@redeemid/emdash 0.0.2 → 0.0.4

package/src/components/Content.astro

@@ -0,0 +1,60 @@
+---
+/**
+ * An entry's body, with RedeemID's paywall break applied.
+ *
+ *   <Content value={post.data.content} collection="posts" terms={post.data.terms} />
+ *
+ * Everything before the first "Paywall break" block is shown to everyone.
+ * What follows reaches the page only for readers who may read it: the levels
+ * picked on the break, or when none are picked the entry's rule (with no rule,
+ * the break changes nothing, as on WordPress). Others get the "locked" slot (or a built-in notice).
+ * A body with no break follows the entry's rule as a whole; readers who can't
+ * read it see the collection's teaser (config `teaser`, in words), if any.
+ */
+import { PortableText } from "emdash/ui";
+
+import { canRead, entryRequirement, signInUrl, type Terms } from "../access.js";
+import { splitAtPaywall, teaser } from "../blocks-names.js";
+import { siteConfig } from "../site-config.js";
+
+interface Props {
+	value?: unknown[] | null;
+	collection?: string;
+	terms?: Terms;
+}
+
+const { value, collection = "", terms } = Astro.props;
+const split = splitAtPaywall(value);
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+// A break with levels picked locks the rest to them; with none picked it
+// follows the entry's rule, and does nothing when no rule covers the entry.
+const required = split.paywall
+	? split.levels.length
+		? [split.levels]
+		: await entryRequirement(config, collection, terms)
+	: undefined;
+const verdict =
+	split.paywall && required === null
+		? { allowed: true, reason: "open" as const }
+		: await canRead(Astro, { collection, terms }, required ? { required } : undefined);
+const words = config?.teaser?.[collection] ?? 0;
+const shown = split.paywall ? split.open : verdict.allowed ? split.open : teaser(split.open, words);
+const here = Astro.url.pathname + Astro.url.search;
+---
+
+{shown.length > 0 && <PortableText value={shown} />}
+{verdict.allowed ? (
+	split.locked.length > 0 && <PortableText value={split.locked} />
+) : (
+	<div class="redeemid-locked" data-redeemid-reason={verdict.reason}>
+		<slot name="locked" />
+		{verdict.reason === "sign_in" && (
+			<p>
+				This is for members. <a href={signInUrl(here)}>Sign in</a> to read on.
+			</p>
+		)}
+		{verdict.reason === "upgrade" && <p>Your membership doesn't include the rest of this yet.</p>}
+		{verdict.reason === "disabled" && <p>Your account is turned off. Contact the store for help.</p>}
+		{verdict.reason === "unconfigured" && <p>This is for members.</p>}
+	</div>
+)}

package/src/config.ts

@@ -18,18 +18,32 @@ export interface LevelConfig {
 }
 
 /**
- * Who may read entries. A rule with `term` applies to entries that carry that
- * term; a rule without one applies to the whole collection. Term rules win
- * over collection rules for the same entry.
+ * Who may read entries, like RedeemID's content rules on WordPress:
+ *
+ * - A rule with `taxonomy` and `term` covers entries that carry that term, or
+ *   a child of it in a hierarchical taxonomy (a child's own rule wins over its
+ *   parent's).
+ * - A rule with neither covers the whole collection.
+ * - `collection: "*"` is the site default, for collections with no rule.
+ *
+ * Term rules beat the collection rule, which beats the site default. When
+ * several term rules cover one entry, a reader must pass every one of them
+ * (most restrictive), unless `combine` is "any".
  */
 export interface RuleConfig {
+	/** Collection slug, or "*" for the site default. */
 	collection: string;
 	/** Taxonomy slug, e.g. "category". Requires `term`. */
 	taxonomy?: string;
 	/** Term slug, e.g. "premium". */
 	term?: string;
-	/** Level slugs that may read. An empty list means signed-in members of any level. */
+	/** Level slugs, any of which may read. An empty list means any signed-in member. */
 	levels: string[];
+	/**
+	 * A term rule that opens its entries to everyone, whatever else covers them
+	 * ("Opens" on WordPress). `levels` is ignored.
+	 */
+	open?: boolean;
 }
 
 export interface RedeemIDConfig {
@@ -43,6 +57,17 @@ export interface RedeemIDConfig {
 	label?: string;
 	levels?: LevelConfig[];
 	rules?: RuleConfig[];
+	/**
+	 * How several term rules on one entry combine: "all" (default, the most
+	 * restrictive: pass every rule) or "any" (pass one of them).
+	 */
+	combine?: "all" | "any";
+	/**
+	 * Teaser length in words, per collection, for locked entries with no paywall
+	 * break: readers who can't read on see this many words of the body. Without
+	 * one they see none of it.
+	 */
+	teaser?: Record<string, number>;
 	/**
 	 * Extra /_emdash path prefixes signed-in members may use. Everything else
 	 * under /_emdash is refused to Subscribers (see guard.ts).

