@mindful-web/marko-web-identity-x 1.80.3 → 1.83.1

package/CLAUDE.md

@@ -99,16 +99,29 @@ path of authentication. To compare upstreams:
 **`MindfulApiCall` is sampled.** Unsampled it ran ~55k events/hour / ~40M per month on the Fusable
 fleet, 88.9% of it `GetActiveAppContext` + `CheckContentAccess` — per-page-load context calls that
 are uniformly fast and analytically useless. Kept: **every non-`ok` outcome**, **every `ok` call
->= `MINDFUL_API_CALL_SLOW_MS`** (default 250ms — deliberately under Omeda's observed p95 of 282ms, so
-ordinary Omeda latency stays visible while fast idx calls fall away), and **1 in
-`MINDFUL_API_CALL_SAMPLE_RATE`** (default 100) of the rest. Each event carries `sampleRate` = the
-number of real calls it represents, so `sum(sampleRate)` recovers true volume; `sampleRate = 1` means
-the call was kept because it failed or was slow.
+>= `MINDFUL_API_CALL_SLOW_MS`** (default 250ms) *whose operation is not in*
+**`MINDFUL_API_CALL_NO_SLOW_CAPTURE`** (default `GetActiveAppContext,CheckContentAccess`), and **1 in
+`MINDFUL_API_CALL_SAMPLE_RATE`** (default 100) of everything else. Each event carries `sampleRate` =
+the number of real calls it represents, so `sum(sampleRate)` recovers true volume; `sampleRate = 1`
+means the call was kept because it failed or was slow.
+
+**Why the exclusion list exists.** The 250ms threshold alone did not hold. It was tuned against a
+`GetActiveAppContext` p95 of 206ms measured over only **1.4 hours**; over 48h that operation cleared
+250ms constantly and produced **96.3% of all kept events** (259,448 of 269,322 — 5,625/hour), so the
+sampler barely applied to the one operation generating the volume. Excluding the two per-page-load
+context operations from *slow*-capture drops them through to the 1-in-N sampler instead. Raising the
+threshold to ~1s was the alternative and is worse: it costs fidelity on every *other* operation to
+fix two. Errors and timeouts are unaffected — `GetActiveAppContext` contributed 28 errors and the
+only observed timeout (15,009ms against the 15s budget), and all of it still flows.
 
 Consequences when querying: `average(ms)` over everything **skews high** (fast calls are
 under-represented by design) — filter `WHERE sampleRate = 1` for the error/slow tail, or
-`WHERE sampleRate > 1` for a fast-call view. Set `MINDFUL_API_CALL_SAMPLE_RATE=1` to record
-everything again during an investigation, no deploy required.
+`WHERE sampleRate > 1` for a fast-call view. For the excluded operations the skew runs the *other*
+way: every success is sampled regardless of duration, so their `sampleRate = 1` rows are errors and
+timeouts **only**, never a slow tail — use `sampleRate > 1` with `percentile(ms, 95)` for their
+latency. Set `MINDFUL_API_CALL_SAMPLE_RATE=1` to record everything again during an investigation, or
+`MINDFUL_API_CALL_NO_SLOW_CAPTURE=` (explicitly empty) to restore slow-capture for every operation —
+neither needs a deploy. An *unset* `NO_SLOW_CAPTURE` means the default list, not "exclude nothing".
 
 It wraps `client.query`/`client.mutate`, **not** `fetch` — `@parameter1/omeda-graphql-client` sets
 `fetch` *after* spreading the caller's `linkConfig`, so a wrapped transport cannot be injected from

package/README.md

@@ -150,6 +150,24 @@ import IdentityX from '@mindful-web/marko-web-identity-x/browser';
 +});
 ```
 
+## Cookie lifetimes
+
+All cookie durations in this package are expressed in **milliseconds**, because that is the unit
+express's `res.cookie` `maxAge` option expects. Env vars and config keys that carry a duration are
+suffixed `_MS` / `Ms` so the unit is unambiguous at the call site.
