@redeemid/emdash 0.0.14 → 0.0.15

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.14, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, paywall markup, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
+**Status: 0.0.15, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, paywall markup, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -296,7 +296,7 @@ With `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` set (it also runs member preferences
 
 - **Member detail.** Open a member from the Members page to see their levels, tags and features, resync them from Shopify, or add and remove tags. Tag edits are made in Shopify, then read back; nothing is granted on the EmDash side.
 - **Bulk resync.** Reads the 25 members synced longest ago from Shopify in one request, few enough for the Workers Free limit of 50 database queries a request. Run it again for the next 25. It never runs on its own.
-- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings).
+- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings). A topic Shopify refuses, such as `customers/merge` without the `read_customer_merge` scope, is named with the reason and doesn't stop the others.
 - **Recent deliveries.** The last webhooks the site took, with their topics and times.
 - **Access test.** Enter a collection, terms and a reader's tags to see what the entry needs and whether that reader gets in.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.14",
+	"version": "0.0.15",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",

package/src/admin-api.ts

@@ -176,10 +176,22 @@ export async function webhookSubscriptions(config: RedeemIDConfig, fetcher: type
 	return data.webhookSubscriptions.nodes.map((n) => ({ id: n.id, topic: n.topic, uri: n.uri ?? "" }));
 }
 
-/** Register the topics RedeemID needs that no subscription sends to `uri` yet. Returns the topics it added. */
-export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetcher: typeof fetch = fetch): Promise<string[]> {
+/** Scopes a topic needs beyond read_customers, to explain a refusal. */
+const TOPIC_SCOPES: Partial<Record<(typeof WEBHOOK_TOPICS)[number], string>> = { CUSTOMERS_MERGE: "read_customer_merge" };
+
+/**
+ * Register the topics RedeemID needs that no subscription sends to `uri` yet.
+ * A topic Shopify refuses doesn't stop the others: it comes back in `failed`.
+ */
+export async function registerWebhooks(
+	config: RedeemIDConfig,
+	uri: string,
+	fetcher: typeof fetch = fetch,
+): Promise<{ added: string[]; failed: Array<{ topic: string; message: string }> }> {
 	const have = await webhookSubscriptions(config, fetcher);
 	const missing = WEBHOOK_TOPICS.filter((t) => !have.some((h) => h.topic === t && h.uri === uri));
+	const added: string[] = [];
+	const failed: Array<{ topic: string; message: string }> = [];
 	for (const topic of missing) {
 		const data = await admin<{ webhookSubscriptionCreate: { userErrors: Array<{ message: string }> } }>(
 			config,
@@ -188,7 +200,8 @@ export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetc
 			fetcher,
 		);
 		const err = data.webhookSubscriptionCreate.userErrors[0];
-		if (err) throw new AdminError(`${topic}: ${err.message}`);
+		if (!err) added.push(topic);
+		else failed.push({ topic, message: TOPIC_SCOPES[topic] ? `${err.message} (the app needs the ${TOPIC_SCOPES[topic]} scope)` : err.message });
 	}
-	return [...missing];
+	return { added, failed };
 }

package/src/components/Notices.astro

@@ -16,6 +16,7 @@ const DEFAULTS: Record<string, string> = {
 	sign_in_unavailable: "Sign-in isn't available right now. Try again in a few minutes.",
 	sign_in_expired: "That sign-in took too long. Try again.",
 	staff_account: "This account can't sign in here. Use a different email.",
+	account_disabled: "Your account is turned off. Contact the store for help.",
 	site_not_ready: "This site isn't ready for sign-in yet.",
 	email_required: "Your account needs an email address to sign in.",
 	token_failed: "Sign-in didn't finish. Try again.",

package/src/guard.ts

@@ -24,6 +24,7 @@ import { defineMiddleware } from "astro:middleware";
 import { signInUrl } from "./access.js";
 import { readCart } from "./cart.js";
 import { keysFromPath, pathAccess, refusal } from "./files.js";
+import { AFTER_LOGOUT_COOKIE, readAfterLogout } from "./routes/shared.js";
 import { siteConfig } from "./site-config.js";
 
