hecks 5.0.0 → 7.0.0

data/rust/host/src/web/commerce.rs

@@ -4,7 +4,7 @@
 
 use super::{
     checkout_enabled, newsletter, newsletter_send, payments_routes, registrations_list_route,
-    resend_webhook, respond, session_secret,
+    resend_webhook, respond, session_secret, CheckoutRequest,
 };
 use crate::extension::{Ctx, HostExtension, RateRule};
 use crate::payments;
@@ -21,7 +21,7 @@ fn checkout_domain() -> Option<String> {
 #[async_trait]
 impl HostExtension for Commerce {
     // Registration/checkout/newsletter routes are opt-in: they only exist when HECKS_CHECKOUT_DOMAIN
-    // names this domain, since Event/Registration and the Payments::Payment chapter are declared
+    // names this domain, since Event/Registration and the Payments::Payment bluebook are declared
     // against it specifically. The capability shapes are pinned by
     // spec/fixtures/rust_host/checkout_fixture, which this module's tests run against.
     async fn guest_route(&self, ctx: &Ctx<'_>) -> Option<Value> {
@@ -46,13 +46,9 @@ impl HostExtension for Commerce {
                     "HECKS_IR_PATH not set or unreadable — this domain has no web layer configured",
                 ));
             };
-            if let Err(response) = newsletter_send::require_admin(
-                domain_ir,
-                ctx.cookies,
-                &session_secret(),
-                ctx.client,
-            )
-            .await
+            if let Err(response) =
+                newsletter_send::require_admin(domain_ir, ctx.cookies, &session_secret(), ctx.store)
+                    .await
             {
                 return Some(response);
             }
@@ -81,15 +77,11 @@ impl HostExtension for Commerce {
             .and_then(|h| h.get("stripe-signature"))
             .and_then(|v| v.as_str())
             .unwrap_or("");
-        payments_routes(
-            ir,
-            ctx.method,
-            ctx.path,
-            ctx.raw_body,
+        let request = CheckoutRequest {
             stripe_signature,
-            ctx.host(),
-        )
-        .await
+            cookies: ctx.cookies,
+        };
+        payments_routes(ir, ctx.method, ctx.path, ctx.raw_body, &request, ctx.host()).await
     }
 
     async fn account_route(&self, ctx: &Ctx<'_>) -> Option<Value> {
@@ -115,7 +107,7 @@ impl HostExtension for Commerce {
                     domain_ir,
                     ctx.cookies,
                     &secret,
-                    ctx.client,
+                    ctx.store,
                     ctx.wasm_path,
                     ctx.config,
                 )

data/rust/host/src/web/newsletter/cooldown.rs

@@ -1,56 +1,104 @@
-use std::collections::HashMap;
+use std::collections::{HashMap, VecDeque};
 use std::sync::Mutex;
 use std::time::{Duration, Instant};
 
 /// How long an address is left alone after a confirmation email went to it.
 pub(super) const WINDOW: Duration = Duration::from_mins(10);
 
-/// The most addresses remembered; past it a new address is refused, not evicting a live one.
+/// The most addresses remembered; past it the oldest is forgotten to make room.
 pub(super) const CAPACITY: usize = 10_000;
 
-/// A per-address cooldown on confirmation emails, so the form cannot mail-bomb someone.
+/// The most confirmation emails sent to anyone in one window, so a flood of distinct addresses
+/// cannot turn the form into a mailer.
+pub(super) const GLOBAL_LIMIT: usize = 500;
+
+/// A per-address cooldown on confirmation emails, so the form cannot mail-bomb someone, under a
+/// cap on how many go out in all.
+///
+/// An address is keyed by the mailbox it reaches (`mailbox_key`), so spelling variants that land in
+/// one inbox share one cooldown.
 ///
 /// In-process: not shared between tasks and lost on restart, so each task has its own window.
 pub(super) struct ConfirmationCooldown {
     window: Duration,
     capacity: usize,
-    last_sent: Mutex<HashMap<String, Instant>>,
+    global_limit: usize,
+    state: Mutex<Sent>,
+}
+
+#[derive(Default)]
+struct Sent {
+    by_mailbox: HashMap<String, Instant>,
+    all: VecDeque<Instant>,
 }
 
 impl ConfirmationCooldown {
-    pub(super) fn new(window: Duration, capacity: usize) -> Self {
+    pub(super) fn new(window: Duration, capacity: usize, global_limit: usize) -> Self {
         Self {
             window,
             capacity,
-            last_sent: Mutex::new(HashMap::new()),
+            global_limit,
+            state: Mutex::new(Sent::default()),
         }
     }
 
