Skip to content

Commit

Permalink
Tcf2 id support (#1420)
Browse files Browse the repository at this point in the history
  • Loading branch information
@hhhjort
hhhjort authored Aug 12, 2020
1 parent cc43502 commit e67dfa4
Show file tree
Hide file tree
Showing 10 changed files with 100 additions and 38 deletions.
5 changes: 3 additions & 2 deletions endpoints/auction_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -408,6 +408,7 @@ type auctionMockPermissions struct {
allowHostCookies bool
allowPI bool
allowGeo bool
allowID bool
}

func (m *auctionMockPermissions) HostCookiesAllowed(ctx context.Context, consent string) (bool, error) {
Expand All @@ -418,8 +419,8 @@ func (m *auctionMockPermissions) BidderSyncAllowed(ctx context.Context, bidder o
return m.allowBidderSync, nil
}

func (m *auctionMockPermissions) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, error) {
return m.allowPI, m.allowGeo, nil
func (m *auctionMockPermissions) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, bool, error) {
return m.allowPI, m.allowGeo, m.allowID, nil
}

func (m *auctionMockPermissions) AMPException() bool {
Expand Down
4 changes: 2 additions & 2 deletions endpoints/cookie_sync_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -254,8 +254,8 @@ func (g *gdprPerms) BidderSyncAllowed(ctx context.Context, bidder openrtb_ext.Bi
return ok, nil
}

func (g *gdprPerms) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, error) {
return true, true, nil
func (g *gdprPerms) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, bool, error) {
return true, true, true, nil
}

func (g *gdprPerms) AMPException() bool {
Expand Down
4 changes: 2 additions & 2 deletions endpoints/setuid_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -437,8 +437,8 @@ func (g *mockPermsSetUID) BidderSyncAllowed(ctx context.Context, bidder openrtb_
return false, nil
}

func (g *mockPermsSetUID) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, error) {
return g.allowPI, g.allowPI, nil
func (g *mockPermsSetUID) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, bool, error) {
return g.allowPI, g.allowPI, g.allowPI, nil
}

func (g *mockPermsSetUID) AMPException() bool {
Expand Down
4 changes: 3 additions & 1 deletion exchange/utils.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -107,12 +107,14 @@ func cleanOpenRTBRequests(ctx context.Context,
coreBidder := resolveBidder(bidder.String(), aliases)

var publisherID = labels.PubID
ok, geo, err := gDPR.PersonalInfoAllowed(ctx, coreBidder, publisherID, consent)
ok, geo, id, err := gDPR.PersonalInfoAllowed(ctx, coreBidder, publisherID, consent)
privacyEnforcement.GDPR = !ok && err == nil
privacyEnforcement.GDPRGeo = !geo && err == nil
privacyEnforcement.GDPRID = !id && err == nil
} else {
privacyEnforcement.GDPR = false
privacyEnforcement.GDPRGeo = false
privacyEnforcement.GDPRID = false
}

privacyEnforcement.Apply(bidReq, ampGDPRException)
Expand Down
4 changes: 2 additions & 2 deletions exchange/utils_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@ func (p *permissionsMock) BidderSyncAllowed(ctx context.Context, bidder openrtb_
return true, nil
}

func (p *permissionsMock) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, error) {
return p.personalInfoAllowed, p.personalInfoAllowed, nil
func (p *permissionsMock) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, bool, error) {
return p.personalInfoAllowed, p.personalInfoAllowed, p.personalInfoAllowed, nil
}

func (p *permissionsMock) AMPException() bool {
Expand Down
2 changes: 1 addition & 1 deletion gdpr/gdpr.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ type Permissions interface {
// Determines whether or not to send PI information to a bidder, or mask it out.
//
// If the consent string was nonsensical, the returned error will be an ErrorMalformedConsent.
PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, error)
PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, bool, error)

