@redeemid/emdash 0.0.7 → 0.0.9

package/src/components/Contribution.astro

@@ -0,0 +1,74 @@
+---
+/**
+ * Pay what you want: the reader picks an amount and checks out. Set up a
+ * Shopify product priced at 1.00 (one unit of the currency); the amount
+ * becomes the line's quantity, so Shopify charges exactly what they chose.
+ * With another price the field asks for a quantity instead.
+ *
+ *   <Contribution handle="support-the-newsroom" amounts={[5, 10, 25]} />
+ */
+import { siteConfig } from "../site-config.js";
+import { money, product as loadProduct, type Product } from "../storefront.js";
+
+interface Props {
+	handle: string;
+	/** Suggested amounts, as buttons. */
+	amounts?: number[];
+	/** The amount filled in to start with. */
+	initial?: number;
+	label?: string;
+	title?: string;
+}
+
+const { handle, amounts = [5, 10, 25], initial = 10, label = "Give", title } = Astro.props;
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+let p: Product | null = null;
+if (config) {
+	try {
+		p = await loadProduct(config, handle);
+	} catch {
+		p = null;
+	}
+}
+const variant = p?.variants.find((v) => v.availableForSale);
+const unit = variant ? Number(variant.price.amount) === 1 : false;
+const currency = variant?.price.currencyCode ?? "USD";
+const symbol = new Intl.NumberFormat("en-US", { style: "currency", currency }).formatToParts(0).find((x) => x.type === "currency")?.value ?? "";
+const here = Astro.url.pathname + Astro.url.search;
+const id = `redeemid-give-${handle}`;
+---
+
+{p && variant ? (
+	<form class="redeemid-contribution" method="post" action="/_emdash/api/auth/redeemid/cart-edit" data-redeemid-product={p.handle}>
+		<h2 class="redeemid-contribution__title">{title ?? p.title}</h2>
+		{p.description && <p>{p.description}</p>}
+		<input type="hidden" name="action" value="add" />
+		<input type="hidden" name="product" value={p.handle} />
+		<input type="hidden" name="variant" value={variant.id} />
+		<input type="hidden" name="return" value={here} />
+		<input type="hidden" name="then" value="checkout" />
+		{unit ? (
+			<>
+				{amounts.length > 0 && (
+					<p class="redeemid-contribution__amounts">
+						{amounts.map((a) => (
+							<button type="submit" name="quantity" value={String(a)}>{symbol}{a}</button>
+						))}
+					</p>
+				)}
+				<p>
+					<label for={`${id}-amount`}>Another amount ({currency})</label>
+					<input id={`${id}-amount`} name="quantity" type="number" min="1" max="1000" step="1" value={initial} inputmode="numeric" />
+				</p>
+			</>
+		) : (
+			<p>
+				<label for={`${id}-amount`}>Quantity ({money(variant.price)} each)</label>
+				<input id={`${id}-amount`} name="quantity" type="number" min="1" max="1000" value="1" inputmode="numeric" />
+			</p>
+		)}
+		<button type="submit">{label}</button>
+	</form>
+) : (
+	<slot />
+)}

package/src/components/Feature.astro

@@ -0,0 +1,20 @@
+---
+/**
+ * Shows its default slot only to members who hold the feature (see config
+ * `features`), and the "else" slot to everyone else.
+ *
+ *   <Feature slug="supporter">
+ *     <p>Thanks for supporting us.</p>
+ *     <a slot="else" href="/support/">Support us</a>
+ *   </Feature>
+ */
+import { hasFeature } from "../features.js";
+
+interface Props {
+	slug: string;
+}
+
+const held = await hasFeature(Astro, Astro.props.slug);
+---
+
+{held ? <slot /> : <slot name="else" />}

package/src/components/MemberCard.astro

@@ -10,6 +10,7 @@
  * membership reads it from the store again.
  */
 import { accountUrl, membership, meterUsage, refreshUrl, signInUrl, signOutUrl, viewer } from "../access.js";
+import { featuresFor } from "../features.js";
 import { siteConfig } from "../site-config.js";
 