+
+| Variable | Applies to | Default | Notes |
+| - | - | - | - |
+| `IDX_CONTENT_ACCESS_MAXAGE_MS` | `__idx_form_<surveyId>_<contentId>` (content access) | `86400000` (1 day) | |
+| `IDX_CONTENT_DOWNLOAD_MAXAGE_MS` | `__idx_form_content-download_<contentId>` | `86400000` (1 day) | |
+| `IDX_CONTENT_ACCESS_MAXAGE` | — | — | **Deprecated** alias of the `_MS` var above. |
+| `IDX_CONTENT_DOWNLOAD_MAXAGE` | — | — | **Deprecated** alias of the `_MS` var above. |
+
+The unsuffixed names are still honored, but avoid them in new deployments: `MAXAGE` reads as the HTTP
+`Max-Age` directive, which is in *seconds*, so a value of `86400` intended as "one day" silently
+produced an 86-second cookie. Non-numeric or non-positive values are ignored with a warning and the
+default applies, rather than sending `NaN` into `res.cookie` (which throws on every affected request).
+
 ## Vue Event emission
 
 This package emits the following events via the EventBus/global Vue root. Each payload will be an

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -239,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.3/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.83.1/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.80.3/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.83.1/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/middleware/content-access-state.js

@@ -1,15 +1,10 @@
 const { get, getAsObject } = require('@mindful-web/object-path');
-
-const cookieNamePrefix = '__idx_form';
-// default is one day
-const maxAge = process.env.IDX_CONTENT_ACCESS_MAXAGE
-  ? Number(process.env.IDX_CONTENT_ACCESS_MAXAGE)
-  : (24 * 60 * 60 * 1000);
+const { accessMaxAge, buildName } = require('../utils/content-form-cookie');
 
 const contentAccessState = ({ res, content }) => {
   // Handle setting of contentAccessState Object
   const { surveyType, surveyId } = getAsObject(content, 'gating');
-  const cookieName = `${cookieNamePrefix}_${surveyId}_${content.id}`;
+  const cookieName = buildName({ surveyId, contentId: content.id });
 
   const setFormDisplay = ({ req }) => {
     res.locals.contentAccessState.displayForm = !get(req, `cookies.${cookieName}`);
@@ -20,7 +15,7 @@ const contentAccessState = ({ res, content }) => {
   };
 
   if (surveyType === 'idx') {
-    const cookie = { name: cookieName, maxAge };
+    const cookie = { name: cookieName, maxAge: accessMaxAge() };
     res.locals.contentAccessState.formId = surveyId;
     res.locals.contentAccessState.cookie = cookie;
   }

package/middleware/content-download-state.js

@@ -1,14 +1,10 @@
 const { get } = require('@mindful-web/object-path');
-
-const cookieNamePrefix = '__idx_form';
-const maxAge = process.env.IDX_CONTENT_DOWNLOAD_MAXAGE
-  ? Number(process.env.IDX_CONTENT_DOWNLOAD_MAXAGE)
-  : (24 * 60 * 60 * 1000);
+const { DOWNLOAD_SURVEY_ID, buildName, downloadMaxAge } = require('../utils/content-form-cookie');
 
 const contentDownloadState = ({ res, content }) => {
   // Handle setting of contentDownloadState Object
-  const surveyId = 'content-download';
-  const cookieName = `${cookieNamePrefix}_${surveyId}_${content.id}`;
+  const surveyId = DOWNLOAD_SURVEY_ID;
+  const cookieName = buildName({ surveyId, contentId: content.id });
 
   const setFormDisplay = ({ req }) => {
     res.locals.contentDownloadState.displayForm = !get(req, `cookies.${cookieName}`);
@@ -17,7 +13,7 @@ const contentDownloadState = ({ res, content }) => {
     displayForm: false,
     setFormDisplay,
   };
-  const cookie = { name: cookieName, maxAge };
+  const cookie = { name: cookieName, maxAge: downloadMaxAge() };
   res.locals.contentDownloadState.formId = surveyId;
   res.locals.contentDownloadState.cookie = cookie;
 };

package/middleware.js

@@ -17,8 +17,11 @@ module.exports = (config) => asyncRoute(async (req, res, next) => {
 
   const cookie = service.getIdentity(res);
 
-  // Don't overwrite an existing cookie
-  if (cookie) return next();
+  // Don't overwrite an existing cookie, but do extend its expiration.
