@mparticle/web-sdk 3.21.0 → 3.23.0

package/src/pageUrl.ts

@@ -0,0 +1,150 @@
+import { isAllowedQueryParam } from './pageViewTracker';
+import { getHref, valueof } from './utils';
+
+// The one rule for a URL that leaves the SDK, shared with kits through
+// `mParticle._cleanUrl`. `path` keeps scheme, host and path. `full` adds the
+// query params an auto page view may capture, then the fragment.
+export const UrlMode = {
+    Path: 'path',
+    Full: 'full',
+} as const;
+
+export type UrlMode = valueof<typeof UrlMode>;
+
+// OAuth 2.0 / OIDC authorization-flow params. They stay off URLs even where the
+// page view allowlist admits them, because a URL travels on every event.
+export const EXCLUDED_URL_QUERY_PARAMS: string[] = [
+    'client_id',
+    'redirect_uri',
+    'response_type',
+    'scope',
+    'state',
+    'code',
+    'nonce',
+];
+
+// An OAuth implicit or OIDC fragment response puts its tokens in `#k=v&...`.
+export const EXCLUDED_URL_FRAGMENT_PARAMS: string[] = EXCLUDED_URL_QUERY_PARAMS.concat(
+    [
+        'access_token',
+        'id_token',
+        'refresh_token',
+        'provider_token',
+        'provider_refresh_token',
+    ]
+);
+
+// Allowlisted params whose value is itself a URL, so it can carry a query.
+const URL_VALUED_QUERY_PARAMS: string[] = ['ref', 'referrer'];
+
+const USERINFO = /^((?:[a-z][a-z0-9+.-]*:)?\/\/)[^/]*@/i;
+
+const decodeQueryComponent = (component: string): string =>
+    decodeURIComponent(component.replace(/\+/g, ' '));
+
+const cleanQueryPair = (pair: string): string | null => {
+    const separator = pair.indexOf('=');
+    const rawName = separator === -1 ? pair : pair.slice(0, separator);
+    let name: string;
+    try {
+        name = decodeQueryComponent(rawName);
+    } catch (e) {
+        return null;
+    }
+
+    const lowerName = name.toLowerCase();
+    if (
+        !name ||
+        !isAllowedQueryParam(name) ||
+        EXCLUDED_URL_QUERY_PARAMS.indexOf(lowerName) !== -1
+    ) {
+        return null;
+    }
+
+    if (separator === -1 || URL_VALUED_QUERY_PARAMS.indexOf(lowerName) === -1) {
+        return pair;
+    }
+
+    let value: string;
+    try {
+        value = decodeQueryComponent(pair.slice(separator + 1));
+    } catch (e) {
+        return null;
+    }
+    const cleanedValue = cleanUrl(value, UrlMode.Path);
+    return cleanedValue === value
+        ? pair
+        : `${rawName}=${encodeURIComponent(cleanedValue)}`;
+};
+
+const cleanQuery = (query: string): string =>
+    query
+        .split('&')
+        .map(cleanQueryPair)
+        .filter((pair): pair is string => pair !== null)
+        .join('&');
+
+const keepsFragmentPair = (pair: string): boolean => {
+    try {
+        const name = decodeQueryComponent(pair.split('=')[0]);
+        return EXCLUDED_URL_FRAGMENT_PARAMS.indexOf(name.toLowerCase()) === -1;
+    } catch (e) {
+        return false;
+    }
+};
+
+// A hash route (`#/...`, `#!...`, or a path with no `=` before its `?`) keeps
+// its path; a query inside it gets the same allowlist as the URL's own query.
+// A fragment of bare pairs loses the OAuth/OIDC ones.
+const cleanFragment = (hash: string): string => {
+    const queryStart = hash.indexOf('?');
+    const route = queryStart === -1 ? hash : hash.slice(0, queryStart);
+    const isRoute =
+        /^#[/!]/.test(hash) || (queryStart !== -1 && route.indexOf('=') === -1);
+
+    if (isRoute && queryStart !== -1) {
+        const query = cleanQuery(hash.slice(queryStart + 1));
+        return route + (query ? `?${query}` : '');
+    }
+
+    if (hash.indexOf('=') === -1) {
+        return hash;
+    }
+
+    const pairs = hash
+        .slice(1)
+        .split('&')
+        .filter(keepsFragmentPair)
+        .join('&');
+    return pairs ? `#${pairs}` : '';
+};
+
+// String-based rather than `new URL`, so kept pairs and the fragment go out
+// exactly as the browser reported them and no environment can parse differently.
+// An unknown mode is treated as `path`.
+export const cleanUrl = (href: string, mode: UrlMode): string => {
+    if (typeof href !== 'string' || !href) {
+        return '';
+    }
+
+    const hashStart = href.indexOf('#');
+    const hash = hashStart === -1 ? '' : href.slice(hashStart);
+    const beforeHash = hashStart === -1 ? href : href.slice(0, hashStart);
+    const queryStart = beforeHash.indexOf('?');
+    const path = (queryStart === -1
+        ? beforeHash
+        : beforeHash.slice(0, queryStart)
+    ).replace(USERINFO, '$1');
+
+    if (mode !== UrlMode.Full) {
+        return path;
+    }
+
+    const query =
+        queryStart === -1 ? '' : cleanQuery(beforeHash.slice(queryStart + 1));
+
+    return path + (query ? `?${query}` : '') + cleanFragment(hash);
+};
+
+// The current page as it may appear on an event.
+export const cleanPageHref = (): string => cleanUrl(getHref(), UrlMode.Full);