 interface Props {
@@ -25,6 +26,8 @@ const m = v.member;
 const disabled = m?.status === "disabled";
 const { current, past } = m && !disabled ? membership(m, config?.levels) : { current: [], past: [] };
 const meter = v.signedIn ? await meterUsage(Astro) : null;
+const held = m ? featuresFor(m, config?.features, config?.levels) : [];
+const features = (config?.features ?? []).filter((f) => held.includes(f.slug));
 const date = (iso: string | null) => {
 	if (!iso) return null;
 	const t = Date.parse(iso);
@@ -60,6 +63,11 @@ const join = config?.join;
 					You don't have a membership yet.{join && <> <a href={join.href}>{join.label ?? "Become a member"}</a></>}
 				</p>
 			)}
+			{features.length > 0 && (
+				<p class="redeemid-member__features">
+					Includes: {features.map((f) => f.name).join(", ")}
+				</p>
+			)}
 			{past.length > 0 && (
 				<>
 					<h3 class="redeemid-member__subtitle">Before</h3>

package/src/components/Notices.astro

@@ -21,6 +21,10 @@ const DEFAULTS: Record<string, string> = {
 	plan_unavailable: "That plan isn't available right now.",
 	checkout_failed: "Checkout didn't open. Try again.",
 	cart_empty: "Your cart is empty.",
+	cart_added: "Added to your cart.",
+	cart_updated: "Your cart is updated.",
+	discount_applied: "Discount applied.",
+	discount_not_applicable: "That discount code doesn't apply to this cart.",
 	refreshed: "Your membership is up to date.",
 	account_unavailable: "Your account page isn't available right now. Try again in a few minutes.",
 };

package/src/components/Product.astro

@@ -0,0 +1,78 @@
+---
+/**
+ * A Shopify product: image, title, price, description, a variant choice
+ * when it has several, a quantity, and "Add to cart" and "Buy now".
+ * Everything comes from the Storefront API; the default slot shows if the
+ * product can't be loaded.
+ *
+ *   <Product handle="harbor-tote" />
+ */
+import { siteConfig } from "../site-config.js";
+import { money, product as loadProduct, type Product } from "../storefront.js";
+
+interface Props {
+	handle: string;
+	/** Heading level for the title. */
+	heading?: "h1" | "h2" | "h3";
+	/** Leave out the description (for cards). */
+	compact?: boolean;
+	addLabel?: string;
+	buyLabel?: string;
+}
+
+const { handle, heading = "h2", compact = false, addLabel = "Add to cart", buyLabel = "Buy now" } = Astro.props;
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+let p: Product | null = null;
+if (config) {
+	try {
+		p = await loadProduct(config, handle);
+	} catch {
+		p = null;
+	}
+}
+const available = p?.variants.filter((v) => v.availableForSale) ?? [];
+const first = available[0] ?? p?.variants[0];
+const here = Astro.url.pathname + Astro.url.search;
+const Heading = heading;
+const id = `redeemid-product-${handle}`;
+---
+
+{p ? (
+	<div class="redeemid-product" data-redeemid-product={p.handle}>
+		{p.image && <img class="redeemid-product__image" src={p.image.url} alt={p.image.altText ?? ""} loading="lazy" />}
+		<Heading class="redeemid-product__title">{p.title}</Heading>
+		{first && <p class="redeemid-product__price">{money(first.price)}</p>}
+		{!compact && p.description && <p class="redeemid-product__description">{p.description}</p>}
+		{available.length > 0 ? (
+			<form method="post" action="/_emdash/api/auth/redeemid/cart-edit">
+				<input type="hidden" name="action" value="add" />
+				<input type="hidden" name="product" value={p.handle} />
+				<input type="hidden" name="return" value={here} />
+				{p.variants.length > 1 ? (
+					<p>
+						<label for={`${id}-variant`}>Option</label>
+						<select id={`${id}-variant`} name="variant">
+							{p.variants.map((v) => (
+								<option value={v.id} disabled={!v.availableForSale}>
+									{v.title} ({money(v.price)}){!v.availableForSale && " sold out"}
+								</option>
+							))}
+						</select>
+					</p>
+				) : (
+					<input type="hidden" name="variant" value={first?.id} />
+				)}
+				<p>
+					<label for={`${id}-quantity`}>Quantity</label>
+					<input id={`${id}-quantity`} name="quantity" type="number" min="1" max="1000" value="1" inputmode="numeric" />
+				</p>
+				<button type="submit" name="then" value="back">{addLabel}</button>
+				<button type="submit" name="then" value="checkout">{buyLabel}</button>
+			</form>
+		) : (
+			<p class="redeemid-product__unavailable">Sold out.</p>
+		)}
+	</div>
+) : (
+	<slot />
+)}

