@mindful-web/marko-web-identity-x 1.83.1 → 1.85.0

package/utils/get-progressive-form-fields.js

@@ -0,0 +1,67 @@
+const { getAsArray } = require('@mindful-web/object-path');
+
+const TYPENAME_FOR = {
+  'custom-boolean': 'BooleanField',
+  'custom-select': 'SelectField',
+  'custom-text': 'TextField',
+};
+
+/**
+ * See `get-missing-progressive-fields.js` — the answer's own `id` is not the field's id.
+ */
+const findAnswer = (answers, fieldId) => answers
+  .find((answer) => answer && answer.field && answer.field.id === fieldId);
+
+/**
+ * Builds the `custom*FieldAnswers` props that `browser/custom-column.vue` expects, for a set of
+ * progressive-profile field rows.
+ *
+ * A correct, feature-scoped replacement for `utils/get-form-custom-fields.js`, which is broken in
+ * two ways this cannot afford: it matches a user's answer on the answer's own id rather than
+ * `answer.field.id` (so it never matches), and then `if (userAnswer)` is truthy on the empty array
+ * that produces, so it spreads `undefined` and returns `{}` — an answer object with no `field`,
+ * which `custom-column.vue` renders as its raw-metadata `<pre>` debug block. That util is shared
+ * with the live survey-access and profile flows across 18 repos, so it is left alone here and
+ * fixed separately.
+ *
+ * **`id` is the field definition's id, not the answer's.** That is the contract
+ * `custom-column.vue` reads (`ans.id === fieldId`, where `fieldId` is the configured column id)
+ * and what `get-create-user-custom-fields.js` already emits. `build-progressive-profile-payload`
+ * reads it back the same way, so the round trip is consistent.
+ *
+ * @param {object} params
+ * @param {object[]} [params.fields] Definitions from `loadActiveContext({ withFields: true })`.
+ * @param {import('..').CustomColumnDefinition[][]} [params.fieldRows] Usually `state.missingRows`.
+ * @param {object} [params.user] The active/identified AppUser, when known.
+ */
+module.exports = ({ fields = [], fieldRows = [], user } = {}) => {
+  const definitions = [];
+  const seen = new Set();
+  getAsArray({ fieldRows }, 'fieldRows').forEach((row) => getAsArray({ row }, 'row').forEach((col) => {
+    if (!col || !col.id || seen.has(col.id)) return;
+    const field = fields.find(({ id }) => id === col.id);
+    // A configured id with no matching idx field definition cannot be rendered — the Vue column
+    // has nothing to draw. Dropping it here leaves an empty column rather than a debug dump.
+    if (!field) return;
+    seen.add(col.id);
+    definitions.push({ col, field });
+  }));
+
+  const build = (type, emptyAnswer, userAnswerKey) => definitions
+    // eslint-disable-next-line no-underscore-dangle
+    .filter(({ field }) => field.__typename === TYPENAME_FOR[type])
+    .map(({ field }) => {
+      const existing = user ? findAnswer(getAsArray(user, userAnswerKey), field.id) : null;
+      // Progressive profiling only ever renders *missing* fields, so the answered branch is a
+      // safety net rather than the common path. `id` is overwritten with the field id either way.
+      return existing
+        ? { ...existing, id: field.id, field }
+        : { id: field.id, field, ...emptyAnswer };
+    });
+
+  return {
+    customBooleanFieldAnswers: build('custom-boolean', { hasAnswered: false, answer: null, value: null }, 'customBooleanFieldAnswers'),
+    customSelectFieldAnswers: build('custom-select', { hasAnswered: false, answers: [] }, 'customSelectFieldAnswers'),
+    customTextFieldAnswers: build('custom-text', { hasAnswered: false, value: null }, 'customTextFieldAnswers'),
+  };
+};

package/utils/progressive-profile-cookies.js

@@ -0,0 +1,120 @@
+const { get } = require('@mindful-web/object-path');
+
+/**
+ * The three cookies the progressive-profile gate keeps, in one place so the identity-x route and
+ * the theme middleware cannot drift on names or semantics.