package/src/pageViewTracker.ts

@@ -55,6 +55,12 @@ export const ALLOWED_QUERY_PARAMS: string[] = [
     'utm_term',
     'utm_content',
     'utm_id',
+    'utm_source_platform',
+    'utm_creative_format',
+    'utm_marketing_tactic',
+    'gad_source',
+    'gad_campaignid',
+    'mc_cid',
 
     // Ad-network click ids
     'gclid',
@@ -66,6 +72,12 @@ export const ALLOWED_QUERY_PARAMS: string[] = [
     'twclid',
     'li_fat_id',
     'dclid',
+    'srsltid',
+    'epik',
+    'ScCid',
+    'irclickid',
+    'rtid',
+    'rclid',
 
     // OAuth / OIDC — see the SECURITY note above
     'client_id',
@@ -84,8 +96,11 @@ export const ALLOWED_QUERY_PARAMS: string[] = [
     'per_page',
 
     // Site search term, as the common platforms spell it. Matching is
-    // case-insensitive; single-letter names other than `q` are too generic.
+    // case-insensitive. `s` is WordPress and WooCommerce search; other
+    // single-letter names are too generic. `oq` is a storefront search term.
     'q',
+    's',
+    'oq',
     'search',
     'query',
     'keyword',
@@ -105,6 +120,9 @@ export const ALLOWED_QUERY_PARAMS: string[] = [
     'sku',
     'skuId',
     'variant',
+    'color',
+    'colour',
+    'size',
 
     // Category
     'category',
@@ -114,6 +132,27 @@ export const ALLOWED_QUERY_PARAMS: string[] = [
     'referrer',
 ];
 
+// Params matched by name prefix, for platforms that put a per-product id in the
+// name. Salesforce Commerce Cloud spells a variant choice
+// `dwvar_<productId>_<attribute>`, e.g. `dwvar_12345_color=navy`.
+export const ALLOWED_QUERY_PARAM_PREFIXES: string[] = ['dwvar_'];
+
+const hasAllowedPrefix = (name: string): boolean =>
+    ALLOWED_QUERY_PARAM_PREFIXES.some(prefix => name.indexOf(prefix) === 0);
+
+const ALLOWED_QUERY_PARAMS_LOWER: string[] = ALLOWED_QUERY_PARAMS.map(name =>
+    name.toLowerCase()
+);
+
+// Whether a query param name, in any case, is one an auto page view captures.
+export const isAllowedQueryParam = (name: string): boolean => {
+    const lower = name.toLowerCase();
+    return (
+        ALLOWED_QUERY_PARAMS_LOWER.indexOf(lower) !== -1 ||
+        hasAllowedPrefix(lower)
+    );
+};
+
 interface IPageSnapshot {
     path: string;
     params: Dictionary<string>;
@@ -146,8 +185,18 @@ interface IPendingNavigation {
 // attribute), drops empty values, and carries the fallback for browsers without
 // URLSearchParams. Tolerates an empty href, so SSR yields no params rather than
 // throwing.
-export const allowedQueryParams = (href: string): Dictionary<string> =>
-    queryStringParser(href, ALLOWED_QUERY_PARAMS);
+export const allowedQueryParams = (href: string): Dictionary<string> => {
+    const params = queryStringParser(href, ALLOWED_QUERY_PARAMS);
+    const allParams = queryStringParser(href);
+
+    Object.keys(allParams)
+        .filter(name => hasAllowedPrefix(name) && allParams[name])
+        .forEach(name => {
+            params[name] = allParams[name];
+        });
+
+    return params;
+};
 