package/src/config.ts

@@ -63,6 +63,21 @@ export interface RuleConfig {
  * free each month (or week). Guests get the wall; an entry counts once per
  * period, when its own page renders through <Content> with an `id`.
  */
+/** A perk members hold through any of its levels or Shopify tags. */
+export interface FeatureConfig {
+	slug: string;
+	name: string;
+	levels?: string[];
+	tags?: string[];
+}
+
+/** Where to send signed member events (see events.ts). The signing secret is REDEEMID_EVENTS_SECRET. */
+export interface EventsConfig {
+	url: string;
+	/** Send only these events. All of them when left out. */
+	only?: Array<"member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted">;
+}
+
 export interface MeterConfig {
 	/** Free entries per period. */
 	limit: number;
@@ -83,6 +98,8 @@ export interface RedeemIDConfig {
 	levels?: LevelConfig[];
 	rules?: RuleConfig[];
 	meter?: MeterConfig;
+	features?: FeatureConfig[];
+	events?: EventsConfig;
 	/** The wall's join link: where readers become members, e.g. { href: "/join/", label: "Become a member" }. */
 	join?: { href: string; label?: string };
 	/**
@@ -123,6 +140,10 @@ export const ENV = {
 	clientSecret: "REDEEMID_SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_SECRET",
 	/** Client secret of the Shopify (Admin API) app whose webhooks the site receives. Shopify signs webhooks with it. */
 	webhookSecret: "REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_SECRET",
+	/** Client ID of that Shopify (Admin API) app. With the secret it lets staff tools call the Admin API (client credentials). */
+	adminClientId: "REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID",
+	/** Secret for signing the outbound events RedeemID sends to `events.url`. */
+	eventsSecret: "REDEEMID_EVENTS_SECRET",
 	/** Storefront API private token, for server-side plan and checkout calls. */
 	storefrontPrivateToken: "REDEEMID_SHOPIFY_STOREFRONT_PRIVATE_TOKEN",
 	/** Storefront API public token, used only when the private token isn't set. */

package/src/descriptor.ts

@@ -11,6 +11,7 @@ import { VERSION } from "./version.js";
 export const PAGES = [
 	{ path: "/", label: "Members", icon: "users" },
 	{ path: "/status", label: "Status", icon: "pulse" },
+	{ path: "/test", label: "Access test", icon: "search" },
 ];
 export const WIDGETS = [{ id: "status", title: "RedeemID", size: "half" as const }];
 

package/src/events.ts

@@ -0,0 +1,74 @@
+/**
+ * Outbound events: RedeemID POSTs JSON to `events.url` when something
+ * happens to a member, signed so the receiver can trust it.
+ *
+ *   events: { url: "https://hooks.example.com/redeemid" }   // + REDEEMID_EVENTS_SECRET
+ *
+ * Headers: X-RedeemID-Event (the name), X-RedeemID-Delivery (a fresh id) and
+ * X-RedeemID-Signature: sha256=<hex HMAC of the raw body>. Events:
+ * member.signed_in, member.levels_changed, meter.used, meter.exhausted.
+ * Sending never blocks or breaks the page: failures are logged and dropped.
+ * No event carries an email address or a name; match people by `customerId`.
+ */
+
+import { env, ENV, type RedeemIDConfig } from "./config.js";
+import { USER_AGENT } from "./shopify.js";
+
+export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted";
+
+const TIMEOUT_MS = 3000;
+
+export async function signBody(body: string, secret: string): Promise<string> {
+	const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+	const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(body)));
+	return [...mac].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+/** Send one event. Returns whether the receiver answered 2xx; never throws. */
+export async function emit(config: RedeemIDConfig | null, name: EventName, data: Record<string, unknown>, fetcher: typeof fetch = fetch): Promise<boolean> {
+	const url = config?.events?.url;
+	const secret = env(ENV.eventsSecret);
+	if (!url || !secret) return false;
+	if (config.events?.only && !config.events.only.includes(name)) return false;
+	const id = crypto.randomUUID();
+	const body = JSON.stringify({ id, event: name, at: new Date().toISOString(), data });
+	try {
+		const res = await fetcher(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"User-Agent": USER_AGENT,
+				"X-RedeemID-Event": name,
+				"X-RedeemID-Delivery": id,
+				"X-RedeemID-Signature": `sha256=${await signBody(body, secret)}`,
+			},
+			body,
+			signal: AbortSignal.timeout(TIMEOUT_MS),
+		});
+		return res.ok;
+	} catch (e) {
+		console.error("[redeemid] event not sent:", name, (e as Error).message);
+		return false;
+	}
+}
+
+/** Send member.levels_changed when a mirror write changed the member's levels. */
+export async function levelChange(
+	config: RedeemIDConfig | null,
+	beforeTags: string[] | null,
+	after: { customerId: string; tags: string[]; status: string },
+	source: string,
+	fetcher: typeof fetch = fetch,
+): Promise<void> {
+	if (!config?.events?.url) return;
+	const { levelsFor } = await import("./access.js");
+	const was = beforeTags ? levelsFor(beforeTags, config.levels) : [];
+	const now = after.status === "disabled" ? [] : levelsFor(after.tags, config.levels);
+	if (was.length === now.length && was.every((l) => now.includes(l))) return;
+	await emit(
+		config,
+		"member.levels_changed",
+		{ customerId: after.customerId, levels: now, added: now.filter((l) => !was.includes(l)), removed: was.filter((l) => !now.includes(l)), source },
+		fetcher,
+	);
+}

