@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/server/membership-login.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/** Site member sign-in (AGL-109); sets the session cookie on success. */
+export declare const membershipLoginHandler: PluginApiHandler;

package/src/lib/server/membership-login.js

@@ -0,0 +1,137 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { emitHostEvent } from "@aglyn/tenant-runtime";
+import { readCartId } from "./cart-cookie.js";
+import { MEMBER_SUSPENDED_ERROR, mintMemberSession, setMemberCookie, verifyMemberPassword } from "./membership.js";
+import { NO_CLIENT_ADDRESS_BUCKET, readClientIp } from "@aglyn/aglyn/app-utils/request-ip";
+// Best-effort per-instance brute-force damper (mirrors AGL-87 unlock).
+const attemptsByIp = new Map();
+const WINDOW_MS = 60000;
+const MAX_ATTEMPTS = 10;
+/** Site member sign-in (AGL-109); sets the session cookie on success. */ export const membershipLoginHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2, _readClientIp, _attemptsByIp_get;
+    var _req_body, _req_body1, _req_body2, _req_socket;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const email = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.email) != null ? _ref1 : '').trim().toLowerCase();
+    const password = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.password) != null ? _ref2 : '');
+    if (!hostId || !email || !password) {
+        return res.status(400).json({
+            error: 'Invalid request'
+        });
+    }
+    // Keeps counting under the no-address bucket rather than being skipped: this
+    // damper guards a PASSWORD, and one that stops counting is a password anyone
+    // can grind. On a deployment that cannot name its callers the whole site
+    // shares one attempt budget, which is the direction to be wrong in here.
+    const ip = (_readClientIp = readClientIp(req.headers, {
+        remoteAddress: (_req_socket = req.socket) == null ? void 0 : _req_socket.remoteAddress
+    })) != null ? _readClientIp : NO_CLIENT_ADDRESS_BUCKET;
+    const now = Date.now();
+    const attempts = ((_attemptsByIp_get = attemptsByIp.get(ip)) != null ? _attemptsByIp_get : []).filter((at)=>now - at < WINDOW_MS);
+    attempts.push(now);
+    attemptsByIp.set(ip, attempts);
+    if (attempts.length > MAX_ATTEMPTS) {
+        return res.status(429).json({
+            error: 'Too many attempts'
+        });
+    }
+    try {
+        const firestore = firebaseAdmin.app().firestore();
+        const membersQuery = await firestore.collection('hosts').doc(hostId).collection('siteMembers').where('email', '==', email).limit(1).get();
+        const memberDoc = membersQuery.docs[0];
+        if (!memberDoc || !verifyMemberPassword(password, memberDoc.get('passwordScrypt'))) {
+            return res.status(401).json({
+                error: 'Wrong email or password'
+            });
+        }
+        // Suspension gate (AGL-546): console-suspended members cannot sign in.
+        // Checked after the password so the message never leaks account
+        // existence to guessers who don't hold the credentials.
+        if (memberDoc.get('suspended') === true) {
+            return res.status(401).json({
+                error: MEMBER_SUSPENDED_ERROR
+            });
+        }
+        // Event trigger (AGL-128/148).
+        await emitHostEvent(hostId, 'memberSignIn', {
+            email
+        });
+        // Cart linkage (AGL-294): stamp the guest cart with the member so
+        // abandoned-cart and analytics can attribute it.
+        //
+        // AGL-1763: `update()`, never `set(..., { merge: true })`. `cartId` is the
+        // `aglyn_cart_{hostId}` cookie verbatim — the one value on this request the
+        // client chooses — and a merge-set against a missing path CREATES the
+        // document. So a member could mint `carts/{anything}` at will, one document
+        // per sign-in, each holding a `customerId` and nothing else: no `lines`, no
+        // `createdAtMs`, no `updatedAtMs`. Inert to read — `cart.ts` treats a
+        // missing `lines` as `[]` — but real storage on the merchant's Firestore
+        // and real weight in the per-host document count, growing without bound and
+        // belonging to no basket anyone ever filled.
+        //
+        // Nor is the cookie confined to one document. `CollectionReference.doc()`
+        // appends a SLASH-SEPARATED path and refuses it only when the component
+        // count comes out odd, so a cookie of `a/b/c` wrote to `carts/a/b/c` — a
+        // document at a nesting of the caller's choosing.
+        //
+        // Refusing loses nothing, which is why this is a plain refusal rather than
+        // AGL-1760's refuse-and-record: a cart that does not exist holds no lines,
+        // so there is no basket to attribute and no work to strand. `cart.ts` is
+        // what creates a cart — on the first POST that puts something in it, with
+        // the whole document written. This only ever stamps one.
+        //
+        // AGL-1769 moved the cookie's name and its validity rule into
+        // `cart-cookie.ts`, so a slash-bearing value never reaches `.doc()` from
+        // here at all. `update()` stays: the rule bounds the value to ONE document
+        // id, and whether THAT document exists is a separate question only the
+        // write can answer.
+        const cartId = readCartId(req.cookies, hostId);
+        if (cartId) {
+            try {
+                await firestore.collection('hosts').doc(hostId).collection('carts').doc(cartId).update({
+                    customerId: memberDoc.id
+                });
+            } catch (error) {
+                // Absent cart, malformed cookie, or a Firestore failure — none of them
+                // may fail a sign-in that has already succeeded, so this stays
+                // swallowed as it was. It is no longer SILENT, though: the old
+                // `.catch(() => undefined)` could not tell a missing cart from an
+                // outage. And the guard is a `try` rather than a `.catch()` because
+                // `.doc()` throws SYNCHRONOUSLY on an odd-component path, outside the
+                // promise the old handler covered — a mangled cookie used to 500 the
+                // member's own sign-in.