package/src/descriptor.ts

@@ -0,0 +1,29 @@
+/**
+ * The RedeemID plugin descriptor, safe to load from astro.config.mjs (no
+ * runtime imports). The plugin itself is in plugin.ts.
+ */
+
+import type { PluginDescriptor } from "emdash";
+
+import type { RedeemIDConfig } from "./config.js";
+import { VERSION } from "./version.js";
+
+export const PAGES = [
+	{ path: "/", label: "Members", icon: "users" },
+	{ path: "/status", label: "Status", icon: "pulse" },
+];
+export const WIDGETS = [{ id: "status", title: "RedeemID", size: "half" as const }];
+
+/** The descriptor for `emdash({ plugins: [...] })`. Pass the same config as `redeemid()`. */
+export function redeemidPlugin(config: RedeemIDConfig): PluginDescriptor<RedeemIDConfig> {
+	return {
+		id: "redeemid",
+		version: VERSION,
+		entrypoint: "@redeemid/emdash/plugin",
+		componentsEntry: "@redeemid/emdash/blocks",
+		options: config,
+		adminPages: PAGES,
+		adminWidgets: WIDGETS,
+	};
+}
+

package/src/index.ts

@@ -36,6 +36,7 @@ import { STORAGE_CONFIG } from "./storage.js";
 
 export type { LevelConfig, RedeemIDConfig, RuleConfig } from "./config.js";
 export type { MemberRecord } from "./storage.js";
+export { redeemidPlugin } from "./descriptor.js";
 // Page-time helpers live in "@redeemid/emdash/access": they read the site's
 // build-time config module, which astro.config.mjs can't load.
 
@@ -54,6 +55,8 @@ export function redeemid(config: RedeemIDConfig): AuthProviderDescriptor {
 			{ pattern: `${BASE}/logout`, entrypoint: "@redeemid/emdash/routes/logout.ts" },
 			{ pattern: `${BASE}/webhook`, entrypoint: "@redeemid/emdash/routes/webhook.ts" },
 			{ pattern: `${BASE}/buy`, entrypoint: "@redeemid/emdash/routes/buy.ts" },
+			{ pattern: `${BASE}/cart`, entrypoint: "@redeemid/emdash/routes/cart.ts" },
+			{ pattern: `${BASE}/account`, entrypoint: "@redeemid/emdash/routes/account.ts" },
 		],
 		publicRoutes: [`${BASE}/`],
 		storage: STORAGE_CONFIG,

