@redeemid/emdash 0.0.6 → 0.0.7

package/README.md

@@ -2,7 +2,7 @@
 
 Shopify customer accounts, member levels and paywalls for [EmDash](https://github.com/emdash-cms/emdash) sites. Shopify runs the store and the customer account; EmDash runs the content.
 
-**Status: 0.0.6, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout are covered by an end-to-end test against a fake store.
+**Status: 0.0.7, early.** Runs on Node and Cloudflare Workers. Sign-in, the member mirror, webhooks, levels, rules, the meter and drip, teasers, badges, the page gate, the Shopify cart and checkout are covered by an end-to-end test against a fake store.
 
 ## What it does
 
@@ -13,6 +13,7 @@ Shopify customer accounts, member levels and paywalls for [EmDash](https://githu
 - **Meter and drip.** Signed-in readers may open a few locked entries free each month or week. A rule can also drip: members read its entries once they've held their level for so many days.
 - **Teasers and badges.** Locked entries can show their first paragraphs, up to a word count. `<AccessBadge>` names the level an entry needs and shows a lock to readers it keeps out.
 - **Plans, cart and checkout.** `<Plan>` shows a Shopify product's price and adds it to the visitor's Shopify cart; `<Cart>` shows the count and opens Shopify checkout.
+- **Member account card.** `<MemberCard>` shows members their levels with when each started, the levels they held before, the meter, and Refresh membership, which reads their tags from the store again.
 - **Account.** Members get an Account link to their Shopify customer account (orders, profile, addresses) and Sign out, which also ends the Shopify session.
 - **Paywall break block.** Editors write one body and drop a "Paywall break" block where members-only content starts, picking which levels may read on, or leaving it to the entry's rule. `<Content>` renders the body and leaves the rest off the page for everyone else.
 - **Members only block.** For a members part in the middle of a body: "Members only" (pick the levels) and "Members only: end". Everyone else sees the wall in its place and reads on after it.
@@ -154,13 +155,15 @@ import Cart from "@redeemid/emdash/components/Cart.astro";
 <Cart />
 ```
 
-Sell a plan. `<Plan>` shows a Shopify product's title and price with a button that adds it to the visitor's Shopify cart and opens checkout (signed-in members check out with their email). Shopify Flow or an app tags the customer after the order, and access follows that tag:
+For an account page, `<MemberCard />` shows the member's levels (with when each started), levels they held before, how much of the meter they've used, and links to their store account, Refresh membership and Sign out. Visitors get a sign-in link. Refresh membership (`refreshUrl(returnTo)` in `@redeemid/emdash/access`) sends the member to the store with no sign-in form; a member still signed in there comes straight back with their tags read again and the `refreshed` notice, and anyone else goes through the usual sign-in. Use it after a purchase, when Shopify's tag webhook hasn't arrived yet.
+
+Sell a plan. `<Plan>` shows a Shopify product's title and price with a button that adds it to the visitor's Shopify cart and opens checkout (signed-in members check out with their email). Shopify Flow or an app tags the customer after the order, and access follows that tag. With `levels`, members who already hold one of them see "You're on this plan." (`heldLabel`) in place of the button; the Plan block has the same choice:
 
 ```astro
 ---
 import Plan from "@redeemid/emdash/components/Plan.astro";
 ---
-<Plan handle="gold-membership" label="Join Gold">
+<Plan handle="gold-membership" label="Join Gold" levels={["gold"]}>
 	<p>Shown if the product can't be loaded.</p>
 </Plan>
 ```

package/docs/shopify-setup.md

@@ -53,4 +53,4 @@ The Workers free plan is enough: RedeemID is a native plugin and doesn't need sa
 3. Click **Sign in**, sign in with that customer's email, and you come back to the post, unlocked.
 4. Add or remove the tag in Shopify; the post opens or locks again once the webhook arrives.
 
-If sign-in sends you back with `?redeemid_notice=…`, the code says why: `not_configured` (secrets or `shop` missing), `sign_in_unavailable` (store discovery failed), `sign_in_expired`, `staff_account`, `site_not_ready`, `email_required`, `token_failed`, `bad_id_token`, `identity_failed`. A Buy button can return `plan_unavailable` (no such product, or sold out) or `checkout_failed`. The Cart link returns `cart_empty` when there's nothing in the cart, and Account returns `account_unavailable` when store discovery fails.
