@mindful-web/marko-web-identity-x 1.79.6 → 1.79.7

package/CLAUDE.md

@@ -119,6 +119,35 @@ login/authenticate pages get the button with **no per-site edit**. For the site-
 document layout, gated on `!req.identityX.token`. The button tag can also be placed in a content
 meter / gate.
 
+**Telemetry.** Two seams. Neither needs site configuration:
+- `config.addRequestAttributes` — called with a flat object as the route progresses
+  (`idxGoogleStep`, `idxUserId`, `idxCreatedNewUser`, `idxRequiresUserInput`, `idxGoogleSurface`,
+  `idxGoogleMissingFieldsBehavior`). **Defaults to `utils/add-custom-attributes.js`**, which tags
+  the current New Relic transaction, so the attributes ride on the `Transaction` *and* any
+  `TransactionError` it produces — a 500 says which step failed instead of being a bare GraphQL
+  message. That default resolves the agent **only if the app already loaded it** (checks
+  `require.cache`, never requires it cold — requiring `newrelic` would *start* an agent on sites
+  that don't use it), so it arrives fleet-wide on a dep bump and is inert everywhere else. Pass a
+  function to override, or a no-op to disable. Deliberately **not** `noticeError`: that records a
+  second error next to the one the error handler already captures and doubles the counts.
+- `config.onHookError` — non-fatal errors, now called as `(error, customAttributes)` to match
+  `newrelic.noticeError`. The Google `sub` linkage failures report through it with their step and
+  user id, which keeps them distinguishable from fatal errors on the same route (they arrive on a
+  200).
+
+Client-side, `fail()` fires a p1events `Identity / Authenticate Failed` event mirroring the success
+event. There is no New Relic Browser agent on the monorail sites, so without it a client-side
+failure reaches no backend at all. The originating surface (`button` | `prompt`, from GIS
+`select_by`) is posted to the route as `body.surface` — both surfaces otherwise share a route, a
+`loginSource` and an impersonation method, so nothing server-side could tell them apart.
+
+**Failure handling.** All client-side failures funnel through `fail()` in `google-init.marko`: it
+always `console.error`s, writes to `#google-sign-in-error` when that element is on the page (it is
+rendered by `google-sign-in-button.marko`, so it exists only where the button does), and otherwise
+— the site-wide floating prompt case — redirects to the login endpoint with `?redirectTo=`. Never
+let a failure be a silent no-op: GIS closes the prompt on its own, so the user reads "nothing
+happened" as success and only discovers they're anonymous on the next page load.
+
 **CSS.** `.google-sign-in` styles ship in `marko-web-theme-monorail/scss/components/_identity-x.scss`
 (with the rest of the auth CSS) — no separate import.
 

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko

@@ -2,6 +2,7 @@ $ const { req } = out.global;
 $ const config = req.identityX && req.identityX.config;
 $ const { clientId, autoPrompt } = config ? config.getAsObject('googleAuth') : {};
 $ const callbackName = 'handleGoogleOneTapCredential';
+$ const loginUrl = config ? config.getEndpointFor('login') : '/user/login';
 $ const initScript = `
 (function() {
   window.${callbackName} = function(response) {
@@ -12,24 +13,94 @@ $ const initScript = `
     // GIS 'select_by' distinguishes the surface: a 'btn*' value means the
     // rendered "Sign in with Google" button, 'user*'/'auto' means the One-Tap
     // prompt. Used to label the p1events authentication event accordingly.
-    var eventLabel = String(response.select_by || '').indexOf('btn') === 0
-      ? 'Google Sign In'
-      : 'Google One Tap';
+    var isButton = String(response.select_by || '').indexOf('btn') === 0;
+    var eventLabel = isButton ? 'Google Sign In' : 'Google One Tap';
+
+    // Every failure path routes through here. The site-wide floating One-Tap
+    // prompt renders outside any form, so there is no '#google-sign-in-error'
+    // element on the page — previously that meant a failed sign-in did nothing
+    // at all: GIS closed the prompt, the user assumed success, and only found
+    // out they were still anonymous on the next page load. Always log, and
+    // fall back to the login page when there's nowhere to show the message.
+    var authenticated = false;
+    function fail(message, detail) {
+      if (window.console && window.console.error) {
+        window.console.error('[identity-x google-auth] ' + message, detail);
+      }
+      // There is no New Relic Browser agent on these sites, so a client-side
+      // failure reaches no backend at all unless we send one. p1events is
+      // already on every page -- mirror the success event so failed sign-ins
+      // are countable next to successful ones rather than invisible.
+      if (window.p1events) {
+        window.p1events('track', {
+          category: 'Identity',
+          action: 'Authenticate Failed',
+          label: eventLabel,
+          props: {
+            actionSource: 'google-one-tap',
+            surface: isButton ? 'button' : 'prompt',
+            message: message,
+            status: detail && detail.status ? detail.status : null,
+          },
+        });
+      }
+      // The session cookie is already set — a throw in the post-success
+      // analytics/redirect code must not bounce an authenticated user to login.
+      if (authenticated) return;
+      if (errorEl) {
+        errorEl.textContent = message;
+        errorEl.style.display = 'block';
+        return;
+      }
+      var returnTo = window.location.pathname + window.location.search;
+      window.location.href = ${JSON.stringify(loginUrl)} + '?redirectTo=' + encodeURIComponent(returnTo);
+    }
 
