@mindful-web/marko-web-identity-x 1.96.3 → 1.105.1

package/CLAUDE.md

@@ -5,7 +5,8 @@ Web sites. Owns the whole authenticated-user surface: login / register / authent
 / profile / logout, content access + download gating, comments, and the server-side IdentityX API
 client. Add-ons layer on top: `marko-web-omeda-identity-x` (wraps this and adds Omeda hooks —
 how most sites install it), `marko-web-auth0-identity-x`, `marko-web-identity-x-mailchimp`. Google
-Sign-In (One-Tap + button) is **built in** here (see below).
+Sign-In (One-Tap + button) is **built in** here (see below). The opt-in Identity Bridge sync
+(`integrations/identity-bridge-sync`, see below) reports member events to Mindful Identity Bridge.
 
 ## Config model — the `IdentityXConfiguration` instance (`config.js`)
 
@@ -698,6 +699,52 @@ Submitted **answer values are never tracked** anywhere — `fieldKeys` and the m
    still exclude `custom-boolean` — no longer for the renderer bug, but because the gate forces
    required columns and a required checkbox can only submit `true` (see the boot-check table).
 
+## Identity Bridge sync (`integrations/identity-bridge-sync`) — added 2026-10
+
+Opt-in hook installer that reports member events to Mindful Identity Bridge's `POST /:tenantKey/sync`
+(`apis/identity-bridge` in mindful-reporting, tracked in parameter1/mindful-reporting#304). Identity
+Bridge decides which third-party providers act on each event (eMagazines today). **This package holds
+no provider logic, config or keys** — it replaced mindful-web#363, which ran eMagazines from here.
+
+```js
+const installIdentityBridgeSync = require('@mindful-web/marko-web-identity-x/integrations/identity-bridge-sync');
+installIdentityBridgeSync(idxConfig, { websiteId: process.env.SITE_ID });
+```
+
+| Hook | Event sent |
+|---|---|
+| `onAuthenticationSuccess` | `{ event: 'authenticated', websiteId, user, loginSource }` |
+| `onUserProfileUpdate` | `{ event: 'profile-updated', websiteId, user }` |
+| `onChangeEmailSuccess` | `{ event: 'email-changed', websiteId, user /* new email */, oldEmail }` |
+
+`user` is `{ id, email, givenName, familyName, street, city, regionCode, postalCode }` from the
+IdentityX app user.
+
+- **Send values as they are.** The server normalizes `null`/`''`/whitespace to unset and lowercases
+  emails. Don't clean them here.
+- **Don't filter here.** Every login is sent, `change-email` included (`change-email-confirm.js`
+  fires `onAuthenticationSuccess` right after `onChangeEmailSuccess`). The server skips those logins
+  and applies the website's `loginSources`. Adding a filter here would split one rule across two repos.
+- **All three hooks use `shouldAwait: false`.** The server runs synchronously and returns 502 when a
+  provider call fails, and the client throws on any non-2xx. So failures reach `onHookError` without
+  blocking the IdentityX request.
+- **The client comes from the request.** The hooks call `req.mindful.identityBridge.sync()`, which
+  the `@mindful-web/mindful` service middleware sets when given `identityBridge`
+  (`packages/mindful/identity-bridge.js`). Each hook throws a clear error when the client is missing.
+  ⚠️ The site must install that middleware **before** its IdentityX routes:
+
+  ```js
+  identityBridge: {
+    apiKey: process.env.MINDFUL_IDENTITY_BRIDGE_API_KEY,
+    tenantKey: 'allured', // the Mindful tenant key, NOT the site's TENANT_KEY (e.g. `indm_multi`)
+  },
+  ```
+
+- `websiteId` is the CMS website id (`SITE_ID`). The server returns 400 if that id doesn't belong to
+  the tenant. A website with no providers configured gets `{ data: [] }`.
+- Specs: `test/integrations/identity-bridge-sync.spec.js` (hooks) and `packages/mindful/test/` (client
+  + middleware).
+
 ## Fleet / rollout
 
 Not tracked in-repo. The Google-auth architecture change + fleet rollout plan lives outside the repo

