@redeemid/emdash 0.0.19 → 0.0.20

package/src/setup.ts

@@ -0,0 +1,280 @@
+/**
+ * Plugins → RedeemID → Setup: connecting a store, step by step, from the
+ * admin alone. Each step says what to do in Shopify (with the exact values
+ * to paste), what to set on the site, and has a button for whatever
+ * RedeemID can do itself: register the webhooks, add the first level.
+ *
+ * Nothing about progress is stored. Each step's state comes from the site
+ * as it is (setupFacts), so opening Setup again picks up where things stand
+ * and it always agrees with the Status page.
+ *
+ * Secrets stay where they are today, in the site's environment: the wizard
+ * checks them and gives the command to set each one, and never stores one.
+ * It writes only what staff can already write (a level, through Access) and
+ * never grants access: levels still come only from Shopify tags.
+ *
+ * setupSteps() and setupPage() are pure.
+ */
+
+import { adminConfigured, adminScopes, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
+import { env, ENV, storeDomain, type RedeemIDConfig } from "./config.js";
+import { discover } from "./shopify.js";
+import type { Stores } from "./storage.js";
+
+type Toast = { message: string; type: "success" | "error" | "info" };
+export type Blocks = { blocks: unknown[]; toast?: Toast };
+
+/** Scopes the webhook app needs for staff tools and webhook registration. */
+export const SETUP_SCOPES = ["read_customers", "write_customers"] as const;
+
+export const CALLBACK = "/_emdash/api/auth/redeemid/callback";
+export const WEBHOOK = "/_emdash/api/auth/redeemid/webhook";
+
+/** What the site looks like right now, for the steps. */
+export interface SetupFacts {
+	origin: string;
+	domain: string | null;
+	/** null when there's no domain to look up; "ok", or why discovery failed. */
+	discovery: string | null;
+	clientId: boolean;
+	clientSecret: boolean;
+	webhookSecret: boolean;
+	adminClientId: boolean;
+	/** null without the app; "ok", or why the Admin API token was refused. */
+	admin: string | null;
+	scopes: string[];
+	/** Topics not yet sent to this site, or null when that can't be checked. */
+	webhooksMissing: string[] | null;
+	levels: Array<{ name: string; tags: string[] }>;
+	/** Members who have signed in on this site. */
+	signedIn: number;
+	storefront: boolean;
+}
+
+export type StepState = "done" | "todo" | "waiting" | "optional";
+
+export interface Step {
+	key: "store" | "sign_in" | "app" | "webhooks" | "level" | "try" | "storefront";
+	title: string;
+	state: StepState;
+	/** Why it's waiting, for a step that needs an earlier one. */
+	waitingFor?: string;
+}
+
+/** Read the facts. Every check that fails says why instead of throwing. */
+export async function setupFacts(config: RedeemIDConfig, s: Stores, origin: string): Promise<SetupFacts> {
+	const domain = storeDomain(config) || null;
+	const discovery = domain
+		? await discover(config)
+				.then(() => "ok")
+				.catch((e: Error) => e.message || "failed")
+		: null;
+	let admin: string | null = null;
+	let scopes: string[] = [];
+	let webhooksMissing: string[] | null = null;
+	if (domain && adminConfigured()) {
+		try {
+			scopes = (await adminScopes(config)).split(",").map((t) => t.trim()).filter(Boolean);
+			admin = "ok";
+			const subs = await webhookSubscriptions(config);
+			webhooksMissing = WEBHOOK_TOPICS.filter((t) => !subs.some((h) => h.topic === t && h.uri === `${origin}${WEBHOOK}`));
+		} catch (e) {
+			admin = (e as Error).message || "failed";
+		}
+	}
+	let signedIn = 0;
+	try {
+		const { items } = await s.members.query({ limit: 100 });
+		signedIn = items.filter((r) => r.data.userId).length;
+	} catch {
+		signedIn = 0;
+	}
+	return {
+		origin,
+		domain,
+		discovery,
+		clientId: Boolean(env(ENV.clientId)),
+		clientSecret: Boolean(env(ENV.clientSecret)),
+		webhookSecret: Boolean(env(ENV.webhookSecret)),
+		adminClientId: Boolean(env(ENV.adminClientId)),
+		admin,
+		scopes,
+		webhooksMissing,
+		levels: (config.levels ?? []).map((l) => ({ name: l.name, tags: l.tags })),
+		signedIn,
+		storefront: Boolean(env(ENV.storefrontPrivateToken) || env(ENV.storefrontPublicToken)),
+	};
+}
+
+const missingScopes = (f: SetupFacts) => SETUP_SCOPES.filter((sc) => !f.scopes.includes(sc));
+
+/** The steps and where each one stands. Pure. */
+export function setupSteps(f: SetupFacts): Step[] {
+	const store = f.discovery === "ok";
+	const signIn = store && f.clientId;
+	const app = store && f.webhookSecret && f.adminClientId && f.admin === "ok" && missingScopes(f).length === 0;
