.com'])
     expect(rawPayload.app.assets).toBeUndefined()
   })
+
+  test('defaults allowed_domains to empty array when admin has no allowed_domains configured', async () => {
+    // Given
+    vi.spyOn(payload, 'getUIExtensionPayload').mockResolvedValue({mock: 'ext'} as unknown as UIExtensionPayload)
+    const adminExt = createAdminExtension({})
+
+    const options = {
+      apiKey: 'api-key',
+      appName: 'my-app',
+      url: 'https://tunnel.example.com',
+      websocketURL: 'wss://tunnel.example.com',
+      extensions: [adminExt],
+      storeFqdn: 'store.myshopify.com',
+      manifestVersion: '3',
+    } as unknown as ExtensionsPayloadStoreOptions
+
+    // When
+    const rawPayload = await getExtensionsPayloadStoreRawPayload(options, 'bundle-path')
+
+    // Then
+    expect(rawPayload.app.allowedDomains).toStrictEqual([])
+  })
 })
 
 describe('ExtensionsPayloadStore()', () => {
diff --git a/packages/app/src/cli/services/dev/extension/payload/store.ts b/packages/app/src/cli/services/dev/extension/payload/store.ts
index 414b5cd8d80..b8ef1f6242b 100644
--- a/packages/app/src/cli/services/dev/extension/payload/store.ts
+++ b/packages/app/src/cli/services/dev/extension/payload/store.ts
@@ -15,7 +15,7 @@ export interface ExtensionsPayloadStoreOptions extends ExtensionDevOptions {
 }
 
 interface AdminConfig {
-  allowedDomains?: string[]
+  allowedDomains: string[]
   staticRoot?: string
 }