package/README.md

@@ -264,3 +264,40 @@ The Google account id (JWT `sub`) is persisted as a supplementary idx external i
 `{ provider: 'google', tenant: 'oauth', type: 'account' }`; email stays the primary key.
 Non-fatal linkage errors report through the config's `onHookError`.
 | `identity-x-comment-stream-errored` | `{ label, message: '...', ...additionalEventData }`
+
+## Identity Bridge sync
+
+Opt-in, and **off until installed.** It reports logins, profile updates and email changes to Mindful
+Identity Bridge, which passes them on to the third-party providers configured for the website (e.g.
+eMagazines). Every decision is made server side. This package sends the events and nothing else.
+
+1. Give the Mindful service middleware an Identity Bridge client. Install it **before** the IdentityX
+   routes, because the hooks read `req.mindful.identityBridge`:
+
+   ```js
+   const mindfulService = require('@mindful-web/mindful/marko-web/middleware/service');
+
+   app.use(mindfulService({
+     namespace: '<tenant>/<site>',
+     identityBridge: {
+       apiKey: process.env.MINDFUL_IDENTITY_BRIDGE_API_KEY,
+       tenantKey: 'allured', // the Mindful tenant key, not the site's TENANT_KEY
+     },
+   }));
+   ```
+
+   `identityBridge` also takes `timeout` (ms, default 15000) and `url` (default
+   `https://apis.internal.mindfulcms.com/identity-bridge`). Without it, `req.mindful.identityBridge`
+   is `null`.
+
+2. Install the hooks on the IdentityX config:
+
+   ```js
+   const installIdentityBridgeSync = require('@mindful-web/marko-web-identity-x/integrations/identity-bridge-sync');
+
+   installIdentityBridgeSync(idxConfig, { websiteId: process.env.SITE_ID });
+   ```
+
+The `onAuthenticationSuccess`, `onUserProfileUpdate` and `onChangeEmailSuccess` hooks are not
+awaited. A failed sync, including a missing client on the request, is reported through the config's
+`onHookError`.

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -239,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/progressive-profile-form.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/progressive-profile-form.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/progressive-profile-form.marko",
     marko_component = require("./progressive-profile-form.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -137,7 +137,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/progressive-profile-form.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/progressive-profile-form.marko",
     component: "./progressive-profile-form.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.96.3/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.105.1/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.96.3/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.105.1/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/integrations/identity-bridge-sync/index.js

@@ -0,0 +1,77 @@
+/**
+ * Maps an IdentityX app user to the Identity Bridge `user`. Values are sent as they are: the server
+ * normalizes `null`/empty fields and lowercases the email.
+ *
+ * @param {object} user The IdentityX app user
+ */
+const toSyncUser = (user) => ({
+  id: user.id,
+  email: user.email,
+  givenName: user.givenName,
+  familyName: user.familyName,
+  street: user.street,
+  city: user.city,
+  regionCode: user.regionCode,
+  postalCode: user.postalCode,
+});
+
+/**
+ * @param {import('express').Request} req
+ */
+const getClient = (req) => {
+  const client = req && req.mindful && req.mindful.identityBridge;
+  if (!client) throw new Error('No Identity Bridge client on the request. Pass `identityBridge` to the Mindful service middleware.');
+  return client;
+};
+
+/**
+ * Reports IdentityX member events to Mindful Identity Bridge (`POST /:tenantKey/sync`), which
+ * decides which third-party providers act on them. Nothing provider-specific lives here: login
+ * source filtering, `change-email` logins and subscription checks are all handled server side.
+ *
+ * Requires the `@mindful-web/mindful` service middleware, configured with `identityBridge`, to run
+ * before the IdentityX routes so `req.mindful.identityBridge` is set.
+ *
+ * None of the hooks are awaited, so a slow or failed sync never blocks the IdentityX request.
+ * Failures are reported through the config's `onHookError`.
+ *
+ * @param {import("../../config")} idxConfig
+ * @param {object} options
+ * @param {string} options.websiteId The site's CMS website ID (`SITE_ID`)
+ */
+module.exports = (idxConfig, { websiteId } = {}) => {
+  if (!idxConfig || !idxConfig.addHook) throw new Error('Unable to install the Identity Bridge sync hooks.');
+  if (!websiteId) throw new Error('A websiteId is required to install the Identity Bridge sync hooks.');
+
+  idxConfig.addHook({
+    name: 'onAuthenticationSuccess',
+    shouldAwait: false,
+    fn: async ({ req, user, loginSource }) => getClient(req).sync({
+      event: 'authenticated',
+      websiteId,
+      loginSource,
+      user: toSyncUser(user),
+    }),
+  });
+
+  idxConfig.addHook({
+    name: 'onUserProfileUpdate',
+    shouldAwait: false,
+    fn: async ({ req, user }) => getClient(req).sync({
+      event: 'profile-updated',
+      websiteId,
+      user: toSyncUser(user),
+    }),
+  });
+
+  idxConfig.addHook({
+    name: 'onChangeEmailSuccess',
+    shouldAwait: false,
+    fn: async ({ req, user, oldEmail }) => getClient(req).sync({
+      event: 'email-changed',
+      websiteId,
+      oldEmail,
+      user: toSyncUser(user),
+    }),
+  });
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.96.3",
+  "version": "1.105.1",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -43,5 +43,5 @@
     "chai": "^4.3.7",
     "mocha": "^6.2.3"
   },
-  "gitHead": "3b66b74c73d0d784f2baf47a506f705012071923"
+  "gitHead": "e6054405dc7918b784fd8cb8b8b0042dd251f248"
 }

