@redeemid/emdash 0.0.15 → 0.0.16

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.15, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, paywall markup, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
+**Status: 0.0.16, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, paywall markup, badges, the page gate, the Shopify cart and checkout, the staff tools, preferences, protected files, privacy requests, AI agent tools, the command line, replacement text and outbound events are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -368,6 +368,16 @@ import Plan from "@redeemid/emdash/components/Plan.astro";
 
 A route cache keys pages by URL alone and serves a stored page without running any code. So if the site turns on Astro's route cache, don't cache the pages that render `<Content>` or `<Gate>` for locked entries: a member would get the visitor's stored copy, wall included. Call `Astro.cache.set(hint)` only on pages whose entries no rule covers.
 
+### Rate limits
+
+On Cloudflare Workers, `redeemidGuard({ rateLimit: true })` limits how often one visitor can start Sign in, Buy or a cart change, the routes that make calls to Shopify. Add a [Rate Limiting binding](https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/) named `REDEEMID_RATE_LIMIT` to your wrangler config; the limit and period are set there:
+
+```jsonc
+"ratelimits": [{ "name": "REDEEMID_RATE_LIMIT", "namespace_id": "1001", "simple": { "limit": 20, "period": 60 } }]
+```
+
+Each action counts separately per visitor (by `CF-Connecting-IP`). A visitor over the limit goes back to the page they came from with the `too_many_requests` notice. If the binding is missing or fails, nothing is limited. Off by default; leave it off on Node.
+
 ### Shop
 
 Products, collections and the cart come from the Storefront API; Shopify works out prices, discounts, taxes and stock.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.15",
+	"version": "0.0.16",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",
@@ -14,6 +14,7 @@
 		".": "./src/index.ts",
 		"./access": "./src/access.ts",
 		"./guard.ts": "./src/guard.ts",
+		"./rate-limit-cloudflare.ts": "./src/rate-limit-cloudflare.ts",
 		"./storefront": "./src/storefront.ts",
 		"./features": "./src/features.ts",
 		"./events": "./src/events.ts",

package/src/astro-modules.d.ts

@@ -2,3 +2,7 @@ declare module "*.astro" {
 	const Component: (props: Record<string, unknown>) => unknown;
 	export default Component;
 }
+
+declare module "cloudflare:workers" {
+	export const env: unknown;
+}

package/src/components/Notices.astro

@@ -17,6 +17,7 @@ const DEFAULTS: Record<string, string> = {
 	sign_in_expired: "That sign-in took too long. Try again.",
 	staff_account: "This account can't sign in here. Use a different email.",
 	account_disabled: "Your account is turned off. Contact the store for help.",
+	too_many_requests: "Too many tries. Wait a minute, then try again.",
 	site_not_ready: "This site isn't ready for sign-in yet.",
 	email_required: "Your account needs an email address to sign in.",
 	token_failed: "Sign-in didn't finish. Try again.",

package/src/index.ts

@@ -70,11 +70,14 @@ export function redeemid(config: RedeemIDConfig): AuthProviderDescriptor {
  * Astro integration that keeps members (EmDash Subscribers) out of EmDash's
  * content API and admin, so only RedeemID's checks decide who reads what.
  */
-export function redeemidGuard(): AstroIntegration {
+export function redeemidGuard(options: { rateLimit?: boolean } = {}): AstroIntegration {
 	return {
 		name: "@redeemid/emdash/guard",
 		hooks: {
 			"astro:config:setup": ({ addMiddleware }) => {
+				// Cloudflare Workers only: limits Sign in, Buy and cart changes per
+				// visitor with the REDEEMID_RATE_LIMIT Rate Limiting binding.
+				if (options.rateLimit) addMiddleware({ entrypoint: "@redeemid/emdash/rate-limit-cloudflare.ts", order: "pre" });
 				addMiddleware({ entrypoint: "@redeemid/emdash/guard.ts", order: "post" });
 			},
 		},

