@redeemid/emdash 0.0.9 → 0.0.11

package/src/components/Preferences.astro

@@ -0,0 +1,102 @@
+---
+/**
+ * The member's preferences form: every field in `preferences`, read from
+ * their Shopify customer, with a control for each type. Fields set to "view"
+ * are shown, not editable. Works without JavaScript: it posts to the
+ * preferences route and comes back with a notice. Visitors and sites without
+ * preferences get nothing (or the "signed-out" slot).
+ *
+ *   <Preferences title="Your preferences" />
+ */
+import { viewer } from "../access.js";
+import { preferencesConfigured, readPreferences, type PreferenceField } from "../preferences.js";
+import { siteConfig } from "../site-config.js";
+import { text } from "../text.js";
+
+interface Props {
+	title?: string;
+	/** Heading level for the title. */
+	heading?: "h2" | "h3" | "h4";
+	label?: string;
+}
+
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const { title = text(config, "Your preferences"), heading = "h2", label = text(config, "Save preferences") } = Astro.props;
+const v = await viewer(Astro);
+const m = v.member;
+let fields: PreferenceField[] = [];
+let failed = false;
+if (config && preferencesConfigured(config) && m && m.status !== "disabled") {
+	try {
+		fields = await readPreferences(config, m.customerId);
+	} catch (e) {
+		failed = true;
+		console.error("[redeemid] preferences not read:", (e as Error).message);
+	}
+}
+const here = Astro.url.pathname + Astro.url.search.replace(/[?&]redeemid_notice=[^&]*/, "").replace(/^&/, "?");
+const H = heading;
+const id = (key: string) => `redeemid-pref-${key.replace(/[^\w-]/g, "-")}`;
+const show = (f: PreferenceField) =>
+	f.value === null || (Array.isArray(f.value) && f.value.length === 0) ? text(config, "Not set") : Array.isArray(f.value) ? f.value.join(", ") : f.type === "boolean" ? text(config, f.value ? "Yes" : "No") : String(f.value);
+const editable = fields.filter((f) => f.editable);
+---
+
+{v.signedIn && (fields.length > 0 || failed) ? (
+	<section class="redeemid-preferences">
+		<H class="redeemid-preferences__title">{title}</H>
+		{failed ? (
+			<p>{text(config, "Your preferences can't be loaded right now. Try again in a few minutes.")}</p>
+		) : (
+			<form method="post" action="/_emdash/api/auth/redeemid/preferences">
+				<input type="hidden" name="return" value={here} />
+				{fields.map((f) => (
+					<div class="redeemid-preferences__field" data-redeemid-pref={f.key}>
+						{f.editable && <input type="hidden" name={`present:${f.key}`} value="1" />}
+						{!f.editable ? (
+							<p>
+								<strong>{f.name}:</strong> {show(f)}
+							</p>
+						) : f.type === "boolean" ? (
+							<label>
+								<input type="checkbox" name={`pref:${f.key}`} value="true" checked={f.value === true} /> {f.name}
+							</label>
+						) : f.type === "list.single_line_text_field" && f.choices ? (
+							<fieldset>
+								<legend>{f.name}</legend>
+								{f.choices.map((c) => (
+									<label>
+										<input type="checkbox" name={`pref:${f.key}`} value={c} checked={Array.isArray(f.value) && f.value.includes(c)} /> {c}
+									</label>
+								))}
+							</fieldset>
+						) : (
+							<>
+								<label for={id(f.key)}>{f.name}</label>
+								{f.choices ? (
+									<select id={id(f.key)} name={`pref:${f.key}`}>
+										<option value="">{text(config, "Not set")}</option>
+										{f.choices.map((c) => <option value={c} selected={f.value === c}>{c}</option>)}
+									</select>
+								) : f.type === "multi_line_text_field" || f.type === "list.single_line_text_field" ? (
+									<textarea id={id(f.key)} name={`pref:${f.key}`} rows="3" maxlength={f.max && f.type === "multi_line_text_field" ? Number(f.max) : undefined}>{Array.isArray(f.value) ? f.value.join("\n") : (f.value ?? "")}</textarea>
+								) : f.type === "number_integer" || f.type === "number_decimal" ? (
+									<input id={id(f.key)} type="number" name={`pref:${f.key}`} step={f.type === "number_integer" ? "1" : "any"} min={f.min ?? undefined} max={f.max ?? undefined} value={f.value === null ? "" : String(f.value)} />
+								) : f.type === "date" ? (
+									<input id={id(f.key)} type="date" name={`pref:${f.key}`} min={f.min?.slice(0, 10)} max={f.max?.slice(0, 10)} value={typeof f.value === "string" ? f.value : ""} />
+								) : (
+									<input id={id(f.key)} type="text" name={`pref:${f.key}`} maxlength={f.max ? Number(f.max) : undefined} value={typeof f.value === "string" ? f.value : ""} />
+								)}
+								{f.type === "list.single_line_text_field" && !f.choices && <small>{text(config, "One per line.")}</small>}
+							</>
+						)}
+						{f.description && f.editable && <small class="redeemid-preferences__help">{f.description}</small>}
+					</div>
+				))}
+				{editable.length > 0 && <button type="submit">{label}</button>}
+			</form>
+		)}
+	</section>
+) : (
+	!v.signedIn && <slot name="signed-out" />
+)}

