@mindful-web/marko-web-identity-x 1.83.0 → 1.85.0

package/routes/progressive-profile.js

@@ -0,0 +1,296 @@
+const { verifyToken } = require('@mindful-web/marko-web-recaptcha');
+const { asyncRoute } = require('@mindful-web/utils');
+const { getAsArray } = require('@mindful-web/object-path');
+const PROGRESSIVE_PROFILE_UPDATE = require('../api/mutations/progressive-profile-update');
+const buildPayload = require('../utils/build-progressive-profile-payload');
+const callHooksFor = require('../utils/call-hooks-for');
+const cookies = require('../utils/progressive-profile-cookies');
+const { EVENT_TYPES, createRecorder } = require('../utils/progressive-profile-telemetry');
+
+const { buildContentSource } = buildPayload;
+
+const ACTION_SOURCE = 'progressiveProfile';
+
+/**
+ * The reCAPTCHA v3 action for this form. Declared client-side and checked server-side, so a token
+ * minted for some other form on the site cannot be replayed here.
+ */
+const RECAPTCHA_ACTION = 'progressiveProfileSubmit';
+
+/**
+ * Score floor. The package default is 0.5, which is what every other form on the fleet uses.
+ * Overridable per site via `progressiveProfile.recaptchaMinimumScore` on the IdentityX config.
+ */
+const DEFAULT_MINIMUM_SCORE = 0.5;
+
+const DEFAULTS = {
+  suppressAfterDismissDays: 0,
+  unverifiedSuppressDays: cookies.DEFAULT_UNVERIFIED_SUPPRESS_DAYS,
+};
+
+const optionFor = (config, key) => config.get(`progressiveProfile.${key}`, DEFAULTS[key]);
+
+/**
+ * `POST /__idx/progressive-profile`
+ *
+ * A thin proxy over the single `progressiveProfileUpdate` mutation. It holds **no write logic of
+ * its own**: the re-diff that drops already-filled fields, the attribute writes, the
+ * `action-history` attribution and the `PROGRESSIVE_PROFILE_SUBMIT` submission event all happen
+ * inside that mutation's transaction.
+ *
+ * What this route *does* own is trust: which member is being written to (never `body.userId`),
+ * which fields may be written (server config, never the body), and reCAPTCHA.
+ *
+ * ## Bot protection — reCAPTCHA, and what a failure actually does
+ *
+ * The threat is concrete. `marko-web-omeda-identity-x/middleware/set-identity-cookie.js` mints
+ * `__idx_idt` for a **real person's** AppUser id on any request carrying `oly_enc_id`, so a
+ * newsletter security scanner following an emailed link browses *as* an identified human and could
+ * write to a real record. Cloudflare on these sites segregates rather than drops, so there is no
+ * upstream to lean on.
+ *
+ * Verification is the fleet standard — reCAPTCHA v3 via `@mindful-web/marko-web-recaptcha`, the
+ * same package and score floor behind newsletter signup, contact-us, inquiries and the RigDig
+ * checkout. What differs is the **response to a failure**.
+ *
+ * **A failed check never rejects the visitor. It silently drops the write.** The submission
+ * "succeeds", the content unlocks, and the answers go nowhere. Rejecting instead would be strictly
+ * worse: this gate stands between a reader and an article, so a false positive locks a real person
+ * out of content they can otherwise reach — a bigger loss than the bot write it prevented. A bot,
+ * meanwhile, gains only an article it could largely have read anonymously, and gains no write at
+ * all, which is the only thing actually at stake.
+ *
+ * Two consequences that are easy to miss:
+ *
+ * - **A suppression cookie is mandatory, not a nicety.** The answers were discarded, so the
+ *   member's record is unchanged and the diff would gate them again on the next article, forever.
+ *   `setUnverifiedSuppressed` stops that and hands them back to the content meter.