-    /// Whether an email may go to `email` now (keyed by lowercased address). A `true` records the
-    /// send, so the caller must then send.
+    /// Whether an email may go to `email` now. A `true` records the send, so the caller must then
+    /// send.
     pub(super) fn try_acquire(&self, email: &str) -> bool {
         self.try_acquire_at(email, Instant::now())
     }
 
     /// `try_acquire` with the clock supplied, so tests need not sleep.
     pub(super) fn try_acquire_at(&self, email: &str, now: Instant) -> bool {
-        let key = email.to_lowercase();
-        let mut last_sent = self
-            .last_sent
+        let key = mailbox_key(email);
+        let mut sent = self
+            .state
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner);
         let window = self.window;
-        last_sent.retain(|_, sent| now.saturating_duration_since(*sent) < window);
-        if last_sent.contains_key(&key) || last_sent.len() >= self.capacity {
+        let live = |at: &Instant| now.saturating_duration_since(*at) < window;
+        sent.by_mailbox.retain(|_, at| live(at));
+        while sent.all.front().is_some_and(|at| !live(at)) {
+            sent.all.pop_front();
+        }
+        if sent.by_mailbox.contains_key(&key) || sent.all.len() >= self.global_limit {
             return false;
         }
-        last_sent.insert(key, now);
+        if sent.by_mailbox.len() >= self.capacity {
+            forget_oldest(&mut sent.by_mailbox);
+        }
+        sent.by_mailbox.insert(key, now);
+        sent.all.push_back(now);
         true
     }
 
     #[cfg(test)]
     fn remembered(&self) -> usize {
-        self.last_sent.lock().unwrap().len()
+        self.state.lock().unwrap().by_mailbox.len()
+    }
+}
+
+fn forget_oldest(by_mailbox: &mut HashMap<String, Instant>) {
+    let oldest = by_mailbox
+        .iter()
+        .min_by_key(|(_, at)| **at)
+        .map(|(key, _)| key.clone());
+    if let Some(oldest) = oldest {
+        by_mailbox.remove(&oldest);
+    }
+}
+
+/// The mailbox `email` reaches: lowercased, without a `+tag`, and for Gmail without the dots it
+/// ignores and with `googlemail.com` read as `gmail.com`.
+pub(super) fn mailbox_key(email: &str) -> String {
+    let email = email.trim().to_lowercase();
+    let Some((local, domain)) = email.rsplit_once('@') else {
+        return email;
+    };
+    let local = local.split('+').next().unwrap_or(local);
+    match domain {
+        "gmail.com" | "googlemail.com" => format!("{}@gmail.com", local.replace('.', "")),
+        _ => format!("{local}@{domain}"),
     }
 }
 
@@ -59,7 +107,7 @@ mod tests {
     use super::*;
 
     fn cooldown() -> ConfirmationCooldown {
-        ConfirmationCooldown::new(Duration::from_secs(600), 3)
+        ConfirmationCooldown::new(Duration::from_secs(600), 3, 100)
     }
 
     #[test]
@@ -87,7 +135,7 @@ mod tests {
     }
 
     #[test]
-    fn the_key_is_the_lowercased_address() {
+    fn the_key_is_the_mailbox_the_address_reaches() {
         let (cooldown, start) = (cooldown(), Instant::now());
         assert!(cooldown.try_acquire_at("Ann@Example.com", start));
         assert!(!cooldown.try_acquire_at("ann@example.COM", start));
@@ -111,14 +159,18 @@ mod tests {
     }
 
     #[test]
-    fn at_capacity_a_new_address_is_refused_and_no_live_entry_is_evicted() {
+    fn at_capacity_a_new_address_forgets_the_oldest_rather_than_being_refused() {
         let (cooldown, start) = (cooldown(), Instant::now());
-        for address in ["a@example.com", "b@example.com", "c@example.com"] {
-            assert!(cooldown.try_acquire_at(address, start));
+        for (i, address) in ["a@example.com", "b@example.com", "c@example.com"]
+            .iter()
+            .enumerate()
+        {
+            assert!(cooldown.try_acquire_at(address, start + Duration::from_secs(i as u64)));
         }
-        assert!(!cooldown.try_acquire_at("d@example.com", start + Duration::from_secs(1)));
+        assert!(cooldown.try_acquire_at("d@example.com", start + Duration::from_secs(5)));
         assert_eq!(cooldown.remembered(), 3);
-        assert!(!cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(1)));
+        assert!(cooldown.try_acquire_at("a@example.com", start + Duration::from_secs(6)));
+        assert!(!cooldown.try_acquire_at("d@example.com", start + Duration::from_secs(7)));
     }
 