+  if (cookie) {
+    service.refreshIdentityCookie();
+    return next();
+  }
 
   // Set cookie for logged in users
   if (service.token) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.80.3",
+  "version": "1.83.1",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -13,9 +13,9 @@
     "test": "yarn compile --no-clean && yarn lint"
   },
   "dependencies": {
-    "@mindful-web/marko-web-gtm": "^1.80.2",
-    "@mindful-web/object-path": "^1.80.2",
-    "@mindful-web/utils": "^1.80.2",
+    "@mindful-web/marko-web-gtm": "^1.83.1",
+    "@mindful-web/object-path": "^1.83.1",
+    "@mindful-web/utils": "^1.83.1",
     "apollo-cache-inmemory": "^1.6.6",
     "apollo-client": "^2.6.10",
     "apollo-link-context": "^1.0.20",
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "02de6be94c16fd962d5c94b37b9f09a151142f48"
+  "gitHead": "c9507129d0e30847cb2b2a941cb383746d1fd501"
 }

package/routes/access.js

@@ -1,5 +1,6 @@
 const gql = require('graphql-tag');
 const { asyncRoute } = require('@mindful-web/utils');
+const { accessMaxAge, isValidName } = require('../utils/content-form-cookie');
 
 const mutation = gql`
   mutation StoreContentAccessSubmission($input: CreateContentAccessSubmissionMutationInput!) {
@@ -13,14 +14,24 @@ module.exports = asyncRoute(async (req, res) => {
   /** @type {import('../middleware').IdentityXRequest} */
   const { body, apollo, identityX } = req;
   const { contentId, payload, cookie } = body;
+
+  // Validate BEFORE the mutation: this previously destructured `cookie` blindly and passed its
+  // `maxAge` straight to `res.cookie`, so a missing key or non-numeric max age threw a 500 *after*
+  // the submission had already committed. The cookie's lifetime is never taken from the request --
+  // only its name, which must match one this app would have issued for this content.
+  const COOKIE_NAME = cookie && cookie.name;
+  if (!isValidName(COOKIE_NAME, contentId)) {
+    res.status(400).json({ ok: false, message: 'A valid content access cookie name is required.' });
+    return;
+  }
+
   const input = {
     contentId,
     payload,
     ipAddress: req.ip,
   };
-  const { name: COOKIE_NAME, maxAge } = cookie;
   await apollo.mutate({ mutation, variables: { input } });
-  res.cookie(COOKIE_NAME, true, { maxAge, httpOnly: false });
+  res.cookie(COOKIE_NAME, true, { maxAge: accessMaxAge(), httpOnly: false });
   const entity = await identityX.generateEntityId();
   res.json({
     ok: true,

package/routes/download.js

@@ -1,5 +1,6 @@
 const gql = require('graphql-tag');
 const { asyncRoute } = require('@mindful-web/utils');
+const { DOWNLOAD_SURVEY_ID, buildName, downloadMaxAge } = require('../utils/content-form-cookie');
 
 const mutation = gql`
   mutation StoreContentDownloadSubmission($input: CreateContentDownloadSubmissionMutationInput!) {
@@ -12,15 +13,26 @@ const mutation = gql`
 module.exports = asyncRoute(async (req, res) => {
   /** @type {import('../middleware').IdentityXRequest} */
   const { body, apollo, identityX } = req;
-  const { contentId, payload, cookie } = body;
+  const { contentId, payload } = body;
+
+  // Validate BEFORE the mutation: this previously destructured `cookie` from the body blindly and
+  // passed its `maxAge` straight to `res.cookie`, so a missing key or non-numeric max age threw a
+  // 500 *after* the submission had already committed. Unlike the access form, the download form's
+  // survey id is a fixed constant, so the cookie is derived entirely server-side and the body's
+  // `cookie` is ignored.
+  if (!contentId) {
+    res.status(400).json({ ok: false, message: 'A content id is required.' });
+    return;
+  }
+
   const input = {
     contentId,
     payload,
     ipAddress: req.ip,
   };
-  const { name: COOKIE_NAME, maxAge } = cookie;
   await apollo.mutate({ mutation, variables: { input } });
-  res.cookie(COOKIE_NAME, true, { maxAge, httpOnly: false });
+  const COOKIE_NAME = buildName({ surveyId: DOWNLOAD_SURVEY_ID, contentId });
+  res.cookie(COOKIE_NAME, true, { maxAge: downloadMaxAge(), httpOnly: false });
   const entity = await identityX.generateEntityId();
   res.json({
     ok: true,

package/service.js

@@ -24,6 +24,9 @@ const tokenCookie = require('./utils/token-cookie');
 const isEmpty = (v) => v == null || v === '';
 const isFn = (v) => typeof v === 'function';
 const IDENTITY_COOKIE_NAME = '__idx_idt';
+// Express's `res.cookie` maxAge is in **milliseconds**. This was previously expressed in seconds,
+// which silently reduced the cookie's lifetime from one year to ~8.76 hours.