package/src/features.ts

@@ -0,0 +1,39 @@
+/**
+ * Features: named perks a member holds through their levels or their
+ * Shopify tags (an ad-free site, a supporter thank-you, early access).
+ * Like levels they come only from the mirrored tags; nothing here grants
+ * them otherwise.
+ *
+ *   features: [
+ *     { slug: "ad-free", name: "Ad-free", levels: ["gold", "premium"] },
+ *     { slug: "supporter", name: "Supporter", tags: ["supporter"] },
+ *   ]
+ */
+
+import { levelsFor, viewer, type AstroLike } from "./access.js";
+import type { FeatureConfig, LevelConfig } from "./config.js";
+import { siteConfig } from "./site-config.js";
+import type { MemberRecord } from "./storage.js";
+
+/** The feature slugs a member holds: from any of the feature's levels or tags. */
+export function featuresFor(member: Pick<MemberRecord, "tags" | "status"> | null, features: FeatureConfig[] = [], levels: LevelConfig[] = []): string[] {
+	if (!member || member.status === "disabled") return [];
+	const held = levelsFor(member.tags, levels);
+	const tags = new Set(member.tags.map((t) => t.toLowerCase()));
+	return features
+		.filter((f) => (f.levels ?? []).some((l) => held.includes(l)) || (f.tags ?? []).some((t) => tags.has(t.toLowerCase())))
+		.map((f) => f.slug);
+}
+
+/** Does the visitor hold this feature? */
+export async function hasFeature(astro: AstroLike, slug: string): Promise<boolean> {
+	return (await viewerFeatures(astro)).includes(slug);
+}
+
+/** The visitor's features. */
+export async function viewerFeatures(astro: AstroLike): Promise<string[]> {
+	const config = siteConfig((astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+	if (!config?.features?.length) return [];
+	const v = await viewer(astro);
+	return featuresFor(v.member, config.features, config.levels);
+}

package/src/index.ts

@@ -56,6 +56,7 @@ export function redeemid(config: RedeemIDConfig): AuthProviderDescriptor {
 			{ pattern: `${BASE}/webhook`, entrypoint: "@redeemid/emdash/routes/webhook.ts" },
 			{ pattern: `${BASE}/buy`, entrypoint: "@redeemid/emdash/routes/buy.ts" },
 			{ pattern: `${BASE}/cart`, entrypoint: "@redeemid/emdash/routes/cart.ts" },
+			{ pattern: `${BASE}/cart-edit`, entrypoint: "@redeemid/emdash/routes/cart-edit.ts" },
 			{ pattern: `${BASE}/account`, entrypoint: "@redeemid/emdash/routes/account.ts" },
 		],
 		publicRoutes: [`${BASE}/`],

package/src/plugin.ts

@@ -33,10 +33,20 @@ import { discover } from "./shopify.js";
 import { stores, type MemberRecord } from "./storage.js";
 import { PAGES, WIDGETS } from "./descriptor.js";
 import { VERSION } from "./version.js";
+import { adminConfigured } from "./admin-api.js";
+import { accessTest, bulkResync, BULK_BATCH, deliveriesSection, memberDetail, registerWebhooks, resyncOne, tagEdit, webhooksSection } from "./staff.js";
 
