@redeemid/emdash 0.0.11 → 0.0.14

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.11, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
+**Status: 0.0.14, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, paywall markup, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -89,6 +89,8 @@ Set these secrets in the environment (`.env` locally, `wrangler secret put` on W
 | `REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN` | Storefront API | Private access token, for the plan cards and checkout (server-side). |
 | `REDEEMID_SHOPIFY_STOREFRONT_PUBLIC_TOKEN` | Storefront API | Public access token. Only used when the private token isn't set. |
 
+Set them as runtime variables or secrets of the site itself, not as build-time variables. If a value shows as Missing on the Status page, check its name: the Status page also lists any `REDEEMID_` variable that is set but that RedeemID doesn't read, by name only.
+
 RedeemID finds the authorization, token and logout endpoints itself from the store's discovery documents, so they need no setting.
 
 In Shopify, give the Customer Account API client these settings:
@@ -239,7 +241,7 @@ With `agents: { actions: true }` in the config, three actions are offered too:
 | MCP tool | Command | What it does |
 | --- | --- | --- |
 | `resync_member` | `resync <customer id>` | Reads one member from Shopify and updates the site. Changes nothing in Shopify. |
-| `resync_batch` | `resync-batch` | Reads the 50 members synced longest ago. |
+| `resync_batch` | `resync-batch` | Reads the 25 members synced longest ago. |
 | `edit_member_tags` | `tags <customer id> --add a,b --remove c` | Adds or removes tags on the Shopify customer, then reads back what Shopify holds. It's marked destructive for agents. |
 
 **Agents.** EmDash's MCP server is at `/_emdash/api/mcp`, on EmDash versions with plugin MCP tools. RedeemID's tools stay off until an administrator turns them on for RedeemID under **Plugins**. Turning them on approves the list as it stands, and a release that changes the list needs approving again. The agent uses an EmDash API token with the `mcp:tools` or `mcp:tools:redeemid` scope, made by an administrator. Tool names carry the plugin's prefix, for example `redeemid__explain_access`.
@@ -293,7 +295,7 @@ No event carries an email address or a name: match people by the Shopify `custom
 With `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` set (it also runs member preferences), RedeemID gets an Admin API token for the webhook app with the client credentials grant (the app must belong to the same Shopify organization as the store, as Dev Dashboard apps do) and needs the `read_customers` and `write_customers` scopes. Then, in the admin:
 
 - **Member detail.** Open a member from the Members page to see their levels, tags and features, resync them from Shopify, or add and remove tags. Tag edits are made in Shopify, then read back; nothing is granted on the EmDash side.
-- **Bulk resync.** Reads the 50 members synced longest ago from Shopify in one request. Run it again for the next 50. It never runs on its own.
+- **Bulk resync.** Reads the 25 members synced longest ago from Shopify in one request, few enough for the Workers Free limit of 50 database queries a request. Run it again for the next 25. It never runs on its own.
 - **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings).
 - **Recent deliveries.** The last webhooks the site took, with their topics and times.
 - **Access test.** Enter a collection, terms and a reader's tags to see what the entry needs and whether that reader gets in.
@@ -308,13 +310,15 @@ EmDash has no content filter hook, so templates decide what to render. Render th
 ---
 import Content from "@redeemid/emdash/components/Content.astro";
 ---
-<Content value={post.data.content} collection="posts" terms={post.data.terms} id={post.id}>
+<Content value={post.data.content} collection="posts" terms={post.data.terms} id={post.id} title={post.data.title}>
 	<a slot="locked" href="/join/">Become a member</a>
 </Content>
 ```
 
 Everything before the first Paywall break block is shown to everyone. What follows reaches the page only for readers the break allows: the levels picked on it ("Signed in" for any member), or when none are picked the entry's rule. With none picked and no rule covering the entry, the break changes nothing. A body with no break follows the entry's rule as a whole; readers it keeps out see the collection's `teaser` (the paragraphs within that many words, never half a paragraph), if one is set. Plain `<PortableText>` ignores the break and shows everything, so use `<Content>` for any body that may hold one.
 
+On the entry's own page (with `id`), a locked entry also gets Google's paywalled-content markup: JSON-LD saying `isAccessibleForFree: false`, with the wall (`.redeemid-locked`) as the part that isn't free. Search engines can then tell a paywall from cloaking. Pass `title` for its headline. Set `schema: false` in the config if an SEO plugin already adds this markup.
+
 A "Members only" block starts a part for the levels picked on it (none picked: the entry's rule, or any signed-in member) that runs to the next "Members only: end" block. Readers who can't read it see the wall there, and the body goes on after the end block.
 
 The wall is `<LockedPanel>`: it says why the reader is kept out and offers sign-in or the join link, with the wall text of the first level they are missing. `<Content>` and `<Gate>` show it; its default slot (and `<Content>`'s "locked" slot) goes on top.
@@ -358,6 +362,12 @@ import Plan from "@redeemid/emdash/components/Plan.astro";
 </Plan>
 ```
 