+ * - **A false positive is invisible to everyone.** The visitor is never told, and we would never
+ *   know either — which is why the score is recorded on *every* submit, passing or not. That
+ *   telemetry is what makes this shape safe to ship; see `CLAUDE.md` for the decision rule it
+ *   feeds.
+ *
+ * **One rule for every visitor.** A failed check drops the write whether or not a session is
+ * present. An earlier revision exempted session holders on the grounds that `/user/profile` has no
+ * captcha either, so a session is already sufficient authorization for a profile write elsewhere in
+ * this package — but that is a user-initiated edit on a page someone navigated to, while this is an
+ * interstitial pushed at a link-follower, which is exactly what an email scanner hits. Scanners do
+ * follow magic links, so a session is not proof of a human.
+ *
+ * The exemption also bought nothing the uniform rule does not: the score is recorded on every
+ * submit regardless, so authenticated submits still serve as the known-human control group that
+ * says whether the threshold itself is wrong. Only the write differs, and passive accept means the
+ * visitor keeps the content either way.
+ *
+ * The hard damage bound is not here at all: the mutation re-diffs inside its transaction and can
+ * only ever fill a field that was already empty, so nothing that gets past reCAPTCHA can destroy
+ * data. Every write is also recorded in `action-history` with its `input`/`result`, so a bad one is
+ * findable and reversible from one collection.
+ */
+const submit = asyncRoute(async (req, res) => {
+  /** @type {import('../middleware').IdentityXRequest} */
+  const { identityX, body = {} } = req;
+  const { config } = identityX;
+  const onError = config.get('onHookError') || (() => {});
+
+  // Telemetry: exactly one event per submit, typed by what happened -- `ProgressiveProfileSubmit`,
+  // `Discarded`, `Rejected` or `Error`. Each terminal branch below records its own, which is what
+  // makes the outcomes separately countable.
+  //
+  // The arithmetic is guaranteed by the recorder, not by whoever edits this next:
+  // `record` is a no-op once anything has fired (so no path can double count), and the `finally`
+  // at the bottom is a backstop for a path that recorded nothing. If you add a branch and forget
+  // the call, it does not go missing -- it surfaces as `ProgressiveProfileError` with
+  // `reason: 'unrecorded'`.
+  //
+  // `telemetry.set(...)` accumulates the attributes shared by whichever type ends up firing, so a
+  // call site only names what is specific to it.
+  const telemetry = createRecorder(req);
+  telemetry.set({ contentId: body.contentId == null ? null : `${body.contentId}` });
+
+  try {
+    // --- Verify, but do not reject. -------------------------------------------------------------
+    const {
+      success, score, action, errorCodes,
+    } = await verifyToken({
+      token: body.recaptchaToken,
+      secretKey: config.get(
+        'progressiveProfile.recaptchaSecretKey',
+        process.env.RECAPTCHA_V3_SECRET_KEY,
+      ),
+    });
+    const minimumScore = config.get('progressiveProfile.recaptchaMinimumScore', DEFAULT_MINIMUM_SCORE);
+
+    // Each outcome is recorded separately. `no-token` in volume means blocked scripts, not bots;
+    // `wrong-action` means a token minted for another form on the site; `low-score` is the only one
+    // whose rate is a judgement call, and the only one the score can explain.
+    const outcome = (() => {
+      if (!body.recaptchaToken) return 'no-token';
+      if (!success) return errorCodes.includes('timeout-or-duplicate') ? 'stale-token' : 'bad-token';
+      if (action !== RECAPTCHA_ACTION) return 'wrong-action';
+      // `score != null` mirrors `validateToken`: a success carrying no score is not a low score.
+      if (score != null && score < minimumScore) return 'low-score';
+      return 'passed';
+    })();
+    // Recorded on every submit, including passes -- a rejection rate is unactionable without the
+    // distribution behind it, and the passing scores are the baseline it has to be read against.