+	const hooks = app && f.webhooksMissing !== null && f.webhooksMissing.length === 0;
+	const level = f.levels.some((l) => l.tags.length > 0);
+	const ready = signIn && hooks && level;
+	return [
+		{ key: "store", title: "Connect the store", state: store ? "done" : "todo" },
+		{ key: "sign_in", title: "Create the sign-in client", state: signIn ? "done" : store ? "todo" : "waiting", waitingFor: "Connect the store first." },
+		{ key: "app", title: "Connect the webhook app", state: app ? "done" : store ? "todo" : "waiting", waitingFor: "Connect the store first." },
+		{ key: "webhooks", title: "Register the webhooks", state: hooks ? "done" : app ? "todo" : "waiting", waitingFor: "Connect the webhook app first: webhooks are registered through it." },
+		{ key: "level", title: "Create your first level", state: level ? "done" : "todo" },
+		{ key: "try", title: "Try a sign-in", state: f.signedIn > 0 ? "done" : ready ? "todo" : "waiting", waitingFor: "Finish the steps above first." },
+		{ key: "storefront", title: "Add Storefront tokens (for plans and the shop)", state: f.storefront ? "done" : "optional" },
+	];
+}
+
+const BADGE: Record<StepState, string> = { done: "Done", todo: "To do", waiting: "Waiting", optional: "Optional" };
+
+function secretCommand(names: string[]): unknown {
+	return {
+		type: "code",
+		language: "sh",
+		code: [
+			"# Cloudflare Workers (or set them as encrypted secrets in the dashboard):",
+			...names.map((n) => `npx wrangler secret put ${n}`),
+			"# Node: add them to the site's environment (.env), then restart.",
+		].join("\n"),
+	};
+}
+
+function stepBlocks(step: Step, f: SetupFacts): unknown[] {
+	const out: unknown[] = [{ type: "header", text: `${step.title}: ${BADGE[step.state]}` }];
+	if (step.state === "waiting") return [...out, { type: "context", text: step.waitingFor ?? "" }];
+	switch (step.key) {
+		case "store":
+			if (step.state === "done") return [...out, { type: "context", text: `Connected to ${f.domain}.` }];
+			return [
+				...out,
+				{
+					type: "section",
+					text: f.domain
+						? `RedeemID couldn't read ${f.domain}'s sign-in settings: ${f.discovery}. Check the domain (the store's myshopify.com domain, or its custom customer-account domain), and that the store uses the new customer accounts (Shopify admin, Settings, Customer accounts).`
+						: "Tell RedeemID which store to use: its myshopify.com domain, such as my-store.myshopify.com. The store must use the new customer accounts (Shopify admin, Settings, Customer accounts); classic accounts can't sign in.",
+				},
+				secretCommand([ENV.storeDomain]),
+				{ type: "context", text: "Or set `shop` in the RedeemID config in astro.config.mjs." },
+			];
+		case "sign_in":
+			if (step.state === "done") return [...out, { type: "context", text: `Client ID set${f.clientSecret ? ", with a client secret (confidential client)" : " (public client)"}.` }];
+			return [
+				...out,
+				{
+					type: "section",
+					text: "In Shopify admin, open Sales channels, then Headless (add the channel if it isn't there), and Create storefront. Name it after this site. Open its Customer Account API settings, pick a client type (Public needs no secret; Confidential gives one) and, under Application setup, add these:",
+				},
+				{
+					type: "fields",
+					fields: [
+						{ label: "Callback URI", value: `${f.origin}${CALLBACK}` },
+						{ label: "JavaScript origin (public clients)", value: f.origin },
+						{ label: "Logout URI", value: `${f.origin}/` },
+					],
+				},
+				{ type: "section", text: "Copy the Client ID (and the Client secret for a confidential client) and set them on the site:" },
+				secretCommand([ENV.clientId, `${ENV.clientSecret}   # confidential clients only`]),
+				{ type: "context", text: "Shopify only accepts https callback URIs, so a local site needs a tunnel to sign in for real." },
+			];
+		case "app": {
+			if (step.state === "done") return [...out, { type: "context", text: `Admin API connected (${f.scopes.join(", ")}).` }];
+			const why =
+				f.webhookSecret && f.adminClientId && f.admin && f.admin !== "ok"
+					? `Shopify refused the app: ${f.admin} The app must be installed on this store and be in the same Shopify organization.`
+					: f.admin === "ok"
+						? `The app is connected but lacks ${missingScopes(f).join(" and ")}. Add the scopes, release a new version and let the store accept it.`
+						: "Shopify signs webhooks with an app's client secret, and RedeemID uses the same app to register webhooks and to resync members.";
+			return [
+				...out,
+				{ type: "section", text: why },
+				{