 export const AUTO_PAGE_VIEW_ATTRIBUTE = 'is_auto_page_view';
 
@@ -159,10 +208,9 @@ export const autoPageViewAttribute = (
 ): Dictionary<boolean> =>
     isAutoPageView ? { [AUTO_PAGE_VIEW_ATTRIBUTE]: true } : {};
 
-// The captured params, in allowlist order. Ordering comes from the constant
-// rather than a sort: it is deterministic without needing a comparator, and it
-// does not depend on the object's insertion order, so reordering the query string
-// cannot produce a different key.
+// The captured params, in allowlist order, then prefix-matched names sorted.
+// Neither depends on the object's insertion order, so reordering the query
+// string cannot produce a different key.
 //
 // Membership is an own-property check, not `in`. `in` walks the prototype
 // chain, so a name matching an Object.prototype member reports as present on
@@ -170,7 +218,11 @@ export const autoPageViewAttribute = (
 // only thing making `in` safe here — and it stops being a safe assumption the
 // moment this list can be extended from configuration.
 const capturedNames = (params: Dictionary<string>): string[] =>
-    ALLOWED_QUERY_PARAMS.filter(name => hasOwnProp(params, name));
+    ALLOWED_QUERY_PARAMS.filter(name => hasOwnProp(params, name)).concat(
+        Object.keys(params)
+            .filter(hasAllowedPrefix)
+            .sort()
+    );
 
 // The dedup key: pathname plus the allowlisted params in a fixed order, so that
 // reordering the query string is not a new page. Params outside the allowlist

package/src/roktManager.ts

@@ -15,7 +15,7 @@ import {
 import { SDKIdentityApi } from "./identity.interfaces";
 import { SDKLoggerApi } from "./sdkRuntimeModels";
 import { IStore, LocalSessionAttributes } from "./store";
-import { UserIdentities } from "@mparticle/web-sdk";
+import { MPID, UserIdentities } from "@mparticle/web-sdk";
 import { IdentityType, PerformanceMarkType } from "./types";
 import { ErrorCodes, IErrorReportingService, ILoggingService, WSDKErrorSeverity } from "./reporting/types";
 import { IRoktLauncherOptions, normalizeRoktLauncherOptions } from "./roktLauncherOptions";
@@ -23,7 +23,7 @@ import { PARTNER_MODULE_IDS } from "./cookieSyncManager";
 import IntegrationCapture from "./integrationCapture";
 import Constants from "./constants";
 import { subscribeToRouteChange } from "./routeChangeMonitor";
-import type { CheckoutIntentKind } from "./buttonTracking/checkoutIntent";
+import type { CheckoutIntentKind, CheckoutIntentSource } from "./buttonTracking/checkoutIntent";
 
 const PASSBACK_CONVERSION_TRACKING_ID = 'passbackconversiontrackingid';
 const CHECKOUT_INTENT_BUFFER_LIMIT = 4;
@@ -74,9 +74,14 @@ export interface RoktKitFilterSettings {
     filteredUser?: IMParticleUser | null;
 }
 