+                console.error('Cart linkage failed', hostId, error);
+            }
+        }
+        setMemberCookie(res, hostId, mintMemberSession(hostId, memberDoc.id));
+        return res.status(200).json({
+            ok: true
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Sign-in failed'
+        });
+    }
+};
+
+//# sourceMappingURL=membership-login.js.map

package/src/lib/server/membership-login.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-login.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport { readCartId } from './cart-cookie'\nimport {\n  MEMBER_SUSPENDED_ERROR,\n  mintMemberSession,\n  setMemberCookie,\n  verifyMemberPassword,\n} from './membership'\nimport {\n  NO_CLIENT_ADDRESS_BUCKET,\n  readClientIp,\n} from '@aglyn/aglyn/app-utils/request-ip'\n\n// Best-effort per-instance brute-force damper (mirrors AGL-87 unlock).\nconst attemptsByIp = new Map<string, number[]>()\nconst WINDOW_MS = 60_000\nconst MAX_ATTEMPTS = 10\n\n/** Site member sign-in (AGL-109); sets the session cookie on success. */\nexport const membershipLoginHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  const password = String(req.body?.password ?? '')\n  if (!hostId || !email || !password) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  // Keeps counting under the no-address bucket rather than being skipped: this\n  // damper guards a PASSWORD, and one that stops counting is a password anyone\n  // can grind. On a deployment that cannot name its callers the whole site\n  // shares one attempt budget, which is the direction to be wrong in here.\n  const ip =\n    readClientIp(req.headers, { remoteAddress: req.socket?.remoteAddress }) ??\n    NO_CLIENT_ADDRESS_BUCKET\n  const now = Date.now()\n  const attempts = (attemptsByIp.get(ip) ?? []).filter(\n    (at) => now - at < WINDOW_MS,\n  )\n  attempts.push(now)\n  attemptsByIp.set(ip, attempts)\n  if (attempts.length > MAX_ATTEMPTS) {\n    return res.status(429).json({ error: 'Too many attempts' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const membersQuery = await firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('siteMembers')\n      .where('email', '==', email)\n      .limit(1)\n      .get()\n    const memberDoc = membersQuery.docs[0]\n    if (\n      !memberDoc ||\n      !verifyMemberPassword(password, memberDoc.get('passwordScrypt'))\n    ) {\n      return res.status(401).json({ error: 'Wrong email or password' })\n    }\n    // Suspension gate (AGL-546): console-suspended members cannot sign in.\n    // Checked after the password so the message never leaks account\n    // existence to guessers who don't hold the credentials.\n    if (memberDoc.get('suspended') === true) {\n      return res.status(401).json({ error: MEMBER_SUSPENDED_ERROR })\n    }\n    // Event trigger (AGL-128/148).\n    await emitHostEvent(hostId, 'memberSignIn', { email })\n    // Cart linkage (AGL-294): stamp the guest cart with the member so\n    // abandoned-cart and analytics can attribute it.\n    //\n    // AGL-1763: `update()`, never `set(..., { merge: true })`. `cartId` is the\n    // `aglyn_cart_{hostId}` cookie verbatim — the one value on this request the\n    // client chooses — and a merge-set against a missing path CREATES the\n    // document. So a member could mint `carts/{anything}` at will, one document\n    // per sign-in, each holding a `customerId` and nothing else: no `lines`, no\n    // `createdAtMs`, no `updatedAtMs`. Inert to read — `cart.ts` treats a\n    // missing `lines` as `[]` — but real storage on the merchant's Firestore\n    // and real weight in the per-host document count, growing without bound and\n    // belonging to no basket anyone ever filled.\n    //\n    // Nor is the cookie confined to one document. `CollectionReference.doc()`\n    // appends a SLASH-SEPARATED path and refuses it only when the component\n    // count comes out odd, so a cookie of `a/b/c` wrote to `carts/a/b/c` — a\n    // document at a nesting of the caller's choosing.\n    //\n    // Refusing loses nothing, which is why this is a plain refusal rather than\n    // AGL-1760's refuse-and-record: a cart that does not exist holds no lines,\n    // so there is no basket to attribute and no work to strand. `cart.ts` is\n    // what creates a cart — on the first POST that puts something in it, with\n    // the whole document written. This only ever stamps one.\n    //\n    // AGL-1769 moved the cookie's name and its validity rule into\n    // `cart-cookie.ts`, so a slash-bearing value never reaches `.doc()` from\n    // here at all. `update()` stays: the rule bounds the value to ONE document\n    // id, and whether THAT document exists is a separate question only the\n    // write can answer.\n    const cartId = readCartId(req.cookies, hostId)\n    if (cartId) {\n      try {\n        await firestore\n          .collection('hosts')\n          .doc(hostId)\n          .collection('carts')\n          .doc(cartId)\n          .update({ customerId: memberDoc.id })\n      } catch (error) {\n        // Absent cart, malformed cookie, or a Firestore failure — none of them\n        // may fail a sign-in that has already succeeded, so this stays\n        // swallowed as it was. It is no longer SILENT, though: the old\n        // `.catch(() => undefined)` could not tell a missing cart from an\n        // outage. And the guard is a `try` rather than a `.catch()` because\n        // `.doc()` throws SYNCHRONOUSLY on an odd-component path, outside the\n        // promise the old handler covered — a mangled cookie used to 500 the\n        // member's own sign-in.