+    telemetry.set({ recaptcha: outcome, ...(score != null && { recaptchaScore: score }) });
+
+    // --- Target resolution. `body.userId` is never trusted. -------------------------------------
+    const { user: authUser } = await identityX.loadActiveContext();
+    const targetId = authUser ? authUser.id : identityX.getIdentity(res);
+    if (!targetId) {
+      telemetry.record(EVENT_TYPES.REJECTED, { reason: 'no-identity' });
+      res.status(401).json({ ok: false, message: 'No identity present.' });
+      return;
+    }
+    if (!authUser && body.userId && `${body.userId}` !== `${targetId}`) {
+      telemetry.record(EVENT_TYPES.REJECTED, { reason: 'identity-mismatch' });
+      res.status(403).json({ ok: false, message: 'The supplied user does not match the current identity.' });
+      return;
+    }
+
+    const isOrgAuth = !authUser;
+    telemetry.set({ userId: `${targetId}`, auth: isOrgAuth ? 'org' : 'user' });
+
+    // --- Passive accept: unlock the content, drop the write. ------------------------------------
+    // Checked before the payload is built, so a body we were never going to write is a quiet 200
+    // rather than a 400 explaining what a better-formed request would have looked like.
+    if (outcome !== 'passed') {
+      cookies.setUnverifiedSuppressed(res, optionFor(config, 'unverifiedSuppressDays'));
+      cookies.clearAttempts(res);
+      telemetry.record(EVENT_TYPES.DISCARDED);
+      // `changed: false` is what the GA4 conversion already filters on, so a discarded submit is
+      // excluded from completions without any GTM change. `accepted` makes it separately countable.
+      res.json({
+        ok: true, changed: false, accepted: 'unverified', user: null,
+      });
+      return;
+    }
+
+    // --- What may be written comes from server config, never the request. -----------------------
+    const definitions = config.getProgressiveProfileFieldRows()
+      .reduce((arr, row) => [...arr, ...getAsArray({ row }, 'row')], []);
+    const { selectAnswers, booleanAnswers, textAnswers } = buildPayload({ body, definitions });
+    const fieldCount = selectAnswers.length + booleanAnswers.length + textAnswers.length;
+    if (!fieldCount) {
+      // The mutation throws a `UserInputError` for this anyway; catching it here keeps a client bug
+      // out of the audience API's error log.
+      telemetry.record(EVENT_TYPES.REJECTED, { reason: 'no-answers', fieldCount });
+      res.status(400).json({ ok: false, message: 'At least one answer is required.' });
+      return;
+    }
+
+    const { data } = await identityX.client.mutate({
+      mutation: PROGRESSIVE_PROFILE_UPDATE,
+      variables: {
+        input: {
+          // Ignored on the AppUser path; required on the org path. Sent from the *resolved* target,
+          // not the body.
+          ...(isOrgAuth && { userId: targetId }),
+          ...(selectAnswers.length && { selectAnswers }),
+          ...(booleanAnswers.length && { booleanAnswers }),
+          ...(textAnswers.length && { textAnswers }),
+          // `contentId` from the body, as `routes/access.js` already does. The mutation
+          // validates it is exactly 8 digits and belongs to the request's own tenant before
+          // deriving `postId`, so the worst a wrong value can do is misattribute one submission
+          // event -- it cannot reach another tenant's content or change who is written to.
+          source: buildContentSource({
+            config,
+            contentId: body.contentId,
+            actionSource: ACTION_SOURCE,
+          }),
+        },
+      },
+      // An authenticated visitor writes as themselves; an identified one is written by the org.
+      ...(isOrgAuth && { context: { apiToken: identityX.getOrgUserApiToken() } }),
+    });
+
+    const { ok, changed, appUser } = data.progressiveProfileUpdate;
+
+    // Release the escape valve. Cleared on any success, not only on `changed: true` -- a no-op
+    // submit means the fields are already filled, so the next render will not gate anyway and a
+    // stale counter would only shorten someone else's runway.
