@redeemid/emdash 0.0.0-stage → 0.0.3

package/src/components/Gate.astro

@@ -0,0 +1,40 @@
+---
+/**
+ * Show the default slot to readers who may read the entry, the "locked" slot
+ * (or a built-in notice) to everyone else.
+ *
+ *   <Gate collection="posts" terms={post.data.terms}>
+ *     <PortableText value={post.data.content} />
+ *     <p slot="locked">…teaser…</p>
+ *   </Gate>
+ *
+ * Pass `levels` to lock a part of a page to specific levels instead.
+ */
+import { canRead, signInUrl, type Terms } from "../access.js";
+
+interface Props {
+	collection?: string;
+	terms?: Terms;
+	levels?: string[];
+}
+
+const { collection = "", terms, levels } = Astro.props;
+const verdict = await canRead(Astro, { collection, terms }, levels ? { levels } : undefined);
+const here = Astro.url.pathname + Astro.url.search;
+---
+
+{verdict.allowed ? (
+	<slot />
+) : (
+	<div class="redeemid-locked" data-redeemid-reason={verdict.reason}>
+		<slot name="locked" />
+		{verdict.reason === "sign_in" && (
+			<p>
+				This is for members. <a href={signInUrl(here)}>Sign in</a> to read it.
+			</p>
+		)}
+		{verdict.reason === "upgrade" && <p>Your membership doesn't include this yet.</p>}
+		{verdict.reason === "disabled" && <p>Your account is turned off. Contact the store for help.</p>}
+		{verdict.reason === "unconfigured" && <p>This is for members.</p>}
+	</div>
+)}

package/src/components/Plan.astro

@@ -0,0 +1,53 @@
+---
+/**
+ * A membership plan from Shopify: name, price and a Buy button that starts
+ * checkout. Prices come from the Storefront API; the default slot shows if
+ * the product can't be loaded.
+ *
+ *   <Plan handle="gold-membership" />
+ */
+import { siteConfig } from "../site-config.js";
+import { plan as loadPlan, type Plan } from "../storefront.js";
+
+interface Props {
+	handle: string;
+	/** Button text. */
+	label?: string;
+	/** Heading override; defaults to the Shopify product title. */
+	title?: string;
+}
+
+const { handle, label = "Join", title } = Astro.props;
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+let p: Plan | null = null;
+if (config) {
+	try {
+		p = await loadPlan(config, handle);
+	} catch {
+		p = null;
+	}
+}
+const price = p?.price
+	? new Intl.NumberFormat("en-US", { style: "currency", currency: p.price.currencyCode }).format(Number(p.price.amount))
+	: null;
+const here = Astro.url.pathname + Astro.url.search;
+---
+
+{p ? (
+	<div class="redeemid-plan" data-redeemid-plan={p.handle}>
+		<h2 class="redeemid-plan__title">{title ?? p.title}</h2>
+		{price && <p class="redeemid-plan__price">{price}</p>}
+		{p.description && <p class="redeemid-plan__description">{p.description}</p>}
+		{p.availableForSale ? (
+			<form method="post" action="/_emdash/api/auth/redeemid/buy">
+				<input type="hidden" name="plan" value={p.handle} />
+				<input type="hidden" name="return" value={here} />
+				<button type="submit">{label}</button>
+			</form>
+		) : (
+			<p class="redeemid-plan__unavailable">Not available right now.</p>
+		)}
+	</div>
+) : (
+	<slot />
+)}

