@redeemid/emdash 0.0.14 → 0.0.16

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.14, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, paywall markup, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
+**Status: 0.0.16, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, paywall markup, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -296,7 +296,7 @@ With `REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID` set (it also runs member preferences
 
 - **Member detail.** Open a member from the Members page to see their levels, tags and features, resync them from Shopify, or add and remove tags. Tag edits are made in Shopify, then read back; nothing is granted on the EmDash side.
 - **Bulk resync.** Reads the 25 members synced longest ago from Shopify in one request, few enough for the Workers Free limit of 50 database queries a request. Run it again for the next 25. It never runs on its own.
-- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings).
+- **Webhooks.** The Status page lists the store's subscriptions to this site and registers any that are missing (`customers/redact` stays in the app's own settings). A topic Shopify refuses, such as `customers/merge` without the `read_customer_merge` scope, is named with the reason and doesn't stop the others.
 - **Recent deliveries.** The last webhooks the site took, with their topics and times.
 - **Access test.** Enter a collection, terms and a reader's tags to see what the entry needs and whether that reader gets in.
 
@@ -368,6 +368,16 @@ import Plan from "@redeemid/emdash/components/Plan.astro";
 
 A route cache keys pages by URL alone and serves a stored page without running any code. So if the site turns on Astro's route cache, don't cache the pages that render `<Content>` or `<Gate>` for locked entries: a member would get the visitor's stored copy, wall included. Call `Astro.cache.set(hint)` only on pages whose entries no rule covers.
 
+### Rate limits
+
+On Cloudflare Workers, `redeemidGuard({ rateLimit: true })` limits how often one visitor can start Sign in, Buy or a cart change, the routes that make calls to Shopify. Add a [Rate Limiting binding](https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/) named `REDEEMID_RATE_LIMIT` to your wrangler config; the limit and period are set there:
+
+```jsonc
+"ratelimits": [{ "name": "REDEEMID_RATE_LIMIT", "namespace_id": "1001", "simple": { "limit": 20, "period": 60 } }]
+```
+
+Each action counts separately per visitor (by `CF-Connecting-IP`). A visitor over the limit goes back to the page they came from with the `too_many_requests` notice. If the binding is missing or fails, nothing is limited. Off by default; leave it off on Node.
+
 ### Shop
 
 Products, collections and the cart come from the Storefront API; Shopify works out prices, discounts, taxes and stock.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.14",
+	"version": "0.0.16",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",
@@ -14,6 +14,7 @@
 		".": "./src/index.ts",
 		"./access": "./src/access.ts",
 		"./guard.ts": "./src/guard.ts",
+		"./rate-limit-cloudflare.ts": "./src/rate-limit-cloudflare.ts",
 		"./storefront": "./src/storefront.ts",
 		"./features": "./src/features.ts",
 		"./events": "./src/events.ts",

package/src/admin-api.ts

@@ -176,10 +176,22 @@ export async function webhookSubscriptions(config: RedeemIDConfig, fetcher: type
 	return data.webhookSubscriptions.nodes.map((n) => ({ id: n.id, topic: n.topic, uri: n.uri ?? "" }));
 }
 
-/** Register the topics RedeemID needs that no subscription sends to `uri` yet. Returns the topics it added. */
-export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetcher: typeof fetch = fetch): Promise<string[]> {
+/** Scopes a topic needs beyond read_customers, to explain a refusal. */
+const TOPIC_SCOPES: Partial<Record<(typeof WEBHOOK_TOPICS)[number], string>> = { CUSTOMERS_MERGE: "read_customer_merge" };
+
+/**
+ * Register the topics RedeemID needs that no subscription sends to `uri` yet.
+ * A topic Shopify refuses doesn't stop the others: it comes back in `failed`.
+ */
+export async function registerWebhooks(
+	config: RedeemIDConfig,
+	uri: string,
+	fetcher: typeof fetch = fetch,
+): Promise<{ added: string[]; failed: Array<{ topic: string; message: string }> }> {
 	const have = await webhookSubscriptions(config, fetcher);
 	const missing = WEBHOOK_TOPICS.filter((t) => !have.some((h) => h.topic === t && h.uri === uri));
+	const added: string[] = [];
+	const failed: Array<{ topic: string; message: string }> = [];
 	for (const topic of missing) {
 		const data = await admin<{ webhookSubscriptionCreate: { userErrors: Array<{ message: string }> } }>(
 			config,
@@ -188,7 +200,8 @@ export async function registerWebhooks(config: RedeemIDConfig, uri: string, fetc
 			fetcher,
 		);
 		const err = data.webhookSubscriptionCreate.userErrors[0];
-		if (err) throw new AdminError(`${topic}: ${err.message}`);
+		if (!err) added.push(topic);
+		else failed.push({ topic, message: TOPIC_SCOPES[topic] ? `${err.message} (the app needs the ${TOPIC_SCOPES[topic]} scope)` : err.message });
 	}
-	return [...missing];
+	return { added, failed };
 }