+const IDENTITY_COOKIE_MAX_AGE = 1000 * 60 * 60 * 24 * 365;
 
 const { log } = console;
 
@@ -294,12 +297,29 @@ class IdentityX {
    */
   setIdentityCookie(id) {
     const options = {
-      maxAge: 60 * 60 * 24 * 365,
+      maxAge: IDENTITY_COOKIE_MAX_AGE,
       httpOnly: false,
     };
     this.res.cookie(IDENTITY_COOKIE_NAME, id, options);
   }
 
+  /**
+   * Extends the expiration of an already-persisted identity cookie, so an active visitor's
+   * identity only lapses after a genuine year of absence.
+   *
+   * Deliberately reads `req.cookies` directly rather than using `getIdentity`: that falls back to
+   * parsing the outgoing `Set-Cookie` header, and express *appends* cookies rather than replacing
+   * them, so refreshing off it would emit a duplicate for a cookie set earlier in this request.
+   *
+   * @returns {Boolean} Whether the cookie was refreshed.
+   */
+  refreshIdentityCookie() {
+    const id = get(this.req, `cookies.${IDENTITY_COOKIE_NAME}`);
+    if (!id || this.res.headersSent) return false;
+    this.setIdentityCookie(id);
+    return true;
+  }
+
   /**
    * @param {Object} o
    * @param {String} o.identifier

package/utils/content-form-cookie.js

@@ -0,0 +1,64 @@
+const { resolveDurationMS } = require('@mindful-web/utils');
+
+const COOKIE_NAME_PREFIX = '__idx_form';
+const DEFAULT_MAX_AGE = 24 * 60 * 60 * 1000; // 1 day, in ms (express maxAge is ms)
+const DOWNLOAD_SURVEY_ID = 'content-download';
+
+/**
+ * Resolves the content-access cookie max age, in milliseconds.
+ *
+ * `IDX_CONTENT_ACCESS_MAXAGE` is a deprecated alias: "MAXAGE" reads as the HTTP `Max-Age`
+ * directive, which is in *seconds*, so an operator setting `86400` for "one day" silently got 86
+ * seconds. The `_MS` suffix makes the unit explicit; the old name still works.
+ */
+const accessMaxAge = () => resolveDurationMS({
+  value: process.env.IDX_CONTENT_ACCESS_MAXAGE_MS || process.env.IDX_CONTENT_ACCESS_MAXAGE,
+  defaultValue: DEFAULT_MAX_AGE,
+  name: 'IDX_CONTENT_ACCESS_MAXAGE_MS',
+});
+
+/**
+ * Resolves the content-download cookie max age, in milliseconds. See `accessMaxAge` on the
+ * deprecated `IDX_CONTENT_DOWNLOAD_MAXAGE` alias.
+ */
+const downloadMaxAge = () => resolveDurationMS({
+  value: process.env.IDX_CONTENT_DOWNLOAD_MAXAGE_MS || process.env.IDX_CONTENT_DOWNLOAD_MAXAGE,
+  defaultValue: DEFAULT_MAX_AGE,
+  name: 'IDX_CONTENT_DOWNLOAD_MAXAGE_MS',
+});
+
+/**
+ * @param {Object} params
+ * @param {String} params.surveyId
+ * @param {String|Number} params.contentId
+ * @returns {String} The cookie name, e.g. `__idx_form_content-download_12345`
+ */
+const buildName = ({ surveyId, contentId }) => `${COOKIE_NAME_PREFIX}_${surveyId}_${contentId}`;
+
+/**
+ * Whether a client-supplied cookie name is one this app would have issued for `contentId`.
+ *
+ * The access form's cookie name is derived from the content's `gating.surveyId`, which the submit
+ * route does not have (only `contentId` is posted), so the name still round-trips through the
+ * browser. Validating it against the expected shape prevents a caller from writing an
+ * arbitrarily-named cookie on `/`, without costing an extra GraphQL round trip on the submit path.
+ *
+ * @param {String} name
+ * @param {String|Number} contentId
+ * @returns {Boolean}
+ */
+const isValidName = (name, contentId) => {
+  if (typeof name !== 'string' || !contentId) return false;
+  const escaped = `${contentId}`.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`^${COOKIE_NAME_PREFIX}_[\\w-]+_${escaped}$`).test(name);
+};
+
+module.exports = {
+  COOKIE_NAME_PREFIX,
+  DEFAULT_MAX_AGE,
+  DOWNLOAD_SURVEY_ID,
+  accessMaxAge,
+  buildName,
+  downloadMaxAge,
+  isValidName,
+};