package/src/config.ts

@@ -0,0 +1,112 @@
+/**
+ * RedeemID configuration.
+ *
+ * Levels and rules live in code (astro.config.mjs), so they are versioned with
+ * the site. Secrets come from the environment and never from config.
+ */
+
+/** A member level, held by Shopify customers with its tags. */
+export interface LevelConfig {
+	/** Stable slug, used in rules (e.g. "member"). */
+	slug: string;
+	/** Name shown to members. */
+	name: string;
+	/** Shopify customer tags that grant this level. Matched case-insensitively. */
+	tags: string[];
+	/** "any" (default): one of the tags is enough. "all": every tag is needed. */
+	match?: "any" | "all";
+}
+
+/**
+ * Who may read entries. A rule with `term` applies to entries that carry that
+ * term; a rule without one applies to the whole collection. Term rules win
+ * over collection rules for the same entry.
+ */
+export interface RuleConfig {
+	collection: string;
+	/** Taxonomy slug, e.g. "category". Requires `term`. */
+	taxonomy?: string;
+	/** Term slug, e.g. "premium". */
+	term?: string;
+	/** Level slugs that may read. An empty list means signed-in members of any level. */
+	levels: string[];
+}
+
+export interface RedeemIDConfig {
+	/**
+	 * The store's myshopify.com domain (a custom storefront or customer-account
+	 * domain works too). Discovery is read from https://<shop>/.well-known/.
+	 * Leave it out to read REDEEMID_SHOPIFY_STORE_DOMAIN at request time.
+	 */
+	shop?: string;
+	/** Sign-in button label. Members never see "Shopify". */
+	label?: string;
+	levels?: LevelConfig[];
+	rules?: RuleConfig[];
+	/**
+	 * Extra /_emdash path prefixes signed-in members may use. Everything else
+	 * under /_emdash is refused to Subscribers (see guard.ts).
+	 */
+	memberPaths?: string[];
+	/**
+	 * Only for local tests: lets `shop` be a full http:// origin of a fake store.
+	 * Never set this on a live site.
+	 */
+	allowInsecureShop?: boolean;
+}
+
+export const PROVIDER_ID = "redeemid";
+
+/**
+ * Environment variable names. Values are read at request time, so on Workers
+ * they can be secrets.
+ */
+export const ENV = {
+	/** The store's myshopify.com domain, when `shop` isn't set in config. */
+	storeDomain: "REDEEMID_SHOPIFY_STORE_DOMAIN",
+	/** Customer Account API client ID (Headless storefront). */
+	clientId: "REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID",
+	/** Customer Account API client secret. Confidential clients only; public clients leave it unset. */
+	clientSecret: "REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET",
+	/** Client secret of the Shopify (Admin API) app whose webhooks the site receives. Shopify signs webhooks with it. */
+	webhookSecret: "REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET",
+	/** Storefront API private token, for server-side plan and checkout calls. */
+	storefrontPrivateToken: "REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN",
+	/** Storefront API public token, used only when the private token isn't set. */
+	storefrontPublicToken: "REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN",
+} as const;
+
+export function env(name: string): string {
+	const value = typeof process !== "undefined" ? process.env[name] : undefined;
+	return typeof value === "string" ? value.trim() : "";
+}
+
+/** The store origin, e.g. https://shop.example.com. */
+export function shopOrigin(config: RedeemIDConfig): string {
+	const raw = storeDomain(config).replace(/\/+$/, "");
+	if (raw === "") throw new Error("RedeemID: no store domain.");
+	if (/^https?:\/\//i.test(raw)) {
+		const url = new URL(raw);
+		if (url.protocol === "http:" && !config.allowInsecureShop) {
+			throw new Error("RedeemID: the shop must use https.");
+		}
+		return url.origin;
+	}
+	const host = raw.replace(/^admin\.shopify\.com\/store\//i, "").toLowerCase();
+	// A bare store handle ("my-store") means its myshopify.com domain.
+	return `https://${host.includes(".") ? host : `${host}.myshopify.com`}`;
+}
+
+/** The configured store domain, from config or the environment. */
+export function storeDomain(config: RedeemIDConfig): string {
+	return (config.shop ?? "").trim() || env(ENV.storeDomain);
+}
+
+/** Find this provider's config among EmDash's configured auth providers. */
+export function readConfig(emdashConfig: unknown): RedeemIDConfig | null {
+	const providers = (emdashConfig as { authProviders?: Array<{ id: string; config?: unknown }> } | null)
+		?.authProviders;
+	const found = providers?.find((p) => p.id === PROVIDER_ID);
+	const config = found?.config as RedeemIDConfig | undefined;
+	return config && typeof config === "object" ? config : null;
+}

package/src/descriptor.ts

@@ -0,0 +1,29 @@
+/**
+ * The RedeemID plugin descriptor, safe to load from astro.config.mjs (no
+ * runtime imports). The plugin itself is in plugin.ts.
+ */
+
+import type { PluginDescriptor } from "emdash";
+
+import type { RedeemIDConfig } from "./config.js";
+import { VERSION } from "./version.js";
+
+export const PAGES = [
+	{ path: "/", label: "Members", icon: "users" },
+	{ path: "/status", label: "Status", icon: "pulse" },
+];
+export const WIDGETS = [{ id: "status", title: "RedeemID", size: "half" as const }];
+
+/** The descriptor for `emdash({ plugins: [...] })`. Pass the same config as `redeemid()`. */
+export function redeemidPlugin(config: RedeemIDConfig): PluginDescriptor<RedeemIDConfig> {
+	return {
+		id: "redeemid",
+		version: VERSION,
+		entrypoint: "@redeemid/emdash/plugin",
+		componentsEntry: "@redeemid/emdash/blocks",
+		options: config,
+		adminPages: PAGES,
+		adminWidgets: WIDGETS,
+	};
+}
+