+ *
+ * None is a bot safeguard — that is reCAPTCHA's job. These are the escape valve, the optional
+ * dismissal suppression, and the suppression that follows a submission we could not verify.
+ *
+ * All are `httpOnly: false` to match the rest of this package's cookies (`__idx_idt`,
+ * `__idx_form_*`); none authorizes anything, and a client that clears them only earns itself
+ * the gate it was trying to escape.
+ */
+
+const ATTEMPTS_COOKIE = '__idx_pp_att';
+const DISMISS_COOKIE = '__idx_pp_dis';
+const UNVERIFIED_COOKIE = '__idx_pp_sup';
+
+// Days. Long enough that a false-positive human is not re-asked on their next article, short
+// enough that we get another chance at them within the week.
+const DEFAULT_UNVERIFIED_SUPPRESS_DAYS = 3;
+
+// Long enough to outlive a reading session, short enough that a counter left behind by a bad
+// afternoon does not follow someone for a year.
+const ATTEMPTS_MAX_AGE = 24 * 60 * 60 * 1000;
+
+const cookieOptions = (maxAge) => ({ maxAge, httpOnly: false, sameSite: 'lax' });
+
+/**
+ * How many times the gate has been rendered to this browser without a successful submit.
+ *
+ * @param {import('express').Request} req
+ * @returns {number}
+ */
+const getAttempts = (req) => {
+  const raw = get(req, `cookies.${ATTEMPTS_COOKIE}`);
+  const value = Number.parseInt(raw, 10);
+  return Number.isFinite(value) && value > 0 ? value : 0;
+};
+
+/**
+ * Records one more gate render. The caller releases the content once this passes
+ * `maxAttemptsPerUser`.
+ *
+ * This is the escape valve, not a metric. The known cause of an unclearable gate is gone
+ * structurally — there is no `setUnverifiedAppUserData` to no-op silently, and the mutation
+ * reports `changed` truthfully — but a gate that can trap a real person is worse than no gate, so
+ * the valve stays regardless.
+ */
+const incrementAttempts = (req, res) => {
+  const next = getAttempts(req) + 1;
+  if (!res.headersSent) res.cookie(ATTEMPTS_COOKIE, `${next}`, cookieOptions(ATTEMPTS_MAX_AGE));
+  return next;
+};
+
+const clearAttempts = (res) => {
+  if (!res.headersSent) res.clearCookie(ATTEMPTS_COOKIE, { httpOnly: false });
+};
+
+/**
+ * @param {import('express').Request} req
+ * @returns {boolean}
+ */
+const isDismissed = (req) => Boolean(get(req, `cookies.${DISMISS_COOKIE}`));
+
+/**
+ * @param {import('express').Response} res
+ * @param {number} days `suppressAfterDismissDays`. Zero or less is a no-op — the default cadence
+ *   is a hard gate, so dismissal is opt-in per site.
+ */
+const setDismissed = (res, days) => {
+  const value = Number(days);
+  if (!Number.isFinite(value) || value <= 0) return false;
+  if (res.headersSent) return false;
+  res.cookie(DISMISS_COOKIE, '1', cookieOptions(value * 24 * 60 * 60 * 1000));
+  return true;
+};
+
+/**
+ * Whether this browser recently submitted the gate with a reCAPTCHA result we could not trust.
+ *
+ * The answers were discarded, so the member's record still has every field missing and the diff
+ * would gate them again on the very next article — forever. This cookie is what stops that, and it
+ * is not optional: without it the passive-accept path is an infinite loop for anyone reCAPTCHA
+ * consistently misjudges.
+ *
+ * Suppressing the progressive gate hands the visitor back to the content meter, exactly as
+ * dismissal does. It is not a free pass to the whole site.
+ *
+ * @param {import('express').Request} req
+ * @returns {boolean}
+ */
+const isUnverifiedSuppressed = (req) => Boolean(get(req, `cookies.${UNVERIFIED_COOKIE}`));
+
+/**
+ * @param {import('express').Response} res
+ * @param {number} [days] `progressiveProfile.unverifiedSuppressDays`.