 const SUBSCRIBER = 10;
@@ -98,6 +99,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
+	// Back from ending the store session after a refused sign-in.
+	if (url.pathname === "/" && !url.searchParams.has("redeemid_notice")) {
+		const after = readAfterLogout(context.cookies.get(AFTER_LOGOUT_COOKIE)?.value);
+		if (after) {
+			const sep = after.returnTo.includes("?") ? "&" : "?";
+			const location = `${after.returnTo}${sep}redeemid_notice=${encodeURIComponent(after.code)}`;
+			return new Response(null, { status: 302, headers: { location, "cache-control": "private, no-store", "set-cookie": `${AFTER_LOGOUT_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax` } });
+		}
+	}
+
 	if (!url.pathname.startsWith("/_emdash")) {
 		const own = Boolean(user) || Boolean(await readCart(context.session as never).catch(() => null));
 		return own ? keepPrivate(context, await next()) : next();

package/src/plugin.ts

@@ -342,8 +342,10 @@ async function action(
 		}
 		case "webhooks_register": {
 			try {
-				const added = await registerWebhooks(config, webhookUri(request));
-				return { ...(await statusPage(config, request)), toast: { type: "success", message: added.length ? `Registered ${added.length} webhooks.` : "Nothing was missing." } };
+				const { added, failed } = await registerWebhooks(config, webhookUri(request));
+				const done = added.length ? `Registered ${added.length} webhooks.` : failed.length ? "" : "Nothing was missing.";
+				const refused = failed.map((f) => `Shopify refused ${f.topic}: ${f.message}`).join(" ");
+				return { ...(await statusPage(config, request)), toast: { type: failed.length ? "error" : "success", message: [done, refused].filter(Boolean).join(" ") } };
 			} catch (e) {
 				return { ...(await statusPage(config, request)), toast: fail(e) };
 			}

package/src/routes/callback.ts

@@ -12,15 +12,16 @@
 import { findOrCreateOAuthUser, OAuthError, Role } from "@emdash-cms/auth";
 import { createKyselyAdapter, type AuthTables } from "@emdash-cms/auth/adapters/kysely";
 import type { APIRoute } from "astro";
-import { OptionsRepository } from "emdash/api/route-utils";
 import type { Kysely } from "kysely";
 
 import { env, ENV, PROVIDER_ID, readConfig, storeDomain } from "../config.js";
 import { emit, levelChange } from "../events.js";
 import { levelsFor } from "../access.js";
-import { discover, exchangeCode, identity, ShopifyError, verifyIdToken } from "../shopify.js";
+import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
-import { callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
+import { getPublicOrigin, OptionsRepository } from "emdash/api/route-utils";
+
+import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
 
 export const prerender = false;
 
@@ -63,10 +64,13 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			verifier: flow.verifier,
 		});
 		const claims = await verifyIdToken(d, tokens.idToken, { clientId, nonce: flow.nonce });
+		// Refusals from here on also end the store session, so the next Sign in
+		// asks for an email again instead of reusing this account.
+		const refuse = (code: string) => signedOut(d, tokens.idToken, url, emdash.config, returnTo, code) ?? fail(redirect, returnTo, code);
 		const who = await identity(d, tokens.accessToken);
 
 		const email = (typeof claims.email === "string" ? claims.email : who.email)?.toLowerCase() ?? null;
-		if (!email) return fail(redirect, returnTo, "email_required");
+		if (!email) return refuse("email_required");
 		const emailVerified = claims.email_verified === true;
 