// Exposes the AMP execption flag
AMPException() bool
Expand Down
35 changes: 21 additions & 14 deletions gdpr/impl.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,10 @@ func (p *permissionsImpl) BidderSyncAllowed(ctx context.Context, bidder openrtb_
return false, nil
}

func (p *permissionsImpl) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, error) {
func (p *permissionsImpl) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, bool, error) {
_, ok := p.cfg.NonStandardPublisherMap[PublisherID]
if ok {
return true, true, nil
return true, true, true, nil
}

id, ok := p.vendorIDs[bidder]
Expand All @@ -54,10 +54,10 @@ func (p *permissionsImpl) PersonalInfoAllowed(ctx context.Context, bidder openrt
}

if consent == "" {
return p.cfg.UsersyncIfAmbiguous, p.cfg.UsersyncIfAmbiguous, nil
return p.cfg.UsersyncIfAmbiguous, p.cfg.UsersyncIfAmbiguous, p.cfg.UsersyncIfAmbiguous, nil
}

return false, false, nil
return false, false, false, nil
}

func (p *permissionsImpl) AMPException() bool {
Expand Down Expand Up @@ -98,41 +98,42 @@ func (p *permissionsImpl) allowSync(ctx context.Context, vendorID uint16, consen
return false, nil
}

func (p *permissionsImpl) allowPI(ctx context.Context, vendorID uint16, consent string) (bool, bool, error) {
func (p *permissionsImpl) allowPI(ctx context.Context, vendorID uint16, consent string) (bool, bool, bool, error) {
// If we're not given a consent string, respect the preferences in the app config.
if consent == "" {
return p.cfg.UsersyncIfAmbiguous, p.cfg.UsersyncIfAmbiguous, nil
return p.cfg.UsersyncIfAmbiguous, p.cfg.UsersyncIfAmbiguous, p.cfg.UsersyncIfAmbiguous, nil
}

parsedConsent, vendor, err := p.parseVendor(ctx, vendorID, consent)
if err != nil {
return false, false, err
return false, false, false, err
}

if vendor == nil {
return false, false, nil
return false, false, false, nil
}

if parsedConsent.Version() == 2 {
if p.cfg.TCF2.Enabled {
return p.allowPITCF2(parsedConsent, vendor, vendorID)
}
if (vendor.Purpose(consentconstants.InfoStorageAccess) || vendor.LegitimateInterest(consentconstants.InfoStorageAccess)) && parsedConsent.PurposeAllowed(consentconstants.InfoStorageAccess) && (vendor.Purpose(consentconstants.PersonalizationProfile) || vendor.LegitimateInterest(consentconstants.PersonalizationProfile)) && parsedConsent.PurposeAllowed(consentconstants.PersonalizationProfile) && parsedConsent.VendorConsent(vendorID) {
return true, true, nil
return true, true, true, nil
}
} else {
if (vendor.Purpose(tcf1constants.InfoStorageAccess) || vendor.LegitimateInterest(tcf1constants.InfoStorageAccess)) && parsedConsent.PurposeAllowed(tcf1constants.InfoStorageAccess) && (vendor.Purpose(tcf1constants.AdSelectionDeliveryReporting) || vendor.LegitimateInterest(tcf1constants.AdSelectionDeliveryReporting)) && parsedConsent.PurposeAllowed(tcf1constants.AdSelectionDeliveryReporting) && parsedConsent.VendorConsent(vendorID) {
return true, true, nil
return true, true, true, nil
}
}
return false, false, nil
return false, false, false, nil
}

func (p *permissionsImpl) allowPITCF2(parsedConsent api.VendorConsents, vendor api.Vendor, vendorID uint16) (allowPI bool, allowGeo bool, err error) {
func (p *permissionsImpl) allowPITCF2(parsedConsent api.VendorConsents, vendor api.Vendor, vendorID uint16) (allowPI bool, allowGeo bool, allowID bool, err error) {
consent, ok := parsedConsent.(tcf2.ConsentMetadata)
err = nil
allowPI = false
allowGeo = false
allowID = false
if !ok {
err = fmt.Errorf("Unable to access TCF2 parsed consent")
return
Expand All @@ -142,6 +143,12 @@ func (p *permissionsImpl) allowPITCF2(parsedConsent api.VendorConsents, vendor a
} else {
allowGeo = true
}
for i := 2; i <= 10; i++ {
if p.checkPurpose(consent, vendor, vendorID, tcf1constants.Purpose(i)) {
allowID = true
break
}
}
// Set to true so any purpose check can flip it to false
allowPI = true
if p.cfg.TCF2.Purpose1.Enabled {
Expand Down Expand Up @@ -214,8 +221,8 @@ func (a AlwaysAllow) BidderSyncAllowed(ctx context.Context, bidder openrtb_ext.B
return true, nil
}

