@redeemid/emdash 0.0.18 → 0.0.20

package/src/plugin.ts

@@ -30,7 +30,7 @@ import { definePlugin } from "emdash";
 
 import { levelsFor, SIGNED_IN, type Terms } from "./access.js";
 import { accessAction, accessPage, entryPanel, entrySave, entrySlugChanged, isAccessAction, type AccessEnv, type PanelEntry } from "./access-admin.js";
-import { entryKey, loadAccess, onLevels, withSaved } from "./settings.js";
+import { deleteAccess, entryKey, loadAccess, onLevels, withSaved } from "./settings.js";
 import { env, ENV, storeDomain, unknownEnvNames, type LevelConfig, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import { stores, type MemberRecord, type Stores } from "./storage.js";
@@ -40,7 +40,10 @@ import { AdminError, adminConfigured } from "./admin-api.js";
 import { cancelShopifyErasure, closeRequest, eraseMember, exportMember, exportRequest, requestShopifyErasure } from "./privacy.js";
 import { accessTest, bulkResync, BULK_BATCH, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, tagEdit } from "./staff.js";
 import { textProblems } from "./text.js";
+import { gatedFindings, templateFindings } from "./template-scan.js";
+import { setupFacts, setupPage, WEBHOOK } from "./setup.js";
 import { record } from "./log.js";
+import { resend } from "./events.js";
 import { eventsPage, healthCheck, HEALTH_TASK, lastCheck, parseFilter, reportsPage, saveMonitor, WEBHOOK_PATH, WEBHOOK_TABS, webhooksPage, type MonitorEnv, type WebhookTab } from "./monitor.js";
 import { z } from "astro/zod";
 import { AgentError, explainAccess, findProducts, getCollection, getMember, getProduct, getRules, levelChanges, listLevels, siteHealth, type ExplainInput } from "./agents.js";
@@ -239,8 +242,15 @@ export function createPlugin(code: RedeemIDConfig = {}): ResolvedPlugin {
 				await entrySlugChanged((await memberStores()).access, event.collection, id, slug).catch(() => undefined);
 			},
 			"content:afterDelete": async (event) => {
-				if (!event.permanent) return;
-				await (await memberStores()).access.delete(entryKey(event.id)).catch(() => undefined);
+				const store = (await memberStores()).access;
+				// Trashed: the rule waits (by id) for a restore, without the slug.
+				if (!event.permanent) return entrySlugChanged(store, null, event.id, null).catch(() => undefined);
+				if (await store.get(entryKey(event.id)).catch(() => null)) await deleteAccess(store, entryKey(event.id)).catch(() => undefined);
+			},
+			"content:afterRestore": async (event) => {
+				const id = typeof event.content.id === "string" ? event.content.id : null;
+				const slug = typeof event.content.slug === "string" ? event.content.slug : null;
+				if (id) await entrySlugChanged((await memberStores()).access, event.collection, id, slug).catch(() => undefined);
 			},
 		},
 		routes: {
@@ -276,6 +286,7 @@ export function createPlugin(code: RedeemIDConfig = {}): ResolvedPlugin {
 							if (out.toast?.type === "success") await record({ event: "settings.saved", label: `access: ${String(i.action_id).replace(/_/g, " ")}`, status: "ok", origin: "staff" });
 							return out;
 						}
+						if ((i.type === "block_action" || i.type === "form_submit") && isSetupAction(i.action_id)) return await setupAction(config, live, ctx, i);
 						if (i.type === "block_action" || i.type === "form_submit") return await action(config, ctx, i);
 						if (i.type !== "page_load") return { blocks: [] };
 						if (i.page === "/") return await membersPage(config);
@@ -286,6 +297,7 @@ export function createPlugin(code: RedeemIDConfig = {}): ResolvedPlugin {
 						}
 						if (i.page === "/events") return await eventsPage(await memberStores());
 						if (i.page === "/reports") return await reportsPage(config, await memberStores());
+						if (i.page === "/setup") return setupPage(await setupFacts(config, await memberStores(), siteOrigin(ctx)));
 						if (i.page === "/status") return await statusPage(config, ctx.request);
 						if (i.page === "/test") return await accessTest(config);
 						if (i.page === "/privacy") return await privacyPage(await memberStores());
@@ -456,6 +468,44 @@ function agentTools(config: RedeemIDConfig) {
 	return { tools };
 }
 