-import { MEMBERS_BLOCK, MEMBERS_END_BLOCK, PAYWALL_BLOCK, PLAN_BLOCK } from "./blocks-names.js";
+import {
+	COLLECTION_BLOCK,
+	CONTRIBUTION_BLOCK,
+	MEMBERS_BLOCK,
+	MEMBERS_END_BLOCK,
+	PAYWALL_BLOCK,
+	PLAN_BLOCK,
+	PRODUCT_BLOCK,
+} from "./blocks-names.js";
 
-export { MEMBERS_BLOCK, MEMBERS_END_BLOCK, PAYWALL_BLOCK, PLAN_BLOCK };
+export { COLLECTION_BLOCK, CONTRIBUTION_BLOCK, MEMBERS_BLOCK, MEMBERS_END_BLOCK, PAYWALL_BLOCK, PLAN_BLOCK, PRODUCT_BLOCK };
 
 function blocks(config: RedeemIDConfig) {
 	const levelOptions = [
@@ -97,6 +107,39 @@ function blocks(config: RedeemIDConfig) {
 				},
 			],
 		},
+		{
+			type: PRODUCT_BLOCK,
+			label: "Product",
+			icon: "tag",
+			description: "A Shopify product with Add to cart and Buy now",
+			placeholder: "Shopify product handle",
+			fields: [{ type: "text_input" as const, action_id: "handle", label: "Shopify product handle", placeholder: "harbor-tote" }],
+		},
+		{
+			type: COLLECTION_BLOCK,
+			label: "Collection",
+			icon: "grid",
+			description: "A Shopify collection's products as cards",
+			placeholder: "Shopify collection handle",
+			fields: [
+				{ type: "text_input" as const, action_id: "handle", label: "Shopify collection handle", placeholder: "shop" },
+				{ type: "text_input" as const, action_id: "limit", label: "How many products (up to 50)", placeholder: "12" },
+				{ type: "text_input" as const, action_id: "link", label: "Product page link, with {handle}", placeholder: "/shop/{handle}/" },
+			],
+		},
+		{
+			type: CONTRIBUTION_BLOCK,
+			label: "Contribution",
+			icon: "star",
+			description: "Pay what you want, with a Shopify product priced at 1.00",
+			placeholder: "Shopify product handle",
+			fields: [
+				{ type: "text_input" as const, action_id: "handle", label: "Shopify product handle (priced at 1.00)", placeholder: "support" },
+				{ type: "text_input" as const, action_id: "title", label: "Title (optional, Shopify's title otherwise)" },
+				{ type: "text_input" as const, action_id: "amounts", label: "Suggested amounts, comma separated", placeholder: "5, 10, 25" },
+				{ type: "text_input" as const, action_id: "label", label: "Button label", placeholder: "Give" },
+			],
+		},
 	];
 }
 
@@ -113,11 +156,13 @@ export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
 		routes: {
 			admin: {
 				handler: async (ctx: RouteContext) => {
-					const i = (ctx.input ?? {}) as { type?: string; page?: string };
-					if (i.type !== "page_load") return { blocks: [] };
+					const i = (ctx.input ?? {}) as { type?: string; page?: string; action_id?: string; value?: unknown; values?: Record<string, unknown>; block_id?: string };
 					try {
+						if (i.type === "block_action" || i.type === "form_submit") return await action(config, ctx.request, i);
+						if (i.type !== "page_load") return { blocks: [] };
 						if (i.page === "/") return await membersPage(config);
 						if (i.page === "/status") return await statusPage(config, ctx.request);
+						if (i.page === "/test") return await accessTest(config);
 						if (i.page === "widget:status") return await statusWidget(config);
 					} catch (e) {
 						return { blocks: [{ type: "banner", variant: "error", title: "RedeemID couldn't load this page", description: (e as Error).message }] };
@@ -131,6 +176,75 @@ export function createPlugin(config: RedeemIDConfig = {}): ResolvedPlugin {
 
 export default createPlugin;
 