     fetch('/__idx/google', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ credential: response.credential, redirectTo: redirectTo }),
+      body: JSON.stringify({
+        credential: response.credential,
+        redirectTo: redirectTo,
+        // Lets the server tag its telemetry with the originating surface --
+        // both post here and are otherwise indistinguishable server-side.
+        surface: isButton ? 'button' : 'prompt',
+      }),
     })
-      .then(function(res) { return res.json(); })
-      .then(function(data) {
+      // Parse defensively: a 5xx from the idx router returns
+      // { error, status, message } (no 'ok'), and an upstream proxy can return
+      // HTML that would otherwise blow up res.json() into the generic catch.
+      .then(function(res) {
+        return res.text().then(function(text) {
+          var parsed = {};
+          try { parsed = JSON.parse(text); } catch (e) { /* non-JSON response */ }
+          return { status: res.status, redirected: res.redirected, url: res.url, data: parsed };
+        });
+      })
+      .then(function(result) {
+        var data = result.data;
         if (!data.ok) {
-          if (errorEl) {
-            errorEl.textContent = data.error || 'Google sign-in failed. Please try again.';
-            errorEl.style.display = 'block';
+          // A 301/302 on this POST (host canonicalization — apex -> www, or
+          // http -> https) is re-issued by the browser as a GET with the body
+          // dropped. The idx router only registers POST /__idx/google, so the
+          // redirected request falls through to a 404 and the sign-in is lost.
+          // Call that out by name rather than reporting a generic failure.
+          if (result.redirected) {
+            fail(
+              'Google sign-in failed: the request was redirected to ' + result.url
+                + ', which turns it into a GET and drops the credential. '
+                + 'Serve this page from the canonical host.',
+              { status: result.status }
+            );
+            return;
           }
+          fail(
+            data.error || data.message || 'Google sign-in failed. Please try again.',
+            { status: result.status }
+          );
           return;
         }
+        authenticated = true;
         if (window.p1events) {
           // De-anonymize the session to the app user, then record the
           // authentication — mirrors the identity-x conversion events.
@@ -65,11 +136,8 @@ $ const initScript = `
           window.location.href = data.redirectTo || window.location.href;
         }
       })
-      .catch(function() {
-        if (errorEl) {
-          errorEl.textContent = 'An error occurred during Google sign-in. Please try again.';
-          errorEl.style.display = 'block';
-        }
+      .catch(function(e) {
+        fail('An error occurred during Google sign-in. Please try again.', e);
       });
   };
 })();

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -18,6 +18,8 @@ function render(input, out, __component, component, state) {
 
   const callbackName = 'handleGoogleOneTapCredential';
 
