@redeemid/emdash 0.0.18 → 0.0.19

package/README.md

@@ -7,7 +7,7 @@ Memberships and paywalls for [EmDash](https://github.com/emdash-cms/emdash) site
 
 Readers sign in with the store's own customer account. Their Shopify customer tags decide what they can read. Shopify keeps the store, checkout, orders and subscriptions, and EmDash keeps the content. Nothing on the site grants access by itself, so there is one source of truth for who paid for what.
 
-**Status: 0.0.18, early.** Runs on Node and Cloudflare Workers. Every feature below is covered by unit tests and an end-to-end test that boots a real EmDash site against a fake Shopify store. Expect changes before 1.0.
+**Status: 0.0.19, early.** Runs on Node and Cloudflare Workers. Every feature below is covered by unit tests and an end-to-end test that boots a real EmDash site against a fake Shopify store. Expect changes before 1.0.
 
 ## Contents
 

package/docs/developer-api.md

@@ -47,7 +47,7 @@ Under `/_emdash/api/auth/redeemid/`. Same-origin only: EmDash checks `Origin` on
 - `api/state` (GET): the visitor's own state.
 
   ```json
-  { "apiVersion": "1.0.0", "version": "0.0.18", "signedIn": true, "linked": true,
+  { "apiVersion": "1.0.0", "version": "0.0.19", "signedIn": true, "linked": true,
     "levels": ["gold"], "features": ["ad-free"], "cart": { "count": 2 },
     "meter": { "used": 1, "limit": 3, "period": "month" } }
   ```

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.18",
+	"version": "0.0.19",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",

package/src/files.ts

@@ -118,7 +118,8 @@ export async function fileAccess(astro: AstroLike, config: RedeemIDConfig | null
 	if (!config?.files?.length) return { protected: false };
 	const locals = astro.locals as { user?: { role?: number } | null; emdash?: { db?: unknown } | null };
 	const db = locals.emdash?.db;
-	if (!db) return { protected: false };
+	// No database to look the file up in: the caller fails closed.
+	if (!db) throw new Error("no database for the file check");
 	const media = await mediaByKey(db, key);
 	const rule = ruleFor(config, media?.folder ?? null);
 	if (!media || !rule) return { protected: false };
@@ -162,12 +163,49 @@ export function keysFromPath(pathname: string): string[] | null {
 			break;
 		}
 		out.push(decoded);
+		// The file route drops slashes around the key, so the check does too.
+		const trimmed = decoded.replace(/^\/+|\/+$/g, "");
+		if (trimmed && trimmed !== decoded) out.push(trimmed);
 		if (decoded === candidate) break;
 		candidate = decoded;
 	}
 	return [...new Set(out)];
 }
 
+/** Astro's image endpoint, which reads the file its `href` names and answers with it. */
+export const IMAGE_PATH = "/_image";
+
+/**
+ * The storage keys a request could reach: a file URL's own, or those of the
+ * file an image-endpoint request asks for by `href`. Null when it names none.
+ */
+export function keysFromUrl(url: URL): string[] | null {
+	const direct = keysFromPath(url.pathname);
+	if (direct) return direct;
+	if (url.pathname.replace(/\/+$/, "") !== IMAGE_PATH) return null;
+	const out: string[] = [];
+	for (const href of url.searchParams.getAll("href")) {
+		let candidate = href;
+		for (let layer = 0; layer < 4; layer++) {
+			try {
+				const keys = keysFromPath(new URL(candidate, url.origin).pathname);
+				if (keys) out.push(...keys);
+			} catch {
+				// Not a URL: nothing to check.
+			}
+			let decoded: string;
+			try {
+				decoded = decodeURIComponent(candidate);
+			} catch {
+				break;
+			}
+			if (decoded === candidate) break;
+			candidate = decoded;
+		}
+	}
+	return out.length ? [...new Set(out)] : null;
+}
+
 /** Decide a download that may name several keys: the first protected one decides. */
 export async function pathAccess(astro: AstroLike, config: RedeemIDConfig | null, keys: string[]): Promise<FileVerdict> {
 	for (const key of keys) {

package/src/guard.ts

@@ -23,7 +23,7 @@ import { defineMiddleware } from "astro:middleware";
 
 import { signInUrl } from "./access.js";
 import { readCart } from "./cart.js";
-import { keysFromPath, pathAccess, refusal } from "./files.js";
+import { keysFromUrl, pathAccess, refusal } from "./files.js";
 import { AFTER_LOGOUT_COOKIE, readAfterLogout } from "./routes/shared.js";
 import { shareConfig, siteConfig } from "./site-config.js";
 
@@ -49,7 +49,14 @@ export function memberMayUse(path: string, extra: string[] = []): boolean {
  */
 async function withUser(context: { locals: unknown; session?: { get(k: string): Promise<unknown> } }) {
 	const locals = context.locals as { user?: { id: string; role?: number } | null; emdash?: { db?: unknown } | null };
-	if (locals.user || !locals.emdash?.db) return context;
+	if (!locals.emdash?.db) {
+		// EmDash leaves the database off some public requests: fetch it, so the check can run.
+		const { getDb } = await import("emdash/runtime");
+		const next = { ...locals, emdash: { ...(locals.emdash ?? {}), db: await getDb() } };
+		shareConfig(locals, next);
+		return withUser({ ...context, locals: next });
+	}
+	if (locals.user) return context;
 	const sessionUser = (await context.session?.get("user")) as { id?: string } | undefined;
 	if (!sessionUser?.id) return context;
 	const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
@@ -80,7 +87,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	const config = await siteConfig(locals);
 