\n        console.error('Cart linkage failed', hostId, error)\n      }\n    }\n    setMemberCookie(res, hostId, mintMemberSession(hostId, memberDoc.id))\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Sign-in failed' })\n  }\n}\n"],"names":["firebaseAdmin","emitHostEvent","readCartId","MEMBER_SUSPENDED_ERROR","mintMemberSession","setMemberCookie","verifyMemberPassword","NO_CLIENT_ADDRESS_BUCKET","readClientIp","attemptsByIp","Map","WINDOW_MS","MAX_ATTEMPTS","membershipLoginHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","password","ip","headers","remoteAddress","socket","now","Date","attempts","get","filter","at","push","set","length","firestore","app","membersQuery","collection","doc","where","limit","memberDoc","docs","cartId","cookies","update","customerId","id","console","ok"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,aAAa,QAAQ,wBAAuB;AACrD,SAASC,UAAU,QAAQ,mBAAe;AAC1C,SACEC,sBAAsB,EACtBC,iBAAiB,EACjBC,eAAe,EACfC,oBAAoB,QACf,kBAAc;AACrB,SACEC,wBAAwB,EACxBC,YAAY,QACP,oCAAmC;AAE1C,uEAAuE;AACvE,MAAMC,eAAe,IAAIC;AACzB,MAAMC,YAAY;AAClB,MAAMC,eAAe;AAErB,uEAAuE,GACvE,OAAO,MAAMC,yBAA2C,OAAOC,KAAKC;4BAiBhEP,eAGgBC;QAhBIK,WACDA,YAGGA,YASqBA;IAhB7C,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,IAAI,CAACN,UAAU,CAACG,SAAS,CAACG,UAAU;QAClC,OAAOX,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,MAAMQ,MACJnB,gBAAAA,aAAaM,IAAIc,OAAO,EAAE;QAAEC,aAAa,GAAEf,cAAAA,IAAIgB,MAAM,qBAAVhB,YAAYe,aAAa;IAAC,cAArErB,gBACAD;IACF,MAAMwB,MAAMC,KAAKD,GAAG;IACpB,MAAME,WAAW,EAACxB,oBAAAA,aAAayB,GAAG,CAACP,eAAjBlB,oBAAwB,EAAE,EAAE0B,MAAM,CAClD,CAACC,KAAOL,MAAMK,KAAKzB;IAErBsB,SAASI,IAAI,CAACN;IACdtB,aAAa6B,GAAG,CAACX,IAAIM;IACrB,IAAIA,SAASM,MAAM,GAAG3B,cAAc;QAClC,OAAOG,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoB;IAC3D;IACA,IAAI;QACF,MAAMqB,YAAYxC,cAAcyC,GAAG,GAAGD,SAAS;QAC/C,MAAME,eAAe,MAAMF,UACxBG,UAAU,CAAC,SACXC,GAAG,CAACxB,QACJuB,UAAU,CAAC,eACXE,KAAK,CAAC,SAAS,MAAMtB,OACrBuB,KAAK,CAAC,GACNZ,GAAG;QACN,MAAMa,YAAYL,aAAaM,IAAI,CAAC,EAAE;QACtC,IACE,CAACD,aACD,CAACzC,qBAAqBoB,UAAUqB,UAAUb,GAAG,CAAC,oBAC9C;YACA,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA0B;QACjE;QACA,uEAAuE;QACvE,gEAAgE;QAChE,wDAAwD;QACxD,IAAI4B,UAAUb,GAAG,CAAC,iBAAiB,MAAM;YACvC,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOhB;YAAuB;QAC9D;QACA,+BAA+B;QAC/B,MAAMF,cAAcmB,QAAQ,gBAAgB;YAAEG;QAAM;QACpD,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,6CAA6C;QAC7C,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,kDAAkD;QAClD,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,yDAAyD;QACzD,EAAE;QACF,8DAA8D;QAC9D,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,oBAAoB;QACpB,MAAM0B,SAAS/C,WAAWY,IAAIoC,OAAO,EAAE9B;QACvC,IAAI6B,QAAQ;YACV,IAAI;gBACF,MAAMT,UACHG,UAAU,CAAC,SACXC,GAAG,CAACxB,QACJuB,UAAU,CAAC,SACXC,GAAG,CAACK,QACJE,MAAM,CAAC;oBAAEC,YAAYL,UAAUM,EAAE;gBAAC;YACvC,EAAE,OAAOlC,OAAO;gBACd,uEAAuE;gBACvE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,kEAAkE;gBAClE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,wBAAwB;gBACxBmC,QAAQnC,KAAK,CAAC,uBAAuBC,QAAQD;YAC/C;QACF;QACAd,gBAAgBU,KAAKK,QAAQhB,kBAAkBgB,QAAQ2B,UAAUM,EAAE;QACnE,OAAOtC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEqC,IAAI;QAAK;IACzC,EAAE,OAAOpC,OAAO;QACdmC,QAAQnC,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}

package/src/lib/server/membership-logout.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/** Member sign-out (AGL-294): clears the session cookie. */
+export declare const membershipLogoutHandler: PluginApiHandler;

package/src/lib/server/membership-logout.js

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { setMemberCookie } from "./membership.js";
+/** Member sign-out (AGL-294): clears the session cookie. */ export const membershipLogoutHandler = (req, res)=>{
+    var _ref;
+    var _req_body;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    if (!hostId) return res.status(400).json({
+        error: 'Missing hostId'
+    });
+    setMemberCookie(res, hostId, null);
+    return res.status(200).json({
+        ok: true
+    });
+};
+
+//# sourceMappingURL=membership-logout.js.map

package/src/lib/server/membership-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-logout.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { setMemberCookie } from './membership'\n\n/** Member sign-out (AGL-294): clears the session cookie. */\nexport const membershipLogoutHandler: PluginApiHandler = (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  if (!hostId) return res.status(400).json({ error: 'Missing hostId' })\n  setMemberCookie(res, hostId, null)\n  return res.status(200).json({ ok: true })\n}\n"],"names":["setMemberCookie","membershipLogoutHandler","req","res","method","status","json","error","hostId","String","body","ok"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,eAAe,QAAQ,kBAAc;AAE9C,0DAA0D,GAC1D,OAAO,MAAMC,0BAA4C,CAACC,KAAKC;;QAIvCD;IAHtB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,IAAI,CAACA,QAAQ,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAiB;IACnEP,gBAAgBG,KAAKK,QAAQ;IAC7B,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEK,IAAI;IAAK;AACzC,EAAC"}

package/src/lib/server/membership-recover.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Password-recovery request (AGL-552). ALWAYS answers `200 {ok:true}` once
+ * the input validates and the caller is inside its rate budget — whether or
+ * not the email belongs to a member — so the endpoint can't be used to probe
+ * account existence. When a member matches, a single-use one-hour token
+ * (bound to the current password hash, see membership.ts) is mailed via
+ * Resend with a link to the site's `/recover` route.
+ *
+ * ## Abuse controls (AGL-1966)
+ *
+ * This is an unauthenticated endpoint that makes us send mail from
+ * `noreply@aglyn.com` to an address the caller chose, and it composes with
+ * `membership/register` — which admits arbitrary addresses because member
+ * accounts are unlimited on every plan (AGL-889) — into a mail relay. The
+ * bounces from that land on the sending reputation shared by every customer's
+ * transactional mail.
