@osano/osano-cmp-react-native 0.1.0

package/src/iab/tcf/consent.js

@@ -0,0 +1,345 @@
+import {
+	CMPEventStatus,
+	CMPStatusCodes,
+	DisplayStatusCodes,
+	consentToPurpose,
+} from './constants';
+import { Locale, ScreenIds } from '../../constants';
+import {
+	doesGDPRApply,
+	getConsentString,
+	getCurrentScreen,
+	getPublisherCountryCode,
+	getPurposeConsents,
+	getPurposeOptOuts,
+	getPurposesLITransparency,
+	getSpecialFeatureOptIns,
+	getStore,
+	getVendorListVersion,
+	getVendorOptOuts,
+	getVendors,
+	hasActed,
+} from './selectors';
+import { get, merge, set } from '../../utils';
+import {
+	getConsent,
+	getSavedConsent,
+	isConsentReady,
+	isSaved,
+} from '../../redux/selectors';
+
+export const commonConsent = {
+	consentLanguage: 'en',
+	cmpLoaded: true,
+	cmpStatus: CMPStatusCodes.LOADED, // TODO: async CMP load
+	eventStatus: CMPEventStatus.TC_LOADED, // TODO: async CMP load
+	isServiceSpecific: true,
+	useNonStandardStacks: true,
+	purposeOneTreatment: false,
+};
+
+export const getVendorConsents = (state, apiVersion) => {
+	const vendors = getVendors(state, apiVersion);
+	/*
+	 *  Unless a user has specifically opted out of a vendor, the consent
+	 *  is determined by purposes and specialFeatures.
+	 */
+	const optOutVendors = getVendorOptOuts(state, apiVersion);
+	/*
+	 *  Vendors may process your information based on purpose consent.
+	 *  If the user has consented to any vendor's purposes the consent
+	 *  is marked as true.
+	 */
+	const purposeConsent = consentToPurpose(
+		getSavedConsent(state) || getConsent(state),
+		apiVersion,
+	);
+	const consents = Object.entries(vendors).reduce(
+		(vendorConsents, [vendorId, { purposes = [], deletedDate } = {}]) => {
+			// We also need to apply IAB rules found here:
+			//   https://github.com/InteractiveAdvertisingBureau/iabtcf-es/blob/dfc427d015d63d1f5d745c41e77eaae6c5dec2d4/modules/core/src/encoder/SemanticPreEncoder.ts
+			//   These may need to be updated from time to time.
+
+			// Note that flexiblePurposes only matter if we support publisher
+			// restrictions, which we currently do not. They must have a vendor
+			// default (the purpose must be in either consents or
+			// legitimateInterests as well as flexiblePurposes) so we will
+			// respect that default.
+
+			// If the vendor has been deleted or the user has opted out of the
+			// vendor then the vendor should not be included in consents.
+			if (!deletedDate && !optOutVendors[`${vendorId}`]) {
+				const vendorHasConsent =
+					// If all indicated purposes have been consented to
+					purposes.length > 0 &&
+					purposes.every(purposeId => purposeConsent[`${purposeId}`]);
+				if (vendorHasConsent) {
+					vendorConsents[`${vendorId}`] = !optOutVendors[`${vendorId}`];
+				}
+			}
+			return vendorConsents;
+		},
+		{},
+	);
+	return consents;
+};
+
+export const getVendorLegitimateInterests = (state, apiVersion) => {
+	/*
+	 *  Unless a use has specifically opted out of a vendor, the consent
+	 *  is determined by LI.
+	 */
+	const optOutVendors = getVendorOptOuts(state, apiVersion);
+	/*
+	 *  Vendors may have specific legitimate interest purposes.
+	 *  If the user has not objected to the LI purpose, it is
+	 *  marked as true.
+	 */
+	const optOutPurposes = getPurposeOptOuts(state, apiVersion);
+	const vendors = getVendors(state, apiVersion);
+	const vendorLegitimateInterests = {};
+	Object.entries(vendors).forEach(
+		([
+			vendorId,
+			{
+				legIntPurposes = [],
+				purposes = [],
+				specialPurposes = [],
+				deletedDate,
+			} = {},
+		]) => {
+			// We also need to apply IAB rules found here:
+			//   https://github.com/InteractiveAdvertisingBureau/iabtcf-es/blob/dfc427d015d63d1f5d745c41e77eaae6c5dec2d4/modules/core/src/encoder/SemanticPreEncoder.ts
+			//   These may need to be updated from time to time.
+
+			// Note that flexiblePurposes only matter if we support publisher
+			// restrictions, which we currently do not. They must have a vendor
+			// default (the purpose must be in either consents or
+			// legitimateInterests as well as flexiblePurposes) so we will
+			// respect that default.