+If sign-in sends you back with `?redeemid_notice=…`, the code says why: `not_configured` (secrets or `shop` missing), `sign_in_unavailable` (store discovery failed), `sign_in_expired`, `staff_account`, `site_not_ready`, `email_required`, `token_failed`, `bad_id_token`, `identity_failed`. A Buy button can return `plan_unavailable` (no such product, or sold out) or `checkout_failed`. The Cart link returns `cart_empty` when there's nothing in the cart, and Account returns `account_unavailable` when store discovery fails. Refresh membership returns `refreshed` once it has read the member's tags again.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@redeemid/emdash",
-	"version": "0.0.6",
+	"version": "0.0.7",
 	"description": "Shopify customer accounts, member levels and paywalls for EmDash sites. Shopify runs commerce; EmDash runs content.",
 	"type": "module",
 	"license": "MIT",

package/src/access.ts

@@ -187,6 +187,61 @@ export function memberSince(member: MemberRecord, levels: LevelConfig[] = []): s
 	return starts[0] ?? member.linkedAt ?? null;
 }
 
+export interface HeldLevel {
+	slug: string;
+	name: string;
+	/** When the level started (see memberSince), ISO, or null when unknown. */
+	since: string | null;
+}
+
+export interface PastLevel {
+	slug: string;
+	name: string;
+	from: string | null;
+	to: string;
+}
+
+/**
+ * The member's levels now (with when each started) and the levels they held
+ * before (from the tags Shopify has since removed), newest first.
+ */
+export function membership(member: MemberRecord, levels: LevelConfig[] = []): { current: HeldLevel[]; past: PastLevel[] } {
+	const held = levelsFor(member.tags, levels);
+	const current = held.map((slug) => {
+		const level = levels.find((l) => l.slug === slug)!;
+		return { slug, name: level.name, since: memberSince({ ...member, linkedAt: null }, [level]) };
+	});
+	const pastTags = member.pastTags ?? [];
+	const past: PastLevel[] = [];
+	for (const level of levels) {
+		if (held.includes(level.slug)) continue;
+		const wanted = new Set(level.tags.map((t) => t.toLowerCase()));
+		const spans = pastTags.filter((p) => wanted.has(p.tag));
+		if (spans.length === 0) continue;
+		const froms = spans.map((p) => p.from).filter((d): d is string => Boolean(d)).sort();
+		const to = spans.map((p) => p.to).sort().at(-1)!;
+		past.push({ slug: level.slug, name: level.name, from: froms[0] ?? null, to });
+	}
+	past.sort((a, b) => (a.to < b.to ? 1 : a.to > b.to ? -1 : 0));
+	return { current, past };
+}
+
+/** How much of this period's meter the signed-in reader has used, or null when no meter runs. */
+export async function meterUsage(astro: AstroLike): Promise<{ used: number; limit: number; period: "month" | "week" } | null> {
+	const locals = astro.locals as Locals;
+	const meter = siteConfig(locals.emdash?.config)?.meter;
+	const user = locals.user;
+	const db = locals.emdash?.db;
+	if (!meter || !(meter.limit > 0) || !user?.id || !db) return null;
+	const period = meter.period ?? "month";
+	try {
+		const record = await stores(db).meter.get(`${user.id}:${periodKey(new Date(), period)}`);
+		return { used: Math.min(record?.items.length ?? 0, meter.limit), limit: meter.limit, period };
+	} catch {
+		return null;
+	}
+}
+
 /** When drip opens an entry for this member: `since` plus `days`. */
 export function dripOpensAt(since: string | null, days: number): Date | null {
 	if (!since || days <= 0) return null;
@@ -355,6 +410,11 @@ export function accountUrl(returnTo = "/"): string {
 	return `/_emdash/api/auth/redeemid/account?return=${encodeURIComponent(safeReturn(returnTo))}`;
 }
 
+/** Re-read the member's tags from the store without a sign-in form when their store session is still open. */
+export function refreshUrl(returnTo = "/"): string {
+	return `/_emdash/api/auth/redeemid/login?refresh=1&return=${encodeURIComponent(safeReturn(returnTo))}`;
+}
+
 export function signOutUrl(returnTo = "/"): string {
 	return `/_emdash/api/auth/redeemid/logout?return=${encodeURIComponent(safeReturn(returnTo))}`;
 }

package/src/blocks/PlanBlock.astro

@@ -3,11 +3,11 @@
 import Plan from "../components/Plan.astro";
 
 interface Props {
-	node: { handle?: string; title?: string; label?: string };
+	node: { handle?: string; title?: string; label?: string; levels?: string[] };
 }
 
 const { node } = Astro.props;
 const handle = (node.handle ?? "").trim();
 ---
 
-{handle && <Plan handle={handle} title={node.title?.trim() || undefined} label={node.label?.trim() || "Join"} />}
+{handle && <Plan handle={handle} title={node.title?.trim() || undefined} label={node.label?.trim() || "Join"} levels={Array.isArray(node.levels) ? node.levels : []} />}

package/src/components/MemberCard.astro

@@ -0,0 +1,95 @@
+---
+/**
+ * The member's own account card, for an account page: their levels with
+ * when each started, levels they held before, the meter, and links to the
+ * store account, Refresh membership and Sign out. Visitors get a sign-in link.
