@mindful-web/marko-web-identity-x 1.76.7 → 1.77.0

package/CLAUDE.md

@@ -0,0 +1,139 @@
+# marko-web-identity-x — Claude Code Context
+
+The Marko/Express wrapper for **IdentityX** (Parameter1's identity + access platform) on Mindful
+Web sites. Owns the whole authenticated-user surface: login / register / authenticate (email-link)
+/ profile / logout, content access + download gating, comments, and the server-side IdentityX API
+client. Add-ons layer on top: `marko-web-omeda-identity-x` (wraps this and adds Omeda hooks —
+how most sites install it), `marko-web-auth0-identity-x`, `marko-web-identity-x-mailchimp`. Google
+Sign-In (One-Tap + button) is **built in** here (see below).
+
+## Config model — the `IdentityXConfiguration` instance (`config.js`)
+
+Unlike most Mindful packages, config is **not** read from `site.getAsObject(...)` — it's an
+instance of `IdentityXConfiguration` (`new IdentityX({...})`), passed to the installer and injected
+onto every request as `req.identityX.config`. Read in templates via
+`req.identityX.config.get(...)` / `.getAsObject(...)` / typed getters.
+
+```js
+const IdentityX = require('@mindful-web/marko-web-identity-x/config');
+const config = new IdentityX({
+  appId: '<APP-ID>',                 // required
+  apiToken: process.env.IDENTITYX_API_TOKEN,   // required for write ops
+  requiredServerFields: ['organization', 'countryCode'],
+  requiredClientFields: [...],       // gate access until present
+  hiddenFields: [...], defaultCountryCode, booleanQuestionsLabel, gtmUserFields,
+  onHookError: newrelic.noticeError.bind(newrelic),   // hook + google-auth error reporter
+  googleAuth: { clientId, missingFieldsBehavior, autoPrompt, signInButtonEnabled }, // opt-in; see below
+});
+```
+
+Arbitrary extra keys pass through `...rest` into `options` and are reachable via `config.get(path)`.
+`endpointTypes` (`authenticate|changeEmail|login|logout|register|profile`) map to `/user/<type>`
+routes via `getEndpointFor(type)` (override with an `endpoints` config key).
+
+## Wiring (`index.js`)
+
+`IdentityX(app, config, { templates })`:
+1. `app.use(middleware(config))` — injects the service (below).
+2. `app.use('/__idx', routes)` — the JSON API router.
+3. For each `endpointType` with a supplied `template`, registers `GET <endpoint>` to render it
+   (the `authenticate` endpoint redirects to profile when a token is already present).
+
+Most sites don't call this directly — they call `omedaIdentityX(app, { idxConfig, idxRouteTemplates, … })`,
+which adds Omeda integration hooks to `idxConfig` and then calls `identityX(app, idxConfig, …)`
+internally. So **`googleAuth` goes on the `idxConfig` instance**, not the omeda params and not site config.
+
+## Middleware (`middleware.js`)
+
+Injects a per-request `IdentityX` **service** instance as `req.identityX` (+ `res.locals.identityX`),
+reads the token cookie, and sets the identity cookie for logged-in users. `IdentityXRequest.identityX`
+is the type every route/template relies on.
+
+## Routes — `/__idx/*` (`routes/index.js`)
+
+JSON API behind the Vue components: `authenticate`, `login`, `login-fields`, `logout`, `profile`,
+`access`, `download`, `change-email/{initiate,confirm}`, `comment(s)`/`comment-count`/`flag`,
+`countries`/`regions`, and **`google`** (see below). `logout.js` removes the context cookie, calls
+`onLogout` (tokenless) or `logoutAppUser`, and **clears the GIS `g_state` cookie** unconditionally.
+
+## Components / tags (`components/marko.json`)
+
+Marko wrappers (`<marko-web-identity-x-*>`) that render a matching **browser Vue component**
+(`browser/*.vue`, registered in `browser/index.js` as `IdentityX*`, overridable via
+`Custom*Component`): `form-login`, `form-authenticate`, `form-register`, `form-profile`,
+`form-change-email`, `form-logout`, `form-access`, `access`, `comment-stream`, `identify` /
+`non-auth-identify`, `context` (a `|{ user, application, fields, isEnabled }|` provider), and the
+Google tags. Vue components emit an EventBus stream bridged to `dataLayer` + p1events (see
+`browser/index.js`).
+
+## Service (`service.js`)
+
+Server-side IdentityX GraphQL client (Apollo, idx-compat). Key methods: `loadActiveContext`,
+`loadAppUserByEmail` / `findUserById` / `findUserByExternalId`, `createAppUser`,
+`impersonateAppUser`, `logoutAppUser`, `addExternalUserId`, `setUnverifiedAppUserData`,
+`generateEntityId`, `sendLoginLink`, `checkContentAccess`, cookie helpers (`setToken`,
