@redeemid/emdash 0.0.19 → 0.0.21

package/src/index.ts

@@ -28,11 +28,16 @@
  * (the client secret of the Shopify app whose webhooks the site receives).
  */
 
+import { readdirSync, readFileSync, type Dirent } from "node:fs";
+import { join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
 import type { AstroIntegration } from "astro";
 import type { AuthProviderDescriptor } from "emdash";
 
 import { PROVIDER_ID, type RedeemIDConfig } from "./config.js";
 import { STORAGE_CONFIG } from "./storage.js";
+import { scanTemplate, type TemplateFinding } from "./template-scan.js";
 
 export type { LevelConfig, RedeemIDConfig, RuleConfig } from "./config.js";
 export type { MemberRecord } from "./storage.js";
@@ -77,7 +82,11 @@ export function redeemidGuard(options: { rateLimit?: boolean } = {}): AstroInteg
 	return {
 		name: "@redeemid/emdash/guard",
 		hooks: {
-			"astro:config:setup": ({ addMiddleware }) => {
+			"astro:config:setup": ({ addMiddleware, updateConfig, config }) => {
+				// Finds templates that render a body with EmDash's <PortableText>
+				// instead of <Content>, for the Status page.
+				updateConfig({ vite: { plugins: [templateScan(config.root, config.srcDir)] } });
+				addMiddleware({ entrypoint: "@redeemid/emdash/templates.ts", order: "pre" });
 				// Cloudflare Workers only: limits Sign in, Buy and cart changes per
 				// visitor with the REDEEMID_RATE_LIMIT Rate Limiting binding.
 				if (options.rateLimit) addMiddleware({ entrypoint: "@redeemid/emdash/rate-limit-cloudflare.ts", order: "pre" });
@@ -87,4 +96,41 @@ export function redeemidGuard(options: { rateLimit?: boolean } = {}): AstroInteg
 	};
 }
 
+const TEMPLATES_MARK = "const FINDINGS: TemplateFinding[] | null = null; // redeemid:templates";
+
+/** Vite plugin: fills templates.ts with the scan of the site's .astro files. */
+function templateScan(root: URL, srcDir: URL) {
+	return {
+		name: "redeemid:templates",
+		// Before TypeScript is stripped, so the marker line is still there.
+		enforce: "pre" as const,
+		transform(code: string, id: string) {
+			if (!id.split("?")[0]!.endsWith("/templates.ts") || !code.includes(TEMPLATES_MARK)) return undefined;
+			const base = fileURLToPath(root);
+			const out: TemplateFinding[] = [];
+			// Static node: imports only: astro.config's module runner is closed by
+			// the time this runs, so a dynamic import() here fails.
+			const walk = (dir: string): void => {
+				let items: Dirent[] = [];
+				try {
+					items = readdirSync(dir, { withFileTypes: true });
+				} catch {
+					return;
+				}
+				for (const d of items) {
+					const path = join(dir, d.name);
+					if (d.isDirectory() && d.name !== "node_modules") walk(path);
+					else if (d.isFile() && d.name.endsWith(".astro")) {
+						const found = scanTemplate(relative(base, path).split("\\").join("/"), readFileSync(path, "utf8"));
+						if (found) out.push(found);
+					}
+				}
+			};
+			walk(fileURLToPath(srcDir));
+			out.sort((a, b) => a.file.localeCompare(b.file));
+			return { code: code.replace(TEMPLATES_MARK, `const FINDINGS = ${JSON.stringify(out)};`), map: null };
+		},
+	};
+}
+
 export default redeemid;

package/src/log.ts

@@ -45,6 +45,7 @@ export const LOG_EVENTS: Record<string, string> = {
 	"staff.webhooks": "Webhook registration",
 	"settings.saved": "Settings saved",
 	"events.failed": "Outbound event failed",
+	"events.resent": "Outbound event sent again",
 	"health.check": "Health check",
 	"meter.used": "Metered read",
 	"meter.exhausted": "Metered read, meter used up",
@@ -88,13 +89,15 @@ export async function timed<T>(event: string, label: string, run: () => Promise<
 	}
 }
 