package/src/guard.ts

@@ -0,0 +1,45 @@
+/**
+ * Keeps members out of EmDash's own APIs and admin.
+ *
+ * EmDash's Subscriber role may read every published entry through
+ * /_emdash/api/content. With RedeemID, access comes from Shopify tags only, so
+ * a member with one level could otherwise read another level's posts there.
+ * This middleware runs after EmDash's auth and refuses Subscribers on every
+ * /_emdash path except the few public pages need.
+ */
+
+import { defineMiddleware } from "astro:middleware";
+
+import { siteConfig } from "./site-config.js";
+
+const SUBSCRIBER = 10;
+
+/** Paths signed-in members still need. Everything else under /_emdash is refused. */
+export const MEMBER_PATHS = [
+	"/_emdash/api/auth/redeemid/",
+	"/_emdash/api/auth/logout",
+	"/_emdash/api/media/file/",
+	"/_emdash/api/comments",
+	"/_emdash/api/plugins/",
+];
+
+export function memberMayUse(path: string, extra: string[] = []): boolean {
+	if (!path.startsWith("/_emdash")) return true;
+	return [...MEMBER_PATHS, ...extra].some((p) => path === p.replace(/\/$/, "") || path.startsWith(p));
+}
+
+export const onRequest = defineMiddleware(async ({ locals, url }, next) => {
+	const user = (locals as { user?: { role?: number } | null }).user;
+	if (!user || user.role !== SUBSCRIBER) return next();
+
+	const config = siteConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
+	if (memberMayUse(url.pathname, config?.memberPaths)) return next();
+
+	if (url.pathname.startsWith("/_emdash/admin")) {
+		return new Response(null, { status: 302, headers: { location: "/", "cache-control": "private, no-store" } });
+	}
+	return new Response(JSON.stringify({ error: { code: "FORBIDDEN", message: "Members can't use this API." } }), {
+		status: 403,
+		headers: { "content-type": "application/json", "cache-control": "private, no-store" },
+	});
+});

package/src/index.ts

@@ -0,0 +1,81 @@
+/**
+ * RedeemID for EmDash.
+ *
+ * Shopify runs the store and the customer account; EmDash runs the content.
+ * Add to astro.config.mjs:
+ *
+ *   integrations: [
+ *     emdash({ authProviders: [redeemid({ ... })] }),
+ *     redeemidGuard(),
+ *   ]
+ *
+ * In full:
+ *
+ *   emdash({
+ *     authProviders: [
+ *       redeemid({
+ *         shop: "my-store.myshopify.com",
+ *         levels: [{ slug: "member", name: "Member", tags: ["member"] }],
+ *         rules: [{ collection: "posts", taxonomy: "category", term: "members", levels: ["member"] }],
+ *       }),
+ *     ],
+ *   })
+ *
+ * Secrets come from the environment (see ENV in config.ts):
+ * REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID and, for confidential clients,
+ * REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET (the Headless storefront's
+ * Customer Account API client), and REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET
+ * (the client secret of the Shopify app whose webhooks the site receives).
+ */
+
+import type { AstroIntegration } from "astro";
+import type { AuthProviderDescriptor } from "emdash";
+
+import { PROVIDER_ID, type RedeemIDConfig } from "./config.js";
+import { STORAGE_CONFIG } from "./storage.js";
+
+export type { LevelConfig, RedeemIDConfig, RuleConfig } from "./config.js";
+export type { MemberRecord } from "./storage.js";
+export { redeemidPlugin } from "./descriptor.js";
+// Page-time helpers live in "@redeemid/emdash/access": they read the site's
+// build-time config module, which astro.config.mjs can't load.
+
+const BASE = "/_emdash/api/auth/redeemid";
+
+export function redeemid(config: RedeemIDConfig): AuthProviderDescriptor {
+	if (!config) throw new Error("RedeemID: pass a config object.");
+	return {
+		id: PROVIDER_ID,
+		label: config.label ?? "Sign in",
+		config,
+		// No adminEntry: members sign in from the site, not the EmDash login page.
+		routes: [
+			{ pattern: `${BASE}/login`, entrypoint: "@redeemid/emdash/routes/login.ts" },
+			{ pattern: `${BASE}/callback`, entrypoint: "@redeemid/emdash/routes/callback.ts" },
+			{ pattern: `${BASE}/logout`, entrypoint: "@redeemid/emdash/routes/logout.ts" },
+			{ pattern: `${BASE}/webhook`, entrypoint: "@redeemid/emdash/routes/webhook.ts" },
+			{ pattern: `${BASE}/buy`, entrypoint: "@redeemid/emdash/routes/buy.ts" },
+			{ pattern: `${BASE}/cart`, entrypoint: "@redeemid/emdash/routes/cart.ts" },
+			{ pattern: `${BASE}/account`, entrypoint: "@redeemid/emdash/routes/account.ts" },
+		],
+		publicRoutes: [`${BASE}/`],
+		storage: STORAGE_CONFIG,
+	};
+}
+
+/**
+ * Astro integration that keeps members (EmDash Subscribers) out of EmDash's
+ * content API and admin, so only RedeemID's checks decide who reads what.
+ */
+export function redeemidGuard(): AstroIntegration {
+	return {
+		name: "@redeemid/emdash/guard",
+		hooks: {
+			"astro:config:setup": ({ addMiddleware }) => {
+				addMiddleware({ entrypoint: "@redeemid/emdash/guard.ts", order: "post" });
+			},
+		},
+	};
+}
+
+export default redeemid;

