@mindful-web/marko-web-identity-x 1.80.2 → 1.83.0

package/CLAUDE.md

@@ -184,9 +184,26 @@ simply cannot authorize this mutation, and the fix is to stop using it — backf
 via `setUnverifiedAppUserData` (org-token, but writes *unverified* data, so it is a semantic change
 worth deciding deliberately).
 
-`idxGoogleStepMs` records elapsed ms at the start of each step, making the route self-profiling:
-`FACET idxGoogleStep SELECT max(idxGoogleStepMs)` shows where the ~12s on a *successful* sign-in
-goes, and a request that dies mid-flight still reports how far it got. Responds `{ ok, requiresUserInput,
+**Timing comes in two parts, deliberately.** `idxGoogleStepMs` is elapsed-at-last-step and
+**last-write-wins** — on a completed request it is effectively total route time, and on one that dies
+mid-flight it says how far in it got. It cannot attribute time to a step: every `setStep` overwrites
+it, which is why the per-step breakdown it was originally meant to provide never actually survived
+(confirmed in production — the query returned one value per transaction, not a profile).
+
+`idxMs<Step>` is the real breakdown: one attribute per step (`idxMsVerifyCredential`,
+`idxMsImpersonateAppUser`, `idxMsHooksLoginLinkSent`, `idxMsHooksAuthenticationSuccess`, …), each
+holding how long **that step** took, emitted when the next step begins. `complete` has no duration of
+its own — it is a marker, not work. The durations sum to `idxGoogleStepMs`. About ten attributes, well
+inside New Relic's per-transaction budget.
+
+```
+SELECT average(idxMsHooksAuthenticationSuccess), average(idxMsImpersonateAppUser),
+       average(idxMsHooksLoginLinkSent), average(idxGoogleStepMs)
+FROM Transaction WHERE name LIKE '%__idx/google%'
+```
+
+Both hook steps sit on the blocking path and Omeda shows a ~4s tail, so this is what says whether
+they own the remaining latency. Responds `{ ok, requiresUserInput,
 redirectTo, user, entity, additionalEventData, … }`; the client redirects to `/user/profile` when
 input is required.
 

package/README.md

@@ -150,6 +150,24 @@ import IdentityX from '@mindful-web/marko-web-identity-x/browser';
 +});
 ```
 
+## Cookie lifetimes
+
+All cookie durations in this package are expressed in **milliseconds**, because that is the unit
+express's `res.cookie` `maxAge` option expects. Env vars and config keys that carry a duration are
+suffixed `_MS` / `Ms` so the unit is unambiguous at the call site.
+
+| Variable | Applies to | Default | Notes |
+| - | - | - | - |
+| `IDX_CONTENT_ACCESS_MAXAGE_MS` | `__idx_form_<surveyId>_<contentId>` (content access) | `86400000` (1 day) | |
+| `IDX_CONTENT_DOWNLOAD_MAXAGE_MS` | `__idx_form_content-download_<contentId>` | `86400000` (1 day) | |
+| `IDX_CONTENT_ACCESS_MAXAGE` | — | — | **Deprecated** alias of the `_MS` var above. |
+| `IDX_CONTENT_DOWNLOAD_MAXAGE` | — | — | **Deprecated** alias of the `_MS` var above. |
+
+The unsuffixed names are still honored, but avoid them in new deployments: `MAXAGE` reads as the HTTP
+`Max-Age` directive, which is in *seconds*, so a value of `86400` intended as "one day" silently
+produced an 86-second cookie. Non-numeric or non-positive values are ignored with a warning and the
+default applies, rather than sending `NaN` into `res.cookie` (which throws on every affected request).
