@redeemid/emdash 0.0.10 → 0.0.11

package/src/staff.ts

@@ -9,6 +9,7 @@ import { describe, levelsFor, membership, passes, requirement, termTree, type Te
 import type { RedeemIDConfig } from "./config.js";
 import { levelChange } from "./events.js";
 import { featuresFor } from "./features.js";
+import { recentRequests } from "./privacy.js";
 import { cleanTags, numericId, type MemberRecord, type Stores } from "./storage.js";
 
 /** Members resynced per click; well inside Shopify's query cost limits. */
@@ -80,6 +81,97 @@ export function memberDetail(config: RedeemIDConfig, m: MemberRecord, toast?: Bl
 				? { type: "actions", elements: [{ type: "button", action_id: "member_resync", label: "Resync from Shopify", style: "primary", value: m.customerId }] }
 				: { type: "divider" },
 			{ type: "context", text: "Tags are written to Shopify, then read back. Shopify stays the only source of access." },
+			...privacySection(m.customerId),
+		],
+	};
+}
+
+/** Export and erase for one member, on their detail page. */
+function privacySection(customerId: string): unknown[] {
+	const erase = {
+		type: "button",
+		action_id: "member_erase",
+		label: "Erase site data",
+		style: "danger",
+		value: customerId,
+		confirm: {
+			title: "Erase this member's data on the site?",
+			text: "Removes their synced record and meter here. Their site user and everything in Shopify stay. If they sign in again they're linked again.",
+			confirm: "Erase",
+			deny: "Cancel",
+			style: "danger",
+		},
+	};
+	const shopify = adminConfigured()
+		? [
+				{
+					type: "button",
+					action_id: "member_shopify_erase",
+					label: "Also request erasure in Shopify",
+					style: "danger",
+					value: customerId,
+					confirm: {
+						title: "Ask Shopify to erase this customer?",
+						text: "Shopify erases the customer's personal data across the store, orders included, after a waiting period. Needs the write_customer_data_erasure scope.",
+						confirm: "Request erasure",
+						deny: "Cancel",
+						style: "danger",
+					},
+				},
+				{ type: "button", action_id: "member_shopify_cancel", label: "Cancel the Shopify erasure", style: "secondary", value: customerId },
+			]
+		: [];
+	return [
+		{ type: "header", text: "Privacy" },
+		{ type: "actions", elements: [{ type: "button", action_id: "member_export", label: "Export data", style: "secondary", value: customerId }, erase, ...shopify] },
+		{ type: "context", text: "Export shows everything RedeemID keeps about this member. Erasing removes it from the site; Shopify stays the record of the customer." },
+	];
+}
+
+/** The member's export, as JSON, under their detail page. */
+export function exportBlocks(detail: Blocks, data: unknown): Blocks {
+	return { ...detail, blocks: [...detail.blocks, { type: "header", text: "Export" }, { type: "code", language: "jsonc", code: JSON.stringify(data, null, 2) }] };
+}
+
+/** Every privacy request: what came in, from where, and what's still open. */
+export async function privacyPage(s: Stores, toast?: Blocks["toast"], extra: unknown[] = []): Promise<Blocks> {
+	const items = await recentRequests(s);
+	return {
+		toast,
+		blocks: [
+			{ type: "header", text: "Privacy requests" },
+			{ type: "context", text: "Exports and erasures of what RedeemID keeps, from members, staff and Shopify's compliance webhooks. Open requests need staff: send a Shopify data request's export to the store owner, then mark it done." },
+			items.length
+				? {
+						type: "table",
+						page_action_id: "privacy_requests",
+						columns: [
+							{ key: "at", label: "When", format: "relative_time" },
+							{ key: "kind", label: "Request" },
+							{ key: "source", label: "From" },
+							{ key: "customer", label: "Shopify customer" },
+							{ key: "status", label: "Status", format: "badge" },
+							{ key: "act", label: "", format: "element" },
+						],
+						rows: items.map(({ id, data: r }) => ({
+							at: r.at,
+							kind: r.kind === "export" ? "Export" : "Erase",
+							source: { member: "Member, on the site", staff: "Staff", shopify: "Shopify" }[r.source] + (r.shopifyRequestId ? ` (request ${r.shopifyRequestId})` : "") + (r.note ? `: ${r.note}` : ""),
+							customer: r.customerId ?? "All",
+							status: r.status === "open" ? "Open" : "Done",
+							act:
+								r.status === "open"
+									? {
+											type: "button",
+											action_id: "privacy_done",
+											label: r.kind === "export" && r.customerId ? "Export and mark done" : "Mark done",
+											value: id,
+										}
+									: null,
+						})),
+					}
+				: { type: "context", text: "No requests yet." },
+			...extra,
 		],
 	};
 }