package/src/plugin.ts

@@ -0,0 +1,290 @@
+/**
+ * RedeemID as an EmDash plugin: what editors and admins see.
+ *
+ *   emdash({
+ *     authProviders: [redeemid(config)],
+ *     plugins: [redeemidPlugin(config)],
+ *   })
+ *
+ * It adds two Portable Text blocks to the editor, a Members page, a Status
+ * page and a dashboard widget. Sign-in, webhooks and checkout stay on the
+ * auth provider's routes.
+ *
+ * - "Paywall break" (`redeemid-paywall`): everything after it in the body is
+ *   for members. Pick the levels that may read on ("Signed in" for any
+ *   member); none picked means the entry's rule, and nothing is locked when
+ *   no rule covers the entry, as on WordPress.
+ * - "Plan" (`redeemid-plan`): a Shopify product's title and price with a
+ *   button that adds it to the cart and opens checkout.
+ *
+ * Render bodies with `<Content>` (components/Content.astro), which keeps the
+ * part after a paywall break off the page for readers who can't read it.
+ */
+
+import type { ResolvedPlugin, RouteContext } from "emdash";
+import { definePlugin } from "emdash";
+
+import { describe, levelsFor, SIGNED_IN } from "./access.js";
+import { env, ENV, storeDomain, type RedeemIDConfig } from "./config.js";
+import { discover } from "./shopify.js";
+import { stores, type MemberRecord } from "./storage.js";
+import { PAGES, WIDGETS } from "./descriptor.js";
+import { VERSION } from "./version.js";
+
+import { PAYWALL_BLOCK, PLAN_BLOCK } from "./blocks-names.js";
+
+export { PAYWALL_BLOCK, PLAN_BLOCK };
+
+function blocks(config: RedeemIDConfig) {
+	const levelOptions = [
+		{ label: "Signed in (any member)", value: SIGNED_IN },
+		...(config.levels ?? []).map((l) => ({ label: l.name, value: l.slug })),
+	];
+	return [
+		{
+			type: PAYWALL_BLOCK,
+			label: "Paywall break",
+			icon: "lock",
+			description: "Everything after this is for members",
+			fields: [
+				{
+					type: "checkbox" as const,
+					action_id: "levels",
+					label: "Who can read on (none = the entry's rule)",
+					options: levelOptions,
+				},
+			],
+		},
+		{
+			type: PLAN_BLOCK,
+			label: "Plan",
+			icon: "tag",
+			description: "A Shopify product with its price and a buy button",
+			placeholder: "Shopify product handle",
+			fields: [
+				{ type: "text_input" as const, action_id: "handle", label: "Shopify product handle", placeholder: "gold-membership" },
+				{ type: "text_input" as const, action_id: "title", label: "Title (optional, Shopify's title otherwise)" },
+				{ type: "text_input" as const, action_id: "label", label: "Button label", placeholder: "Join" },
+			],
+		},
+	];
+}
+
+export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
+	return definePlugin({
+		id: "redeemid",
+		version: VERSION,
+		capabilities: [],
+		admin: {
+			pages: PAGES,
+			widgets: WIDGETS,
+			portableTextBlocks: blocks(config),
+		},
+		routes: {
+			admin: {
+				handler: async (ctx: RouteContext) => {
+					const i = (ctx.input ?? {}) as { type?: string; page?: string };
+					if (i.type !== "page_load") return { blocks: [] };
+					try {
+						if (i.page === "/") return await membersPage(config);
+						if (i.page === "/status") return await statusPage(config, ctx.request);
+						if (i.page === "widget:status") return await statusWidget(config);
+					} catch (e) {
+						return { blocks: [{ type: "banner", variant: "error", title: "RedeemID couldn't load this page", description: (e as Error).message }] };
+					}
+					return { blocks: [] };
+				},
+			},
+		},
+	});
+}
+
+export default createPlugin;
+
+// ---------------------------------------------------------------- pages
+
+async function memberStores() {
+	const { getDb } = await import("emdash/runtime");
+	return stores(await getDb());
+}
+
+async function allMembers(): Promise<MemberRecord[]> {
+	const s = await memberStores();
+	const out: MemberRecord[] = [];
+	let cursor: string | undefined;
+	do {
+		const page = await s.members.query({ limit: 100, cursor });
+		out.push(...page.items.map((r) => r.data));
+		cursor = page.cursor;
+	} while (cursor && out.length < 1000);
+	return out;
+}
+
+async function membersPage(config: RedeemIDConfig) {
+	const members = await allMembers();
+	const levels = config.levels ?? [];
+	const counts = levels.map((l) => ({
+		label: l.name,
+		value: String(members.filter((m) => m.status === "enabled" && levelsFor(m.tags, levels).includes(l.slug)).length),
+	}));
+	const name = (m: MemberRecord) => [m.firstName, m.lastName].filter(Boolean).join(" ") || "—";
+	const levelNames = (m: MemberRecord) => {
+		const held = levelsFor(m.tags, levels);
+		return levels.filter((l) => held.includes(l.slug)).map((l) => l.name).join(", ") || "—";
+	};
+	return {
+		blocks: [
+			{ type: "header", text: "Members" },
+			{
+				type: "context",
+				text: "Shopify customers who have signed in or that Shopify has sent. Levels come only from their Shopify tags; change tags in Shopify (or with Flow) and access follows.",
+			},
+			{
+				type: "stats",
+				items: [
+					{ label: "Members", value: String(members.length) },
+					{ label: "Turned off", value: String(members.filter((m) => m.status === "disabled").length) },
+					...counts,
+				],