+
 ## Vue Event emission
 
 This package emits the following events via the EventBus/global Vue root. Each payload will be an

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -239,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.2/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.0/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.2/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.0/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/middleware/content-access-state.js

@@ -1,15 +1,10 @@
 const { get, getAsObject } = require('@mindful-web/object-path');
-
-const cookieNamePrefix = '__idx_form';
-// default is one day
-const maxAge = process.env.IDX_CONTENT_ACCESS_MAXAGE
-  ? Number(process.env.IDX_CONTENT_ACCESS_MAXAGE)
-  : (24 * 60 * 60 * 1000);
+const { accessMaxAge, buildName } = require('../utils/content-form-cookie');
 
 const contentAccessState = ({ res, content }) => {
   // Handle setting of contentAccessState Object
   const { surveyType, surveyId } = getAsObject(content, 'gating');
-  const cookieName = `${cookieNamePrefix}_${surveyId}_${content.id}`;
+  const cookieName = buildName({ surveyId, contentId: content.id });
 
   const setFormDisplay = ({ req }) => {
     res.locals.contentAccessState.displayForm = !get(req, `cookies.${cookieName}`);
@@ -20,7 +15,7 @@ const contentAccessState = ({ res, content }) => {
   };
 
   if (surveyType === 'idx') {
-    const cookie = { name: cookieName, maxAge };
+    const cookie = { name: cookieName, maxAge: accessMaxAge() };
     res.locals.contentAccessState.formId = surveyId;
     res.locals.contentAccessState.cookie = cookie;
   }

package/middleware/content-download-state.js

@@ -1,14 +1,10 @@
 const { get } = require('@mindful-web/object-path');
-
-const cookieNamePrefix = '__idx_form';
-const maxAge = process.env.IDX_CONTENT_DOWNLOAD_MAXAGE
-  ? Number(process.env.IDX_CONTENT_DOWNLOAD_MAXAGE)
-  : (24 * 60 * 60 * 1000);
+const { DOWNLOAD_SURVEY_ID, buildName, downloadMaxAge } = require('../utils/content-form-cookie');
 
 const contentDownloadState = ({ res, content }) => {
   // Handle setting of contentDownloadState Object
-  const surveyId = 'content-download';
-  const cookieName = `${cookieNamePrefix}_${surveyId}_${content.id}`;
+  const surveyId = DOWNLOAD_SURVEY_ID;
+  const cookieName = buildName({ surveyId, contentId: content.id });
 
   const setFormDisplay = ({ req }) => {
     res.locals.contentDownloadState.displayForm = !get(req, `cookies.${cookieName}`);
@@ -17,7 +13,7 @@ const contentDownloadState = ({ res, content }) => {
     displayForm: false,
     setFormDisplay,
   };
-  const cookie = { name: cookieName, maxAge };
+  const cookie = { name: cookieName, maxAge: downloadMaxAge() };
   res.locals.contentDownloadState.formId = surveyId;
   res.locals.contentDownloadState.cookie = cookie;
 };

package/middleware.js

@@ -17,8 +17,11 @@ module.exports = (config) => asyncRoute(async (req, res, next) => {
 
   const cookie = service.getIdentity(res);
 
-  // Don't overwrite an existing cookie
-  if (cookie) return next();
+  // Don't overwrite an existing cookie, but do extend its expiration.