+// ---------------------------------------------------------------- setup
+
+const SETUP_ACTIONS = new Set(["setup_check", "setup_register", "setup_level"]);
+const isSetupAction = (id: unknown) => typeof id === "string" && SETUP_ACTIONS.has(id);
+
+/** The site's own origin, as visitors reach it. */
+function siteOrigin(ctx: PluginContext): string {
+	return new URL(ctx.url("/")).origin;
+}
+
+/** Setup's buttons: Check again, Register, Add level. Each answers the page as it is after the step. */
+async function setupAction(
+	config: RedeemIDConfig,
+	live: () => Promise<RedeemIDConfig>,
+	ctx: PluginContext,
+	i: { action_id?: string; values?: Record<string, unknown> },
+) {
+	const s = await memberStores();
+	const origin = siteOrigin(ctx);
+	const page = async (toast?: { type: "success" | "error" | "info"; message: string }) => setupPage(await setupFacts(await live(), s, origin), toast);
+	if (i.action_id === "setup_register") {
+		try {
+			const { added, failed } = await registerWebhooks(config, origin + WEBHOOK);
+			await record({ event: "staff.webhooks", label: "register (setup)", status: failed.length ? `${failed.length} refused` : `${added.length} registered`, level: failed.length ? "warn" : "ok", origin: "staff" });
+			const refused = failed.map((f) => `Shopify refused ${f.topic}: ${f.message}`).join(" ");
+			return page({ type: failed.length ? "error" : "success", message: [added.length ? `Registered ${added.length} webhooks.` : failed.length ? "" : "Nothing was missing.", refused].filter(Boolean).join(" ") });
+		} catch (e) {
+			return page({ type: "error", message: (e as Error).message });
+		}
+	}
+	if (i.action_id === "setup_level") {
+		const out = await accessAction(await accessEnv(config), { action_id: "level_save", block_id: "level:new", values: { name: i.values?.name, tags: i.values?.tags } });
+		if (out.toast?.type === "success") await record({ event: "settings.saved", label: "access: level save (setup)", status: "ok", origin: "staff" });
+		return page(out.toast?.type === "success" ? { type: "success", message: "Level added. Change it any time under Access." } : out.toast);
+	}
+	return page({ type: "info", message: "Checked." });
+}
+
 // ---------------------------------------------------------------- actions
 
 async function action(
@@ -544,6 +594,18 @@ async function action(
 			return eventsPage(s, { event: String(i.value ?? "") || undefined });
 		case "events_page":
 			return eventsPage(s, parseFilter(i.block_id), cursorOf(i.value));
+		case "failed_resend": {
+			const sent = await resend(config, s, String(i.value ?? "")).catch(() => false);
+			return eventsPage(s, {}, undefined, sent ? { type: "success", message: "Sent. It's off the failed list." } : { type: "error", message: "The receiver still didn't take it. It stays on the list." });
+		}
+		case "failed_clear":
+			await s.failedEvents.delete(String(i.value ?? ""));
+			return eventsPage(s, {}, undefined, { type: "success", message: "Cleared." });
+		case "failed_clear_all": {
+			const { items } = await s.failedEvents.query({ limit: 100 });
+			await s.failedEvents.deleteMany(items.map((r) => r.id));
+			return eventsPage(s, {}, undefined, { type: "success", message: "Failed events cleared." });
+		}
 		case "access_test":
 			return accessTest(config, i.values);
 		case "member_export": {
@@ -750,7 +812,8 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 						},
 					]
 				: []),
-			{ type: "context", text: "Deliveries, their health and the webhook subscriptions are under Webhooks; everything RedeemID did is under App events." },
+			...templateBlocks(config),
+			{ type: "context", text: "Setting up a store step by step is under Setup. Deliveries, their health and the webhook subscriptions are under Webhooks; everything RedeemID did is under App events." },
 			{ type: "divider" },
 			{ type: "header", text: "Shopify settings" },
 			{
@@ -768,6 +831,30 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 	};
 }
 
