@redeemid/emdash 0.0.27 → 0.0.29

package/docs/developer-api.md

@@ -56,7 +56,7 @@ Under `/_emdash/api/auth/redeemid/`. Same-origin only: EmDash checks `Origin` on
 - `api/state` (GET): the visitor's own state.
 
   ```json
-  { "apiVersion": "1.5.0", "version": "0.0.27", "signedIn": true, "linked": true,
+  { "apiVersion": "1.5.0", "version": "0.0.29", "signedIn": true, "linked": true,
     "levels": ["gold"], "features": ["ad-free"], "cart": { "count": 2 },
     "meter": { "used": 1, "limit": 3, "period": "month" } }
   ```

package/docs/shop.md

@@ -64,7 +64,14 @@ import type { APIRoute } from "astro";
 export const GET: APIRoute = async ({ locals, url }) => productSitemap(await siteConfig(locals), url, { productHref: "/shop/{handle}/" });
 ```
 
-Then submit it to search engines, or list it in robots.txt. A custom robots.txt in EmDash's SEO settings replaces the generated one, so keep both lines in it: `Sitemap: https://<your site>/sitemap.xml` and `Sitemap: https://<your site>/sitemap-products.xml`. If the store's Online Store channel is open too, search engines find two pages for each product; headless stores usually password-protect the Online Store or redirect it to the site.
+Then submit it to search engines, or list it in robots.txt. A custom robots.txt in EmDash's SEO settings replaces the generated one, so keep both lines in it: `Sitemap: https://<your site>/sitemap.xml` and `Sitemap: https://<your site>/sitemap-products.xml`. If the store's Online Store channel is open too, search engines find two pages for each product: publish the [redirect theme](https://github.com/webmultipliers/redeemid-emdash-shopify-redirect-theme) on the store to send its pages to the site (below).
+
+<a id="discount-links"></a>**The store's own pages and discount links.** The [RedeemID redirect theme](https://github.com/webmultipliers/redeemid-emdash-shopify-redirect-theme) is a Shopify theme that sends the store's online store pages to the site (`/products/gold` to `/shop/gold/`, with editable path rules), while checkout and customer accounts stay on Shopify. It passes two things along, and the guard middleware (`redeemidGuard()`) takes both off the URL before the page renders:
+
+- `?discount=CODE`, from Shopify's discount links (`https://<store>/discount/CODE?redirect=/products/gold`). The code goes on the visitor's cart straight away, or waits in their session for the first cart made for them (an Add to cart or a plan's Join button). Shopify decides at checkout whether it applies.
+- `?logged_in=true`, when the customer is signed in to the store. A visitor who isn't signed in on the site is sent through sign-in with `prompt=none` (`login?quiet=1`), so they come back signed in without a form, or still signed out if the store session has ended, with no notice either way.
+
+You can link to any site page with `?discount=CODE` yourself, too.
 
 **Shoppers' agents.** Shopify runs a Storefront MCP server for every store at `https://<store domain>/api/mcp`, for AI agents that browse, build a cart and check out. Point shopping agents there; RedeemID's own tools are for staff.
 

package/docs/shopify-setup.md

@@ -27,11 +27,11 @@ The store must use the new customer accounts (Settings → Customer accounts). C
 
 RedeemID keeps tags and status current from webhooks sent by a Shopify app on the store (for example a Dev Dashboard app). Shopify signs every webhook with that app's **client secret**, which is the site's webhook secret.
 
-Give the app the `read_customers` and `write_customers` Admin API scopes, plus `read_customer_merge` for `customers/merge`, and set its **client ID** on the site as well. Then the Setup page (or **Webhooks → Setup**) registers these topics at `https://<site>/_emdash/api/auth/redeemid/webhook` with one button:
+Give the app the `read_customers` and `write_customers` Admin API scopes (`write_customers` alone is enough, since a write scope includes its read scope), plus `read_customer_merge` for `customers/merge`, and set its **client ID** on the site as well. Then the Setup page (or **Webhooks → Setup**) registers these topics at `https://<site>/_emdash/api/auth/redeemid/webhook` with one button:
 
 `customers/create`, `customers/update`, `customers/delete`, `customers/disable`, `customers/enable`, `customers/merge`, `customer.tags_added`, `customer.tags_removed`
 
-Without the client ID, subscribe them to that URL yourself. If the app already sends webhooks to another site, add this URL as extra subscriptions.