+			},
+			members.length === 0
+				? { type: "context", text: "No members yet. They appear here after their first sign-in or a Shopify customer webhook." }
+				: {
+						type: "table",
+						page_action_id: "members_page",
+						columns: [
+							{ key: "name", label: "Name" },
+							{ key: "email", label: "Email" },
+							{ key: "levels", label: "Levels" },
+							{ key: "tags", label: "Shopify tags" },
+							{ key: "status", label: "Account" },
+							{ key: "synced", label: "Last synced", format: "relative_time" },
+						],
+						rows: members
+							.sort((a, b) => b.syncedAt.localeCompare(a.syncedAt))
+							.map((m) => ({
+								name: name(m),
+								email: m.email ?? "—",
+								levels: levelNames(m),
+								tags: m.tags.join(", ") || "—",
+								status: m.status === "enabled" ? "On" : "Off",
+								synced: m.syncedAt,
+							})),
+					},
+		],
+	};
+}
+
+async function checks(config: RedeemIDConfig) {
+	const domain = storeDomain(config);
+	let discovery = "Not checked";
+	if (domain) {
+		discovery = await discover(config)
+			.then((d) => `OK (${new URL(d.authorizationEndpoint).host})`)
+			.catch((e: Error) => `Failed: ${e.message}`);
+	}
+	return {
+		domain,
+		discovery,
+		clientId: Boolean(env(ENV.clientId)),
+		webhookSecret: Boolean(env(ENV.webhookSecret)),
+		storefront: env(ENV.storefrontPrivateToken) ? "Private token" : env(ENV.storefrontPublicToken) ? "Public token" : "None (tokenless)",
+	};
+}
+
+async function lastDelivery(): Promise<string | null> {
+	const s = await memberStores();
+	const { items } = await s.deliveries.query({ orderBy: { receivedAt: "desc" }, limit: 1 });
+	const d = items[0]?.data;
+	return d ? `${d.topic} at ${d.receivedAt}` : null;
+}
+
+async function statusPage(config: RedeemIDConfig, request: Request) {
+	const c = await checks(config);
+	const origin = new URL(request.url).origin;
+	const yes = (v: boolean) => (v ? "Set" : "Missing");
+	const levels = config.levels ?? [];
+	const rules = config.rules ?? [];
+	const delivery = await lastDelivery().catch(() => null);
+	return {
+		blocks: [
+			{ type: "header", text: "Status" },
+			c.discovery.startsWith("OK") && c.clientId
+				? { type: "banner", variant: "default", title: "Sign-in is ready", description: "Members can sign in with their Shopify customer account." }
+				: { type: "banner", variant: "alert", title: "Sign-in isn't ready", description: "Set the missing values below as environment secrets, then reload." },
+			{
+				type: "fields",
+				fields: [
+					{ label: "Store domain (REDEEMID_SHOPIFY_STORE_DOMAIN or shop)", value: c.domain || "Missing" },
+					{ label: "Store discovery", value: c.discovery },
+					{ label: "Customer Account API client ID", value: yes(c.clientId) },
+					{ label: "Webhook signing secret", value: yes(c.webhookSecret) },
+					{ label: "Storefront API access", value: c.storefront },
+					{ label: "Last webhook", value: delivery ?? "None received yet" },
+				],
+			},
+			{ type: "divider" },
+			{ type: "header", text: "Shopify settings" },
+			{
+				type: "fields",
+				fields: [
+					{ label: "Callback URI", value: `${origin}/_emdash/api/auth/redeemid/callback` },
+					{ label: "JavaScript origin", value: origin },
+					{ label: "Logout URI", value: `${origin}/` },
+					{ label: "Webhook URL", value: `${origin}/_emdash/api/auth/redeemid/webhook` },
+				],
+			},
+			{ type: "divider" },
+			{ type: "header", text: "Levels" },
+			{ type: "context", text: "Set in astro.config.mjs." },
+			levels.length
+				? {
+						type: "table",
+						page_action_id: "levels_page",
+						columns: [
+							{ key: "name", label: "Level" },
+							{ key: "tags", label: "Shopify tags" },
+							{ key: "match", label: "Needs" },
+						],
+						rows: levels.map((l) => ({ name: l.name, tags: l.tags.join(", "), match: l.match === "all" ? "All tags" : "Any tag" })),
+					}
+				: { type: "context", text: "No levels configured." },
+			{ type: "header", text: "Rules" },
+			rules.length
+				? {
+						type: "table",
+						page_action_id: "rules_page",
+						columns: [
+							{ key: "where", label: "Covers" },
+							{ key: "levels", label: "Who can read" },
+						],
+						rows: rules.map((r) => ({
+							where:
+								r.taxonomy && r.term
+									? `${r.collection === "*" ? "Every collection" : r.collection}, ${r.taxonomy}: ${r.term} (and its child terms)`
+									: r.collection === "*"
+										? "Site default (collections with no rule)"
+										: `All ${r.collection}`,
+							levels: r.open ? "Everyone (opens the entry)" : r.levels.length ? describe([r.levels], levels) : "Any signed-in member",
+						})),
+					}
+				: { type: "context", text: "No rules. Entries are open unless their body has a paywall break." },
+		],
+	};
+}
+
+async function statusWidget(config: RedeemIDConfig) {
+	const c = await checks(config);
+	const members = await allMembers().catch(() => []);
+	return {
+		blocks: [
+			{
+				type: "fields",
+				fields: [
+					{ label: "Sign-in", value: c.discovery.startsWith("OK") && c.clientId ? "Ready" : "Not ready" },
+					{ label: "Members", value: String(members.length) },
+				],
+			},
+		],
+	};
+}