+type Where<T> = NonNullable<NonNullable<Parameters<StorageCollection<T>["query"]>[0]>["where"]>;
+
 /** Delete entries (and other dated records) older than `days`, a page at a time. */
-export async function prune<T>(store: StorageCollection<T>, field: string, days = LOG_DAYS): Promise<number> {
+export async function prune<T>(store: StorageCollection<T>, field: string, days = LOG_DAYS, where: Record<string, string | number | boolean> = {}): Promise<number> {
 	const before = new Date(Date.now() - days * 86_400_000).toISOString();
 	let gone = 0;
 	// A few pages a run: enough to keep up with a busy site, few enough queries for one request.
 	for (let page = 0; page < PRUNE_PAGES; page++) {
-		const { items } = await store.query({ where: { [field]: { lt: before } }, limit: 100 });
+		const { items } = await store.query({ where: { ...where, [field]: { lt: before } } as Where<T>, limit: 100 });
 		if (items.length === 0) break;
 		gone += await store.deleteMany(items.map((i) => i.id));
 		if (items.length < 100) break;

package/src/monitor.ts

@@ -16,6 +16,7 @@ import { levelsFor, membership } from "./access.js";
 import { adminConfigured, registerWebhooks } from "./admin-api.js";
 import { env, ENV, type RedeemIDConfig } from "./config.js";
 import { LOG_DAYS, LOG_EVENTS, prune, record, type LogEntry } from "./log.js";
+import { RETRY_DELAYS_MS, type FailedEvent } from "./events.js";
 import type { DeliveryRecord, MemberRecord, Stores } from "./storage.js";
 import { webhooksSection } from "./staff.js";
 
@@ -181,10 +182,15 @@ async function alert(env_: MonitorEnv, settings: MonitorSettings, result: Health
 	}
 }
 
-/** Drop app events and delivery records older than LOG_DAYS, a page of each. */
+/** Finished privacy requests are kept this long, as the record that they were answered. Open ones stay until staff close them. */
+export const REQUEST_DAYS = 365;
+
+/** Drop app events and delivery records older than LOG_DAYS, and finished privacy requests older than REQUEST_DAYS. */
 export async function tidy(s: Stores): Promise<void> {
 	await prune(s.log, "at").catch(() => 0);
 	await prune(s.deliveries, "receivedAt").catch(() => 0);
+	await prune(s.failedEvents, "at").catch(() => 0);
+	await prune(s.requests, "at", REQUEST_DAYS, { status: "done" }).catch(() => 0);
 }
 
 /** WEBHOOK_TOPICS name → the topic Shopify shows: CUSTOMER_TAGS_ADDED → customer.tags_added. */
@@ -379,6 +385,7 @@ export async function eventsPage(s: Stores, filter: EventFilter = {}, cursor?: s
 	if (filter.event && filter.event in LOG_EVENTS) where.event = filter.event;
 	if (filter.problems) where.level = { in: ["warn", "error"] };
 	const page = await s.log.query({ where: where as never, orderBy: { at: "desc" }, limit: 50, ...(cursor ? { cursor } : {}) });
+	const failed = cursor ? null : await s.failedEvents.query({ orderBy: { at: "desc" }, limit: 50 }).catch(() => null);
 	return {
 		blocks: [
 			{ type: "header", text: "App events" },
@@ -386,6 +393,7 @@ export async function eventsPage(s: Stores, filter: EventFilter = {}, cursor?: s
 				type: "context",
 				text: `What RedeemID did and what came of it: webhooks, sign-ins, calls to Shopify, staff actions, settings saves and outbound events. Kept ${LOG_DAYS} days. Never bodies, tokens or emails.`,
 			},
+			...(failed?.items.length ? failedBlocks(failed.items.map((r) => r.data)) : []),
 			{
 				type: "form",
 				block_id: "events_filter",
@@ -424,6 +432,60 @@ export async function eventsPage(s: Stores, filter: EventFilter = {}, cursor?: s
 	};
 }
 