+### Caching
+
+`redeemidGuard()` keeps every site page private for a signed-in visitor or a visitor with a cart: `Cache-Control: private, no-store`, and out of Astro's route cache (it calls `cache.set(false)` after the page has set its own cache hint). Visitors with neither get the same page, so their pages stay cacheable.
+
+A route cache keys pages by URL alone and serves a stored page without running any code. So if the site turns on Astro's route cache, don't cache the pages that render `<Content>` or `<Gate>` for locked entries: a member would get the visitor's stored copy, wall included. Call `Astro.cache.set(hint)` only on pages whose entries no rule covers.
+
 ### Shop
 
 Products, collections and the cart come from the Storefront API; Shopify works out prices, discounts, taxes and stock.

package/bin/redeemid-emdash.mjs

@@ -28,7 +28,7 @@ Commands:
   health                  What's set up (never the values)
   changes --since <date>  Who joined or left a level [--level <slug>]
   resync <customer id>    Read one member from Shopify again *
-  resync-batch            Read the 50 members synced longest ago *
+  resync-batch            Read the 25 members synced longest ago *
   tags <customer id>      Edit tags in Shopify: --add a,b --remove c *
 
   * only when the site sets agents: { actions: true }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.11",
+	"version": "0.0.14",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",

package/src/admin-api.ts

@@ -124,9 +124,12 @@ export async function customers(config: RedeemIDConfig, ids: string[], fetcher:
  */
 export async function resync(config: RedeemIDConfig, s: Stores, ids: string[], source = "resync", fetcher: typeof fetch = fetch): Promise<{ updated: MemberRecord[]; missing: string[] }> {
 	const found = await customers(config, ids, fetcher);
+	// One read for the whole batch: on Workers Free one request may make only
+	// 50 database queries, and each write below is one.
+	const known = await s.members.getMany(found.map((c) => c.customerId));
 	const updated: MemberRecord[] = [];
 	for (const c of found) {
-		const m = (await s.members.get(c.customerId)) ?? emptyMember(c.customerId);
+		const m = known.get(c.customerId) ?? emptyMember(c.customerId);
 		m.email = c.email ?? m.email;
 		m.firstName = c.firstName ?? m.firstName;
 		m.lastName = c.lastName ?? m.lastName;

package/src/agents.ts

@@ -11,7 +11,7 @@
 
 import { adminConfigured } from "./admin-api.js";
 import { describe as describeRequirement, dripDays, levelsFor, membership, passes, requirement, termTree, type Requirement, type Terms } from "./access.js";
-import { ENV, env, storeDomain, type RedeemIDConfig } from "./config.js";
+import { ENV, env, storeDomain, unknownEnvNames, type RedeemIDConfig } from "./config.js";
 import { featuresFor } from "./features.js";
 import { bodyClauses } from "./files.js";
 import { holdsItem, soldItem, type SoldItem } from "./blocks-names.js";
@@ -155,6 +155,7 @@ export async function siteHealth(config: RedeemIDConfig, s: Stores): Promise<Rec
 		lastWebhook: items[0]?.data ?? null,
 		openPrivacyRequests: open.items.length,
 		ignoredTextReplacements: textProblems(config).length,
+		unusedSettings: unknownEnvNames(),
 	};
 }
 

package/src/components/Content.astro

@@ -24,6 +24,11 @@
  * `drip` keeps it shut until the member has held their level that many days,
  * and config `meter` lets signed-in readers open a few locked entries each
  * period (each entry counts once). Leave `id` off in lists.
+ *
+ * With `id`, a locked entry's page also gets Google's paywalled-content
+ * markup (isAccessibleForFree false, pointing at the wall), the same for
+ * every reader. Pass `title` for its headline. Config `schema: false` turns
+ * it off.
  */
 import { PortableText } from "emdash/ui";
 