+/** Status: templates that would show a gated body in full (see template-scan.ts). */
+function templateBlocks(config: RedeemIDConfig): unknown[] {
+	const found = templateFindings();
+	if (!found) return [{ type: "banner", variant: "alert", title: "Templates weren't checked", description: "Add redeemidGuard() to the integrations in astro.config.mjs. It gates pages and keeps members out of EmDash's own APIs, and checks the templates." }];
+	const risky = gatedFindings(found, config);
+	if (!risky.length) return [{ type: "context", text: "Templates: none renders a gated collection's body with EmDash's PortableText. Bodies go through RedeemID's Content." }];
+	const sure = risky.filter((f) => f.gated.length);
+	return [
+		sure.length
+			? { type: "banner", variant: "error", title: "A template shows locked bodies in full", description: "These templates render a gated collection's body with EmDash's <PortableText>, which skips every rule, Paywall break and Members only part. Use RedeemID's <Content value={entry.data.content} collection=\"…\" terms={entry.data.terms} id={entry.id} /> instead." }
+			: { type: "banner", variant: "alert", title: "Check these templates", description: "They render a body with EmDash's <PortableText> and RedeemID couldn't see which collection. If it's one with a rule, use RedeemID's <Content> instead." },
+		{
+			type: "table",
+			page_action_id: "template_findings",
+			columns: [
+				{ key: "file", label: "Template" },
+				{ key: "lines", label: "Line" },
+				{ key: "collections", label: "Gated collection" },
+			],
+			rows: risky.map((f) => ({ file: f.file, lines: f.lines.join(", "), collections: f.gated.join(", ") || "Not found in the file" })),
+		},
+	];
+}
+
 async function statusWidget(config: RedeemIDConfig, ctx: PluginContext) {
 	const c = await checks(config);
 	const members = await allMembers().catch(() => []);

package/src/rate-limit.ts

@@ -1,6 +1,6 @@
 /**
  * Optional per-visitor rate limits on the routes that start work at Shopify:
- * Sign in, Buy and cart changes. On Cloudflare Workers they use a Rate
+ * Sign in, Buy, cart changes and catalog search. On Cloudflare Workers they use a Rate
  * Limiting binding named REDEEMID_RATE_LIMIT (see rate-limit-cloudflare.ts);
  * nothing is limited without one.
  */
@@ -18,6 +18,8 @@ const LIMITED: Record<string, string> = {
 	[`POST ${BASE}/buy`]: "buy",
 	[`POST ${BASE}/cart-edit`]: "cart",
 	[`POST ${BASE}/api/cart`]: "cart",
+	// Each new query is a Storefront API call.
+	[`GET ${BASE}/api/search`]: "search",
 };
 
 /** Which limited action a request is, or null. */

package/src/routes/account.ts

@@ -11,7 +11,7 @@ import type { APIRoute } from "astro";
 import { safeReturn, signInUrl } from "../access.js";
 import { readConfig, storeDomain } from "../config.js";
 import { discover } from "../shopify.js";
-import { fail } from "./shared.js";
+import { fail, sessionUser } from "./shared.js";
 
 export const prerender = false;
 
@@ -20,7 +20,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	const config = readConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
 	if (!config || !storeDomain(config)) return fail(redirect, returnTo, "not_configured");
 
-	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const user = await sessionUser(session, (locals as { emdash?: { db?: unknown } }).emdash?.db);
 	if (!user?.id) return redirect(signInUrl(returnTo));
 	try {
 		const d = await discover(config);

package/src/routes/api/state.ts

@@ -18,6 +18,7 @@ import { siteConfig } from "../../site-config.js";
 import { memberForUser, stores } from "../../storage.js";
 import { VERSION } from "../../version.js";
 import { json } from "./shared.js";
+import { sessionUser } from "../shared.js";
 
 export const prerender = false;
 
