@aglyn/plugins-commerce 1.0.0-beta.183 → 1.0.0-beta.185

package/src/lib/server/membership-admin-remove.js

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { hostRoleCanWrite } from "@aglyn/aglyn/server";
+import { firebaseAdmin, isImpersonationSession } from "@aglyn/tenant-data-admin";
+import { isMemberDocumentId, memberCredentialRef } from "./member-credentials.js";
+/**
+ * Remove a SITE MEMBER from the console (AGL-3308): the profile and its
+ * credential document, in one batch.
+ *
+ * The password hash lives in a collection no client can reach, so a client
+ * delete of the profile would leave it behind — a credential for an account
+ * the site owner removed. The rules therefore refuse a client delete of any
+ * member that has a credential document, and this route is the removal.
+ *
+ * Who may call it is who the rules let delete a profile before it: a site
+ * role that writes content (`admin`, `editor` or `author` in the host's
+ * `memberRoles`). A frozen site is refused by the dispatcher's lockdown gate
+ * before this runs, the half the rules spelled `hostWritesFrozen`.
+ *
+ * Removing the profile also ends every session the member holds:
+ * `readActiveMemberSession` reads a missing profile as signed out.
+ *
+ * Idempotent. A member already gone answers 200, and a credential document
+ * left without its profile is cleared on the way.
+ */ export const membershipAdminRemoveHandler = async (req, res)=>{
+    var _req_headers_authorization, _ref, _ref1;
+    var _req_body, _req_body1;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers['authorization']) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : '';
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const memberId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.memberId) != null ? _ref1 : '');
+    if (!hostId || !memberId) {
+        return res.status(400).json({
+            error: 'Missing hostId or memberId'
+        });
+    }
+    if (!isMemberDocumentId(memberId)) {
+        return res.status(400).json({
+            error: 'Unknown member'
+        });
+    }
+    try {
+        var _hostSnapshot_get;
+        const app = firebaseAdmin.app();
+        const decoded = await app.auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            // The shape of emailUnverifiedResponse (AGL-479), by hand for the same
+            // reason as membership-admin-password: this is a (req, res) handler.
+            return res.status(403).json({
+                error: 'Verify your email to continue',
+                reason: 'email-unverified'
+            });
+        }
+        const firestore = app.firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (!hostSnapshot.exists || !hostRoleCanWrite(memberRole)) {
+            return res.status(403).json({
+                error: 'Not permitted'
+            });
+        }
+        const batch = firestore.batch();
+        batch.delete(hostRef.collection('siteMembers').doc(memberId));
+        batch.delete(memberCredentialRef(hostRef, memberId));
+        await batch.commit();
+        return res.status(200).json({
+            ok: true
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Could not remove the member'
+        });
+    }
+};
+
+//# sourceMappingURL=membership-admin-remove.js.map

package/src/lib/server/membership-admin-remove.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-admin-remove.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { hostRoleCanWrite, type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, isImpersonationSession } from '@aglyn/tenant-data-admin'\nimport { isMemberDocumentId, memberCredentialRef } from './member-credentials'\n\n/**\n * Remove a SITE MEMBER from the console (AGL-3308): the profile and its\n * credential document, in one batch.\n *\n * The password hash lives in a collection no client can reach, so a client\n * delete of the profile would leave it behind — a credential for an account\n * the site owner removed. The rules therefore refuse a client delete of any\n * member that has a credential document, and this route is the removal.\n *\n * Who may call it is who the rules let delete a profile before it: a site\n * role that writes content (`admin`, `editor` or `author` in the host's\n * `memberRoles`). A frozen site is refused by the dispatcher's lockdown gate\n * before this runs, the half the rules spelled `hostWritesFrozen`.\n *\n * Removing the profile also ends every session the member holds:\n * `readActiveMemberSession` reads a missing profile as signed out.\n *\n * Idempotent. A member already gone answers 200, and a credential document\n * left without its profile is cleared on the way.\n */\nexport const membershipAdminRemoveHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const authorization = String(req.headers['authorization'] ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : ''\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  const hostId = String(req.body?.hostId ?? '')\n  const memberId = String(req.body?.memberId ?? '')\n  if (!hostId || !memberId) {\n    return res.status(400).json({ error: 'Missing hostId or memberId' })\n  }\n  if (!isMemberDocumentId(memberId)) {\n    return res.status(400).json({ error: 'Unknown member' })\n  }\n\n  try {\n    const app = firebaseAdmin.app()\n    const decoded = await app.auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      // The shape of emailUnverifiedResponse (AGL-479), by hand for the same\n      // reason as membership-admin-password: this is a (req, res) handler.\n      return res.status(403).json({\n        error: 'Verify your email to continue',\n        reason: 'email-unverified',\n      })\n    }\n    const firestore = app.firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (!hostSnapshot.exists || !hostRoleCanWrite(memberRole)) {\n      return res.status(403).json({ error: 'Not permitted' })\n    }\n\n    const batch = firestore.batch()\n    batch.delete(hostRef.collection('siteMembers').doc(memberId))\n    batch.delete(memberCredentialRef(hostRef, memberId))\n    await batch.commit()\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Could not remove the member' })\n  }\n}\n"],"names":["hostRoleCanWrite","firebaseAdmin","isImpersonationSession","isMemberDocumentId","memberCredentialRef","membershipAdminRemoveHandler","req","res","method","status","json","error","authorization","String","headers","idToken","startsWith","slice","length","hostId","body","memberId","hostSnapshot","app","decoded","auth","verifyIdToken","email_verified","reason","firestore","hostRef","collection","doc","get","memberRole","uid","exists","batch","delete","commit","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,QAA+B,sBAAqB;AAC7E,SAASC,aAAa,EAAEC,sBAAsB,QAAQ,2BAA0B;AAChF,SAASC,kBAAkB,EAAEC,mBAAmB,QAAQ,0BAAsB;AAE9E;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAMC,+BAAiD,OAC5DC,KACAC;QAK6BD;QAMPA,WACEA;IAVxB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,gBAAgBC,QAAOP,6BAAAA,IAAIQ,OAAO,CAAC,gBAAgB,YAA5BR,6BAAgC;IAC7D,MAAMS,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpC;IACJ,IAAI,CAACH,SAAS,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,MAAMQ,SAASN,gBAAOP,YAAAA,IAAIc,IAAI,qBAARd,UAAUa,MAAM,mBAAI;IAC1C,MAAME,WAAWR,iBAAOP,aAAAA,IAAIc,IAAI,qBAARd,WAAUe,QAAQ,oBAAI;IAC9C,IAAI,CAACF,UAAU,CAACE,UAAU;QACxB,OAAOd,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA6B;IACpE;IACA,IAAI,CAACR,mBAAmBkB,WAAW;QACjC,OAAOd,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;IAEA,IAAI;YAckBW;QAbpB,MAAMC,MAAMtB,cAAcsB,GAAG;QAC7B,MAAMC,UAAU,MAAMD,IAAIE,IAAI,GAAGC,aAAa,CAACX;QAC/C,IAAI,CAACS,QAAQG,cAAc,IAAI,CAACzB,uBAAuBsB,UAAU;YAC/D,uEAAuE;YACvE,qEAAqE;YACrE,OAAOjB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;gBACPiB,QAAQ;YACV;QACF;QACA,MAAMC,YAAYN,IAAIM,SAAS;QAC/B,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACb;QAClD,MAAMG,eAAe,MAAMQ,QAAQG,GAAG;QACtC,MAAMC,aAAa,EAACZ,oBAAAA,aAAaW,GAAG,CAAC,0BAAjBX,oBAAmC,CAAC,EAAE,CAACE,QAAQW,GAAG,CAAC;QACvE,IAAI,CAACb,aAAac,MAAM,IAAI,CAACpC,iBAAiBkC,aAAa;YACzD,OAAO3B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgB;QACvD;QAEA,MAAM0B,QAAQR,UAAUQ,KAAK;QAC7BA,MAAMC,MAAM,CAACR,QAAQC,UAAU,CAAC,eAAeC,GAAG,CAACX;QACnDgB,MAAMC,MAAM,CAAClC,oBAAoB0B,SAAST;QAC1C,MAAMgB,MAAME,MAAM;QAClB,OAAOhC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE8B,IAAI;QAAK;IACzC,EAAE,OAAO7B,OAAO;QACd8B,QAAQ9B,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;AACF,EAAC"}

package/src/lib/server/membership-login.js

@@ -17,6 +17,7 @@
 import { emitHostEvent } from "@aglyn/tenant-runtime";
 import { readCartId } from "./cart-cookie.js";
 import { MEMBER_SUSPENDED_ERROR, mintMemberSession, setMemberCookie, verifyMemberPassword } from "./membership.js";
+import { readMemberPasswordHash } from "./member-credentials.js";
 import { NO_CLIENT_ADDRESS_BUCKET, readClientIp } from "@aglyn/aglyn/app-utils/request-ip";
 // Best-effort per-instance brute-force damper (mirrors AGL-87 unlock).
 const attemptsByIp = new Map();
@@ -56,9 +57,13 @@ const MAX_ATTEMPTS = 10;
     }
     try {
         const firestore = firebaseAdmin.app().firestore();
-        const membersQuery = await firestore.collection('hosts').doc(hostId).collection('siteMembers').where('email', '==', email).limit(1).get();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const membersQuery = await hostRef.collection('siteMembers').where('email', '==', email).limit(1).get();
         const memberDoc = membersQuery.docs[0];
-        if (!memberDoc || !verifyMemberPassword(password, memberDoc.get('passwordScrypt'))) {
+        // The credential document's hash, else the legacy copy on the profile
+        // (AGL-3308) — see member-credentials.ts.
+        const passwordScrypt = memberDoc ? await readMemberPasswordHash(hostRef, memberDoc) : undefined;
+        if (!memberDoc || !verifyMemberPassword(password, passwordScrypt)) {
             return res.status(401).json({
                 error: 'Wrong email or password'
             });