+  const loginUrl = config ? config.getEndpointFor('login') : '/user/login';
+
   const initScript = `
 (function() {
   window.${callbackName} = function(response) {
@@ -28,24 +30,94 @@ function render(input, out, __component, component, state) {
     // GIS 'select_by' distinguishes the surface: a 'btn*' value means the
     // rendered "Sign in with Google" button, 'user*'/'auto' means the One-Tap
     // prompt. Used to label the p1events authentication event accordingly.
-    var eventLabel = String(response.select_by || '').indexOf('btn') === 0
-      ? 'Google Sign In'
-      : 'Google One Tap';
+    var isButton = String(response.select_by || '').indexOf('btn') === 0;
+    var eventLabel = isButton ? 'Google Sign In' : 'Google One Tap';
+
+    // Every failure path routes through here. The site-wide floating One-Tap
+    // prompt renders outside any form, so there is no '#google-sign-in-error'
+    // element on the page — previously that meant a failed sign-in did nothing
+    // at all: GIS closed the prompt, the user assumed success, and only found
+    // out they were still anonymous on the next page load. Always log, and
+    // fall back to the login page when there's nowhere to show the message.
+    var authenticated = false;
+    function fail(message, detail) {
+      if (window.console && window.console.error) {
+        window.console.error('[identity-x google-auth] ' + message, detail);
+      }
+      // There is no New Relic Browser agent on these sites, so a client-side
+      // failure reaches no backend at all unless we send one. p1events is
+      // already on every page -- mirror the success event so failed sign-ins
+      // are countable next to successful ones rather than invisible.
+      if (window.p1events) {
+        window.p1events('track', {
+          category: 'Identity',
+          action: 'Authenticate Failed',
+          label: eventLabel,
+          props: {
+            actionSource: 'google-one-tap',
+            surface: isButton ? 'button' : 'prompt',
+            message: message,
+            status: detail && detail.status ? detail.status : null,
+          },
+        });
+      }
+      // The session cookie is already set — a throw in the post-success
+      // analytics/redirect code must not bounce an authenticated user to login.
+      if (authenticated) return;
+      if (errorEl) {
+        errorEl.textContent = message;
+        errorEl.style.display = 'block';
+        return;
+      }
+      var returnTo = window.location.pathname + window.location.search;
+      window.location.href = ${JSON.stringify(loginUrl)} + '?redirectTo=' + encodeURIComponent(returnTo);
+    }
 
     fetch('/__idx/google', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ credential: response.credential, redirectTo: redirectTo }),
+      body: JSON.stringify({
+        credential: response.credential,
+        redirectTo: redirectTo,
+        // Lets the server tag its telemetry with the originating surface --
+        // both post here and are otherwise indistinguishable server-side.
+        surface: isButton ? 'button' : 'prompt',
+      }),
     })
-      .then(function(res) { return res.json(); })
-      .then(function(data) {
+      // Parse defensively: a 5xx from the idx router returns
+      // { error, status, message } (no 'ok'), and an upstream proxy can return
+      // HTML that would otherwise blow up res.json() into the generic catch.
+      .then(function(res) {
+        return res.text().then(function(text) {
+          var parsed = {};
+          try { parsed = JSON.parse(text); } catch (e) { /* non-JSON response */ }
+          return { status: res.status, redirected: res.redirected, url: res.url, data: parsed };
+        });
+      })
+      .then(function(result) {
+        var data = result.data;
         if (!data.ok) {
-          if (errorEl) {
-            errorEl.textContent = data.error || 'Google sign-in failed. Please try again.';
-            errorEl.style.display = 'block';
+          // A 301/302 on this POST (host canonicalization — apex -> www, or
+          // http -> https) is re-issued by the browser as a GET with the body
+          // dropped. The idx router only registers POST /__idx/google, so the
+          // redirected request falls through to a 404 and the sign-in is lost.
+          // Call that out by name rather than reporting a generic failure.
+          if (result.redirected) {
+            fail(
+              'Google sign-in failed: the request was redirected to ' + result.url
+                + ', which turns it into a GET and drops the credential. '
+                + 'Serve this page from the canonical host.',
+              { status: result.status }
+            );
+            return;
           }
+          fail(
+            data.error || data.message || 'Google sign-in failed. Please try again.',
+            { status: result.status }
+          );
           return;
         }
+        authenticated = true;
         if (window.p1events) {
           // De-anonymize the session to the app user, then record the
           // authentication — mirrors the identity-x conversion events.
@@ -81,11 +153,8 @@ function render(input, out, __component, component, state) {
           window.location.href = data.redirectTo || window.location.href;
         }
       })
-      .catch(function() {
-        if (errorEl) {
-          errorEl.textContent = 'An error occurred during Google sign-in. Please try again.';
-          errorEl.style.display = 'block';
-        }
+      .catch(function(e) {
+        fail('An error occurred during Google sign-in. Please try again.', e);
       });
   };
 })();
@@ -108,5 +177,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/config.js