@@ -36,7 +37,7 @@ export interface State {
 export const GET: APIRoute = async ({ locals, session }) => {
 	const config = await siteConfig(locals);
 	const db = (locals as { emdash?: { db?: unknown } }).emdash?.db;
-	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const user = await sessionUser(session, db);
 	const ref = await readCart(session);
 	const state: State = {
 		apiVersion: API_VERSION,

package/src/routes/buy.ts

@@ -16,7 +16,7 @@ import { memberForUser, stores } from "../storage.js";
 import { saveCart, readCart } from "../cart.js";
 import { checkoutFor } from "../checkout.js";
 import { addToCart, plan, storeContext } from "../storefront.js";
-import { fail } from "./shared.js";
+import { fail, sessionUser } from "./shared.js";
 
 export const prerender = false;
 
@@ -33,8 +33,8 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 		const p = await plan(config, handle);
 		if (!p?.variantId || !p.availableForSale) return fail(redirect, returnTo, "plan_unavailable");
 		// Provider routes are public, so read the member from the session.
-		const user = (await session?.get("user")) as { id?: string } | undefined;
-		const member = user?.id && emdash?.db ? await memberForUser(stores(emdash.db), user.id) : null;
+		const user = await sessionUser(session, emdash?.db);
+		const member = user && emdash?.db ? await memberForUser(stores(emdash.db), user.id) : null;
 		const current = await readCart(session);
 		const cart = await addToCart(
 			config,

package/src/routes/callback.ts

@@ -21,6 +21,8 @@ import { record } from "../log.js";
 import { levelsFor } from "../access.js";
 import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
+import { adminConfigured, resync } from "../admin-api.js";
+import { seal } from "../token-vault.js";
 import { getPublicOrigin, OptionsRepository } from "emdash/api/route-utils";
 
 import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_CUSTOMER_TOKEN, SESSION_ID_TOKEN, type CustomerToken, type Flow } from "./shared.js";
@@ -48,7 +50,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	const state = url.searchParams.get("state");
 	const code = url.searchParams.get("code");
 	if (!flow || !state || state !== flow.state || !code || Date.now() - flow.at > FLOW_TTL_MS) {
-		await refused("sign_in_expired", "warn");
+		// A request with no sign-in behind it (a crawler, a probe) isn't worth an entry.
+		if (flow) await refused("sign_in_expired", "warn");
 		return fail(redirect, returnTo, "sign_in_expired");
 	}
 
@@ -118,10 +121,18 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 					syncedAt: now,
 					source: "sign-in",
 					linkedAt: member.linkedAt ?? now,
+					emailVerified,
 				},
 				now,
 			),
 		);
+		// With the Admin API app, signing in is a full sync: the membership
+		// dates and marketing consent too. A failure never blocks sign-in.
+		if (adminConfigured()) {
+			await resync(config, s, [who.customerId], "sign-in").catch(async (e: Error) => {
+				await record({ event: "staff.resync", label: "sign-in", status: "error", level: "warn", origin: "member", customerId: who.customerId, note: String(e.message).slice(0, 200) });
+			});
+		}
 
 		const levels = levelsFor(who.tags, config.levels);
 		await record({ event: "member.signed_in", label: flow.refresh ? "refresh" : member.linkedAt ? "sign-in" : "first sign-in", status: "ok", origin: "member", customerId: who.customerId });
@@ -131,7 +142,12 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);
-		session.set(SESSION_CUSTOMER_TOKEN, { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken ?? null, expiresAt: tokens.expiresAt ?? null } satisfies CustomerToken);
+		// Kept only for signed-in checkout, and sealed (see token-vault.ts).
+		if (config.checkout?.signIn !== false) {
+			const sealed = await seal({ accessToken: tokens.accessToken, refreshToken: tokens.refreshToken ?? null, expiresAt: tokens.expiresAt ?? null } satisfies CustomerToken, emdash.db).catch(() => null);
+			if (sealed) session.set(SESSION_CUSTOMER_TOKEN, sealed);
+			else session.delete?.(SESSION_CUSTOMER_TOKEN);
+		} else session.delete?.(SESSION_CUSTOMER_TOKEN);
 		return flow.refresh ? fail(redirect, returnTo, "refreshed") : redirect(returnTo);
 	} catch (e) {
 		const code = e instanceof ShopifyError ? e.code : e instanceof OAuthError ? "signup_not_allowed" : "sign_in_failed";