package/src/routes/account.ts

@@ -0,0 +1,31 @@
+/**
+ * GET /_emdash/api/auth/redeemid/account
+ *
+ * Sends a member to their Shopify customer account (orders, profile,
+ * addresses), on the store's own account domain. Visitors who aren't
+ * signed in go through sign-in first; Shopify would ask them anyway.
+ */
+
+import type { APIRoute } from "astro";
+
+import { safeReturn, signInUrl } from "../access.js";
+import { readConfig, storeDomain } from "../config.js";
+import { discover } from "../shopify.js";
+import { fail } from "./shared.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
+	const returnTo = safeReturn(new URL(request.url).searchParams.get("return"));
+	const config = readConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
+	if (!config || !storeDomain(config)) return fail(redirect, returnTo, "not_configured");
+
+	const user = (await session?.get("user")) as { id?: string } | undefined;
+	if (!user?.id) return redirect(signInUrl(returnTo));
+	try {
+		const d = await discover(config);
+		return redirect(new URL("/", d.authorizationEndpoint).href);
+	} catch {
+		return fail(redirect, returnTo, "account_unavailable");
+	}
+};

package/src/routes/buy.ts

@@ -1,8 +1,9 @@
 /**
- * POST /_emdash/api/auth/redeemid/buy: start a Shopify checkout for one plan.
+ * POST /_emdash/api/auth/redeemid/buy: add a plan to the cart and check out.
  *
  * Takes a product handle, looks its variant up again on Shopify (never
- * trusting a posted variant or price) and sends the buyer to checkout. A
+ * trusting a posted variant or price), adds it to the visitor's Shopify
+ * cart and sends them to that cart's checkout. A
  * signed-in member's email is passed along so the order lands on the same
  * customer. Tags, and so access, still only change when Shopify says so.
  */
@@ -12,7 +13,8 @@ import type { APIRoute } from "astro";
 import { readConfig, storeDomain } from "../config.js";
 import { safeReturn } from "../access.js";
 import { memberForUser, stores } from "../storage.js";
-import { checkoutUrl, plan } from "../storefront.js";
+import { saveCart, readCart } from "../cart.js";
+import { addToCart, plan } from "../storefront.js";
 import { fail } from "./shared.js";
 
 export const prerender = false;
@@ -32,12 +34,15 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 		// Provider routes are public, so read the member from the session.
 		const user = (await session?.get("user")) as { id?: string } | undefined;
 		const member = user?.id && emdash?.db ? await memberForUser(stores(emdash.db), user.id) : null;
-		const to = await checkoutUrl(
+		const current = await readCart(session);
+		const cart = await addToCart(
 			config,
+			current?.id ?? null,
 			{ variantId: p.variantId, sellingPlanId: p.sellingPlanId },
 			{ email: member?.email ?? null, buyerIp: request.headers.get("cf-connecting-ip") },
 		);
-		return redirect(to, 303);
+		saveCart(session, { id: cart.id, count: cart.totalQuantity });
+		return redirect(cart.checkoutUrl, 303);
 	} catch {
 		return fail(redirect, returnTo, "checkout_failed");
 	}