+/** Outbound events that failed every try: send again or clear. */
+function failedBlocks(list: FailedEvent[]): unknown[] {
+	return [
+		{ type: "header", text: "Failed events" },
+		{
+			type: "context",
+			text: `Outbound events your receiver didn't take after ${RETRY_DELAYS_MS.length + 1} tries. Send again keeps each one's delivery id, so a receiver that got it after all can drop the copy. Cleared after ${LOG_DAYS} days.`,
+		},
+		{
+			type: "table",
+			page_action_id: "failed_page",
+			columns: [
+				{ key: "event", label: "Event" },
+				{ key: "customer", label: "Customer" },
+				{ key: "error", label: "Last error" },
+				{ key: "tries", label: "Tries" },
+				{ key: "at", label: "When", format: "relative_time" },
+				{ key: "resend", label: "", format: "element" },
+				{ key: "clear", label: "", format: "element" },
+			],
+			rows: list.map((f) => ({
+				event: f.event,
+				customer: customerOfBody(f.body),
+				error: f.error,
+				tries: String(f.attempts),
+				at: f.at,
+				resend: { type: "button", action_id: "failed_resend", label: "Send again", style: "primary", value: f.id },
+				clear: { type: "button", action_id: "failed_clear", label: "Clear", style: "secondary", value: f.id },
+			})),
+		},
+		{
+			type: "actions",
+			elements: [
+				{
+					type: "button",
+					action_id: "failed_clear_all",
+					label: "Clear all",
+					style: "danger",
+					confirm: { title: "Clear every failed event?", text: "They won't be sent. App events keeps the record that they failed.", confirm: "Clear all", deny: "Cancel", style: "danger" },
+				},
+			],
+		},
+	];
+}
+
+function customerOfBody(body: string): string {
+	try {
+		const id = (JSON.parse(body) as { data?: { customerId?: unknown } }).data?.customerId;
+		return typeof id === "string" ? id : "";
+	} catch {
+		return "";
+	}
+}
+
 function eventRow(e: LogEntry) {
 	const status = e.status === "ok" ? "OK" : cap(e.status);
 	return {

package/src/plugin.ts

@@ -30,7 +30,7 @@ import { definePlugin } from "emdash";
 