package/src/routes/preferences.ts

@@ -17,7 +17,7 @@ import { siteConfig } from "../site-config.js";
 import { emit } from "../events.js";
 import { allowSave, formValues, PreferenceError, preferenceFields, preferencesConfigured, readPreferences, savePreferences } from "../preferences.js";
 import { memberForUser, stores } from "../storage.js";
-import { fail } from "./shared.js";
+import { fail, sessionUser } from "./shared.js";
 
 export const prerender = false;
 
@@ -28,7 +28,7 @@ async function context(locals: unknown, session: { get(k: string): Promise<unkno
 	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
 	const config = await siteConfig(locals);
 	if (!config || !preferencesConfigured(config) || !emdash?.db) return { error: "unavailable" as const };
-	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const user = await sessionUser(session, emdash.db);
 	if (!user?.id) return { error: "sign_in" as const, config };
 	const s = stores(emdash.db);
 	const member = await memberForUser(s, user.id);

package/src/routes/privacy.ts

@@ -15,14 +15,14 @@ import { safeReturn, signInUrl } from "../access.js";
 import { siteConfig } from "../site-config.js";
 import { eraseMember, exportRequest } from "../privacy.js";
 import { memberForUser, stores } from "../storage.js";
-import { fail } from "./shared.js";
+import { fail, sessionUser } from "./shared.js";
 
 export const prerender = false;
 
 async function context(locals: unknown, session: { get(k: string): Promise<unknown> } | undefined) {
 	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
 	if (!emdash?.db) return null;
-	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const user = await sessionUser(session, emdash.db);
 	if (!user?.id) return null;
 	const s = stores(emdash.db);
 	const member = await memberForUser(s, user.id);

package/src/routes/shared.ts

@@ -63,3 +63,22 @@ export function readAfterLogout(raw: string | undefined): { code: string; return
 		return null;
 	}
 }
+
+type SessionLike = { get(key: string): unknown } | undefined;
+
+/**
+ * The signed-in EmDash user behind this session, or null: none, gone, or
+ * disabled in EmDash since they signed in. Every member route asks this
+ * instead of trusting the session's user id.
+ */
+export async function sessionUser(session: SessionLike, db: unknown): Promise<{ id: string } | null> {
+	const held = (await session?.get("user")) as { id?: string } | undefined;
+	if (!held?.id || !db) return null;
+	try {
+		const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
+		const user = await createKyselyAdapter(db as never).getUserById(held.id);
+		return user && !user.disabled ? { id: user.id } : null;
+	} catch {
+		return null;
+	}
+}

package/src/routes/webhook.ts

@@ -12,13 +12,20 @@ import type { APIRoute } from "astro";
 import { env, ENV } from "../config.js";
 import { siteConfig } from "../site-config.js";
 import { levelChange } from "../events.js";
-import { stores } from "../storage.js";
+import { stores, type Stores } from "../storage.js";
+import { adminConfigured, resync } from "../admin-api.js";
+import type { RedeemIDConfig } from "../config.js";
 import { record } from "../log.js";
-import { apply, customerOf, kindOf, verifyHmac } from "../webhooks.js";
+import { apply, customerOf, kindOf, verifyHmac, type Outcome } from "../webhooks.js";
 
 export const prerender = false;
 
 const MAX_BYTES = 1024 * 1024;
+/** A delivery still "pending" after this long never finished. */
+const STALE_PENDING_MS = 60 * 1000;
+/** At most one "Bad signature" entry per this long, so junk requests can't fill App events. */
+const REJECT_LOG_MS = 60 * 1000;
+let lastRejectLogged = 0;
 
 export const POST: APIRoute = async ({ request, locals }) => {
 	const emdash = (locals as { emdash?: { db?: unknown; config?: unknown } }).emdash;
@@ -31,7 +38,10 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	const ok = await verifyHmac(body, request.headers.get("x-shopify-hmac-sha256") ?? "", secret);
 	const topic = (request.headers.get("x-shopify-topic") ?? "").toLowerCase();
 	if (!ok) {
-		await record({ event: "webhook.rejected", label: topic || "unknown", status: "rejected", level: "warn", origin: "webhook", note: "Bad signature" });
+		if (Date.now() - lastRejectLogged > REJECT_LOG_MS) {
+			lastRejectLogged = Date.now();
+			await record({ event: "webhook.rejected", label: topic || "unknown", status: "rejected", level: "warn", origin: "webhook", note: "Bad signature" });
+		}
 		return new Response("Bad signature", { status: 401 });
 	}
 