 		const adapter = createKyselyAdapter(emdash.db as Kysely<AuthTables>);
@@ -74,7 +78,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		// Staff accounts never sign in through the store, even with the same email.
 		const linked = await adapter.getOAuthAccount(PROVIDER_ID, who.customerId);
 		const existing = linked ? await adapter.getUserById(linked.userId) : await adapter.getUserByEmail(email);
-		if (existing && existing.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
+		if (existing && existing.role > Role.SUBSCRIBER) return refuse("staff_account");
 
 		const name = [who.firstName, who.lastName].filter(Boolean).join(" ") || null;
 		const user = await findOrCreateOAuthUser(
@@ -84,8 +88,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			async () => ({ allowed: true, role: Role.SUBSCRIBER }),
 			{ requireVerifiedEmail: true },
 		);
-		if (user.disabled) return fail(redirect, returnTo, "account_disabled");
-		if (user.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
+		if (user.disabled) return refuse("account_disabled");
+		if (user.role > Role.SUBSCRIBER) return refuse("staff_account");
 
 		const s = stores(emdash.db);
 		const found = await s.members.get(who.customerId);
@@ -123,3 +127,11 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		return fail(redirect, returnTo, code);
 	}
 };
+
+/** Ends the store session, then shows `code` on `returnTo` (see AFTER_LOGOUT_COOKIE). */
+function signedOut(d: Discovery, idToken: string, url: URL, emdashConfig: unknown, returnTo: string, code: string): Response | null {
+	const origin = getPublicOrigin(url, emdashConfig as Parameters<typeof getPublicOrigin>[1]);
+	const to = logoutUrl(d, idToken, `${origin}/`);
+	if (!to) return null;
+	return new Response(null, { status: 302, headers: { location: to, "set-cookie": afterLogoutCookie(code, returnTo), "cache-control": "private, no-store" } });
+}

package/src/routes/shared.ts

@@ -26,3 +26,29 @@ export function fail(redirect: (to: string) => Response, returnTo: string, code:
 	const sep = returnTo.includes("?") ? "&" : "?";
 	return redirect(`${returnTo}${sep}redeemid_notice=${encodeURIComponent(code)}`);
 }
+
+/**
+ * A refused sign-in also ends the store session, or the next Sign in would
+ * pass straight through with the same account. Shopify only returns to the
+ * site root after that, so this short cookie carries the notice and the page
+ * back; the guard middleware turns it into the usual `?redeemid_notice=`.
+ */
+export const AFTER_LOGOUT_COOKIE = "redeemid_after_logout";
+export const SIGNED_OUT_NOTICES = ["staff_account", "account_disabled", "email_required"] as const;
+
+export function afterLogoutCookie(code: string, returnTo: string): string {
+	return `${AFTER_LOGOUT_COOKIE}=${encodeURIComponent(JSON.stringify([code, returnTo]))}; Path=/; Max-Age=600; HttpOnly; Secure; SameSite=Lax`;
+}
+
+/** The notice and page a refused sign-in left, or null. */
+export function readAfterLogout(raw: string | undefined): { code: string; returnTo: string } | null {
+	if (!raw) return null;
+	try {
+		const [code, returnTo] = JSON.parse(decodeURIComponent(raw)) as [unknown, unknown];
+		if (typeof code !== "string" || !(SIGNED_OUT_NOTICES as readonly string[]).includes(code)) return null;
+		const to = typeof returnTo === "string" && returnTo.startsWith("/") && !returnTo.startsWith("//") && !returnTo.startsWith("/\\") ? returnTo : "/";
+		return { code, returnTo: to };
+	} catch {
+		return null;
+	}
+}

package/src/text.ts

@@ -84,6 +84,7 @@ export const STRINGS = {
 		"Sign-in isn't available right now. Try again in a few minutes.",
 		"That sign-in took too long. Try again.",
 		"This account can't sign in here. Use a different email.",
+		"Your account is turned off. Contact the store for help.",
 		"This site isn't ready for sign-in yet.",
 		"Your account needs an email address to sign in.",
 		"Sign-in didn't finish. Try again.",

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.14";
+export const VERSION = "0.0.15";