package/src/astro-modules.d.ts

@@ -2,3 +2,7 @@ declare module "*.astro" {
 	const Component: (props: Record<string, unknown>) => unknown;
 	export default Component;
 }
+
+declare module "cloudflare:workers" {
+	export const env: unknown;
+}

package/src/components/Notices.astro

@@ -16,6 +16,8 @@ const DEFAULTS: Record<string, string> = {
 	sign_in_unavailable: "Sign-in isn't available right now. Try again in a few minutes.",
 	sign_in_expired: "That sign-in took too long. Try again.",
 	staff_account: "This account can't sign in here. Use a different email.",
+	account_disabled: "Your account is turned off. Contact the store for help.",
+	too_many_requests: "Too many tries. Wait a minute, then try again.",
 	site_not_ready: "This site isn't ready for sign-in yet.",
 	email_required: "Your account needs an email address to sign in.",
 	token_failed: "Sign-in didn't finish. Try again.",

package/src/guard.ts

@@ -24,6 +24,7 @@ import { defineMiddleware } from "astro:middleware";
 import { signInUrl } from "./access.js";
 import { readCart } from "./cart.js";
 import { keysFromPath, pathAccess, refusal } from "./files.js";
+import { AFTER_LOGOUT_COOKIE, readAfterLogout } from "./routes/shared.js";
 import { siteConfig } from "./site-config.js";
 
 const SUBSCRIBER = 10;
@@ -98,6 +99,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
+	// Back from ending the store session after a refused sign-in.
+	if (url.pathname === "/" && !url.searchParams.has("redeemid_notice")) {
+		const after = readAfterLogout(context.cookies.get(AFTER_LOGOUT_COOKIE)?.value);
+		if (after) {
+			const sep = after.returnTo.includes("?") ? "&" : "?";
+			const location = `${after.returnTo}${sep}redeemid_notice=${encodeURIComponent(after.code)}`;
+			return new Response(null, { status: 302, headers: { location, "cache-control": "private, no-store", "set-cookie": `${AFTER_LOGOUT_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax` } });
+		}
+	}
+
 	if (!url.pathname.startsWith("/_emdash")) {
 		const own = Boolean(user) || Boolean(await readCart(context.session as never).catch(() => null));
 		return own ? keepPrivate(context, await next()) : next();

package/src/index.ts

@@ -70,11 +70,14 @@ export function redeemid(config: RedeemIDConfig): AuthProviderDescriptor {
  * Astro integration that keeps members (EmDash Subscribers) out of EmDash's
  * content API and admin, so only RedeemID's checks decide who reads what.
  */
-export function redeemidGuard(): AstroIntegration {
+export function redeemidGuard(options: { rateLimit?: boolean } = {}): AstroIntegration {
 	return {
 		name: "@redeemid/emdash/guard",
 		hooks: {
 			"astro:config:setup": ({ addMiddleware }) => {
+				// Cloudflare Workers only: limits Sign in, Buy and cart changes per
+				// visitor with the REDEEMID_RATE_LIMIT Rate Limiting binding.
+				if (options.rateLimit) addMiddleware({ entrypoint: "@redeemid/emdash/rate-limit-cloudflare.ts", order: "pre" });
 				addMiddleware({ entrypoint: "@redeemid/emdash/guard.ts", order: "post" });
 			},
 		},

package/src/plugin.ts

@@ -342,8 +342,10 @@ async function action(
 		}
 		case "webhooks_register": {
 			try {
-				const added = await registerWebhooks(config, webhookUri(request));
-				return { ...(await statusPage(config, request)), toast: { type: "success", message: added.length ? `Registered ${added.length} webhooks.` : "Nothing was missing." } };
+				const { added, failed } = await registerWebhooks(config, webhookUri(request));
+				const done = added.length ? `Registered ${added.length} webhooks.` : failed.length ? "" : "Nothing was missing.";
+				const refused = failed.map((f) => `Shopify refused ${f.topic}: ${f.message}`).join(" ");
+				return { ...(await statusPage(config, request)), toast: { type: failed.length ? "error" : "success", message: [done, refused].filter(Boolean).join(" ") } };
 			} catch (e) {
 				return { ...(await statusPage(config, request)), toast: fail(e) };
 			}