package/src/plugin.ts

@@ -0,0 +1,283 @@
+/**
+ * RedeemID as an EmDash plugin: what editors and admins see.
+ *
+ *   emdash({
+ *     authProviders: [redeemid(config)],
+ *     plugins: [redeemidPlugin(config)],
+ *   })
+ *
+ * It adds two Portable Text blocks to the editor, a Members page, a Status
+ * page and a dashboard widget. Sign-in, webhooks and checkout stay on the
+ * auth provider's routes.
+ *
+ * - "Paywall break" (`redeemid-paywall`): everything after it in the body is
+ *   for members. Pick the levels that may read on; none picked means any
+ *   signed-in member, or the entry's rule when one covers it.
+ * - "Plan" (`redeemid-plan`): a Shopify product's title and price with a
+ *   button that adds it to the cart and opens checkout.
+ *
+ * Render bodies with `<Content>` (components/Content.astro), which keeps the
+ * part after a paywall break off the page for readers who can't read it.
+ */
+
+import type { ResolvedPlugin, RouteContext } from "emdash";
+import { definePlugin } from "emdash";
+
+import { levelsFor } from "./access.js";
+import { env, ENV, storeDomain, type RedeemIDConfig } from "./config.js";
+import { discover } from "./shopify.js";
+import { stores, type MemberRecord } from "./storage.js";
+import { PAGES, WIDGETS } from "./descriptor.js";
+import { VERSION } from "./version.js";
+
+import { PAYWALL_BLOCK, PLAN_BLOCK } from "./blocks-names.js";
+
+export { PAYWALL_BLOCK, PLAN_BLOCK };
+
+function blocks(config: RedeemIDConfig) {
+	const levelOptions = (config.levels ?? []).map((l) => ({ label: l.name, value: l.slug }));
+	return [
+		{
+			type: PAYWALL_BLOCK,
+			label: "Paywall break",
+			icon: "lock",
+			description: "Everything after this is for members",
+			fields: [
+				{
+					type: "checkbox" as const,
+					action_id: "levels",
+					label: "Who can read on (none = any signed-in member)",
+					options: levelOptions,
+				},
+			],
+		},
+		{
+			type: PLAN_BLOCK,
+			label: "Plan",
+			icon: "tag",
+			description: "A Shopify product with its price and a buy button",
+			placeholder: "Shopify product handle",
+			fields: [
+				{ type: "text_input" as const, action_id: "handle", label: "Shopify product handle", placeholder: "gold-membership" },
+				{ type: "text_input" as const, action_id: "title", label: "Title (optional, Shopify's title otherwise)" },
+				{ type: "text_input" as const, action_id: "label", label: "Button label", placeholder: "Join" },
+			],
+		},
+	];
+}
+
+export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
+	return definePlugin({
+		id: "redeemid",
+		version: VERSION,
+		capabilities: [],
+		admin: {
+			pages: PAGES,
+			widgets: WIDGETS,
+			portableTextBlocks: blocks(config),
+		},
+		routes: {
+			admin: {
+				handler: async (ctx: RouteContext) => {
+					const i = (ctx.input ?? {}) as { type?: string; page?: string };
+					if (i.type !== "page_load") return { blocks: [] };
+					try {
+						if (i.page === "/") return await membersPage(config);
+						if (i.page === "/status") return await statusPage(config, ctx.request);
+						if (i.page === "widget:status") return await statusWidget(config);
+					} catch (e) {
+						return { blocks: [{ type: "banner", variant: "error", title: "RedeemID couldn't load this page", description: (e as Error).message }] };
+					}
+					return { blocks: [] };
+				},
+			},
+		},
+	});
+}
+
+export default createPlugin;
+
+// ---------------------------------------------------------------- pages
+
+async function memberStores() {
+	const { getDb } = await import("emdash/runtime");
+	return stores(await getDb());
+}
+
+async function allMembers(): Promise<MemberRecord[]> {
+	const s = await memberStores();
+	const out: MemberRecord[] = [];
+	let cursor: string | undefined;