@@ -37,11 +42,13 @@ interface Props {
 	value?: unknown[] | null;
 	collection?: string;
 	terms?: Terms;
-	/** The entry's id, on its own page: turns on drip and the meter. */
+	/** The entry's id, on its own page: turns on drip, the meter and the paywall markup. */
 	id?: string;
+	/** The entry's title, for the paywall markup's headline. */
+	title?: string;
 }
 
-const { value, collection = "", terms, id } = Astro.props;
+const { value, collection = "", terms, id, title } = Astro.props;
 const split = splitAtPaywall(value);
 const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
 const entryRule = await entryRequirement(config, collection, terms);
@@ -77,6 +84,19 @@ async function parts(blocks: unknown[]) {
 }
 const before = await parts(shown);
 const after = await parts(rest);
+// Google's paywalled-content markup, on the entry's own page when any of it is locked.
+const lockedEntry = Boolean(split.paywall ? required : entryRule) || sections(value ?? []).some((s) => s.members);
+const schema =
+	id && lockedEntry && config?.schema !== false
+		? JSON.stringify({
+				"@context": "https://schema.org",
+				"@type": "Article",
+				...(title ? { headline: title } : {}),
+				url: Astro.url.origin + Astro.url.pathname,
+				isAccessibleForFree: false,
+				hasPart: { "@type": "WebPageElement", isAccessibleForFree: false, cssSelector: ".redeemid-locked" },
+			}).replace(/</g, "\\u003c")
+		: null;
 const metered = verdict.reason === "metered" ? (verdict as Verdict) : null;
 const week = metered?.meter?.period === "week";
 const left = metered?.meterLeft ?? 0;
@@ -88,6 +108,7 @@ const meterText =
 			: text(config, week ? "You have {count} free reads left this week." : "You have {count} free reads left this month.", { count: left });
 ---
 
+{schema && <script type="application/ld+json" set:html={schema} />}
 {metered && (
 	<p class="redeemid-meter" role="status" data-redeemid-left={metered.meterLeft}>
 		{meterText}

package/src/config.ts

@@ -150,6 +150,12 @@ export interface RedeemIDConfig {
 	 * one they see none of it.
 	 */
 	teaser?: Record<string, number>;
+	/**
+	 * Google's paywalled-content markup (isAccessibleForFree false, pointing at
+	 * the wall) on the page of each locked entry, printed by <Content> when it
+	 * gets `id`. Set false when an SEO plugin already adds it.
+	 */
+	schema?: false;
 	/**
 	 * Extra /_emdash path prefixes signed-in members may use. Everything else
 	 * under /_emdash is refused to Subscribers (see guard.ts).
@@ -192,6 +198,19 @@ export function env(name: string): string {
 	return typeof value === "string" ? value.trim() : "";
 }
 
+/**
+ * Names of REDEEMID_ variables that are set but that RedeemID doesn't read,
+ * such as a misspelled secret or a WordPress plugin constant. Names only,
+ * never values.
+ */
+export function unknownEnvNames(): string[] {
+	if (typeof process === "undefined" || !process.env) return [];
+	const known = new Set<string>(Object.values(ENV));
+	return Object.keys(process.env)
+		.filter((k) => k.startsWith("REDEEMID_") && !known.has(k))
+		.sort();
+}
+
 /** The store origin, e.g. https://shop.example.com. */
 export function shopOrigin(config: RedeemIDConfig): string {
 	const raw = storeDomain(config).replace(/\/+$/, "");

package/src/guard.ts

@@ -1,16 +1,28 @@
 /**
- * Keeps members out of EmDash's own APIs and admin.
+ * Keeps members out of EmDash's own APIs and admin, and keeps their pages out
+ * of shared caches.
  *
  * EmDash's Subscriber role may read every published entry through
  * /_emdash/api/content. With RedeemID, access comes from Shopify tags only, so
  * a member with one level could otherwise read another level's posts there.
  * This middleware runs after EmDash's auth and refuses Subscribers on every
  * /_emdash path except the few public pages need.
+ *
+ * Site pages for a signed-in visitor, or a visitor with a cart, are private:
+ * `Cache-Control: private, no-store` and out of Astro's route cache. The route
+ * cache ignores Cache-Control and takes its options from `cache.set()`, which
+ * EmDash templates call on every page with the content's cache hint, and it
+ * serves a stored page to the next visitor without running any code. EmDash
+ * opts editors out, not Subscribers, so without this a member's page (locked
+ * text included) could be stored and served to anyone. A later
+ * `Astro.cache.set(hint)` turns caching back on, and the route cache reads its
+ * options only after the page has rendered, so the opt-out runs after `next()`.
  */
 
 import { defineMiddleware } from "astro:middleware";
 
 import { signInUrl } from "./access.js";
+import { readCart } from "./cart.js";
 import { keysFromPath, pathAccess, refusal } from "./files.js";
 import { siteConfig } from "./site-config.js";
 