+ *
+ * Four controls, in the order they run, and the ORDER is part of each:
+ *
+ * 1. **Attempt caps** — per recipient and per IP, durable
+ *    (`membership-recover-throttle.ts`). Consumed BEFORE the member lookup so
+ *    a member and a non-member spend the identical budget and receive the
+ *    identical answer; a visible 429 from here therefore leaks nothing. The
+ *    per-instance `Map` this replaced reset on every cold start and was kept
+ *    per instance, which on Vercel is close to no limit at all (AGL-794).
+ * 2. **The young-member guard** — a member row created inside
+ *    `RECOVER_MIN_MEMBER_AGE_MS` is not worth a reset mail. Register-then-
+ *    recover is the whole attack and nobody forgets a password ten minutes
+ *    after choosing it. Silent-success exit.
+ * 3. **The platform suppression list** — see the note on the call below.
+ *    Silent-success exit.
+ * 4. **The per-site daily send ceiling** — consumed only when a message is
+ *    actually about to go out. Because that branch is reachable only for real
+ *    members, its refusal MUST be the silent-success exit rather than an
+ *    error, or the ceiling becomes the oracle everything else avoids.
+ *
+ * What remains unbounded is stated rather than papered over: a genuine botnet
+ * still gets `RECOVER_ATTEMPTS_PER_IP` per source, and an attacker who can
+ * create many sites gets the per-site ceiling once per site. Host creation is
+ * itself rate-limited, and bounding the botnet case needs an edge WAF, not an
+ * application limiter — the same conclusion `plugin-api-rate-limit.ts` reaches.
+ */
+export declare const membershipRecoverHandler: PluginApiHandler;

package/src/lib/server/membership-recover.js

@@ -0,0 +1,244 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { resolveBrandingProfile } from "@aglyn/aglyn/server";
+import { hostPublicOrigin } from "@aglyn/aglyn/server";
+import { consumeMembershipRecoverAttempt, consumeMembershipRecoverSend, firebaseAdmin, getOrgForHost, hostSendingIdentity, isEmailSuppressed, meterHostEmail, RECOVER_MIN_MEMBER_AGE_MS } from "@aglyn/tenant-data-admin";
+import { isEmailConfigured, sendEmail } from "@aglyn/shared-util-email";
+import { mintPasswordResetToken } from "./membership.js";
+import { readClientIp } from "@aglyn/aglyn/app-utils/request-ip";
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * Password-recovery request (AGL-552). ALWAYS answers `200 {ok:true}` once
+ * the input validates and the caller is inside its rate budget — whether or
+ * not the email belongs to a member — so the endpoint can't be used to probe
+ * account existence. When a member matches, a single-use one-hour token
+ * (bound to the current password hash, see membership.ts) is mailed via
+ * Resend with a link to the site's `/recover` route.
+ *
+ * ## Abuse controls (AGL-1966)
+ *
+ * This is an unauthenticated endpoint that makes us send mail from
+ * `noreply@aglyn.com` to an address the caller chose, and it composes with
+ * `membership/register` — which admits arbitrary addresses because member
+ * accounts are unlimited on every plan (AGL-889) — into a mail relay. The
+ * bounces from that land on the sending reputation shared by every customer's
+ * transactional mail.
+ *
+ * Four controls, in the order they run, and the ORDER is part of each:
+ *
+ * 1. **Attempt caps** — per recipient and per IP, durable
+ *    (`membership-recover-throttle.ts`). Consumed BEFORE the member lookup so
+ *    a member and a non-member spend the identical budget and receive the
+ *    identical answer; a visible 429 from here therefore leaks nothing. The
+ *    per-instance `Map` this replaced reset on every cold start and was kept
+ *    per instance, which on Vercel is close to no limit at all (AGL-794).
+ * 2. **The young-member guard** — a member row created inside
+ *    `RECOVER_MIN_MEMBER_AGE_MS` is not worth a reset mail. Register-then-
+ *    recover is the whole attack and nobody forgets a password ten minutes
+ *    after choosing it. Silent-success exit.
+ * 3. **The platform suppression list** — see the note on the call below.
+ *    Silent-success exit.
+ * 4. **The per-site daily send ceiling** — consumed only when a message is
+ *    actually about to go out. Because that branch is reachable only for real
+ *    members, its refusal MUST be the silent-success exit rather than an
+ *    error, or the ceiling becomes the oracle everything else avoids.
+ *
+ * What remains unbounded is stated rather than papered over: a genuine botnet
+ * still gets `RECOVER_ATTEMPTS_PER_IP` per source, and an attacker who can
+ * create many sites gets the per-site ceiling once per site. Host creation is
+ * itself rate-limited, and bounding the botnet case needs an edge WAF, not an
+ * application limiter — the same conclusion `plugin-api-rate-limit.ts` reaches.
+ */ export const membershipRecoverHandler = async (req, res)=>{
+    var _ref, _ref1;
+    var _req_body, _req_body1, _req_socket;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const email = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.email) != null ? _ref1 : '').trim().toLowerCase();
+    if (!hostId || !EMAIL_PATTERN.test(email)) {
+        return res.status(400).json({
+            error: 'Invalid request'
+        });
+    }
+    // Null when nothing readable names the caller; the throttle then skips its
+    // per-source cap and the per-recipient one carries the control alone.
+    const ip = readClientIp(req.headers, {
+        remoteAddress: (_req_socket = req.socket) == null ? void 0 : _req_socket.remoteAddress
+    });
+    // Control 1. Before the lookup, so both branches spend the same budget.
+    // A store failure degrades to the in-process cap rather than refusing
+    // (`consumeRateLimit` fails soft on an unreachable store, closed on
+    // contention) — a Firestore blip must not lock every site's members out of
+    // their own password reset.
+    const attempt = await consumeMembershipRecoverAttempt({
+        email,
+        ip
+    });
+    if (!attempt.allowed) {
+        res.setHeader('Retry-After', String(attempt.retryAfterSeconds));
+        return res.status(429).json({
+            error: 'Too many attempts'
+        });
+    }
+    try {
+        var _hostPublicOrigin, _ref2, _hostSnapshot_get;
+        var _this;
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const [hostSnapshot, membersQuery] = await Promise.all([
+            hostRef.get(),
+            hostRef.collection('siteMembers').where('email', '==', email).limit(1).get()
+        ]);
+        const memberDoc = membersQuery.docs[0];
+        // Unknown site, unknown email, suspended account (AGL-546): all take
+        // the same silent-success exit — the response never distinguishes.