+Without the client ID, subscribe them to that URL yourself. If the app already sends webhooks to another site, add this URL as extra subscriptions. Subscriptions set in the app's own configuration (its Dev Dashboard version or `shopify.app.toml`) don't show in the Admin API, so Setup counts each of those topics as sent once a delivery of it arrives.
 
 The client ID and those scopes also run the staff tools (member resync and tag edits written to Shopify), member preferences, and the reads that keep tags in order (see [staff tools](staff.md#staff-tools)). RedeemID uses the client credentials grant, which works when the app and the store are in the same Shopify organization. For the **Also request erasure in Shopify** button on a member's page, add the optional `write_customer_data_erasure` scope.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.27",
+	"version": "0.0.29",
 	"description": "Shopify commerce for EmDash sites: storefront, cart, checkout, customer accounts, memberships and paywalls. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",

package/src/admin-api.ts

@@ -28,6 +28,11 @@ export const WEBHOOK_TOPICS = [
 	"CUSTOMER_TAGS_REMOVED",
 ] as const;
 
+/** WEBHOOK_TOPICS name → the topic Shopify shows: CUSTOMER_TAGS_ADDED → customer.tags_added. */
+export function topicName(t: string): string {
+	return t.toLowerCase().replace("_", "/").replace("customer/tags", "customer.tags");
+}
+
 const MARGIN_MS = 5 * 60 * 1000;
 const tokens = new Map<string, { token: string; until: number; scope: string }>();
 
@@ -64,6 +69,17 @@ async function token(config: RedeemIDConfig, fetcher: typeof fetch): Promise<{ t
 	return value;
 }
 
+/**
+ * The scopes a token's `scope` string grants. Shopify lists only write_x
+ * when an app holds both, because a write scope includes its read scope.
+ */
+export function grantedScopes(scope: string): string[] {
+	const listed = scope.split(",").map((t) => t.trim()).filter(Boolean);
+	const out = new Set(listed);
+	for (const t of listed) if (t.startsWith("write_")) out.add(`read_${t.slice("write_".length)}`);
+	return [...out];
+}
+
 /** The scopes the Admin API token carries, or an error message. */
 export async function adminScopes(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<string> {
 	return (await token(config, fetcher)).scope;

package/src/arrivals.ts

@@ -0,0 +1,103 @@
+/**
+ * Visitors sent over from the store's own pages.
+ *
+ * A store that keeps its Online Store channel usually publishes a redirect
+ * theme, which sends its pages to the site with two extras:
+ *
+ * - `?discount=CODE`: Shopify's discount links (`/discount/CODE`) leave the
+ *   code in a store cookie, and the theme passes it on. The code goes on the
+ *   visitor's cart now, or is kept in their session and goes on the first
+ *   cart made for them.
+ * - `?logged_in=true`: the customer is signed in to the store. A visitor who
+ *   isn't signed in here is signed in without a form (`prompt=none`). If the
+ *   store session has ended, they come back signed out, with no notice.
+ *
+ * Either way the visitor then lands on the same page without those
+ * parameters, so the page itself, and any cache in front of it, never sees
+ * them.