+    cookies.clearAttempts(res);
+
+    // --- Downstream profile-update hooks. --------------------------------------------------------
+    // `onUserProfileUpdate` is provider-agnostic. Omeda rapid-identify is the most visible consumer
+    // but it is one of five: `marko-web-omeda-identity-x`, `marko-web-identity-x-mailchimp`,
+    // `marko-web-postup`, plus site-level packages for Braze and ActiveCampaign. Which of them runs
+    // is purely a function of what a site installed.
+    //
+    // Skipped when nothing changed (nothing to sync) and never fatal: the audience write has
+    // already committed, so failing the request here would report a loss that did not happen.
+    //
+    // Deliberately NOT `onLoginLinkSent` / `onAuthenticationSuccess`. Those drive auto-signup and
+    // the GA4 `subscribe` conversion; this is not a registration, and firing them reports phantom
+    // subscriptions.
+    //
+    // `dispatched` means the queue was fired -- NOT that any hook succeeded, and do not "correct"
+    // it to `ok`. Every registrant uses `shouldAwait: false`, so `callHooksFor` returns before the
+    // hooks have done anything, and `utils/call-hooks-for.js` wraps each promise in
+    // `.catch(onHookError)` so it essentially never rejects. An async failure -- the realistic one,
+    // e.g. Omeda timing out seconds later -- is reported there and can never reach this field.
+    // `error` is therefore a *synchronous* throw from dispatch only: guarded because the write has
+    // already committed and an unhandled throw would 500 a request whose data actually landed, and
+    // reported locally because `call-hooks-for` only catches returned promises, so this is not a
+    // double report.
+    let profileUpdateHooks = 'skipped';
+    if (changed && appUser) {
+      try {
+        await callHooksFor(identityX, 'onUserProfileUpdate', {
+          req,
+          user: appUser,
+          additionalEventData: { actionSource: ACTION_SOURCE },
+          actionSource: ACTION_SOURCE,
+        });
+        profileUpdateHooks = 'dispatched';
+      } catch (e) {
+        profileUpdateHooks = 'error';
+        onError(e, { idxProgressiveProfileStep: 'onUserProfileUpdate', idxUserId: targetId });
+      }
+    }
+
+    telemetry.record(EVENT_TYPES.SUBMIT, {
+      fieldCount,
+      changed: Boolean(changed),
+      profileUpdateHooks,
+    });
+
+    // No `actionId` and no `entity`: the submit is recorded server-side and the browser has no
+    // tracking left to do on it. `changed` is server-truth and is what the GA4 conversion
+    // filters on. `accepted` here is the client contract the dataLayer event reads -- unrelated to
+    // the New Relic event type above, which carries the same fact for reporting.
+    res.json({
+      ok: Boolean(ok), changed: Boolean(changed), accepted: 'written', user: appUser || null,
+    });
+  } catch (e) {
+    // Record before rethrowing, so a failure is a row rather than a gap. The error handler still
+    // gets the throw; this only observes it. Message only -- submitted answers never go to New
+    // Relic, and the mutation's errors are generic by design.
+    telemetry.record(EVENT_TYPES.ERROR, { error: `${e.name}: ${e.message}` });
+    throw e;
+  } finally {
+    // Backstop, and a no-op on every path above because they all recorded. It fires only when a
+    // branch returned without one -- and it says so, rather than guessing a type, so the gap is
+    // visible in New Relic instead of silently skewing the mix.
+    telemetry.record(EVENT_TYPES.ERROR, { reason: 'unrecorded' });
+  }
+});
+
+/**
+ * `POST /__idx/progressive-profile/dismiss`
+ *
+ * Only meaningful when a site opts into `dismissible` + `suppressAfterDismissDays`; with the
+ * default hard-gate cadence there is no skip affordance to reach it and the cookie is never set.
+ *
+ * No reCAPTCHA: this writes nothing but a cookie on the caller's own browser.