package/src/storage.ts

@@ -79,16 +79,31 @@ export interface DeliveryRecord {
 	receivedAt: string;
 }
 
+/** One privacy request: an export or erase, and where it came from. Names no one but the customer id. */
+export interface PrivacyRequest {
+	kind: "export" | "erase";
+	/** member: on the site; staff: in the admin; shopify: a compliance webhook. */
+	source: "member" | "staff" | "shopify";
+	customerId: string | null;
+	at: string;
+	/** open: staff still need to act (a Shopify data request, or a Shopify erasure that's pending). */
+	status: "open" | "done";
+	shopifyRequestId?: string | null;
+	note?: string;
+}
+
 export const STORAGE_CONFIG = {
 	members: { indexes: ["email", "userId", "syncedAt"] },
 	deliveries: { indexes: ["receivedAt"] },
 	meter: { indexes: ["userId"] },
+	requests: { indexes: ["at", "customerId", "status"] },
 };
 
 export interface Stores {
 	members: StorageCollection<MemberRecord>;
 	deliveries: StorageCollection<DeliveryRecord>;
 	meter: StorageCollection<MeterRecord>;
+	requests: StorageCollection<PrivacyRequest>;
 }
 
 export function stores(db: unknown): Stores {

package/src/text.ts

@@ -57,6 +57,8 @@ export const STRINGS = {
 		"Your membership doesn't include this yet.",
 		"Your account is turned off. Contact the store for help.",
 		"This is for members.",
+		"Or buy just this for {price}.",
+		"Buy just this",
 	],
 	member: [
 		"Your membership",
@@ -96,8 +98,17 @@ export const STRINGS = {
 		"Your preferences are saved.",
 		"Some answers weren't saved. Check them and try again.",
 		"Your preferences can't be saved right now. Try again in a few minutes.",
+		"Your data on this site is deleted, and you're signed out.",
+		"Tick the box to confirm, then try again.",
 		"Your account page isn't available right now. Try again in a few minutes.",
 	],
+	privacy: [
+		"Your data",
+		"Download my data",
+		"Deleting removes what this site keeps about you and signs you out. Your store account and orders stay; ask the store to delete those.",
+		"I understand",
+		"Delete my data",
+	],
 	plan: ["Join", "You're on this plan.", "Not available right now."],
 	preferences: ["Your preferences", "Save preferences", "Your preferences can't be loaded right now. Try again in a few minutes.", "Not set", "Yes", "No", "One per line."],
 	product: ["Add to cart", "Buy now", "Option", "{option} ({price})", "{option} ({price}) sold out", "Quantity", "Sold out."],

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.10";
+export const VERSION = "0.0.11";

package/src/webhooks.ts

@@ -7,6 +7,8 @@
  */
 
 import { cleanTags, emptyMember, numericId, stampTags, type MemberRecord, type Stores } from "./storage.js";
+import type { RedeemIDConfig } from "./config.js";
+import { eraseAll, eraseMember, shopifyDataRequest } from "./privacy.js";
 
 export type Kind = "profile" | "delete" | "status" | "tags" | "merge" | "compliance" | "ignored";
 
@@ -94,16 +96,27 @@ export async function apply(
 	payload: Record<string, unknown>,
 	/** Called after a member is written, with their tags before (null when new). */
 	onWrite?: (beforeTags: string[] | null, after: MemberRecord) => Promise<void> | void,
+	/** For the member.erased event on customers/redact. */
+	config?: RedeemIDConfig | null,
 ): Promise<Outcome> {
 	const kind = kindOf(topic);
 	if (!kind || kind === "ignored") return "ignored";
 
 	if (kind === "compliance") {
-		// customers/redact: drop the mirror for that customer. data_request and
-		// shop/redact need staff action (or are covered by deleting the app).
+		// Every compliance topic is logged as a privacy request (see privacy.ts).
+		const id = customerOf(payload);
 		if (topic === "customers/redact") {
-			const id = customerOf(payload);
-			if (id) await s.members.delete(id);
+			if (id) await eraseMember(config ?? null, s, id, "shopify");
+			return id ? "processed" : "skipped";
+		}
+		if (topic === "customers/data_request") {
+			if (!id) return "skipped";
+			const req = (payload.data_request as { id?: unknown } | undefined)?.id;
+			await shopifyDataRequest(s, id, req === undefined || req === null ? null : String(req));
+			return "processed";
+		}
+		if (topic === "shop/redact") {
+			await eraseAll(config ?? null, s);
 			return "processed";
 		}
 		return "skipped";