@mindful-web/marko-web-omeda-identity-x 1.87.2 → 1.89.0

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-omeda-identity-x$1.87.2/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-omeda-identity-x$1.89.0/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_getCookieId = require("@mindful-web/marko-web-omeda-identity-x/utils/get-cookie-id"),
@@ -51,7 +51,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-omeda-identity-x$1.87.2/components/identify.marko",
+    id: "/@mindful-web/marko-web-omeda-identity-x$1.89.0/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-identity-x/components/identify.marko",

package/external-id/find-encrypted-customer-ids.js

@@ -0,0 +1,41 @@
+const { asArray } = require('@mindful-web/utils');
+const getEncryptedId = require('./get-encrypted-customer-id');
+
+/**
+ * **Every** encrypted Omeda customer id the member holds for this brand, deduped.
+ *
+ * Sibling of `find-encrypted-customer-id.js`, which returns the first match. This one returns them
+ * all, for the single caller that needs the Omeda service to *arbitrate* between them rather than
+ * pick locally: the `encryptedCustomerIds` sent to `rapidCustomerIdentification`, which decide
+ * which customer record receives the write.
+ *
+ * IdentityX external-id storage appends (`pushExternalSourcesForId` uses `$setUnion`), so a member
+ * accumulates ids and can hold several for one brand — 527 members on abmedia (0.65% of those
+ * holding any) and 2,932 on allured (2.0%), measured Aug 2026. Those sets are of two kinds, and
+ * only the service can tell them apart, because telling them apart requires resolving each id
+ * against Omeda:
+ *
+ * - a stale id plus the survivor it was merged into, which **converge** on one customer once
+ *   resolved (~32% of them) — safe to use, and previously excluded for no reason;
+ * - two simultaneously **active** customers, i.e. a genuine duplicate pair (27 of 40 sampled) —
+ *   where any choice is a guess, so the service falls back to email matching.
+ *
+ * **Do not pre-select an id here.** Position carries no information: the stored order is not
+ * creation order (13 matching vs 14 differing) and `$setUnion` does not guarantee ordering. And
+ * "newest" is the wrong instinct anyway — among divergent pairs the *older* record is the richer
+ * one 9 times to 2, because the newest id is typically the empty shell this bug just minted while
+ * the oldest is the member's real customer.
+ *
+ * Deliberately **not** a change to `find-encrypted-customer-id.js`. Its three other callers —
+ * `routes/rapid-identify.js`, `middleware/resync-customer-data.js` and
+ * `integration-hooks/on-authentication-success.js` — drive reads and the olytics cookie, where
+ * "any id for this brand" is correct and long-standing.
+ *
+ * @param {object} params
+ * @param {object[]} [params.externalIds] The IdentityX user's external ids.
+ * @param {string} params.brandKey The Omeda brand key.
+ * @returns {string[]} The cleaned encrypted ids, deduped. Empty when the member holds none.
+ */
+module.exports = ({ externalIds, brandKey } = {}) => [...new Set(asArray(externalIds)
+  .map((externalId) => getEncryptedId({ externalId, brandKey }))
+  .filter((value) => value))];

package/integration-hooks/on-login-link-sent.js

@@ -77,6 +77,12 @@ module.exports = async (params = {}) => {
             ...(requiredFieldKeys.reduce((obj, key) => ({ ...obj, [key]: user[key] }), {})),
             id: user.id,
             email: user.email,
+            // Identifiers, not state — so they belong here even though this branch deliberately
+            // strips everything else. `rapid-identify` reads the member's stored encrypted Omeda
+            // id from these to identify the customer explicitly. Without it an unverified user —
+            // whose record is frequently email-only to begin with — gives Omeda nothing to match
+            // on but an email, which is precisely what mints a duplicate customer.
+            externalIds: user.externalIds,
           },
           behavior,
           promoCode,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-omeda-identity-x",
-  "version": "1.87.2",
+  "version": "1.89.0",
   "description": "Marko Omeda+IdentityX integration tools",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-omeda-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -13,8 +13,8 @@
     "test": "yarn compile --no-clean && yarn lint && mocha --reporter spec"
   },
   "dependencies": {
-    "@mindful-web/marko-web-identity-x": "^1.87.1",
-    "@mindful-web/marko-web-omeda": "^1.85.0",
+    "@mindful-web/marko-web-identity-x": "^1.89.0",
+    "@mindful-web/marko-web-omeda": "^1.88.0",
     "@mindful-web/object-path": "^1.83.1",
     "@mindful-web/utils": "^1.83.1",
     "@parameter1/joi": "^1.2.10",
@@ -33,5 +33,5 @@
     "chai": "^4.3.7",
     "mocha": "^6.2.3"
   },
-  "gitHead": "6538c2484bbf419592ddfdbf82ead6d1e2e99c98"
+  "gitHead": "ef9a5dabc2cbaafb948233f37763a1bfd792b5a4"
 }