+  if (cookie) {
+    service.refreshIdentityCookie();
+    return next();
+  }
 
   // Set cookie for logged in users
   if (service.token) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.80.2",
+  "version": "1.83.0",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -13,9 +13,9 @@
     "test": "yarn compile --no-clean && yarn lint"
   },
   "dependencies": {
-    "@mindful-web/marko-web-gtm": "^1.80.2",
-    "@mindful-web/object-path": "^1.80.2",
-    "@mindful-web/utils": "^1.80.2",
+    "@mindful-web/marko-web-gtm": "^1.83.0",
+    "@mindful-web/object-path": "^1.83.0",
+    "@mindful-web/utils": "^1.83.0",
     "apollo-cache-inmemory": "^1.6.6",
     "apollo-client": "^2.6.10",
     "apollo-link-context": "^1.0.20",
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "59e2be57d4905ab42c5acfa590c270a8c12bfce7"
+  "gitHead": "2b694183f136fdd763ae0d1bc47843c5bf6e9290"
 }

package/routes/access.js

@@ -1,5 +1,6 @@
 const gql = require('graphql-tag');
 const { asyncRoute } = require('@mindful-web/utils');
+const { accessMaxAge, isValidName } = require('../utils/content-form-cookie');
 
 const mutation = gql`
   mutation StoreContentAccessSubmission($input: CreateContentAccessSubmissionMutationInput!) {
@@ -13,14 +14,24 @@ module.exports = asyncRoute(async (req, res) => {
   /** @type {import('../middleware').IdentityXRequest} */
   const { body, apollo, identityX } = req;
   const { contentId, payload, cookie } = body;
+
+  // Validate BEFORE the mutation: this previously destructured `cookie` blindly and passed its
+  // `maxAge` straight to `res.cookie`, so a missing key or non-numeric max age threw a 500 *after*
+  // the submission had already committed. The cookie's lifetime is never taken from the request --
+  // only its name, which must match one this app would have issued for this content.
+  const COOKIE_NAME = cookie && cookie.name;
+  if (!isValidName(COOKIE_NAME, contentId)) {
+    res.status(400).json({ ok: false, message: 'A valid content access cookie name is required.' });
+    return;
+  }
+
   const input = {
     contentId,
     payload,
     ipAddress: req.ip,
   };
-  const { name: COOKIE_NAME, maxAge } = cookie;
   await apollo.mutate({ mutation, variables: { input } });
-  res.cookie(COOKIE_NAME, true, { maxAge, httpOnly: false });
+  res.cookie(COOKIE_NAME, true, { maxAge: accessMaxAge(), httpOnly: false });
   const entity = await identityX.generateEntityId();
   res.json({
     ok: true,

package/routes/download.js

@@ -1,5 +1,6 @@
 const gql = require('graphql-tag');
 const { asyncRoute } = require('@mindful-web/utils');
+const { DOWNLOAD_SURVEY_ID, buildName, downloadMaxAge } = require('../utils/content-form-cookie');
 
 const mutation = gql`
   mutation StoreContentDownloadSubmission($input: CreateContentDownloadSubmissionMutationInput!) {
@@ -12,15 +13,26 @@ const mutation = gql`
 module.exports = asyncRoute(async (req, res) => {
   /** @type {import('../middleware').IdentityXRequest} */
   const { body, apollo, identityX } = req;
-  const { contentId, payload, cookie } = body;
+  const { contentId, payload } = body;
+
+  // Validate BEFORE the mutation: this previously destructured `cookie` from the body blindly and
+  // passed its `maxAge` straight to `res.cookie`, so a missing key or non-numeric max age threw a
+  // 500 *after* the submission had already committed. Unlike the access form, the download form's
+  // survey id is a fixed constant, so the cookie is derived entirely server-side and the body's
+  // `cookie` is ignored.
+  if (!contentId) {
+    res.status(400).json({ ok: false, message: 'A content id is required.' });
+    return;
+  }
+
   const input = {
     contentId,
     payload,
     ipAddress: req.ip,
   };
-  const { name: COOKIE_NAME, maxAge } = cookie;
   await apollo.mutate({ mutation, variables: { input } });
-  res.cookie(COOKIE_NAME, true, { maxAge, httpOnly: false });
+  const COOKIE_NAME = buildName({ surveyId: DOWNLOAD_SURVEY_ID, contentId });
+  res.cookie(COOKIE_NAME, true, { maxAge: downloadMaxAge(), httpOnly: false });
   const entity = await identityX.generateEntityId();
   res.json({
     ok: true,

package/routes/google.js

@@ -105,18 +105,44 @@ module.exports = asyncRoute(async (req, res) => {
   // the request dies is the step that failed, so an error arrives already
   // localized instead of being a bare GraphQL message to reverse-engineer.
