consent handling: Refactor and various fixes (#172)

Author: zapo

lib/core/network.test.js

@@ -20,7 +20,6 @@ describe("buildRequest", () => {
     expect([...url.searchParams.entries()]).toEqual([
       ["query", "string"],
       ["osdk", `web-${buildInfo.version}`],
-      ["reg", "can"],
       ["gpp", "gpp"],
       ["gpp_sid", "1,2"],
       ["cookies", "yes"],

lib/core/network.ts

@@ -8,20 +8,20 @@ function buildRequest(path: string, config: ResolvedConfig, init?: RequestInit):
   const url = new URL(`${site}${path}`, `https://${host}`);
   url.searchParams.set("osdk", `web-${buildInfo.version}`);
 
-  if (config.consent.reg) {
-    url.searchParams.set("reg", config.consent.reg);
-  }
-
-  if (config.consent.gpp) {
+  if (typeof config.consent.gpp !== "undefined") {
     url.searchParams.set("gpp", config.consent.gpp);
   }
 
-  if (config.consent.gppSectionIDs) {
+  if (typeof config.consent.gppSectionIDs !== "undefined") {
     url.searchParams.set("gpp_sid", config.consent.gppSectionIDs.join(","));
   }
 
-  if (config.consent.tcf) {
-    url.searchParams.set("tcf", config.consent.tcf);
+  if (typeof config.consent.gdpr !== "undefined") {
+    url.searchParams.set("gdpr_consent", config.consent.gdpr);
+  }
+
+  if (typeof config.consent.gdprApplies !== "undefined") {
+    url.searchParams.set("gdpr", Number(config.consent.gdprApplies).toString());
   }
 
   if (cookies) {

lib/core/regs/consent.test.js

@@ -1,4 +1,4 @@
-import { getConsent } from "./consent";
+import { getConsent, applicableReg } from "./consent";
 import * as gpp from "./gpp";
 
 const allowAll = {
@@ -15,6 +15,75 @@ const denyAll = {
   measureAdvertisingPerformance: false,
 };
 
+describe("applicableReg", () => {
+  it("returns gdpr when cmp indicates gdpr applies", () => {
+    expect(applicableReg("can", { gdprApplies: true })).toBe("gdpr");
+    expect(applicableReg("us", { gdprApplies: true })).toBe("gdpr");
+    expect(applicableReg(null, { gdprApplies: true })).toBe("gdpr");
+
+    expect(applicableReg("can", { gppSectionIDs: [2] })).toBe("gdpr");
+    expect(applicableReg("us", { gppSectionIDs: [2] })).toBe("gdpr");
+    expect(applicableReg(null, { gppSectionIDs: [2] })).toBe("gdpr");
+  });
+
+  it("returns can when cmp indicates can applies", () => {
+    expect(applicableReg("gdpr", { gppSectionIDs: [5] })).toBe("can");
+    expect(applicableReg("us", { gppSectionIDs: [5] })).toBe("can");
+    expect(applicableReg(null, { gppSectionIDs: [5] })).toBe("can");
+  });
+
+  it("returns us when cmp indicates us applies", () => {
+    expect(applicableReg("gdpr", { gppSectionIDs: [7] })).toBe("us");
+    expect(applicableReg("can", { gppSectionIDs: [7] })).toBe("us");
+    expect(applicableReg(null, { gppSectionIDs: [7] })).toBe("us");
+  });
+
+  it("returns unknown when cmp indicates detected regulation does not apply", () => {
+    expect(applicableReg("gdpr", { gdprApplies: false })).toBe(null);
+    expect(applicableReg("gdpr", { gppSectionIDs: [999] })).toBe(null);
+    expect(applicableReg("gdpr", { gppSectionIDs: [-1] })).toBe(null);
+
+    expect(applicableReg("can", { gppSectionIDs: [999] })).toBe(null);
+    expect(applicableReg("can", { gppSectionIDs: [-1] })).toBe(null);
+
+    expect(applicableReg("us", { gppSectionIDs: [999] })).toBe(null);
+    expect(applicableReg("us", { gppSectionIDs: [-1] })).toBe(null);
+  });
+
+  it("prefers tcf signaling over gpp", () => {
+    expect(applicableReg("gdpr", { gdprApplies: true, gppSectionIDs: [8] })).toBe("gdpr");
+    expect(applicableReg("can", { gdprApplies: true, gppSectionIDs: [5] })).toBe("gdpr");
+    expect(applicableReg("us", { gdprApplies: true, gppSectionIDs: [-1] })).toBe("gdpr");
+    expect(applicableReg("gdpr", { gdprApplies: false, gppSectionIDs: [8] })).toBe(null);
+    expect(applicableReg("can", { gdprApplies: false, gppSectionIDs: [5] })).toBe("can");
+    expect(applicableReg("us", { gdprApplies: false, gppSectionIDs: [-1] })).toBe("us");
+
+    // presence of gdprData may resolve to gdpr only if it was detected as well
+    expect(applicableReg("gdpr", { gdprData: {} })).toBe("gdpr");
+    expect(applicableReg(null, { gdprData: {} })).toBe(null);
+    expect(applicableReg("can", { gdprData: {} })).toBe("can");
+  });
+
+  it("infers gdpr>can>us when using gpp", () => {
+    expect(applicableReg(null, { gppSectionIDs: [2, 5, 7, 8] })).toBe("gdpr");
+    expect(applicableReg(null, { gppSectionIDs: [5, 7, 8] })).toBe("can");
+    expect(applicableReg(null, { gppSectionIDs: [7, 8] })).toBe("us");
+    expect(applicableReg(null, { gppSectionIDs: [8] })).toBe("us");
+    expect(applicableReg(null, { gppSectionIDs: [] })).toBe(null);
+  });
+
+  it("returns reg until cmp knows", () => {
+    expect(applicableReg("gdpr", {})).toBe("gdpr");
+    expect(applicableReg("gdpr", { gppSectionIDs: [0] })).toBe("gdpr");
+
+    expect(applicableReg("can", {})).toBe("can");
+    expect(applicableReg("can", { gppSectionIDs: [0] })).toBe("can");
+
+    expect(applicableReg("us", {})).toBe("us");
+    expect(applicableReg("us", { gppSectionIDs: [0] })).toBe("us");
+  });
+});
+
 describe("getConsent", () => {
   afterEach(() => {
     Object.defineProperties(window, {
@@ -64,7 +133,7 @@ describe("getConsent", () => {
     // Simulate event indicating that gdpr doesn't apply
     signal(tcfData({ gdprApplies: false, tcString: "doesntapply" }));
     expect(consent.deviceAccess).toBe(true);
-    expect(consent.tcf).toBeUndefined();
+    expect(consent.gdpr).toBe("doesntapply");
 