package/rapid-identify.js

@@ -2,6 +2,8 @@ const gql = require('graphql-tag');
 const Joi = require('@parameter1/joi');
 const { validate } = require('@parameter1/joi/utils');
 const { get, getAsArray } = require('@mindful-web/object-path');
+const olyticsCookie = require('@mindful-web/marko-web-omeda/olytics/customer-cookie');
+const findEncryptedIds = require('./external-id/find-encrypted-customer-ids');
 const isOmedaDemographicId = require('./external-id/is-demographic-id');
 const isDeploymentTypeId = require('./external-id/is-deployment-type-id');
 const isProductId = require('./external-id/is-product-id');
@@ -213,8 +215,38 @@ module.exports = async (params = {}) => {
     appendPromoCodes.forEach((code) => promoCodes.push(code.promoCode));
   }
 
+  /**
+   * Identify the customer explicitly rather than letting Omeda guess from the payload.
+   *
+   * Omeda's identity resolution is heuristic, and a payload it cannot confidently match mints a
+   * *new* customer. That is not a rare edge: on athleticbusiness (Aug 2026) 8 of 11 duplicates were
+   * created at the exact second of a progressive-profile submit, and 7 of 8 were empty shells — no
+   * name, no company, no address — because that is what Omeda writes when it has only an email to
+   * go on. The progressive-profile audience is identified-but-not-authenticated members created
+   * seconds earlier from an email link, so their idx record legitimately holds nothing but an
+   * email; their payload can never carry contact fields. Their encrypted customer id, however, is
+   * written within a second of member creation — before the submit — so it is the one piece of
+   * identifying data those payloads *can* carry.
+   *
+   * Send *every* id held for the brand and let the service arbitrate. A member can hold several
+   * (storage appends), and only resolving them against Omeda distinguishes a stale id plus its
+   * merge survivor — which converge, and are safe — from two simultaneously active duplicate
+   * records, where any choice is a guess. The service uses the id only on convergence. Picking
+   * here is impossible anyway: stored order is not creation order, and the newest id is usually
+   * the shell this bug minted rather than the member's real customer.
+   *
+   * Empty → field omitted → the service's email-only behaviour, unchanged. Resolution failures
+   * (stale, merged, malformed, unknown) also fall back service-side, so a wrong id here costs
+   * nothing beyond a reported notice.
+   */
+  const storedEncryptedIds = findEncryptedIds({
+    externalIds: appUser.externalIds,
+    brandKey,
+  });
+
   const { id, encryptedCustomerId } = await omedaRapidIdentify({
     email: appUser.email,
+    ...(storedEncryptedIds.length && { encryptedCustomerIds: storedEncryptedIds }),
     ...(productId && { productId }),
     ...(givenName && { firstName: givenName }),
     ...(familyName && { lastName: familyName }),
@@ -257,6 +289,43 @@ module.exports = async (params = {}) => {
     throw new Error(`Omeda rapid identification for brand '${brandKey}' returned no ${missing.join(' and no ')}. No external IDs were written for IdentityX user ${appUser.id}.`);
   }
 
+  /**
+   * Omeda came back with a customer that none of the ids we sent point at.
+   *
+   * Two causes, both expected. A merge landed and the service followed the chain to a survivor we
+   * had never stored; or the ids were ambiguous, the service declined to choose, and email matching
+   * picked a record. Either way the write-back below **appends** (`$setUnion`), so the member ends
+   * up holding one more id than before.
+   *
+   * Reported, never acted on. More stored ids is not itself a problem now — the service resolves
+   * the whole set and uses it whenever they converge, which is what a genuine merge produces. What
+   * this counts is the case that does *not* converge: an additional simultaneously-active customer,
+   * i.e. a duplicate pair that needs merging in Omeda. That count sizes both follow-ups (the Omeda
+   * merges, and replace-semantics for idx external ids so a post-merge write-back retires the
+   * stale id). Deliberately non-fatal and deliberately not a write: identification has already
+   * succeeded, and changing external-id semantics under a merge is not something to improvise on
+   * the auth path.
+   */
+  const resolvedEncryptedId = olyticsCookie.clean(encryptedCustomerId);
+  if (storedEncryptedIds.length && !storedEncryptedIds.includes(resolvedEncryptedId)) {
+    // `config` is absent in unit harnesses and for any direct caller that stubs the service.
+    const { config } = identityX;
+    const onHookError = config && typeof config.get === 'function' ? config.get('onHookError') : null;
+    if (typeof onHookError === 'function') {
+      onHookError(
+        new Error(`Omeda resolved IdentityX user ${appUser.id} onto a customer none of the ${storedEncryptedIds.length} stored encrypted id(s) for brand '${brandKey}' point at. The prior id(s) are retained alongside the new one.`),
+        {
+          omedaIdChanged: true,
+          brandKey,
+          idxUserId: `${appUser.id}`,
+          storedEncryptedIds: storedEncryptedIds.join(','),
+          storedEncryptedIdCount: storedEncryptedIds.length,
+          resolvedEncryptedId,
+        },
+      );
+    }
+  }
+
   const namespace = { provider: 'omeda', tenant: brandKey.toLowerCase(), type: 'customer' };
   await Promise.all([
     identityX.addExternalUserId({