package/src/lib/server/membership-login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-login.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport { readCartId } from './cart-cookie'\nimport {\n  MEMBER_SUSPENDED_ERROR,\n  mintMemberSession,\n  setMemberCookie,\n  verifyMemberPassword,\n} from './membership'\nimport {\n  NO_CLIENT_ADDRESS_BUCKET,\n  readClientIp,\n} from '@aglyn/aglyn/app-utils/request-ip'\n\n// Best-effort per-instance brute-force damper (mirrors AGL-87 unlock).\nconst attemptsByIp = new Map<string, number[]>()\nconst WINDOW_MS = 60_000\nconst MAX_ATTEMPTS = 10\n\n/** Site member sign-in (AGL-109); sets the session cookie on success. */\nexport const membershipLoginHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  const password = String(req.body?.password ?? '')\n  if (!hostId || !email || !password) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  // Keeps counting under the no-address bucket rather than being skipped: this\n  // damper guards a PASSWORD, and one that stops counting is a password anyone\n  // can grind. On a deployment that cannot name its callers the whole site\n  // shares one attempt budget, which is the direction to be wrong in here.\n  const ip =\n    readClientIp(req.headers, { remoteAddress: req.socket?.remoteAddress }) ??\n    NO_CLIENT_ADDRESS_BUCKET\n  const now = Date.now()\n  const attempts = (attemptsByIp.get(ip) ?? []).filter(\n    (at) => now - at < WINDOW_MS,\n  )\n  attempts.push(now)\n  attemptsByIp.set(ip, attempts)\n  if (attempts.length > MAX_ATTEMPTS) {\n    return res.status(429).json({ error: 'Too many attempts' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const membersQuery = await firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('siteMembers')\n      .where('email', '==', email)\n      .limit(1)\n      .get()\n    const memberDoc = membersQuery.docs[0]\n    if (\n      !memberDoc ||\n      !verifyMemberPassword(password, memberDoc.get('passwordScrypt'))\n    ) {\n      return res.status(401).json({ error: 'Wrong email or password' })\n    }\n    // Suspension gate (AGL-546): console-suspended members cannot sign in.\n    // Checked after the password so the message never leaks account\n    // existence to guessers who don't hold the credentials.\n    if (memberDoc.get('suspended') === true) {\n      return res.status(401).json({ error: MEMBER_SUSPENDED_ERROR })\n    }\n    // Event trigger (AGL-128/148).\n    await emitHostEvent(hostId, 'memberSignIn', { email })\n    // Cart linkage (AGL-294): stamp the guest cart with the member so\n    // abandoned-cart and analytics can attribute it.\n    //\n    // AGL-1763: `update()`, never `set(..., { merge: true })`. `cartId` is the\n    // `aglyn_cart_{hostId}` cookie verbatim — the one value on this request the\n    // client chooses — and a merge-set against a missing path CREATES the\n    // document. So a member could mint `carts/{anything}` at will, one document\n    // per sign-in, each holding a `customerId` and nothing else: no `lines`, no\n    // `createdAtMs`, no `updatedAtMs`. Inert to read — `cart.ts` treats a\n    // missing `lines` as `[]` — but real storage on the merchant's Firestore\n    // and real weight in the per-host document count, growing without bound and\n    // belonging to no basket anyone ever filled.\n    //\n    // Nor is the cookie confined to one document. `CollectionReference.doc()`\n    // appends a SLASH-SEPARATED path and refuses it only when the component\n    // count comes out odd, so a cookie of `a/b/c` wrote to `carts/a/b/c` — a\n    // document at a nesting of the caller's choosing.\n    //\n    // Refusing loses nothing, which is why this is a plain refusal rather than\n    // AGL-1760's refuse-and-record: a cart that does not exist holds no lines,\n    // so there is no basket to attribute and no work to strand. `cart.ts` is\n    // what creates a cart — on the first POST that puts something in it, with\n    // the whole document written. This only ever stamps one.\n    //\n    // AGL-1769 moved the cookie's name and its validity rule into\n    // `cart-cookie.ts`, so a slash-bearing value never reaches `.doc()` from\n    // here at all. `update()` stays: the rule bounds the value to ONE document\n    // id, and whether THAT document exists is a separate question only the\n    // write can answer.\n    const cartId = readCartId(req.cookies, hostId)\n    if (cartId) {\n      try {\n        await firestore\n          .collection('hosts')\n          .doc(hostId)\n          .collection('carts')\n          .doc(cartId)\n          .update({ customerId: memberDoc.id })\n      } catch (error) {\n        // Absent cart, malformed cookie, or a Firestore failure — none of them\n        // may fail a sign-in that has already succeeded, so this stays\n        // swallowed as it was. It is no longer SILENT, though: the old\n        // `.catch(() => undefined)` could not tell a missing cart from an\n        // outage. And the guard is a `try` rather than a `.catch()` because\n        // `.doc()` throws SYNCHRONOUSLY on an odd-component path, outside the\n        // promise the old handler covered — a mangled cookie used to 500 the\n        // member's own sign-in.\n        console.error('Cart linkage failed', hostId, error)\n      }\n    }\n    setMemberCookie(res, hostId, mintMemberSession(hostId, memberDoc.id))\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Sign-in failed' })\n  }\n}\n"],"names":["firebaseAdmin","emitHostEvent","readCartId","MEMBER_SUSPENDED_ERROR","mintMemberSession","setMemberCookie","verifyMemberPassword","NO_CLIENT_ADDRESS_BUCKET","readClientIp","attemptsByIp","Map","WINDOW_MS","MAX_ATTEMPTS","membershipLoginHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","password","ip","headers","remoteAddress","socket","now","Date","attempts","get","filter","at","push","set","length","firestore","app","membersQuery","collection","doc","where","limit","memberDoc","docs","cartId","cookies","update","customerId","id","console","ok"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,aAAa,QAAQ,wBAAuB;AACrD,SAASC,UAAU,QAAQ,mBAAe;AAC1C,SACEC,sBAAsB,EACtBC,iBAAiB,EACjBC,eAAe,EACfC,oBAAoB,QACf,kBAAc;AACrB,SACEC,wBAAwB,EACxBC,YAAY,QACP,oCAAmC;AAE1C,uEAAuE;AACvE,MAAMC,eAAe,IAAIC;AACzB,MAAMC,YAAY;AAClB,MAAMC,eAAe;AAErB,uEAAuE,GACvE,OAAO,MAAMC,yBAA2C,OAAOC,KAAKC;4BAiBhEP,eAGgBC;QAhBIK,WACDA,YAGGA,YASqBA;IAhB7C,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,IAAI,CAACN,UAAU,CAACG,SAAS,CAACG,UAAU;QAClC,OAAOX,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,MAAMQ,MACJnB,gBAAAA,aAAaM,IAAIc,OAAO,EAAE;QAAEC,aAAa,GAAEf,cAAAA,IAAIgB,MAAM,qBAAVhB,YAAYe,aAAa;IAAC,cAArErB,gBACAD;IACF,MAAMwB,MAAMC,KAAKD,GAAG;IACpB,MAAME,WAAW,EAACxB,oBAAAA,aAAayB,GAAG,CAACP,eAAjBlB,oBAAwB,EAAE,EAAE0B,MAAM,CAClD,CAACC,KAAOL,MAAMK,KAAKzB;IAErBsB,SAASI,IAAI,CAACN;IACdtB,aAAa6B,GAAG,CAACX,IAAIM;IACrB,IAAIA,SAASM,MAAM,GAAG3B,cAAc;QAClC,OAAOG,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoB;IAC3D;IACA,IAAI;QACF,MAAMqB,YAAYxC,cAAcyC,GAAG,GAAGD,SAAS;QAC/C,MAAME,eAAe,MAAMF,UACxBG,UAAU,CAAC,SACXC,GAAG,CAACxB,QACJuB,UAAU,CAAC,eACXE,KAAK,CAAC,SAAS,MAAMtB,OACrBuB,KAAK,CAAC,GACNZ,GAAG;QACN,MAAMa,YAAYL,aAAaM,IAAI,CAAC,EAAE;QACtC,IACE,CAACD,aACD,CAACzC,qBAAqBoB,UAAUqB,UAAUb,GAAG,CAAC,oBAC9C;YACA,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA0B;QACjE;QACA,uEAAuE;QACvE,gEAAgE;QAChE,wDAAwD;QACxD,IAAI4B,UAAUb,GAAG,CAAC,iBAAiB,MAAM;YACvC,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOhB;YAAuB;QAC9D;QACA,+BAA+B;QAC/B,MAAMF,cAAcmB,QAAQ,gBAAgB;YAAEG;QAAM;QACpD,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,6CAA6C;QAC7C,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,kDAAkD;QAClD,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,yDAAyD;QACzD,EAAE;QACF,8DAA8D;QAC9D,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,oBAAoB;QACpB,MAAM0B,SAAS/C,WAAWY,IAAIoC,OAAO,EAAE9B;QACvC,IAAI6B,QAAQ;YACV,IAAI;gBACF,MAAMT,UACHG,UAAU,CAAC,SACXC,GAAG,CAACxB,QACJuB,UAAU,CAAC,SACXC,GAAG,CAACK,QACJE,MAAM,CAAC;oBAAEC,YAAYL,UAAUM,EAAE;gBAAC;YACvC,EAAE,OAAOlC,OAAO;gBACd,uEAAuE;gBACvE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,kEAAkE;gBAClE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,wBAAwB;gBACxBmC,QAAQnC,KAAK,CAAC,uBAAuBC,QAAQD;YAC/C;QACF;QACAd,gBAAgBU,KAAKK,QAAQhB,kBAAkBgB,QAAQ2B,UAAUM,EAAE;QACnE,OAAOtC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEqC,IAAI;QAAK;IACzC,EAAE,OAAOpC,OAAO;QACdmC,QAAQnC,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-login.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport { readCartId } from './cart-cookie'\nimport {\n  MEMBER_SUSPENDED_ERROR,\n  mintMemberSession,\n  setMemberCookie,\n  verifyMemberPassword,\n} from './membership'\nimport { readMemberPasswordHash } from './member-credentials'\nimport {\n  NO_CLIENT_ADDRESS_BUCKET,\n  readClientIp,\n} from '@aglyn/aglyn/app-utils/request-ip'\n\n// Best-effort per-instance brute-force damper (mirrors AGL-87 unlock).\nconst attemptsByIp = new Map<string, number[]>()\nconst WINDOW_MS = 60_000\nconst MAX_ATTEMPTS = 10\n\n/** Site member sign-in (AGL-109); sets the session cookie on success. */\nexport const membershipLoginHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  const password = String(req.body?.password ?? '')\n  if (!hostId || !email || !password) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  // Keeps counting under the no-address bucket rather than being skipped: this\n  // damper guards a PASSWORD, and one that stops counting is a password anyone\n  // can grind. On a deployment that cannot name its callers the whole site\n  // shares one attempt budget, which is the direction to be wrong in here.\n  const ip =\n    readClientIp(req.headers, { remoteAddress: req.socket?.remoteAddress }) ??\n    NO_CLIENT_ADDRESS_BUCKET\n  const now = Date.now()\n  const attempts = (attemptsByIp.get(ip) ?? []).filter(\n    (at) => now - at < WINDOW_MS,\n  )\n  attempts.push(now)\n  attemptsByIp.set(ip, attempts)\n  if (attempts.length > MAX_ATTEMPTS) {\n    return res.status(429).json({ error: 'Too many attempts' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const membersQuery = await hostRef\n      .collection('siteMembers')\n      .where('email', '==', email)\n      .limit(1)\n      .get()\n    const memberDoc = membersQuery.docs[0]\n    // The credential document's hash, else the legacy copy on the profile\n    // (AGL-3308) — see member-credentials.ts.\n    const passwordScrypt = memberDoc\n      ? await readMemberPasswordHash(hostRef, memberDoc)\n      : undefined\n    if (!memberDoc || !verifyMemberPassword(password, passwordScrypt)) {\n      return res.status(401).json({ error: 'Wrong email or password' })\n    }\n    // Suspension gate (AGL-546): console-suspended members cannot sign in.\n    // Checked after the password so the message never leaks account\n    // existence to guessers who don't hold the credentials.\n    if (memberDoc.get('suspended') === true) {\n      return res.status(401).json({ error: MEMBER_SUSPENDED_ERROR })\n    }\n    // Event trigger (AGL-128/148).\n    await emitHostEvent(hostId, 'memberSignIn', { email })\n    // Cart linkage (AGL-294): stamp the guest cart with the member so\n    // abandoned-cart and analytics can attribute it.\n    //\n    // AGL-1763: `update()`, never `set(..., { merge: true })`. `cartId` is the\n    // `aglyn_cart_{hostId}` cookie verbatim — the one value on this request the\n    // client chooses — and a merge-set against a missing path CREATES the\n    // document. So a member could mint `carts/{anything}` at will, one document\n    // per sign-in, each holding a `customerId` and nothing else: no `lines`, no\n    // `createdAtMs`, no `updatedAtMs`. Inert to read — `cart.ts` treats a\n    // missing `lines` as `[]` — but real storage on the merchant's Firestore\n    // and real weight in the per-host document count, growing without bound and\n    // belonging to no basket anyone ever filled.\n    //\n    // Nor is the cookie confined to one document. `CollectionReference.doc()`\n    // appends a SLASH-SEPARATED path and refuses it only when the component\n    // count comes out odd, so a cookie of `a/b/c` wrote to `carts/a/b/c` — a\n    // document at a nesting of the caller's choosing.\n    //\n    // Refusing loses nothing, which is why this is a plain refusal rather than\n    // AGL-1760's refuse-and-record: a cart that does not exist holds no lines,\n    // so there is no basket to attribute and no work to strand. `cart.ts` is\n    // what creates a cart — on the first POST that puts something in it, with\n    // the whole document written. This only ever stamps one.\n    //\n    // AGL-1769 moved the cookie's name and its validity rule into\n    // `cart-cookie.ts`, so a slash-bearing value never reaches `.doc()` from\n    // here at all. `update()` stays: the rule bounds the value to ONE document\n    // id, and whether THAT document exists is a separate question only the\n    // write can answer.\n    const cartId = readCartId(req.cookies, hostId)\n    if (cartId) {\n      try {\n        await firestore\n          .collection('hosts')\n          .doc(hostId)\n          .collection('carts')\n          .doc(cartId)\n          .update({ customerId: memberDoc.id })\n      } catch (error) {\n        // Absent cart, malformed cookie, or a Firestore failure — none of them\n        // may fail a sign-in that has already succeeded, so this stays\n        // swallowed as it was. It is no longer SILENT, though: the old\n        // `.catch(() => undefined)` could not tell a missing cart from an\n        // outage. And the guard is a `try` rather than a `.catch()` because\n        // `.doc()` throws SYNCHRONOUSLY on an odd-component path, outside the\n        // promise the old handler covered — a mangled cookie used to 500 the\n        // member's own sign-in.\n        console.error('Cart linkage failed', hostId, error)\n      }\n    }\n    setMemberCookie(res, hostId, mintMemberSession(hostId, memberDoc.id))\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Sign-in failed' })\n  }\n}\n"],"names":["firebaseAdmin","emitHostEvent","readCartId","MEMBER_SUSPENDED_ERROR","mintMemberSession","setMemberCookie","verifyMemberPassword","readMemberPasswordHash","NO_CLIENT_ADDRESS_BUCKET","readClientIp","attemptsByIp","Map","WINDOW_MS","MAX_ATTEMPTS","membershipLoginHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","password","ip","headers","remoteAddress","socket","now","Date","attempts","get","filter","at","push","set","length","firestore","app","hostRef","collection","doc","membersQuery","where","limit","memberDoc","docs","passwordScrypt","undefined","cartId","cookies","update","customerId","id","console","ok"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,aAAa,QAAQ,wBAAuB;AACrD,SAASC,UAAU,QAAQ,mBAAe;AAC1C,SACEC,sBAAsB,EACtBC,iBAAiB,EACjBC,eAAe,EACfC,oBAAoB,QACf,kBAAc;AACrB,SAASC,sBAAsB,QAAQ,0BAAsB;AAC7D,SACEC,wBAAwB,EACxBC,YAAY,QACP,oCAAmC;AAE1C,uEAAuE;AACvE,MAAMC,eAAe,IAAIC;AACzB,MAAMC,YAAY;AAClB,MAAMC,eAAe;AAErB,uEAAuE,GACvE,OAAO,MAAMC,yBAA2C,OAAOC,KAAKC;4BAiBhEP,eAGgBC;QAhBIK,WACDA,YAGGA,YASqBA;IAhB7C,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,IAAI,CAACN,UAAU,CAACG,SAAS,CAACG,UAAU;QAClC,OAAOX,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,MAAMQ,MACJnB,gBAAAA,aAAaM,IAAIc,OAAO,EAAE;QAAEC,aAAa,GAAEf,cAAAA,IAAIgB,MAAM,qBAAVhB,YAAYe,aAAa;IAAC,cAArErB,gBACAD;IACF,MAAMwB,MAAMC,KAAKD,GAAG;IACpB,MAAME,WAAW,EAACxB,oBAAAA,aAAayB,GAAG,CAACP,eAAjBlB,oBAAwB,EAAE,EAAE0B,MAAM,CAClD,CAACC,KAAOL,MAAMK,KAAKzB;IAErBsB,SAASI,IAAI,CAACN;IACdtB,aAAa6B,GAAG,CAACX,IAAIM;IACrB,IAAIA,SAASM,MAAM,GAAG3B,cAAc;QAClC,OAAOG,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoB;IAC3D;IACA,IAAI;QACF,MAAMqB,YAAYzC,cAAc0C,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACxB;QAClD,MAAMyB,eAAe,MAAMH,QACxBC,UAAU,CAAC,eACXG,KAAK,CAAC,SAAS,MAAMvB,OACrBwB,KAAK,CAAC,GACNb,GAAG;QACN,MAAMc,YAAYH,aAAaI,IAAI,CAAC,EAAE;QACtC,sEAAsE;QACtE,0CAA0C;QAC1C,MAAMC,iBAAiBF,YACnB,MAAM1C,uBAAuBoC,SAASM,aACtCG;QACJ,IAAI,CAACH,aAAa,CAAC3C,qBAAqBqB,UAAUwB,iBAAiB;YACjE,OAAOnC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA0B;QACjE;QACA,uEAAuE;QACvE,gEAAgE;QAChE,wDAAwD;QACxD,IAAI6B,UAAUd,GAAG,CAAC,iBAAiB,MAAM;YACvC,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOjB;YAAuB;QAC9D;QACA,+BAA+B;QAC/B,MAAMF,cAAcoB,QAAQ,gBAAgB;YAAEG;QAAM;QACpD,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,6CAA6C;QAC7C,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,kDAAkD;QAClD,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,yDAAyD;QACzD,EAAE;QACF,8DAA8D;QAC9D,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,oBAAoB;QACpB,MAAM6B,SAASnD,WAAWa,IAAIuC,OAAO,EAAEjC;QACvC,IAAIgC,QAAQ;YACV,IAAI;gBACF,MAAMZ,UACHG,UAAU,CAAC,SACXC,GAAG,CAACxB,QACJuB,UAAU,CAAC,SACXC,GAAG,CAACQ,QACJE,MAAM,CAAC;oBAAEC,YAAYP,UAAUQ,EAAE;gBAAC;YACvC,EAAE,OAAOrC,OAAO;gBACd,uEAAuE;gBACvE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,kEAAkE;gBAClE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,wBAAwB;gBACxBsC,QAAQtC,KAAK,CAAC,uBAAuBC,QAAQD;YAC/C;QACF;QACAf,gBAAgBW,KAAKK,QAAQjB,kBAAkBiB,QAAQ4B,UAAUQ,EAAE;QACnE,OAAOzC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEwC,IAAI;QAAK;IACzC,EAAE,OAAOvC,OAAO;QACdsC,QAAQtC,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}

package/src/lib/server/membership-recover.js

@@ -18,6 +18,7 @@ import { hostPublicOrigin } from "@aglyn/aglyn/server";
 import { consumeMembershipRecoverAttempt, consumeMembershipRecoverSend, firebaseAdmin, getOrgForHost, hostSendingIdentity, isEmailSuppressed, meterHostEmail, RECOVER_MIN_MEMBER_AGE_MS } from "@aglyn/tenant-data-admin";
 import { isEmailConfigured, sendEmail } from "@aglyn/shared-util-email";
 import { mintPasswordResetToken } from "./membership.js";
+import { readMemberPasswordHash } from "./member-credentials.js";
 import { readClientIp } from "@aglyn/aglyn/app-utils/request-ip";
 const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 /**
@@ -173,7 +174,9 @@ const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
                 ok: true
             });
         }
-        const token = mintPasswordResetToken(hostId, memberDoc.id, memberDoc.get('passwordScrypt'));
+        // Bound to the hash sign-in checks: the credential document's, else the
+        // legacy copy on the profile (AGL-3308).
+        const token = mintPasswordResetToken(hostId, memberDoc.id, await readMemberPasswordHash(hostRef, memberDoc));
         // `hostPublicOrigin`, not a hand-rolled apex (AGL-2195). This URL is
         // minted server-side and mailed out, so a wrong apex is not a display
         // bug — it is a live link on somebody else's domain.