package/src/rate-limit-cloudflare.ts

@@ -0,0 +1,20 @@
+/**
+ * Rate limits on Cloudflare Workers, added by `redeemidGuard({ rateLimit: true })`.
+ * Reads the REDEEMID_RATE_LIMIT Rate Limiting binding from wrangler config.
+ */
+
+import { defineMiddleware } from "astro:middleware";
+import { env } from "cloudflare:workers";
+
+import { RATE_LIMIT_BINDING, rateLimited, type RateLimiter } from "./rate-limit.js";
+
+let warned = false;
+
+export const onRequest = defineMiddleware(async (context, next) => {
+	const limiter = (env as Record<string, unknown>)[RATE_LIMIT_BINDING] as RateLimiter | undefined;
+	if (!limiter && !warned) {
+		warned = true;
+		console.warn(`[redeemid] rateLimit is on but there is no ${RATE_LIMIT_BINDING} binding; nothing is limited.`);
+	}
+	return (await rateLimited(limiter, context.request)) ?? next();
+});

package/src/rate-limit.ts

@@ -0,0 +1,66 @@
+/**
+ * Optional per-visitor rate limits on the routes that start work at Shopify:
+ * Sign in, Buy and cart changes. On Cloudflare Workers they use a Rate
+ * Limiting binding named REDEEMID_RATE_LIMIT (see rate-limit-cloudflare.ts);
+ * nothing is limited without one.
+ */
+
+export const RATE_LIMIT_BINDING = "REDEEMID_RATE_LIMIT";
+
+/** The shape of a Workers Rate Limiting binding. */
+export interface RateLimiter {
+	limit(options: { key: string }): Promise<{ success: boolean }>;
+}
+
+const BASE = "/_emdash/api/auth/redeemid";
+const LIMITED: Record<string, string> = {
+	[`GET ${BASE}/login`]: "login",
+	[`POST ${BASE}/buy`]: "buy",
+	[`POST ${BASE}/cart-edit`]: "cart",
+};
+
+/** Which limited action a request is, or null. */
+export function limitedAction(method: string, path: string): string | null {
+	return LIMITED[`${method.toUpperCase()} ${path.replace(/\/+$/, "")}`] ?? null;
+}
+
+/** Where to send a reader who was limited: the page they came from, on this site. */
+function backTo(url: URL, request: Request): string {
+	const ret = url.searchParams.get("return");
+	if (ret && ret.startsWith("/") && !ret.startsWith("//") && !ret.startsWith("/\\")) return ret;
+	const referer = request.headers.get("referer");
+	if (referer) {
+		try {
+			const r = new URL(referer);
+			if (r.origin === url.origin && !r.pathname.startsWith("/_emdash")) return `${r.pathname}${r.search}`;
+		} catch {
+			// ignore
+		}
+	}
+	return "/";
+}
+
+/**
+ * A response for a request over its limit, or null to let it through. Fails
+ * open: a limiter that errors never blocks a reader.
+ */
+export async function rateLimited(limiter: RateLimiter | undefined, request: Request): Promise<Response | null> {
+	if (!limiter || typeof limiter.limit !== "function") return null;
+	const url = new URL(request.url);
+	const action = limitedAction(request.method, url.pathname);
+	if (!action) return null;
+	const ip = request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+	try {
+		const { success } = await limiter.limit({ key: `${action}:${ip}` });
+		if (success) return null;
+	} catch (e) {
+		console.error("[redeemid] rate limit check failed:", (e as Error).message);
+		return null;
+	}
+	const back = backTo(url, request);
+	const sep = back.includes("?") ? "&" : "?";
+	return new Response(null, {
+		status: 303,
+		headers: { location: `${back}${sep}redeemid_notice=too_many_requests`, "retry-after": "60", "cache-control": "private, no-store" },
+	});
+}

package/src/text.ts

@@ -85,6 +85,7 @@ export const STRINGS = {
 		"That sign-in took too long. Try again.",
 		"This account can't sign in here. Use a different email.",
 		"Your account is turned off. Contact the store for help.",
+		"Too many tries. Wait a minute, then try again.",
 		"This site isn't ready for sign-in yet.",
 		"Your account needs an email address to sign in.",
 		"Sign-in didn't finish. Try again.",

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.15";
+export const VERSION = "0.0.16";