+					type: "section",
+					text: "In the Shopify Dev Dashboard (dev.shopify.com), create an app (or use one that already sends this store's webhooks), give it the Admin API scopes read_customers and write_customers (and read_customer_merge, for customers/merge), release it and install it on the store. Then copy its Client ID and Client secret:",
+				},
+				secretCommand([ENV.adminClientId, ENV.webhookSecret]),
+			];
+		}
+		case "webhooks": {
+			if (step.state === "done") return [...out, { type: "context", text: `Every topic RedeemID needs is sent to ${f.origin}${WEBHOOK}.` }];
+			const missing = f.webhooksMissing ?? [];
+			return [
+				...out,
+				{ type: "section", text: `${missing.length} of ${WEBHOOK_TOPICS.length} topics aren't sent to this site yet. RedeemID can register them through the app.` },
+				{ type: "actions", elements: [{ type: "button", action_id: "setup_register", label: `Register ${missing.length} webhooks`, style: "primary" }] },
+				{
+					type: "context",
+					text: `Shopify's privacy topics (customers/data_request, customers/redact, shop/redact) can't be registered this way: add them to the app's configuration under [webhooks.privacy_compliance], pointing at ${f.origin}${WEBHOOK}.`,
+				},
+			];
+		}
+		case "level":
+			if (step.state === "done") return [...out, { type: "context", text: `Levels: ${f.levels.map((l) => `${l.name} (${l.tags.join(", ")})`).join("; ")}. Change them under Access.` }];
+			return [
+				...out,
+				{ type: "section", text: "A level is what members hold: a name, and the Shopify customer tag that gives it. Shopify Flow or your subscription app puts the tag on customers who buy." },
+				{
+					type: "form",
+					block_id: "setup_level",
+					fields: [
+						{ type: "text_input", action_id: "name", label: "Level name", placeholder: "Members" },
+						{ type: "text_input", action_id: "tags", label: "Shopify tag", placeholder: "member" },
+					],
+					submit: { label: "Add level", action_id: "setup_level" },
+				},
+			];
+		case "try": {
+			if (step.state === "done") return [...out, { type: "context", text: `${f.signedIn === 1 ? "A member has" : `${f.signedIn} members have`} signed in. You're set up.` }];
+			const tag = f.levels.find((l) => l.tags.length)?.tags[0] ?? "member";
+			return [
+				...out,
+				{
+					type: "section",
+					text: `In Shopify, add the tag "${tag}" to a test customer. Then open the link below in a private window and sign in with that customer's email: you're signed in here as staff, and staff accounts can't sign in through the store. Come back and press Check again.`,
+				},
+				{ type: "actions", elements: [{ type: "link", label: "Sign in as a member", target: { kind: "external", url: `${f.origin}/_emdash/api/auth/redeemid/login?return=%2F` }, appearance: "secondary" }] },
+			];
+		}
+		case "storefront":
+			if (step.state === "done") return [...out, { type: "context", text: "Storefront API token set." }];
+			return [
+				...out,
+				{ type: "section", text: "Only for selling on the site (Plan cards, the shop, the cart). In the same Headless storefront, open Storefront API and copy the private access token:" },
+				secretCommand([ENV.storefrontPrivateToken]),
+			];
+	}
+	return out;
+}
+
+/** The Setup page. Pure. */
+export function setupPage(f: SetupFacts, toast?: Toast): Blocks {
+	const steps = setupSteps(f);
+	const required = steps.filter((s) => s.state !== "optional" && s.key !== "storefront");
+	const done = required.filter((s) => s.state === "done").length;
+	return {
+		blocks: [
+			{ type: "header", text: "Setup" },
+			done === required.length
+				? { type: "banner", variant: "default", title: "RedeemID is set up", description: "Members can sign in with their Shopify customer account. Levels, rules and the meter are under Access." }
+				: {
+						type: "banner",
+						variant: "alert",
+						title: `${done} of ${required.length} steps done`,
+						description: "Work down the steps. Each one checks the site as it is, so set a secret, redeploy or restart, and press Check again.",
+					},
+			{ type: "actions", elements: [{ type: "button", action_id: "setup_check", label: "Check again", style: "secondary" }] },
+			{
+				type: "table",
+				page_action_id: "setup_steps",
+				columns: [
+					{ key: "step", label: "Step" },
+					{ key: "state", label: "State", format: "badge" },
+				],
+				rows: steps.map((s) => ({ step: s.title, state: BADGE[s.state] })),
+			},
+			...steps.flatMap((s) => [{ type: "divider" }, ...stepBlocks(s, f)]),
+		],
+		...(toast ? { toast } : {}),
+	};
+}