package/src/lib/server/membership-recover.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-recover.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { resolveBrandingProfile } from '@aglyn/aglyn/server'\nimport { hostPublicOrigin } from '@aglyn/aglyn/server'\nimport {\n  consumeMembershipRecoverAttempt,\n  consumeMembershipRecoverSend,\n  firebaseAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  isEmailSuppressed,\n  meterHostEmail,\n  RECOVER_MIN_MEMBER_AGE_MS,\n} from '@aglyn/tenant-data-admin'\nimport { isEmailConfigured, sendEmail } from '@aglyn/shared-util-email'\nimport { mintPasswordResetToken } from './membership'\nimport { readClientIp } from '@aglyn/aglyn/app-utils/request-ip'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Password-recovery request (AGL-552). ALWAYS answers `200 {ok:true}` once\n * the input validates and the caller is inside its rate budget — whether or\n * not the email belongs to a member — so the endpoint can't be used to probe\n * account existence. When a member matches, a single-use one-hour token\n * (bound to the current password hash, see membership.ts) is mailed via\n * Resend with a link to the site's `/recover` route.\n *\n * ## Abuse controls (AGL-1966)\n *\n * This is an unauthenticated endpoint that makes us send mail from\n * `noreply@aglyn.com` to an address the caller chose, and it composes with\n * `membership/register` — which admits arbitrary addresses because member\n * accounts are unlimited on every plan (AGL-889) — into a mail relay. The\n * bounces from that land on the sending reputation shared by every customer's\n * transactional mail.\n *\n * Four controls, in the order they run, and the ORDER is part of each:\n *\n * 1. **Attempt caps** — per recipient and per IP, durable\n *    (`membership-recover-throttle.ts`). Consumed BEFORE the member lookup so\n *    a member and a non-member spend the identical budget and receive the\n *    identical answer; a visible 429 from here therefore leaks nothing. The\n *    per-instance `Map` this replaced reset on every cold start and was kept\n *    per instance, which on Vercel is close to no limit at all (AGL-794).\n * 2. **The young-member guard** — a member row created inside\n *    `RECOVER_MIN_MEMBER_AGE_MS` is not worth a reset mail. Register-then-\n *    recover is the whole attack and nobody forgets a password ten minutes\n *    after choosing it. Silent-success exit.\n * 3. **The platform suppression list** — see the note on the call below.\n *    Silent-success exit.\n * 4. **The per-site daily send ceiling** — consumed only when a message is\n *    actually about to go out. Because that branch is reachable only for real\n *    members, its refusal MUST be the silent-success exit rather than an\n *    error, or the ceiling becomes the oracle everything else avoids.\n *\n * What remains unbounded is stated rather than papered over: a genuine botnet\n * still gets `RECOVER_ATTEMPTS_PER_IP` per source, and an attacker who can\n * create many sites gets the per-site ceiling once per site. Host creation is\n * itself rate-limited, and bounding the botnet case needs an edge WAF, not an\n * application limiter — the same conclusion `plugin-api-rate-limit.ts` reaches.\n */\nexport const membershipRecoverHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  if (!hostId || !EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  // Null when nothing readable names the caller; the throttle then skips its\n  // per-source cap and the per-recipient one carries the control alone.\n  const ip = readClientIp(req.headers, {\n    remoteAddress: req.socket?.remoteAddress,\n  })\n  // Control 1. Before the lookup, so both branches spend the same budget.\n  // A store failure degrades to the in-process cap rather than refusing\n  // (`consumeRateLimit` fails soft on an unreachable store, closed on\n  // contention) — a Firestore blip must not lock every site's members out of\n  // their own password reset.\n  const attempt = await consumeMembershipRecoverAttempt({ email, ip })\n  if (!attempt.allowed) {\n    res.setHeader('Retry-After', String(attempt.retryAfterSeconds))\n    return res.status(429).json({ error: 'Too many attempts' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const [hostSnapshot, membersQuery] = await Promise.all([\n      hostRef.get(),\n      hostRef\n        .collection('siteMembers')\n        .where('email', '==', email)\n        .limit(1)\n        .get(),\n    ])\n    const memberDoc = membersQuery.docs[0]\n    // Unknown site, unknown email, suspended account (AGL-546): all take\n    // the same silent-success exit — the response never distinguishes.\n    if (\n      !hostSnapshot.exists ||\n      !memberDoc ||\n      memberDoc.get('suspended') === true\n    ) {\n      return res.status(200).json({ ok: true })\n    }\n    // Control 2 — the register-then-recover composition (AGL-1966).\n    //\n    // `createdAt` is a server timestamp written by `membership-register.ts`.\n    // A row that has none is a legacy member, not a fresh one: rows predating\n    // the field must NOT be refused, so an unreadable or absent value reads as\n    // \"old enough\". This guard exists to refuse a member created seconds ago,\n    // which is a case where the field is always present by construction.\n    const createdAtMs = (() => {\n      const raw = memberDoc.get('createdAt') as\n        | { toMillis?: () => number }\n        | undefined\n      try {\n        return typeof raw?.toMillis === 'function' ? raw.toMillis() : null\n      } catch {\n        return null\n      }\n    })()\n    if (\n      createdAtMs !== null &&\n      Date.now() - createdAtMs < RECOVER_MIN_MEMBER_AGE_MS\n    ) {\n      return res.status(200).json({ ok: true })\n    }\n    // Control 3 — the platform suppression list (AGL-1918 / AGL-2407).\n    //\n    // `email-suppression.ts` argues that TRANSACTIONAL mail deliberately does\n    // not consult this list, because refusing a password reset over an\n    // unrelated old bounce locks a real customer out of their own account.\n    // That argument is about mail a signed-in human just asked us for. It does\n    // not reach here, and this is the exception it does not cover:\n    //\n    //  - The address is chosen by an ANONYMOUS caller, not by the account\n    //    holder. \"The human just did something\" is exactly the premise that is\n    //    missing on an unauthenticated endpoint.\n    //  - The list holds PERMANENT bounces and spam complaints only — transient\n    //    bounces are excluded at the webhook. A permanent bounce means the\n    //    mailbox does not exist, so the send cannot reach anyone; all it can do\n    //    is tell a provider that `aglyn.com` re-mails dead addresses. There is\n    //    no locked-out customer on the other side of it to protect.\n    //  - The reputational cost is shared by every customer's transactional\n    //    mail, which is precisely what AGL-1966 is about.\n    //\n    // The HOST list (`hosts/{hostId}/suppressions`) is deliberately NOT\n    // consulted: it also holds marketing unsubscribes, and unsubscribing from\n    // a store's newsletter must never stop that store's password resets.\n    //\n    // `isEmailSuppressed` fails CLOSED — a read that throws answers \"treat as\n    // suppressed\". That adds no new outage mode here: the member lookup above\n    // is a Firestore read on the same database, so a Firestore outage has\n    // already taken this handler to its silent-success catch.\n    if (await isEmailSuppressed(email)) {\n      return res.status(200).json({ ok: true })\n    }\n    if (!isEmailConfigured()) {\n      // Config gaps must not become an existence oracle either; log for\n      // the operator and keep the visitor-facing contract.\n      console.error('membership/recover: email is not configured')\n      return res.status(200).json({ ok: true })\n    }\n    const token = mintPasswordResetToken(\n      hostId,\n      memberDoc.id,\n      memberDoc.get('passwordScrypt'),\n    )\n    // `hostPublicOrigin`, not a hand-rolled apex (AGL-2195). This URL is\n    // minted server-side and mailed out, so a wrong apex is not a display\n    // bug — it is a live link on somebody else's domain.\n    const siteBase =\n      hostPublicOrigin({\n        cname: hostSnapshot.get('cname'),\n        subdomain: hostSnapshot.get('subdomain'),\n      }) ?? ''\n    const resetUrl = `${siteBase}/recover?token=${encodeURIComponent(token)}`\n    const siteName = String(\n      hostSnapshot.get('displayName') ?? hostSnapshot.get('subdomain') ?? 'your site',\n    )\n    // White-label sender identity (White-Label Phase 3): the store's brand via\n    // the one shared resolver (the copy already uses the site name).\n    const branding = resolveBrandingProfile(\n      (await getOrgForHost(hostId).catch(() => null))?.org as never,\n    )\n    // Control 4 — the per-site daily ceiling on recovery mail (AGL-1966).\n    //\n    // Consumed here, as late as possible, because it counts MESSAGES and not\n    // requests: everything above this line can refuse without having decided\n    // to send, and a counter that ticked for those would exhaust a site's\n    // budget on traffic that never cost a message.\n    //\n    // The refusal is the silent-success exit, NOT a 429. This branch is\n    // reachable only for an address that really is a member, so a visible\n    // error here would be the existence oracle the whole handler is built to\n    // avoid — the one place where the cheap answer is the wrong one.\n    //\n    // The accepted cost: during an attack on a site, a genuine member can get\n    // no mail and no error. The ceiling is sized more than an order of\n    // magnitude above any real site's daily resets so that reaching it is\n    // evidence of the attack rather than of a busy Tuesday.\n    const sendBudget = await consumeMembershipRecoverSend({ hostId })\n    if (!sendBudget.allowed) {\n      console.error('membership/recover: daily send ceiling reached', {\n        hostId,\n        retryAfterSeconds: sendBudget.retryAfterSeconds,\n      })\n      return res.status(200).json({ ok: true })\n    }\n    await sendEmail({\n      to: email,\n      subject: `Reset your ${siteName} password`,\n      text:\n        `Someone asked to reset the password for your ${siteName} ` +\n        'account. If that was you, set a new password here:\\n\\n' +\n        `${resetUrl}\\n\\n` +\n        'The link works once and expires in 1 hour. If you did not ' +\n        'ask for this, you can safely ignore this email — your ' +\n        'password is unchanged.',\n      fromName: branding.fromName,\n      sendingIdentity: await hostSendingIdentity(hostId),\n      audience: 'tenant',\n      context: 'membership recovery',\n    })\n    // Cost meter (AGL-1438). Transactional, and the clearest case for why a\n    // quota may not refuse one: this email is how the member gets back into\n    // their account.\n    await meterHostEmail(hostId)\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    // Even a backend failure stays silent-success: the enumeration\n    // contract beats the visitor's error visibility here, and the send is\n    // best-effort by design.\n    return res.status(200).json({ ok: true })\n  }\n}\n"],"names":["resolveBrandingProfile","hostPublicOrigin","consumeMembershipRecoverAttempt","consumeMembershipRecoverSend","firebaseAdmin","getOrgForHost","hostSendingIdentity","isEmailSuppressed","meterHostEmail","RECOVER_MIN_MEMBER_AGE_MS","isEmailConfigured","sendEmail","mintPasswordResetToken","readClientIp","EMAIL_PATTERN","membershipRecoverHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","test","ip","headers","remoteAddress","socket","attempt","allowed","setHeader","retryAfterSeconds","hostSnapshot","firestore","app","hostRef","collection","doc","membersQuery","Promise","all","get","where","limit","memberDoc","docs","exists","ok","createdAtMs","raw","toMillis","Date","now","console","token","id","siteBase","cname","subdomain","resetUrl","encodeURIComponent","siteName","branding","catch","org","sendBudget","to","subject","text","fromName","sendingIdentity","audience","context"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,gBAAgB,QAAQ,sBAAqB;AACtD,SACEC,+BAA+B,EAC/BC,4BAA4B,EAC5BC,aAAa,EACbC,aAAa,EACbC,mBAAmB,EACnBC,iBAAiB,EACjBC,cAAc,EACdC,yBAAyB,QACpB,2BAA0B;AACjC,SAASC,iBAAiB,EAAEC,SAAS,QAAQ,2BAA0B;AACvE,SAASC,sBAAsB,QAAQ,kBAAc;AACrD,SAASC,YAAY,QAAQ,oCAAmC;AAEhE,MAAMC,gBAAgB;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,MAAMC,2BAA6C,OAAOC,KAAKC;;QAI9CD,WACDA,YASJA;IAbjB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,IAAI,CAACL,UAAU,CAACR,cAAcc,IAAI,CAACH,QAAQ;QACzC,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,2EAA2E;IAC3E,sEAAsE;IACtE,MAAMQ,KAAKhB,aAAaG,IAAIc,OAAO,EAAE;QACnCC,aAAa,GAAEf,cAAAA,IAAIgB,MAAM,qBAAVhB,YAAYe,aAAa;IAC1C;IACA,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAME,UAAU,MAAM/B,gCAAgC;QAAEuB;QAAOI;IAAG;IAClE,IAAI,CAACI,QAAQC,OAAO,EAAE;QACpBjB,IAAIkB,SAAS,CAAC,eAAeZ,OAAOU,QAAQG,iBAAiB;QAC7D,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoB;IAC3D;IACA,IAAI;YAyFApB,mBAMAoC,OAAAA;YAKC;QAnGH,MAAMC,YAAYlC,cAAcmC,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACpB;QAClD,MAAM,CAACe,cAAcM,aAAa,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACrDL,QAAQM,GAAG;YACXN,QACGC,UAAU,CAAC,eACXM,KAAK,CAAC,SAAS,MAAMtB,OACrBuB,KAAK,CAAC,GACNF,GAAG;SACP;QACD,MAAMG,YAAYN,aAAaO,IAAI,CAAC,EAAE;QACtC,qEAAqE;QACrE,mEAAmE;QACnE,IACE,CAACb,aAAac,MAAM,IACpB,CAACF,aACDA,UAAUH,GAAG,CAAC,iBAAiB,MAC/B;YACA,OAAO7B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,gEAAgE;QAChE,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAMC,cAAc,AAAC,CAAA;YACnB,MAAMC,MAAML,UAAUH,GAAG,CAAC;YAG1B,IAAI;gBACF,OAAO,QAAOQ,uBAAAA,IAAKC,QAAQ,MAAK,aAAaD,IAAIC,QAAQ,KAAK;YAChE,EAAE,eAAM;gBACN,OAAO;YACT;QACF,CAAA;QACA,IACEF,gBAAgB,QAChBG,KAAKC,GAAG,KAAKJ,cAAc5C,2BAC3B;YACA,OAAOQ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,mEAAmE;QACnE,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,+DAA+D;QAC/D,EAAE;QACF,sEAAsE;QACtE,2EAA2E;QAC3E,6CAA6C;QAC7C,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,gEAAgE;QAChE,uEAAuE;QACvE,sDAAsD;QACtD,EAAE;QACF,oEAAoE;QACpE,0EAA0E;QAC1E,qEAAqE;QACrE,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,MAAM7C,kBAAkBkB,QAAQ;YAClC,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,IAAI,CAAC1C,qBAAqB;YACxB,kEAAkE;YAClE,qDAAqD;YACrDgD,QAAQrC,KAAK,CAAC;YACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,MAAMO,QAAQ/C,uBACZU,QACA2B,UAAUW,EAAE,EACZX,UAAUH,GAAG,CAAC;QAEhB,qEAAqE;QACrE,sEAAsE;QACtE,qDAAqD;QACrD,MAAMe,YACJ5D,oBAAAA,iBAAiB;YACf6D,OAAOzB,aAAaS,GAAG,CAAC;YACxBiB,WAAW1B,aAAaS,GAAG,CAAC;QAC9B,cAHA7C,oBAGM;QACR,MAAM+D,WAAW,GAAGH,SAAS,eAAe,EAAEI,mBAAmBN,QAAQ;QACzE,MAAMO,WAAW3C,QACfc,SAAAA,oBAAAA,aAAaS,GAAG,CAAC,0BAAjBT,oBAAmCA,aAAaS,GAAG,CAAC,wBAApDT,QAAoE;QAEtE,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM8B,WAAWnE,wBACd,QAAA,MAAMK,cAAciB,QAAQ8C,KAAK,CAAC,IAAM,0BAAzC,AAAC,MAAgDC,GAAG;QAEtD,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,+CAA+C;QAC/C,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,iEAAiE;QACjE,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,sEAAsE;QACtE,wDAAwD;QACxD,MAAMC,aAAa,MAAMnE,6BAA6B;YAAEmB;QAAO;QAC/D,IAAI,CAACgD,WAAWpC,OAAO,EAAE;YACvBwB,QAAQrC,KAAK,CAAC,kDAAkD;gBAC9DC;gBACAc,mBAAmBkC,WAAWlC,iBAAiB;YACjD;YACA,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,MAAMzC,UAAU;YACd4D,IAAI9C;YACJ+C,SAAS,CAAC,WAAW,EAAEN,SAAS,SAAS,CAAC;YAC1CO,MACE,CAAC,6CAA6C,EAAEP,SAAS,CAAC,CAAC,GAC3D,2DACA,GAAGF,SAAS,IAAI,CAAC,GACjB,+DACA,2DACA;YACFU,UAAUP,SAASO,QAAQ;YAC3BC,iBAAiB,MAAMrE,oBAAoBgB;YAC3CsD,UAAU;YACVC,SAAS;QACX;QACA,wEAAwE;QACxE,wEAAwE;QACxE,iBAAiB;QACjB,MAAMrE,eAAec;QACrB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEgC,IAAI;QAAK;IACzC,EAAE,OAAO/B,OAAO;QACdqC,QAAQrC,KAAK,CAACA;QACd,+DAA+D;QAC/D,sEAAsE;QACtE,yBAAyB;QACzB,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEgC,IAAI;QAAK;IACzC;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-recover.