+        if (!hostSnapshot.exists || !memberDoc || memberDoc.get('suspended') === true) {
+            return res.status(200).json({
+                ok: true
+            });
+        }
+        // Control 2 — the register-then-recover composition (AGL-1966).
+        //
+        // `createdAt` is a server timestamp written by `membership-register.ts`.
+        // A row that has none is a legacy member, not a fresh one: rows predating
+        // the field must NOT be refused, so an unreadable or absent value reads as
+        // "old enough". This guard exists to refuse a member created seconds ago,
+        // which is a case where the field is always present by construction.
+        const createdAtMs = (()=>{
+            const raw = memberDoc.get('createdAt');
+            try {
+                return typeof (raw == null ? void 0 : raw.toMillis) === 'function' ? raw.toMillis() : null;
+            } catch (unused) {
+                return null;
+            }
+        })();
+        if (createdAtMs !== null && Date.now() - createdAtMs < RECOVER_MIN_MEMBER_AGE_MS) {
+            return res.status(200).json({
+                ok: true
+            });
+        }
+        // Control 3 — the platform suppression list (AGL-1918 / AGL-2407).
+        //
+        // `email-suppression.ts` argues that TRANSACTIONAL mail deliberately does
+        // not consult this list, because refusing a password reset over an
+        // unrelated old bounce locks a real customer out of their own account.
+        // That argument is about mail a signed-in human just asked us for. It does
+        // not reach here, and this is the exception it does not cover:
+        //
+        //  - The address is chosen by an ANONYMOUS caller, not by the account
+        //    holder. "The human just did something" is exactly the premise that is
+        //    missing on an unauthenticated endpoint.
+        //  - The list holds PERMANENT bounces and spam complaints only — transient
+        //    bounces are excluded at the webhook. A permanent bounce means the
+        //    mailbox does not exist, so the send cannot reach anyone; all it can do
+        //    is tell a provider that `aglyn.com` re-mails dead addresses. There is
+        //    no locked-out customer on the other side of it to protect.
+        //  - The reputational cost is shared by every customer's transactional
+        //    mail, which is precisely what AGL-1966 is about.
+        //
+        // The HOST list (`hosts/{hostId}/suppressions`) is deliberately NOT
+        // consulted: it also holds marketing unsubscribes, and unsubscribing from
+        // a store's newsletter must never stop that store's password resets.
+        //
+        // `isEmailSuppressed` fails CLOSED — a read that throws answers "treat as
+        // suppressed". That adds no new outage mode here: the member lookup above
+        // is a Firestore read on the same database, so a Firestore outage has
+        // already taken this handler to its silent-success catch.
+        if (await isEmailSuppressed(email)) {
+            return res.status(200).json({
+                ok: true
+            });
+        }
+        if (!isEmailConfigured()) {
+            // Config gaps must not become an existence oracle either; log for
+            // the operator and keep the visitor-facing contract.
+            console.error('membership/recover: email is not configured');
+            return res.status(200).json({
+                ok: true
+            });
+        }
+        const token = mintPasswordResetToken(hostId, memberDoc.id, memberDoc.get('passwordScrypt'));
+        // `hostPublicOrigin`, not a hand-rolled apex (AGL-2195). This URL is
+        // minted server-side and mailed out, so a wrong apex is not a display
+        // bug — it is a live link on somebody else's domain.
+        const siteBase = (_hostPublicOrigin = hostPublicOrigin({
+            cname: hostSnapshot.get('cname'),
+            subdomain: hostSnapshot.get('subdomain')
+        })) != null ? _hostPublicOrigin : '';
+        const resetUrl = `${siteBase}/recover?token=${encodeURIComponent(token)}`;
+        const siteName = String((_ref2 = (_hostSnapshot_get = hostSnapshot.get('displayName')) != null ? _hostSnapshot_get : hostSnapshot.get('subdomain')) != null ? _ref2 : 'your site');
+        // White-label sender identity (White-Label Phase 3): the store's brand via
+        // the one shared resolver (the copy already uses the site name).
+        const branding = resolveBrandingProfile((_this = await getOrgForHost(hostId).catch(()=>null)) == null ? void 0 : _this.org);
+        // Control 4 — the per-site daily ceiling on recovery mail (AGL-1966).
+        //
+        // Consumed here, as late as possible, because it counts MESSAGES and not
+        // requests: everything above this line can refuse without having decided
+        // to send, and a counter that ticked for those would exhaust a site's
+        // budget on traffic that never cost a message.
+        //
+        // The refusal is the silent-success exit, NOT a 429. This branch is
+        // reachable only for an address that really is a member, so a visible
+        // error here would be the existence oracle the whole handler is built to
+        // avoid — the one place where the cheap answer is the wrong one.
+        //
+        // The accepted cost: during an attack on a site, a genuine member can get
+        // no mail and no error. The ceiling is sized more than an order of
+        // magnitude above any real site's daily resets so that reaching it is
+        // evidence of the attack rather than of a busy Tuesday.
+        const sendBudget = await consumeMembershipRecoverSend({
+            hostId
+        });
+        if (!sendBudget.allowed) {
+            console.error('membership/recover: daily send ceiling reached', {
+                hostId,
+                retryAfterSeconds: sendBudget.retryAfterSeconds
+            });
+            return res.status(200).json({
+                ok: true
+            });
+        }
+        await sendEmail({
+            to: email,
+            subject: `Reset your ${siteName} password`,
+            text: `Someone asked to reset the password for your ${siteName} ` + 'account. If that was you, set a new password here:\n\n' + `${resetUrl}\n\n` + 'The link works once and expires in 1 hour. If you did not ' + 'ask for this, you can safely ignore this email — your ' + 'password is unchanged.',
+            fromName: branding.fromName,
+            sendingIdentity: await hostSendingIdentity(hostId),
+            audience: 'tenant',
+            context: 'membership recovery'
+        });
+        // Cost meter (AGL-1438). Transactional, and the clearest case for why a
+        // quota may not refuse one: this email is how the member gets back into
+        // their account.