+// ---------------------------------------------------------------- actions
+
+const webhookUri = (request: Request) => `${new URL(request.url).origin}/_emdash/api/auth/redeemid/webhook`;
+
+async function action(
+	config: RedeemIDConfig,
+	request: Request,
+	i: { action_id?: string; value?: unknown; values?: Record<string, unknown>; block_id?: string },
+) {
+	const s = await memberStores();
+	const fail = (e: unknown) => ({ type: "error" as const, message: (e as Error).message });
+	switch (i.action_id) {
+		case "members_back":
+			return membersPage(config);
+		case "member_open": {
+			const m = await s.members.get(String(i.value ?? ""));
+			return m ? memberDetail(config, m) : { ...(await membersPage(config)), toast: { type: "error", message: "That member is gone." } };
+		}
+		case "member_resync": {
+			const id = String(i.value ?? "");
+			try {
+				const m = await resyncOne(config, s, id, "staff resync");
+				const now = m ?? (await s.members.get(id));
+				if (!now) return membersPage(config);
+				return memberDetail(config, now, m ? { type: "success", message: "Read again from Shopify." } : { type: "error", message: "Shopify no longer has this customer." });
+			} catch (e) {
+				const m = await s.members.get(id);
+				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
+			}
+		}
+		case "member_tag_add":
+		case "member_tag_remove": {
+			const add = i.action_id === "member_tag_add";
+			const v = (i.value ?? {}) as { customerId?: string; tag?: string };
+			const id = add ? String(i.block_id ?? "").replace(/^tags:/, "") : String(v.customerId ?? "");
+			try {
+				const m = await tagEdit(config, s, id, add ? "add" : "remove", add ? i.values?.tags : [v.tag]);
+				const now = m ?? (await s.members.get(id));
+				return now ? memberDetail(config, now, { type: "success", message: add ? "Tags added in Shopify." : "Tag removed in Shopify." }) : membersPage(config);
+			} catch (e) {
+				const m = await s.members.get(id);
+				return m ? memberDetail(config, m, fail(e)) : membersPage(config);
+			}
+		}
+		case "members_resync": {
+			try {
+				const r = await bulkResync(config, s);
+				return {
+					...(await membersPage(config)),
+					toast: { type: "success", message: `Read ${r.done} members again (${r.changed} changed${r.missing ? `, ${r.missing} no longer in Shopify` : ""}).` },
+				};
+			} catch (e) {
+				return { ...(await membersPage(config)), toast: fail(e) };
+			}
+		}
+		case "webhooks_register": {
+			try {
+				const added = await registerWebhooks(config, webhookUri(request));
+				return { ...(await statusPage(config, request)), toast: { type: "success", message: added.length ? `Registered ${added.length} webhooks.` : "Nothing was missing." } };
+			} catch (e) {
+				return { ...(await statusPage(config, request)), toast: fail(e) };
+			}
+		}
+		case "access_test":
+			return accessTest(config, i.values);
+	}
+	return { blocks: [] };
+}
+
 // ---------------------------------------------------------------- pages
 