 import { levelsFor, SIGNED_IN, type Terms } from "./access.js";
 import { accessAction, accessPage, entryPanel, entrySave, entrySlugChanged, isAccessAction, type AccessEnv, type PanelEntry } from "./access-admin.js";
-import { entryKey, loadAccess, onLevels, withSaved } from "./settings.js";
+import { deleteAccess, entryKey, loadAccess, onLevels, withSaved } from "./settings.js";
 import { env, ENV, storeDomain, unknownEnvNames, type LevelConfig, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import { stores, type MemberRecord, type Stores } from "./storage.js";
@@ -40,7 +40,10 @@ import { AdminError, adminConfigured } from "./admin-api.js";
 import { cancelShopifyErasure, closeRequest, eraseMember, exportMember, exportRequest, requestShopifyErasure } from "./privacy.js";
 import { accessTest, bulkResync, BULK_BATCH, exportBlocks, memberDetail, privacyPage, registerWebhooks, resyncOne, tagEdit } from "./staff.js";
 import { textProblems } from "./text.js";
+import { gatedFindings, templateFindings } from "./template-scan.js";
+import { setupFacts, setupPage, WEBHOOK } from "./setup.js";
 import { record } from "./log.js";
+import { resend } from "./events.js";
 import { eventsPage, healthCheck, HEALTH_TASK, lastCheck, parseFilter, reportsPage, saveMonitor, WEBHOOK_PATH, WEBHOOK_TABS, webhooksPage, type MonitorEnv, type WebhookTab } from "./monitor.js";
 import { z } from "astro/zod";
 import { AgentError, explainAccess, findProducts, getCollection, getMember, getProduct, getRules, levelChanges, listLevels, siteHealth, type ExplainInput } from "./agents.js";
@@ -239,8 +242,15 @@ export function createPlugin(code: RedeemIDConfig = {}): ResolvedPlugin {
 				await entrySlugChanged((await memberStores()).access, event.collection, id, slug).catch(() => undefined);
 			},
 			"content:afterDelete": async (event) => {
-				if (!event.permanent) return;
-				await (await memberStores()).access.delete(entryKey(event.id)).catch(() => undefined);
+				const store = (await memberStores()).access;
+				// Trashed: the rule waits (by id) for a restore, without the slug.
+				if (!event.permanent) return entrySlugChanged(store, null, event.id, null).catch(() => undefined);
+				if (await store.get(entryKey(event.id)).catch(() => null)) await deleteAccess(store, entryKey(event.id)).catch(() => undefined);
+			},
+			"content:afterRestore": async (event) => {
+				const id = typeof event.content.id === "string" ? event.content.id : null;
+				const slug = typeof event.content.slug === "string" ? event.content.slug : null;
+				if (id) await entrySlugChanged((await memberStores()).access, event.collection, id, slug).catch(() => undefined);
 			},
 		},
 		routes: {
@@ -276,6 +286,7 @@ export function createPlugin(code: RedeemIDConfig = {}): ResolvedPlugin {
 							if (out.toast?.type === "success") await record({ event: "settings.saved", label: `access: ${String(i.action_id).replace(/_/g, " ")}`, status: "ok", origin: "staff" });
 							return out;
 						}
+						if ((i.type === "block_action" || i.type === "form_submit") && isSetupAction(i.action_id)) return await setupAction(config, live, ctx, i);
 						if (i.type === "block_action" || i.type === "form_submit") return await action(config, ctx, i);
 						if (i.type !== "page_load") return { blocks: [] };
 						if (i.page === "/") return await membersPage(config);
@@ -286,6 +297,7 @@ export function createPlugin(code: RedeemIDConfig = {}): ResolvedPlugin {
 						}
 						if (i.page === "/events") return await eventsPage(await memberStores());
 						if (i.page === "/reports") return await reportsPage(config, await memberStores());
+						if (i.page === "/setup") return setupPage(await setupFacts(config, await memberStores(), siteOrigin(ctx)));
 						if (i.page === "/status") return await statusPage(config, ctx.request);
 						if (i.page === "/test") return await accessTest(config);
 						if (i.page === "/privacy") return await privacyPage(await memberStores());
@@ -456,6 +468,44 @@ function agentTools(config: RedeemIDConfig) {
 	return { tools };
 }
 