package/src/rate-limit-cloudflare.ts

@@ -0,0 +1,20 @@
+/**
+ * Rate limits on Cloudflare Workers, added by `redeemidGuard({ rateLimit: true })`.
+ * Reads the REDEEMID_RATE_LIMIT Rate Limiting binding from wrangler config.
+ */
+
+import { defineMiddleware } from "astro:middleware";
+import { env } from "cloudflare:workers";
+
+import { RATE_LIMIT_BINDING, rateLimited, type RateLimiter } from "./rate-limit.js";
+
+let warned = false;
+
+export const onRequest = defineMiddleware(async (context, next) => {
+	const limiter = (env as Record<string, unknown>)[RATE_LIMIT_BINDING] as RateLimiter | undefined;
+	if (!limiter && !warned) {
+		warned = true;
+		console.warn(`[redeemid] rateLimit is on but there is no ${RATE_LIMIT_BINDING} binding; nothing is limited.`);
+	}
+	return (await rateLimited(limiter, context.request)) ?? next();
+});

package/src/rate-limit.ts

@@ -0,0 +1,66 @@
+/**
+ * Optional per-visitor rate limits on the routes that start work at Shopify:
+ * Sign in, Buy and cart changes. On Cloudflare Workers they use a Rate
+ * Limiting binding named REDEEMID_RATE_LIMIT (see rate-limit-cloudflare.ts);
+ * nothing is limited without one.
+ */
+
+export const RATE_LIMIT_BINDING = "REDEEMID_RATE_LIMIT";
+
+/** The shape of a Workers Rate Limiting binding. */
+export interface RateLimiter {
+	limit(options: { key: string }): Promise<{ success: boolean }>;
+}
+
+const BASE = "/_emdash/api/auth/redeemid";
+const LIMITED: Record<string, string> = {
+	[`GET ${BASE}/login`]: "login",
+	[`POST ${BASE}/buy`]: "buy",
+	[`POST ${BASE}/cart-edit`]: "cart",
+};
+
+/** Which limited action a request is, or null. */
+export function limitedAction(method: string, path: string): string | null {
+	return LIMITED[`${method.toUpperCase()} ${path.replace(/\/+$/, "")}`] ?? null;
+}
+
+/** Where to send a reader who was limited: the page they came from, on this site. */
+function backTo(url: URL, request: Request): string {
+	const ret = url.searchParams.get("return");
+	if (ret && ret.startsWith("/") && !ret.startsWith("//") && !ret.startsWith("/\\")) return ret;
+	const referer = request.headers.get("referer");
+	if (referer) {
+		try {
+			const r = new URL(referer);
+			if (r.origin === url.origin && !r.pathname.startsWith("/_emdash")) return `${r.pathname}${r.search}`;
+		} catch {
+			// ignore
+		}
+	}
+	return "/";
+}
+
+/**
+ * A response for a request over its limit, or null to let it through. Fails
+ * open: a limiter that errors never blocks a reader.
+ */
+export async function rateLimited(limiter: RateLimiter | undefined, request: Request): Promise<Response | null> {
+	if (!limiter || typeof limiter.limit !== "function") return null;
+	const url = new URL(request.url);
+	const action = limitedAction(request.method, url.pathname);
+	if (!action) return null;
+	const ip = request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+	try {
+		const { success } = await limiter.limit({ key: `${action}:${ip}` });
+		if (success) return null;
+	} catch (e) {
+		console.error("[redeemid] rate limit check failed:", (e as Error).message);
+		return null;
+	}
+	const back = backTo(url, request);
+	const sep = back.includes("?") ? "&" : "?";
+	return new Response(null, {
+		status: 303,
+		headers: { location: `${back}${sep}redeemid_notice=too_many_requests`, "retry-after": "60", "cache-control": "private, no-store" },
+	});
+}

package/src/routes/callback.ts

@@ -12,15 +12,16 @@
 import { findOrCreateOAuthUser, OAuthError, Role } from "@emdash-cms/auth";
 import { createKyselyAdapter, type AuthTables } from "@emdash-cms/auth/adapters/kysely";
 import type { APIRoute } from "astro";
-import { OptionsRepository } from "emdash/api/route-utils";
 import type { Kysely } from "kysely";
 
 import { env, ENV, PROVIDER_ID, readConfig, storeDomain } from "../config.js";
 import { emit, levelChange } from "../events.js";
 import { levelsFor } from "../access.js";
-import { discover, exchangeCode, identity, ShopifyError, verifyIdToken } from "../shopify.js";
+import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
-import { callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
+import { getPublicOrigin, OptionsRepository } from "emdash/api/route-utils";
+
+import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
 
 export const prerender = false;
 