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { resolveBrandingProfile } from '@aglyn/aglyn/server'\nimport { hostPublicOrigin } from '@aglyn/aglyn/server'\nimport {\n  consumeMembershipRecoverAttempt,\n  consumeMembershipRecoverSend,\n  firebaseAdmin,\n  getOrgForHost,\n  hostSendingIdentity,\n  isEmailSuppressed,\n  meterHostEmail,\n  RECOVER_MIN_MEMBER_AGE_MS,\n} from '@aglyn/tenant-data-admin'\nimport { isEmailConfigured, sendEmail } from '@aglyn/shared-util-email'\nimport { mintPasswordResetToken } from './membership'\nimport { readMemberPasswordHash } from './member-credentials'\nimport { readClientIp } from '@aglyn/aglyn/app-utils/request-ip'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Password-recovery request (AGL-552). ALWAYS answers `200 {ok:true}` once\n * the input validates and the caller is inside its rate budget — whether or\n * not the email belongs to a member — so the endpoint can't be used to probe\n * account existence. When a member matches, a single-use one-hour token\n * (bound to the current password hash, see membership.ts) is mailed via\n * Resend with a link to the site's `/recover` route.\n *\n * ## Abuse controls (AGL-1966)\n *\n * This is an unauthenticated endpoint that makes us send mail from\n * `noreply@aglyn.com` to an address the caller chose, and it composes with\n * `membership/register` — which admits arbitrary addresses because member\n * accounts are unlimited on every plan (AGL-889) — into a mail relay. The\n * bounces from that land on the sending reputation shared by every customer's\n * transactional mail.\n *\n * Four controls, in the order they run, and the ORDER is part of each:\n *\n * 1. **Attempt caps** — per recipient and per IP, durable\n *    (`membership-recover-throttle.ts`). Consumed BEFORE the member lookup so\n *    a member and a non-member spend the identical budget and receive the\n *    identical answer; a visible 429 from here therefore leaks nothing. The\n *    per-instance `Map` this replaced reset on every cold start and was kept\n *    per instance, which on Vercel is close to no limit at all (AGL-794).\n * 2. **The young-member guard** — a member row created inside\n *    `RECOVER_MIN_MEMBER_AGE_MS` is not worth a reset mail. Register-then-\n *    recover is the whole attack and nobody forgets a password ten minutes\n *    after choosing it. Silent-success exit.\n * 3. **The platform suppression list** — see the note on the call below.\n *    Silent-success exit.\n * 4. **The per-site daily send ceiling** — consumed only when a message is\n *    actually about to go out. Because that branch is reachable only for real\n *    members, its refusal MUST be the silent-success exit rather than an\n *    error, or the ceiling becomes the oracle everything else avoids.\n *\n * What remains unbounded is stated rather than papered over: a genuine botnet\n * still gets `RECOVER_ATTEMPTS_PER_IP` per source, and an attacker who can\n * create many sites gets the per-site ceiling once per site. Host creation is\n * itself rate-limited, and bounding the botnet case needs an edge WAF, not an\n * application limiter — the same conclusion `plugin-api-rate-limit.ts` reaches.\n */\nexport const membershipRecoverHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  if (!hostId || !EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  // Null when nothing readable names the caller; the throttle then skips its\n  // per-source cap and the per-recipient one carries the control alone.\n  const ip = readClientIp(req.headers, {\n    remoteAddress: req.socket?.remoteAddress,\n  })\n  // Control 1. Before the lookup, so both branches spend the same budget.\n  // A store failure degrades to the in-process cap rather than refusing\n  // (`consumeRateLimit` fails soft on an unreachable store, closed on\n  // contention) — a Firestore blip must not lock every site's members out of\n  // their own password reset.\n  const attempt = await consumeMembershipRecoverAttempt({ email, ip })\n  if (!attempt.allowed) {\n    res.setHeader('Retry-After', String(attempt.retryAfterSeconds))\n    return res.status(429).json({ error: 'Too many attempts' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const [hostSnapshot, membersQuery] = await Promise.all([\n      hostRef.get(),\n      hostRef\n        .collection('siteMembers')\n        .where('email', '==', email)\n        .limit(1)\n        .get(),\n    ])\n    const memberDoc = membersQuery.docs[0]\n    // Unknown site, unknown email, suspended account (AGL-546): all take\n    // the same silent-success exit — the response never distinguishes.\n    if (\n      !hostSnapshot.exists ||\n      !memberDoc ||\n      memberDoc.get('suspended') === true\n    ) {\n      return res.status(200).json({ ok: true })\n    }\n    // Control 2 — the register-then-recover composition (AGL-1966).\n    //\n    // `createdAt` is a server timestamp written by `membership-register.ts`.\n    // A row that has none is a legacy member, not a fresh one: rows predating\n    // the field must NOT be refused, so an unreadable or absent value reads as\n    // \"old enough\". This guard exists to refuse a member created seconds ago,\n    // which is a case where the field is always present by construction.\n    const createdAtMs = (() => {\n      const raw = memberDoc.get('createdAt') as\n        | { toMillis?: () => number }\n        | undefined\n      try {\n        return typeof raw?.toMillis === 'function' ? raw.toMillis() : null\n      } catch {\n        return null\n      }\n    })()\n    if (\n      createdAtMs !== null &&\n      Date.now() - createdAtMs < RECOVER_MIN_MEMBER_AGE_MS\n    ) {\n      return res.status(200).json({ ok: true })\n    }\n    // Control 3 — the platform suppression list (AGL-1918 / AGL-2407).\n    //\n    // `email-suppression.ts` argues that TRANSACTIONAL mail deliberately does\n    // not consult this list, because refusing a password reset over an\n    // unrelated old bounce locks a real customer out of their own account.\n    // That argument is about mail a signed-in human just asked us for. It does\n    // not reach here, and this is the exception it does not cover:\n    //\n    //  - The address is chosen by an ANONYMOUS caller, not by the account\n    //    holder. \"The human just did something\" is exactly the premise that is\n    //    missing on an unauthenticated endpoint.\n    //  - The list holds PERMANENT bounces and spam complaints only — transient\n    //    bounces are excluded at the webhook. A permanent bounce means the\n    //    mailbox does not exist, so the send cannot reach anyone; all it can do\n    //    is tell a provider that `aglyn.com` re-mails dead addresses. There is\n    //    no locked-out customer on the other side of it to protect.\n    //  - The reputational cost is shared by every customer's transactional\n    //    mail, which is precisely what AGL-1966 is about.\n    //\n    // The HOST list (`hosts/{hostId}/suppressions`) is deliberately NOT\n    // consulted: it also holds marketing unsubscribes, and unsubscribing from\n    // a store's newsletter must never stop that store's password resets.\n    //\n    // `isEmailSuppressed` fails CLOSED — a read that throws answers \"treat as\n    // suppressed\". That adds no new outage mode here: the member lookup above\n    // is a Firestore read on the same database, so a Firestore outage has\n    // already taken this handler to its silent-success catch.\n    if (await isEmailSuppressed(email)) {\n      return res.status(200).json({ ok: true })\n    }\n    if (!isEmailConfigured()) {\n      // Config gaps must not become an existence oracle either; log for\n      // the operator and keep the visitor-facing contract.\n      console.error('membership/recover: email is not configured')\n      return res.status(200).json({ ok: true })\n    }\n    // Bound to the hash sign-in checks: the credential document's, else the\n    // legacy copy on the profile (AGL-3308).\n    const token = mintPasswordResetToken(\n      hostId,\n      memberDoc.id,\n      await readMemberPasswordHash(hostRef, memberDoc),\n    )\n    // `hostPublicOrigin`, not a hand-rolled apex (AGL-2195). This URL is\n    // minted server-side and mailed out, so a wrong apex is not a display\n    // bug — it is a live link on somebody else's domain.\n    const siteBase =\n      hostPublicOrigin({\n        cname: hostSnapshot.get('cname'),\n        subdomain: hostSnapshot.get('subdomain'),\n      }) ?? ''\n    const resetUrl = `${siteBase}/recover?token=${encodeURIComponent(token)}`\n    const siteName = String(\n      hostSnapshot.get('displayName') ?? hostSnapshot.get('subdomain') ?? 'your site',\n    )\n    // White-label sender identity (White-Label Phase 3): the store's brand via\n    // the one shared resolver (the copy already uses the site name).\n    const branding = resolveBrandingProfile(\n      (await getOrgForHost(hostId).catch(() => null))?.org as never,\n    )\n    // Control 4 — the per-site daily ceiling on recovery mail (AGL-1966).\n    //\n    // Consumed here, as late as possible, because it counts MESSAGES and not\n    // requests: everything above this line can refuse without having decided\n    // to send, and a counter that ticked for those would exhaust a site's\n    // budget on traffic that never cost a message.\n    //\n    // The refusal is the silent-success exit, NOT a 429. This branch is\n    // reachable only for an address that really is a member, so a visible\n    // error here would be the existence oracle the whole handler is built to\n    // avoid — the one place where the cheap answer is the wrong one.\n    //\n    // The accepted cost: during an attack on a site, a genuine member can get\n    // no mail and no error. The ceiling is sized more than an order of\n    // magnitude above any real site's daily resets so that reaching it is\n    // evidence of the attack rather than of a busy Tuesday.\n    const sendBudget = await consumeMembershipRecoverSend({ hostId })\n    if (!sendBudget.allowed) {\n      console.error('membership/recover: daily send ceiling reached', {\n        hostId,\n        retryAfterSeconds: sendBudget.retryAfterSeconds,\n      })\n      return res.status(200).json({ ok: true })\n    }\n    await sendEmail({\n      to: email,\n      subject: `Reset your ${siteName} password`,\n      text:\n        `Someone asked to reset the password for your ${siteName} ` +\n        'account. If that was you, set a new password here:\\n\\n' +\n        `${resetUrl}\\n\\n` +\n        'The link works once and expires in 1 hour. If you did not ' +\n        'ask for this, you can safely ignore this email — your ' +\n        'password is unchanged.',\n      fromName: branding.fromName,\n      sendingIdentity: await hostSendingIdentity(hostId),\n      audience: 'tenant',\n      context: 'membership recovery',\n    })\n    // Cost meter (AGL-1438). Transactional, and the clearest case for why a\n    // quota may not refuse one: this email is how the member gets back into\n    // their account.\n    await meterHostEmail(hostId)\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    // Even a backend failure stays silent-success: the enumeration\n    // contract beats the visitor's error visibility here, and the send is\n    // best-effort by design.\n    return res.status(200).json({ ok: true })\n  }\n}\n"],"names":["resolveBrandingProfile","hostPublicOrigin","consumeMembershipRecoverAttempt","consumeMembershipRecoverSend","firebaseAdmin","getOrgForHost","hostSendingIdentity","isEmailSuppressed","meterHostEmail","RECOVER_MIN_MEMBER_AGE_MS","isEmailConfigured","sendEmail","mintPasswordResetToken","readMemberPasswordHash","readClientIp","EMAIL_PATTERN","membershipRecoverHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","test","ip","headers","remoteAddress","socket","attempt","allowed","setHeader","retryAfterSeconds","hostSnapshot","firestore","app","hostRef","collection","doc","membersQuery","Promise","all","get","where","limit","memberDoc","docs","exists","ok","createdAtMs","raw","toMillis","Date","now","console","token","id","siteBase","cname","subdomain","resetUrl","encodeURIComponent","siteName","branding","catch","org","sendBudget","to","subject","text","fromName","sendingIdentity","audience","context"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,sBAAsB,QAAQ,sBAAqB;AAC5D,SAASC,gBAAgB,QAAQ,sBAAqB;AACtD,SACEC,+BAA+B,EAC/BC,4BAA4B,EAC5BC,aAAa,EACbC,aAAa,EACbC,mBAAmB,EACnBC,iBAAiB,EACjBC,cAAc,EACdC,yBAAyB,QACpB,2BAA0B;AACjC,SAASC,iBAAiB,EAAEC,SAAS,QAAQ,2BAA0B;AACvE,SAASC,sBAAsB,QAAQ,kBAAc;AACrD,SAASC,sBAAsB,QAAQ,0BAAsB;AAC7D,SAASC,YAAY,QAAQ,oCAAmC;AAEhE,MAAMC,gBAAgB;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,MAAMC,2BAA6C,OAAOC,KAAKC;;QAI9CD,WACDA,YASJA;IAbjB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,IAAI,CAACL,UAAU,CAACR,cAAcc,IAAI,CAACH,QAAQ;QACzC,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,2EAA2E;IAC3E,sEAAsE;IACtE,MAAMQ,KAAKhB,aAAaG,IAAIc,OAAO,EAAE;QACnCC,aAAa,GAAEf,cAAAA,IAAIgB,MAAM,qBAAVhB,YAAYe,aAAa;IAC1C;IACA,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAME,UAAU,MAAMhC,gCAAgC;QAAEwB;QAAOI;IAAG;IAClE,IAAI,CAACI,QAAQC,OAAO,EAAE;QACpBjB,IAAIkB,SAAS,CAAC,eAAeZ,OAAOU,QAAQG,iBAAiB;QAC7D,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoB;IAC3D;IACA,IAAI;YA2FArB,mBAMAqC,OAAAA;YAKC;QArGH,MAAMC,YAAYnC,cAAcoC,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACpB;QAClD,MAAM,CAACe,cAAcM,aAAa,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACrDL,QAAQM,GAAG;YACXN,QACGC,UAAU,CAAC,eACXM,KAAK,CAAC,SAAS,MAAMtB,OACrBuB,KAAK,CAAC,GACNF,GAAG;SACP;QACD,MAAMG,YAAYN,aAAaO,IAAI,CAAC,EAAE;QACtC,qEAAqE;QACrE,mEAAmE;QACnE,IACE,CAACb,aAAac,MAAM,IACpB,CAACF,aACDA,UAAUH,GAAG,CAAC,iBAAiB,MAC/B;YACA,OAAO7B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,gEAAgE;QAChE,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAMC,cAAc,AAAC,CAAA;YACnB,MAAMC,MAAML,UAAUH,GAAG,CAAC;YAG1B,IAAI;gBACF,OAAO,QAAOQ,uBAAAA,IAAKC,QAAQ,MAAK,aAAaD,IAAIC,QAAQ,KAAK;YAChE,EAAE,eAAM;gBACN,OAAO;YACT;QACF,CAAA;QACA,IACEF,gBAAgB,QAChBG,KAAKC,GAAG,KAAKJ,cAAc7C,2BAC3B;YACA,OAAOS,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,mEAAmE;QACnE,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,+DAA+D;QAC/D,EAAE;QACF,sEAAsE;QACtE,2EAA2E;QAC3E,6CAA6C;QAC7C,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,gEAAgE;QAChE,uEAAuE;QACvE,sDAAsD;QACtD,EAAE;QACF,oEAAoE;QACpE,0EAA0E;QAC1E,qEAAqE;QACrE,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,MAAM9C,kBAAkBmB,QAAQ;YAClC,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,IAAI,CAAC3C,qBAAqB;YACxB,kEAAkE;YAClE,qDAAqD;YACrDiD,QAAQrC,KAAK,CAAC;YACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,wEAAwE;QACxE,yCAAyC;QACzC,MAAMO,QAAQhD,uBACZW,QACA2B,UAAUW,EAAE,EACZ,MAAMhD,uBAAuB4B,SAASS;QAExC,qEAAqE;QACrE,sEAAsE;QACtE,qDAAqD;QACrD,MAAMY,YACJ7D,oBAAAA,iBAAiB;YACf8D,OAAOzB,aAAaS,GAAG,CAAC;YACxBiB,WAAW1B,aAAaS,GAAG,CAAC;QAC9B,cAHA9C,oBAGM;QACR,MAAMgE,WAAW,GAAGH,SAAS,eAAe,EAAEI,mBAAmBN,QAAQ;QACzE,MAAMO,WAAW3C,QACfc,SAAAA,oBAAAA,aAAaS,GAAG,CAAC,0BAAjBT,oBAAmCA,aAAaS,GAAG,CAAC,wBAApDT,QAAoE;QAEtE,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM8B,WAAWpE,wBACd,QAAA,MAAMK,cAAckB,QAAQ8C,KAAK,CAAC,IAAM,0BAAzC,AAAC,MAAgDC,GAAG;QAEtD,sEAAsE;QACtE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,+CAA+C;QAC/C,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,yEAAyE;QACzE,iEAAiE;QACjE,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,sEAAsE;QACtE,wDAAwD;QACxD,MAAMC,aAAa,MAAMpE,6BAA6B;YAAEoB;QAAO;QAC/D,IAAI,CAACgD,WAAWpC,OAAO,EAAE;YACvBwB,QAAQrC,KAAK,CAAC,kDAAkD;gBAC9DC;gBACAc,mBAAmBkC,WAAWlC,iBAAiB;YACjD;YACA,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEgC,IAAI;YAAK;QACzC;QACA,MAAM1C,UAAU;YACd6D,IAAI9C;YACJ+C,SAAS,CAAC,WAAW,EAAEN,SAAS,SAAS,CAAC;YAC1CO,MACE,CAAC,6CAA6C,EAAEP,SAAS,CAAC,CAAC,GAC3D,2DACA,GAAGF,SAAS,IAAI,CAAC,GACjB,+DACA,2DACA;YACFU,UAAUP,SAASO,QAAQ;YAC3BC,iBAAiB,MAAMtE,oBAAoBiB;YAC3CsD,UAAU;YACVC,SAAS;QACX;QACA,wEAAwE;QACxE,wEAAwE;QACxE,iBAAiB;QACjB,MAAMtE,eAAee;QACrB,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEgC,IAAI;QAAK;IACzC,EAAE,OAAO/B,OAAO;QACdqC,QAAQrC,KAAK,CAACA;QACd,+DAA+D;QAC/D,sEAAsE;QACtE,yBAAyB;QACzB,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEgC,IAAI;QAAK;IACzC;AACF,EAAC"}