+// ---------------------------------------------------------------- setup
+
+const SETUP_ACTIONS = new Set(["setup_check", "setup_register", "setup_level"]);
+const isSetupAction = (id: unknown) => typeof id === "string" && SETUP_ACTIONS.has(id);
+
+/** The site's own origin, as visitors reach it. */
+function siteOrigin(ctx: PluginContext): string {
+	return new URL(ctx.url("/")).origin;
+}
+
+/** Setup's buttons: Check again, Register, Add level. Each answers the page as it is after the step. */
+async function setupAction(
+	config: RedeemIDConfig,
+	live: () => Promise<RedeemIDConfig>,
+	ctx: PluginContext,
+	i: { action_id?: string; values?: Record<string, unknown> },
+) {
+	const s = await memberStores();
+	const origin = siteOrigin(ctx);
+	const page = async (toast?: { type: "success" | "error" | "info"; message: string }) => setupPage(await setupFacts(await live(), s, origin), toast);
+	if (i.action_id === "setup_register") {
+		try {
+			const { added, failed } = await registerWebhooks(config, origin + WEBHOOK);
+			await record({ event: "staff.webhooks", label: "register (setup)", status: failed.length ? `${failed.length} refused` : `${added.length} registered`, level: failed.length ? "warn" : "ok", origin: "staff" });
+			const refused = failed.map((f) => `Shopify refused ${f.topic}: ${f.message}`).join(" ");
+			return page({ type: failed.length ? "error" : "success", message: [added.length ? `Registered ${added.length} webhooks.` : failed.length ? "" : "Nothing was missing.", refused].filter(Boolean).join(" ") });
+		} catch (e) {
+			return page({ type: "error", message: (e as Error).message });
+		}
+	}
+	if (i.action_id === "setup_level") {
+		const out = await accessAction(await accessEnv(config), { action_id: "level_save", block_id: "level:new", values: { name: i.values?.name, tags: i.values?.tags } });
+		if (out.toast?.type === "success") await record({ event: "settings.saved", label: "access: level save (setup)", status: "ok", origin: "staff" });
+		return page(out.toast?.type === "success" ? { type: "success", message: "Level added. Change it any time under Access." } : out.toast);
+	}
+	return page({ type: "info", message: "Checked." });
+}
+
 // ---------------------------------------------------------------- actions
 
 async function action(
@@ -544,6 +594,18 @@ async function action(
 			return eventsPage(s, { event: String(i.value ?? "") || undefined });
 		case "events_page":
 			return eventsPage(s, parseFilter(i.block_id), cursorOf(i.value));
+		case "failed_resend": {
+			const sent = await resend(config, s, String(i.value ?? "")).catch(() => false);
+			return eventsPage(s, {}, undefined, sent ? { type: "success", message: "Sent. It's off the failed list." } : { type: "error", message: "The receiver still didn't take it. It stays on the list." });
+		}
+		case "failed_clear":
+			await s.failedEvents.delete(String(i.value ?? ""));
+			return eventsPage(s, {}, undefined, { type: "success", message: "Cleared." });
+		case "failed_clear_all": {
+			const { items } = await s.failedEvents.query({ limit: 100 });
+			await s.failedEvents.deleteMany(items.map((r) => r.id));
+			return eventsPage(s, {}, undefined, { type: "success", message: "Failed events cleared." });
+		}
 		case "access_test":
 			return accessTest(config, i.values);
 		case "member_export": {
@@ -750,7 +812,8 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 						},
 					]
 				: []),
-			{ type: "context", text: "Deliveries, their health and the webhook subscriptions are under Webhooks; everything RedeemID did is under App events." },
+			...templateBlocks(config),
+			{ type: "context", text: "Setting up a store step by step is under Setup. Deliveries, their health and the webhook subscriptions are under Webhooks; everything RedeemID did is under App events." },
 			{ type: "divider" },
 			{ type: "header", text: "Shopify settings" },
 			{
@@ -768,6 +831,30 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 	};
 }
 
+/** Status: templates that would show a gated body in full (see template-scan.ts). */
+function templateBlocks(config: RedeemIDConfig): unknown[] {
+	const found = templateFindings();
+	if (!found) return [{ type: "banner", variant: "alert", title: "Templates weren't checked", description: "Add redeemidGuard() to the integrations in astro.config.mjs. It gates pages and keeps members out of EmDash's own APIs, and checks the templates." }];
+	const risky = gatedFindings(found, config);
+	if (!risky.length) return [{ type: "context", text: "Templates: none renders a gated collection's body with EmDash's PortableText. Bodies go through RedeemID's Content." }];
+	const sure = risky.filter((f) => f.gated.length);
+	return [
+		sure.length
+			? { type: "banner", variant: "error", title: "A template shows locked bodies in full", description: "These templates render a gated collection's body with EmDash's <PortableText>, which skips every rule, Paywall break and Members only part. Use RedeemID's <Content value={entry.data.content} collection=\"…\" terms={entry.data.terms} id={entry.id} /> instead." }
+			: { type: "banner", variant: "alert", title: "Check these templates", description: "They render a body with EmDash's <PortableText> and RedeemID couldn't see which collection. If it's one with a rule, use RedeemID's <Content> instead." },
+		{
+			type: "table",
+			page_action_id: "template_findings",
+			columns: [
+				{ key: "file", label: "Template" },
+				{ key: "lines", label: "Line" },
+				{ key: "collections", label: "Gated collection" },
+			],
+			rows: risky.map((f) => ({ file: f.file, lines: f.lines.join(", "), collections: f.gated.join(", ") || "Not found in the file" })),
+		},
+	];
+}
+
 async function statusWidget(config: RedeemIDConfig, ctx: PluginContext) {
 	const c = await checks(config);
 	const members = await allMembers().catch(() => []);