package/src/site-config.ts

@@ -36,7 +36,11 @@ export function siteConfig(locals?: unknown): Promise<RedeemIDConfig | null> {
 	const known = key ? loaded.get(key) : undefined;
 	if (known) return known;
 	const code = codeConfig(locals);
-	const fresh = code ? database(locals as Locals).then((db) => withSaved(code, db), () => code) : Promise.resolve(null);
+	const fresh = code ? database(locals as Locals).then(
+				(db) => withSaved(code, db),
+				// No database: the same as storage that can't be read.
+				() => withSaved(code, null),
+			) : Promise.resolve(null);
 	if (key) loaded.set(key, fresh);
 	return fresh;
 }

package/src/staff.ts

@@ -25,6 +25,13 @@ type Blocks = { blocks: unknown[]; toast?: { message: string; type: "success" |
 
 const date = (iso: string | null | undefined) => (iso ? iso.slice(0, 10) : "—");
 
+/** Shopify's marketing state in words: SUBSCRIBED → "Subscribed". */
+function consentLabel(state: string | null | undefined): string {
+	if (!state) return "—";
+	const t = state.toLowerCase().replace(/_/g, " ");
+	return t.charAt(0).toUpperCase() + t.slice(1);
+}
+
 export function memberDetail(config: RedeemIDConfig, m: MemberRecord, toast?: Blocks["toast"]): Blocks {
 	const levels = config.levels ?? [];
 	const { current, past } = membership(m, levels);
@@ -46,6 +53,12 @@ export function memberDetail(config: RedeemIDConfig, m: MemberRecord, toast?: Bl
 					{ label: "Levels", value: current.map((l) => `${l.name} (since ${date(l.since)})`).join(", ") || "—" },
 					{ label: "Levels before", value: past.map((l) => `${l.name} (${date(l.from)} to ${date(l.to)})`).join(", ") || "—" },
 					{ label: "Features", value: featureNames.join(", ") || "—" },
+					{ label: "Member since (Shopify)", value: m.dates?.since ?? "—" },
+					{ label: m.dates?.ends ? "Ends on (Shopify)" : "Renews on (Shopify)", value: m.dates?.ends ?? m.dates?.renews ?? "—" },
+					{ label: "Gift until (Shopify)", value: m.dates?.gift ?? "—" },
+					{ label: "Email verified", value: m.emailVerified === undefined ? "—" : m.emailVerified ? "Yes" : "No" },
+					{ label: "Email marketing", value: consentLabel(m.emailMarketing) },
+					{ label: "SMS marketing", value: consentLabel(m.smsMarketing) },
 					{ label: "Last synced", value: `${m.syncedAt} (${m.source || "unknown"})` },
 				],
 			},