   //
-  // `idxGoogleStepMs` is the elapsed time when each step *began*, which makes the
-  // route self-profiling: `FACET idxGoogleStep` with `max(idxGoogleStepMs)` shows
-  // where the time goes, and a request that dies mid-flight still reports how far
-  // it got and when. Sign-ins here average ~12s even when they succeed, and
-  // without this there is no way to tell which of the ~10 sequential upstream
-  // calls owns that.
+  // Timing comes in two parts, because they answer different questions.
+  //
+  // `idxGoogleStepMs` is elapsed-at-last-step: last-write-wins, so on a completed
+  // request it is effectively total route time, and on one that dies mid-flight it
+  // says how far in it got. Useful, but it cannot attribute time to a *step* —
+  // every `setStep` overwrites the previous value, so the breakdown it was
+  // originally meant to provide never survived.
+  //
+  // `idxMs<Step>` fixes that: one attribute per step, holding how long that step
+  // took. Emitted when the *next* step starts, since that is when the previous
+  // one is known to be over. `complete` therefore has no duration of its own,
+  // which is correct — it is a marker, not work. Roughly ten attributes, well
+  // inside New Relic's per-transaction custom attribute budget.
+  //
+  //   SELECT average(idxMsHooksAuthenticationSuccess), average(idxMsImpersonateAppUser),
+  //          average(idxMsHooksLoginLinkSent)
+  //   FROM Transaction WHERE name LIKE '%__idx/google%'
+  //
+  // With Omeda calls showing a ~4s tail and both hook steps sitting on the
+  // blocking path, this is what says whether they own the remaining latency.
   const startedAt = Date.now();
   const addAttrs = config.get('addRequestAttributes') || (() => {});
-  const setStep = (step) => addAttrs({
-    idxGoogleStep: step,
-    idxGoogleStepMs: Date.now() - startedAt,
-  });
+
+  // 'hooks-login-link-sent' -> 'idxMsHooksLoginLinkSent'
+  const attrNameForStep = (step) => `idxMs${step.split('-').map((part) => (
+    part.charAt(0).toUpperCase() + part.slice(1)
+  )).join('')}`;
+
+  let currentStep;
+  let currentStepStartedAt = startedAt;
+  const setStep = (step) => {
+    const now = Date.now();
+    // Close out the step being left, not the one being entered.
+    if (currentStep) addAttrs({ [attrNameForStep(currentStep)]: now - currentStepStartedAt });
+    currentStep = step;
+    currentStepStartedAt = now;
+    addAttrs({ idxGoogleStep: step, idxGoogleStepMs: now - startedAt });
+  };
 
   const { clientId, missingFieldsBehavior = 'profile-gate' } = config.getAsObject('googleAuth');
   // `surface` is the GIS `select_by` bucket ('button' | 'prompt'), sent by the

package/service.js

@@ -24,6 +24,9 @@ const tokenCookie = require('./utils/token-cookie');
 const isEmpty = (v) => v == null || v === '';
 const isFn = (v) => typeof v === 'function';
 const IDENTITY_COOKIE_NAME = '__idx_idt';
+// Express's `res.cookie` maxAge is in **milliseconds**. This was previously expressed in seconds,
+// which silently reduced the cookie's lifetime from one year to ~8.76 hours.
+const IDENTITY_COOKIE_MAX_AGE = 1000 * 60 * 60 * 24 * 365;
 
 const { log } = console;
 
@@ -294,12 +297,29 @@ class IdentityX {
    */
   setIdentityCookie(id) {
     const options = {
-      maxAge: 60 * 60 * 24 * 365,
+      maxAge: IDENTITY_COOKIE_MAX_AGE,
       httpOnly: false,
     };
     this.res.cookie(IDENTITY_COOKIE_NAME, id, options);
   }
 
+  /**
+   * Extends the expiration of an already-persisted identity cookie, so an active visitor's
+   * identity only lapses after a genuine year of absence.