package/test/integration-hooks.spec.js

@@ -2,6 +2,7 @@ const { describe, it } = require('mocha');
 const { expect } = require('chai');
 const onAuthenticationSuccess = require('../integration-hooks/on-authentication-success');
 const onUserProfileUpdate = require('../integration-hooks/on-user-profile-update');
+const onLoginLinkSent = require('../integration-hooks/on-login-link-sent');
 
 const BRAND = 'athlcd';
 
@@ -80,3 +81,71 @@ describe('integration-hooks/on-user-profile-update', () => {
     expect(h.captured()).to.not.have.property('restrictAnswersToFieldIds');
   });
 });
+
+describe('integration-hooks/on-login-link-sent', () => {
+  // The unverified branch deliberately strips the stored user down to the create-form's required
+  // fields plus id/email -- state must not be rebroadcast as writes (#329). External ids are
+  // *identifiers*, not state, and `rapid-identify` needs the encrypted Omeda id from them to
+  // identify the customer explicitly. Without it an unverified member -- whose record is often
+  // email-only -- gives Omeda nothing but an email to match on, which is what mints duplicates.
+  const loginLinkSentWith = async (user) => {
+    let captured;
+    // The hook re-reads the *stored* user after identifying, to decide what to sync back.
+    const stored = {
+      customSelectFieldAnswers: [],
+      customBooleanFieldAnswers: [],
+      customTextFieldAnswers: [],
+      ...user,
+    };
+    await onLoginLinkSent({
+      behavior: { id: 9 },
+      brandKey: BRAND,
+      formatter: async ({ payload }) => payload,
+      idxOmedaRapidIdentify: async (payload) => {
+        captured = payload;
+        return { encryptedCustomerId: '0240G4865912F6U' };
+      },
+      omedaGraphQLClient: {
+        query: async () => ({ data: { customerByEncryptedId: { id: 1, firstName: 'Austin' } } }),
+      },
+      omedaPromoCodeCookieName: 'omeda_promo_code',
+      req: { cookies: {} },
+      source: 'test',
+      service: {
+        ...service(),
+        // No Omeda-linked custom fields, so the answer-sync half is a no-op.
+        client: {
+          query: async () => ({ data: { fields: { edges: [] } } }),
+          mutate: async () => ({ data: {} }),
+        },
+        getOrgUserApiToken: () => 'token',
+      },
+      user: stored,
+    });
+    return captured;
+  };
+
+  it('keeps externalIds on the stripped payload for an UNVERIFIED user', async () => {
+    const externalIds = [encryptedExternalId()];
+    const captured = await loginLinkSentWith({
+      id: 'idx-1',
+      email: 'someone@example.com',
+      verified: false,
+      givenName: 'Austin',
+      externalIds,
+    });
+    expect(captured.user.externalIds).to.deep.equal(externalIds);
+    expect(captured.user.email).to.equal('someone@example.com');
+  });
+
+  it('passes the full user through for a VERIFIED user, externalIds included', async () => {
+    const externalIds = [encryptedExternalId()];
+    const captured = await loginLinkSentWith({
+      id: 'idx-1',
+      email: 'someone@example.com',
+      verified: true,
+      externalIds,
+    });
+    expect(captured.user.externalIds).to.deep.equal(externalIds);
+  });
+});