package/src/storage.ts

@@ -13,6 +13,7 @@ import { getAuthProviderStorage } from "emdash/api/route-utils";
 import { PROVIDER_ID } from "./config.js";
 import type { AccessRecord } from "./settings.js";
 import type { LogEntry } from "./log.js";
+import type { FailedEvent } from "./events.js";
 
 export interface MemberRecord {
 	/** Numeric Shopify customer id, also the record id. */
@@ -39,10 +40,39 @@ export interface MemberRecord {
 	linkedAt?: string | null;
 	/** Tags Shopify has removed, with when each was held (newest last, at most 50). */
 	pastTags?: PastTag[];
+	/**
+	 * Membership dates the shop keeps in customer metafields (membership.member_since,
+	 * membership.renews_on, membership.ends_on for a pass that doesn't renew,
+	 * membership.gift_until), written by Shopify Flow or a subscription app and
+	 * read with the Admin API. YYYY-MM-DD. Display only: never access.
+	 */
+	dates?: MembershipDates;
+	/** Shopify's email marketing state (SUBSCRIBED, NOT_SUBSCRIBED, ...), as Shopify last said. */
+	emailMarketing?: string | null;
+	/** Shopify's SMS marketing state, from the customer webhooks. */
+	smsMarketing?: string | null;
+	/** Whether Shopify had verified the email at the member's last sign-in. */
+	emailVerified?: boolean;
 	/** When the member last saved preferences (ms), newest last, at most 10: the rate limit. */
 	prefSaves?: number[];
 }
 
+export interface MembershipDates {
+	since?: string | null;
+	renews?: string | null;
+	ends?: string | null;
+	gift?: string | null;
+}
+
+/** A metafield date or date-time as YYYY-MM-DD, or null when it isn't one. */
+export function metaDate(raw: unknown): string | null {
+	if (typeof raw !== "string") return null;
+	const m = /^(\d{4})-(\d{2})-(\d{2})/.exec(raw.trim());
+	if (!m) return null;
+	const d = new Date(Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3])));
+	return d.getUTCFullYear() === Number(m[1]) && d.getUTCMonth() === Number(m[2]) - 1 && d.getUTCDate() === Number(m[3]) ? `${m[1]}-${m[2]}-${m[3]}` : null;
+}
+
 /** A tag the customer held from `from` (when known) until `to`. */
 export interface PastTag {
 	tag: string;
@@ -105,6 +135,7 @@ export const STORAGE_CONFIG = {
 	requests: { indexes: ["at", "customerId", "status"] },
 	access: { indexes: ["kind"] },
 	log: { indexes: ["at", "event", "level"] },
+	failedEvents: { indexes: ["at"] },
 };
 
 export interface Stores {
@@ -116,6 +147,8 @@ export interface Stores {
 	access: StorageCollection<AccessRecord>;
 	/** App events (see log.ts). */
 	log: StorageCollection<LogEntry>;
+	/** Outbound events that failed every try (see events.ts). */
+	failedEvents: StorageCollection<FailedEvent>;
 }
 