 async function memberStores() {
@@ -169,6 +283,25 @@ async function membersPage(config: RedeemIDConfig) {
 				type: "context",
 				text: "Shopify customers who have signed in or that Shopify has sent. Levels come only from their Shopify tags; change tags in Shopify (or with Flow) and access follows.",
 			},
+			adminConfigured()
+				? {
+						type: "actions",
+						elements: [
+							{
+								type: "button",
+								action_id: "members_resync",
+								label: `Resync ${BULK_BATCH} from Shopify`,
+								style: "secondary",
+								confirm: {
+									title: "Read members again from Shopify?",
+									text: `Reads the ${BULK_BATCH} members synced longest ago from Shopify and updates their tags. Click again for the next ${BULK_BATCH}.`,
+									confirm: "Resync",
+									deny: "Cancel",
+								},
+							},
+						],
+					}
+				: { type: "context", text: "Set the Admin API app's client ID (REDEEMID_SHOPIFY_ADMIN_APP_CLIENT_ID) to resync members and edit their tags from here." },
 			{
 				type: "stats",
 				items: [
@@ -189,6 +322,7 @@ async function membersPage(config: RedeemIDConfig) {
 							{ key: "tags", label: "Shopify tags" },
 							{ key: "status", label: "Account" },
 							{ key: "synced", label: "Last synced", format: "relative_time" },
+							{ key: "open", label: "", format: "element" },
 						],
 						rows: members
 							.sort((a, b) => b.syncedAt.localeCompare(a.syncedAt))
@@ -199,6 +333,7 @@ async function membersPage(config: RedeemIDConfig) {
 								tags: m.tags.join(", ") || "—",
 								status: m.status === "enabled" ? "On" : "Off",
 								synced: m.syncedAt,
+								open: { type: "button", action_id: "member_open", label: "Open", value: m.customerId },
 							})),
 					},
 		],
@@ -236,6 +371,10 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 	const levels = config.levels ?? [];
 	const rules = config.rules ?? [];
 	const delivery = await lastDelivery().catch(() => null);
+	const webhooks = await webhooksSection(config, webhookUri(request));
+	const deliveries = await memberStores()
+		.then((s) => deliveriesSection(s))
+		.catch(() => [{ type: "context", text: "Couldn't read deliveries." }]);
 	return {
 		blocks: [
 			{ type: "header", text: "Status" },
@@ -249,11 +388,18 @@ async function statusPage(config: RedeemIDConfig, request: Request) {
 					{ label: "Store discovery", value: c.discovery },
 					{ label: "Customer Account API client ID", value: yes(c.clientId) },
 					{ label: "Webhook signing secret", value: yes(c.webhookSecret) },
+					{ label: "Admin API app client ID (staff tools)", value: yes(Boolean(env(ENV.adminClientId))) },
+					{ label: "Events", value: config.events?.url ? `${config.events.url}${env(ENV.eventsSecret) ? "" : " (REDEEMID_EVENTS_SECRET missing)"}` : "Off" },
 					{ label: "Storefront API access", value: c.storefront },
 					{ label: "Last webhook", value: delivery ?? "None received yet" },
 				],
 			},
 			{ type: "divider" },
+			{ type: "header", text: "Webhooks" },
+			...webhooks,
+			{ type: "header", text: "Recent deliveries" },
+			...deliveries,
+			{ type: "divider" },
 			{ type: "header", text: "Shopify settings" },
 			{
 				type: "fields",

package/src/routes/buy.ts

@@ -39,7 +39,7 @@ export const POST: APIRoute = async ({ request, locals, session, redirect }) =>
 			config,
 			current?.id ?? null,
 			{ variantId: p.variantId, sellingPlanId: p.sellingPlanId },
-			{ email: member?.email ?? null, buyerIp: request.headers.get("cf-connecting-ip") },
+			{ email: member?.email ?? null, attributes: { _redeemid_page: returnTo }, buyerIp: request.headers.get("cf-connecting-ip") },
 		);
 		saveCart(session, { id: cart.id, count: cart.totalQuantity });
 		return redirect(cart.checkoutUrl, 303);

package/src/routes/callback.ts

@@ -16,6 +16,8 @@ import { OptionsRepository } from "emdash/api/route-utils";
 import type { Kysely } from "kysely";
 
 import { env, ENV, PROVIDER_ID, readConfig, storeDomain } from "../config.js";
+import { emit, levelChange } from "../events.js";
+import { levelsFor } from "../access.js";
 import { discover, exchangeCode, identity, ShopifyError, verifyIdToken } from "../shopify.js";
 import { emptyMember, stampTags, stores } from "../storage.js";
 import { callbackUrl, fail, FLOW_TTL_MS, SESSION_FLOW, SESSION_ID_TOKEN, type Flow } from "./shared.js";
@@ -86,7 +88,8 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 		if (user.role > Role.SUBSCRIBER) return fail(redirect, returnTo, "staff_account");
 
 		const s = stores(emdash.db);
-		const member = (await s.members.get(who.customerId)) ?? emptyMember(who.customerId);
+		const found = await s.members.get(who.customerId);
+		const member = found ?? emptyMember(who.customerId);
 		const now = new Date().toISOString();
 		await s.members.put(
 			who.customerId,
@@ -106,6 +109,10 @@ export const GET: APIRoute = async ({ request, locals, session, redirect }) => {
 			),
 		);
 
+		const levels = levelsFor(who.tags, config.levels);
+		await emit(config, "member.signed_in", { customerId: who.customerId, levels, first: !member.linkedAt, refresh: Boolean(flow.refresh) });
+		await levelChange(config, found ? found.tags : null, { customerId: who.customerId, tags: who.tags, status: member.status }, "sign-in");
+
 		session.regenerate?.();
 		session.set("user", { id: user.id });
 		session.set(SESSION_ID_TOKEN, tokens.idToken);