+ *
+ *   <MemberCard />
+ *
+ * Everything shown comes from the mirrored Shopify customer; Refresh
+ * membership reads it from the store again.
+ */
+import { accountUrl, membership, meterUsage, refreshUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+import { siteConfig } from "../site-config.js";
+
+interface Props {
+	/** Heading text; the member's first name is added after it. */
+	title?: string;
+}
+
+const { title = "Your membership" } = Astro.props;
+const v = await viewer(Astro);
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const here = Astro.url.pathname + Astro.url.search;
+const m = v.member;
+const disabled = m?.status === "disabled";
+const { current, past } = m && !disabled ? membership(m, config?.levels) : { current: [], past: [] };
+const meter = v.signedIn ? await meterUsage(Astro) : null;
+const date = (iso: string | null) => {
+	if (!iso) return null;
+	const t = Date.parse(iso);
+	return Number.isNaN(t) ? null : new Intl.DateTimeFormat("en-US", { dateStyle: "long", timeZone: "UTC" }).format(new Date(t));
+};
+const name = [m?.firstName, m?.lastName].filter(Boolean).join(" ");
+const join = config?.join;
+---
+
+<section class="redeemid-member" data-redeemid-signed-in={v.signedIn ? "true" : "false"}>
+	{v.signedIn ? (
+		<>
+			<h2 class="redeemid-member__title">{title}</h2>
+			{(name || m?.email) && (
+				<p class="redeemid-member__who">
+					{name && <strong>{name}</strong>}
+					{m?.email && <span>{m.email}</span>}
+				</p>
+			)}
+			{disabled ? (
+				<p class="redeemid-member__disabled">Your account is turned off. Contact the store for help.</p>
+			) : current.length > 0 ? (
+				<ul class="redeemid-member__levels">
+					{current.map((l) => (
+						<li data-redeemid-level={l.slug}>
+							<strong>{l.name}</strong>
+							{date(l.since) && <> since <time datetime={l.since ?? undefined}>{date(l.since)}</time></>}
+						</li>
+					))}
+				</ul>
+			) : (
+				<p class="redeemid-member__none">
+					You don't have a membership yet.{join && <> <a href={join.href}>{join.label ?? "Become a member"}</a></>}
+				</p>
+			)}
+			{past.length > 0 && (
+				<>
+					<h3 class="redeemid-member__subtitle">Before</h3>
+					<ul class="redeemid-member__past">
+						{past.map((l) => (
+							<li data-redeemid-level={l.slug}>
+								{l.name}
+								{date(l.from) ? `, ${date(l.from)} to ${date(l.to)}` : `, until ${date(l.to)}`}
+							</li>
+						))}
+					</ul>
+				</>
+			)}
+			{meter && current.length === 0 && !disabled && (
+				<p class="redeemid-member__meter" data-redeemid-used={meter.used}>
+					Free reads {meter.period === "week" ? "this week" : "this month"}: {meter.used} of {meter.limit} used.
+				</p>
+			)}
+			<p class="redeemid-member__actions">
+				<a href={accountUrl(here)}>Orders and details</a>
+				<a href={refreshUrl(here)}>Refresh membership</a>
+			</p>
+			<form method="post" action={signOutUrl("/")}>
+				<button type="submit">Sign out</button>
+			</form>
+			<p class="redeemid-member__note">Just bought a plan? It can take a minute to show here. Refresh membership checks again.</p>
+		</>
+	) : (
+		<p>
+			<a href={signInUrl(here)}>{config?.label ?? "Sign in"}</a> to see your membership.