 export function stores(db: unknown): Stores {

package/src/template-scan.ts

@@ -0,0 +1,77 @@
+/**
+ * Templates that put an entry's body on the page with EmDash's own
+ * `<PortableText>` instead of RedeemID's `<Content>`. Those bodies skip
+ * every rule, Paywall break and Members only part, so a gated collection
+ * rendered that way reaches every visitor in full.
+ *
+ * redeemidGuard() scans the site's src/ at build time (scanTemplate, in
+ * Node) and hands the findings to the running site; the Status page then
+ * compares them with the rules as they are now (gatedFindings), because
+ * rules can change in the admin after the build.
+ *
+ * Both functions are pure.
+ */
+
+import type { RedeemIDConfig } from "./config.js";
+
+export interface TemplateFinding {
+	/** Path from the site's root, e.g. src/pages/[slug].astro. */
+	file: string;
+	/** Lines with a <PortableText> tag. */
+	lines: number[];
+	/** Collections the file loads with getEmDashEntry or getEmDashCollection. */
+	collections: string[];
+}
+
+const FROM_EMDASH_UI = /import\s*\{[^}]*\bPortableText\b[^}]*\}\s*from\s*["']emdash\/ui["']/;
+const LOADS = /getEmDash(?:Entry|Collection)\(\s*["'`]([\w-]+)["'`]/g;
+
+/** One template's finding, or null when it doesn't render <PortableText> from emdash/ui. */
+export function scanTemplate(file: string, source: string): TemplateFinding | null {
+	if (!FROM_EMDASH_UI.test(source)) return null;
+	const lines: number[] = [];
+	source.split("\n").forEach((line, i) => {
+		if (/<PortableText[\s/>]/.test(line)) lines.push(i + 1);
+	});
+	if (!lines.length) return null;
+	const collections = [...new Set([...source.matchAll(LOADS)].map((m) => m[1]!))].sort();
+	return { file, lines, collections };
+}
+
+/** Collections some rule or entry rule can lock: "*" when the site default does. */
+export function gatedCollections(config: RedeemIDConfig): Set<string> {
+	const out = new Set<string>();
+	for (const r of config.rules ?? []) if (!r.open) out.add(r.collection);
+	for (const e of Object.values(config.entries ?? {})) if (e && (e.mode === "levels" || e.mode === "add")) out.add(e.collection);
+	return out;
+}
+
+export interface GatedFinding extends TemplateFinding {
+	/** The file's collections that a rule covers; empty when the file loads none we could see. */
+	gated: string[];
+}
+
+/**
+ * Findings that matter now: a file that loads a gated collection, or a file
+ * whose collection we couldn't see (a component given the body as a prop)
+ * while some collection is gated.
+ */
+export function gatedFindings(findings: TemplateFinding[], config: RedeemIDConfig): GatedFinding[] {
+	const gated = gatedCollections(config);
+	if (!gated.size) return [];
+	const all = gated.has("*");
+	return findings.flatMap((f) => {
+		if (!f.collections.length) return [{ ...f, gated: [] }];
+		const hit = f.collections.filter((c) => all || gated.has(c));
+		return hit.length ? [{ ...f, gated: hit }] : [];
+	});
+}
+
+/** Where the running site keeps the scan; unset when redeemidGuard() isn't installed. */
+export const TEMPLATES_KEY = "__redeemidTemplates";
+
+/** The scan, or null when redeemidGuard() isn't installed (or hasn't run yet). */
+export function templateFindings(): TemplateFinding[] | null {
+	const v = (globalThis as Record<string, unknown>)[TEMPLATES_KEY];
+	return Array.isArray(v) ? (v as TemplateFinding[]) : null;
+}

package/src/templates.ts

@@ -0,0 +1,15 @@
+/**
+ * Middleware added by redeemidGuard(): hands the build-time template scan
+ * (see template-scan.ts) to the Status page. The guard's Vite plugin
+ * replaces FINDINGS below with the scan when it builds this file.
+ */
+
+import { defineMiddleware } from "astro:middleware";
+
+import { TEMPLATES_KEY, type TemplateFinding } from "./template-scan.js";
+
+const FINDINGS: TemplateFinding[] | null = null; // redeemid:templates
+
+(globalThis as Record<string, unknown>)[TEMPLATES_KEY] = FINDINGS;
+
+export const onRequest = defineMiddleware((_context, next) => next());

package/src/text.ts

@@ -59,11 +59,18 @@ export const STRINGS = {
 		"This is for members.",
 		"Or buy just this for {price}.",
 		"Buy just this",
+		"Your {level} membership has ended.",
+		"Renew {level}",
+		"Already renewed? {refresh}",
+		"Refresh",
 	],
 	member: [
 		"Your membership",
 		"Your account is turned off. Contact the store for help.",
 		"since {date}",
+		"Renews on {date}",
+		"Ends on {date}",
+		"Gift membership until {date}",
 		"You don't have a membership yet.",
 		"Become a member",
 		"Includes: {features}",
@@ -111,7 +118,7 @@ export const STRINGS = {
 		"I understand",
 		"Delete my data",
 	],
-	plan: ["Join", "You're on this plan.", "Not available right now."],
+	plan: ["Join", "Renew", "You're on this plan.", "Not available right now."],
 	preferences: ["Your preferences", "Save preferences", "Your preferences can't be loaded right now. Try again in a few minutes.", "Not set", "Yes", "No", "One per line."],
 	product: [
 		"Add to cart",