+ */
+
+import { readCart, type CartRef } from "./cart.js";
+import { env, ENV, type RedeemIDConfig } from "./config.js";
+import { setDiscountCodes, type Cart } from "./storefront.js";
+
+export const SESSION_DISCOUNT = "redeemid:discount";
+
+/** Parameters the redirect theme adds, taken off before the page renders. */
+export const ARRIVAL_PARAMS = ["discount", "logged_in", "company_location_id"] as const;
+
+type Session = { get(key: string): unknown; set(key: string, value: unknown): void; delete?(key: string): void } | undefined;
+
+/** A discount code as a link carries it, or null for anything that can't be one. */
+export function discountCode(raw: string | null | undefined): string | null {
+	const code = (raw ?? "").trim();
+	if (!code || code.length > 255 || /[\u0000-\u001f\u007f]/.test(code)) return null;
+	return code;
+}
+
+/** The login route checks `return` again (safeReturn), so this stays free of site config. */
+export function quietSignInUrl(returnTo: string): string {
+	return `/_emdash/api/auth/redeemid/login?quiet=1&return=${encodeURIComponent(returnTo)}`;
+}
+
+/**
+ * The response for a page request that carries the theme's parameters, or
+ * null when it carries none. Only GET and HEAD requests are touched.
+ */
+export async function arrival(
+	context: { url: URL; request?: Request; session?: unknown },
+	config: RedeemIDConfig | null,
+	user: unknown,
+	deps: { setCodes?: typeof setDiscountCodes } = {},
+): Promise<Response | null> {
+	const { url } = context;
+	const method = context.request?.method ?? "GET";
+	if (method !== "GET" && method !== "HEAD") return null;
+	if (!ARRIVAL_PARAMS.some((p) => url.searchParams.has(p))) return null;
+
+	const session = context.session as Session;
+	const code = discountCode(url.searchParams.get("discount"));
+	if (code && session && config) {
+		const cart = await readCart(session as never).catch(() => null);
+		if (cart) {
+			const buyerIp = context.request?.headers.get("cf-connecting-ip") ?? null;
+			await (deps.setCodes ?? setDiscountCodes)(config, cart.id, [code], { buyerIp }).catch((e: Error) => {
+				console.error("[redeemid] discount link failed:", e.message);
+			});
+		} else {
+			session.set(SESSION_DISCOUNT, code);
+		}
+	}
+
+	const clean = new URL(url);
+	for (const p of ARRIVAL_PARAMS) clean.searchParams.delete(p);
+	// "//host" would leave the site.
+	const here = /^\/[\/\\]/.test(clean.pathname) ? "/" : `${clean.pathname}${clean.search}`;
+
+	const signIn = url.searchParams.get("logged_in") === "true" && !user && session && config && env(ENV.clientId);
+	const location = signIn ? quietSignInUrl(here) : here;
+	return new Response(null, { status: 302, headers: { location, "cache-control": "private, no-store" } });
+}
+
+/** The code a discount link left for the visitor's next cart, if any. */
+export async function pendingDiscount(session: Session): Promise<string | null> {
+	return discountCode((await session?.get(SESSION_DISCOUNT)) as string | undefined);
+}
+
+/**
+ * After adding to a cart with a pending code: the code is used up. A new cart
+ * got it when it was made; a cart that already existed gets it now.
+ */
+export async function usedDiscount(
+	session: Session,
+	config: RedeemIDConfig,
+	code: string | null,
+	cart: Cart,
+	before: CartRef | null,
+	opts: { buyerIp?: string | null } = {},
+): Promise<void> {
+	if (!code || !session) return;
+	if (session.delete) session.delete(SESSION_DISCOUNT);
+	else session.set(SESSION_DISCOUNT, undefined);
+	if (before && before.id === cart.id) await setDiscountCodes(config, cart.id, [code], opts).catch(() => null);
+}

package/src/cart-ops.ts

@@ -8,6 +8,7 @@
  * says the product or cart holds.
  */
 
+import { pendingDiscount, usedDiscount } from "./arrivals.js";
 import { readCart, saveCart } from "./cart.js";
 import type { RedeemIDConfig } from "./config.js";
 import { memberForUser, stores } from "./storage.js";
@@ -104,12 +105,14 @@ export async function editCart(input: CartInput, ctx: CartContext): Promise<Cart
 		const user = await sessionUser(session, ctx.db);
 		const member = user && ctx.db ? await memberForUser(stores(ctx.db), user.id) : null;
 		const current = await readCart(session);
+		const discount = await pendingDiscount(session);
 		const cart = await addToCart(
 			config,
 			current?.id ?? null,
 			{ variantId: variant.id, sellingPlanId: plan, quantity },
-			{ email: member?.email ?? null, attributes: input.page ? { _redeemid_page: input.page } : {}, buyerIp, context },
+			{ email: member?.email ?? null, attributes: input.page ? { _redeemid_page: input.page } : {}, buyerIp, context, discountCodes: discount ? [discount] : [] },
 		);
+		await usedDiscount(session, config, discount, cart, current, { buyerIp });
 		save(cart);
 		return { notice: "cart_added", cart: null, base: cart, added: { product: p.handle, variant: variant.id, quantity, sellingPlan: Boolean(plan) } };
 	}

package/src/guard.ts

@@ -28,6 +28,7 @@
 import { defineMiddleware } from "astro:middleware";
 
 import { signInUrl } from "./access.js";
+import { arrival } from "./arrivals.js";
 import { readCart } from "./cart.js";
 import { keysFromUrl, pathAccess, refusal } from "./files.js";
 import { keptOut, purgeRouteCache } from "./route-cache.js";
@@ -142,6 +143,9 @@ async function guard(context: Context, next: Next): Promise<Response> {
 	}
 
 	if (!url.pathname.startsWith("/_emdash")) {
+		// Sent over from the store's own pages, with a discount code or a store sign-in.
+		const arrived = await arrival(context, config, user);
+		if (arrived) return arrived;
 		const own = Boolean(user) || Boolean(await readCart(context.session as never).catch(() => null));
 		if (own) return keepPrivate(context, await next());
 		const res = await next();

package/src/monitor.ts

@@ -13,7 +13,7 @@
  */
 
 import { levelsFor, membership } from "./access.js";
-import { adminConfigured, registerWebhooks } from "./admin-api.js";
+import { adminConfigured, registerWebhooks, topicName } from "./admin-api.js";
 import { env, ENV, type RedeemIDConfig } from "./config.js";
 import { LOG_DAYS, LOG_EVENTS, prune, record, type LogEntry } from "./log.js";
 import { RETRY_DELAYS_MS, type FailedEvent } from "./events.js";
@@ -193,10 +193,7 @@ export async function tidy(s: Stores): Promise<void> {
 	await prune(s.requests, "at", REQUEST_DAYS, { status: "done" }).catch(() => 0);
 }
 
-/** WEBHOOK_TOPICS name → the topic Shopify shows: CUSTOMER_TAGS_ADDED → customer.tags_added. */
-export function topicName(t: string): string {
-	return t.toLowerCase().replace("_", "/").replace("customer/tags", "customer.tags");
-}
+export { topicName };
 
 // ---------------------------------------------------------------- Webhooks page
 

package/src/routes/buy.ts

@@ -13,6 +13,7 @@ import type { APIRoute } from "astro";
 import { readConfig, storeDomain } from "../config.js";
 import { safeReturn } from "../access.js";
 import { memberForUser, stores } from "../storage.js";
+import { pendingDiscount, usedDiscount } from "../arrivals.js";
 import { saveCart, readCart } from "../cart.js";
 import { checkoutFor } from "../checkout.js";
 import { addToCart, plan, storeContext } from "../storefront.js";
@@ -37,12 +38,15 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 		const user = await sessionUser(session, emdash?.db);
 		const member = user && emdash?.db ? await memberForUser(stores(emdash.db), user.id) : null;
 		const current = await readCart(session);
+		const discount = await pendingDiscount(session);
+		const buyerIp = request.headers.get("cf-connecting-ip");
 		const cart = await addToCart(
 			config,
 			current?.id ?? null,
 			{ variantId: p.variantId, sellingPlanId: p.sellingPlanId },
-			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip"), context },
+			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp, context, discountCodes: discount ? [discount] : [] },
 		);
+		await usedDiscount(session, config, discount, cart, current, { buyerIp });
 		saveCart(session, { id: cart.id, count: cart.totalQuantity });
 		return redirect(await checkoutFor(config, cart, { session, request, emdashConfig: emdash?.config }), 303);
 	} catch {

package/src/routes/callback.ts

@@ -41,6 +41,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	if (!config || !storeDomain(config) || !clientId || !emdash?.db || !session) return fail(redirect, returnTo, "not_configured");
 
 	if (url.searchParams.get("error")) {
+		// The store session had ended after all: back to the page, still signed out.
+		if (flow?.quiet) return redirect(returnTo);
 		// Refresh found no open store session: sign in as usual.
 		if (flow?.refresh) return redirect(`/_emdash/api/auth/redeemid/login?return=${encodeURIComponent(returnTo)}`);
 		await refused("sign_in_cancelled", "ok");

package/src/routes/login.ts

@@ -5,6 +5,9 @@
  * With `refresh=1` it asks the store not to show a form (`prompt=none`):
  * a member whose store session is still open comes straight back with their
  * tags read again; anyone else is sent through the usual sign-in.
+ * With `quiet=1` it asks the same, but anyone without an open store session
+ * just goes back, still signed out: for visitors the store's redirect theme
+ * says are signed in there.
  */
 
 import type { APIRoute } from "astro";
@@ -20,11 +23,12 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	const url = new URL(request.url);
 	const returnTo = safeReturn(url.searchParams.get("return"));
 	const refresh = url.searchParams.get("refresh") === "1";
+	const quiet = url.searchParams.get("quiet") === "1";
 	const emdash = (locals as { emdash?: { config?: unknown } }).emdash;
 	const config = readConfig(emdash?.config);
 	const clientId = env(ENV.clientId);
 
-	if (!config || !storeDomain(config) || !clientId || !session) return fail(redirect, returnTo, "not_configured");
+	if (!config || !storeDomain(config) || !clientId || !session) return quiet ? redirect(returnTo) : fail(redirect, returnTo, "not_configured");
 
 	try {
 		const d = await discover(config);
@@ -35,6 +39,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			returnTo,
 			at: Date.now(),
 			...(refresh ? { refresh: true } : {}),
+			...(quiet ? { quiet: true } : {}),
 		};
 		session.set(SESSION_FLOW, flow);
 		return redirect(
@@ -45,11 +50,11 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 				nonce: flow.nonce,
 				challenge: await challengeFor(flow.verifier),
 				locale: request.headers.get("accept-language")?.split(",")[0]?.trim(),
-				...(refresh ? { prompt: "none" as const } : {}),
+				...(refresh || quiet ? { prompt: "none" as const } : {}),
 			}),
 		);
 	} catch (e) {
 		console.error("[redeemid] sign-in start failed:", (e as Error).message);
-		return fail(redirect, returnTo, "sign_in_unavailable");
+		return quiet ? redirect(returnTo) : fail(redirect, returnTo, "sign_in_unavailable");
 	}
 };

package/src/routes/shared.ts

@@ -24,6 +24,8 @@ export interface Flow {
 	at: number;
 	/** Started by Refresh membership (prompt=none). */
 	refresh?: boolean;
+	/** Started because the store said the customer is signed in there: a refusal comes back with no notice and no form. */
+	quiet?: boolean;
 }
 
 export const CALLBACK_PATH = "/_emdash/api/auth/redeemid/callback";

package/src/setup.ts

@@ -16,7 +16,7 @@
  * setupSteps() and setupPage() are pure.
  */
 
-import { adminConfigured, adminScopes, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
+import { adminConfigured, adminScopes, grantedScopes, topicName, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
 import { env, ENV, levelTags, storeDomain, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import type { Stores } from "./storage.js";
@@ -43,7 +43,12 @@ export interface SetupFacts {
 	/** null without the app; "ok", or why the Admin API token was refused. */
 	admin: string | null;
 	scopes: string[];
-	/** Topics not yet sent to this site, or null when that can't be checked. */
+	/**
+	 * Topics not yet sent to this site, or null when that can't be checked.
+	 * A topic counts as sent when the Admin API lists a subscription for it
+	 * here, or when a delivery of it has arrived: subscriptions set in the
+	 * app's own configuration don't show in the Admin API.
+	 */
 	webhooksMissing: string[] | null;
 	levels: Array<{ name: string; tags: string[] }>;
 	/** Members who have signed in on this site. */
@@ -74,10 +79,10 @@ export async function setupFacts(config: RedeemIDConfig, s: Stores, origin: stri
 	let webhooksMissing: string[] | null = null;
 	if (domain && adminConfigured()) {
 		try {
-			scopes = (await adminScopes(config)).split(",").map((t) => t.trim()).filter(Boolean);
+			scopes = grantedScopes(await adminScopes(config));
 			admin = "ok";
-			const subs = await webhookSubscriptions(config);
-			webhooksMissing = WEBHOOK_TOPICS.filter((t) => !subs.some((h) => h.topic === t && h.uri === `${origin}${WEBHOOK}`));
+			const [subs, heard] = await Promise.all([webhookSubscriptions(config), heardTopics(s)]);
+			webhooksMissing = WEBHOOK_TOPICS.filter((t) => !subs.some((h) => h.topic === t && h.uri === `${origin}${WEBHOOK}`) && !heard.has(topicName(t)));
 		} catch (e) {
 			admin = (e as Error).message || "failed";
 		}
@@ -106,6 +111,16 @@ export async function setupFacts(config: RedeemIDConfig, s: Stores, origin: stri
 	};
 }
 
+/** Topics of the latest deliveries, as Shopify names them (customers/update). */
+async function heardTopics(s: Stores): Promise<Set<string>> {
+	try {
+		const { items } = await s.deliveries.query({ orderBy: { receivedAt: "desc" }, limit: 200 });
+		return new Set(items.map((r) => r.data.topic.trim().toLowerCase()));
+	} catch {
+		return new Set();
+	}
+}
+
 const missingScopes = (f: SetupFacts) => SETUP_SCOPES.filter((sc) => !f.scopes.includes(sc));
 
 /** The steps and where each one stands. Pure. */
@@ -201,7 +216,11 @@ function stepBlocks(step: Step, f: SetupFacts): unknown[] {
 			const missing = f.webhooksMissing ?? [];
 			return [
 				...out,
-				{ type: "section", text: `${missing.length} of ${WEBHOOK_TOPICS.length} topics aren't sent to this site yet. RedeemID can register them through the app.` },
+				{ type: "section", text: `${missing.length} of ${WEBHOOK_TOPICS.length} topics aren't sent to this site yet: ${missing.map(topicName).join(", ")}. RedeemID can register them through the app.` },
+				{
+					type: "context",
+					text: "Webhooks set in the app's own configuration (Dev Dashboard version or shopify.app.toml) don't show in the Admin API. Each of those topics counts here once Shopify has sent one, so registering them again isn't needed.",
+				},
 				{ type: "actions", elements: [{ type: "button", action_id: "setup_register", label: `Register ${missing.length} webhooks`, style: "primary" }] },
 				{
 					type: "context",

package/src/storefront.ts

@@ -232,6 +232,8 @@ export async function addToCart(
 		fetcher?: typeof fetch;
 		/** A new cart's country, for local prices. */
 		context?: StoreContext;
+		/** Discount codes for a new cart. */
+		discountCodes?: string[];
 	} = {},
 ): Promise<Cart> {
 	const quantity = Math.max(1, Math.floor(line.quantity ?? 1));
@@ -248,6 +250,7 @@ export async function addToCart(
 	if (Object.keys(identity).length) input.buyerIdentity = identity;
 	const attributes = Object.entries(opts.attributes ?? {}).filter(([, v]) => v);
 	if (attributes.length) input.attributes = attributes.map(([key, value]) => ({ key, value }));
+	if (opts.discountCodes?.length) input.discountCodes = opts.discountCodes;
 	const data = await storefront<{ cartCreate: CartResult }>(config, CART_NEW, { input }, opts);
 	const cart = data.cartCreate.cart;
 	if (!cart) throw new Error(data.cartCreate.userErrors[0]?.message ?? "Shopify returned no cart.");

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.27";
+export const VERSION = "0.0.29";