@mindful-web/marko-web-identity-x 1.80.0 → 1.80.1

package/CLAUDE.md

@@ -150,6 +150,26 @@ so it bails, writes no `autoSignups`, and **no `subscribe` conversion is ever re
 `idxAutoSignupCount: 0` seen on every completed One Tap sign-in on overdriveonline.com. Safe to await
 only because the Omeda client now has a request timeout.
 
+**The name backfill is non-fatal, and must stay that way.** `GoogleSignInUpdateUser`
+(`updateOwnAppUser`) is the **only** call in this route authenticated as the *user* rather than the
+org — every other one passes `context: { apiToken: getOrgUserApiToken() }` — so it is the only one
+depending on the session token minted moments earlier already being readable. Production shows it
+returning *"The provided value is not a valid token"*, while the same token value works on the very
+next request arriving from the cookie: a read-after-write race on the idx token store. Retried once
+for that reason.
+
+Non-fatal matters more than the retry. It backfills a first and last name — cosmetic — but
+`tokenCookie.setTo` has **already run**, so the user is authenticated by the time it executes.
+Throwing turned a fully successful sign-in into a 500, and the client, seeing `!data.ok`, ran `fail()`
+and redirected a *logged-in* user to `/user/login`. A missing display name must never cost someone
+their session. Failures report through `onHookError` and the route continues.
+
+`FACET idxNameBackfill` (`ok` | `retried` | `failed`) distinguishes the two bugs that share this one
+error message: if `retried` dominates it is the race; if `failed` dominates the impersonation token
+simply cannot authorize this mutation, and the fix is to stop using it — backfill before impersonation
+via `setUnverifiedAppUserData` (org-token, but writes *unverified* data, so it is a semantic change
+worth deciding deliberately).
+
 `idxGoogleStepMs` records elapsed ms at the start of each step, making the route self-profiling:
 `FACET idxGoogleStep SELECT max(idxGoogleStepMs)` shows where the ~12s on a *successful* sign-in
 goes, and a request that dies mid-flight still reports how far it got. Responds `{ ok, requiresUserInput,
@@ -218,7 +238,8 @@ meter / gate.
 **Telemetry.** Two seams. Neither needs site configuration:
 - `config.addRequestAttributes` — called with a flat object as the route progresses
   (`idxGoogleStep`, `idxUserId`, `idxCreatedNewUser`, `idxRequiresUserInput`, `idxGoogleSurface`,
-  `idxGoogleMissingFieldsBehavior`, `idxAutoSignupCount`, `idxImpersonateAttempts`). **Defaults to `utils/add-custom-attributes.js`**, which tags
+  `idxGoogleMissingFieldsBehavior`, `idxAutoSignupCount`, `idxImpersonateAttempts`,
+  `idxNameBackfill`, `idxNameBackfillAttempts`). **Defaults to `utils/add-custom-attributes.js`**, which tags
   the current New Relic transaction, so the attributes ride on the `Transaction` *and* any
   `TransactionError` it produces — a 500 says which step failed instead of being a bare GraphQL
   message. That default resolves the agent **only if the app already loaded it** (checks

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -239,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.0/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.0/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.80.0",
+  "version": "1.80.1",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "564bbee92cbb8f659f8fc6e7cf8991f8d647dec3"
+  "gitHead": "956e3462d636f6e7785c1e82b99d66b4c410e9df"
 }

package/routes/google.js

@@ -33,6 +33,24 @@ const LOGIN_SOURCE = 'google-one-tap';
 const IMPERSONATE_MAX_ATTEMPTS = 2;
 const IMPERSONATE_RETRY_DELAY_MS = 250;
 
+// Same shape as the impersonation retry, and for the same suspected cause: a
+// read-after-write race, this time on the token the previous step just minted.
+const NAME_BACKFILL_MAX_ATTEMPTS = 2;
+const NAME_BACKFILL_RETRY_DELAY_MS = 250;
+
+/**
+ * A session token that the idx API does not (yet) recognise.
+ *
+ * Apollo exposes GraphQL errors both individually on `graphQLErrors` and folded
+ * into `error.message` as "GraphQL error: <message>"; check both so this does not
+ * depend on which shape the caller happens to see.
+ */
+const isFreshTokenError = (e) => {
+  if (!e) return false;
+  const messages = [e.message, ...asArray(e.graphQLErrors).map((g) => g && g.message)];
+  return messages.some((m) => /not a valid token|invalid token|token was not found/i.test(String(m)));
+};
+
 /**
  * Transport-level failures only — a timeout, reset or DNS blip is worth
  * repeating; a GraphQL validation or authorization error is not, and repeating
@@ -266,10 +284,55 @@ module.exports = asyncRoute(async (req, res) => {
   if (familyName && !appUser.familyName) nameInput.familyName = familyName;
   if (Object.keys(nameInput).length) {
     setStep('update-own-app-user');
-    await identityX.client.mutate({
-      mutation: UPDATE_OWN_APP_USER,
-      variables: { input: nameInput },
-    });
+    // This is the ONLY call in the route authenticated as the *user* rather than
+    // the org — every other one passes `context: { apiToken: getOrgUserApiToken() }`
+    // — so it is the only one that depends on the session token minted moments
+    // earlier already being readable. That is exactly why it is the only
+    // operation reported failing: production shows `GoogleSignInUpdateUser`
+    // returning "The provided value is not a valid token".
+    //
+    // The same token value works on the *next* request, arriving from the cookie
+    // set above — which is what makes a read-after-write race on the idx token
+    // store the leading explanation, so retry once.
+    //
+    // Non-fatal regardless of the cause, which matters more than the retry. This
+    // backfills a first and last name; it is cosmetic. But `tokenCookie.setTo`
+    // has already run, so the user IS authenticated by the time we get here —
+    // throwing turned a fully successful sign-in into a 500, and the client, on
+    // seeing `!data.ok`, ran `fail()` and redirected a logged-in user to
+    // /user/login. A missing display name must never cost someone their session.
+    let backfill = 'ok';
+    let attempts = 0;
+    for (;;) {
+      attempts += 1;
+      try {
+        // eslint-disable-next-line no-await-in-loop
+        await identityX.client.mutate({
+          mutation: UPDATE_OWN_APP_USER,
+          variables: { input: nameInput },
+        });
+        break;
+      } catch (e) {
+        const retryable = attempts < NAME_BACKFILL_MAX_ATTEMPTS
+          && (isFreshTokenError(e) || isRetryableIdxError(e));
+        if (!retryable) {
+          backfill = 'failed';
+          onError(e, {
+            idxGoogleStep: 'update-own-app-user',
+            idxUserId: appUser.id,
+            idxNameBackfillAttempts: attempts,
+          });
+          break;
+        }
+        backfill = 'retried';
+        // eslint-disable-next-line no-await-in-loop
+        await sleep(NAME_BACKFILL_RETRY_DELAY_MS);
+      }
+    }
+    // Measurable: `FACET idxNameBackfill` separates "the retry rescues it" (a
+    // race) from "it always fails" (an impersonation token that simply cannot
+    // authorize this mutation) — two different bugs with one error message.
+    addAttrs({ idxNameBackfill: backfill, idxNameBackfillAttempts: attempts });
   }
 
   // Load the refreshed user so hooks and field checks have up-to-date data.