+        await meterHostEmail(hostId);
+        return res.status(200).json({
+            ok: true
+        });
+    } catch (error) {
+        console.error(error);
+        // Even a backend failure stays silent-success: the enumeration
+        // contract beats the visitor's error visibility here, and the send is
+        // best-effort by design.
+        return res.status(200).json({
+            ok: true
+        });
+    }
+};
+
+//# sourceMappingURL=membership-recover.js.map

package/src/lib/server/membership-recover.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-recover.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { resolveBrandingProfile } from '@aglyn/aglyn/server'\nimport { hostPublicOrigin } from '@aglyn/aglyn/server'\nimport {\n  consumeMembershipRecoverAttempt,\n  consumeMembershipRecoverSend,\n  firebaseAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  isEmailSuppressed,\n  meterHostEmail,\n  RECOVER_MIN_MEMBER_AGE_MS,\n} from '@aglyn/tenant-data-admin'\nimport { isEmailConfigured, sendEmail } from '@aglyn/shared-util-email'\nimport { mintPasswordResetToken } from './membership'\nimport { readClientIp } from '@aglyn/aglyn/app-utils/request-ip'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Password-recovery request (AGL-552). ALWAYS answers `200 {ok:true}` once\n * the input validates and the caller is inside its rate budget — whether or\n * not the email belongs to a member — so the endpoint can't be used to probe\n * account existence. When a member matches, a single-use one-hour token\n * (bound to the current password hash, see membership.ts) is mailed via\n * Resend with a link to the site's `/recover` route.\n *\n * ## Abuse controls (AGL-1966)\n *\n * This is an unauthenticated endpoint that makes us send mail from\n * `noreply@aglyn.com` to an address the caller chose, and it composes with\n * `membership/register` — which admits arbitrary addresses because member\n * accounts are unlimited on every plan (AGL-889) — into a mail relay. The\n * bounces from that land on the sending reputation shared by every customer's\n * transactional mail.\n *\n * Four controls, in the order they run, and the ORDER is part of each:\n *\n * 1. **Attempt caps** — per recipient and per IP, durable\n *    (`membership-recover-throttle.ts`). Consumed BEFORE the member lookup so\n *    a member and a non-member spend the identical budget and receive the\n *    identical answer; a visible 429 from here therefore leaks nothing. The\n *    per-instance `Map` this replaced reset on every cold start and was kept\n *    per instance, which on Vercel is close to no limit at all (AGL-794).\n * 2. **The young-member guard** — a member row created inside\n *    `RECOVER_MIN_MEMBER_AGE_MS` is not worth a reset mail. Register-then-\n *    recover is the whole attack and nobody forgets a password ten minutes\n *    after choosing it. Silent-success exit.\n * 3. **The platform suppression list** — see the note on the call below.\n *    Silent-success exit.\n * 4. **The per-site daily send ceiling** — consumed only when a message is\n *    actually about to go out. Because that branch is reachable only for real\n *    members, its refusal MUST be the silent-success exit rather than an\n *    error, or the ceiling becomes the oracle everything else avoids.\n *\n * What remains unbounded is stated rather than papered over: a genuine botnet\n * still gets `RECOVER_ATTEMPTS_PER_IP` per source, and an attacker who can\n * create many sites gets the per-site ceiling once per site. Host creation is\n * itself rate-limited, and bounding the botnet case needs an edge WAF, not an\n * application limiter — the same conclusion `plugin-api-rate-limit.ts` reaches.\n */\nexport const membershipRecoverHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  if (!hostId || !EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  // Null when nothing readable names the caller; the throttle then skips its\n  // per-source cap and the per-recipient one carries the control alone.\n  const ip = readClientIp(req.headers, {\n    remoteAddress: req.socket?.remoteAddress,\n  })\n  // Control 1. Before the lookup, so both branches spend the same budget.\n  // A store failure degrades to the in-process cap rather than refusing\n  // (`consumeRateLimit` fails soft on an unreachable store, closed on\n  // contention) — a Firestore blip must not lock every site's members out of\n  // their own password reset.\n  const attempt = await consumeMembershipRecoverAttempt({ email, ip })\n  if (!attempt.allowed) {\n    res.setHeader('Retry-After', String(attempt.retryAfterSeconds))\n    return res.status(429).json({ error: 'Too many attempts' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const [hostSnapshot, membersQuery] = await Promise.all([\n      hostRef.get(),\n      hostRef\n        .collection('siteMembers')\n        .where('email', '==', email)\n        .limit(1)\n        .get(),\n    ])\n    const memberDoc = membersQuery.docs[0]\n    // Unknown site, unknown email, suspended account (AGL-546): all take\n    // the same silent-success exit — the response never distinguishes.\n    if (\n      !hostSnapshot.exists ||\n      !memberDoc ||\n      memberDoc.get('suspended') === true\n    ) {\n      return res.status(200).json({ ok: true })\n    }\n    // Control 2 — the register-then-recover composition (AGL-1966).\n    //\n    // `createdAt` is a server timestamp written by `membership-register.ts`.