     // Simulate event where no consent is granted
     signal(
@@ -74,7 +143,7 @@ describe("getConsent", () => {
       })
     );
     expect(consent.deviceAccess).toBe(false);
-    expect(consent.tcf).toBe("noconsent");
+    expect(consent.gdpr).toBe("noconsent");
 
     // Simulate event where purpose 1 consent is granted to the publisher
     signal(
@@ -84,7 +153,7 @@ describe("getConsent", () => {
       })
     );
     expect(consent.deviceAccess).toBe(true);
-    expect(consent.tcf).toBe("purpose1");
+    expect(consent.gdpr).toBe("purpose1");
 
     // Simulate removing consent
     signal(
@@ -94,7 +163,7 @@ describe("getConsent", () => {
       })
     );
     expect(consent.deviceAccess).toBe(false);
-    expect(consent.tcf).toBe("revoked");
+    expect(consent.gdpr).toBe("revoked");
   });
 
   it("updates consent based on gpp signals for gdpr", () => {
@@ -105,11 +174,11 @@ describe("getConsent", () => {
     expect(consent.deviceAccess).toBe(false);
     expect(consent.reg).toBe("gdpr");
 
-    // Simulate gpp ready event indicating no applicable sections
-    signal({ applicableSections: [-1], gppString: "ignored" });
-    expect(consent.deviceAccess).toBe(true);
+    // Simulate gpp ready event indicating applicable sections unknown
+    signal({ applicableSections: [0], gppString: "ignored" });
+    expect(consent.deviceAccess).toBe(false);
     expect(consent.gpp).toBe("ignored");
-    expect(consent.gppSectionIDs).toEqual([-1]);
+    expect(consent.gppSectionIDs).toEqual([0]);
 
     // Section tcfeuv2 applies but nothing in parsed sections
     signal({ parsedSections: {}, applicableSections: [gpp.tcfeuv2.SectionID], gppString: "noparsedsections" });
@@ -247,7 +316,7 @@ describe("getConsent", () => {
     );
 
     expect(consent.deviceAccess).toBe(true);
-    expect(consent.tcf).toBe("granted");
+    expect(consent.gdpr).toBe("granted");
     expect(consent.gpp).toBe("revoked");
   });