package/test/rapid-identify.spec.js

@@ -211,3 +211,112 @@ describe('rapid-identify (idx → omeda payload)', () => {
     });
   });
 });
+
+const encryptedExternalId = (value) => ({
+  id: `omeda.customer.${BRAND}*${value}~encrypted`,
+  namespace: { provider: 'omeda', tenant: BRAND, type: 'customer' },
+  identifier: { value, type: 'encrypted' },
+});
+
+const numericExternalId = (value) => ({
+  id: `omeda.customer.${BRAND}*${value}`,
+  namespace: { provider: 'omeda', tenant: BRAND, type: 'customer' },
+  identifier: { value, type: null },
+});
+
+const ID_A = '9130C2719701F5S';
+const ID_B = '6466A3060334H6A';
+
+describe('rapid-identify (deterministic customer matching)', () => {
+  it('sends the stored encrypted id when the member has one for the brand', async () => {
+    // The whole point: identify the customer explicitly so Omeda's heuristics -- which mint
+    // duplicates on contact-field-empty payloads -- are bypassed.
+    const payload = await run({
+      externalIds: [numericExternalId('1105483508'), encryptedExternalId(ID_A)],
+    });
+    expect(payload.encryptedCustomerIds).to.deep.equal([ID_A]);
+  });
+
+  it('sends ALL ids when the member has several, and lets the service arbitrate', async () => {
+    // Only resolving them against Omeda distinguishes a stale id plus its merge survivor (which
+    // converge -- safe to use) from two simultaneously active duplicates (where any choice is a
+    // guess). Pre-selecting here would be a guess, and would strand ~a third of multi-id members
+    // on email matching for no reason.
+    const payload = await run({
+      externalIds: [encryptedExternalId(ID_A), encryptedExternalId(ID_B)],
+    });
+    expect(payload.encryptedCustomerIds).to.deep.equal([ID_A, ID_B]);
+  });
+
+  it('dedupes the same id stored twice, case-insensitively', async () => {
+    const payload = await run({
+      externalIds: [encryptedExternalId(ID_A), encryptedExternalId(ID_A.toLowerCase())],
+    });
+    expect(payload.encryptedCustomerIds).to.deep.equal([ID_A]);
+  });
+
+  it('omits the field when the member has none, or only ids for another brand', async () => {
+    expect(await run({})).to.not.have.property('encryptedCustomerIds');
+    expect(await run({ externalIds: [] })).to.not.have.property('encryptedCustomerIds');
+
+    const otherBrand = encryptedExternalId(ID_A);
+    otherBrand.namespace = { provider: 'omeda', tenant: 'allucd', type: 'customer' };
+    expect(await run({ externalIds: [otherBrand] })).to.not.have.property('encryptedCustomerIds');
+
+    // A numeric id is not an encrypted one.
+    const numericOnly = await run({ externalIds: [numericExternalId('1105483508')] });
+    expect(numericOnly).to.not.have.property('encryptedCustomerIds');
+  });
+
+  it('reports through onHookError when Omeda resolves onto a customer we did not send', async () => {
+    const reported = [];
+    await idxOmedaRapidIdentify({
+      brandKey: BRAND,
+      appUser: {
+        email: 'someone@example.com',
+        id: 'idx-1',
+        externalIds: [encryptedExternalId(ID_A)],
+      },
+      identityX: {
+        addExternalUserId: async () => ({}),
+        config: { get: (key) => (key === 'onHookError' ? (e, attrs) => reported.push({ e, attrs }) : null) },
+      },
+      omedaRapidIdentify: async () => ({ id: 2, encryptedCustomerId: ID_B }),
+    });
+
+    expect(reported).to.have.lengthOf(1);
+    expect(reported[0].attrs).to.deep.equal({
+      omedaIdChanged: true,
+      brandKey: BRAND,
+      idxUserId: 'idx-1',
+      storedEncryptedIds: ID_A,
+      storedEncryptedIdCount: 1,
+      resolvedEncryptedId: ID_B,
+    });
+  });
+
+  it('stays silent when the resolved id is one of the ids we sent', async () => {
+    const reported = [];
+    await idxOmedaRapidIdentify({
+      brandKey: BRAND,
+      appUser: {
+        email: 'someone@example.com',
+        id: 'idx-1',
+        // Ambiguous member: the service may legitimately answer with either one.
+        externalIds: [encryptedExternalId(ID_A), encryptedExternalId(ID_B)],
+      },
+      identityX: {
+        addExternalUserId: async () => ({}),
+        config: { get: () => (e) => reported.push(e) },
+      },
+      // Lowercase -- stored values are cleaned/uppercased, so this is the same id, not a merge.
+      omedaRapidIdentify: async () => ({ id: 2, encryptedCustomerId: ID_B.toLowerCase() }),
+    });
+    expect(reported).to.have.lengthOf(0);
+  });
+
+  it('does not throw when the service has no config (stubbed/direct callers)', async () => {
+    const payload = await run({ id: 'idx-1', externalIds: [encryptedExternalId(ID_A)] });
+    expect(payload.encryptedCustomerIds).to.deep.equal([ID_A]);
+  });
+});