func (a AlwaysAllow) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, error) {
return true, true, nil
func (a AlwaysAllow) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, consent string) (bool, bool, bool, error) {
return true, true, true, nil
}

func (a AlwaysAllow) AMPException() bool {
Expand Down
35 changes: 27 additions & 8 deletions gdpr/impl_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -207,17 +207,17 @@ func TestAllowPersonalInfo(t *testing.T) {
}

// PI needs both purposes to succeed
allowPI, _, err := perms.PersonalInfoAllowed(context.Background(), openrtb_ext.BidderAppnexus, "", "BOS2bx5OS2bx5ABABBAAABoAAAABBwAA")
allowPI, _, _, err := perms.PersonalInfoAllowed(context.Background(), openrtb_ext.BidderAppnexus, "", "BOS2bx5OS2bx5ABABBAAABoAAAABBwAA")
assertNilErr(t, err)
assertBoolsEqual(t, false, allowPI)

allowPI, _, err = perms.PersonalInfoAllowed(context.Background(), openrtb_ext.BidderPubmatic, "", "BOS2bx5OS2bx5ABABBAAABoAAAABBwAA")
allowPI, _, _, err = perms.PersonalInfoAllowed(context.Background(), openrtb_ext.BidderPubmatic, "", "BOS2bx5OS2bx5ABABBAAABoAAAABBwAA")
assertNilErr(t, err)
assertBoolsEqual(t, true, allowPI)

// Assert that an item that otherwise would not be allowed PI access, gets approved because it is found in the GDPR.NonStandardPublishers array
perms.cfg.NonStandardPublisherMap = map[string]int{"appNexusAppID": 1}
allowPI, _, err = perms.PersonalInfoAllowed(context.Background(), openrtb_ext.BidderAppnexus, "appNexusAppID", "BOS2bx5OS2bx5ABABBAAABoAAAABBwAA")
allowPI, _, _, err = perms.PersonalInfoAllowed(context.Background(), openrtb_ext.BidderAppnexus, "appNexusAppID", "BOS2bx5OS2bx5ABABBAAABoAAAABBwAA")
assertNilErr(t, err)
assertBoolsEqual(t, true, allowPI)
}
Expand Down Expand Up @@ -257,6 +257,7 @@ type tcf2TestDef struct {
consent string
allowPI bool
allowGeo bool
allowID bool
}

func TestAllowPersonalInfoTCF2(t *testing.T) {
Expand Down Expand Up @@ -285,28 +286,32 @@ func TestAllowPersonalInfoTCF2(t *testing.T) {
consent: "COzTVhaOzTVhaGvAAAENAiCIAP_AAH_AAAAAAEEUACCKAAA",
allowPI: false,
allowGeo: false,
allowID: false,
},
{
description: "Pubmatic vendor test, flex purposes claimed",
bidder: openrtb_ext.BidderPubmatic,
consent: "COzTVhaOzTVhaGvAAAENAiCIAP_AAH_AAAAAAEEUACCKAAA",
allowPI: true,
allowGeo: true,
allowID: true,
},
{
description: "Rubicon vendor test, Specific purposes/LIs claimed, no geo claimed",
bidder: openrtb_ext.BidderRubicon,
consent: "COzTVhaOzTVhaGvAAAENAiCIAP_AAH_AAAAAAEEUACCKAAA",
allowPI: true,
allowGeo: false,
allowID: true,
},
}

for _, td := range testDefs {
allowPI, allowGeo, err := perms.PersonalInfoAllowed(context.Background(), td.bidder, "", td.consent)
allowPI, allowGeo, allowID, err := perms.PersonalInfoAllowed(context.Background(), td.bidder, "", td.consent)
assert.NoErrorf(t, err, "Error processing PersonalInfoAllowed for %s", td.description)
assert.EqualValuesf(t, td.allowPI, allowPI, "AllowPI failure on %s", td.description)
assert.EqualValuesf(t, td.allowGeo, allowGeo, "AllowGeo failure on %s", td.description)
assert.EqualValuesf(t, td.allowID, allowID, "AllowGeo failure on %s", td.description)
}
}