\n    // A row that has none is a legacy member, not a fresh one: rows predating\n    // the field must NOT be refused, so an unreadable or absent value reads as\n    // \"old enough\". This guard exists to refuse a member created seconds ago,\n    // which is a case where the field is always present by construction.\n    const createdAtMs = (() => {\n      const raw = memberDoc.get('createdAt') as\n        | { toMillis?: () => number }\n        | undefined\n      try {\n        return typeof raw?.toMillis === 'function' ? raw.toMillis() : null\n      } catch {\n        return null\n      }\n    })()\n    if (\n      createdAtMs !== null &&\n      Date.now() - createdAtMs < RECOVER_MIN_MEMBER_AGE_MS\n    ) {\n      return res.status(200).json({ ok: true })\n    }\n    // Control 3 — the platform suppression list (AGL-1918 / AGL-2407).\n    //\n    // `email-suppression.ts` argues that TRANSACTIONAL mail deliberately does\n    // not consult this list, because refusing a password reset over an\n    // unrelated old bounce locks a real customer out of their own account.\n    // That argument is about mail a signed-in human just asked us for. It does\n    // not reach here, and this is the exception it does not cover:\n    //\n    //  - The address is chosen by an ANONYMOUS caller, not by the account\n    //    holder. \"The human just did something\" is exactly the premise that is\n    //    missing on an unauthenticated endpoint.\n    //  - The list holds PERMANENT bounces and spam complaints only — transient\n    //    bounces are excluded at the webhook. A permanent bounce means the\n    //    mailbox does not exist, so the send cannot reach anyone; all it can do\n    //    is tell a provider that `aglyn.com` re-mails dead addresses. There is\n    //    no locked-out customer on the other side of it to protect.\n    //  - The reputational cost is shared by every customer's transactional\n    //    mail, which is precisely what AGL-1966 is about.\n    //\n    // The HOST list (`hosts/{hostId}/suppressions`) is deliberately NOT\n    // consulted: it also holds marketing unsubscribes, and unsubscribing from\n    // a store's newsletter must never stop that store's password resets.\n    //\n    // `isEmailSuppressed` fails CLOSED — a read that throws answers \"treat as\n    // suppressed\". That adds no new outage mode here: the member lookup above\n    // is a Firestore read on the same database, so a Firestore outage has\n    // already taken this handler to its silent-success catch.\n    if (await isEmailSuppressed(email)) {\n      return res.status(200).json({ ok: true })\n    }\n    if (!isEmailConfigured()) {\n      // Config gaps must not become an existence oracle either; log for\n      // the operator and keep the visitor-facing contract.\n      console.error('membership/recover: email is not configured')\n      return res.status(200).json({ ok: true })\n    }\n    const token = mintPasswordResetToken(\n      hostId,\n      memberDoc.id,\n      memberDoc.get('passwordScrypt'),\n    )\n    // `hostPublicOrigin`, not a hand-rolled apex (AGL-2195). This URL is\n    // minted server-side and mailed out, so a wrong apex is not a display\n    // bug — it is a live link on somebody else's domain.\n    const siteBase =\n      hostPublicOrigin({\n        cname: hostSnapshot.get('cname'),\n        subdomain: hostSnapshot.get('subdomain'),\n      }) ?? ''\n    const resetUrl = `${siteBase}/recover?token=${encodeURIComponent(token)}`\n    const siteName = String(\n      hostSnapshot.get('displayName') ?? hostSnapshot.get('subdomain') ?? 'your site',\n    )\n    // White-label sender identity (White-Label Phase 3): the store's brand via\n    // the one shared resolver (the copy already uses the site name).\n    const branding = resolveBrandingProfile(\n      (await getOrgForHost(hostId).catch(() => null))?.org as never,\n    )\n    // Control 4 — the per-site daily ceiling on recovery mail (AGL-1966).\n    //\n    // Consumed here, as late as possible, because it counts MESSAGES and not\n    // requests: everything above this line can refuse without having decided\n    // to send, and a counter that ticked for those would exhaust a site's\n    // budget on traffic that never cost a message.\n    //\n    // The refusal is the silent-success exit, NOT a 429. This branch is\n    // reachable only for an address that really is a member, so a visible\n    // error here would be the existence oracle the whole handler is built to\n    // avoid — the one place where the cheap answer is the wrong one.\n    //\n    // The accepted cost: during an attack on a site, a genuine member can get\n    // no mail and no error. The ceiling is sized more than an order of\n    // magnitude above any real site's daily resets so that reaching it is\n    // evidence of the attack rather than of a busy Tuesday.\n    const sendBudget = await consumeMembershipRecoverSend({ hostId })\n    if (!sendBudget.allowed) {\n      console.error('membership/recover: daily send ceiling reached', {\n        hostId,\n        retryAfterSeconds: sendBudget.retryAfterSeconds,\n      })\n      return res.status(200).json({ ok: true })\n    }\n    await sendEmail({\n      to: email,\n      subject: `Reset your ${siteName} password`,\n      text:\n        `Someone asked to reset the password for your ${siteName} ` +\n        'account. If that was you, set a new password here:\\n\\n' +\n        `${resetUrl}\\n\\n` +\n        'The link works once and expires in 1 hour. If you did not ' +\n        'ask for this, you can safely ignore this email — your ' +\n        'password is unchanged.',\n      fromName: branding.fromName,\n      sendingIdentity: await hostSendingIdentity(hostId),\n      audience: 'tenant',\n      context: 'membership recovery',\n    })\n    // Cost meter (AGL-1438). Transactional, and the clearest case for why a\n    // quota may not refuse one: this email is how the member gets back into\n    // their account.