package/src/lib/server/membership-register.d.ts

@@ -16,7 +16,8 @@
  */
 import type { PluginApiHandler } from '@aglyn/aglyn/server';
 /**
- * Site member sign-up (AGL-109): creates the member record (scrypt hash),
- * doubles as a lead, and signs the visitor in via the session cookie.
+ * Site member sign-up (AGL-109): creates the member record and its credential
+ * document (the scrypt hash, AGL-3308), doubles as a lead, and signs the
+ * visitor in via the session cookie.
  */
 export declare const membershipRegisterHandler: PluginApiHandler;

package/src/lib/server/membership-register.js

@@ -20,10 +20,12 @@ import { firebaseAdmin, recordVisitorRecordCeilingTrip, resolveCampaignTouch } f
 import { emitHostEvent } from "@aglyn/tenant-runtime";
 import recordCapturedContact from "@aglyn/aglyn/plugin-manager/record-captured-contact";
 import { hashMemberPassword, mintMemberSession, setMemberCookie } from "./membership.js";
+import { memberCredentialRef } from "./member-credentials.js";
 const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 /**
- * Site member sign-up (AGL-109): creates the member record (scrypt hash),
- * doubles as a lead, and signs the visitor in via the session cookie.
+ * Site member sign-up (AGL-109): creates the member record and its credential
+ * document (the scrypt hash, AGL-3308), doubles as a lead, and signs the
+ * visitor in via the session cookie.
  */ export const membershipRegisterHandler = async (req, res)=>{
     var _ref, _ref1, _ref2, _ref3;
     var _req_body, _req_body1, _req_body2, _req_body3, _req_body4;
@@ -117,11 +119,15 @@ const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
                 duplicate: false,
                 ceiling: verdict.ceiling
             };
+            // The hash goes to the credential document, which no client can read
+            // (AGL-3308), and in this transaction, so a member never exists without
+            // the password they chose. The profile below is what the console lists.
+            tx.set(memberCredentialRef(hostRef, memberRef.id), {
+                passwordScrypt: hashMemberPassword(password)
+            });
             tx.create(memberRef, _extends({
                 email
-            }, displayName ? memberNameSearchFields(displayName) : {}, {
-                passwordScrypt: hashMemberPassword(password)
-            }, marketingConsent ? marketingConsentFieldsForHost(hostId, Date.now()) : {}, {
+            }, displayName ? memberNameSearchFields(displayName) : {}, marketingConsent ? marketingConsentFieldsForHost(hostId, Date.now()) : {}, {
                 createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
             }));
             return null;