Expand All @@ -328,10 +333,11 @@ func TestAllowPersonalInfoWhitelistTCF2(t *testing.T) {
}
// Assert that an item that otherwise would not be allowed PI access, gets approved because it is found in the GDPR.NonStandardPublishers array
perms.cfg.NonStandardPublisherMap = map[string]int{"appNexusAppID": 1}
allowPI, allowGeo, err := perms.PersonalInfoAllowed(context.Background(), openrtb_ext.BidderAppnexus, "appNexusAppID", "COzTVhaOzTVhaGvAAAENAiCIAP_AAH_AAAAAAEEUACCKAAA")
allowPI, allowGeo, allowID, err := perms.PersonalInfoAllowed(context.Background(), openrtb_ext.BidderAppnexus, "appNexusAppID", "COzTVhaOzTVhaGvAAAENAiCIAP_AAH_AAAAAAEEUACCKAAA")
assert.NoErrorf(t, err, "Error processing PersonalInfoAllowed")
assert.EqualValuesf(t, true, allowPI, "AllowPI failure")
assert.EqualValuesf(t, true, allowGeo, "AllowGeo failure")
assert.EqualValuesf(t, true, allowID, "AllowID failure")

}

Expand Down Expand Up @@ -361,28 +367,32 @@ func TestAllowPersonalInfoTCF2PubRestrict(t *testing.T) {
consent: "COwAdDhOwAdDhN4ABAENAPCgAAQAAv___wAAAFP_AAp_4AI6ACACAA",
allowPI: false,
allowGeo: false,
allowID: false,
},
{
description: "Pubmatic vendor test, flex purposes claimed",
bidder: openrtb_ext.BidderPubmatic,
consent: "COwAdDhOwAdDhN4ABAENAPCgAAQAAv___wAAAFP_AAp_4AI6ACACAA",
allowPI: false,
allowGeo: false,
allowID: false,
},
{
description: "Rubicon vendor test, Specific purposes/LIs claimed, no geo claimed",
bidder: openrtb_ext.BidderRubicon,
consent: "COwAdDhOwAdDhN4ABAENAPCgAAQAAv___wAAAFP_AAp_4AI6ACACAA",
allowPI: false,
allowGeo: false,
allowID: true,
},
}

for _, td := range testDefs {
allowPI, allowGeo, err := perms.PersonalInfoAllowed(context.Background(), td.bidder, "", td.consent)
allowPI, allowGeo, allowID, err := perms.PersonalInfoAllowed(context.Background(), td.bidder, "", td.consent)
assert.NoErrorf(t, err, "Error processing PersonalInfoAllowed for %s", td.description)
assert.EqualValuesf(t, td.allowPI, allowPI, "AllowPI failure on %s", td.description)
assert.EqualValuesf(t, td.allowGeo, allowGeo, "AllowGeo failure on %s", td.description)
assert.EqualValuesf(t, td.allowID, allowID, "AllowPI failure on %s", td.description)
}
}

Expand Down Expand Up @@ -413,28 +423,32 @@ func TestAllowPersonalInfoTCF2PurposeOneTrue(t *testing.T) {
consent: "COzqiL3OzqiL3NIAAAENAiCMAP_AAH_AAIAAAQEX2S5MAICL7JcmAAA",
allowPI: false,
allowGeo: false,
allowID: false,
},
{
description: "Pubmatic vendor test, flex purposes claimed",
bidder: openrtb_ext.BidderPubmatic,
consent: "COzqiL3OzqiL3NIAAAENAiCMAP_AAH_AAIAAAQEX2S5MAICL7JcmAAA",
allowPI: true,
allowGeo: true,
allowID: true,
},
{
description: "Rubicon vendor test, Specific purposes/LIs claimed, no geo claimed",
bidder: openrtb_ext.BidderRubicon,
consent: "COzqiL3OzqiL3NIAAAENAiCMAP_AAH_AAIAAAQEX2S5MAICL7JcmAAA",
allowPI: true,
allowGeo: false,
allowID: true,
},
}

