@mindful-web/marko-web-identity-x 1.76.7 → 1.78.0

package/components/google-init.marko

@@ -0,0 +1,73 @@
+$ const { req } = out.global;
+$ const config = req.identityX && req.identityX.config;
+$ const { clientId, autoPrompt } = config ? config.getAsObject('googleAuth') : {};
+$ const callbackName = 'handleGoogleOneTapCredential';
+$ const initScript = `
+(function() {
+  window.${callbackName} = function(response) {
+    var redirectTo = window.__googleSignInRedirectTo || '';
+    var errorEl = document.getElementById('google-sign-in-error');
+    if (errorEl) errorEl.style.display = 'none';
+
+    // GIS 'select_by' distinguishes the surface: a 'btn*' value means the
+    // rendered "Sign in with Google" button, 'user*'/'auto' means the One-Tap
+    // prompt. Used to label the p1events authentication event accordingly.
+    var eventLabel = String(response.select_by || '').indexOf('btn') === 0
+      ? 'Google Sign In'
+      : 'Google One Tap';
+
+    fetch('/__idx/google', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ credential: response.credential, redirectTo: redirectTo }),
+    })
+      .then(function(res) { return res.json(); })
+      .then(function(data) {
+        if (!data.ok) {
+          if (errorEl) {
+            errorEl.textContent = data.error || 'Google sign-in failed. Please try again.';
+            errorEl.style.display = 'block';
+          }
+          return;
+        }
+        if (window.p1events) {
+          // De-anonymize the session to the app user, then record the
+          // authentication — mirrors the identity-x conversion events.
+          window.p1events('setIdentity', data.entity);
+          window.p1events('track', {
+            category: 'Identity',
+            action: 'Authenticate',
+            label: eventLabel,
+            props: { idxEntity: data.entity, actionSource: 'google-one-tap' },
+          });
+        }
+        if (data.requiresUserInput) {
+          var destination = data.redirectTo || window.location.pathname;
+          window.location.href = '/user/profile?returnTo=' + encodeURIComponent(destination);
+        } else {
+          window.location.href = data.redirectTo || window.location.href;
+        }
+      })
+      .catch(function() {
+        if (errorEl) {
+          errorEl.textContent = 'An error occurred during Google sign-in. Please try again.';
+          errorEl.style.display = 'block';
+        }
+      });
+  };
+})();
+`;
+
+<if(clientId)>
+  <div
+    id="g_id_onload"
+    data-client_id=clientId
+    data-callback=callbackName
+    data-auto_prompt=(autoPrompt ? 'true' : 'false')
+    data-auto_select="false"
+    data-cancel_on_tap_outside="true"
+    data-itp_support="true"
+  />
+  <script src="https://accounts.google.com/gsi/client" async defer />
+  <script>$!{initScript}</script>
+</if>