package/src/lib/server/membership-register.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-register.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { memberNameSearchFields } from './member-name-search'\nimport {\n  checkVisitorRecordCeiling,\n  HOST_TOKENS,\n  marketingConsentFieldsForHost,\n  SITE_MEMBER_CEILING_CODE,\n  SITE_MEMBER_UNAVAILABLE_MESSAGE,\n  SITE_MEMBERS_MAX_PER_HOST,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  recordVisitorRecordCeilingTrip,\n  resolveCampaignTouch,\n} from '@aglyn/tenant-data-admin'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport recordCapturedContact from '@aglyn/aglyn/plugin-manager/record-captured-contact'\nimport {\n  hashMemberPassword,\n  mintMemberSession,\n  setMemberCookie,\n} from './membership'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Site member sign-up (AGL-109): creates the member record (scrypt hash),\n * doubles as a lead, and signs the visitor in via the session cookie.\n */\nexport const membershipRegisterHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  const password = String(req.body?.password ?? '')\n  const displayName = String(req.body?.displayName ?? '')\n    .trim()\n    .slice(0, 80)\n  // Explicit opt-in checkbox (AGL-2499) — never inferred from signing up.\n  const marketingConsent = req.body?.marketingConsent === true\n  if (!hostId) return res.status(400).json({ error: 'Missing host' })\n  if (!EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Enter a valid email' })\n  }\n  if (password.length < 8) {\n    return res\n      .status(400)\n      .json({ error: 'Password must be at least 8 characters' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // Member accounts are UNLIMITED on every plan (AGL-889) — no seat or\n    // quota check belongs here. Audience monetization happens downstream:\n    // contact bands meter the CRM projection (AGL-890) and paid\n    // memberships carry the plan's digital transaction fee (AGL-892).\n    //\n    // `SITE_MEMBERS_MAX_PER_HOST` below is NOT that check and does not make\n    // it one (AGL-1529). It is a flat PLATFORM ceiling — same number on every\n    // plan, no `OrgEntitlements` key, nothing on the price list — and it\n    // exists because this handler is reachable by an ANONYMOUS VISITOR, so\n    // without it the collection was bounded only by a per-(host, IP) rate\n    // limiter that fails soft and bounds the RATE rather than the TOTAL. An\n    // abuse control is not something we sell; \"unlimited member accounts on\n    // every plan\" stays literally true.\n    const membersRef = hostRef.collection('siteMembers')\n    const memberRef = membersRef.doc()\n    /*\n     * COUNT, DEDUPE AND CREATE IN ONE TRANSACTION (AGL-1529, the AGL-2231\n     * treatment).\n     *\n     * Read-then-decide-then-`set()` is the create-time quota that laundered\n     * everywhere else in this repo: N concurrent sign-ups each read the same\n     * pre-count, each find room, and each land — and nothing re-counts\n     * afterwards, so the extra accounts are permanent. The fix is WHEN the\n     * count is evaluated, not the counting rule.\n     * `Transaction.get(AggregateQuery)` serialises the count against a\n     * concurrent create into this collection: the loser retries, re-reads the\n     * higher count and is refused. The duplicate-email read moves inside for\n     * free, which also closes the smaller race it always had — two\n     * simultaneous sign-ups on one address both saw `empty` and both wrote.\n     *\n     * ALL READS BEFORE THE WRITE, which Firestore requires.\n     *\n     * The scrypt hash sits between the last read and the create ON PURPOSE.\n     * It is ~100 ms of CPU and it is the most expensive thing in the request,\n     * so a refused sign-up must never pay it — hashing before the transaction\n     * would hand a flood a CPU amplifier on exactly the path the ceiling\n     * exists to contain, and would also be a regression, since today a\n     * duplicate-email refusal does not hash either. It is a pure computation,\n     * not an effect, so it does not violate the \"nothing happens in a\n     * transaction body\" rule the sibling routes state.\n     *\n     * A refusal is returned as DATA and rendered outside: a body that can run\n     * several times must not be the place a response is built.\n     */\n    const refusal = await firestore.runTransaction(async (tx) => {\n      const existing = await tx.get(membersRef.where('email', '==', email).limit(1))\n      if (!existing.empty) return { duplicate: true, ceiling: 0 }\n      const used = (await tx.get(membersRef.count())).data().count\n      // Live documents only, so removing a member in the inbox frees the slot.\n      const verdict = checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST)\n      if (verdict.exceeded) return { duplicate: false, ceiling: verdict.ceiling }\n      tx.create(memberRef, {\n        email,\n        ...(displayName ? memberNameSearchFields(displayName) : {}),\n        passwordScrypt: hashMemberPassword(password),\n        /*\n         * The checkbox is PERSISTED on the member, not only forwarded.\n         *\n         * It reached the lead and the contact from the two lines below and\n         * was dropped for this document, so `hosts/{hostId}/siteMembers` had\n         * no consent field of any kind and `audience: 'members'` had nothing\n         * for the send-time join to read — the audience could not be filtered\n         * even in principle (`docs/specs/email-overhaul.md` §1d/§3f). The\n         * other two documents are not a substitute: a member is deduped in\n         * this transaction while leads append every time, and contacts are\n         * ORG-scoped where a member is the site's own.\n         *\n         * Written only when ticked. Signing up is not opting in — that is why\n         * the checkbox exists and why it defaults unchecked — so the omitted\n         * case stores nothing and reads back as an unrecorded basis rather\n         * than as a refusal.\n         *\n         * Under this site's key even though `siteMembers` already lives\n         * beneath it, so that one reader answers for every silo — see\n         * `addHostLead`, which makes the same write for the same reason.\n         */\n        ...(marketingConsent\n          ? marketingConsentFieldsForHost(hostId, Date.now())\n          : {}),\n        createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      })\n      return null\n    })\n    if (refusal?.duplicate) {\n      return res.status(409).json({ error: 'That email is already a member' })\n    }\n    if (refusal) {\n      // Visible to the HOST — the rule that a control nobody can see in\n      // the console did not ship. Durable counter + one notification.\n      await recordVisitorRecordCeilingTrip({\n        hostRef,\n        hostId,\n        kind: 'siteMembers',\n        ceiling: refusal.ceiling,\n      })\n      // Opaque to the VISITOR, who is a stranger to this site and not our\n      // customer (AGL-1666's rules, restated in the message's own docblock).\n      // The one genuinely useful thing to hand them is a door that still\n      // opens, so the site's OWN published support address rides along when\n      // it has one — read through the host-token registry, whose description\n      // of this field is literally \"where visitors should write for help\".\n      // Nothing else off the host document may leave the console.\n      const contact = HOST_TOKENS['supportEmail']?.resolve(\n        hostSnapshot.data() as any,\n      )\n      return res.status(429).json({\n        error: SITE_MEMBER_UNAVAILABLE_MESSAGE,\n        // Machine-readable, because the dispatcher's rate limiter answers 429\n        // too and the status therefore discriminates nothing.\n        code: SITE_MEMBER_CEILING_CODE,\n        ...(contact ? { contact } : {}),\n      })\n    }\n    // Sign-ups double as leads for the site owner (AGL-109), through the one\n    // writer that enforces `LEADS_MAX_PER_HOST` (AGL-1529). A refused lead\n    // never fails the sign-up: the visitor asked for an account, not for a\n    // lead record, and the trip is recorded for the owner either way.\n    /*\n     * THE CAMPAIGN TOUCH, RESOLVED ONCE FOR THE WHOLE SIGN-UP.\n     *\n     * A sign-up is the identify moment for a visitor who has been anonymous\n     * until now, and it writes two records that a campaign can be credited\n     * with — the lead and the contact. One resolve, one keyed read, and the\n     * two cannot end up naming different campaigns.\n     *\n     * The MEMBER record itself is not attributed. A member is an account the\n     * visitor holds and the lead is the site's record of the same act, so\n     * crediting both would count one sign-up twice under two names.\n     */\n    const signedUpAtMs = Date.now()\n    const campaignTouch = await resolveCampaignTouch({\n      hostId,\n      wire: req.body?.campaignTouch,\n      email,\n      atMs: signedUpAtMs,\n    })\n    /*\n     * Contacts ingestion (AGL-197), reported to whichever plugin keeps people\n     * rather than written by this one (AGL-3080). Commerce knows it just met\n     * somebody; what a person record is belongs to the plugin that models it,\n     * and a workspace that keeps none is a quiet, correct answer here.\n     */\n    /*\n     * A member account is a RELATIONSHIP (AGL-3232): the person is a\n     * contact from this moment, and an open lead the site held for the\n     * address is closed as converted onto that contact by the record\n     * system — a sign-up files no lead of its own any more, the way a\n     * portal user is a contact and not a lead in Salesforce.\n     */\n    void recordCapturedContact({\n      /*\n       * Not resolved here. The record system keys a person on the SITE they\n       * were met on, so this costs the capture nothing — and resolving it\n       * would put a Firestore read in front of the writer, which is the one\n       * thing `recordCapturedContact` asks a door not to do.\n       */\n      orgId: '',\n      hostId,\n      identity: { email, name: displayName || undefined },\n      interaction: {\n        source: 'member',\n        refId: memberRef.id,\n        summary: 'Joined as a member',\n      },\n      surface: 'relationship',\n      // An account is a subscription to the site, not an enquiry (AGL-2612):\n      // the stage on the contact says only that the person asked to be\n      // kept. A floor, so a customer who opens an account stays a customer.\n      lifecycleFloor: 'subscriber',\n      ...(marketingConsent ? { marketingConsent: true } : {}),\n      // Where the visitor ARRIVED from — a fact about this visit and not\n      // about the person, which is what `detail` carries.\n      ...(campaignTouch ? { detail: { campaignTouch } } : {}),\n    })\n    // Event trigger (AGL-128/148). A sign-up is no longer a lead (AGL-3232),\n    // so the `lead` event is the lead surfaces' to emit.\n    await emitHostEvent(hostId, 'memberSignUp', { email })\n    setMemberCookie(res, hostId, mintMemberSession(hostId, memberRef.id))\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Sign-up failed' })\n  }\n}\n"],"names":["memberNameSearchFields","checkVisitorRecordCeiling","HOST_TOKENS","marketingConsentFieldsForHost","SITE_MEMBER_CEILING_CODE","SITE_MEMBER_UNAVAILABLE_MESSAGE","SITE_MEMBERS_MAX_PER_HOST","firebaseAdmin","recordVisitorRecordCeilingTrip","resolveCampaignTouch","emitHostEvent","recordCapturedContact","hashMemberPassword","mintMemberSession","setMemberCookie","EMAIL_PATTERN","membershipRegisterHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","password","displayName","slice","marketingConsent","test","length","firestore","app","hostRef","collection","doc","hostSnapshot","get","exists","membersRef","memberRef","refusal","runTransaction","tx","existing","where","limit","empty","duplicate","ceiling","used","count","data","verdict","exceeded","create","passwordScrypt","Date","now","createdAt","FieldValue","serverTimestamp","kind","contact","resolve","code","signedUpAtMs","campaignTouch","wire","atMs","orgId","identity","name","undefined","interaction","source","refId","id","summary","surface","lifecycleFloor","detail","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,sBAAsB,QAAQ,0BAAsB;AAC7D,SACEC,yBAAyB,EACzBC,WAAW,EACXC,6BAA6B,EAC7BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,yBAAyB,QACpB,sBAAqB;AAC5B,SACEC,aAAa,EACbC,8BAA8B,EAC9BC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,aAAa,QAAQ,wBAAuB;AACrD,OAAOC,2BAA2B,sDAAqD;AACvF,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,eAAe,QACV,kBAAc;AAErB,MAAMC,gBAAgB;AAEtB;;;CAGC,GACD,OAAO,MAAMC,4BAA8C,OAAOC,KAAKC;;QAI/CD,WACDA,YAGGA,YACGA,YAIFA;IAZzB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,MAAMC,cAAcN,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUa,WAAW,oBAAI,IACjDH,IAAI,GACJI,KAAK,CAAC,GAAG;IACZ,wEAAwE;IACxE,MAAMC,mBAAmBf,EAAAA,aAAAA,IAAIQ,IAAI,qBAARR,WAAUe,gBAAgB,MAAK;IACxD,IAAI,CAACT,QAAQ,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAe;IACjE,IAAI,CAACP,cAAckB,IAAI,CAACP,QAAQ;QAC9B,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsB;IAC7D;IACA,IAAIO,SAASK,MAAM,GAAG,GAAG;QACvB,OAAOhB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAyC;IAC5D;IACA,IAAI;YA2IML;QA1IR,MAAMkB,YAAY5B,cAAc6B,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMiB,eAAe,MAAMH,QAAQI,GAAG;QACtC,IAAI,CAACD,aAAaE,MAAM,EAAE;YACxB,OAAOxB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,qEAAqE;QACrE,sEAAsE;QACtE,4DAA4D;QAC5D,kEAAkE;QAClE,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,oCAAoC;QACpC,MAAMqB,aAAaN,QAAQC,UAAU,CAAC;QACtC,MAAMM,YAAYD,WAAWJ,GAAG;QAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BC,GACD,MAAMM,UAAU,MAAMV,UAAUW,cAAc,CAAC,OAAOC;YACpD,MAAMC,WAAW,MAAMD,GAAGN,GAAG,CAACE,WAAWM,KAAK,CAAC,SAAS,MAAMvB,OAAOwB,KAAK,CAAC;YAC3E,IAAI,CAACF,SAASG,KAAK,EAAE,OAAO;gBAAEC,WAAW;gBAAMC,SAAS;YAAE;YAC1D,MAAMC,OAAO,AAAC,CAAA,MAAMP,GAAGN,GAAG,CAACE,WAAWY,KAAK,GAAE,EAAGC,IAAI,GAAGD,KAAK;YAC5D,yEAAyE;YACzE,MAAME,UAAUxD,0BAA0BqD,MAAMhD;YAChD,IAAImD,QAAQC,QAAQ,EAAE,OAAO;gBAAEN,WAAW;gBAAOC,SAASI,QAAQJ,OAAO;YAAC;YAC1EN,GAAGY,MAAM,CAACf,WAAW;gBACnBlB;eACII,cAAc9B,uBAAuB8B,eAAe,CAAC;gBACzD8B,gBAAgBhD,mBAAmBiB;eAsB/BG,mBACA7B,8BAA8BoB,QAAQsC,KAAKC,GAAG,MAC9C,CAAC;gBACLC,WAAWxD,cAAc4B,SAAS,CAAC6B,UAAU,CAACC,eAAe;;YAE/D,OAAO;QACT;QACA,IAAIpB,2BAAAA,QAASO,SAAS,EAAE;YACtB,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;QACA,IAAIuB,SAAS;gBAgBK3C;YAfhB,kEAAkE;YAClE,gEAAgE;YAChE,MAAMM,+BAA+B;gBACnC6B;gBACAd;gBACA2C,MAAM;gBACNb,SAASR,QAAQQ,OAAO;YAC1B;YACA,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,4DAA4D;YAC5D,MAAMc,WAAUjE,4BAAAA,WAAW,CAAC,eAAe,qBAA3BA,0BAA6BkE,OAAO,CAClD5B,aAAagB,IAAI;YAEnB,OAAOtC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAOjB;gBACP,sEAAsE;gBACtE,sDAAsD;gBACtDgE,MAAMjE;eACF+D,UAAU;gBAAEA;YAAQ,IAAI,CAAC;QAEjC;QACA,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE;;;;;;;;;;;KAWC,GACD,MAAMG,eAAeT,KAAKC,GAAG;QAC7B,MAAMS,gBAAgB,MAAM9D,qBAAqB;YAC/Cc;YACAiD,IAAI,GAAEvD,aAAAA,IAAIQ,IAAI,qBAARR,WAAUsD,aAAa;YAC7B7C;YACA+C,MAAMH;QACR;QACA;;;;;KAKC,GACD;;;;;;KAMC,GACD,KAAK3D,sBAAsB;YACzB;;;;;OAKC,GACD+D,OAAO;YACPnD;YACAoD,UAAU;gBAAEjD;gBAAOkD,MAAM9C,eAAe+C;YAAU;YAClDC,aAAa;gBACXC,QAAQ;gBACRC,OAAOpC,UAAUqC,EAAE;gBACnBC,SAAS;YACX;YACAC,SAAS;YACT,uEAAuE;YACvE,iEAAiE;YACjE,sEAAsE;YACtEC,gBAAgB;WACZpD,mBAAmB;YAAEA,kBAAkB;QAAK,IAAI,CAAC,GAGjDuC,gBAAgB;YAAEc,QAAQ;gBAAEd;YAAc;QAAE,IAAI,CAAC;QAEvD,yEAAyE;QACzE,qDAAqD;QACrD,MAAM7D,cAAca,QAAQ,gBAAgB;YAAEG;QAAM;QACpDZ,gBAAgBI,KAAKK,QAAQV,kBAAkBU,QAAQqB,UAAUqC,EAAE;QACnE,OAAO/D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEiE,IAAI;QAAK;IACzC,EAAE,OAAOhE,OAAO;QACdiE,QAAQjE,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-register.