 	// Protected files: checked for everyone, on every download.
-	const keys = config?.files?.length ? keysFromPath(url.pathname) : null;
+	const keys = config?.files?.length ? keysFromUrl(url) : null;
 	if (keys) {
 		let verdict;
 		try {

package/src/log.ts

@@ -10,6 +10,7 @@
 import type { StorageCollection } from "emdash";
 
 export const LOG_DAYS = 30;
+const PRUNE_PAGES = 5;
 
 export type LogOrigin = "webhook" | "member" | "staff" | "agent" | "cron" | "site";
 
@@ -90,7 +91,13 @@ export async function timed<T>(event: string, label: string, run: () => Promise<
 /** Delete entries (and other dated records) older than `days`, a page at a time. */
 export async function prune<T>(store: StorageCollection<T>, field: string, days = LOG_DAYS): Promise<number> {
 	const before = new Date(Date.now() - days * 86_400_000).toISOString();
-	const { items } = await store.query({ where: { [field]: { lt: before } }, limit: 100 });
-	if (items.length === 0) return 0;
-	return store.deleteMany(items.map((i) => i.id));
+	let gone = 0;
+	// A few pages a run: enough to keep up with a busy site, few enough queries for one request.
+	for (let page = 0; page < PRUNE_PAGES; page++) {
+		const { items } = await store.query({ where: { [field]: { lt: before } }, limit: 100 });
+		if (items.length === 0) break;
+		gone += await store.deleteMany(items.map((i) => i.id));
+		if (items.length < 100) break;
+	}
+	return gone;
 }

package/src/routes/callback.ts

@@ -48,7 +48,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	const state = url.searchParams.get("state");
 	const code = url.searchParams.get("code");
 	if (!flow || !state || state !== flow.state || !code || Date.now() - flow.at > FLOW_TTL_MS) {
-		await refused("sign_in_expired", "warn");
+		// A request with no sign-in behind it (a crawler, a probe) isn't worth an entry.
+		if (flow) await refused("sign_in_expired", "warn");
 		return fail(redirect, returnTo, "sign_in_expired");
 	}
 

package/src/routes/webhook.ts

@@ -19,6 +19,11 @@ import { apply, customerOf, kindOf, verifyHmac } from "../webhooks.js";
 export const prerender = false;
 
 const MAX_BYTES = 1024 * 1024;
+/** A delivery still "pending" after this long never finished. */
+const STALE_PENDING_MS = 60 * 1000;
+/** At most one "Bad signature" entry per this long, so junk requests can't fill App events. */
+const REJECT_LOG_MS = 60 * 1000;
+let lastRejectLogged = 0;
 
 export const POST: APIRoute = async ({ request, locals }) => {
 	const emdash = (locals as { emdash?: { db?: unknown; config?: unknown } }).emdash;
@@ -31,7 +36,10 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	const ok = await verifyHmac(body, request.headers.get("x-shopify-hmac-sha256") ?? "", secret);
 	const topic = (request.headers.get("x-shopify-topic") ?? "").toLowerCase();
 	if (!ok) {
-		await record({ event: "webhook.rejected", label: topic || "unknown", status: "rejected", level: "warn", origin: "webhook", note: "Bad signature" });
+		if (Date.now() - lastRejectLogged > REJECT_LOG_MS) {
+			lastRejectLogged = Date.now();
+			await record({ event: "webhook.rejected", label: topic || "unknown", status: "rejected", level: "warn", origin: "webhook", note: "Bad signature" });
+		}
 		return new Response("Bad signature", { status: 401 });
 	}
 
@@ -51,7 +59,17 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	const customerId = topic === "shop/redact" ? null : customerOf(payload);
 	const receivedAt = new Date().toISOString();
 	if (delivery) {
-		const claimed = await s.deliveries.compareAndSet(delivery, null, { topic, receivedAt, outcome: "pending", customerId });
+		const claim = () => s.deliveries.compareAndSet(delivery, null, { topic, receivedAt, outcome: "pending", customerId });
+		let claimed = await claim();
+		if (!claimed.applied) {
+			// A delivery left "pending" was cut off before it finished (a
+			// timeout, a crash): let Shopify's retry run it again.
+			const earlier = await s.deliveries.get(delivery);
+			if (earlier?.outcome === "pending" && Date.now() - Date.parse(earlier.receivedAt) > STALE_PENDING_MS) {
+				await s.deliveries.delete(delivery);
+				claimed = await claim();
+			}
+		}
 		if (!claimed.applied) {
 			await record({ event: "webhook.received", label: topic, status: "duplicate", origin: "webhook", customerId });
 			return new Response("Duplicate", { status: 200 });

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.18";
+export const VERSION = "0.0.19";