package/src/routes/cart.ts

@@ -0,0 +1,37 @@
+/**
+ * GET /_emdash/api/auth/redeemid/cart?return=/path
+ *
+ * Sends the visitor to their Shopify cart's checkout. With no cart, or one
+ * Shopify has closed (its checkout completed), they go back with the
+ * `cart_empty` notice and the stored cart is cleared.
+ */
+
+import type { APIRoute } from "astro";
+
+import { safeReturn } from "../access.js";
+import { readCart, saveCart } from "../cart.js";
+import { readConfig, storeDomain } from "../config.js";
+import { getCart } from "../storefront.js";
+import { fail } from "./shared.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
+	const returnTo = safeReturn(new URL(request.url).searchParams.get("return"));
+	const config = readConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
+	if (!config || !storeDomain(config)) return fail(redirect, returnTo, "not_configured");
+
+	const ref = await readCart(session);
+	if (!ref) return fail(redirect, returnTo, "cart_empty");
+	try {
+		const cart = await getCart(config, ref.id, { buyerIp: request.headers.get("cf-connecting-ip") });
+		if (!cart || cart.totalQuantity < 1) {
+			saveCart(session, null);
+			return fail(redirect, returnTo, "cart_empty");
+		}
+		saveCart(session, { id: cart.id, count: cart.totalQuantity });
+		return redirect(cart.checkoutUrl, 303);
+	} catch {
+		return fail(redirect, returnTo, "checkout_failed");
+	}
+};

package/src/shopify.ts

@@ -24,6 +24,12 @@ const DISCOVERY_TTL_MS = 60 * 60 * 1000;
 const discoveryCache = new Map<string, { at: number; value: Discovery }>();
 const jwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();
 
+/**
+ * Shopify answers 403 to requests with no User-Agent, and fetch on
+ * Cloudflare Workers sends none, so every server-side call names itself.
+ */
+export const USER_AGENT = "@redeemid/emdash (+https://github.com/webmultipliers/redeemid-emdash)";
+
 export class ShopifyError extends Error {
 	constructor(
 		public readonly code: string,
@@ -65,7 +71,7 @@ export async function discover(config: RedeemIDConfig, fetcher: typeof fetch = f
 }
 
 async function getJson(fetcher: typeof fetch, url: string): Promise<Record<string, unknown>> {
-	const res = await fetcher(url, { headers: { Accept: "application/json" } });
+	const res = await fetcher(url, { headers: { Accept: "application/json", "User-Agent": USER_AGENT } });
 	if (!res.ok) throw new ShopifyError("discovery_failed", `Discovery failed (${res.status}) for ${url}`);
 	return (await res.json()) as Record<string, unknown>;
 }
@@ -128,6 +134,7 @@ export async function exchangeCode(
 	const headers: Record<string, string> = {
 		"Content-Type": "application/x-www-form-urlencoded",
 		Accept: "application/json",
+		"User-Agent": USER_AGENT,
 	};
 	// Public clients are checked against their registered JavaScript origins.
 	if (args.origin) headers.Origin = args.origin;
@@ -149,7 +156,7 @@ export async function verifyIdToken(
 ): Promise<JWTPayload> {
 	let jwks = jwksCache.get(d.jwksUri);
 	if (!jwks) {
-		jwks = createRemoteJWKSet(new URL(d.jwksUri));
+		jwks = createRemoteJWKSet(new URL(d.jwksUri), { headers: { "User-Agent": USER_AGENT } });
 		jwksCache.set(d.jwksUri, jwks);
 	}
 	try {
@@ -191,7 +198,7 @@ export async function identity(d: Discovery, accessToken: string, fetcher: typeo
 	const res = await fetcher(d.graphqlApi, {
 		method: "POST",
 		// The Customer Account API takes the bare access token, without "Bearer".
-		headers: { "Content-Type": "application/json", Authorization: accessToken },
+		headers: { "Content-Type": "application/json", Authorization: accessToken, "User-Agent": USER_AGENT },
 		body: JSON.stringify({ query: IDENTITY_QUERY }),
 	});
 	const data = (await res.json().catch(() => ({}))) as {