+	do {
+		const page = await s.members.query({ limit: 100, cursor });
+		out.push(...page.items.map((r) => r.data));
+		cursor = page.cursor;
+	} while (cursor && out.length < 1000);
+	return out;
+}
+
+async function membersPage(config: RedeemIDConfig) {
+	const members = await allMembers();
+	const levels = config.levels ?? [];
+	const counts = levels.map((l) => ({
+		label: l.name,
+		value: String(members.filter((m) => m.status === "enabled" && levelsFor(m.tags, levels).includes(l.slug)).length),
+	}));
+	const name = (m: MemberRecord) => [m.firstName, m.lastName].filter(Boolean).join(" ") || "—";
+	const levelNames = (m: MemberRecord) => {
+		const held = levelsFor(m.tags, levels);
+		return levels.filter((l) => held.includes(l.slug)).map((l) => l.name).join(", ") || "—";
+	};
+	return {
+		blocks: [
+			{ type: "header", text: "Members" },
+			{
+				type: "context",
+				text: "Shopify customers who have signed in or that Shopify has sent. Levels come only from their Shopify tags; change tags in Shopify (or with Flow) and access follows.",
+			},
+			{
+				type: "stats",
+				items: [
+					{ label: "Members", value: String(members.length) },
+					{ label: "Turned off", value: String(members.filter((m) => m.status === "disabled").length) },
+					...counts,
+				],
+			},
+			members.length === 0
+				? { type: "context", text: "No members yet. They appear here after their first sign-in or a Shopify customer webhook." }
+				: {
+						type: "table",
+						page_action_id: "members_page",
+						columns: [
+							{ key: "name", label: "Name" },
+							{ key: "email", label: "Email" },
+							{ key: "levels", label: "Levels" },
+							{ key: "tags", label: "Shopify tags" },
+							{ key: "status", label: "Account" },
+							{ key: "synced", label: "Last synced", format: "relative_time" },
+						],
+						rows: members
+							.sort((a, b) => b.syncedAt.localeCompare(a.syncedAt))
+							.map((m) => ({
+								name: name(m),
+								email: m.email ?? "—",
+								levels: levelNames(m),
+								tags: m.tags.join(", ") || "—",
+								status: m.status === "enabled" ? "On" : "Off",
+								synced: m.syncedAt,
+							})),
+					},
+		],
+	};
+}
+
+async function checks(config: RedeemIDConfig) {
+	const domain = storeDomain(config);
+	let discovery = "Not checked";
+	if (domain) {
+		discovery = await discover(config)
+			.then((d) => `OK (${new URL(d.authorizationEndpoint).host})`)
+			.catch((e: Error) => `Failed: ${e.message}`);
+	}
+	return {
+		domain,
+		discovery,
+		clientId: Boolean(env(ENV.clientId)),
+		webhookSecret: Boolean(env(ENV.webhookSecret)),
+		storefront: env(ENV.storefrontPrivateToken) ? "Private token" : env(ENV.storefrontPublicToken) ? "Public token" : "None (tokenless)",
+	};
+}
+
+async function lastDelivery(): Promise<string | null> {
+	const s = await memberStores();
+	const { items } = await s.deliveries.query({ orderBy: { receivedAt: "desc" }, limit: 1 });
+	const d = items[0]?.data;
+	return d ? `${d.topic} at ${d.receivedAt}` : null;
+}
+
+async function statusPage(config: RedeemIDConfig, request: Request) {
+	const c = await checks(config);
+	const origin = new URL(request.url).origin;
+	const yes = (v: boolean) => (v ? "Set" : "Missing");
+	const levels = config.levels ?? [];
+	const rules = config.rules ?? [];
+	const delivery = await lastDelivery().catch(() => null);
+	return {
+		blocks: [
+			{ type: "header", text: "Status" },
+			c.discovery.startsWith("OK") && c.clientId
+				? { type: "banner", variant: "default", title: "Sign-in is ready", description: "Members can sign in with their Shopify customer account." }
+				: { type: "banner", variant: "alert", title: "Sign-in isn't ready", description: "Set the missing values below as environment secrets, then reload." },