     #[test]
@@ -130,4 +182,37 @@ mod tests {
         assert!(cooldown.try_acquire_at("d@example.com", start + Duration::from_secs(600)));
         assert_eq!(cooldown.remembered(), 1);
     }
+
+    #[test]
+    fn spelling_variants_of_one_gmail_inbox_share_one_cooldown() {
+        let (cooldown, start) = (cooldown(), Instant::now());
+        assert!(cooldown.try_acquire_at("victim@gmail.com", start));
+        for variant in [
+            "v.i.c.t.i.m@gmail.com",
+            "victim+1@gmail.com",
+            "Vic.Tim+x@GoogleMail.com",
+        ] {
+            assert!(!cooldown.try_acquire_at(variant, start), "{variant}");
+        }
+    }
+
+    #[test]
+    fn a_plus_tag_is_the_same_mailbox_anywhere_but_dots_only_fold_at_gmail() {
+        assert_eq!(mailbox_key(" Ann+news@Example.com "), "ann@example.com");
+        assert_eq!(mailbox_key("a.nn@example.com"), "a.nn@example.com");
+        assert_eq!(mailbox_key("a.nn+x@googlemail.com"), "ann@gmail.com");
+        assert_eq!(mailbox_key("no-at-sign"), "no-at-sign");
+    }
+
+    #[test]
+    fn past_the_global_limit_no_address_is_mailed_until_the_window_moves_on() {
+        let (cooldown, start) = (
+            ConfirmationCooldown::new(Duration::from_secs(600), 100, 2),
+            Instant::now(),
+        );
+        assert!(cooldown.try_acquire_at("a@example.com", start));
+        assert!(cooldown.try_acquire_at("b@example.com", start + Duration::from_secs(1)));
+        assert!(!cooldown.try_acquire_at("c@example.com", start + Duration::from_secs(2)));
+        assert!(cooldown.try_acquire_at("c@example.com", start + Duration::from_secs(600)));
+    }
 }