package/routes/authenticate.js

@@ -40,7 +40,9 @@ module.exports = asyncRoute(async (req, res) => {
   const { token: authToken, user, loginSource } = data.loginAppUser;
   const additionalEventData = {
     ...getAsObject(body, 'additionalEventData'),
-    ...getAsObject(data, 'loginAppUer.AdditionContext'),
+    // The login's own event data (displayOverlay, newsletterSignupType, …), stored on the login
+    // token by sendLoginLink. Was read from a misspelled path, so hooks never received it.
+    ...getAsObject(data, 'loginAppUser.additionalContext'),
   };
 
   // call authentication hooks

package/test/integrations/identity-bridge-sync.spec.js

@@ -0,0 +1,162 @@
+const { describe, it } = require('mocha');
+const { expect } = require('chai');
+const install = require('../../integrations/identity-bridge-sync');
+
+/**
+ * Installs the hooks against a stub config and returns them by name.
+ */
+const installHooks = (options = { websiteId: 'website-1' }) => {
+  const hooks = [];
+  install({ addHook: (hook) => hooks.push(hook) }, options);
+  return hooks.reduce((o, hook) => ({ ...o, [hook.name]: hook }), {});
+};
+
+/**
+ * A request carrying a stubbed Identity Bridge client that records every event.
+ */
+const buildReq = () => {
+  const events = [];
+  const identityBridge = {
+    sync: async (event) => {
+      events.push(event);
+      return [];
+    },
+  };
+  return { req: { mindful: { identityBridge } }, events };
+};
+
+const rejectionOf = async (promise) => {
+  try {
+    await promise;
+  } catch (e) {
+    return e;
+  }
+  return null;
+};
+
+const user = {
+  id: 'user-1',
+  email: 'jane@example.com',
+  givenName: 'Jane',
+  familyName: null,
+  street: '',
+  city: 'Chicago',
+  regionCode: 'US-IL',
+  postalCode: '60601',
+  verified: true,
+  customAttributes: { foo: 'bar' },
+};
+
+// Sent as IdentityX has it, `null` and `''` included; the server normalizes them.
+const syncUser = {
+  id: 'user-1',
+  email: 'jane@example.com',
+  givenName: 'Jane',
+  familyName: null,
+  street: '',
+  city: 'Chicago',
+  regionCode: 'US-IL',
+  postalCode: '60601',
+};
+
+describe('integrations/identity-bridge-sync', () => {
+  describe('install', () => {
+    it('registers non-awaited login, profile update and email change hooks', () => {
+      const hooks = [];
+      install({ addHook: (hook) => hooks.push(hook) }, { websiteId: 'website-1' });
+      expect(hooks.map(({ name }) => name)).to.deep.equal([
+        'onAuthenticationSuccess',
+        'onUserProfileUpdate',
+        'onChangeEmailSuccess',
+      ]);
+      hooks.forEach((hook) => expect(hook.shouldAwait).to.equal(false));
+    });
+
+    it('throws without an IdentityX config', () => {
+      expect(() => install()).to.throw('Unable to install the Identity Bridge sync hooks.');
+    });
+
+    it('throws without a website id', () => {
+      expect(() => installHooks({})).to.throw('A websiteId is required to install the Identity Bridge sync hooks.');
+    });
+  });
+
+  describe('onAuthenticationSuccess', () => {
+    it('sends an authenticated event with the login source', async () => {
+      const { req, events } = buildReq();
+      await installHooks().onAuthenticationSuccess.fn({ req, user, loginSource: 'contentGate' });
+      expect(events).to.deep.equal([{
+        event: 'authenticated',
+        websiteId: 'website-1',
+        loginSource: 'contentGate',
+        user: syncUser,
+      }]);
+    });
+
+    it('sends every login source, including change-email, for the server to filter', async () => {
+      const { req, events } = buildReq();
+      await installHooks().onAuthenticationSuccess.fn({ req, user, loginSource: 'change-email' });
+      expect(events).to.have.lengthOf(1);
+      expect(events[0].loginSource).to.equal('change-email');
+    });
+  });
+
+  describe('onUserProfileUpdate', () => {
+    it('sends a profile-updated event', async () => {
+      const { req, events } = buildReq();
+      await installHooks().onUserProfileUpdate.fn({ req, user, actionSource: 'profile' });
+      expect(events).to.deep.equal([{
+        event: 'profile-updated',
+        websiteId: 'website-1',
+        user: syncUser,
+      }]);
+    });
+  });
+
+  describe('onChangeEmailSuccess', () => {
+    it('sends an email-changed event with the new email on the user', async () => {
+      const { req, events } = buildReq();
+      await installHooks().onChangeEmailSuccess.fn({
+        req,
+        user: { ...user, email: 'jane.new@example.com' },
+        oldEmail: 'jane@example.com',
+      });
+      expect(events).to.deep.equal([{
+        event: 'email-changed',
+        websiteId: 'website-1',
+        oldEmail: 'jane@example.com',
+        user: { ...syncUser, email: 'jane.new@example.com' },
+      }]);
+    });
+  });
+
+  describe('without a client on the request', () => {
+    ['onAuthenticationSuccess', 'onUserProfileUpdate', 'onChangeEmailSuccess'].forEach((name) => {
+      it(`${name} throws a clear error`, async () => {
+        const hooks = installHooks();
+        const reqs = [{}, { mindful: {} }, { mindful: { identityBridge: null } }];
+        const errors = await Promise.all(reqs.map((req) => rejectionOf(hooks[name].fn({
+          req,
+          user,
+          oldEmail: 'jane@example.com',
+        }))));
+        errors.forEach((error) => {
+          expect(error).to.be.an('error');
+          expect(error.message).to.equal('No Identity Bridge client on the request. Pass `identityBridge` to the Mindful service middleware.');
+        });
+      });
+    });
+  });
+
+  it('passes on a failed sync so onHookError reports it', async () => {
+    const req = {
+      mindful: {
+        identityBridge: {
+          sync: async () => { throw new Error('Identity Bridge sync failed (502): emagazines'); },
+        },
+      },
+    };
+    const error = await rejectionOf(installHooks().onUserProfileUpdate.fn({ req, user }));
+    expect(error.message).to.equal('Identity Bridge sync failed (502): emagazines');
+  });
+});