+ */
+const setUnverifiedSuppressed = (res, days = DEFAULT_UNVERIFIED_SUPPRESS_DAYS) => {
+  const value = Number(days);
+  if (!Number.isFinite(value) || value <= 0) return false;
+  if (res.headersSent) return false;
+  res.cookie(UNVERIFIED_COOKIE, '1', cookieOptions(value * 24 * 60 * 60 * 1000));
+  return true;
+};
+
+module.exports = {
+  ATTEMPTS_COOKIE,
+  ATTEMPTS_MAX_AGE,
+  DEFAULT_UNVERIFIED_SUPPRESS_DAYS,
+  DISMISS_COOKIE,
+  UNVERIFIED_COOKIE,
+  clearAttempts,
+  getAttempts,
+  incrementAttempts,
+  isDismissed,
+  isUnverifiedSuppressed,
+  setDismissed,
+  setUnverifiedSuppressed,
+};

package/utils/progressive-profile-telemetry.js

@@ -0,0 +1,148 @@
+const { get } = require('@mindful-web/object-path');
+const { newrelicAgent } = require('@mindful-web/utils');
+
+/**
+ * One event per progressive-profile submit, typed by what actually happened.
+ *
+ * Split by type rather than carried as an `outcome` field so each outcome is independently
+ * countable, alertable and dashboardable — "how many passive submits" is a bare `count(*)` on
+ * `ProgressiveProfileDiscarded` rather than a filter someone has to remember.
+ *
+ * Totals and rates span types with a comma-union, which NRQL supports natively:
+ *
+ *   SELECT count(*) FROM ProgressiveProfileSubmit, ProgressiveProfileDiscarded,
+ *     ProgressiveProfileRejected, ProgressiveProfileError FACET eventType() SINCE 1 day ago
+ *
+ *   SELECT percentage(count(*), WHERE eventType() = 'ProgressiveProfileDiscarded')
+ *   FROM ProgressiveProfileSubmit, ProgressiveProfileDiscarded SINCE 1 week ago
+ *
+ * There is deliberately **no `outcome` or `accepted` attribute** — the type carries that fact, and
+ * two encodings of the same thing drift. (The HTTP response still returns
+ * `accepted: 'written' | 'unverified'`; that is the client contract the dataLayer event reads, and
+ * is unrelated.)
+ */
+const EVENT_TYPES = {
+  /** The mutation ran. Adds `fieldCount`, `changed`, `profileUpdateHooks`. */
+  SUBMIT: 'ProgressiveProfileSubmit',
+  /** Passive accept: reCAPTCHA was not satisfied so the write was dropped; `recaptcha` says why. */
+  DISCARDED: 'ProgressiveProfileDiscarded',
+  /** 401/403/400. Adds `reason`: `no-identity` | `identity-mismatch` | `no-answers`. */
+  REJECTED: 'ProgressiveProfileRejected',
+  /** Threw (adds `error`), or fell through without recording (adds `reason: 'unrecorded'`). */
+  ERROR: 'ProgressiveProfileError',
+};
+
+/**
+ * The New Relic agent for this request.
+ *
+ * `req.app.locals.newrelic` is the explicit instance a site passed to `startServer` — see
+ * mindful-web#314. It wins when present. Otherwise fall back to the shared lazy resolver, which
+ * picks up an agent the host app already loaded: the option is new and **no site passes it yet**,
+ * so without the fallback this would go dark on every repo until each entrypoint opts in.
+ *
+ * @param {import('express').Request} req
+ */
+const resolveAgent = (req) => get(req, 'app.locals.newrelic') || newrelicAgent.getAgent();
+
+/**
+ * Records a custom event through this request's agent. The low-level primitive — routes should use
+ * `createRecorder` instead, which adds the at-most-once guarantee and attribute accumulation.