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { memberNameSearchFields } from './member-name-search'\nimport {\n  checkVisitorRecordCeiling,\n  HOST_TOKENS,\n  marketingConsentFieldsForHost,\n  SITE_MEMBER_CEILING_CODE,\n  SITE_MEMBER_UNAVAILABLE_MESSAGE,\n  SITE_MEMBERS_MAX_PER_HOST,\n} from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  recordVisitorRecordCeilingTrip,\n  resolveCampaignTouch,\n} from '@aglyn/tenant-data-admin'\nimport { emitHostEvent } from '@aglyn/tenant-runtime'\nimport recordCapturedContact from '@aglyn/aglyn/plugin-manager/record-captured-contact'\nimport {\n  hashMemberPassword,\n  mintMemberSession,\n  setMemberCookie,\n} from './membership'\nimport { memberCredentialRef } from './member-credentials'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\n/**\n * Site member sign-up (AGL-109): creates the member record and its credential\n * document (the scrypt hash, AGL-3308), doubles as a lead, and signs the\n * visitor in via the session cookie.\n */\nexport const membershipRegisterHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const email = String(req.body?.email ?? '')\n    .trim()\n    .toLowerCase()\n  const password = String(req.body?.password ?? '')\n  const displayName = String(req.body?.displayName ?? '')\n    .trim()\n    .slice(0, 80)\n  // Explicit opt-in checkbox (AGL-2499) — never inferred from signing up.\n  const marketingConsent = req.body?.marketingConsent === true\n  if (!hostId) return res.status(400).json({ error: 'Missing host' })\n  if (!EMAIL_PATTERN.test(email)) {\n    return res.status(400).json({ error: 'Enter a valid email' })\n  }\n  if (password.length < 8) {\n    return res\n      .status(400)\n      .json({ error: 'Password must be at least 8 characters' })\n  }\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    // Member accounts are UNLIMITED on every plan (AGL-889) — no seat or\n    // quota check belongs here. Audience monetization happens downstream:\n    // contact bands meter the CRM projection (AGL-890) and paid\n    // memberships carry the plan's digital transaction fee (AGL-892).\n    //\n    // `SITE_MEMBERS_MAX_PER_HOST` below is NOT that check and does not make\n    // it one (AGL-1529). It is a flat PLATFORM ceiling — same number on every\n    // plan, no `OrgEntitlements` key, nothing on the price list — and it\n    // exists because this handler is reachable by an ANONYMOUS VISITOR, so\n    // without it the collection was bounded only by a per-(host, IP) rate\n    // limiter that fails soft and bounds the RATE rather than the TOTAL. An\n    // abuse control is not something we sell; \"unlimited member accounts on\n    // every plan\" stays literally true.\n    const membersRef = hostRef.collection('siteMembers')\n    const memberRef = membersRef.doc()\n    /*\n     * COUNT, DEDUPE AND CREATE IN ONE TRANSACTION (AGL-1529, the AGL-2231\n     * treatment).\n     *\n     * Read-then-decide-then-`set()` is the create-time quota that laundered\n     * everywhere else in this repo: N concurrent sign-ups each read the same\n     * pre-count, each find room, and each land — and nothing re-counts\n     * afterwards, so the extra accounts are permanent. The fix is WHEN the\n     * count is evaluated, not the counting rule.\n     * `Transaction.get(AggregateQuery)` serialises the count against a\n     * concurrent create into this collection: the loser retries, re-reads the\n     * higher count and is refused. The duplicate-email read moves inside for\n     * free, which also closes the smaller race it always had — two\n     * simultaneous sign-ups on one address both saw `empty` and both wrote.\n     *\n     * ALL READS BEFORE THE WRITE, which Firestore requires.\n     *\n     * The scrypt hash sits between the last read and the create ON PURPOSE.\n     * It is ~100 ms of CPU and it is the most expensive thing in the request,\n     * so a refused sign-up must never pay it — hashing before the transaction\n     * would hand a flood a CPU amplifier on exactly the path the ceiling\n     * exists to contain, and would also be a regression, since today a\n     * duplicate-email refusal does not hash either. It is a pure computation,\n     * not an effect, so it does not violate the \"nothing happens in a\n     * transaction body\" rule the sibling routes state.\n     *\n     * A refusal is returned as DATA and rendered outside: a body that can run\n     * several times must not be the place a response is built.\n     */\n    const refusal = await firestore.runTransaction(async (tx) => {\n      const existing = await tx.get(membersRef.where('email', '==', email).limit(1))\n      if (!existing.empty) return { duplicate: true, ceiling: 0 }\n      const used = (await tx.get(membersRef.count())).data().count\n      // Live documents only, so removing a member in the inbox frees the slot.\n      const verdict = checkVisitorRecordCeiling(used, SITE_MEMBERS_MAX_PER_HOST)\n      if (verdict.exceeded) return { duplicate: false, ceiling: verdict.ceiling }\n      // The hash goes to the credential document, which no client can read\n      // (AGL-3308), and in this transaction, so a member never exists without\n      // the password they chose. The profile below is what the console lists.\n      tx.set(memberCredentialRef(hostRef, memberRef.id), {\n        passwordScrypt: hashMemberPassword(password),\n      })\n      tx.create(memberRef, {\n        email,\n        ...(displayName ? memberNameSearchFields(displayName) : {}),\n        /*\n         * The checkbox is PERSISTED on the member, not only forwarded.\n         *\n         * It reached the lead and the contact from the two lines below and\n         * was dropped for this document, so `hosts/{hostId}/siteMembers` had\n         * no consent field of any kind and `audience: 'members'` had nothing\n         * for the send-time join to read — the audience could not be filtered\n         * even in principle (`docs/specs/email-overhaul.md` §1d/§3f). The\n         * other two documents are not a substitute: a member is deduped in\n         * this transaction while leads append every time, and contacts are\n         * ORG-scoped where a member is the site's own.\n         *\n         * Written only when ticked. Signing up is not opting in — that is why\n         * the checkbox exists and why it defaults unchecked — so the omitted\n         * case stores nothing and reads back as an unrecorded basis rather\n         * than as a refusal.\n         *\n         * Under this site's key even though `siteMembers` already lives\n         * beneath it, so that one reader answers for every silo — see\n         * `addHostLead`, which makes the same write for the same reason.\n         */\n        ...(marketingConsent\n          ? marketingConsentFieldsForHost(hostId, Date.now())\n          : {}),\n        createdAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      })\n      return null\n    })\n    if (refusal?.duplicate) {\n      return res.status(409).json({ error: 'That email is already a member' })\n    }\n    if (refusal) {\n      // Visible to the HOST — the rule that a control nobody can see in\n      // the console did not ship. Durable counter + one notification.\n      await recordVisitorRecordCeilingTrip({\n        hostRef,\n        hostId,\n        kind: 'siteMembers',\n        ceiling: refusal.ceiling,\n      })\n      // Opaque to the VISITOR, who is a stranger to this site and not our\n      // customer (AGL-1666's rules, restated in the message's own docblock).\n      // The one genuinely useful thing to hand them is a door that still\n      // opens, so the site's OWN published support address rides along when\n      // it has one — read through the host-token registry, whose description\n      // of this field is literally \"where visitors should write for help\".\n      // Nothing else off the host document may leave the console.\n      const contact = HOST_TOKENS['supportEmail']?.resolve(\n        hostSnapshot.data() as any,\n      )\n      return res.status(429).json({\n        error: SITE_MEMBER_UNAVAILABLE_MESSAGE,\n        // Machine-readable, because the dispatcher's rate limiter answers 429\n        // too and the status therefore discriminates nothing.\n        code: SITE_MEMBER_CEILING_CODE,\n        ...(contact ? { contact } : {}),\n      })\n    }\n    // Sign-ups double as leads for the site owner (AGL-109), through the one\n    // writer that enforces `LEADS_MAX_PER_HOST` (AGL-1529). A refused lead\n    // never fails the sign-up: the visitor asked for an account, not for a\n    // lead record, and the trip is recorded for the owner either way.\n    /*\n     * THE CAMPAIGN TOUCH, RESOLVED ONCE FOR THE WHOLE SIGN-UP.\n     *\n     * A sign-up is the identify moment for a visitor who has been anonymous\n     * until now, and it writes two records that a campaign can be credited\n     * with — the lead and the contact. One resolve, one keyed read, and the\n     * two cannot end up naming different campaigns.\n     *\n     * The MEMBER record itself is not attributed. A member is an account the\n     * visitor holds and the lead is the site's record of the same act, so\n     * crediting both would count one sign-up twice under two names.\n     */\n    const signedUpAtMs = Date.now()\n    const campaignTouch = await resolveCampaignTouch({\n      hostId,\n      wire: req.body?.campaignTouch,\n      email,\n      atMs: signedUpAtMs,\n    })\n    /*\n     * Contacts ingestion (AGL-197), reported to whichever plugin keeps people\n     * rather than written by this one (AGL-3080). Commerce knows it just met\n     * somebody; what a person record is belongs to the plugin that models it,\n     * and a workspace that keeps none is a quiet, correct answer here.\n     */\n    /*\n     * A member account is a RELATIONSHIP (AGL-3232): the person is a\n     * contact from this moment, and an open lead the site held for the\n     * address is closed as converted onto that contact by the record\n     * system — a sign-up files no lead of its own any more, the way a\n     * portal user is a contact and not a lead in Salesforce.\n     */\n    void recordCapturedContact({\n      /*\n       * Not resolved here. The record system keys a person on the SITE they\n       * were met on, so this costs the capture nothing — and resolving it\n       * would put a Firestore read in front of the writer, which is the one\n       * thing `recordCapturedContact` asks a door not to do.\n       */\n      orgId: '',\n      hostId,\n      identity: { email, name: displayName || undefined },\n      interaction: {\n        source: 'member',\n        refId: memberRef.id,\n        summary: 'Joined as a member',\n      },\n      surface: 'relationship',\n      // An account is a subscription to the site, not an enquiry (AGL-2612):\n      // the stage on the contact says only that the person asked to be\n      // kept. A floor, so a customer who opens an account stays a customer.\n      lifecycleFloor: 'subscriber',\n      ...(marketingConsent ? { marketingConsent: true } : {}),\n      // Where the visitor ARRIVED from — a fact about this visit and not\n      // about the person, which is what `detail` carries.\n      ...(campaignTouch ? { detail: { campaignTouch } } : {}),\n    })\n    // Event trigger (AGL-128/148). A sign-up is no longer a lead (AGL-3232),\n    // so the `lead` event is the lead surfaces' to emit.\n    await emitHostEvent(hostId, 'memberSignUp', { email })\n    setMemberCookie(res, hostId, mintMemberSession(hostId, memberRef.id))\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Sign-up failed' })\n  }\n}\n"],"names":["memberNameSearchFields","checkVisitorRecordCeiling","HOST_TOKENS","marketingConsentFieldsForHost","SITE_MEMBER_CEILING_CODE","SITE_MEMBER_UNAVAILABLE_MESSAGE","SITE_MEMBERS_MAX_PER_HOST","firebaseAdmin","recordVisitorRecordCeilingTrip","resolveCampaignTouch","emitHostEvent","recordCapturedContact","hashMemberPassword","mintMemberSession","setMemberCookie","memberCredentialRef","EMAIL_PATTERN","membershipRegisterHandler","req","res","method","status","json","error","hostId","String","body","email","trim","toLowerCase","password","displayName","slice","marketingConsent","test","length","firestore","app","hostRef","collection","doc","hostSnapshot","get","exists","membersRef","memberRef","refusal","runTransaction","tx","existing","where","limit","empty","duplicate","ceiling","used","count","data","verdict","exceeded","set","id","passwordScrypt","create","Date","now","createdAt","FieldValue","serverTimestamp","kind","contact","resolve","code","signedUpAtMs","campaignTouch","wire","atMs","orgId","identity","name","undefined","interaction","source","refId","summary","surface","lifecycleFloor","detail","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,sBAAsB,QAAQ,0BAAsB;AAC7D,SACEC,yBAAyB,EACzBC,WAAW,EACXC,6BAA6B,EAC7BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,yBAAyB,QACpB,sBAAqB;AAC5B,SACEC,aAAa,EACbC,8BAA8B,EAC9BC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,aAAa,QAAQ,wBAAuB;AACrD,OAAOC,2BAA2B,sDAAqD;AACvF,SACEC,kBAAkB,EAClBC,iBAAiB,EACjBC,eAAe,QACV,kBAAc;AACrB,SAASC,mBAAmB,QAAQ,0BAAsB;AAE1D,MAAMC,gBAAgB;AAEtB;;;;CAIC,GACD,OAAO,MAAMC,4BAA8C,OAAOC,KAAKC;;QAI/CD,WACDA,YAGGA,YACGA,YAIFA;IAZzB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI,IACrCC,IAAI,GACJC,WAAW;IACd,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,MAAMC,cAAcN,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUa,WAAW,oBAAI,IACjDH,IAAI,GACJI,KAAK,CAAC,GAAG;IACZ,wEAAwE;IACxE,MAAMC,mBAAmBf,EAAAA,aAAAA,IAAIQ,IAAI,qBAARR,WAAUe,gBAAgB,MAAK;IACxD,IAAI,CAACT,QAAQ,OAAOL,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAe;IACjE,IAAI,CAACP,cAAckB,IAAI,CAACP,QAAQ;QAC9B,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAsB;IAC7D;IACA,IAAIO,SAASK,MAAM,GAAG,GAAG;QACvB,OAAOhB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAyC;IAC5D;IACA,IAAI;YAgJML;QA/IR,MAAMkB,YAAY7B,cAAc8B,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAAChB;QAClD,MAAMiB,eAAe,MAAMH,QAAQI,GAAG;QACtC,IAAI,CAACD,aAAaE,MAAM,EAAE;YACxB,OAAOxB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,qEAAqE;QACrE,sEAAsE;QACtE,4DAA4D;QAC5D,kEAAkE;QAClE,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,oCAAoC;QACpC,MAAMqB,aAAaN,QAAQC,UAAU,CAAC;QACtC,MAAMM,YAAYD,WAAWJ,GAAG;QAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BC,GACD,MAAMM,UAAU,MAAMV,UAAUW,cAAc,CAAC,OAAOC;YACpD,MAAMC,WAAW,MAAMD,GAAGN,GAAG,CAACE,WAAWM,KAAK,CAAC,SAAS,MAAMvB,OAAOwB,KAAK,CAAC;YAC3E,IAAI,CAACF,SAASG,KAAK,EAAE,OAAO;gBAAEC,WAAW;gBAAMC,SAAS;YAAE;YAC1D,MAAMC,OAAO,AAAC,CAAA,MAAMP,GAAGN,GAAG,CAACE,WAAWY,KAAK,GAAE,EAAGC,IAAI,GAAGD,KAAK;YAC5D,yEAAyE;YACzE,MAAME,UAAUzD,0BAA0BsD,MAAMjD;YAChD,IAAIoD,QAAQC,QAAQ,EAAE,OAAO;gBAAEN,WAAW;gBAAOC,SAASI,QAAQJ,OAAO;YAAC;YAC1E,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxEN,GAAGY,GAAG,CAAC7C,oBAAoBuB,SAASO,UAAUgB,EAAE,GAAG;gBACjDC,gBAAgBlD,mBAAmBkB;YACrC;YACAkB,GAAGe,MAAM,CAAClB,WAAW;gBACnBlB;eACII,cAAc/B,uBAAuB+B,eAAe,CAAC,GAsBrDE,mBACA9B,8BAA8BqB,QAAQwC,KAAKC,GAAG,MAC9C,CAAC;gBACLC,WAAW3D,cAAc6B,SAAS,CAAC+B,UAAU,CAACC,eAAe;;YAE/D,OAAO;QACT;QACA,IAAItB,2BAAAA,QAASO,SAAS,EAAE;YACtB,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;QACA,IAAIuB,SAAS;gBAgBK5C;YAfhB,kEAAkE;YAClE,gEAAgE;YAChE,MAAMM,+BAA+B;gBACnC8B;gBACAd;gBACA6C,MAAM;gBACNf,SAASR,QAAQQ,OAAO;YAC1B;YACA,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,4DAA4D;YAC5D,MAAMgB,WAAUpE,4BAAAA,WAAW,CAAC,eAAe,qBAA3BA,0BAA6BqE,OAAO,CAClD9B,aAAagB,IAAI;YAEnB,OAAOtC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAOlB;gBACP,sEAAsE;gBACtE,sDAAsD;gBACtDmE,MAAMpE;eACFkE,UAAU;gBAAEA;YAAQ,IAAI,CAAC;QAEjC;QACA,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,kEAAkE;QAClE;;;;;;;;;;;KAWC,GACD,MAAMG,eAAeT,KAAKC,GAAG;QAC7B,MAAMS,gBAAgB,MAAMjE,qBAAqB;YAC/Ce;YACAmD,IAAI,GAAEzD,aAAAA,IAAIQ,IAAI,qBAARR,WAAUwD,aAAa;YAC7B/C;YACAiD,MAAMH;QACR;QACA;;;;;KAKC,GACD;;;;;;KAMC,GACD,KAAK9D,sBAAsB;YACzB;;;;;OAKC,GACDkE,OAAO;YACPrD;YACAsD,UAAU;gBAAEnD;gBAAOoD,MAAMhD,eAAeiD;YAAU;YAClDC,aAAa;gBACXC,QAAQ;gBACRC,OAAOtC,UAAUgB,EAAE;gBACnBuB,SAAS;YACX;YACAC,SAAS;YACT,uEAAuE;YACvE,iEAAiE;YACjE,sEAAsE;YACtEC,gBAAgB;WACZrD,mBAAmB;YAAEA,kBAAkB;QAAK,IAAI,CAAC,GAGjDyC,gBAAgB;YAAEa,QAAQ;gBAAEb;YAAc;QAAE,IAAI,CAAC;QAEvD,yEAAyE;QACzE,qDAAqD;QACrD,MAAMhE,cAAcc,QAAQ,gBAAgB;YAAEG;QAAM;QACpDb,gBAAgBK,KAAKK,QAAQX,kBAAkBW,QAAQqB,UAAUgB,EAAE;QACnE,OAAO1C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEkE,IAAI;QAAK;IACzC,EAAE,OAAOjE,OAAO;QACdkE,QAAQlE,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}