package/src/components/Product.astro

@@ -9,6 +9,7 @@
  */
 import { siteConfig } from "../site-config.js";
 import { money, product as loadProduct, type Product } from "../storefront.js";
+import { text } from "../text.js";
 
 interface Props {
 	handle: string;
@@ -20,8 +21,8 @@ interface Props {
 	buyLabel?: string;
 }
 
-const { handle, heading = "h2", compact = false, addLabel = "Add to cart", buyLabel = "Buy now" } = Astro.props;
 const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const { handle, heading = "h2", compact = false, addLabel = text(config, "Add to cart"), buyLabel = text(config, "Buy now") } = Astro.props;
 let p: Product | null = null;
 if (config) {
 	try {
@@ -50,11 +51,11 @@ const id = `redeemid-product-${handle}`;
 				<input type="hidden" name="return" value={here} />
 				{p.variants.length > 1 ? (
 					<p>
-						<label for={`${id}-variant`}>Option</label>
+						<label for={`${id}-variant`}>{text(config, "Option")}</label>
 						<select id={`${id}-variant`} name="variant">
 							{p.variants.map((v) => (
 								<option value={v.id} disabled={!v.availableForSale}>
-									{v.title} ({money(v.price)}){!v.availableForSale && " sold out"}
+									{text(config, v.availableForSale ? "{option} ({price})" : "{option} ({price}) sold out", { option: v.title, price: money(v.price) })}
 								</option>
 							))}
 						</select>
@@ -63,14 +64,14 @@ const id = `redeemid-product-${handle}`;
 					<input type="hidden" name="variant" value={first?.id} />
 				)}
 				<p>
-					<label for={`${id}-quantity`}>Quantity</label>
+					<label for={`${id}-quantity`}>{text(config, "Quantity")}</label>
 					<input id={`${id}-quantity`} name="quantity" type="number" min="1" max="1000" value="1" inputmode="numeric" />
 				</p>
 				<button type="submit" name="then" value="back">{addLabel}</button>
 				<button type="submit" name="then" value="checkout">{buyLabel}</button>
 			</form>
 		) : (
-			<p class="redeemid-product__unavailable">Sold out.</p>
+			<p class="redeemid-product__unavailable">{text(config, "Sold out.")}</p>
 		)}
 	</div>
 ) : (

package/src/components/YourData.astro

@@ -0,0 +1,42 @@
+---
+/**
+ * The member's own data, for an account page: "Download my data" (everything
+ * this site keeps about them, as JSON) and "Delete my data", which erases it
+ * after they tick a box and signs them out. Their store account and orders
+ * stay; the text says so. Visitors get nothing.
+ *
+ *   <YourData />
+ */
+import { viewer } from "../access.js";
+import { siteConfig } from "../site-config.js";
+import { text } from "../text.js";
+
+interface Props {
+	title?: string;
+	heading?: "h2" | "h3" | "h4";
+}
+
+const config = siteConfig((Astro.locals as { emdash?: { config?: unknown } }).emdash?.config);
+const { title = text(config, "Your data"), heading = "h2" } = Astro.props;
+const v = await viewer(Astro);
+const route = "/_emdash/api/auth/redeemid/privacy";
+const here = Astro.url.pathname;
+const H = heading;
+---
+
+{v.signedIn && v.member && (
+	<section class="redeemid-data">
+		<H class="redeemid-data__title">{title}</H>
+		<p>
+			<a href={`${route}?return=${encodeURIComponent(here)}`} download>{text(config, "Download my data")}</a>
+		</p>
+		<form method="post" action={route} class="redeemid-data__erase">
+			<input type="hidden" name="return" value={here} />
+			<p>{text(config, "Deleting removes what this site keeps about you and signs you out. Your store account and orders stay; ask the store to delete those.")}</p>
+			<label>
+				<input type="checkbox" name="confirm" value="yes" required /> {text(config, "I understand")}
+			</label>
+			<button type="submit">{text(config, "Delete my data")}</button>
+		</form>
+	</section>
+)}

package/src/config.ts

@@ -72,10 +72,29 @@ export interface FeatureConfig {
 }
 
 /** Where to send signed member events (see events.ts). The signing secret is REDEEMID_EVENTS_SECRET. */
+/** A media folder whose files only some readers may download. Any of the given ways in is enough. */
+export interface FileRule {
+	/** The media folder's name in the EmDash media library. */
+	folder: string;
+	/** Members holding any of these levels. An empty list means any signed-in member. */
+	levels?: string[];
+	/** Members holding any of these features. */
+	features?: string[];
+	/** Whoever can read a published entry that uses the file (its rule, drip and the levels picked in its body). */
+	entries?: boolean;
+}
+
+export interface PreferenceConfig {
+	/** "namespace.key" of a customer metafield definition. */
+	key: string;
+	/** "edit" (default): members can change it. "view": members only see it. */
+	access?: "view" | "edit";
+}
+
 export interface EventsConfig {
 	url: string;
 	/** Send only these events. All of them when left out. */
-	only?: Array<"member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted">;
+	only?: Array<"member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved" | "member.erased">;
 }
 
 export interface MeterConfig {
@@ -100,6 +119,24 @@ export interface RedeemIDConfig {
 	meter?: MeterConfig;
 	features?: FeatureConfig[];
 	events?: EventsConfig;
+	/**
+	 * Customer metafields members may see or change, in this order, by
+	 * "namespace.key". Define them in Shopify (Settings → Custom data →
+	 * Customers). Needs the Admin API app (staff tools) for reading and saving.
+	 */
+	preferences?: PreferenceConfig[];
+	/**
+	 * AI agents (EmDash's MCP server) and the command line. Read-only tools are
+	 * always declared; `actions: true` also offers resync and tag edits.
+	 */
+	agents?: { actions?: boolean };
+	/** Protected files, by media folder. See FileRule. */
+	files?: FileRule[];
+	/**
+	 * Replacement text, by each string's original English, e.g.
+	 * { "Sign in": "Log in" }. One string at a time; see text.ts for the list.
+	 */
+	text?: Record<string, string>;
 	/** The wall's join link: where readers become members, e.g. { href: "/join/", label: "Become a member" }. */
 	join?: { href: string; label?: string };
 	/**

package/src/descriptor.ts

@@ -12,6 +12,7 @@ export const PAGES = [
 	{ path: "/", label: "Members", icon: "users" },
 	{ path: "/status", label: "Status", icon: "pulse" },
 	{ path: "/test", label: "Access test", icon: "search" },
+	{ path: "/privacy", label: "Privacy", icon: "lock" },
 ];
 export const WIDGETS = [{ id: "status", title: "RedeemID", size: "half" as const }];
 

package/src/events.ts

@@ -6,7 +6,8 @@
  *
  * Headers: X-RedeemID-Event (the name), X-RedeemID-Delivery (a fresh id) and
  * X-RedeemID-Signature: sha256=<hex HMAC of the raw body>. Events:
- * member.signed_in, member.levels_changed, meter.used, meter.exhausted.
+ * member.signed_in, member.levels_changed, meter.used, meter.exhausted,
+ * preferences.saved.
  * Sending never blocks or breaks the page: failures are logged and dropped.
  * No event carries an email address or a name; match people by `customerId`.
  */
@@ -14,7 +15,7 @@
 import { env, ENV, type RedeemIDConfig } from "./config.js";
 import { USER_AGENT } from "./shopify.js";
 
-export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted";
+export type EventName = "member.signed_in" | "member.levels_changed" | "meter.used" | "meter.exhausted" | "preferences.saved" | "member.erased";
 
 const TIMEOUT_MS = 3000;
 

package/src/files.ts

@@ -0,0 +1,196 @@
+/**
+ * Protected files: uploads in a media folder named in `files` are served only
+ * to readers the folder's rule lets in, checked on every download. EmDash
+ * serves uploads at /_emdash/api/media/file/<storage key>; the guard
+ * middleware calls fileAccess() before EmDash answers, refuses readers
+ * without access, and marks allowed downloads private so no cache keeps them.
+ *
+ *   files: [
+ *     { folder: "Gold downloads", levels: ["gold"] },
+ *     { folder: "Member downloads", levels: [] },            // any signed-in member
+ *     { folder: "Supporter extras", features: ["supporter"] },
+ *     { folder: "Story files", entries: true },              // whoever can read an entry using it
+ *   ]
+ *
+ * Staff (any EmDash role above Subscriber) can always download. Folder names
+ * match case-insensitively. Access still comes only from Shopify tags.
+ */
+
+import { readEntry, viewer, type AstroLike, type Terms } from "./access.js";
+import { holdsItem, ITEM_BLOCK, PAYWALL_BLOCK, sections, soldItem, splitAtPaywall } from "./blocks-names.js";
+import type { FileRule, RedeemIDConfig } from "./config.js";
+import { featuresFor } from "./features.js";
+import { text } from "./text.js";
+
+export const FILE_PATH = "/_emdash/api/media/file/";
+const SUBSCRIBER = 10;
+
+export type FileVerdict = { protected: false } | { protected: true; allowed: true } | { protected: true; allowed: false; reason: "sign_in" | "denied" };
+
+interface MediaRow {
+	id: string;
+	folder: string | null;
+}
+
+/** The media item behind a storage key, with its folder's name. */
+async function mediaByKey(db: unknown, key: string): Promise<MediaRow | null> {
+	// Kysely, typed loosely: EmDash's schema types aren't exported.
+	const k = db as {
+		selectFrom(t: string): {
+			leftJoin(t: string, a: string, b: string): { select(c: string[]): { where(c: string, op: string, v: string): { executeTakeFirst(): Promise<Record<string, unknown> | undefined> } } };
+		};
+	};
+	const row = await k
+		.selectFrom("media")
+		.leftJoin("media_folders", "media_folders.id", "media.folder_id")
+		.select(["media.id as id", "media_folders.name as folder"])
+		.where("media.storage_key", "=", key)
+		.executeTakeFirst();
+	return row ? { id: String(row.id), folder: (row.folder as string | null) ?? null } : null;
+}
+
+/** Published entries that use the media item: collection and id. */
+async function entriesUsing(db: unknown, mediaId: string): Promise<Array<{ collection: string; id: string }>> {
+	const k = db as {
+		selectFrom(t: string): {
+			innerJoin(t: string, cb: (j: { onRef(a: string, op: string, b: string): { onRef(a: string, op: string, b: string): unknown } }) => unknown): {
+				select(c: string[]): {
+					where(c: string, op: string, v: unknown): {
+						where(c: string, op: string, v: unknown): { where(c: string, op: string, v: unknown): { limit(n: number): { execute(): Promise<Array<Record<string, unknown>>> } } };
+					};
+				};
+			};
+		};
+	};
+	const rows = await k
+		.selectFrom("_emdash_media_usage_sources as s")
+		.innerJoin("_emdash_media_usage as u", (j) => j.onRef("u.source_key", "=", "s.source_key").onRef("u.generation", "=", "s.current_generation"))
+		.select(["s.collection_slug as collection", "s.content_id as id"])
+		.where("u.media_id", "=", mediaId)
+		.where("s.content_status", "=", "published")
+		.where("s.content_deleted_at", "is", null)
+		.limit(50)
+		.execute();
+	const seen = new Set<string>();
+	return rows
+		.filter((r) => typeof r.collection === "string" && typeof r.id === "string")
+		.map((r) => ({ collection: r.collection as string, id: r.id as string }))
+		.filter((e) => !seen.has(`${e.collection}:${e.id}`) && Boolean(seen.add(`${e.collection}:${e.id}`)));
+}
+
+/** The levels picked on an entry body's breaks and members-only parts: readers must hold one from each. */
+export function bodyClauses(body: unknown): string[][] {
+	const blocks = Array.isArray(body) ? body : [];
+	const out: string[][] = [];
+	const split = splitAtPaywall(blocks);
+	if (split.paywall && split.levels.length) out.push(split.levels);
+	for (const s of sections(blocks)) if (s.members && s.levels.length) out.push(s.levels);
+	return out;
+}
+
+/** May this reader read the whole entry: its rule, drip, and every part with levels picked? */
+async function readsWhole(astro: AstroLike, entry: { collection: string; id: string }): Promise<boolean> {
+	const { getEmDashEntry } = await import("emdash");
+	const result = (await getEmDashEntry(entry.collection, entry.id)) as { entry?: { data?: Record<string, unknown> } | null } | null;
+	const data = result?.entry?.data;
+	if (!data) return false;
+	const terms = data.terms as Terms | undefined;
+	const body = Object.values(data).find((v) => Array.isArray(v) && v.some((b) => [PAYWALL_BLOCK, "redeemid-members", ITEM_BLOCK].includes((b as { _type?: string })?._type ?? "")));
+	const item = soldItem(body);
+	if (item) {
+		const m = (await viewer(astro)).member;
+		if (m && m.status !== "disabled" && holdsItem(item, m.tags)) return true;
+	}
+	const verdict = await readEntry(astro, { collection: entry.collection, terms });
+	if (!verdict.allowed) return false;
+	const clauses = bodyClauses(body);
+	return clauses.every((clause) => clause.some((l) => verdict.viewer.levels.includes(l) || (l === "signed-in" && verdict.viewer.signedIn)));
+}
+
+export function ruleFor(config: RedeemIDConfig | null, folder: string | null): FileRule | null {
+	if (!folder || !config?.files?.length) return null;
+	const name = folder.trim().toLowerCase();
+	return config.files.find((r) => r.folder.trim().toLowerCase() === name) ?? null;
+}
+
+/** Decide one download. `key` is the storage key from the file URL. */
+export async function fileAccess(astro: AstroLike, config: RedeemIDConfig | null, key: string): Promise<FileVerdict> {
+	if (!config?.files?.length) return { protected: false };
+	const locals = astro.locals as { user?: { role?: number } | null; emdash?: { db?: unknown } | null };
+	const db = locals.emdash?.db;
+	if (!db) return { protected: false };
+	const media = await mediaByKey(db, key);
+	const rule = ruleFor(config, media?.folder ?? null);
+	if (!media || !rule) return { protected: false };
+
+	const role = locals.user?.role ?? 0;
+	if (role > SUBSCRIBER) return { protected: true, allowed: true };
+	const v = await viewer(astro);
+	if (!v.signedIn) return { protected: true, allowed: false, reason: "sign_in" };
+	const m = v.member;
+	if (!m || m.status === "disabled") return { protected: true, allowed: false, reason: "denied" };
+
+	if (rule.levels && (rule.levels.length === 0 ? true : rule.levels.some((l) => v.levels.includes(l) || l === "signed-in"))) {
+		return { protected: true, allowed: true };
+	}
+	if (rule.features?.length && featuresFor(m, config.features, config.levels).some((f) => rule.features?.includes(f))) {
+		return { protected: true, allowed: true };
+	}
+	if (rule.entries) {
+		for (const e of await entriesUsing(db, media.id)) {
+			if (await readsWhole(astro, e)) return { protected: true, allowed: true };
+		}
+	}
+	return { protected: true, allowed: false, reason: "denied" };
+}
+
+/**
+ * Every storage key a file URL path could name: the key after each layer of
+ * percent-decoding, because storage backends differ in whether they decode
+ * keys. The guard checks all of them, so an encoded key can't slip past.
+ */
+export function keysFromPath(pathname: string): string[] | null {
+	if (!pathname.startsWith(FILE_PATH)) return null;
+	let candidate = pathname.slice(FILE_PATH.length);
+	if (!candidate) return null;
+	const out: string[] = [];
+	for (let layer = 0; layer < 4; layer++) {
+		let decoded: string;
+		try {
+			decoded = decodeURIComponent(candidate);
+		} catch {
+			break;
+		}
+		out.push(decoded);
+		if (decoded === candidate) break;
+		candidate = decoded;
+	}
+	return [...new Set(out)];
+}
+
+/** Decide a download that may name several keys: the first protected one decides. */
+export async function pathAccess(astro: AstroLike, config: RedeemIDConfig | null, keys: string[]): Promise<FileVerdict> {
+	for (const key of keys) {
+		const v = await fileAccess(astro, config, key);
+		if (v.protected) return v;
+	}
+	return { protected: false };
+}
+
+function escapeHtml(s: string): string {
+	return s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+
+/** The page a refused download gets. */
+export function refusal(reason: "sign_in" | "denied", signIn: string, config: RedeemIDConfig | null = null): Response {
+	const status = reason === "sign_in" ? 401 : 403;
+	const t = (s: string) => escapeHtml(text(config, s));
+	const body =
+		reason === "sign_in"
+			? `<p>${t("Sign in to download this file.")}</p><p><a href="${escapeHtml(signIn)}">${t("Sign in")}</a></p>`
+			: `<p>${t("Your membership doesn't include this file.")}</p>`;
+	return new Response(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="robots" content="noindex"><title>${t("File not available")}</title></head><body><main>${body}</main></body></html>`, {
+		status,
+		headers: { "content-type": "text/html; charset=utf-8", "cache-control": "private, no-store", "x-robots-tag": "noindex" },
+	});
+}

package/src/guard.ts

@@ -10,6 +10,8 @@
 
 import { defineMiddleware } from "astro:middleware";
 
+import { signInUrl } from "./access.js";
+import { keysFromPath, pathAccess, refusal } from "./files.js";
 import { siteConfig } from "./site-config.js";
 
 const SUBSCRIBER = 10;
@@ -28,11 +30,50 @@ export function memberMayUse(path: string, extra: string[] = []): boolean {
 	return [...MEMBER_PATHS, ...extra].some((p) => path === p.replace(/\/$/, "") || path.startsWith(p));
 }
 
-export const onRequest = defineMiddleware(async ({ locals, url }, next) => {
+/**
+ * EmDash skips the session on its public file route, so resolve the signed-in
+ * user here: the access check needs it.
+ */
+async function withUser(context: { locals: unknown; session?: { get(k: string): Promise<unknown> } }) {
+	const locals = context.locals as { user?: { id: string; role?: number } | null; emdash?: { db?: unknown } | null };
+	if (locals.user || !locals.emdash?.db) return context;
+	const sessionUser = (await context.session?.get("user")) as { id?: string } | undefined;
+	if (!sessionUser?.id) return context;
+	const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
+	const user = await createKyselyAdapter(locals.emdash.db as never).getUserById(sessionUser.id);
+	if (!user || user.disabled) return context;
+	return { ...context, locals: { ...locals, user: { id: user.id, role: user.role, disabled: user.disabled } } };
+}
+
+export const onRequest = defineMiddleware(async (context, next) => {
+	const { locals, url } = context;
 	const user = (locals as { user?: { role?: number } | null }).user;
+	const config = siteConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
+
+	// Protected files: checked for everyone, on every download.
+	const keys = config?.files?.length ? keysFromPath(url.pathname) : null;
+	if (keys) {
+		let verdict;
+		try {
+			verdict = await pathAccess(await withUser(context), config, keys);
+		} catch (e) {
+			// Fail closed: a file we can't check isn't served.
+			console.error("[redeemid] file check failed:", (e as Error).message);
+			return refusal("denied", signInUrl(url.pathname), config);
+		}
+		if (verdict.protected) {
+			if (!verdict.allowed) return refusal(verdict.reason, signInUrl(url.pathname), config);
+			const res = await next();
+			const out = new Response(res.body, res);
+			out.headers.set("cache-control", "private, no-store");
+			out.headers.set("vary", "Cookie");
+			out.headers.set("x-robots-tag", "noindex");
+			return out;
+		}
+	}
+
 	if (!user || user.role !== SUBSCRIBER) return next();
 
-	const config = siteConfig((locals as { emdash?: { config?: unknown } }).emdash?.config);
 	if (memberMayUse(url.pathname, config?.memberPaths)) return next();
 
 	if (url.pathname.startsWith("/_emdash/admin")) {

package/src/index.ts

@@ -58,6 +58,8 @@ export function redeemid(config: RedeemIDConfig): AuthProviderDescriptor {
 			{ pattern: `${BASE}/cart`, entrypoint: "@redeemid/emdash/routes/cart.ts" },
 			{ pattern: `${BASE}/cart-edit`, entrypoint: "@redeemid/emdash/routes/cart-edit.ts" },
 			{ pattern: `${BASE}/account`, entrypoint: "@redeemid/emdash/routes/account.ts" },
+			{ pattern: `${BASE}/preferences`, entrypoint: "@redeemid/emdash/routes/preferences.ts" },
+			{ pattern: `${BASE}/privacy`, entrypoint: "@redeemid/emdash/routes/privacy.ts" },
 		],
 		publicRoutes: [`${BASE}/`],
 		storage: STORAGE_CONFIG,