@@ -51,7 +61,17 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	const customerId = topic === "shop/redact" ? null : customerOf(payload);
 	const receivedAt = new Date().toISOString();
 	if (delivery) {
-		const claimed = await s.deliveries.compareAndSet(delivery, null, { topic, receivedAt, outcome: "pending", customerId });
+		const claim = () => s.deliveries.compareAndSet(delivery, null, { topic, receivedAt, outcome: "pending", customerId });
+		let claimed = await claim();
+		if (!claimed.applied) {
+			// A delivery left "pending" was cut off before it finished (a
+			// timeout, a crash): let Shopify's retry run it again.
+			const earlier = await s.deliveries.get(delivery);
+			if (earlier?.outcome === "pending" && Date.now() - Date.parse(earlier.receivedAt) > STALE_PENDING_MS) {
+				await s.deliveries.delete(delivery);
+				claimed = await claim();
+			}
+		}
 		if (!claimed.applied) {
 			await record({ event: "webhook.received", label: topic, status: "duplicate", origin: "webhook", customerId });
 			return new Response("Duplicate", { status: 200 });
@@ -60,7 +80,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 	try {
 		const config = await siteConfig(locals);
-		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config);
+		const outcome = (await currentTags(config, s, topic, customerId)) ?? (await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config));
 		if (delivery) await s.deliveries.put(delivery, { topic, receivedAt, outcome, customerId }).catch(() => undefined);
 		await record({ event: "webhook.received", label: topic, status: outcome, origin: "webhook", customerId, ms: Date.now() - started });
 		return new Response(outcome, { status: 200 });
@@ -71,3 +91,24 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		return new Response("Retry", { status: 500 });
 	}
 };
+
+/**
+ * Tag webhooks carry only the change, and can arrive out of order. With the
+ * Admin API app set up, read the customer's tags as they are now instead of
+ * applying the change. Null (apply the change) without the app, or when the
+ * read fails.
+ */
+async function currentTags(config: RedeemIDConfig | null, s: Stores, topic: string, customerId: string | null): Promise<Outcome | null> {
+	if (!config || !customerId || kindOf(topic) !== "tags" || !adminConfigured()) return null;
+	try {
+		const before = await s.members.get(customerId);
+		const { updated } = await resync(config, s, [customerId], topic);
+		const m = updated[0];
+		if (!m) return "skipped";
+		await levelChange(config, before?.tags ?? null, m, topic);
+		return "processed";
+	} catch (e) {
+		console.error("[redeemid] tag webhook resync failed, applying the change:", (e as Error).message);
+		return null;
+	}
+}

package/src/settings.ts

@@ -63,7 +63,16 @@ export interface EntryRule {
 	updatedAt?: string;
 }
 
-export type AccessRecord = SiteAccess | EntryRule;
+/**
+ * Bumped on every write to the collection, so a request can tell with one
+ * small read whether the settings it holds are still current.
+ */
+export interface AccessStamp {
+	kind: "stamp";
+	version: string;
+}
+
+export type AccessRecord = SiteAccess | EntryRule | AccessStamp;
 
 export interface LoadedAccess {
 	site: SiteAccess | null;
@@ -71,6 +80,7 @@ export interface LoadedAccess {
 }
 
 export const SITE_ID = "site";
+export const STAMP_ID = "stamp";
 export const entryKey = (entryId: string) => `entry:${entryId}`;
 
 /** Read everything saved, in one query. */
@@ -118,18 +128,96 @@ export function overridden(site: SiteAccess | null): Set<ManagedKey> {
 	return new Set(MANAGED.filter((k) => site && k in site));
 }
 