+ */
+const dismiss = asyncRoute(async (req, res) => {
+  /** @type {import('../middleware').IdentityXRequest} */
+  const { identityX } = req;
+  const dismissed = cookies.setDismissed(res, optionFor(identityX.config, 'suppressAfterDismissDays'));
+  res.json({ ok: true, dismissed });
+});
+
+module.exports = { RECAPTCHA_ACTION, dismiss, submit };

package/service.js

@@ -354,6 +354,37 @@ class IdentityX {
     return data.appUserById;
   }
 
+  /**
+   * `findUserById`, memoized for the life of the request.
+   *
+   * A gated page load asks for the same record up to three times — the progressive-profile
+   * middleware, `getIdentityData()`, and `non-auth-identify.marko` — for one identity that cannot
+   * change mid-request. This collapses them to a single round trip.
+   *
+   * **Deliberately a separate method rather than caching `findUserById` itself.**
+   * `routes/google.js` calls `findUserById` twice on purpose, either side of the
+   * `onLoginLinkSent` hook, precisely to observe the `externalIds` that hook writes — memoizing
+   * the shared method would hand it stale data and silently drop the Omeda `oly_enc_id` from the
+   * response. Only read paths that perform no writes may use this.
+   *
+   * @param {String} id The user id
+   * @returns {Promise<User|null>}
+   */
+  async findUserByIdMemoized(id) {
+    if (!id) return null;
+    if (!this.userByIdQueries) this.userByIdQueries = new Map();
+    if (!this.userByIdQueries.has(id)) {
+      // The *promise* is cached, not its result, so concurrent callers share one in-flight query
+      // rather than each starting their own.
+      this.userByIdQueries.set(id, this.findUserById(id).catch((e) => {
+        // A failed lookup must not be cached as a permanent failure for the rest of the request.
+        this.userByIdQueries.delete(id);
+        throw e;
+      }));
+    }
+    return this.userByIdQueries.get(id);
+  }
+
   /**
    *
    * @param {object} params

package/utils/add-custom-attributes.js

@@ -1,50 +1,23 @@
+const { newrelicAgent } = require('@mindful-web/utils');
+
 /**
- * Default sink for `config.addRequestAttributes` — tags the current New Relic
- * transaction, with no configuration and no New Relic dependency.
+ * Default sink for `config.addRequestAttributes` — tags the current New Relic transaction.
+ *
+ * A thin delegation to `@mindful-web/utils`, which owns the agent resolution: it uses the agent
+ * **only when the host application has already loaded it** (a `require.cache` check rather than a
+ * try/caught require, because requiring `newrelic` cold would *start* an agent on sites that don't
+ * use it). Net effect is unchanged — attributes arrive fleet-wide on a dependency bump and the
+ * whole thing is inert without New Relic — and it swallows every error, because telemetry must
+ * never break a request.
+ *
+ * This file used to carry its own copy of that resolution logic, line for line. It is gone:
+ * identity-x already depends on `@mindful-web/utils` directly *and* transitively
+ * (`utils/create-client.js` → `instrumentApolloClient` → `newrelic-agent`), so the duplicate was
+ * two copies that could only ever drift apart.
  *
- * The agent is used **only when the application has already loaded it**. Every
- * marko-web site requires its `newrelic.js` at boot, so by the time a request
- * is served the module is in `require.cache` and `require('newrelic')` returns
- * that same initialized singleton. Requiring it unconditionally would instead
- * *start* an agent on sites that don't use New Relic, which is why this checks
- * the cache rather than just try/catching the require.
+ * A site can still pass its own `addRequestAttributes` to override this entirely. For telemetry
+ * that should **not** ride on the transaction, see `utils/progressive-profile-telemetry.js`.
  *
- * Net effect: attributes appear fleet-wide on a dependency bump alone, and the
- * whole thing is inert on any site without New Relic. A site can still pass its
- * own `addRequestAttributes` to override.
+ * @param {object} attributes Flat key/values only — New Relic drops nested objects.