\n    await meterHostEmail(hostId)\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    // Even a backend failure stays silent-success: the enumeration\n    // contract beats the visitor's error visibility here, and the send is\n    // best-effort by design.\n    return res.status(200).json({ ok: true })\n  }\n}\n"],"names":["resolveBrandingProfile","hostPublicOrigin","consumeMembershipRecoverAttempt","consumeMembershipRecoverSend","firebaseAdmin","getOrgForHost","hostSendingIdentity","isEmailSuppressed","meterHostEmail","RECOVER_MIN_MEMBER_AGE_MS","isEmailConfigured","sendEmail","mintPasswordResetToken","readClientIp","EMAIL_PATTERN","membershipRecoverHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","test","ip","headers","remoteAddress","socket","attempt","allowed","setHeader","retryAfterSeconds","hostSnapshot","firestore","app","hostRef","collection","doc","membersQuery","Promise","all","get","where","limit","memberDoc","docs","exists","ok","createdAtMs","raw","toMillis","Date","now","console","token","id","siteBase","cname","subdomain","resetUrl","encodeURIComponent","siteName","branding","catch","org","sendBudget","to","subject","text","fromName","sendingIdentity","audience","context"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,gBAAgB,QAAQ,sBAAqB;AACtD,SACEC,+BAA+B,EAC/BC,4BAA4B,EAC5BC,aAAa,EACbC,aAAa,EACbC,mBAAmB,EACnBC,iBAAiB,EACjBC,cAAc,EACdC,yBAAyB,QACpB,2BAA0B;AACjC,SAASC,iBAAiB,EAAEC,SAAS,QAAQ,2BAA0B;AACvE,SAASC,sBAAsB,QAAQ,kBAAc;AACrD,SAASC,YAAY,QAAQ,oCAAmC;AAEhE,MAAMC,gBAAgB;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,MAAMC,2BAA6C,OAAOC,KAAKC;;QAI9CD,WACDA,YASJA;IAbjB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,IAAI,CAACL,UAAU,CAACR,cAAcc,IAAI,CAACH,QAAQ;QACzC,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,2EAA2E;IAC3E,sEAAsE;IACtE,MAAMQ,KAAKhB,aAAaG,IAAIc,OAAO,EAAE;QACnCC,aAAa,GAAEf,cAAAA,IAAIgB,MAAM,qBAAVhB,YAAYe,aAAa;IAC1C;IACA,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAME,UAAU,MAAM/B,gCAAgC;QAAEuB;QAAOI;IAAG;IAClE,IAAI,CAACI,QAAQC,OAAO,EAAE;QACpBjB,IAAIkB,SAAS,CAAC,eAAeZ,OAAOU,QAAQG,iBAAiB;QAC7D,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoB;IAC3D;IACA,IAAI;YAyFApB,mBAMAoC,OAAAA;YAKC;QAnGH,MAAMC,YAAYlC,cAAcmC,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACpB;QAClD,MAAM,CAACe,cAAcM,aAAa,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACrDL,QAAQM,GAAG;YACXN,QACGC,UAAU,CAAC,eACXM,KAAK,CAAC,SAAS,MAAMtB,OACrBuB,KAAK,CAAC,GACNF,GAAG;SACP;QACD,MAAMG,YAAYN,aAAaO,IAAI,CAAC,EAAE;QACtC,qEAAqE;QACrE,mEAAmE;QACnE,IACE,CAACb,aAAac,MAAM,IACpB,CAACF,aACDA,UAAUH,GAAG,CAAC,iBAAiB,MAC/B;YACA,OAAO7B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,gEAAgE;QAChE,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAMC,cAAc,AAAC,CAAA;YACnB,MAAMC,MAAML,UAAUH,GAAG,CAAC;YAG1B,IAAI;gBACF,OAAO,QAAOQ,uBAAAA,IAAKC,QAAQ,MAAK,aAAaD,IAAIC,QAAQ,KAAK;YAChE,EAAE,eAAM;gBACN,OAAO;YACT;QACF,CAAA;QACA,IACEF,gBAAgB,QAChBG,KAAKC,GAAG,KAAKJ,cAAc5C,2BAC3B;YACA,OAAOQ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,mEAAmE;QACnE,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,+DAA+D;QAC/D,EAAE;QACF,sEAAsE;QACtE,2EAA2E;QAC3E,6CAA6C;QAC7C,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,gEAAgE;QAChE,uEAAuE;QACvE,sDAAsD;QACtD,EAAE;QACF,oEAAoE;QACpE,0EAA0E;QAC1E,qEAAqE;QACrE,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,MAAM7C,kBAAkBkB,QAAQ;YAClC,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,IAAI,CAAC1C,qBAAqB;YACxB,kEAAkE;YAClE,qDAAqD;YACrDgD,QAAQrC,KAAK,CAAC;YACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,MAAMO,QAAQ/C,uBACZU,QACA2B,UAAUW,EAAE,EACZX,UAAUH,GAAG,CAAC;QAEhB,qEAAqE;QACrE,sEAAsE;QACtE,qDAAqD;QACrD,MAAMe,YACJ5D,oBAAAA,iBAAiB;YACf6D,OAAOzB,aAAaS,GAAG,CAAC;YACxBiB,WAAW1B,aAAaS,GAAG,CAAC;QAC9B,cAHA7C,oBAGM;QACR,MAAM+D,WAAW,GAAGH,SAAS,eAAe,EAAEI,mBAAmBN,QAAQ;QACzE,MAAMO,WAAW3C,QACfc,SAAAA,oBAAAA,aAAaS,GAAG,CAAC,0BAAjBT,oBAAmCA,aAAaS,GAAG,CAAC,wBAApDT,QAAoE;QAEtE,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM8B,WAAWnE,wBACd,QAAA,MAAMK,cAAciB,QAAQ8C,KAAK,CAAC,IAAM,0BAAzC,AAAC,MAAgDC,GAAG;QAEtD,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,+CAA+C;QAC/C,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,iEAAiE;QACjE,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,sEAAsE;QACtE,wDAAwD;QACxD,MAAMC,aAAa,MAAMnE,6BAA6B;YAAEmB;QAAO;QAC/D,IAAI,CAACgD,WAAWpC,OAAO,EAAE;YACvBwB,QAAQrC,KAAK,CAAC,kDAAkD;gBAC9DC;gBACAc,mBAAmBkC,WAAWlC,iBAAiB;YACjD;YACA,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,MAAMzC,UAAU;YACd4D,IAAI9C;YACJ+C,SAAS,CAAC,WAAW,EAAEN,SAAS,SAAS,CAAC;YAC1CO,MACE,CAAC,6CAA6C,EAAEP,SAAS,CAAC,CAAC,GAC3D,2DACA,GAAGF,SAAS,IAAI,CAAC,GACjB,+DACA,2DACA;YACFU,UAAUP,SAASO,QAAQ;YAC3BC,iBAAiB,MAAMrE,oBAAoBgB;YAC3CsD,UAAU;YACVC,SAAS;QACX;QACA,wEAAwE;QACxE,wEAAwE;QACxE,iBAAiB;QACjB,MAAMrE,eAAec;QACrB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEgC,IAAI;QAAK;IACzC,EAAE,OAAO/B,OAAO;QACdqC,QAAQrC,KAAK,CAACA;QACd,+DAA+D;QAC/D,sEAAsE;QACtE,yBAAyB;QACzB,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEgC,IAAI;QAAK;IACzC;AACF,EAAC"}

package/src/lib/server/membership-register.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Site member sign-up (AGL-109): creates the member record (scrypt hash),
+ * doubles as a lead, and signs the visitor in via the session cookie.
+ */
+export declare const membershipRegisterHandler: PluginApiHandler;