+   *
+   * Deliberately reads `req.cookies` directly rather than using `getIdentity`: that falls back to
+   * parsing the outgoing `Set-Cookie` header, and express *appends* cookies rather than replacing
+   * them, so refreshing off it would emit a duplicate for a cookie set earlier in this request.
+   *
+   * @returns {Boolean} Whether the cookie was refreshed.
+   */
+  refreshIdentityCookie() {
+    const id = get(this.req, `cookies.${IDENTITY_COOKIE_NAME}`);
+    if (!id || this.res.headersSent) return false;
+    this.setIdentityCookie(id);
+    return true;
+  }
+
   /**
    * @param {Object} o
    * @param {String} o.identifier

package/utils/content-form-cookie.js

@@ -0,0 +1,64 @@
+const { resolveDurationMS } = require('@mindful-web/utils');
+
+const COOKIE_NAME_PREFIX = '__idx_form';
+const DEFAULT_MAX_AGE = 24 * 60 * 60 * 1000; // 1 day, in ms (express maxAge is ms)
+const DOWNLOAD_SURVEY_ID = 'content-download';
+
+/**
+ * Resolves the content-access cookie max age, in milliseconds.
+ *
+ * `IDX_CONTENT_ACCESS_MAXAGE` is a deprecated alias: "MAXAGE" reads as the HTTP `Max-Age`
+ * directive, which is in *seconds*, so an operator setting `86400` for "one day" silently got 86
+ * seconds. The `_MS` suffix makes the unit explicit; the old name still works.
+ */
+const accessMaxAge = () => resolveDurationMS({
+  value: process.env.IDX_CONTENT_ACCESS_MAXAGE_MS || process.env.IDX_CONTENT_ACCESS_MAXAGE,
+  defaultValue: DEFAULT_MAX_AGE,
+  name: 'IDX_CONTENT_ACCESS_MAXAGE_MS',
+});
+
+/**
+ * Resolves the content-download cookie max age, in milliseconds. See `accessMaxAge` on the
+ * deprecated `IDX_CONTENT_DOWNLOAD_MAXAGE` alias.
+ */
+const downloadMaxAge = () => resolveDurationMS({
+  value: process.env.IDX_CONTENT_DOWNLOAD_MAXAGE_MS || process.env.IDX_CONTENT_DOWNLOAD_MAXAGE,
+  defaultValue: DEFAULT_MAX_AGE,
+  name: 'IDX_CONTENT_DOWNLOAD_MAXAGE_MS',
+});
+
+/**
+ * @param {Object} params
+ * @param {String} params.surveyId
+ * @param {String|Number} params.contentId
+ * @returns {String} The cookie name, e.g. `__idx_form_content-download_12345`
+ */
+const buildName = ({ surveyId, contentId }) => `${COOKIE_NAME_PREFIX}_${surveyId}_${contentId}`;
+
+/**
+ * Whether a client-supplied cookie name is one this app would have issued for `contentId`.
+ *
+ * The access form's cookie name is derived from the content's `gating.surveyId`, which the submit
+ * route does not have (only `contentId` is posted), so the name still round-trips through the
+ * browser. Validating it against the expected shape prevents a caller from writing an
+ * arbitrarily-named cookie on `/`, without costing an extra GraphQL round trip on the submit path.
+ *
+ * @param {String} name
+ * @param {String|Number} contentId
+ * @returns {Boolean}
+ */
+const isValidName = (name, contentId) => {
+  if (typeof name !== 'string' || !contentId) return false;
+  const escaped = `${contentId}`.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^${COOKIE_NAME_PREFIX}_[\\w-]+_${escaped}$`).test(name);
+};
+
+module.exports = {
+  COOKIE_NAME_PREFIX,
+  DEFAULT_MAX_AGE,
+  DOWNLOAD_SURVEY_ID,
+  accessMaxAge,
+  buildName,
+  downloadMaxAge,
+  isValidName,
+};