data/rust/host/src/web/newsletter/naming.rs

@@ -0,0 +1,104 @@
+use std::collections::HashMap;
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+
+/// How long after subscribing the signup form's second step may still name the subscriber.
+pub(super) const WINDOW: Duration = Duration::from_mins(30);
+
+/// The most fresh subscriptions remembered; past it the oldest is forgotten to make room.
+pub(super) const CAPACITY: usize = 10_000;
+
+/// The subscriptions this process recorded in the last `WINDOW`, which alone may be named without
+/// the confirm token: anyone can type an address, so naming one that was already on the list would
+/// let a stranger rename its subscriber.
+///
+/// In-process: a second step that reaches another task, or arrives after a restart, needs the token.
+pub(super) struct NamingWindow {
+    window: Duration,
+    capacity: usize,
+    subscribed: Mutex<HashMap<String, Instant>>,
+}
+
+impl NamingWindow {
+    pub(super) fn new(window: Duration, capacity: usize) -> Self {
+        Self {
+            window,
+            capacity,
+            subscribed: Mutex::new(HashMap::new()),
+        }
+    }
+
+    /// Records that `email` subscribed just now.
+    pub(super) fn opened(&self, email: &str) {
+        self.opened_at(email, Instant::now());
+    }
+
+    /// Whether `email` subscribed within the window.
+    pub(super) fn is_open(&self, email: &str) -> bool {
+        self.is_open_at(email, Instant::now())
+    }
+
+    fn opened_at(&self, email: &str, now: Instant) {
+        let mut subscribed = self.lock();
+        let window = self.window;
+        subscribed.retain(|_, at| now.saturating_duration_since(*at) < window);
+        if subscribed.len() >= self.capacity {
+            let oldest = subscribed
+                .iter()
+                .min_by_key(|(_, at)| **at)
+                .map(|(key, _)| key.clone());
+            if let Some(oldest) = oldest {
+                subscribed.remove(&oldest);
+            }
+        }
+        subscribed.insert(email.to_string(), now);
+    }
+
+    fn is_open_at(&self, email: &str, now: Instant) -> bool {
+        self.lock()
+            .get(email)
+            .is_some_and(|at| now.saturating_duration_since(*at) < self.window)
+    }
+
+    fn lock(&self) -> std::sync::MutexGuard<'_, HashMap<String, Instant>> {
+        self.subscribed
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn naming() -> NamingWindow {
+        NamingWindow::new(Duration::from_mins(30), 2)
+    }
+
+    #[test]
+    fn an_address_may_be_named_only_inside_the_window_after_it_subscribed() {
+        let (naming, start) = (naming(), Instant::now());
+        assert!(!naming.is_open_at("a@example.com", start));
+        naming.opened_at("a@example.com", start);
+        assert!(naming.is_open_at("a@example.com", start + Duration::from_secs(1799)));
+        assert!(!naming.is_open_at("a@example.com", start + Duration::from_mins(30)));
+    }
+
+    #[test]
+    fn the_window_is_for_the_exact_address_that_subscribed() {
+        let (naming, start) = (naming(), Instant::now());
+        naming.opened_at("a@example.com", start);
+        assert!(!naming.is_open_at("A@example.com", start));
+        assert!(!naming.is_open_at("b@example.com", start));
+    }
+
+    #[test]
+    fn at_capacity_the_oldest_subscription_is_forgotten() {
+        let (naming, start) = (naming(), Instant::now());
+        naming.opened_at("a@example.com", start);
+        naming.opened_at("b@example.com", start + Duration::from_secs(1));
+        naming.opened_at("c@example.com", start + Duration::from_secs(2));
+        assert!(!naming.is_open_at("a@example.com", start + Duration::from_secs(3)));
+        assert!(naming.is_open_at("c@example.com", start + Duration::from_secs(3)));
+    }
+}

data/rust/host/src/web/newsletter/tests.rs

@@ -234,3 +234,56 @@ fn without_a_template_the_plain_text_confirmation_is_unchanged() {
     let body = confirmation_body(CONFIRM);
     assert_eq!(body, format!("Please confirm your newsletter subscription by opening this link:\n\n{CONFIRM}\n\nIf you didn't ask for this, you can ignore this email and nothing will be sent to you.\n"));
 }
+
+fn fresh_naming() -> naming::NamingWindow {
+    naming::NamingWindow::new(naming::WINDOW, naming::CAPACITY)
+}
+
+#[test]
+fn an_address_already_on_the_list_cannot_be_named_by_a_stranger() {
+    let naming = fresh_naming();
+    assert!(!may_name(
+        &naming,
+        Some("s3cret-value"),
+        "a@example.com",
+        None
+    ));
+    assert!(!may_name(
+        &naming,
+        Some("s3cret-value"),
+        "a@example.com",
+        Some("garbage")
+    ));
+    let other = confirm_token("s3cret-value", "b@example.com");
+    assert!(!may_name(
+        &naming,
+        Some("s3cret-value"),
+        "a@example.com",
+        Some(&other)
+    ));
+}
+
+#[test]
+fn the_forms_second_step_names_the_address_it_just_subscribed() {
+    let naming = fresh_naming();
+    naming.opened("a@example.com");
+    assert!(may_name(&naming, None, "a@example.com", None));
+    assert!(!may_name(&naming, None, "b@example.com", None));
+}
+
+#[test]
+fn the_addresss_own_confirm_token_names_it_at_any_time() {
+    let token = confirm_token("s3cret-value", "a@example.com");
+    assert!(may_name(
+        &fresh_naming(),
+        Some("s3cret-value"),
+        "a@example.com",
+        Some(&token)
+    ));
+    assert!(!may_name(
+        &fresh_naming(),
+        None,
+        "a@example.com",
+        Some(&token)
+    ));
+}

data/rust/host/src/web/newsletter.rs

@@ -6,14 +6,14 @@ use crate::dispatch;
 use crate::host::Host;
 use crate::ir::ir;
 use crate::resend::{Email, Mailer};
+use crate::store::Store;
 use serde_json::{json, Value};
 use std::collections::HashMap;
 use std::path::Path;
 use std::sync::OnceLock;
-use tokio::sync::Mutex;
-use tokio_postgres::Client;
 