package/src/rate-limit.ts

@@ -1,6 +1,6 @@
 /**
  * Optional per-visitor rate limits on the routes that start work at Shopify:
- * Sign in, Buy and cart changes. On Cloudflare Workers they use a Rate
+ * Sign in, Buy, cart changes and catalog search. On Cloudflare Workers they use a Rate
  * Limiting binding named REDEEMID_RATE_LIMIT (see rate-limit-cloudflare.ts);
  * nothing is limited without one.
  */
@@ -18,6 +18,8 @@ const LIMITED: Record<string, string> = {
 	[`POST ${BASE}/buy`]: "buy",
 	[`POST ${BASE}/cart-edit`]: "cart",
 	[`POST ${BASE}/api/cart`]: "cart",
+	// Each new query is a Storefront API call.
+	[`GET ${BASE}/api/search`]: "search",
 };
 
 /** Which limited action a request is, or null. */

package/src/routes/account.ts

@@ -11,7 +11,7 @@ import type { APIRoute } from "astro";
 import { safeReturn, signInUrl } from "../access.js";
 import { readConfig, storeDomain } from "../config.js";
 import { discover } from "../shopify.js";
-import { fail } from "./shared.js";
+import { fail, sessionUser } from "./shared.js";
 
 export const prerender = false;
 
@@ -20,7 +20,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	const config = readConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
 	if (!config || !storeDomain(config)) return fail(redirect, returnTo, "not_configured");
 
-	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const user = await sessionUser(session, (locals as { emdash?: { db?: unknown } }).emdash?.db);
 	if (!user?.id) return redirect(signInUrl(returnTo));
 	try {
 		const d = await discover(config);

package/src/routes/api/state.ts

@@ -18,6 +18,7 @@ import { siteConfig } from "../../site-config.js";
 import { memberForUser, stores } from "../../storage.js";
 import { VERSION } from "../../version.js";
 import { json } from "./shared.js";
+import { sessionUser } from "../shared.js";
 
 export const prerender = false;
 
@@ -36,7 +37,7 @@ export interface State {
 export const GET: APIRoute = async ({ locals, session }) => {
 	const config = await siteConfig(locals);
 	const db = (locals as { emdash?: { db?: unknown } }).emdash?.db;
-	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const user = await sessionUser(session, db);
 	const ref = await readCart(session);
 	const state: State = {
 		apiVersion: API_VERSION,

package/src/routes/buy.ts

@@ -16,7 +16,7 @@ import { memberForUser, stores } from "../storage.js";
 import { saveCart, readCart } from "../cart.js";
 import { checkoutFor } from "../checkout.js";
 import { addToCart, plan, storeContext } from "../storefront.js";
-import { fail } from "./shared.js";
+import { fail, sessionUser } from "./shared.js";
 
 export const prerender = false;
 