@@ -63,10 +64,13 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			verifier: flow.verifier,
 		});
 		const claims = await verifyIdToken(d, tokens.idToken, { clientId, nonce: flow.nonce });
+		// Refusals from here on also end the store session, so the next Sign in
+		// asks for an email again instead of reusing this account.
+		const refuse = (code: string) => signedOut(d, tokens.idToken, url, emdash.config, returnTo, code) ?? fail(redirect, returnTo, code);
 		const who = await identity(d, tokens.accessToken);
 
 		const email = (typeof claims.email === "string" ? claims.email : who.email)?.toLowerCase() ?? null;
-		if (!email) return fail(redirect, returnTo, "email_required");
+		if (!email) return refuse("email_required");
 		const emailVerified = claims.email_verified === true;
 
 		const adapter = createKyselyAdapter(emdash.db as Kysely<AuthTables>);
@@ -74,7 +78,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		// Staff accounts never sign in through the store, even with the same email.
 		const linked = await adapter.getOAuthAccount(PROVIDER_ID, who.customerId);
 		const existing = linked ? await adapter.getUserById(linked.userId) : await adapter.getUserByEmail(email);
-		if (existing && existing.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
+		if (existing && existing.role > Role.SUBSCRIBER) return refuse("staff_account");
 
 		const name = [who.firstName, who.lastName].filter(Boolean).join(" ") || null;
 		const user = await findOrCreateOAuthUser(
@@ -84,8 +88,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			async () => ({ allowed: true, role: Role.SUBSCRIBER }),
 			{ requireVerifiedEmail: true },
 		);
-		if (user.disabled) return fail(redirect, returnTo, "account_disabled");
-		if (user.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
+		if (user.disabled) return refuse("account_disabled");
+		if (user.role > Role.SUBSCRIBER) return refuse("staff_account");
 
 		const s = stores(emdash.db);
 		const found = await s.members.get(who.customerId);
@@ -123,3 +127,11 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		return fail(redirect, returnTo, code);
 	}
 };
+
+/** Ends the store session, then shows `code` on `returnTo` (see AFTER_LOGOUT_COOKIE). */
+function signedOut(d: Discovery, idToken: string, url: URL, emdashConfig: unknown, returnTo: string, code: string): Response | null {
+	const origin = getPublicOrigin(url, emdashConfig as Parameters<typeof getPublicOrigin>[1]);
+	const to = logoutUrl(d, idToken, `${origin}/`);
+	if (!to) return null;
+	return new Response(null, { status: 302, headers: { location: to, "set-cookie": afterLogoutCookie(code, returnTo), "cache-control": "private, no-store" } });
+}

package/src/routes/shared.ts

@@ -26,3 +26,29 @@ export function fail(redirect: (to: string) => Response, returnTo: string, code:
 	const sep = returnTo.includes("?") ? "&" : "?";
 	return redirect(`${returnTo}${sep}redeemid_notice=${encodeURIComponent(code)}`);
 }
+
+/**
+ * A refused sign-in also ends the store session, or the next Sign in would
+ * pass straight through with the same account. Shopify only returns to the
+ * site root after that, so this short cookie carries the notice and the page
+ * back; the guard middleware turns it into the usual `?redeemid_notice=`.
+ */
+export const AFTER_LOGOUT_COOKIE = "redeemid_after_logout";
+export const SIGNED_OUT_NOTICES = ["staff_account", "account_disabled", "email_required"] as const;
+
+export function afterLogoutCookie(code: string, returnTo: string): string {
+	return `${AFTER_LOGOUT_COOKIE}=${encodeURIComponent(JSON.stringify([code, returnTo]))}; Path=/; Max-Age=600; HttpOnly; Secure; SameSite=Lax`;
+}
+
+/** The notice and page a refused sign-in left, or null. */
+export function readAfterLogout(raw: string | undefined): { code: string; returnTo: string } | null {
+	if (!raw) return null;
+	try {
+		const [code, returnTo] = JSON.parse(decodeURIComponent(raw)) as [unknown, unknown];
+		if (typeof code !== "string" || !(SIGNED_OUT_NOTICES as readonly string[]).includes(code)) return null;
+		const to = typeof returnTo === "string" && returnTo.startsWith("/") && !returnTo.startsWith("//") && !returnTo.startsWith("/\\") ? returnTo : "/";
+		return { code, returnTo: to };
+	} catch {
+		return null;
+	}
+}

package/src/text.ts

@@ -84,6 +84,8 @@ export const STRINGS = {
 		"Sign-in isn't available right now. Try again in a few minutes.",
 		"That sign-in took too long. Try again.",
 		"This account can't sign in here. Use a different email.",
+		"Your account is turned off. Contact the store for help.",
+		"Too many tries. Wait a minute, then try again.",
 		"This site isn't ready for sign-in yet.",
 		"Your account needs an email address to sign in.",
 		"Sign-in didn't finish. Try again.",

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.14";
+export const VERSION = "0.0.16";