+// What a kit receives on checkout intent: the kind, when the shopper acted,
+// which rule recognised it and the path it happened on. Older kits read only
+// kind and t.
 export interface ICheckoutIntentSignal {
     kind: CheckoutIntentKind;
     t: number;
+    source?: CheckoutIntentSource;
+    pathname?: string;
 }
 
 export interface IRoktKitSettings {
@@ -131,6 +136,7 @@ export default class RoktManager {
     public kit: IRoktKit = null;
     public filters: RoktKitFilterSettings = {};
     private currentUser: IMParticleUser | null = null;
+    private createFilteredUser?: (mpid: MPID) => IMParticleUser;
     private messageQueue: Map<string, IRoktMessage> = new Map();
     private sandbox: boolean | null = null;
     private placementAttributesMapping: Dictionary<string>[] = [];
@@ -173,6 +179,7 @@ export default class RoktManager {
      * @param {Function} captureTiming - Function to capture performance timing marks
      * @param {IErrorReportingService} errorReporter - Dispatcher for error/warning reporting
      * @param {ILoggingService} loggingService - Dispatcher for informational logging
+     * @param {Function} createFilteredUser - Builds a user as the Rokt connection's filters and the data plan allow
      *
      * @throws Logs error to console if placementAttributesMapping parsing fails
      */
@@ -187,6 +194,7 @@ export default class RoktManager {
         errorReporter?: IErrorReportingService,
         loggingService?: ILoggingService,
         integrationCapture?: IntegrationCapture,
+        createFilteredUser?: (mpid: MPID) => IMParticleUser,
     ): void {
         const { userAttributeFilters, settings } = roktConfig || {};
         const { placementAttributesMapping, hashedEmailUserIdentityType } = settings || {};
@@ -199,6 +207,7 @@ export default class RoktManager {
         this.loggingService = loggingService;
         this.captureTiming = captureTiming;
         this.integrationCapture = integrationCapture;
+        this.createFilteredUser = createFilteredUser;
 
         this.captureTiming?.(PerformanceMarkType.JointSdkRoktKitInit);
 
@@ -314,6 +323,16 @@ export default class RoktManager {
         return !!nav && nav.globalPrivacyControl === true;
     }
 
+    // True when the kit can wait for the shopper's confirm click: signals are not
+    // suppressed and the browser exposes the composed path the detector reads.
+    // Decided from config alone, so tracker setup and teardown never change it.
+    public isCheckoutIntentLive(): boolean {
+        if (this.isCheckoutIntentSuppressed()) {
+            return false;
+        }
+        return typeof Event !== 'undefined' && isFunction(Event.prototype.composedPath);
+    }
+
     // Reads `this.kit` at call time; before a kit attaches the signal is buffered
     // with the path it was raised on.
     public notifyCheckoutIntent(signal: ICheckoutIntentSignal, pathname: string = window.location.pathname): void {
@@ -489,11 +508,13 @@ export default class RoktManager {
                 }
             }
 
-            // Optimistic merge: apply the pending identity changes locally so
-            // enrichedAttributes are correct without waiting for the identify round-trip.
-            // The next call to selectPlacements re-fetches currentUser (see line above),
-            // so stale identity state does not persist beyond this invocation.
-            const finalUserIdentities = { ...currentUserIdentities, ...newIdentities };
+            // The identify above needs every identity, so currentUserIdentities stays unfiltered.
+            // Without createFilteredUser the connection's filters cannot be applied, so no identity is added.
+            const roktUser =
+                this.currentUser && this.createFilteredUser
+                    ? this.createFilteredUser(this.currentUser.getMPID())
+                    : null;
+            const roktUserIdentities = roktUser?.getUserIdentities()?.userIdentities || {};
 
             const timeOnSite = this.store?.getTimeOnSite?.();
             const totalTimeOnSite = this.store?.getTotalTimeOnSite?.();
@@ -506,19 +527,25 @@ export default class RoktManager {
             };
 
             // Propagate email from current user identities if not already in attributes
-            if (finalUserIdentities.email && !enrichedAttributes.email) {
-                enrichedAttributes.email = finalUserIdentities.email;
+            if (!enrichedAttributes.email) {
+                if (roktUserIdentities.email) {
+                    enrichedAttributes.email = roktUserIdentities.email;
+                } else if (currentUserIdentities.email) {
+                    this.logFilteredIdentity('email');
+                }
             }
 