  */
-
-let resolvedPath;
-let lookupFailed = false;
-let agent = null;
-
-const getAgent = () => {
-  if (agent) return agent;
-  if (lookupFailed) return null;
-  if (!resolvedPath) {
-    try {
-      resolvedPath = require.resolve('newrelic');
-    } catch (e) {
-      // Not installed — nothing to report to.
-      lookupFailed = true;
-      return null;
-    }
-  }
-  // `newrelic` is intentionally NOT a dependency of this package: declaring it
-  // would install it on every monorail site, and requiring an uninitialized
-  // agent starts one. We only ever pick up an instance the host app already
-  // created, which is why the cache check above guards this require.
-  // eslint-disable-next-line global-require, import/no-extraneous-dependencies
-  if (require.cache[resolvedPath]) agent = require('newrelic');
-  return agent;
-};
-
-module.exports = (attributes) => {
-  const nr = getAgent();
-  if (!nr || typeof nr.addCustomAttributes !== 'function') return;
-  try {
-    nr.addCustomAttributes(attributes);
-  } catch (e) {
-    // Telemetry must never break a request.
-  }
-};
+module.exports = (attributes) => newrelicAgent.addCustomAttributes(attributes);

package/utils/build-progressive-profile-payload.js

@@ -0,0 +1,117 @@
+const { getAsArray } = require('@mindful-web/object-path');
+
+/**
+ * Locates the submitted answer for a definition.
+ *
+ * `get-progressive-form-fields.js` stamps `id` with the **field** id (the contract
+ * `custom-column.vue` reads), so that is the primary match. `field.id` is accepted as a fallback
+ * for an answer that arrived straight off an idx record without passing through that util.
+ */
+const findSubmitted = (answers, fieldId) => answers.find((answer) => answer && (
+  answer.id === fieldId || (answer.field && answer.field.id === fieldId)
+));
+
+const isBlank = (value) => value == null || `${value}`.trim() === '';
+
+/**
+ * Marshals a submitted progressive-profile form body into `progressiveProfileUpdate` variables.
+ *
+ * Three things it deliberately does **not** do:
+ *
+ * - **Decide what is missing.** The mutation re-diffs every answer against the member's live
+ *   record inside its own transaction and drops anything already filled, so a stale form cannot
+ *   overwrite good data and this util does not need to guarantee freshness.
+ * - **Trust the request for field definitions.** `definitions` comes from server config
+ *   (`config.getProgressiveProfileFieldRows()`), never from the body, so a client cannot widen
+ *   what gets written by posting extra rows.
+ * - **Write built-ins.** The shipped mutation is attributes-only; there is no `builtIns` input.
+ *   `config.js` refuses to boot with a `built-in` column for that reason.
+ *
+ * @param {object} params
+ * @param {object} [params.body] The posted form body (`{ ...user }` from the Vue component).
+ * @param {import('..').CustomColumnDefinition[]} [params.definitions] Flattened, server-supplied.
+ * @returns {{ selectAnswers: object[], booleanAnswers: object[], textAnswers: object[] }}
+ */
+module.exports = ({ body, definitions = [] } = {}) => {
+  const selectAnswers = [];
+  const booleanAnswers = [];
+  const textAnswers = [];
+
+  const submitted = {
+    'custom-select': getAsArray(body, 'customSelectFieldAnswers'),
+    'custom-boolean': getAsArray(body, 'customBooleanFieldAnswers'),
+    'custom-text': getAsArray(body, 'customTextFieldAnswers'),
+  };
+
+  definitions.forEach((col) => {
+    if (!col || !col.id) return;
+    const answer = findSubmitted(submitted[col.type] || [], col.id);
+    if (!answer) return;
+
+    switch (col.type) {
+      case 'custom-select': {
+        const options = getAsArray(answer, 'answers').filter((option) => option && option.id);
+        // An empty selection is not an answer. Sending it anyway would post `optionIds: []`,
+        // which the underlying writer reads as "unset" — the one way this feature could destroy
+        // data despite the mutation's fill-blanks-only rule.