 mod cooldown;
+mod naming;
 mod template;
 #[cfg(test)]
 mod tests;
@@ -28,9 +28,9 @@ pub(super) async fn newsletter_route(
     host: Host<'_>,
 ) -> Option<Value> {
     let Host {
-        client, wasm_path, ..
+        store, wasm_path, ..
     } = host;
-    // The chapter that declares `provides "newsletter"` names the verbs
+    // The bluebook that declares `provides "newsletter"` names the verbs
     // and the subscribing aggregate; a domain that attaches none serves
     // none of these routes.
     let provider = ir().and_then(newsletter_provider)?;
@@ -39,7 +39,7 @@ pub(super) async fn newsletter_route(
             Some(newsletter_subscribe_route(&provider, raw_body, host).await)
         }
         ("GET", "/newsletter/subscribers") => {
-            Some(newsletter_subscribers_list_route(&provider, client, wasm_path).await)
+            Some(newsletter_subscribers_list_route(&provider, store, wasm_path).await)
         }
         ("GET", "/newsletter/subscribers/confirm") => {
             Some(newsletter_confirm_route(&provider, query, host).await)
@@ -52,14 +52,15 @@ pub(super) async fn newsletter_route(
 }
 
 // Called twice by the two-step signup form: first without a name (Subscribe),
-// then with one (AddName).
+// then with one (AddName). The reply is the same whether or not the address
+// was already on the list, so the form cannot be used to learn who is.
 async fn newsletter_subscribe_route(
     provider: &NewsletterProvider,
     raw_body: &str,
     host: Host<'_>,
 ) -> Value {
     let Host {
-        client, wasm_path, ..
+        store, wasm_path, ..
     } = host;
     let body: Value = match serde_json::from_str(raw_body) {
         Ok(v) => v,
@@ -87,7 +88,7 @@ async fn newsletter_subscribe_route(
         .and_then(|v| v.as_str())
         .filter(|s| !s.is_empty());
 
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
@@ -96,12 +97,10 @@ async fn newsletter_subscribe_route(
         .any(|(id, _)| id == email);
 
     if existing {
+        let token = body.get("token").and_then(|v| v.as_str());
         if let (Some(first), Some(last)) = (first_name, last_name) {
-            let facts = json!({"first_name": {"value": first}, "last_name": {"value": last}});
-            if let Err(e) =
-                dispatch::handle_routed(host, &provider.add_name, json!(email), facts, None).await
-            {
-                return respond(500, "text/plain", &format!("{e:#}"));
+            if may_name(naming_window(), confirm_secret().as_deref(), email, token) {
+                add_name(provider, email, first, last, host).await;
             }
         }
     } else {
@@ -123,44 +122,67 @@ async fn newsletter_subscribe_route(
                 &last_refusal(&outcome.result).to_string(),
             );
         }
+        naming_window().opened(email);
         send_confirmation(email).await;
     }
 
     // Confirm is not dispatched here: a new subscriber stays `pending`
-    // until they follow the confirm link (the route below). This route only
-    // reports where the subscriber ended up.
-    let read = match dispatch::read(client, wasm_path).await {
-        Ok(r) => r,
-        Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
-    };
-    let subscribers = instances_for(&read, &provider.instance_prefix());
-    let Some((_, subscriber)) = subscribers.iter().find(|(id, _)| id == email) else {
-        return respond(
-            500,
-            "text/plain",
-            "subscriber vanished immediately after being written",
-        );
-    };
-    let status = subscriber
-        .get("status")
-        .and_then(|v| v.as_str())
-        .unwrap_or_else(|| provider.initial_status());
+    // until they follow the confirm link (the route below), and that is
+    // what every reply says.
     respond(
         200,
         "application/json",
-        &json!({"email": email, "status": status}).to_string(),
+        &json!({"email": email, "status": provider.initial_status()}).to_string(),
     )
 }
 