@@ -1,6 +1,7 @@
 const { get, getAsArray, getAsObject } = require('@mindful-web/object-path');
 const { isFunction: isFn } = require('@mindful-web/utils');
 const validHooks = require('./hooks');
+const defaultAddRequestAttributes = require('./utils/add-custom-attributes');
 
 const { log } = console;
 
@@ -15,7 +16,17 @@ class IdentityXConfiguration {
    * @param {string[]} [options.requiredCreateFieldRows] Required fields, when creating a new user.
    * @param {string[]} [options.activeCustomFieldIds] Limit displayed custom fields, if present.
    * @param {string[]} [options.hiddenFields] The fields to hide from the profile.
-   * @param {function} [options.onHookError]
+   * @param {function} [options.onHookError] Reporter for non-fatal errors. Called as
+   *   `(error, customAttributes)` — matches `newrelic.noticeError`.
+   * @param {function} [options.addRequestAttributes] Sink for per-request telemetry,
+   *   called with a flat object of primitives. **Defaults to tagging the current New
+   *   Relic transaction** when the app has already loaded the agent (every marko-web
+   *   site does, at boot) — so the attributes ride on both the `Transaction` and any
+   *   `TransactionError` it produces, and a 500 arrives already saying which step
+   *   failed and for whom. No site configuration required; inert without New Relic.
+   *   Deliberately not `noticeError` — that would record a second error alongside the
+   *   one the error handler already captures, and double the counts. Pass your own
+   *   function to override, or a no-op to disable.
    * @param {object} [options.googleAuth] Google Sign-In config. When `clientId` is
    *   set, the One-Tap prompt / "Sign in with Google" button render in the auth
    *   templates and `POST /__idx/google` accepts credentials. Dormant otherwise.
@@ -40,6 +51,7 @@ class IdentityXConfiguration {
     gtmUserFields = {},
     googleAuth = {},
     onHookError,
+    addRequestAttributes,
     ...rest
   } = {}) {
     if (!appId) throw new Error('Unable to configure IdentityX: no Application ID was provided.');
@@ -58,13 +70,18 @@ class IdentityXConfiguration {
       booleanQuestionsLabel,
       gtmUserFields,
       googleAuth,
-      onHookError: (e) => {
+      // Extra args are forwarded so callers can pass structured context —
+      // `newrelic.noticeError(error, customAttributes)` takes it natively.
+      onHookError: (e, ...args) => {
         if (process.env.NODE_ENV === 'development') {
-          log('ERROR IN IDENTITY-X HOOK', e);
+          log('ERROR IN IDENTITY-X HOOK', e, ...args);
           if (e.networkError) log('Network Error', get(e, 'networkError.result.errors.0'));
         }
-        if (isFn(onHookError)) onHookError(e);
+        if (isFn(onHookError)) onHookError(e, ...args);
       },
+      addRequestAttributes: isFn(addRequestAttributes)
+        ? addRequestAttributes
+        : defaultAddRequestAttributes,
       ...rest,
     };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.79.6",
+  "version": "1.79.7",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "ffb05490d900bcdc2d3a2230c6e41da40f9f07ce"
+  "gitHead": "cd09a3d725bbcb04b8a1ffae70164981bbe1305e"
 }

package/routes/google.js

@@ -14,6 +14,16 @@ const UPDATE_OWN_APP_USER = gql`
 
 const isEmpty = (v) => v == null || v === '';
 
+// Cache one OAuth2Client per client id. `verifyIdToken` fetches (and caches on
+// the *instance*) Google's public signing certs, so constructing a client per
+// request re-fetched them on every sign-in — turning a transient network blip
+// or rate-limit at Google into a failed sign-in.
+const oauthClients = new Map();
+const getOAuthClient = (clientId) => {
+  if (!oauthClients.has(clientId)) oauthClients.set(clientId, new OAuth2Client(clientId));
+  return oauthClients.get(clientId);
+};
+
 const LOGIN_SOURCE = 'google-one-tap';
 
 // Namespace under which the Google account id (the JWT `sub`) is stored as an
@@ -50,7 +60,21 @@ module.exports = asyncRoute(async (req, res) => {
   const { config } = identityX;
   const onError = config.get('onHookError') || defaultOnError;
 