+        if (!options.length) return;
+        selectAnswers.push({
+          fieldId: col.id,
+          optionIds: options.map(({ id }) => id),
+          writeInValues: options.reduce((arr, { id, writeInValue }) => ([
+            ...arr,
+            ...(isBlank(writeInValue) ? [] : [{ optionId: id, value: writeInValue }]),
+          ]), []),
+        });
+        break;
+      }
+      case 'custom-boolean': {
+        // `hasAnswered` is the gate, not truthiness: an explicit `false` is an answer.
+        //
+        // Unreachable today — `config.js` rejects `custom-boolean` at boot because the shared
+        // `custom-column.vue` cannot render a boolean's answered state (it binds `answer` but the
+        // change handler writes `value`), which makes a *required* boolean an unsatisfiable gate.
+        // Kept in step with the diff util and the mutation so re-enabling it is one line once
+        // that shared bug is fixed.
+        if (!answer.hasAnswered) return;
+        const value = answer.value == null ? answer.answer : answer.value;
+        booleanAnswers.push({ fieldId: col.id, value: Boolean(value) });
+        break;
+      }
+      case 'custom-text': {
+        if (isBlank(answer.value)) return;
+        textAnswers.push({ fieldId: col.id, value: `${answer.value}`.trim() });
+        break;
+      }
+      default:
+        break;
+    }
+  });
+
+  return { selectAnswers, booleanAnswers, textAnswers };
+};
+
+/**
+ * Assembles the mutation's required `source` object — where the gate was rendered.
+ *
+ * All four values are validated server-side: `legacyTenantKey` must resolve to a known legacy
+ * tenant **and** match the tenant the request resolved to, and `integerId` must be exactly 8
+ * digits (true of all 442 content routes across the 18 website repos). A mismatch therefore
+ * surfaces as a `UserInputError` rather than silently recording a wrong `postId`.
+ *
+ * `websiteChannelId` is the idx app id: the two are the same value, confirmed against the tenancy
+ * `websites` map and the audience `attributes.websiteChannelIds` data.
+ *
+ * @param {object} params
+ * @param {import('../config')} params.config
+ * @param {string|number} params.contentId The base-CMS post integer id.
+ * @param {string} [params.actionSource]
+ */
+module.exports.buildContentSource = ({ config, contentId, actionSource } = {}) => ({
+  // The same env var `marko-web-p1-events/utils/create-namespace.js` reads, and `package.json`'s
+  // `website.tenant`.
+  legacyTenantKey: process.env.TENANT_KEY,
+  integerId: Number.parseInt(contentId, 10),
+  websiteChannelId: config.getAppId(),
+  ...(actionSource && { actionSource }),
+});

package/utils/get-missing-progressive-fields.js

@@ -0,0 +1,114 @@
+const { getAsArray } = require('@mindful-web/object-path');
+
+/**
+ * The only column types progressive profiling can ask for.
+ *
+ * `built-in` is deliberately absent. The `progressiveProfileUpdate` mutation is **attributes
+ * only** — core/root member fields were cut from it during review — so a built-in column would
+ * render in the gate, accept a value, and then be silently unwritable: the user submits, the
+ * mutation reports `changed: false`, and the gate re-renders forever. `config.js` refuses to boot
+ * with one for that reason; this set is the second half of the same guard.
+ */
+const SUPPORTED_TYPES = new Set(['custom-select', 'custom-boolean', 'custom-text']);
+
+/**
+ * Finds a user's answer for a field definition.
+ *
+ * Matched on `answer.field.id`, **never** `answer.id`. An idx custom answer carries its own id —
+ * the id of the answer document, not of the field it answers — so comparing `answer.id` to a
+ * configured field id never matches. That is the live bug in `utils/get-form-custom-fields.js`
+ * (and in `config.getGTMUserData`), which is why this feature does not reuse either.