@@ -45,6 +57,20 @@ async function withUser(context: { locals: unknown; session?: { get(k: string):
 	return { ...context, locals: { ...locals, user: { id: user.id, role: user.role, disabled: user.disabled } } };
 }
 
+/** Keep one visitor's response out of every shared cache, the route cache included. */
+export function keepPrivate(context: { cache?: { set(options: false): void } }, res: Response): Response {
+	context.cache?.set(false);
+	try {
+		res.headers.set("cache-control", "private, no-store");
+		return res;
+	} catch {
+		// Immutable headers (a redirect made with Response.redirect).
+		const out = new Response(res.body, res);
+		out.headers.set("cache-control", "private, no-store");
+		return out;
+	}
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { locals, url } = context;
 	const user = (locals as { user?: { role?: number } | null }).user;
@@ -72,6 +98,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
+	if (!url.pathname.startsWith("/_emdash")) {
+		const own = Boolean(user) || Boolean(await readCart(context.session as never).catch(() => null));
+		return own ? keepPrivate(context, await next()) : next();
+	}
+
 	if (!user || user.role !== SUBSCRIBER) return next();
 
 	if (memberMayUse(url.pathname, config?.memberPaths)) return next();

package/src/plugin.ts

@@ -28,7 +28,7 @@ import type { ResolvedPlugin, RouteContext } from "emdash";
 import { definePlugin } from "emdash";
 
 import { describe, levelsFor, SIGNED_IN } from "./access.js";
-import { env, ENV, storeDomain, type RedeemIDConfig } from "./config.js";
+import { env, ENV, storeDomain, unknownEnvNames, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import { stores, type MemberRecord, type Stores } from "./storage.js";
 import { PAGES, WIDGETS } from "./descriptor.js";
@@ -279,7 +279,7 @@ function agentTools(config: RedeemIDConfig) {
 	};
 	if (config.agents?.actions) {
 		tools.resync_member = { route: "resync-member", input: CUSTOMER, description: "Read one member from Shopify now and update the site. Changes nothing in Shopify." };
-		tools.resync_batch = { route: "resync-batch", input: EMPTY, description: "Read the 50 members synced longest ago from Shopify. Run again for the next 50." };
+		tools.resync_batch = { route: "resync-batch", input: EMPTY, description: `Read the ${BULK_BATCH} members synced longest ago from Shopify. Run again for the next ${BULK_BATCH}.` };
 		tools.edit_member_tags = { route: "edit-member-tags", input: TAGS, destructive: true, description: "Add or remove tags on a member's Shopify customer, then read back what Shopify holds. Access follows from Shopify." };
 	}
 	return { tools };
@@ -544,6 +544,7 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 					{ label: "Storefront API access", value: c.storefront },
 					{ label: "Last webhook", value: delivery ?? "None received yet" },
 					{ label: "Replacement text", value: textSummary(config) },
+					...(unknownEnvNames().length ? [{ label: "Set but not used (check the name)", value: unknownEnvNames().join(", ") }] : []),
 				],
 			},
 			...(textProblems(config).length

package/src/staff.ts

@@ -13,7 +13,12 @@ import { recentRequests } from "./privacy.js";
 import { cleanTags, numericId, type MemberRecord, type Stores } from "./storage.js";
 
 /** Members resynced per click; well inside Shopify's query cost limits. */
-export const BULK_BATCH = 50;
+/**
+ * Members per bulk resync click. Each one costs a database write, and on the
+ * Workers Free plan one request may make only 50 database queries (EmDash's
+ * own session and settings reads included), so a batch has to leave room.
+ */
+export const BULK_BATCH = 25;
 
 type Blocks = { blocks: unknown[]; toast?: { message: string; type: "success" | "error" | "info" } };
 

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.11";
+export const VERSION = "0.0.14";