             // Propagate emailsha256 from current user identities if not already in attributes
-            if (isValidHashedEmailIdentityType) {
-                const hashedEmail = finalUserIdentities[this.mappedEmailShaIdentityType];
-                if (
-                    hashedEmail &&
-                    !enrichedAttributes.emailsha256 &&
-                    !enrichedAttributes[this.mappedEmailShaIdentityType]
-                ) {
+            if (
+                isValidHashedEmailIdentityType &&
+                !enrichedAttributes.emailsha256 &&
+                !enrichedAttributes[this.mappedEmailShaIdentityType]
+            ) {
+                const hashedEmail = roktUserIdentities[this.mappedEmailShaIdentityType];
+                if (hashedEmail) {
                     enrichedAttributes.emailsha256 = hashedEmail;
+                } else if (currentUserIdentities[this.mappedEmailShaIdentityType]) {
+                    this.logFilteredIdentity(this.mappedEmailShaIdentityType);
                 }
             }
 
@@ -531,7 +558,7 @@ export default class RoktManager {
                 }
             }
 
-            this.filters.filteredUser = this.currentUser || this.filters.filteredUser || null;
+            this.filters.filteredUser = roktUser || this.filters.filteredUser || null;
 
             const enrichedOptions = {
                 ...options,
@@ -544,6 +571,12 @@ export default class RoktManager {
         }
     }
 
+    private logFilteredIdentity(identityType: string): void {
+        this.logger?.verbose(
+            `mParticle.Rokt selectPlacements did not add the ${identityType} user identity to the attributes because the Rokt connection does not allow it`
+        );
+    }
+
     /**
      * Hashes attributes and returns both original and hashed versions
      * with Rokt-compatible key names (like emailsha256, mobilesha256)

package/src/sdkRuntimeModels.ts

@@ -53,6 +53,7 @@ import {
 import Constants from './constants';
 import RoktManager, { IRoktLauncherOptions } from './roktManager';
 import { IConsoleLogger } from './logger';
+import { UrlMode } from './pageUrl';
 import { ErrorCodes, IErrorReportingService, ILoggingService } from './reporting/types';
 
 // TODO: Resolve this with version in @mparticle/web-sdk
@@ -282,6 +283,7 @@ export interface IMParticleInstanceManager extends MParticleWebSDK {
     _instances: Dictionary<IMParticleWebSDKInstance>;
     _isTestEnv?: boolean;
     _forceNoLocalStorage?: boolean;
+    _cleanUrl(href: string, mode: UrlMode): string;
 
     // Public Properties
     config: SDKInitConfig;

package/src/serverModel.ts

@@ -17,8 +17,8 @@ import {
     Dictionary,
     isValidCustomFlagProperty,
     extend,
-    getHref,
 } from './utils';
+import { cleanPageHref } from './pageUrl';
 import { IntegrationAttributes, ServerSettings } from './store';
 import { MPID } from '@mparticle/web-sdk';
 import {
@@ -310,7 +310,7 @@ export default function ServerModel(
                     ),
                     ActiveTimeOnSite: mpInstance._timeOnSiteTimer?.getTimeInForeground(),
                     TotalTimeOnSite: mpInstance._Store.getTotalTimeOnSite?.(),
-                    PageUrl: getHref() || null,
+                    PageUrl: cleanPageHref() || null,
                     SourceMessageId:
                         event.sourceMessageId ||
                         mpInstance._Helpers.generateUniqueId(),
@@ -352,7 +352,7 @@ export default function ServerModel(
 
             if (eventObject.EventDataType === MessageType.AppStateTransition) {
                 eventObject.IsFirstRun = mpInstance._Store.isFirstRun;
-                eventObject.LaunchReferral = window.location.href || null;
+                eventObject.LaunchReferral = cleanPageHref() || null;
             }
 
             // FIXME: Remove duplicate occurence

package/src/utils.ts

@@ -385,7 +385,7 @@ interface URLSearchParamsFallback {
 
 const queryStringParserFallback = (url: string): URLSearchParamsFallback => {
     const params: Dictionary<string> = {};
-    const queryString = url.split('?')[1] || '';
+    const queryString = url.split('#')[0].split('?')[1] || '';
     const pairs = queryString.split('&');
 
     pairs.forEach(pair => {