+ *
+ * @param {object[]} answers
+ * @param {string} fieldId
+ */
+const findAnswer = (answers, fieldId) => answers
+  .find((answer) => answer && answer.field && answer.field.id === fieldId);
+
+/**
+ * Whether a single configured column is unanswered on the given user.
+ *
+ * @param {object} params
+ * @param {object} params.appUser
+ * @param {import('..').CustomColumnDefinition} params.col
+ * @returns {boolean}
+ */
+const isColumnMissing = ({ appUser, col }) => {
+  const { id, type } = col;
+  // An unsupported or id-less column can never be written, so it must never gate anyone.
+  if (!id || !SUPPORTED_TYPES.has(type)) return false;
+
+  switch (type) {
+    case 'custom-select': {
+      const answer = findAnswer(getAsArray(appUser, 'customSelectFieldAnswers'), id);
+      if (!answer || !answer.hasAnswered) return true;
+      return !getAsArray(answer, 'answers').length;
+    }
+    case 'custom-text': {
+      const answer = findAnswer(getAsArray(appUser, 'customTextFieldAnswers'), id);
+      if (!answer || !answer.hasAnswered) return true;
+      const { value } = answer;
+      return value == null || `${value}`.trim() === '';
+    }
+    case 'custom-boolean': {
+      const answer = findAnswer(getAsArray(appUser, 'customBooleanFieldAnswers'), id);
+      // `hasAnswered` is the whole test: a deliberate `false` IS an answer.
+      return !answer || !answer.hasAnswered;
+    }
+    /* istanbul ignore next -- guarded by SUPPORTED_TYPES above */
+    default:
+      return false;
+  }
+};
+
+/**
+ * Diffs a user's AppUser record against a site's configured progressive-profile fields.
+ *
+ * Pure — no i/o, no config access. The middleware calls it to decide whether to gate; the Marko
+ * tag calls it (via the state the middleware set) to decide what to render.
+ *
+ * The NA relaxation in `generate-required-field-payload.js` (skip `regionCode`/`postalCode`
+ * outside US/CA/MX) has no analogue here: those are built-ins, which this feature cannot ask for.
+ *
+ * @param {object} params
+ * @param {object} [params.appUser] The full idx AppUser record (with custom answers).
+ * @param {import('..').CustomColumnDefinition[][]} [params.fieldRows]
+ * @returns {{
+ *   hasMissing: boolean,
+ *   missingRows: import('..').CustomColumnDefinition[][],
+ *   missingCustomFieldIds: string[],
+ *   missingCount: number,
+ * }}
+ */
+module.exports = ({ appUser, fieldRows = [] } = {}) => {
+  // Never gate a user we could not read. An absent record is a lookup failure, not a profile with
+  // every field empty, and treating it as the latter gates everyone the moment idx has a bad day.
+  if (!appUser) {
+    return {
+      hasMissing: false, missingRows: [], missingCustomFieldIds: [], missingCount: 0,
+    };
+  }
+
+  // Rows are preserved so the gate lays out exactly as the site configured it; fully-satisfied
+  // rows drop out, partially-satisfied ones keep only their missing columns, and every surviving
+  // column is forced required — the gate has no optional questions.
+  const missingRows = getAsArray({ fieldRows }, 'fieldRows')
+    .map((row) => getAsArray({ row }, 'row')
+      .filter((col) => col && isColumnMissing({ appUser, col }))
+      .map((col) => ({ ...col, required: true })))
+    .filter((row) => row.length);
+
+  const missingCustomFieldIds = missingRows.reduce((ids, row) => {
+    row.forEach((col) => ids.push(col.id));
+    return ids;
+  }, []);
+
+  return {
+    hasMissing: Boolean(missingCustomFieldIds.length),
+    missingRows,
+    missingCustomFieldIds,
+    missingCount: missingCustomFieldIds.length,
+  };
+};
+
+module.exports.SUPPORTED_TYPES = SUPPORTED_TYPES;