+		</p>
+	)}
+</section>

package/src/components/Notices.astro

@@ -21,6 +21,7 @@ const DEFAULTS: Record<string, string> = {
 	plan_unavailable: "That plan isn't available right now.",
 	checkout_failed: "Checkout didn't open. Try again.",
 	cart_empty: "Your cart is empty.",
+	refreshed: "Your membership is up to date.",
 	account_unavailable: "Your account page isn't available right now. Try again in a few minutes.",
 };
 

package/src/components/Plan.astro

@@ -4,8 +4,12 @@
  * checkout. Prices come from the Storefront API; the default slot shows if
  * the product can't be loaded.
  *
- *   <Plan handle="gold-membership" />
+ *   <Plan handle="gold-membership" levels={["gold"]} />
+ *
+ * With `levels`, members who hold one of them see "You're on this plan"
+ * in place of the button.
  */
+import { viewer } from "../access.js";
 import { siteConfig } from "../site-config.js";
 import { plan as loadPlan, type Plan } from "../storefront.js";
 
@@ -15,9 +19,12 @@ interface Props {
 	label?: string;
 	/** Heading override; defaults to the Shopify product title. */
 	title?: string;
+	/** The levels this plan gives. Members holding one see `heldLabel`, not the button. */
+	levels?: string[];
+	heldLabel?: string;
 }
 
-const { handle, label = "Join", title } = Astro.props;
+const { handle, label = "Join", title, levels = [], heldLabel = "You're on this plan." } = Astro.props;
 const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
 let p: Plan | null = null;
 if (config) {
@@ -31,14 +38,17 @@ const price = p?.price
 	? new Intl.NumberFormat("en-US", { style: "currency", currency: p.price.currencyCode }).format(Number(p.price.amount))
 	: null;
 const here = Astro.url.pathname + Astro.url.search;
+const held = levels.length > 0 && (await viewer(Astro)).levels.some((l) => levels.includes(l));
 ---
 
 {p ? (
-	<div class="redeemid-plan" data-redeemid-plan={p.handle}>
+	<div class:list={["redeemid-plan", { "is-held": held }]} data-redeemid-plan={p.handle}>
 		<h2 class="redeemid-plan__title">{title ?? p.title}</h2>
 		{price && <p class="redeemid-plan__price">{price}</p>}
 		{p.description && <p class="redeemid-plan__description">{p.description}</p>}
-		{p.availableForSale ? (
+		{held ? (
+			<p class="redeemid-plan__held">{heldLabel}</p>
+		) : p.availableForSale ? (
 			<form method="post" action="/_emdash/api/auth/redeemid/buy">
 				<input type="hidden" name="plan" value={p.handle} />
 				<input type="hidden" name="return" value={here} />

package/src/plugin.ts

@@ -89,6 +89,12 @@ function blocks(config: RedeemIDConfig) {
 				{ type: "text_input" as const, action_id: "handle", label: "Shopify product handle", placeholder: "gold-membership" },
 				{ type: "text_input" as const, action_id: "title", label: "Title (optional, Shopify's title otherwise)" },
 				{ type: "text_input" as const, action_id: "label", label: "Button label", placeholder: "Join" },
+				{
+					type: "checkbox" as const,
+					action_id: "levels",
+					label: "Levels this plan gives (members on them see \"You're on this plan\")",
+					options: (config.levels ?? []).map((l) => ({ label: l.name, value: l.slug })),
+				},
 			],
 		},
 	];

package/src/routes/callback.ts

@@ -33,7 +33,11 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	const clientId = env(ENV.clientId);
 	if (!config || !storeDomain(config) || !clientId || !emdash?.db || !session) return fail(redirect, returnTo, "not_configured");
 
-	if (url.searchParams.get("error")) return fail(redirect, returnTo, "sign_in_cancelled");
+	if (url.searchParams.get("error")) {
+		// Refresh found no open store session: sign in as usual.
+		if (flow?.refresh) return redirect(`/_emdash/api/auth/redeemid/login?return=${encodeURIComponent(returnTo)}`);
+		return fail(redirect, returnTo, "sign_in_cancelled");
+	}
 
 	const state = url.searchParams.get("state");
 	const code = url.searchParams.get("code");
@@ -105,7 +109,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);
-		return redirect(returnTo);
+		return flow.refresh ? fail(redirect, returnTo, "refreshed") : redirect(returnTo);
 	} catch (e) {
 		const code = e instanceof ShopifyError ? e.code : e instanceof OAuthError ? "signup_not_allowed" : "sign_in_failed";
 		console.error("[redeemid] sign-in failed:", (e as Error).message);

package/src/routes/login.ts

@@ -2,6 +2,9 @@
  * GET /_emdash/api/auth/redeemid/login?return=/path
  *
  * Starts Shopify customer account sign-in (authorization code + PKCE).