@@ -33,8 +33,8 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 		const p = await plan(config, handle);
 		if (!p?.variantId || !p.availableForSale) return fail(redirect, returnTo, "plan_unavailable");
 		// Provider routes are public, so read the member from the session.
-		const user = (await session?.get("user")) as { id?: string } | undefined;
-		const member = user?.id && emdash?.db ? await memberForUser(stores(emdash.db), user.id) : null;
+		const user = await sessionUser(session, emdash?.db);
+		const member = user && emdash?.db ? await memberForUser(stores(emdash.db), user.id) : null;
 		const current = await readCart(session);
 		const cart = await addToCart(
 			config,

package/src/routes/callback.ts

@@ -21,6 +21,8 @@ import { record } from "../log.js";
 import { levelsFor } from "../access.js";
 import { discover, exchangeCode, identity, logoutUrl, ShopifyError, verifyIdToken, type Discovery } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
+import { adminConfigured, resync } from "../admin-api.js";
+import { seal } from "../token-vault.js";
 import { getPublicOrigin, OptionsRepository } from "emdash/api/route-utils";
 
 import { afterLogoutCookie, callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_CUSTOMER_TOKEN, SESSION_ID_TOKEN, type CustomerToken, type Flow } from "./shared.js";
@@ -119,10 +121,18 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 					syncedAt: now,
 					source: "sign-in",
 					linkedAt: member.linkedAt ?? now,
+					emailVerified,
 				},
 				now,
 			),
 		);
+		// With the Admin API app, signing in is a full sync: the membership
+		// dates and marketing consent too. A failure never blocks sign-in.
+		if (adminConfigured()) {
+			await resync(config, s, [who.customerId], "sign-in").catch(async (e: Error) => {
+				await record({ event: "staff.resync", label: "sign-in", status: "error", level: "warn", origin: "member", customerId: who.customerId, note: String(e.message).slice(0, 200) });
+			});
+		}
 
 		const levels = levelsFor(who.tags, config.levels);
 		await record({ event: "member.signed_in", label: flow.refresh ? "refresh" : member.linkedAt ? "sign-in" : "first sign-in", status: "ok", origin: "member", customerId: who.customerId });
@@ -132,7 +142,12 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);
-		session.set(SESSION_CUSTOMER_TOKEN, { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken ?? null, expiresAt: tokens.expiresAt ?? null } satisfies CustomerToken);
+		// Kept only for signed-in checkout, and sealed (see token-vault.ts).
+		if (config.checkout?.signIn !== false) {
+			const sealed = await seal({ accessToken: tokens.accessToken, refreshToken: tokens.refreshToken ?? null, expiresAt: tokens.expiresAt ?? null } satisfies CustomerToken, emdash.db).catch(() => null);
+			if (sealed) session.set(SESSION_CUSTOMER_TOKEN, sealed);
+			else session.delete?.(SESSION_CUSTOMER_TOKEN);
+		} else session.delete?.(SESSION_CUSTOMER_TOKEN);
 		return flow.refresh ? fail(redirect, returnTo, "refreshed") : redirect(returnTo);
 	} catch (e) {
 		const code = e instanceof ShopifyError ? e.code : e instanceof OAuthError ? "signup_not_allowed" : "sign_in_failed";

package/src/routes/preferences.ts

@@ -17,7 +17,7 @@ import { siteConfig } from "../site-config.js";
 import { emit } from "../events.js";
 import { allowSave, formValues, PreferenceError, preferenceFields, preferencesConfigured, readPreferences, savePreferences } from "../preferences.js";
 import { memberForUser, stores } from "../storage.js";
-import { fail } from "./shared.js";
+import { fail, sessionUser } from "./shared.js";
 
 export const prerender = false;
 