+			{
+				type: "fields",
+				fields: [
+					{ label: "Store domain (REDEEMID_SHOPIFY_STORE_DOMAIN or shop)", value: c.domain || "Missing" },
+					{ label: "Store discovery", value: c.discovery },
+					{ label: "Customer Account API client ID", value: yes(c.clientId) },
+					{ label: "Webhook signing secret", value: yes(c.webhookSecret) },
+					{ label: "Storefront API access", value: c.storefront },
+					{ label: "Last webhook", value: delivery ?? "None received yet" },
+				],
+			},
+			{ type: "divider" },
+			{ type: "header", text: "Shopify settings" },
+			{
+				type: "fields",
+				fields: [
+					{ label: "Callback URI", value: `${origin}/_emdash/api/auth/redeemid/callback` },
+					{ label: "JavaScript origin", value: origin },
+					{ label: "Logout URI", value: `${origin}/` },
+					{ label: "Webhook URL", value: `${origin}/_emdash/api/auth/redeemid/webhook` },
+				],
+			},
+			{ type: "divider" },
+			{ type: "header", text: "Levels" },
+			{ type: "context", text: "Set in astro.config.mjs." },
+			levels.length
+				? {
+						type: "table",
+						page_action_id: "levels_page",
+						columns: [
+							{ key: "name", label: "Level" },
+							{ key: "tags", label: "Shopify tags" },
+							{ key: "match", label: "Needs" },
+						],
+						rows: levels.map((l) => ({ name: l.name, tags: l.tags.join(", "), match: l.match === "all" ? "All tags" : "Any tag" })),
+					}
+				: { type: "context", text: "No levels configured." },
+			{ type: "header", text: "Rules" },
+			rules.length
+				? {
+						type: "table",
+						page_action_id: "rules_page",
+						columns: [
+							{ key: "where", label: "Covers" },
+							{ key: "levels", label: "Who can read" },
+						],
+						rows: rules.map((r) => ({
+							where: r.taxonomy && r.term ? `${r.collection}, ${r.taxonomy}: ${r.term}` : `All ${r.collection}`,
+							levels: r.levels.length
+								? r.levels.map((s) => levels.find((l) => l.slug === s)?.name ?? s).join(" or ")
+								: "Any signed-in member",
+						})),
+					}
+				: { type: "context", text: "No rules. Entries are open unless their body has a paywall break." },
+		],
+	};
+}
+
+async function statusWidget(config: RedeemIDConfig) {
+	const c = await checks(config);
+	const members = await allMembers().catch(() => []);
+	return {
+		blocks: [
+			{
+				type: "fields",
+				fields: [
+					{ label: "Sign-in", value: c.discovery.startsWith("OK") && c.clientId ? "Ready" : "Not ready" },
+					{ label: "Members", value: String(members.length) },
+				],
+			},
+		],
+	};
+}

package/src/routes/account.ts

@@ -0,0 +1,31 @@
+/**
+ * GET /_emdash/api/auth/redeemid/account
+ *
+ * Sends a member to their Shopify customer account (orders, profile,
+ * addresses), on the store's own account domain. Visitors who aren't
+ * signed in go through sign-in first; Shopify would ask them anyway.
+ */
+
+import type { APIRoute } from "astro";
+
+import { safeReturn, signInUrl } from "../access.js";
+import { readConfig, storeDomain } from "../config.js";
+import { discover } from "../shopify.js";
+import { fail } from "./shared.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
+	const returnTo = safeReturn(new URL(request.url).searchParams.get("return"));
+	const config = readConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
+	if (!config || !storeDomain(config)) return fail(redirect, returnTo, "not_configured");
+
+	const user = (await session?.get("user")) as { id?: string } | undefined;
+	if (!user?.id) return redirect(signInUrl(returnTo));
+	try {
+		const d = await discover(config);
+		return redirect(new URL("/", d.authorizationEndpoint).href);
+	} catch {
+		return fail(redirect, returnTo, "account_unavailable");
+	}
+};