+ * With `refresh=1` it asks the store not to show a form (`prompt=none`):
+ * a member whose store session is still open comes straight back with their
+ * tags read again; anyone else is sent through the usual sign-in.
  */
 
 import type { APIRoute } from "astro";
@@ -16,6 +19,7 @@ export const prerender = false;
 export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 	const url = new URL(request.url);
 	const returnTo = safeReturn(url.searchParams.get("return"));
+	const refresh = url.searchParams.get("refresh") === "1";
 	const emdash = (locals as { emdash?: { config?: unknown } }).emdash;
 	const config = readConfig(emdash?.config);
 	const clientId = env(ENV.clientId);
@@ -30,6 +34,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			verifier: randomToken(48),
 			returnTo,
 			at: Date.now(),
+			...(refresh ? { refresh: true } : {}),
 		};
 		session.set(SESSION_FLOW, flow);
 		return redirect(
@@ -40,6 +45,7 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 				nonce: flow.nonce,
 				challenge: await challengeFor(flow.verifier),
 				locale: request.headers.get("accept-language")?.split(",")[0]?.trim(),
+				...(refresh ? { prompt: "none" as const } : {}),
 			}),
 		);
 	} catch (e) {

package/src/routes/shared.ts

@@ -11,6 +11,8 @@ export interface Flow {
 	verifier: string;
 	returnTo: string;
 	at: number;
+	/** Started by Refresh membership (prompt=none). */
+	refresh?: boolean;
 }
 
 export const CALLBACK_PATH = "/_emdash/api/auth/redeemid/callback";

package/src/shopify.ts

@@ -97,7 +97,16 @@ export function base64url(bytes: Uint8Array): string {
 
 export function authorizeUrl(
 	d: Discovery,
-	args: { clientId: string; redirectUri: string; state: string; nonce: string; challenge: string; locale?: string },
+	args: {
+		clientId: string;
+		redirectUri: string;
+		state: string;
+		nonce: string;
+		challenge: string;
+		locale?: string;
+		/** "none": no sign-in form; the store answers with an error when the customer isn't signed in there. */
+		prompt?: "none";
+	},
 ): string {
 	const url = new URL(d.authorizationEndpoint);
 	url.searchParams.set("scope", SCOPES);
@@ -109,6 +118,7 @@ export function authorizeUrl(
 	url.searchParams.set("code_challenge", args.challenge);
 	url.searchParams.set("code_challenge_method", "S256");
 	if (args.locale) url.searchParams.set("ui_locales", args.locale);
+	if (args.prompt) url.searchParams.set("prompt", args.prompt);
 	return url.toString();
 }
 

package/src/storage.ts

@@ -35,8 +35,19 @@ export interface MemberRecord {
 	tagsSince?: Record<string, string>;
 	/** When the customer first signed in here, ISO. */
 	linkedAt?: string | null;
+	/** Tags Shopify has removed, with when each was held (newest last, at most 50). */
+	pastTags?: PastTag[];
 }
 
+/** A tag the customer held from `from` (when known) until `to`. */
+export interface PastTag {
+	tag: string;
+	from: string | null;
+	to: string;
+}
+
+const PAST_TAGS_KEPT = 50;
+
 /** A signed-in reader's meter for one period: the locked items they opened free. */
 export interface MeterRecord {
 	userId: string;
@@ -45,11 +56,18 @@ export interface MeterRecord {
 	items: string[];
 }
 
-/** Update `tagsSince` to the record's current tags: new tags start now, removed tags are dropped. */
+/**
+ * Update `tagsSince` to the record's current tags: new tags start now;
+ * removed tags move to `pastTags` with the dates they were held.
+ */
 export function stampTags(m: MemberRecord, now = new Date().toISOString()): MemberRecord {
 	const before = m.tagsSince ?? {};
 	const since: Record<string, string> = {};
 	for (const t of m.tags.map((t) => t.toLowerCase())) since[t] = before[t] ?? now;
+	const removed = Object.keys(before).filter((t) => !(t in since));
+	if (removed.length) {
+		m.pastTags = [...(m.pastTags ?? []), ...removed.map((tag) => ({ tag, from: before[tag] ?? null, to: now }))].slice(-PAST_TAGS_KEPT);
+	}
 	m.tagsSince = since;
 	return m;
 }

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.0.6";
+export const VERSION = "0.0.7";