+  // Tag the transaction as the route progresses. Whatever step is recorded when
+  // the request dies is the step that failed, so an error arrives already
+  // localized instead of being a bare GraphQL message to reverse-engineer.
+  const addAttrs = config.get('addRequestAttributes') || (() => {});
+  const setStep = (step) => addAttrs({ idxGoogleStep: step });
+
   const { clientId, missingFieldsBehavior = 'profile-gate' } = config.getAsObject('googleAuth');
+  // `surface` is the GIS `select_by` bucket ('button' | 'prompt'), sent by the
+  // client. Both surfaces share a route, a loginSource and an impersonation
+  // method, so without it there is no way to tell from the server whether the
+  // rendered button works independently of the One-Tap prompt.
+  addAttrs({
+    idxGoogleSurface: body.surface === 'button' ? 'button' : 'prompt',
+    idxGoogleMissingFieldsBehavior: missingFieldsBehavior,
+  });
 
   if (!clientId) {
     res.status(400).json({ ok: false, error: 'Google Sign-In is not configured for this site.' });
@@ -62,7 +86,8 @@ module.exports = asyncRoute(async (req, res) => {
   }
 
   // Verify the Google JWT and extract user info.
-  const oauthClient = new OAuth2Client(clientId);
+  setStep('verify-credential');
+  const oauthClient = getOAuthClient(clientId);
   const ticket = await oauthClient.verifyIdToken({ idToken: credential, audience: clientId });
   const googlePayload = ticket.getPayload();
   const {
@@ -75,11 +100,14 @@ module.exports = asyncRoute(async (req, res) => {
   if (!email) throw new Error('Google credential did not include an email address.');
 
   // Find or create the identity-x user.
+  setStep('load-app-user');
   let appUser = await identityX.loadAppUserByEmail(email);
   const createdNewUser = !appUser;
   if (!appUser) {
+    setStep('create-app-user');
     appUser = await identityX.createAppUser({ email });
   }
+  addAttrs({ idxUserId: appUser.id, idxCreatedNewUser: createdNewUser });
 
   // Persist the Google account id (the JWT `sub`) as an idx external id so the
   // user is linked to its Google identity. Email stays the primary key; this is
@@ -92,6 +120,7 @@ module.exports = asyncRoute(async (req, res) => {
       && extId.identifier.value === googleSub
     ));
     if (!alreadyLinked) {
+      setStep('link-google-sub');
       try {
         // If this sub is already attached to a different user (e.g. the Google
         // account's email changed and a new user was created under it), report
@@ -104,7 +133,7 @@ module.exports = asyncRoute(async (req, res) => {
         if (existing && existing.id !== appUser.id) {
           onError(new Error(
             `Google sub already linked to idx user ${existing.id}, not ${appUser.id}`,
-          ));
+          ), { idxGoogleStep: 'link-google-sub', idxUserId: appUser.id, idxConflictUserId: existing.id });
         } else {
           await identityX.addExternalUserId({
             userId: appUser.id,
@@ -114,11 +143,14 @@ module.exports = asyncRoute(async (req, res) => {
         }
       } catch (e) {
         // Supplementary linkage — never block authentication on a failure here.
-        onError(e);
+        // Reported with context so these stay distinguishable from fatal errors
+        // on the same route (they arrive on a 200).
+        onError(e, { idxGoogleStep: 'link-google-sub', idxUserId: appUser.id });
       }
     }
   }
 
+  setStep('impersonate-app-user');
   // Impersonate the user with verify: true — marks them as verified and returns
   // a session token, bypassing the normal email-link flow.
   const { data: impersonateData } = await identityX.client.mutate({
@@ -140,9 +172,13 @@ module.exports = asyncRoute(async (req, res) => {
 
   // Re-init the Apollo client with the user's own session token so that
   // updateOwnAppUser is authenticated as this user (not as the org admin).
-  identityX.setToken(authToken);
+  // `setToken` takes the token *string* — passing the `{ id, value }` object
+  // produced an `AppUser [object Object]` authorization header, which failed
+  // every subsequent user-authenticated call (see updateOwnAppUser below).
+  identityX.setToken(authToken.value);
 
   // Set name fields from Google as verified data if not already present.
+  setStep('update-own-app-user');
   const needsNameUpdate = !appUser.givenName || !appUser.familyName;
   if (needsNameUpdate && (givenName || familyName)) {
     const nameInput = {};
@@ -155,6 +191,7 @@ module.exports = asyncRoute(async (req, res) => {
   }
 