package/src/lib/server/membership-reset.d.ts

@@ -19,8 +19,14 @@ import type { PluginApiHandler } from '@aglyn/aglyn/server';
  * Password reset completion (AGL-552): verifies the recover token
  * (signature + expiry + binding to the member's CURRENT password hash —
  * so a completed reset invalidates every outstanding token) and writes the
- * new scrypt hash. No session is minted here; the client signs in through
- * the normal login route with the new password. Token guessing is a
- * non-issue (256-bit HMAC), so no extra damper beyond login's.
+ * new scrypt hash to the member's credential document (AGL-3308). No session
+ * is minted here; the client signs in through the normal login route with the
+ * new password. Token guessing is a non-issue (256-bit HMAC), so no extra
+ * damper beyond login's.
+ *
+ * ONE TRANSACTION, from the token check to the write. The hash the token is
+ * checked against is the hash the write replaces, so two submissions of one
+ * link cannot both land — the second re-reads the new hash and fails the
+ * binding — and a member removed mid-request is not recreated as a stub.
  */
 export declare const membershipResetHandler: PluginApiHandler;

package/src/lib/server/membership-reset.js

@@ -15,13 +15,20 @@
  * limitations under the License.
  */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
 import { MEMBER_SUSPENDED_ERROR, hashMemberPassword, passwordResetTokenMemberId, verifyPasswordResetToken } from "./membership.js";
+import { isMemberDocumentId, memberCredentialRef, retiredCredentialFields, storedPasswordHash } from "./member-credentials.js";
 /**
  * Password reset completion (AGL-552): verifies the recover token
  * (signature + expiry + binding to the member's CURRENT password hash —
  * so a completed reset invalidates every outstanding token) and writes the
- * new scrypt hash. No session is minted here; the client signs in through
- * the normal login route with the new password. Token guessing is a
- * non-issue (256-bit HMAC), so no extra damper beyond login's.
+ * new scrypt hash to the member's credential document (AGL-3308). No session
+ * is minted here; the client signs in through the normal login route with the
+ * new password. Token guessing is a non-issue (256-bit HMAC), so no extra
+ * damper beyond login's.
+ *
+ * ONE TRANSACTION, from the token check to the write. The hash the token is
+ * checked against is the hash the write replaces, so two submissions of one
+ * link cannot both land — the second re-reads the new hash and fails the
+ * binding — and a member removed mid-request is not recreated as a stub.
  */ export const membershipResetHandler = async (req, res)=>{
     var _ref, _ref1, _ref2;
     var _req_body, _req_body1, _req_body2;
@@ -49,31 +56,43 @@ import { MEMBER_SUSPENDED_ERROR, hashMemberPassword, passwordResetTokenMemberId,
     // Structural pre-check only (host + expiry); the signature binds to the
     // member's current hash, which we have to load first.
     const memberId = passwordResetTokenMemberId(hostId, token);
-    if (!memberId) return invalid();
+    if (!memberId || !isMemberDocumentId(memberId)) return invalid();
     try {
         const firestore = firebaseAdmin.app().firestore();
-        const memberRef = firestore.collection('hosts').doc(hostId).collection('siteMembers').doc(memberId);
-        const memberDoc = await memberRef.get();
-        if (!memberDoc.exists) return invalid();
-        if (!verifyPasswordResetToken(hostId, token, memberDoc.get('passwordScrypt'))) {
-            return invalid();
-        }
-        // Suspension gate (AGL-546/550): a token minted before the
-        // suspension stays cryptographically valid for its hour, so reject
-        // here — recovery must not rehabilitate a suspended account. Checked
-        // AFTER the signature so only the mailed-link holder (who already
-        // knows the account exists) can observe the suspension.
-        if (memberDoc.get('suspended') === true) {
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const memberRef = hostRef.collection('siteMembers').doc(memberId);
+        const credentialRef = memberCredentialRef(hostRef, memberId);
+        // Hashed once, however often the body retries, and only for a link that
+        // verified: ~100 ms of CPU is not spent on a stale or forged token.
+        let newHash;
+        const outcome = await firestore.runTransaction(async (tx)=>{
+            const [memberDoc, credentialDoc] = await tx.getAll(memberRef, credentialRef);
+            if (!memberDoc.exists) return 'invalid';
+            if (!verifyPasswordResetToken(hostId, token, storedPasswordHash(credentialDoc, memberDoc))) {
+                return 'invalid';
+            }
+            // Suspension gate (AGL-546/550): a token minted before the
+            // suspension stays cryptographically valid for its hour, so reject
+            // here — recovery must not rehabilitate a suspended account. Checked
+            // AFTER the signature so only the mailed-link holder (who already
+            // knows the account exists) can observe the suspension.
+            if (memberDoc.get('suspended') === true) return 'suspended';
+            newHash != null ? newHash : newHash = hashMemberPassword(password);
+            tx.set(credentialRef, {
+                passwordScrypt: newHash,
+                passwordResetAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+            }, {
+                merge: true
+            });
+            tx.update(memberRef, retiredCredentialFields());
+            return 'reset';
+        });
+        if (outcome === 'invalid') return invalid();
+        if (outcome === 'suspended') {
             return res.status(403).json({
                 error: MEMBER_SUSPENDED_ERROR
             });
         }
-        await memberRef.set({
-            passwordScrypt: hashMemberPassword(password),
-            passwordResetAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
-        }, {
-            merge: true
-        });
         return res.status(200).json({
             ok: true
         });

package/src/lib/server/membership-reset.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-reset.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  MEMBER_SUSPENDED_ERROR,\n  hashMemberPassword,\n  passwordResetTokenMemberId,\n  verifyPasswordResetToken,\n} from './membership'\n\n/**\n * Password reset completion (AGL-552): verifies the recover token\n * (signature + expiry + binding to the member's CURRENT password hash —\n * so a completed reset invalidates every outstanding token) and writes the\n * new scrypt hash. No session is minted here; the client signs in through\n * the normal login route with the new password. Token guessing is a\n * non-issue (256-bit HMAC), so no extra damper beyond login's.\n */\nexport const membershipResetHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const token = String(req.body?.token ?? '')\n  const password = String(req.body?.password ?? '')\n  if (!hostId || !token) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  if (password.length < 8) {\n    return res\n      .status(400)\n      .json({ error: 'Password must be at least 8 characters' })\n  }\n  const invalid = () =>\n    res.status(400).json({\n      error: 'That reset link is invalid or has expired — request a new one.',\n    })\n  // Structural pre-check only (host + expiry); the signature binds to the\n  // member's current hash, which we have to load first.\n  const memberId = passwordResetTokenMemberId(hostId, token)\n  if (!memberId) return invalid()\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const memberRef = firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('siteMembers')\n      .doc(memberId)\n    const memberDoc = await memberRef.get()\n    if (!memberDoc.exists) return invalid()\n    if (\n      !verifyPasswordResetToken(hostId, token, memberDoc.get('passwordScrypt'))\n    ) {\n      return invalid()\n    }\n    // Suspension gate (AGL-546/550): a token minted before the\n    // suspension stays cryptographically valid for its hour, so reject\n    // here — recovery must not rehabilitate a suspended account. Checked\n    // AFTER the signature so only the mailed-link holder (who already\n    // knows the account exists) can observe the suspension.\n    if (memberDoc.get('suspended') === true) {\n      return res.status(403).json({ error: MEMBER_SUSPENDED_ERROR })\n    }\n    await memberRef.set(\n      {\n        passwordScrypt: hashMemberPassword(password),\n        passwordResetAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Reset failed' })\n  }\n}\n"],"names":["firebaseAdmin","MEMBER_SUSPENDED_ERROR","hashMemberPassword","passwordResetTokenMemberId","verifyPasswordResetToken","membershipResetHandler","req","res","method","status","json","error","hostId","String","body","token","password","length","invalid","memberId","firestore","app","memberRef","collection","doc","memberDoc","get","exists","set","passwordScrypt","passwordResetAt","FieldValue","serverTimestamp","merge","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SACEC,sBAAsB,EACtBC,kBAAkB,EAClBC,0BAA0B,EAC1BC,wBAAwB,QACnB,kBAAc;AAErB;;;;;;;CAOC,GACD,OAAO,MAAMC,yBAA2C,OAAOC,KAAKC;;QAI5CD,WACDA,YACGA;IALxB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI;IACxC,MAAMC,WAAWH,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUU,QAAQ,oBAAI;IAC9C,IAAI,CAACJ,UAAU,CAACG,OAAO;QACrB,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,IAAIK,SAASC,MAAM,GAAG,GAAG;QACvB,OAAOV,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAyC;IAC5D;IACA,MAAMO,UAAU,IACdX,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YACnBC,OAAO;QACT;IACF,wEAAwE;IACxE,sDAAsD;IACtD,MAAMQ,WAAWhB,2BAA2BS,QAAQG;IACpD,IAAI,CAACI,UAAU,OAAOD;IACtB,IAAI;QACF,MAAME,YAAYpB,cAAcqB,GAAG,GAAGD,SAAS;QAC/C,MAAME,YAAYF,UACfG,UAAU,CAAC,SACXC,GAAG,CAACZ,QACJW,UAAU,CAAC,eACXC,GAAG,CAACL;QACP,MAAMM,YAAY,MAAMH,UAAUI,GAAG;QACrC,IAAI,CAACD,UAAUE,MAAM,EAAE,OAAOT;QAC9B,IACE,CAACd,yBAAyBQ,QAAQG,OAAOU,UAAUC,GAAG,CAAC,oBACvD;YACA,OAAOR;QACT;QACA,2DAA2D;QAC3D,mEAAmE;QACnE,qEAAqE;QACrE,kEAAkE;QAClE,wDAAwD;QACxD,IAAIO,UAAUC,GAAG,CAAC,iBAAiB,MAAM;YACvC,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOV;YAAuB;QAC9D;QACA,MAAMqB,UAAUM,GAAG,CACjB;YACEC,gBAAgB3B,mBAAmBc;YACnCc,iBAAiB9B,cAAcoB,SAAS,CAACW,UAAU,CAACC,eAAe;QACrE,GACA;YAAEC,OAAO;QAAK;QAEhB,OAAO1B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEwB,IAAI;QAAK;IACzC,EAAE,OAAOvB,OAAO;QACdwB,QAAQxB,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAe;IACtD;AACF,EAAC"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/membership-reset.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  MEMBER_SUSPENDED_ERROR,\n  hashMemberPassword,\n  passwordResetTokenMemberId,\n  verifyPasswordResetToken,\n} from './membership'\nimport {\n  isMemberDocumentId,\n  memberCredentialRef,\n  retiredCredentialFields,\n  storedPasswordHash,\n} from './member-credentials'\n\n/**\n * Password reset completion (AGL-552): verifies the recover token\n * (signature + expiry + binding to the member's CURRENT password hash —\n * so a completed reset invalidates every outstanding token) and writes the\n * new scrypt hash to the member's credential document (AGL-3308). No session\n * is minted here; the client signs in through the normal login route with the\n * new password. Token guessing is a non-issue (256-bit HMAC), so no extra\n * damper beyond login's.\n *\n * ONE TRANSACTION, from the token check to the write. The hash the token is\n * checked against is the hash the write replaces, so two submissions of one\n * link cannot both land — the second re-reads the new hash and fails the\n * binding — and a member removed mid-request is not recreated as a stub.\n */\nexport const membershipResetHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const token = String(req.body?.token ?? '')\n  const password = String(req.body?.password ?? '')\n  if (!hostId || !token) {\n    return res.status(400).json({ error: 'Invalid request' })\n  }\n  if (password.length < 8) {\n    return res\n      .status(400)\n      .json({ error: 'Password must be at least 8 characters' })\n  }\n  const invalid = () =>\n    res.status(400).json({\n      error: 'That reset link is invalid or has expired — request a new one.',\n    })\n  // Structural pre-check only (host + expiry); the signature binds to the\n  // member's current hash, which we have to load first.\n  const memberId = passwordResetTokenMemberId(hostId, token)\n  if (!memberId || !isMemberDocumentId(memberId)) return invalid()\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const memberRef = hostRef.collection('siteMembers').doc(memberId)\n    const credentialRef = memberCredentialRef(hostRef, memberId)\n    // Hashed once, however often the body retries, and only for a link that\n    // verified: ~100 ms of CPU is not spent on a stale or forged token.\n    let newHash: string | undefined\n    const outcome = await firestore.runTransaction(async (tx) => {\n      const [memberDoc, credentialDoc] = await tx.getAll(memberRef, credentialRef)\n      if (!memberDoc.exists) return 'invalid'\n      if (\n        !verifyPasswordResetToken(\n          hostId,\n          token,\n          storedPasswordHash(credentialDoc, memberDoc),\n        )\n      ) {\n        return 'invalid'\n      }\n      // Suspension gate (AGL-546/550): a token minted before the\n      // suspension stays cryptographically valid for its hour, so reject\n      // here — recovery must not rehabilitate a suspended account. Checked\n      // AFTER the signature so only the mailed-link holder (who already\n      // knows the account exists) can observe the suspension.\n      if (memberDoc.get('suspended') === true) return 'suspended'\n      newHash ??= hashMemberPassword(password)\n      tx.set(\n        credentialRef,\n        {\n          passwordScrypt: newHash,\n          passwordResetAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n        },\n        { merge: true },\n      )\n      tx.update(memberRef, retiredCredentialFields())\n      return 'reset'\n    })\n    if (outcome === 'invalid') return invalid()\n    if (outcome === 'suspended') {\n      return res.status(403).json({ error: MEMBER_SUSPENDED_ERROR })\n    }\n    return res.status(200).json({ ok: true })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Reset failed' })\n  }\n}\n"],"names":["firebaseAdmin","MEMBER_SUSPENDED_ERROR","hashMemberPassword","passwordResetTokenMemberId","verifyPasswordResetToken","isMemberDocumentId","memberCredentialRef","retiredCredentialFields","storedPasswordHash","membershipResetHandler","req","res","method","status","json","error","hostId","String","body","token","password","length","invalid","memberId","firestore","app","hostRef","collection","doc","memberRef","credentialRef","newHash","outcome","runTransaction","tx","memberDoc","credentialDoc","getAll","exists","get","set","passwordScrypt","passwordResetAt","FieldValue","serverTimestamp","merge","update","ok","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SACEC,sBAAsB,EACtBC,kBAAkB,EAClBC,0BAA0B,EAC1BC,wBAAwB,QACnB,kBAAc;AACrB,SACEC,kBAAkB,EAClBC,mBAAmB,EACnBC,uBAAuB,EACvBC,kBAAkB,QACb,0BAAsB;AAE7B;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,yBAA2C,OAAOC,KAAKC;;QAI5CD,WACDA,YACGA;IALxB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,QAAQF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,KAAK,oBAAI;IACxC,MAAMC,WAAWH,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUU,QAAQ,oBAAI;IAC9C,IAAI,CAACJ,UAAU,CAACG,OAAO;QACrB,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,IAAIK,SAASC,MAAM,GAAG,GAAG;QACvB,OAAOV,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAAyC;IAC5D;IACA,MAAMO,UAAU,IACdX,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YACnBC,OAAO;QACT;IACF,wEAAwE;IACxE,sDAAsD;IACtD,MAAMQ,WAAWpB,2BAA2Ba,QAAQG;IACpD,IAAI,CAACI,YAAY,CAAClB,mBAAmBkB,WAAW,OAAOD;IACvD,IAAI;QACF,MAAME,YAAYxB,cAAcyB,GAAG,GAAGD,SAAS;QAC/C,MAAME,UAAUF,UAAUG,UAAU,CAAC,SAASC,GAAG,CAACZ;QAClD,MAAMa,YAAYH,QAAQC,UAAU,CAAC,eAAeC,GAAG,CAACL;QACxD,MAAMO,gBAAgBxB,oBAAoBoB,SAASH;QACnD,wEAAwE;QACxE,oEAAoE;QACpE,IAAIQ;QACJ,MAAMC,UAAU,MAAMR,UAAUS,cAAc,CAAC,OAAOC;YACpD,MAAM,CAACC,WAAWC,cAAc,GAAG,MAAMF,GAAGG,MAAM,CAACR,WAAWC;YAC9D,IAAI,CAACK,UAAUG,MAAM,EAAE,OAAO;YAC9B,IACE,CAAClC,yBACCY,QACAG,OACAX,mBAAmB4B,eAAeD,aAEpC;gBACA,OAAO;YACT;YACA,2DAA2D;YAC3D,mEAAmE;YACnE,qEAAqE;YACrE,kEAAkE;YAClE,wDAAwD;YACxD,IAAIA,UAAUI,GAAG,CAAC,iBAAiB,MAAM,OAAO;YAChDR,kBAAAA,UAAAA,UAAY7B,mBAAmBkB;YAC/Bc,GAAGM,GAAG,CACJV,eACA;gBACEW,gBAAgBV;gBAChBW,iBAAiB1C,cAAcwB,SAAS,CAACmB,UAAU,CAACC,eAAe;YACrE,GACA;gBAAEC,OAAO;YAAK;YAEhBX,GAAGY,MAAM,CAACjB,WAAWtB;YACrB,OAAO;QACT;QACA,IAAIyB,YAAY,WAAW,OAAOV;QAClC,IAAIU,YAAY,aAAa;YAC3B,OAAOrB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOd;YAAuB;QAC9D;QACA,OAAOU,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEiC,IAAI;QAAK;IACzC,EAAE,OAAOhC,OAAO;QACdiC,QAAQjC,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAe;IACtD;AACF,EAAC"}