@@ -28,7 +28,7 @@ async function context(locals: unknown, session: { get(k: string): Promise<unkno
 	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
 	const config = await siteConfig(locals);
 	if (!config || !preferencesConfigured(config) || !emdash?.db) return { error: "unavailable" as const };
-	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const user = await sessionUser(session, emdash.db);
 	if (!user?.id) return { error: "sign_in" as const, config };
 	const s = stores(emdash.db);
 	const member = await memberForUser(s, user.id);

package/src/routes/privacy.ts

@@ -15,14 +15,14 @@ import { safeReturn, signInUrl } from "../access.js";
 import { siteConfig } from "../site-config.js";
 import { eraseMember, exportRequest } from "../privacy.js";
 import { memberForUser, stores } from "../storage.js";
-import { fail } from "./shared.js";
+import { fail, sessionUser } from "./shared.js";
 
 export const prerender = false;
 
 async function context(locals: unknown, session: { get(k: string): Promise<unknown> } | undefined) {
 	const emdash = (locals as { emdash?: { config?: unknown; db?: unknown } }).emdash;
 	if (!emdash?.db) return null;
-	const user = (await session?.get("user")) as { id?: string } | undefined;
+	const user = await sessionUser(session, emdash.db);
 	if (!user?.id) return null;
 	const s = stores(emdash.db);
 	const member = await memberForUser(s, user.id);

package/src/routes/shared.ts

@@ -63,3 +63,22 @@ export function readAfterLogout(raw: string | undefined): { code: string; return
 		return null;
 	}
 }
+
+type SessionLike = { get(key: string): unknown } | undefined;
+
+/**
+ * The signed-in EmDash user behind this session, or null: none, gone, or
+ * disabled in EmDash since they signed in. Every member route asks this
+ * instead of trusting the session's user id.
+ */
+export async function sessionUser(session: SessionLike, db: unknown): Promise<{ id: string } | null> {
+	const held = (await session?.get("user")) as { id?: string } | undefined;
+	if (!held?.id || !db) return null;
+	try {
+		const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
+		const user = await createKyselyAdapter(db as never).getUserById(held.id);
+		return user && !user.disabled ? { id: user.id } : null;
+	} catch {
+		return null;
+	}
+}

package/src/routes/webhook.ts

@@ -12,9 +12,11 @@ import type { APIRoute } from "astro";
 import { env, ENV } from "../config.js";
 import { siteConfig } from "../site-config.js";
 import { levelChange } from "../events.js";
-import { stores } from "../storage.js";
+import { stores, type Stores } from "../storage.js";
+import { adminConfigured, resync } from "../admin-api.js";
+import type { RedeemIDConfig } from "../config.js";
 import { record } from "../log.js";
-import { apply, customerOf, kindOf, verifyHmac } from "../webhooks.js";
+import { apply, customerOf, kindOf, verifyHmac, type Outcome } from "../webhooks.js";
 
 export const prerender = false;
 
@@ -78,7 +80,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 	try {
 		const config = await siteConfig(locals);
-		const outcome = await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config);
+		const outcome = (await currentTags(config, s, topic, customerId)) ?? (await apply(s, topic, payload, (before, after) => levelChange(config, before, after, topic), config));
 		if (delivery) await s.deliveries.put(delivery, { topic, receivedAt, outcome, customerId }).catch(() => undefined);
 		await record({ event: "webhook.received", label: topic, status: outcome, origin: "webhook", customerId, ms: Date.now() - started });
 		return new Response(outcome, { status: 200 });
@@ -89,3 +91,24 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		return new Response("Retry", { status: 500 });
 	}
 };
+
+/**
+ * Tag webhooks carry only the change, and can arrive out of order. With the
+ * Admin API app set up, read the customer's tags as they are now instead of
+ * applying the change. Null (apply the change) without the app, or when the
+ * read fails.
+ */
+async function currentTags(config: RedeemIDConfig | null, s: Stores, topic: string, customerId: string | null): Promise<Outcome | null> {
+	if (!config || !customerId || kindOf(topic) !== "tags" || !adminConfigured()) return null;
+	try {
+		const before = await s.members.get(customerId);
+		const { updated } = await resync(config, s, [customerId], topic);
+		const m = updated[0];
+		if (!m) return "skipped";
+		await levelChange(config, before?.tags ?? null, m, topic);
+		return "processed";
+	} catch (e) {
+		console.error("[redeemid] tag webhook resync failed, applying the change:", (e as Error).message);
+		return null;
+	}
+}