package/test/routes/authenticate.spec.js

@@ -0,0 +1,67 @@
+const { describe, it } = require('mocha');
+const { expect } = require('chai');
+const route = require('../../routes/authenticate');
+
+const run = async ({ additionalContext, bodyEventData } = {}) => {
+  const hookArgs = [];
+  let json;
+  const identityX = {
+    client: {
+      mutate: async () => ({
+        data: {
+          loginAppUser: {
+            token: { id: 'tok', value: 'tok-value' },
+            user: { id: 'user-1' },
+            loginSource: 'content_meter_login',
+            additionalContext,
+          },
+        },
+      }),
+    },
+    config: {
+      hooks: {
+        onAuthenticationSuccess: [{ fn: (args) => hookArgs.push(args), shouldAwait: true }],
+      },
+      get: () => undefined,
+      getAppId: () => 'app-1',
+    },
+    getOrgUserApiToken: () => 'org-token',
+    setIdentityCookie: () => {},
+    generateEntityId: async () => 'entity-1',
+    findUserById: async (id) => ({ id }),
+  };
+  const req = { identityX, body: { token: 'login-token', additionalEventData: bodyEventData } };
+  const res = { cookie: () => {}, json: (value) => { json = value; } };
+  let error;
+  await route(req, res, (e) => { error = e; });
+  if (error) throw error;
+  return { hookArgs, json };
+};
+
+describe('routes/authenticate', () => {
+  it('passes the login token context to onAuthenticationSuccess', async () => {
+    // The login's own event data is what lets the hook attribute the Verify Email behavior to
+    // the same source as Log In (e.g. a metered-gate overlay). It was read from a misspelled
+    // path, so the hook never received it.
+    const { hookArgs, json } = await run({
+      additionalContext: { displayOverlay: true, actionSource: 'content_meter_login', source: 'content_meter_login' },
+    });
+    expect(hookArgs).to.have.length(1);
+    expect(hookArgs[0].loginSource).to.equal('content_meter_login');
+    expect(hookArgs[0].additionalEventData).to.include({ displayOverlay: true, actionSource: 'content_meter_login' });
+    expect(json.additionalEventData).to.include({ displayOverlay: true });
+  });
+
+  it('lets the token context win over event data posted by the authenticate page', async () => {
+    const { hookArgs } = await run({
+      additionalContext: { newsletterSignupType: 'pushdown' },
+      bodyEventData: { newsletterSignupType: 'footer', fromPage: true },
+    });
+    expect(hookArgs[0].additionalEventData).to.include({ newsletterSignupType: 'pushdown', fromPage: true });
+  });
+
+  it('tolerates a token with no stored context', async () => {
+    const { hookArgs } = await run({ bodyEventData: { fromPage: true } });
+    expect(hookArgs[0].additionalEventData).to.deep.equal({ fromPage: true });
+  });
+});