for _, td := range testDefs {
allowPI, allowGeo, err := perms.PersonalInfoAllowed(context.Background(), td.bidder, "", td.consent)
allowPI, allowGeo, allowID, err := perms.PersonalInfoAllowed(context.Background(), td.bidder, "", td.consent)
assert.NoErrorf(t, err, "Error processing PersonalInfoAllowed for %s", td.description)
assert.EqualValuesf(t, td.allowPI, allowPI, "AllowPI failure on %s", td.description)
assert.EqualValuesf(t, td.allowGeo, allowGeo, "AllowGeo failure on %s", td.description)
assert.EqualValuesf(t, td.allowID, allowID, "AllowID failure on %s", td.description)
}
}

Expand All @@ -458,35 +472,40 @@ func TestAllowPersonalInfoTCF2PurposeOneFalse(t *testing.T) {
perms.cfg.TCF2.PurposeOneTreatment.AccessAllowed = false

// COzqiL3OzqiL3NIAAAENAiCMAP_AAH_AAIAAAQEX2S5MAICL7JcmAAA Purpose one flag set
// Purpose one treatment will fail PI, but allow passing the IDs.
testDefs := []tcf2TestDef{
{
description: "Appnexus vendor test, insufficient purposes claimed",
bidder: openrtb_ext.BidderAppnexus,
consent: "COzqiL3OzqiL3NIAAAENAiCMAP_AAH_AAIAAAQEX2S5MAICL7JcmAAA",
allowPI: false,
allowGeo: false,
allowID: false,
},
{
description: "Pubmatic vendor test, flex purposes claimed",
bidder: openrtb_ext.BidderPubmatic,
consent: "COzqiL3OzqiL3NIAAAENAiCMAP_AAH_AAIAAAQEX2S5MAICL7JcmAAA",
allowPI: false,
allowGeo: true,
allowID: true,
},
{
description: "Rubicon vendor test, Specific purposes/LIs claimed, no geo claimed",
bidder: openrtb_ext.BidderRubicon,
consent: "COzqiL3OzqiL3NIAAAENAiCMAP_AAH_AAIAAAQEX2S5MAICL7JcmAAA",
allowPI: false,
allowGeo: false,
allowID: true,
},
}

for _, td := range testDefs {
allowPI, allowGeo, err := perms.PersonalInfoAllowed(context.Background(), td.bidder, "", td.consent)
allowPI, allowGeo, allowID, err := perms.PersonalInfoAllowed(context.Background(), td.bidder, "", td.consent)
assert.NoErrorf(t, err, "Error processing PersonalInfoAllowed for %s", td.description)
assert.EqualValuesf(t, td.allowPI, allowPI, "AllowPI failure on %s", td.description)
assert.EqualValuesf(t, td.allowGeo, allowGeo, "AllowGeo failure on %s", td.description)
assert.EqualValuesf(t, td.allowID, allowID, "AllowID failure on %s", td.description)
}
}

Expand Down
5 changes: 3 additions & 2 deletions privacy/enforcement.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,13 @@ type Enforcement struct {
COPPA bool
GDPR bool
GDPRGeo bool
GDPRID bool
LMT bool
}

// Any returns true if at least one privacy policy requires enforcement.
func (e Enforcement) Any() bool {
return e.CCPA || e.COPPA || e.GDPR || e.GDPRGeo || e.LMT
return e.CCPA || e.COPPA || e.GDPR || e.GDPRGeo || e.GDPRID || e.LMT
}

// Apply cleans personally identifiable information from an OpenRTB bid request.
Expand Down Expand Up @@ -64,7 +65,7 @@ func (e Enforcement) getUserScrubStrategy(ampGDPRException bool) ScrubStrategyUs
}

// If no user scrubbing is needed, then return none, else scrub ID (COPPA checked above)
if e.CCPA || e.GDPR || e.LMT {
if e.CCPA || e.GDPRID || e.LMT {
return ScrubStrategyUserID
}

Expand Down
Loading

0 comments on commit e67dfa4

Please sign in to comment.