+`setIdentityCookie`, `getIdentity`). Org-scoped writes use `getOrgUserApiToken()`.
+
+## Hooks (`hooks.js`)
+
+`onLoadActiveContext`, `onLoginLinkSent`, `onAuthenticationSuccess`, `onLogout`,
+`onChangeEmailLinkSent`, `onChangeEmailSuccess`, `onUserProfileUpdate`. Registered via
+`config.addHook({ name, fn, shouldAwait })` and invoked with `utils/call-hooks-for`. This is the
+seam Omeda uses for rapid-identify + subscription sync. **Note:** `onLogout` currently fires only
+in the tokenless logout branch — a "fire `onLogout` always" change would let the `g_state` clear
+become a hook rather than inline route code.
+
+## Google Sign-In (One-Tap + button) — folded in 2026-07
+
+Verifies a Google Identity Services (GIS) credential server-side and drops the user into the
+standard IdentityX session, bypassing the email-link step. Handles the One-Tap prompt **and** the
+rendered "Sign in with Google" button; both post to `POST /__idx/google`. **Dormant until
+`googleAuth.clientId` is set** — no client id ⇒ nothing renders and the route 400s. Previously a
+standalone `marko-web-google-identity-x` package; folded in here because it was ~all ceremony gated
+on a client id and already depended on idx internals.
+
+**Config** (on the IdentityX config, above): `clientId` (master gate — per-deploy env),
+`missingFieldsBehavior` (`profile-gate` default | `immediate` | `relaxed`; `relaxed` is a doc-only
+alias of `immediate` — only `profile-gate` is special-cased), `autoPrompt` (site-wide floating
+overlay), `signInButtonEnabled` (button; default true).
+
+**Route — `routes/google.js` (`POST /__idx/google`).** Verify the JWT →
+`loadAppUserByEmail`/`createAppUser` (**email is the primary key**) → link the Google `sub` as a
+supplementary external id under `{ provider:'google', tenant:'oauth', type:'account' }` (idempotent;
+conflict-guarded; non-fatal via `config.get('onHookError')`) → `impersonateAppUser({ method:'GOOGLE_ONE_TAP', verify:true })`
+→ backfill given/family name only if absent → fire `onLoginLinkSent` **then** (re-fetch)
+`onAuthenticationSuccess`, same order/hooks as email-link so Omeda rapid-identify + subscription
+sync run identically. `profile-gate` computes `requiresUserInput` by checking required fields are
+non-empty (deliberately not `forceProfileReVerification`). Responds `{ ok, requiresUserInput,
+redirectTo, user, entity, … }`; the client redirects to `/user/profile` when input is required.
+
+**Tags** (`components/marko.json`, config read from `req.identityX.config`):
+- `<marko-web-identity-x-google-init>` — loads the GSI client + defines `window.handleGoogleOneTapCredential`;
+  shows the One-Tap prompt when `autoPrompt`. The button depends on this being on the page.
+- `<marko-web-identity-x-google-sign-in-button client-id= redirect-to= label=>` — the button; self-hides
+  when unconfigured or `signInButtonEnabled` is false.
+
+**Auto-rendering.** Both tags render inside `form-login.marko` + `form-authenticate.marko`, so the
+login/authenticate pages get the button with **no per-site edit**. For the site-wide floating prompt
+(`autoPrompt: true`), a site additionally drops `<marko-web-identity-x-google-init/>` once in its
+document layout, gated on `!req.identityX.token`. The button tag can also be placed in a content
+meter / gate.
+
+**CSS.** `.google-sign-in` styles ship in `marko-web-theme-monorail/scss/components/_identity-x.scss`
+(with the rest of the auth CSS) — no separate import.
+
+**Logout.** `routes/logout.js` clears the GIS `g_state` cookie so a later sign-in with a *different*
+Google account isn't blocked by stale auto-select state (harmless no-op when Google Sign-In is unused).
+
+**Deliberate decisions / limitations.** `loginSource: 'google-one-tap'` and
+`method: 'GOOGLE_ONE_TAP'` are emitted for BOTH surfaces (don't distinguish button vs prompt) —
+kept for analytics/enum continuity. One success p1event (`Identity / Authenticate`, label
+`Google Sign In` for the button via GIS `select_by` `btn*`, else `Google One Tap`), fired client-side
+after `setIdentity`. `google-auth-library` is now a base-idx dependency (every site pulls it,
+server-only) — accepted because the feature is gated on the client id. The Google OAuth app must
+list each site origin as an authorized JavaScript origin or the surfaces silently no-show.
+
+## Fleet / rollout
+
+Not tracked in-repo. The Google-auth architecture change + fleet rollout plan lives outside the repo
+at `../GOOGLE-AUTH-ROLLOUT.md` (mindful working dir).

package/README.md

@@ -197,4 +197,52 @@ Each component will emit an event when an error is encountered and include the e
 | `identity-x-profile-errored` | `{ label, message: '...', ...additionalEventData }`
 | `identity-x-comment-post-errored` | `{ label, message: '...', ...additionalEventData }`
 | `identity-x-comment-report-errored` | `{ label, message: '...', ...additionalEventData }`
+
+## Google Sign-In (One-Tap + button)
+
+Built in. Verifies a Google Identity Services (GIS) credential server-side and drops the user
+into the standard IdentityX session, bypassing the email-link step. Handles both the One-Tap
+prompt and the rendered "Sign in with Google" button; both post to `POST /__idx/google`.
+
+**Dormant until configured** — with no `clientId`, nothing renders and the route 400s. Enable
+per-site by adding a `googleAuth` block to the IdentityX config:
+
+```js
+const config = new IdentityX({
+  appId: '<MY-APPLICATION-ID>',
+  googleAuth: {
+    clientId: process.env.GOOGLE_AUTH_CLIENT_ID || '', // GIS OAuth client id — the master gate
+    missingFieldsBehavior: 'profile-gate',             // 'profile-gate' | 'immediate' | 'relaxed'
+    autoPrompt: false,                                 // floating One-Tap overlay
+    signInButtonEnabled: true,                         // render the button
+  },
+});
+```
+
+Reading the values from env is optional — set literals here if you'd rather not manage infra
+env vars. The client id's Google OAuth app must list each site origin as an **authorized
+JavaScript origin**, or the prompt/button silently no-shows.
+
+`missingFieldsBehavior`: `profile-gate` authenticates immediately but forces profile completion
+before gated content; `immediate`/`relaxed` grant access with fields left blank (`relaxed` is a
+doc-only alias of `immediate`).
+
+**Rendering.** The button + GIS init are rendered automatically inside the `form-login` and
+`form-authenticate` templates — no per-site placement, and both self-hide when unconfigured. For
+the **site-wide floating One-Tap prompt** (`autoPrompt: true`), also drop
+`<marko-web-identity-x-google-init/>` once in your document layout, gated on an unauthenticated
+user, e.g. `<if(!req.identityX.token)> <marko-web-identity-x-google-init/> </if>`. The button tag
+(`<marko-web-identity-x-google-sign-in-button redirect-to=... />`) can also be placed in a content meter
+or gate if desired.
+
+**CSS.** Styles ship with the rest of the auth CSS in `marko-web-theme-monorail`
+(`scss/components/_identity-x.scss`) — no separate import.
+
+**Logout.** The idx logout route clears the GIS `g_state` cookie so a later sign-in with a
+*different* Google account isn't blocked by stale auto-select state (harmless no-op when Google
+Sign-In isn't used).
+
+The Google account id (JWT `sub`) is persisted as a supplementary idx external id under
+`{ provider: 'google', tenant: 'oauth', type: 'account' }`; email stays the primary key.
+Non-fatal linkage errors report through the config's `onHookError`.
 | `identity-x-comment-stream-errored` | `{ label, message: '...', ...additionalEventData }`

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -85,7 +85,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -174,7 +174,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko

@@ -32,5 +32,7 @@ $ const lang = input.lang || defaultValue(site.config.lang, "en");
       lang
     };
     <marko-web-browser-component name="IdentityXAuthenticate" props=props />
+    <marko-web-identity-x-google-init/>
+    <marko-web-identity-x-google-sign-in-button redirect-to=query.redirectTo/>
   </marko-web-identity-x-context>
 </if>

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -13,6 +13,10 @@ var marko_template = module.exports = require("marko/dist/html").t(__filename),
     marko_web_browser_component_template = require("@mindful-web/marko-web/components/browser-component.marko"),
     marko_loadTag = require("marko/dist/runtime/helpers/load-tag"),
     marko_web_browser_component_tag = marko_loadTag(marko_web_browser_component_template),
+    marko_web_identity_x_google_init_template = require("./google-init.marko"),
+    marko_web_identity_x_google_init_tag = marko_loadTag(marko_web_identity_x_google_init_template),
+    marko_web_identity_x_google_sign_in_button_template = require("./google-sign-in-button.marko"),
+    marko_web_identity_x_google_sign_in_button_tag = marko_loadTag(marko_web_identity_x_google_sign_in_button_template),
     marko_web_identity_x_context_template = require("./context.marko"),
     marko_web_identity_x_context_tag = marko_loadTag(marko_web_identity_x_context_template);
 
@@ -61,6 +65,12 @@ function render(input, out, __component, component, state) {
               name: "IdentityXAuthenticate",
               props: props
             }, out, __component, "1");
+
+          marko_web_identity_x_google_init_tag({}, out, __component, "2");
+
+          marko_web_identity_x_google_sign_in_button_tag({
+              redirectTo: query.redirectTo
+            }, out, __component, "3");
         }
       }, out, __component, "0");
   }
@@ -71,10 +81,12 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",
+      "./google-init.marko",
+      "./google-sign-in-button.marko",
       "./context.marko"
     ]
   };

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko

@@ -40,6 +40,8 @@ $ const withFields = defaultValue(input.withFields, false);
     };
     <if(isEnabled)>
       <marko-web-browser-component name="IdentityXLogin" props=props />
+      <marko-web-identity-x-google-init/>
+      <marko-web-identity-x-google-sign-in-button redirect-to=input.redirect/>
     </if>
   </marko-web-identity-x-context>
 </if>

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -15,6 +15,10 @@ var marko_template = module.exports = require("marko/dist/html").t(__filename),
     marko_web_browser_component_template = require("@mindful-web/marko-web/components/browser-component.marko"),
     marko_loadTag = require("marko/dist/runtime/helpers/load-tag"),
     marko_web_browser_component_tag = marko_loadTag(marko_web_browser_component_template),
+    marko_web_identity_x_google_init_template = require("./google-init.marko"),
+    marko_web_identity_x_google_init_tag = marko_loadTag(marko_web_identity_x_google_init_template),
+    marko_web_identity_x_google_sign_in_button_template = require("./google-sign-in-button.marko"),
+    marko_web_identity_x_google_sign_in_button_tag = marko_loadTag(marko_web_identity_x_google_sign_in_button_template),
     marko_web_identity_x_context_template = require("./context.marko"),
     marko_web_identity_x_context_tag = marko_loadTag(marko_web_identity_x_context_template);
 
@@ -71,6 +75,12 @@ function render(input, out, __component, component, state) {
                 name: "IdentityXLogin",
                 props: props
               }, out, __component, "1");
+
+            marko_web_identity_x_google_init_tag({}, out, __component, "2");
+
+            marko_web_identity_x_google_sign_in_button_tag({
+                redirectTo: input.redirect
+              }, out, __component, "3");
           }
         }
       }, out, __component, "0");
@@ -82,10 +92,12 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",
+      "./google-init.marko",
+      "./google-sign-in-button.marko",
       "./context.marko"
     ]
   };

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko

@@ -0,0 +1,73 @@
+$ const { req } = out.global;
+$ const config = req.identityX && req.identityX.config;
+$ const { clientId, autoPrompt } = config ? config.getAsObject('googleAuth') : {};
+$ const callbackName = 'handleGoogleOneTapCredential';
+$ const initScript = `
+(function() {
+  window.${callbackName} = function(response) {
+    var redirectTo = window.__googleSignInRedirectTo || '';
+    var errorEl = document.getElementById('google-sign-in-error');
+    if (errorEl) errorEl.style.display = 'none';
+
+    // GIS 'select_by' distinguishes the surface: a 'btn*' value means the
+    // rendered "Sign in with Google" button, 'user*'/'auto' means the One-Tap
+    // prompt. Used to label the p1events authentication event accordingly.
+    var eventLabel = String(response.select_by || '').indexOf('btn') === 0
+      ? 'Google Sign In'
+      : 'Google One Tap';
+
+    fetch('/__idx/google', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ credential: response.credential, redirectTo: redirectTo }),
+    })
+      .then(function(res) { return res.json(); })
+      .then(function(data) {
+        if (!data.ok) {
+          if (errorEl) {
+            errorEl.textContent = data.error || 'Google sign-in failed. Please try again.';
+            errorEl.style.display = 'block';
+          }
+          return;
+        }
+        if (window.p1events) {
+          // De-anonymize the session to the app user, then record the
+          // authentication — mirrors the identity-x conversion events.
+          window.p1events('setIdentity', data.entity);
+          window.p1events('track', {
+            category: 'Identity',
+            action: 'Authenticate',
+            label: eventLabel,
+            props: { idxEntity: data.entity, actionSource: 'google-one-tap' },
+          });
+        }
+        if (data.requiresUserInput) {
+          var destination = data.redirectTo || window.location.pathname;
+          window.location.href = '/user/profile?returnTo=' + encodeURIComponent(destination);
+        } else {
+          window.location.href = data.redirectTo || window.location.href;
+        }
+      })
+      .catch(function() {
+        if (errorEl) {
+          errorEl.textContent = 'An error occurred during Google sign-in. Please try again.';
+          errorEl.style.display = 'block';
+        }
+      });
+  };
+})();
+`;
+
+<if(clientId)>
+  <div
+    id="g_id_onload"
+    data-client_id=clientId
+    data-callback=callbackName
+    data-auto_prompt=(autoPrompt ? 'true' : 'false')
+    data-auto_select="false"
+    data-cancel_on_tap_outside="true"
+    data-itp_support="true"
+  />
+  <script src="https://accounts.google.com/gsi/client" async defer />
+  <script>$!{initScript}</script>
+</if>

package/components/google-init.marko.js

@@ -0,0 +1,95 @@
+// Compiled using marko@4.20.2 - DO NOT EDIT
+"use strict";
+
+var marko_template = module.exports = require("marko/dist/html").t(__filename),
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/google-init.marko",
+    marko_renderer = require("marko/dist/runtime/components/renderer"),
+    marko_attr = require("marko/dist/runtime/html/helpers/attr"),
+    marko_str = require("marko/dist/runtime/helpers/to-string");
+
+function render(input, out, __component, component, state) {
+  var data = input;
+
+  const { req } = out.global;
+
+  const config = req.identityX && req.identityX.config;
+
+  const { clientId, autoPrompt } = config ? config.getAsObject('googleAuth') : {};
+
+  const callbackName = 'handleGoogleOneTapCredential';
+
+  const initScript = `
+(function() {
+  window.${callbackName} = function(response) {
+    var redirectTo = window.__googleSignInRedirectTo || '';
+    var errorEl = document.getElementById('google-sign-in-error');
+    if (errorEl) errorEl.style.display = 'none';
+
+    // GIS 'select_by' distinguishes the surface: a 'btn*' value means the
+    // rendered "Sign in with Google" button, 'user*'/'auto' means the One-Tap
+    // prompt. Used to label the p1events authentication event accordingly.
+    var eventLabel = String(response.select_by || '').indexOf('btn') === 0
+      ? 'Google Sign In'
+      : 'Google One Tap';
+
+    fetch('/__idx/google', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ credential: response.credential, redirectTo: redirectTo }),
+    })
+      .then(function(res) { return res.json(); })
+      .then(function(data) {
+        if (!data.ok) {
+          if (errorEl) {
+            errorEl.textContent = data.error || 'Google sign-in failed. Please try again.';
+            errorEl.style.display = 'block';
+          }
+          return;
+        }
+        if (window.p1events) {
+          // De-anonymize the session to the app user, then record the
+          // authentication — mirrors the identity-x conversion events.
+          window.p1events('setIdentity', data.entity);
+          window.p1events('track', {
+            category: 'Identity',
+            action: 'Authenticate',
+            label: eventLabel,
+            props: { idxEntity: data.entity, actionSource: 'google-one-tap' },
+          });
+        }
+        if (data.requiresUserInput) {
+          var destination = data.redirectTo || window.location.pathname;
+          window.location.href = '/user/profile?returnTo=' + encodeURIComponent(destination);
+        } else {
+          window.location.href = data.redirectTo || window.location.href;
+        }
+      })
+      .catch(function() {
+        if (errorEl) {
+          errorEl.textContent = 'An error occurred during Google sign-in. Please try again.';
+          errorEl.style.display = 'block';
+        }
+      });
+  };
+})();
+`;
+
+  if (clientId) {
+    out.w("<div id=\"g_id_onload\"" +
+      marko_attr("data-client_id", clientId) +
+      marko_attr("data-callback", callbackName) +
+      marko_attr("data-auto_prompt", autoPrompt ? "true" : "false") +
+      " data-auto_select=\"false\" data-cancel_on_tap_outside=\"true\" data-itp_support=\"true\"></div><script src=\"https://accounts.google.com/gsi/client\" async defer></script><script>" +
+      marko_str(initScript) +
+      "</script>");
+  }
+}
+
+marko_template._ = marko_renderer(render, {
+    d_: true,
+    e_: marko_componentType
+  });
+
+marko_template.meta = {
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/google-init.marko"
+  };

package/components/google-sign-in-button.marko

@@ -0,0 +1,24 @@
+$ const { req } = out.global;
+$ const config = req.identityX && req.identityX.config;
+$ const googleAuth = config ? config.getAsObject('googleAuth') : {};
+$ const clientId = input.clientId || googleAuth.clientId || '';
+$ const redirectTo = input.redirectTo || '';
+$ const label = input.label || 'Or sign in with Google';
+$ const signInButtonEnabled = googleAuth.signInButtonEnabled !== false;
+
+<if(clientId && signInButtonEnabled)>
+  <div class="google-sign-in">
+    <p class="google-sign-in__divider">${label}</p>
+    <div
+      class="g_id_signin"
+      data-type="standard"
+      data-theme="outline"
+      data-text="signin_with"
+      data-shape="rectangular"
+      data-logo_alignment="left"
+      data-width="300"
+    />
+    <p id="google-sign-in-error" class="google-sign-in__error" style="display:none;" role="alert" />
+    <script>window.__googleSignInRedirectTo = $!{JSON.stringify(redirectTo)};</script>
+  </div>
+</if>

package/components/google-sign-in-button.marko.js

@@ -0,0 +1,44 @@
+// Compiled using marko@4.20.2 - DO NOT EDIT
+"use strict";
+
+var marko_template = module.exports = require("marko/dist/html").t(__filename),
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/google-sign-in-button.marko",
+    marko_renderer = require("marko/dist/runtime/components/renderer"),
+    helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
+    marko_escapeXml = helpers_escape_xml.x,
+    marko_escapeScript = require("marko/dist/runtime/html/helpers/escape-script-placeholder");
+
+function render(input, out, __component, component, state) {
+  var data = input;
+
+  const { req } = out.global;
+
+  const config = req.identityX && req.identityX.config;
+
+  const googleAuth = config ? config.getAsObject('googleAuth') : {};
+
+  const clientId = input.clientId || googleAuth.clientId || '';
+
+  const redirectTo = input.redirectTo || '';
+
+  const label = input.label || 'Or sign in with Google';
+
+  const signInButtonEnabled = googleAuth.signInButtonEnabled !== false;
+
+  if (clientId && signInButtonEnabled) {
+    out.w("<div class=\"google-sign-in\"><p class=\"google-sign-in__divider\">" +
+      marko_escapeXml(label) +
+      "</p><div class=\"g_id_signin\" data-type=\"standard\" data-theme=\"outline\" data-text=\"signin_with\" data-shape=\"rectangular\" data-logo_alignment=\"left\" data-width=\"300\"></div><p id=\"google-sign-in-error\" class=\"google-sign-in__error\" style=\"display:none;\" role=\"alert\"></p><script>" +
+      marko_escapeScript(("window.__googleSignInRedirectTo = " + JSON.stringify(redirectTo)) + ";") +
+      "</script></div>");
+  }
+}
+
+marko_template._ = marko_renderer(render, {
+    d_: true,
+    e_: marko_componentType
+  });
+
+marko_template.meta = {
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/google-sign-in-button.marko"
+  };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/marko.json

@@ -106,5 +106,14 @@
   "<marko-web-identity-x-identify>": {
     "template": "./identify.marko",
     "@provider-data": "object"
+  },
+  "<marko-web-identity-x-google-init>": {
+    "template": "./google-init.marko"
+  },
+  "<marko-web-identity-x-google-sign-in-button>": {
+    "template": "./google-sign-in-button.marko",
+    "@client-id": "string",
+    "@redirect-to": "string",
+    "@label": "string"
   }
 }

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.77.0/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.77.0/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/config.js

@@ -16,6 +16,13 @@ class IdentityXConfiguration {
    * @param {string[]} [options.activeCustomFieldIds] Limit displayed custom fields, if present.
    * @param {string[]} [options.hiddenFields] The fields to hide from the profile.
    * @param {function} [options.onHookError]
+   * @param {object} [options.googleAuth] Google Sign-In config. When `clientId` is
+   *   set, the One-Tap prompt / "Sign in with Google" button render in the auth
+   *   templates and `POST /__idx/google` accepts credentials. Dormant otherwise.
+   * @param {string} [options.googleAuth.clientId] GIS OAuth client id — the master gate.
+   * @param {("profile-gate"|"immediate"|"relaxed")} [options.googleAuth.missingFieldsBehavior]
+   * @param {boolean} [options.googleAuth.autoPrompt] Show the floating One-Tap overlay.
+   * @param {boolean} [options.googleAuth.signInButtonEnabled] Render the button (default true).
    * @param {object} options.rest
    */
   constructor({
@@ -31,6 +38,7 @@ class IdentityXConfiguration {
     defaultCountryCode,
     booleanQuestionsLabel,
     gtmUserFields = {},
+    googleAuth = {},
     onHookError,
     ...rest
   } = {}) {
@@ -49,6 +57,7 @@ class IdentityXConfiguration {
       defaultCountryCode,
       booleanQuestionsLabel,
       gtmUserFields,
+      googleAuth,
       onHookError: (e) => {
         if (process.env.NODE_ENV === 'development') {
           log('ERROR IN IDENTITY-X HOOK', e);
@@ -141,6 +150,14 @@ class IdentityXConfiguration {
     return this.getAsArray('activeCustomFieldIds');
   }
 
+  /**
+   * The Google Sign-In config block. Empty object when unconfigured, so a missing
+   * `clientId` reads as falsy and the feature stays dormant.
+   */
+  getGoogleAuth() {
+    return this.getAsObject('googleAuth');
+  }
+
   getAdditionalCustomFieldIds() {
     return this.getAsArray('additionalCustomFieldIds');
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.76.7",
+  "version": "1.77.0",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -24,6 +24,7 @@
     "cookie": "0.3.1",
     "dayjs": "^1.11.7",
     "express": "^4.18.2",
+    "google-auth-library": "^9.0.0",
     "graphql-tag": "^2.12.6",
     "i18n-iso-countries": "^4.3.1",
     "jsonwebtoken": "^8.5.1",
@@ -37,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "e6fc8615e76b1f00858bb0595230e652275c7333"
+  "gitHead": "c8c0dca117cb9c8f76ae5e8d5786cc99904a0da3"
 }

package/routes/google.js

@@ -0,0 +1,206 @@
+const gql = require('graphql-tag');
+const { OAuth2Client } = require('google-auth-library');
+const { asyncRoute } = require('@mindful-web/utils');
+const IMPERSONATE_APP_USER = require('../api/mutations/impersonate-app-user');
+const tokenCookie = require('../utils/token-cookie');
+const contextCookie = require('../utils/context-cookie');
+const callHooksFor = require('../utils/call-hooks-for');
+
+const UPDATE_OWN_APP_USER = gql`
+  mutation GoogleSignInUpdateUser($input: UpdateOwnAppUserMutationInput!) {
+    updateOwnAppUser(input: $input) { id givenName familyName }
+  }
+`;
+
+const isEmpty = (v) => v == null || v === '';
+
+const LOGIN_SOURCE = 'google-one-tap';
+
+// Namespace under which the Google account id (the JWT `sub`) is stored as an
+// idx external id, mirroring the Omeda { provider, tenant, type } convention.
+// These values must remain stable — changing them orphans existing links.
+const GOOGLE_NAMESPACE = { provider: 'google', tenant: 'oauth', type: 'account' };
+
+// eslint-disable-next-line no-console
+const defaultOnError = (e) => console.error('[identity-x google-auth]', e);
+
+/**
+ * `POST /__idx/google` — the Google Sign-In route. Handles both the One-Tap
+ * prompt and the "Sign in with Google" button; both surfaces post here.
+ *
+ * Verifies the Google credential, finds-or-creates the IdentityX app user, links
+ * the Google account id (`sub`) as an external id, impersonates the user to mint
+ * a session token, and fires the standard `onLoginLinkSent` /
+ * `onAuthenticationSuccess` hooks so downstream integrations (e.g. Omeda
+ * rapid-identify + subscription sync) run exactly as they do for email-link
+ * users.
+ *
+ * Configuration lives on the IdentityX config under the `googleAuth` key
+ * (`{ clientId, missingFieldsBehavior, autoPrompt, signInButtonEnabled }`). The
+ * route is dormant until `clientId` is set: no client id ⇒ 400.
+ *
+ * Non-fatal errors from the supplementary `sub`-linkage are reported through the
+ * IdentityX config's `onHookError` (the same reporter sites already wire to
+ * newrelic for hook failures), falling back to `console.error`.
+ */
+module.exports = asyncRoute(async (req, res) => {
+  /** @type {import('../service')} */
+  const { identityX, body } = req;
+  const { credential, redirectTo } = body;
+  const { config } = identityX;
+  const onError = config.get('onHookError') || defaultOnError;
+
+  const { clientId, missingFieldsBehavior = 'profile-gate' } = config.getAsObject('googleAuth');
+
+  if (!clientId) {
+    res.status(400).json({ ok: false, error: 'Google Sign-In is not configured for this site.' });
+    return;
+  }
+  if (!credential) {
+    res.status(400).json({ ok: false, error: 'No Google credential was provided.' });
+    return;
+  }
+
+  // Verify the Google JWT and extract user info.
+  const oauthClient = new OAuth2Client(clientId);
+  const ticket = await oauthClient.verifyIdToken({ idToken: credential, audience: clientId });
+  const googlePayload = ticket.getPayload();
+  const {
+    email,
+    given_name: givenName,
+    family_name: familyName,
+    sub: googleSub,
+  } = googlePayload;
+
+  if (!email) throw new Error('Google credential did not include an email address.');
+
+  // Find or create the identity-x user.
+  let appUser = await identityX.loadAppUserByEmail(email);
+  const createdNewUser = !appUser;
+  if (!appUser) {
+    appUser = await identityX.createAppUser({ email });
+  }
+
+  // Persist the Google account id (the JWT `sub`) as an idx external id so the
+  // user is linked to its Google identity. Email stays the primary key; this is
+  // supplementary provenance and must never block sign-in.
+  if (googleSub) {
+    const alreadyLinked = (appUser.externalIds || []).some((extId) => (
+      extId.namespace
+      && extId.namespace.provider === GOOGLE_NAMESPACE.provider
+      && extId.identifier
+      && extId.identifier.value === googleSub
+    ));
+    if (!alreadyLinked) {
+      try {
+        // If this sub is already attached to a different user (e.g. the Google
+        // account's email changed and a new user was created under it), report
+        // and skip rather than fanning the sub across two users.
+        const existing = await identityX.findUserByExternalId({
+          identifier: googleSub,
+          namespace: GOOGLE_NAMESPACE,
+          type: 'sub',
+        });
+        if (existing && existing.id !== appUser.id) {
+          onError(new Error(
+            `Google sub already linked to idx user ${existing.id}, not ${appUser.id}`,
+          ));
+        } else {
+          await identityX.addExternalUserId({
+            userId: appUser.id,
+            identifier: { value: googleSub, type: 'sub' },
+            namespace: GOOGLE_NAMESPACE,
+          });
+        }
+      } catch (e) {
+        // Supplementary linkage — never block authentication on a failure here.
+        onError(e);
+      }
+    }
+  }
+
+  // Impersonate the user with verify: true — marks them as verified and returns
+  // a session token, bypassing the normal email-link flow.
+  const { data: impersonateData } = await identityX.client.mutate({
+    mutation: IMPERSONATE_APP_USER,
+    variables: {
+      input: {
+        id: appUser.id,
+        method: 'GOOGLE_ONE_TAP',
+        verify: true,
+      },
+    },
+    context: { apiToken: identityX.getOrgUserApiToken() },
+  });
+  const { token: authToken } = impersonateData.impersonateAppUser;
+
+  tokenCookie.setTo(res, authToken.value);
+  contextCookie.setTo(res, { loginSource: LOGIN_SOURCE });
+  identityX.setIdentityCookie(appUser.id);
+
+  // Re-init the Apollo client with the user's own session token so that
+  // updateOwnAppUser is authenticated as this user (not as the org admin).
+  identityX.setToken(authToken);
+
+  // Set name fields from Google as verified data if not already present.
+  const needsNameUpdate = !appUser.givenName || !appUser.familyName;
+  if (needsNameUpdate && (givenName || familyName)) {
+    const nameInput = {};
+    if (givenName && !appUser.givenName) nameInput.givenName = givenName;
+    if (familyName && !appUser.familyName) nameInput.familyName = familyName;
+    await identityX.client.mutate({
+      mutation: UPDATE_OWN_APP_USER,
+      variables: { input: nameInput },
+    });
+  }
+
+  // Load the refreshed user so hooks and field checks have up-to-date data.
+  const user = await identityX.findUserById(appUser.id);
+  const entity = await identityX.generateEntityId({ userId: appUser.id });
+
+  // For profile-gate: check whether the user is actually missing required fields
+  // rather than using forceProfileReVerification, which isn't cleared by a normal
+  // /user/profile submission and would redirect complete users on every sign-in.
+  let requiresUserInput = false;
+  if (missingFieldsBehavior === 'profile-gate') {
+    const requiredFields = [
+      ...config.getRequiredServerFields(),
+      ...config.getRequiredClientFields(),
+    ];
+    requiresUserInput = requiredFields.some((key) => isEmpty(user[key]));
+  }
+
+  // Fire onLoginLinkSent before onAuthenticationSuccess so that hooks wired to
+  // it (e.g. Omeda rapid-identify and subscription sync) run for Google users
+  // the same way they do for email-link users.  This also populates
+  // user.externalIds with the Omeda encryptedCustomerId so the subsequent
+  // onAuthenticationSuccess hook can set oly_enc_id in the response.
+  await callHooksFor(identityX, 'onLoginLinkSent', {
+    req,
+    source: LOGIN_SOURCE,
+    user,
+  });
+
+  // Re-fetch so onAuthenticationSuccess sees the externalIds written by
+  // the onLoginLinkSent hook (Omeda rapid-identify).
+  const userAfterLinkSent = await identityX.findUserById(appUser.id);
+
+  await callHooksFor(identityX, 'onAuthenticationSuccess', {
+    req,
+    res,
+    user: userAfterLinkSent,
+    authToken,
+    loginSource: LOGIN_SOURCE,
+    additionalEventData: { createdNewUser, requiresUserInput },
+  });
+
+  res.json({
+    ok: true,
+    requiresUserInput,
+    redirectTo: redirectTo || null,
+    applicationId: config.getAppId(),
+    user: userAfterLinkSent,
+    loginSource: LOGIN_SOURCE,
+    entity,
+  });
+});

package/routes/index.js

@@ -11,6 +11,7 @@ const countries = require('./countries');
 const createComment = require('./create-comment');
 const download = require('./download');
 const flagComment = require('./flag-comment');
+const google = require('./google');
 const login = require('./login');
 const loginFields = require('./login-fields');
 const logout = require('./logout');
@@ -31,6 +32,7 @@ router.post('/change-email/initiate', changeEmailInit);
 router.post('/comment', createComment);
 router.post('/comment/flag/:id', flagComment);
 router.post('/download', download);
+router.post('/google', google);
 router.post('/login-fields', loginFields);
 router.post('/login', login);
 router.post('/logout', logout);

package/routes/logout.js

@@ -7,6 +7,11 @@ module.exports = asyncRoute(async (req, res) => {
   /** @type {import('../middleware').IdentityXRequest} */
   const { identityX } = req;
   contextCookie.removeFrom(res);
+  // Clear the Google Identity Services `g_state` cookie so a subsequent Google
+  // sign-in (especially with a *different* account) isn't blocked by stale
+  // auto-select state. GIS only loads for unauthenticated users, so nothing else
+  // resets this on logout. Harmless no-op for sites not using Google Sign-In.
+  res.clearCookie('g_state', { path: '/' });
   const token = tokenCookie.getFrom(req);
   if (!token) {
     await callHooksFor(identityX, 'onLogout', { req, res });