-/** Code config plus the admin's settings, read with `db`. */
+/**
+ * A level slug no level can have (slugs can't hold a colon), so nobody
+ * passes a requirement that names it: what every entry needs while the
+ * saved settings can't be read.
+ */
+export const UNAVAILABLE = "redeemid:unavailable";
+
+/**
+ * The settings while the saved ones can't be read and none were read before:
+ * every entry locked (see UNAVAILABLE), no meter to open one, and files in
+ * any folder refused. Failing open would show what the admin locked.
+ */
+export function lockdown(code: RedeemIDConfig): RedeemIDConfig {
+	const out: RedeemIDConfig = { ...code, unavailable: true };
+	delete out.meter;
+	return out;
+}
+
+/** What this server last read, and the stamp it was read at. */
+interface Held {
+	version: string | null;
+	saved: LoadedAccess;
+}
+const HELD = Symbol.for("redeemid:access-held");
+const held = () => globalThis as unknown as Record<symbol, Held | undefined>;
+
+/** Forget the settings held in memory (tests, and after a write here). */
+export function forgetAccess(): void {
+	held()[HELD] = undefined;
+}
+
+/** Record that the settings changed, so every server reads them again. */
+export async function touchAccess(store: StorageCollection<AccessRecord>): Promise<void> {
+	forgetAccess();
+	await store.put(STAMP_ID, { kind: "stamp", version: crypto.randomUUID() });
+}
+
+/** Save one record and bump the stamp. */
+export async function putAccess(store: StorageCollection<AccessRecord>, id: string, data: SiteAccess | EntryRule): Promise<void> {
+	await store.put(id, data);
+	await touchAccess(store);
+}
+
+/** Delete one record and bump the stamp. */
+export async function deleteAccess(store: StorageCollection<AccessRecord>, id: string): Promise<void> {
+	await store.delete(id);
+	await touchAccess(store);
+}
+
+/**
+ * The saved settings, read again only when the stamp has moved: one small
+ * read per request instead of the whole collection.
+ */
+async function savedAccess(store: StorageCollection<AccessRecord>): Promise<LoadedAccess> {
+	const stamp = (await store.get(STAMP_ID)) as AccessStamp | null;
+	const version = stamp?.kind === "stamp" ? stamp.version : null;
+	const known = held()[HELD];
+	if (known && version !== null && known.version === version) return known.saved;
+	const saved = await loadAccess(store);
+	if (version === null) {
+		// Saved before stamps existed: start one, so the next request can skip the read.
+		const fresh = crypto.randomUUID();
+		await store.put(STAMP_ID, { kind: "stamp", version: fresh }).catch(() => undefined);
+		held()[HELD] = { version: fresh, saved };
+	} else {
+		held()[HELD] = { version, saved };
+	}
+	return saved;
+}
+
+/**
+ * Code config plus the admin's settings, read with `db`. When storage can't
+ * be read, the settings last read stand; with none, every entry is locked
+ * (see lockdown). Never the code's settings alone: a rule saved only in the
+ * admin would open its entries for as long as the error lasts.
+ */
 export async function withSaved(code: RedeemIDConfig | null, db: unknown): Promise<RedeemIDConfig | null> {
 	if (!code) return null;
+	let saved: LoadedAccess;
 	try {
-		const merged = mergeAccess(code, await loadAccess(stores(db).access));
-		announceLevels(merged?.levels);
-		return merged;
+		saved = await savedAccess(stores(db).access);
 	} catch (e) {
-		// No storage yet (or it can't be read): the code's settings stand.
-		console.error("[redeemid] couldn't read saved access settings:", (e as Error).message);
-		return code;
+		const last = held()[HELD];
+		console.error("[redeemid] couldn't read saved access settings:", (e as Error).message, last ? "(using the last ones read)" : "(locking entries)");
+		if (!last) return lockdown(code);
+		saved = last.saved;
 	}
+	const merged = mergeAccess(code, saved);
+	announceLevels(merged?.levels);
+	return merged;
 }
 
 // ---------------------------------------------------------------- level pickers