package/components/google-init.marko.js

@@ -0,0 +1,95 @@
+// Compiled using marko@4.20.2 - DO NOT EDIT
+"use strict";
+
+var marko_template = module.exports = require("marko/dist/html").t(__filename),
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.78.0/components/google-init.marko",
+    marko_renderer = require("marko/dist/runtime/components/renderer"),
+    marko_attr = require("marko/dist/runtime/html/helpers/attr"),
+    marko_str = require("marko/dist/runtime/helpers/to-string");
+
+function render(input, out, __component, component, state) {
+  var data = input;
+
+  const { req } = out.global;
+
+  const config = req.identityX && req.identityX.config;
+
+  const { clientId, autoPrompt } = config ? config.getAsObject('googleAuth') : {};
+
+  const callbackName = 'handleGoogleOneTapCredential';
+
+  const initScript = `
+(function() {
+  window.${callbackName} = function(response) {
+    var redirectTo = window.__googleSignInRedirectTo || '';
+    var errorEl = document.getElementById('google-sign-in-error');
+    if (errorEl) errorEl.style.display = 'none';
+
+    // GIS 'select_by' distinguishes the surface: a 'btn*' value means the
+    // rendered "Sign in with Google" button, 'user*'/'auto' means the One-Tap
+    // prompt. Used to label the p1events authentication event accordingly.
+    var eventLabel = String(response.select_by || '').indexOf('btn') === 0
+      ? 'Google Sign In'
+      : 'Google One Tap';
+
+    fetch('/__idx/google', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ credential: response.credential, redirectTo: redirectTo }),
+    })
+      .then(function(res) { return res.json(); })
+      .then(function(data) {
+        if (!data.ok) {
+          if (errorEl) {
+            errorEl.textContent = data.error || 'Google sign-in failed. Please try again.';
+            errorEl.style.display = 'block';
+          }
+          return;
+        }
+        if (window.p1events) {
+          // De-anonymize the session to the app user, then record the
+          // authentication — mirrors the identity-x conversion events.
+          window.p1events('setIdentity', data.entity);
+          window.p1events('track', {
+            category: 'Identity',
+            action: 'Authenticate',
+            label: eventLabel,
+            props: { idxEntity: data.entity, actionSource: 'google-one-tap' },
+          });
+        }
+        if (data.requiresUserInput) {
+          var destination = data.redirectTo || window.location.pathname;
+          window.location.href = '/user/profile?returnTo=' + encodeURIComponent(destination);
+        } else {
+          window.location.href = data.redirectTo || window.location.href;
+        }
+      })
+      .catch(function() {
+        if (errorEl) {
+          errorEl.textContent = 'An error occurred during Google sign-in. Please try again.';
+          errorEl.style.display = 'block';
+        }
+      });
+  };
+})();
+`;
+
+  if (clientId) {
+    out.w("<div id=\"g_id_onload\"" +
+      marko_attr("data-client_id", clientId) +
+      marko_attr("data-callback", callbackName) +
+      marko_attr("data-auto_prompt", autoPrompt ? "true" : "false") +
+      " data-auto_select=\"false\" data-cancel_on_tap_outside=\"true\" data-itp_support=\"true\"></div><script src=\"https://accounts.google.com/gsi/client\" async defer></script><script>" +
+      marko_str(initScript) +
+      "</script>");
+  }
+}
+
+marko_template._ = marko_renderer(render, {
+    d_: true,
+    e_: marko_componentType
+  });
+
+marko_template.meta = {
+    id: "/@mindful-web/marko-web-identity-x$1.78.0/components/google-init.marko"
+  };

package/components/google-sign-in-button.marko

@@ -0,0 +1,24 @@
+$ const { req } = out.global;
+$ const config = req.identityX && req.identityX.config;
+$ const googleAuth = config ? config.getAsObject('googleAuth') : {};
+$ const clientId = input.clientId || googleAuth.clientId || '';
+$ const redirectTo = input.redirectTo || '';
+$ const label = input.label || 'Or sign in with Google';
+$ const signInButtonEnabled = googleAuth.signInButtonEnabled !== false;
+
+<if(clientId && signInButtonEnabled)>
+  <div class="google-sign-in">
+    <p class="google-sign-in__divider">${label}</p>
+    <div
+      class="g_id_signin"
+      data-type="standard"
+      data-theme="outline"
+      data-text="signin_with"
+      data-shape="rectangular"
+      data-logo_alignment="left"
+      data-width="300"
+    />
+    <p id="google-sign-in-error" class="google-sign-in__error" style="display:none;" role="alert" />
+    <script>window.__googleSignInRedirectTo = $!{JSON.stringify(redirectTo)};</script>
+  </div>
+</if>

package/components/google-sign-in-button.marko.js

@@ -0,0 +1,44 @@
+// Compiled using marko@4.20.2 - DO NOT EDIT
+"use strict";
+
+var marko_template = module.exports = require("marko/dist/html").t(__filename),
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.78.0/components/google-sign-in-button.marko",
+    marko_renderer = require("marko/dist/runtime/components/renderer"),
+    helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
+    marko_escapeXml = helpers_escape_xml.x,
+    marko_escapeScript = require("marko/dist/runtime/html/helpers/escape-script-placeholder");
+
+function render(input, out, __component, component, state) {
+  var data = input;
+
+  const { req } = out.global;
+
+  const config = req.identityX && req.identityX.config;
+
+  const googleAuth = config ? config.getAsObject('googleAuth') : {};
+
+  const clientId = input.clientId || googleAuth.clientId || '';
+
+  const redirectTo = input.redirectTo || '';
+
+  const label = input.label || 'Or sign in with Google';
+
+  const signInButtonEnabled = googleAuth.signInButtonEnabled !== false;
+
+  if (clientId && signInButtonEnabled) {
+    out.w("<div class=\"google-sign-in\"><p class=\"google-sign-in__divider\">" +
+      marko_escapeXml(label) +
+      "</p><div class=\"g_id_signin\" data-type=\"standard\" data-theme=\"outline\" data-text=\"signin_with\" data-shape=\"rectangular\" data-logo_alignment=\"left\" data-width=\"300\"></div><p id=\"google-sign-in-error\" class=\"google-sign-in__error\" style=\"display:none;\" role=\"alert\"></p><script>" +
+      marko_escapeScript(("window.__googleSignInRedirectTo = " + JSON.stringify(redirectTo)) + ";") +
+      "</script></div>");
+  }
+}
+
+marko_template._ = marko_renderer(render, {
+    d_: true,
+    e_: marko_componentType
+  });
+
+marko_template.meta = {
+    id: "/@mindful-web/marko-web-identity-x$1.78.0/components/google-sign-in-button.marko"
+  };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.78.0/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.78.0/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/marko.json

@@ -95,6 +95,8 @@
       "type": "string",
       "required": true
     },
+    "@type": "string",
+    "@content-entity": "string",
     "@title": "string",
     "@description": "string",
     "@url": "string",
@@ -106,5 +108,14 @@
   "<marko-web-identity-x-identify>": {
     "template": "./identify.marko",
     "@provider-data": "object"
+  },
+  "<marko-web-identity-x-google-init>": {
+    "template": "./google-init.marko"
+  },
+  "<marko-web-identity-x-google-sign-in-button>": {
+    "template": "./google-sign-in-button.marko",
+    "@client-id": "string",
+    "@redirect-to": "string",
+    "@label": "string"
   }
 }

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.78.0/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.78.0/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.76.7/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.78.0/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.76.7/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.78.0/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/config.js

@@ -16,6 +16,13 @@ class IdentityXConfiguration {
    * @param {string[]} [options.activeCustomFieldIds] Limit displayed custom fields, if present.
    * @param {string[]} [options.hiddenFields] The fields to hide from the profile.
    * @param {function} [options.onHookError]
+   * @param {object} [options.googleAuth] Google Sign-In config. When `clientId` is
+   *   set, the One-Tap prompt / "Sign in with Google" button render in the auth
+   *   templates and `POST /__idx/google` accepts credentials. Dormant otherwise.
+   * @param {string} [options.googleAuth.clientId] GIS OAuth client id — the master gate.
+   * @param {("profile-gate"|"immediate"|"relaxed")} [options.googleAuth.missingFieldsBehavior]
+   * @param {boolean} [options.googleAuth.autoPrompt] Show the floating One-Tap overlay.
+   * @param {boolean} [options.googleAuth.signInButtonEnabled] Render the button (default true).
    * @param {object} options.rest
    */
   constructor({
@@ -31,6 +38,7 @@ class IdentityXConfiguration {
     defaultCountryCode,
     booleanQuestionsLabel,
     gtmUserFields = {},
+    googleAuth = {},
     onHookError,
     ...rest
   } = {}) {
@@ -49,6 +57,7 @@ class IdentityXConfiguration {
       defaultCountryCode,
       booleanQuestionsLabel,
       gtmUserFields,
+      googleAuth,
       onHookError: (e) => {
         if (process.env.NODE_ENV === 'development') {
           log('ERROR IN IDENTITY-X HOOK', e);
@@ -141,6 +150,14 @@ class IdentityXConfiguration {
     return this.getAsArray('activeCustomFieldIds');
   }
 
+  /**
+   * The Google Sign-In config block. Empty object when unconfigured, so a missing
+   * `clientId` reads as falsy and the feature stays dormant.
+   */
+  getGoogleAuth() {
+    return this.getAsObject('googleAuth');
+  }
+
   getAdditionalCustomFieldIds() {
     return this.getAsArray('additionalCustomFieldIds');
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.76.7",
+  "version": "1.78.0",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -24,6 +24,7 @@
     "cookie": "0.3.1",
     "dayjs": "^1.11.7",
     "express": "^4.18.2",
+    "google-auth-library": "^9.0.0",
     "graphql-tag": "^2.12.6",
     "i18n-iso-countries": "^4.3.1",
     "jsonwebtoken": "^8.5.1",
@@ -37,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "e6fc8615e76b1f00858bb0595230e652275c7333"
+  "gitHead": "0cedd578e969f7a2581c1dbc142351dd02b0b705"
 }

package/routes/google.js

@@ -0,0 +1,206 @@
+const gql = require('graphql-tag');
+const { OAuth2Client } = require('google-auth-library');
+const { asyncRoute } = require('@mindful-web/utils');
+const IMPERSONATE_APP_USER = require('../api/mutations/impersonate-app-user');
+const tokenCookie = require('../utils/token-cookie');
+const contextCookie = require('../utils/context-cookie');
+const callHooksFor = require('../utils/call-hooks-for');
+
+const UPDATE_OWN_APP_USER = gql`
+  mutation GoogleSignInUpdateUser($input: UpdateOwnAppUserMutationInput!) {
+    updateOwnAppUser(input: $input) { id givenName familyName }
+  }
+`;
+
+const isEmpty = (v) => v == null || v === '';
+
+const LOGIN_SOURCE = 'google-one-tap';
+
+// Namespace under which the Google account id (the JWT `sub`) is stored as an
+// idx external id, mirroring the Omeda { provider, tenant, type } convention.
+// These values must remain stable — changing them orphans existing links.
+const GOOGLE_NAMESPACE = { provider: 'google', tenant: 'oauth', type: 'account' };
+
+// eslint-disable-next-line no-console
+const defaultOnError = (e) => console.error('[identity-x google-auth]', e);
+
+/**
+ * `POST /__idx/google` — the Google Sign-In route. Handles both the One-Tap
+ * prompt and the "Sign in with Google" button; both surfaces post here.
+ *
+ * Verifies the Google credential, finds-or-creates the IdentityX app user, links
+ * the Google account id (`sub`) as an external id, impersonates the user to mint
+ * a session token, and fires the standard `onLoginLinkSent` /
+ * `onAuthenticationSuccess` hooks so downstream integrations (e.g. Omeda
+ * rapid-identify + subscription sync) run exactly as they do for email-link
+ * users.
+ *
+ * Configuration lives on the IdentityX config under the `googleAuth` key
+ * (`{ clientId, missingFieldsBehavior, autoPrompt, signInButtonEnabled }`). The
+ * route is dormant until `clientId` is set: no client id ⇒ 400.
+ *
+ * Non-fatal errors from the supplementary `sub`-linkage are reported through the
+ * IdentityX config's `onHookError` (the same reporter sites already wire to
+ * newrelic for hook failures), falling back to `console.error`.
+ */
+module.exports = asyncRoute(async (req, res) => {
+  /** @type {import('../service')} */
+  const { identityX, body } = req;
+  const { credential, redirectTo } = body;
+  const { config } = identityX;
+  const onError = config.get('onHookError') || defaultOnError;
+
+  const { clientId, missingFieldsBehavior = 'profile-gate' } = config.getAsObject('googleAuth');
+
+  if (!clientId) {
+    res.status(400).json({ ok: false, error: 'Google Sign-In is not configured for this site.' });
+    return;
+  }
+  if (!credential) {
+    res.status(400).json({ ok: false, error: 'No Google credential was provided.' });
+    return;
+  }
+
+  // Verify the Google JWT and extract user info.
+  const oauthClient = new OAuth2Client(clientId);
+  const ticket = await oauthClient.verifyIdToken({ idToken: credential, audience: clientId });
+  const googlePayload = ticket.getPayload();
+  const {
+    email,
+    given_name: givenName,
+    family_name: familyName,
+    sub: googleSub,
+  } = googlePayload;
+
+  if (!email) throw new Error('Google credential did not include an email address.');
+
+  // Find or create the identity-x user.
+  let appUser = await identityX.loadAppUserByEmail(email);
+  const createdNewUser = !appUser;
+  if (!appUser) {
+    appUser = await identityX.createAppUser({ email });
+  }
+
+  // Persist the Google account id (the JWT `sub`) as an idx external id so the
+  // user is linked to its Google identity. Email stays the primary key; this is
+  // supplementary provenance and must never block sign-in.
+  if (googleSub) {
+    const alreadyLinked = (appUser.externalIds || []).some((extId) => (
+      extId.namespace
+      && extId.namespace.provider === GOOGLE_NAMESPACE.provider
+      && extId.identifier
+      && extId.identifier.value === googleSub
+    ));
+    if (!alreadyLinked) {
+      try {
+        // If this sub is already attached to a different user (e.g. the Google
+        // account's email changed and a new user was created under it), report
+        // and skip rather than fanning the sub across two users.
+        const existing = await identityX.findUserByExternalId({
+          identifier: googleSub,
+          namespace: GOOGLE_NAMESPACE,
+          type: 'sub',
+        });
+        if (existing && existing.id !== appUser.id) {
+          onError(new Error(
+            `Google sub already linked to idx user ${existing.id}, not ${appUser.id}`,
+          ));
+        } else {
+          await identityX.addExternalUserId({
+            userId: appUser.id,
+            identifier: { value: googleSub, type: 'sub' },
+            namespace: GOOGLE_NAMESPACE,
+          });
+        }
+      } catch (e) {
+        // Supplementary linkage — never block authentication on a failure here.
+        onError(e);
+      }
+    }
+  }
+
+  // Impersonate the user with verify: true — marks them as verified and returns
+  // a session token, bypassing the normal email-link flow.
+  const { data: impersonateData } = await identityX.client.mutate({
+    mutation: IMPERSONATE_APP_USER,
+    variables: {
+      input: {
+        id: appUser.id,
+        method: 'GOOGLE_ONE_TAP',
+        verify: true,
+      },
+    },
+    context: { apiToken: identityX.getOrgUserApiToken() },
+  });
+  const { token: authToken } = impersonateData.impersonateAppUser;
+
+  tokenCookie.setTo(res, authToken.value);
+  contextCookie.setTo(res, { loginSource: LOGIN_SOURCE });
+  identityX.setIdentityCookie(appUser.id);
+
+  // Re-init the Apollo client with the user's own session token so that
+  // updateOwnAppUser is authenticated as this user (not as the org admin).
+  identityX.setToken(authToken);
+
+  // Set name fields from Google as verified data if not already present.
+  const needsNameUpdate = !appUser.givenName || !appUser.familyName;
+  if (needsNameUpdate && (givenName || familyName)) {
+    const nameInput = {};
+    if (givenName && !appUser.givenName) nameInput.givenName = givenName;
+    if (familyName && !appUser.familyName) nameInput.familyName = familyName;
+    await identityX.client.mutate({
+      mutation: UPDATE_OWN_APP_USER,
+      variables: { input: nameInput },
+    });
+  }
+
+  // Load the refreshed user so hooks and field checks have up-to-date data.
+  const user = await identityX.findUserById(appUser.id);
+  const entity = await identityX.generateEntityId({ userId: appUser.id });
+
+  // For profile-gate: check whether the user is actually missing required fields
+  // rather than using forceProfileReVerification, which isn't cleared by a normal
+  // /user/profile submission and would redirect complete users on every sign-in.
+  let requiresUserInput = false;
+  if (missingFieldsBehavior === 'profile-gate') {
+    const requiredFields = [
+      ...config.getRequiredServerFields(),
+      ...config.getRequiredClientFields(),
+    ];
+    requiresUserInput = requiredFields.some((key) => isEmpty(user[key]));
+  }
+
+  // Fire onLoginLinkSent before onAuthenticationSuccess so that hooks wired to
+  // it (e.g. Omeda rapid-identify and subscription sync) run for Google users
+  // the same way they do for email-link users.  This also populates
+  // user.externalIds with the Omeda encryptedCustomerId so the subsequent
+  // onAuthenticationSuccess hook can set oly_enc_id in the response.
+  await callHooksFor(identityX, 'onLoginLinkSent', {
+    req,
+    source: LOGIN_SOURCE,
+    user,
+  });
+
+  // Re-fetch so onAuthenticationSuccess sees the externalIds written by
+  // the onLoginLinkSent hook (Omeda rapid-identify).
+  const userAfterLinkSent = await identityX.findUserById(appUser.id);
+
+  await callHooksFor(identityX, 'onAuthenticationSuccess', {
+    req,
+    res,
+    user: userAfterLinkSent,
+    authToken,
+    loginSource: LOGIN_SOURCE,
+    additionalEventData: { createdNewUser, requiresUserInput },
+  });
+
+  res.json({
+    ok: true,
+    requiresUserInput,
+    redirectTo: redirectTo || null,
+    applicationId: config.getAppId(),
+    user: userAfterLinkSent,
+    loginSource: LOGIN_SOURCE,
+    entity,
+  });
+});

package/routes/index.js

@@ -11,6 +11,7 @@ const countries = require('./countries');
 const createComment = require('./create-comment');
 const download = require('./download');
 const flagComment = require('./flag-comment');
+const google = require('./google');
 const login = require('./login');
 const loginFields = require('./login-fields');
 const logout = require('./logout');
@@ -31,6 +32,7 @@ router.post('/change-email/initiate', changeEmailInit);
 router.post('/comment', createComment);
 router.post('/comment/flag/:id', flagComment);
 router.post('/download', download);
+router.post('/google', google);
 router.post('/login-fields', loginFields);
 router.post('/login', login);
 router.post('/logout', logout);

package/routes/logout.js

@@ -7,6 +7,11 @@ module.exports = asyncRoute(async (req, res) => {
   /** @type {import('../middleware').IdentityXRequest} */
   const { identityX } = req;
   contextCookie.removeFrom(res);
+  // Clear the Google Identity Services `g_state` cookie so a subsequent Google
+  // sign-in (especially with a *different* account) isn't blocked by stale
+  // auto-select state. GIS only loads for unauthenticated users, so nothing else
+  // resets this on logout. Harmless no-op for sites not using Google Sign-In.
+  res.clearCookie('g_state', { path: '/' });
   const token = tokenCookie.getFrom(req);
   if (!token) {
     await callHooksFor(identityX, 'onLogout', { req, res });