+ *
+ * ## Why a custom event and not transaction attributes
+ *
+ * **Not because transaction attributes are sampled** — measured, they are not. These apps run
+ * 165–588 transactions/minute against a ~10k reservoir, `Transaction` data is queryable 35 days
+ * back, and the existing `idxGoogleStep` attributes land and query fine today. Every New Relic
+ * destination is reservoir-backed anyway (`transaction_events`, `custom_insights_events`,
+ * `application_logging.forwarding`), so there is no unsampled path to move to. Do not "fix" this
+ * back to `addCustomAttributes` on the grounds that sampling was never the problem — it wasn't, and
+ * these are the reasons:
+ *
+ * - The rollout decision rule reads `histogram(recaptchaScore)` and `percentile(recaptchaScore)`.
+ *   A dedicated event type is the right shape for that; `FROM Transaction WHERE name LIKE '%…%'` is
+ *   a string match against a route path that a refactor can silently break.
+ * - It cannot be crowded out by page-view transactions if traffic grows, and it does not depend on
+ *   `Transaction` retention staying where someone set it.
+ *
+ * ## Deliberately not sampled
+ *
+ * Unlike `MindfulApiCall`, which needed a hand-written sampler because it ran ~40M events/month,
+ * this is one row per gate submission. There is no `sampleRate` attribute and `sum(sampleRate)`
+ * semantics do not apply — `count(*)` is the true count.
+ *
+ * Never records submitted answer values. Same rule as the p1event `fieldKeys` and the member-event
+ * `fieldIds`: which questions were asked, never what was entered.
+ *
+ * Failure-proof by the same contract as `newrelicAgent` itself — a missing agent is a silent no-op
+ * and a throwing one is swallowed. Telemetry must never break a request.
+ *
+ * @param {import('express').Request} req
+ * @param {string} type The event type — one of `EVENT_TYPES`.
+ * @param {object} attributes Flat key/values only — New Relic drops nested objects.
+ */
+const recordEvent = (req, type, attributes) => {
+  const nr = resolveAgent(req);
+  if (!nr || typeof nr.recordCustomEvent !== 'function') return;
+  try {
+    nr.recordCustomEvent(type, attributes);
+  } catch (e) { /* telemetry must never break a request */ }
+};
+
+/**
+ * A per-request recorder that emits **at most one** event, whichever branch gets there first.
+ *
+ * The route has five terminal branches plus a throw, and each records its own type — which is what
+ * makes the outcomes separately queryable. The risk in any such design is arithmetic: a path that
+ * records twice inflates a count, and one that records nothing leaves a hole, and either silently
+ * skews the rates the rollout decision reads. So the guarantee is enforced here rather than left to
+ * whoever edits the route next:
+ *
+ * - `record` is a no-op once anything has fired, so a double call cannot double count.
+ * - The caller pairs it with a `finally` backstop, so a path that recorded nothing still produces a
+ *   row — and because that row is `ERROR` with `reason: 'unrecorded'`, a branch added without a
+ *   call site shows up in New Relic instead of quietly going missing.
+ *
+ * `set` accumulates the attributes shared by whichever type ends up firing — `contentId`, then
+ * `recaptcha`/`recaptchaScore` once verified, then `userId`/`auth` once the identity resolves. The
+ * alternative is every call site re-assembling the same list, which is precisely how
+ * multi-call-site telemetry drifts apart.
+ *
+ * @param {import('express').Request} req
+ */
+const createRecorder = (req) => {
+  const started = Date.now();
+  const shared = {};
+  let recorded = null;
+  return {
+    /**
+     * Accumulate attributes for whichever event fires.
+     * @param {object} attributes
+     */
+    set(attributes) {
+      Object.assign(shared, attributes);
+      return this;
+    },
+
+    /**
+     * Emit, unless something already did.
+     * @param {string} type One of `EVENT_TYPES`.
+     * @param {object} [attributes] Merged over the accumulated ones.
+     * @returns {?string} The type written, or `null` when suppressed.
+     */
+    record(type, attributes = {}) {
+      if (recorded) return null;
+      recorded = type;
+      recordEvent(req, type, { ...shared, ...attributes, ms: Date.now() - started });
+      return type;
+    },
+
+    /** The type already written, if any. */
+    get recordedType() {
+      return recorded;
+    },
+  };
+};
+
+module.exports = {
+  EVENT_TYPES, createRecorder, recordEvent, resolveAgent,
+};