   // Load the refreshed user so hooks and field checks have up-to-date data.
+  setStep('load-refreshed-user');
   const user = await identityX.findUserById(appUser.id);
   const entity = await identityX.generateEntityId({ userId: appUser.id });
 
@@ -169,12 +206,14 @@ module.exports = asyncRoute(async (req, res) => {
     ];
     requiresUserInput = requiredFields.some((key) => isEmpty(user[key]));
   }
+  addAttrs({ idxRequiresUserInput: requiresUserInput });
 
   // Fire onLoginLinkSent before onAuthenticationSuccess so that hooks wired to
   // it (e.g. Omeda rapid-identify and subscription sync) run for Google users
   // the same way they do for email-link users.  This also populates
   // user.externalIds with the Omeda encryptedCustomerId so the subsequent
   // onAuthenticationSuccess hook can set oly_enc_id in the response.
+  setStep('hooks-login-link-sent');
   await callHooksFor(identityX, 'onLoginLinkSent', {
     req,
     source: LOGIN_SOURCE,
@@ -185,6 +224,7 @@ module.exports = asyncRoute(async (req, res) => {
   // the onLoginLinkSent hook (Omeda rapid-identify).
   const userAfterLinkSent = await identityX.findUserById(appUser.id);
 
+  setStep('hooks-authentication-success');
   await callHooksFor(identityX, 'onAuthenticationSuccess', {
     req,
     res,
@@ -194,6 +234,7 @@ module.exports = asyncRoute(async (req, res) => {
     additionalEventData: { createdNewUser, requiresUserInput },
   });
 
+  setStep('complete');
   res.json({
     ok: true,
     requiresUserInput,

package/service.js

@@ -355,8 +355,9 @@ class IdentityX {
   }
 
   /**
+   * Sets the active app-user token and re-inits the Apollo client with it.
    *
-   * @param {*} param0
+   * @param {String} token The token *value* (not the `{ id, value }` object).
    */
   setToken(token) {
     this.token = token;
@@ -379,7 +380,11 @@ class IdentityX {
     });
     const { token } = data.impersonateAppUser;
     tokenCookie.setTo(this.res, token.value);
-    this.setToken(token);
+    // `setToken` expects the token string (as the constructor supplies from the
+    // cookie) — passing the `{ id, value }` object here produced an
+    // `AppUser [object Object]` authorization header on the re-inited client,
+    // and left `this.token` as an object for `logoutAppUser`.
+    this.setToken(token.value);
   }
 
   async logoutAppUser() {

package/utils/add-custom-attributes.js

@@ -0,0 +1,50 @@
+/**
+ * Default sink for `config.addRequestAttributes` — tags the current New Relic
+ * transaction, with no configuration and no New Relic dependency.
+ *
+ * The agent is used **only when the application has already loaded it**. Every
+ * marko-web site requires its `newrelic.js` at boot, so by the time a request
+ * is served the module is in `require.cache` and `require('newrelic')` returns
+ * that same initialized singleton. Requiring it unconditionally would instead
+ * *start* an agent on sites that don't use New Relic, which is why this checks
+ * the cache rather than just try/catching the require.
+ *
+ * Net effect: attributes appear fleet-wide on a dependency bump alone, and the
+ * whole thing is inert on any site without New Relic. A site can still pass its
+ * own `addRequestAttributes` to override.
+ */
+
+let resolvedPath;
+let lookupFailed = false;
+let agent = null;
+
+const getAgent = () => {
+  if (agent) return agent;
+  if (lookupFailed) return null;
+  if (!resolvedPath) {
+    try {
+      resolvedPath = require.resolve('newrelic');
+    } catch (e) {
+      // Not installed — nothing to report to.
+      lookupFailed = true;
+      return null;
+    }
+  }
+  // `newrelic` is intentionally NOT a dependency of this package: declaring it
+  // would install it on every monorail site, and requiring an uninitialized
+  // agent starts one. We only ever pick up an instance the host app already
+  // created, which is why the cache check above guards this require.
+  // eslint-disable-next-line global-require, import/no-extraneous-dependencies
+  if (require.cache[resolvedPath]) agent = require('newrelic');
+  return agent;
+};
+
+module.exports = (attributes) => {
+  const nr = getAgent();
+  if (!nr || typeof nr.addCustomAttributes !== 'function') return;
+  try {
+    nr.addCustomAttributes(attributes);
+  } catch (e) {
+    // Telemetry must never break a request.
+  }
+};