+// Names an address already on the list only in the form's second step, shortly after this process
+// took its Subscribe, or with the address's own confirm token.
+fn may_name(
+    naming: &naming::NamingWindow,
+    secret: Option<&str>,
+    email: &str,
+    token: Option<&str>,
+) -> bool {
+    let signed = match (secret, token) {
+        (Some(secret), Some(token)) => confirm_token_matches(secret, token, email),
+        _ => false,
+    };
+    signed || naming.is_open(email)
+}
+
+// Best-effort, like the confirmation email: a name the subscriber's lifecycle refuses is logged,
+// and the reply stays the one every subscribe request gets.
+async fn add_name(
+    provider: &NewsletterProvider,
+    email: &str,
+    first: &str,
+    last: &str,
+    host: Host<'_>,
+) {
+    let facts = json!({"first_name": {"value": first}, "last_name": {"value": last}});
+    if let Err(e) =
+        dispatch::handle_routed(host, &provider.add_name, json!(email), facts, None).await
+    {
+        eprintln!("newsletter: the subscriber's name was not recorded: {e:#}");
+    }
+}
+
+// Per-process only (not shared across instances); see `NamingWindow`.
+fn naming_window() -> &'static naming::NamingWindow {
+    static NAMING: OnceLock<naming::NamingWindow> = OnceLock::new();
+    NAMING.get_or_init(|| naming::NamingWindow::new(naming::WINDOW, naming::CAPACITY))
+}
+
 // Reads directly off `instances`, not `dispatch::query`: Subscriber lives
-// under the Newsletter chapter, not `config.domain`, so the qualified
+// under the Newsletter bluebook, not `config.domain`, so the qualified
 // question name would not resolve there.
 async fn newsletter_subscribers_list_route(
     provider: &NewsletterProvider,
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
 ) -> Value {
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
@@ -230,8 +252,13 @@ fn confirm_url(site_url: &str, email: &str, token: &str) -> String {
 // Per-process only (not shared across instances); see `ConfirmationCooldown`.
 fn confirmation_cooldown() -> &'static cooldown::ConfirmationCooldown {
     static COOLDOWN: OnceLock<cooldown::ConfirmationCooldown> = OnceLock::new();
-    COOLDOWN
-        .get_or_init(|| cooldown::ConfirmationCooldown::new(cooldown::WINDOW, cooldown::CAPACITY))
+    COOLDOWN.get_or_init(|| {
+        cooldown::ConfirmationCooldown::new(
+            cooldown::WINDOW,
+            cooldown::CAPACITY,
+            cooldown::GLOBAL_LIMIT,
+        )
+    })
 }
 
 fn confirmation_body(confirm_url: &str) -> String {
@@ -260,7 +287,7 @@ pub(super) async fn send_confirmation(email: &str) {
         }
     };
     if !confirmation_cooldown().try_acquire(email) {
-        eprintln!("newsletter: a confirmation was already emailed to this address in the last 10 minutes, so none was sent; the subscriber stays pending");
+        eprintln!("newsletter: no confirmation was sent, since this mailbox had one in the last 10 minutes or the cap on confirmations per 10 minutes is reached; the subscriber stays pending");
         return;
     }
     let site = site_url();
@@ -287,15 +314,11 @@ pub(super) async fn send_confirmation(email: &str) {
 
 // Only mails when the address is now `pending`; an already-confirmed or
 // unsubscribed registrant is left alone.
-pub(super) async fn send_confirmation_if_pending(
-    email: &str,
-    client: &Mutex<Client>,
-    wasm_path: &Path,
-) {
+pub(super) async fn send_confirmation_if_pending(email: &str, store: &Store, wasm_path: &Path) {
     let Some(provider) = ir().and_then(newsletter_provider) else {
         return;
     };
-    let Ok(read) = dispatch::read(client, wasm_path).await else {
+    let Ok(read) = dispatch::read(store, wasm_path).await else {
         return;
     };
     let pending = instances_for(&read, &provider.instance_prefix())
@@ -320,7 +343,7 @@ async fn newsletter_confirm_route(
     host: Host<'_>,
 ) -> Value {
     let Host {
-        client, wasm_path, ..
+        store, wasm_path, ..
     } = host;
     let Some(email) = query.get("email") else {
         return respond(
@@ -341,7 +364,7 @@ async fn newsletter_confirm_route(
         );
     }
 
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
@@ -362,7 +385,7 @@ async fn newsletter_confirm_route(
         }
     }
 
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
@@ -417,14 +440,14 @@ async fn newsletter_unsubscribe_route(
     host: Host<'_>,
 ) -> Value {
     let Host {
-        client, wasm_path, ..
+        store, wasm_path, ..
     } = host;
     let email = match unsubscribe_authorized(confirm_secret().as_deref(), query) {
         Ok(email) => email,
         Err(refusal) => return refusal,
     };
 
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
@@ -446,7 +469,7 @@ async fn newsletter_unsubscribe_route(
         }
     }
 
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };