@redeemid/emdash 0.0.28 → 0.0.29

package/docs/developer-api.md

@@ -56,7 +56,7 @@ Under `/_emdash/api/auth/redeemid/`. Same-origin only: EmDash checks `Origin` on
 - `api/state` (GET): the visitor's own state.
 
   ```json
-  { "apiVersion": "1.5.0", "version": "0.0.28", "signedIn": true, "linked": true,
+  { "apiVersion": "1.5.0", "version": "0.0.29", "signedIn": true, "linked": true,
     "levels": ["gold"], "features": ["ad-free"], "cart": { "count": 2 },
     "meter": { "used": 1, "limit": 3, "period": "month" } }
   ```

package/docs/shopify-setup.md

@@ -27,11 +27,11 @@ The store must use the new customer accounts (Settings → Customer accounts). C
 
 RedeemID keeps tags and status current from webhooks sent by a Shopify app on the store (for example a Dev Dashboard app). Shopify signs every webhook with that app's **client secret**, which is the site's webhook secret.
 
-Give the app the `read_customers` and `write_customers` Admin API scopes, plus `read_customer_merge` for `customers/merge`, and set its **client ID** on the site as well. Then the Setup page (or **Webhooks → Setup**) registers these topics at `https://<site>/_emdash/api/auth/redeemid/webhook` with one button:
+Give the app the `read_customers` and `write_customers` Admin API scopes (`write_customers` alone is enough, since a write scope includes its read scope), plus `read_customer_merge` for `customers/merge`, and set its **client ID** on the site as well. Then the Setup page (or **Webhooks → Setup**) registers these topics at `https://<site>/_emdash/api/auth/redeemid/webhook` with one button:
 
 `customers/create`, `customers/update`, `customers/delete`, `customers/disable`, `customers/enable`, `customers/merge`, `customer.tags_added`, `customer.tags_removed`
 
-Without the client ID, subscribe them to that URL yourself. If the app already sends webhooks to another site, add this URL as extra subscriptions.
+Without the client ID, subscribe them to that URL yourself. If the app already sends webhooks to another site, add this URL as extra subscriptions. Subscriptions set in the app's own configuration (its Dev Dashboard version or `shopify.app.toml`) don't show in the Admin API, so Setup counts each of those topics as sent once a delivery of it arrives.
 
 The client ID and those scopes also run the staff tools (member resync and tag edits written to Shopify), member preferences, and the reads that keep tags in order (see [staff tools](staff.md#staff-tools)). RedeemID uses the client credentials grant, which works when the app and the store are in the same Shopify organization. For the **Also request erasure in Shopify** button on a member's page, add the optional `write_customer_data_erasure` scope.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.28",
+	"version": "0.0.29",
 	"description": "Shopify commerce for EmDash sites: storefront, cart, checkout, customer accounts, memberships and paywalls. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",

package/src/admin-api.ts

@@ -28,6 +28,11 @@ export const WEBHOOK_TOPICS = [
 	"CUSTOMER_TAGS_REMOVED",
 ] as const;
 
+/** WEBHOOK_TOPICS name → the topic Shopify shows: CUSTOMER_TAGS_ADDED → customer.tags_added. */
+export function topicName(t: string): string {
+	return t.toLowerCase().replace("_", "/").replace("customer/tags", "customer.tags");
+}
+
 const MARGIN_MS = 5 * 60 * 1000;
 const tokens = new Map<string, { token: string; until: number; scope: string }>();
 
@@ -64,6 +69,17 @@ async function token(config: RedeemIDConfig, fetcher: typeof fetch): Promise<{ t
 	return value;
 }
 
+/**
+ * The scopes a token's `scope` string grants. Shopify lists only write_x
+ * when an app holds both, because a write scope includes its read scope.
+ */
+export function grantedScopes(scope: string): string[] {
+	const listed = scope.split(",").map((t) => t.trim()).filter(Boolean);
+	const out = new Set(listed);
+	for (const t of listed) if (t.startsWith("write_")) out.add(`read_${t.slice("write_".length)}`);
+	return [...out];
+}
+
 /** The scopes the Admin API token carries, or an error message. */
 export async function adminScopes(config: RedeemIDConfig, fetcher: typeof fetch = fetch): Promise<string> {
 	return (await token(config, fetcher)).scope;

package/src/monitor.ts

@@ -13,7 +13,7 @@
  */
 
 import { levelsFor, membership } from "./access.js";
-import { adminConfigured, registerWebhooks } from "./admin-api.js";
+import { adminConfigured, registerWebhooks, topicName } from "./admin-api.js";
 import { env, ENV, type RedeemIDConfig } from "./config.js";
 import { LOG_DAYS, LOG_EVENTS, prune, record, type LogEntry } from "./log.js";
 import { RETRY_DELAYS_MS, type FailedEvent } from "./events.js";
@@ -193,10 +193,7 @@ export async function tidy(s: Stores): Promise<void> {
 	await prune(s.requests, "at", REQUEST_DAYS, { status: "done" }).catch(() => 0);
 }
 
-/** WEBHOOK_TOPICS name → the topic Shopify shows: CUSTOMER_TAGS_ADDED → customer.tags_added. */
-export function topicName(t: string): string {
-	return t.toLowerCase().replace("_", "/").replace("customer/tags", "customer.tags");
-}
+export { topicName };
 
 // ---------------------------------------------------------------- Webhooks page
 

package/src/setup.ts

@@ -16,7 +16,7 @@
  * setupSteps() and setupPage() are pure.
  */
 
-import { adminConfigured, adminScopes, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
+import { adminConfigured, adminScopes, grantedScopes, topicName, webhookSubscriptions, WEBHOOK_TOPICS } from "./admin-api.js";
 import { env, ENV, levelTags, storeDomain, type RedeemIDConfig } from "./config.js";
 import { discover } from "./shopify.js";
 import type { Stores } from "./storage.js";
@@ -43,7 +43,12 @@ export interface SetupFacts {
 	/** null without the app; "ok", or why the Admin API token was refused. */
 	admin: string | null;
 	scopes: string[];
-	/** Topics not yet sent to this site, or null when that can't be checked. */
+	/**
+	 * Topics not yet sent to this site, or null when that can't be checked.
+	 * A topic counts as sent when the Admin API lists a subscription for it
+	 * here, or when a delivery of it has arrived: subscriptions set in the
+	 * app's own configuration don't show in the Admin API.
+	 */
 	webhooksMissing: string[] | null;
 	levels: Array<{ name: string; tags: string[] }>;
 	/** Members who have signed in on this site. */
@@ -74,10 +79,10 @@ export async function setupFacts(config: RedeemIDConfig, s: Stores, origin: stri
 	let webhooksMissing: string[] | null = null;
 	if (domain && adminConfigured()) {
 		try {
-			scopes = (await adminScopes(config)).split(",").map((t) => t.trim()).filter(Boolean);
+			scopes = grantedScopes(await adminScopes(config));
 			admin = "ok";
-			const subs = await webhookSubscriptions(config);
-			webhooksMissing = WEBHOOK_TOPICS.filter((t) => !subs.some((h) => h.topic === t && h.uri === `${origin}${WEBHOOK}`));
+			const [subs, heard] = await Promise.all([webhookSubscriptions(config), heardTopics(s)]);
+			webhooksMissing = WEBHOOK_TOPICS.filter((t) => !subs.some((h) => h.topic === t && h.uri === `${origin}${WEBHOOK}`) && !heard.has(topicName(t)));
 		} catch (e) {
 			admin = (e as Error).message || "failed";
 		}
@@ -106,6 +111,16 @@ export async function setupFacts(config: RedeemIDConfig, s: Stores, origin: stri
 	};
 }
 
+/** Topics of the latest deliveries, as Shopify names them (customers/update). */
+async function heardTopics(s: Stores): Promise<Set<string>> {
+	try {
+		const { items } = await s.deliveries.query({ orderBy: { receivedAt: "desc" }, limit: 200 });
+		return new Set(items.map((r) => r.data.topic.trim().toLowerCase()));
+	} catch {
+		return new Set();
+	}
+}
+
 const missingScopes = (f: SetupFacts) => SETUP_SCOPES.filter((sc) => !f.scopes.includes(sc));
 
 /** The steps and where each one stands. Pure. */
@@ -201,7 +216,11 @@ function stepBlocks(step: Step, f: SetupFacts): unknown[] {
 			const missing = f.webhooksMissing ?? [];
 			return [
 				...out,
-				{ type: "section", text: `${missing.length} of ${WEBHOOK_TOPICS.length} topics aren't sent to this site yet. RedeemID can register them through the app.` },
+				{ type: "section", text: `${missing.length} of ${WEBHOOK_TOPICS.length} topics aren't sent to this site yet: ${missing.map(topicName).join(", ")}. RedeemID can register them through the app.` },
+				{
+					type: "context",
+					text: "Webhooks set in the app's own configuration (Dev Dashboard version or shopify.app.toml) don't show in the Admin API. Each of those topics counts here once Shopify has sent one, so registering them again isn't needed.",
+				},
 				{ type: "actions", elements: [{ type: "button", action_id: "setup_register", label: `Register ${missing.length} webhooks`, style: "primary" }] },
 				{
 					type: "context",

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.28";
+export const VERSION = "0.0.29";