package/src/token-vault.ts

@@ -0,0 +1,83 @@
+/**
+ * The member's Customer Account API tokens, sealed before they go into the
+ * session store.
+ *
+ * Signed-in checkout needs the member's access and refresh tokens, and they
+ * carry the Customer Account API's whole scope. They live only in the
+ * server-side session, encrypted (AES-GCM) with a key RedeemID keeps in the
+ * site's database (option `redeemid:session_key`, made on first need). So a
+ * copy of the session store alone doesn't give anyone a member's tokens.
+ * A token that can't be opened (an older session, a changed key) is treated
+ * as none: checkout falls back to a guest checkout.
+ */
+
+import type { CustomerToken } from "./routes/shared.js";
+
+const OPTION = "redeemid:session_key";
+
+/** A sealed token as the session holds it. */
+export interface SealedToken {
+	sealed: string;
+}
+
+let held: Promise<CryptoKey> | null = null;
+
+function b64(bytes: Uint8Array): string {
+	let s = "";
+	for (const b of bytes) s += String.fromCharCode(b);
+	return btoa(s);
+}
+
+function unb64(text: string): Uint8Array<ArrayBuffer> {
+	return Uint8Array.from(atob(text), (c) => c.charCodeAt(0));
+}
+
+async function importKey(raw: string): Promise<CryptoKey> {
+	return crypto.subtle.importKey("raw", unb64(raw), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+
+/** Use this key (base64 of 32 bytes) instead of the site's: for tests. */
+export function useVaultKey(raw: string | null): void {
+	held = raw ? importKey(raw) : null;
+}
+
+async function siteKey(db?: unknown): Promise<CryptoKey> {
+	if (!held) {
+		held = (async () => {
+			const database = db ?? (await (await import("emdash/runtime")).getDb());
+			const { OptionsRepository } = await import("emdash/api/route-utils");
+			const options = new OptionsRepository(database as ConstructorParameters<typeof OptionsRepository>[0]);
+			await options.setIfAbsent(OPTION, b64(crypto.getRandomValues(new Uint8Array(32))));
+			const raw = await options.get(OPTION);
+			if (typeof raw !== "string") throw new Error("no session key");
+			return importKey(raw);
+		})();
+		held.catch(() => {
+			held = null;
+		});
+	}
+	return held;
+}
+
+/** Seal the tokens for the session. */
+export async function seal(token: CustomerToken, db?: unknown): Promise<SealedToken> {
+	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const data = new TextEncoder().encode(JSON.stringify(token));
+	const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await siteKey(db), data));
+	return { sealed: `${b64(iv)}.${b64(ct)}` };
+}
+
+/** Open what the session holds, or null when it holds none or it can't be opened. */
+export async function unseal(value: unknown, db?: unknown): Promise<CustomerToken | null> {
+	const sealed = (value as SealedToken | null | undefined)?.sealed;
+	if (typeof sealed !== "string") return null;
+	const [iv, ct] = sealed.split(".");
+	if (!iv || !ct) return null;
+	try {
+		const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: unb64(iv) }, await siteKey(db), unb64(ct));
+		const t = JSON.parse(new TextDecoder().decode(plain)) as CustomerToken;
+		return typeof t?.accessToken === "string" ? t : null;
+	} catch {
+		return null;
+	}
+}

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.19";
+export const VERSION = "0.0.20";

package/src/webhooks.ts

@@ -161,6 +161,10 @@ export async function apply(
 		current.firstName = str(payload.first_name) ?? current.firstName;
 		current.lastName = str(payload.last_name) ?? current.lastName;
 		if ("tags" in payload) current.tags = cleanTags(payload.tags);
+		// Marketing consent, as Shopify states it (display and export only).
+		const consent = (raw: unknown) => str((raw as { state?: unknown } | null | undefined)?.state)?.toUpperCase() ?? null;
+		if (payload.email_marketing_consent && typeof payload.email_marketing_consent === "object") current.emailMarketing = consent(payload.email_marketing_consent);
+		if (payload.sms_marketing_consent && typeof payload.sms_marketing_consent === "object") current.smsMarketing = consent(payload.sms_marketing_consent);
 		current.profileUpdatedAt = updatedAt ?? current.profileUpdatedAt;
 	} else if (kind === "status") {
 		if (updatedAt !== null && current.statusUpdatedAt !== null && updatedAt < current.statusUpdatedAt) {