+
+			// If the vendor has been deleted or the user has opted out of the
+			// vendor then the vendor should not be included in LI.
+			if (!deletedDate && !optOutVendors[`${vendorId}`]) {
+				const vendorHasLegitimateInterest =
+					// If any legIntPurposes is not opted out
+					(legIntPurposes &&
+						legIntPurposes.some(
+							purposeId => !optOutPurposes[`${purposeId}`],
+						)) ||
+					/**
+					 * Per June 2021 Policy change, Vendors declaring only
+					 * Special Purposes must have their legitimate interest
+					 * Vendor bit set if they have been disclosed.
+					 */
+					(purposes.length === 0 &&
+						legIntPurposes.length === 0 &&
+						specialPurposes.length > 0);
+				if (vendorHasLegitimateInterest) {
+					vendorLegitimateInterests[`${vendorId}`] = true;
+				}
+			}
+		},
+	);
+	return vendorLegitimateInterests;
+};
+
+export const makeParseConsentString = initOptions => tcString => {
+	const {
+		encoder: { decode },
+		coreFieldSequence,
+		version,
+		cmpId,
+		cmpVersion,
+		specFieldMode = false,
+	} = initOptions;
+	const segments = tcString.split('.');
+	const coreSegment = decode(segments[0]);
+	const tcData = specFieldMode
+		? {}
+		: {
+				...commonConsent,
+				cmpId,
+				cmpVersion,
+				consentLanguage: Locale.locale.slice(0, 2).toUpperCase(),
+				tcfPolicyVersion: parseInt(version, 10),
+			};
+	coreFieldSequence.reduce(
+		(startBit, [field, numBits, { decode: decodeField }, dataField]) => {
+			const value = isFinite(numBits)
+				? coreSegment.slice(startBit, startBit + numBits)
+				: // It's a non-fixed vector, so we need to use rest of the segment
+					coreSegment.slice(startBit);
+
+			const { bitLength, value: decodedValue } = decodeField(value, numBits);
+
+			// The TCF string spec uses PascalCase names for fields, but the TCData object uses camelCase
+			// Reference: https://github.com/IABTechLab/iabgpp-es/blob/42060d7ac2b6d0ee70fc1b5bcd33fc447bf5123c/modules/cmpapi/src/encoder/field/TcfEuV2Field.ts
+			const fieldName = specFieldMode
+				? field[0].toUpperCase() + field.substring(1) // Capitalize first letter
+				: dataField || field;
+			set(tcData, fieldName, decodedValue);
+			return startBit + bitLength;
+		},
+		0,
+	);
+	return tcData;
+};
+
+export const makeGetField = initOptions => {
+	const parseConsentString = makeParseConsentString({
+		...initOptions,
+		specFieldMode: true,
+	});
+	return (tcString, requestedField) =>
+		get(tcString ? parseConsentString(tcString) : {}, requestedField);
+};
+
+/**
+ * TCFAPI consentFromOptions implementation
+ * @function
+ * @param {import('./constants').IABInitOptions} initOptions
+ * @returns {import('./constants').TCDataDeterminateField} Properly formatted TCData object
+ */
+export const makeConsentFromOptions =
+	({
+		version = '2.0',
+		cmpId,
+		cmpVersion,
+		fallbackGvlVersion,
+		gppSection,
+		staticFields,
+		dynamicFields = {},
+	}) =>
+	(data = {}, state) => {
+		const { gdprApplies } = merge(getStore(state), data);
+		const publisherCC = getPublisherCountryCode(state);
+		const currentScreen = getCurrentScreen(state);
+		const isShowingUi = currentScreen !== ScreenIds.None;
+		const willShowUi = !isSaved(state) || isShowingUi;
+		const cmpStatus = isConsentReady(state)
+			? CMPStatusCodes.LOADED
+			: CMPStatusCodes.STUB;
+
+		/**
+		 * The vendor list version should be in the customer's config because
+		 * it's tied to their selected vendors. If it's not there, we don't have
+		 * a way to know what it should be. The TCF spec doesn't cover this case
+		 * and we can't encode 'undefined', so we'll use a fallback version.
+		 */
+		const gvlVersion =
+			getVendorListVersion(state, version) || fallbackGvlVersion;
+
+		/**
+		 *  Since `consentFromOptions` is used for multiple callbacks, all TCDataDeterminateField
+		 *  values should be set here.
+		 */
+		const dynamicConsent = Object.entries(dynamicFields).reduce(
+			(acc, [field, getter]) => {
+				acc[`${field}`] = getter(data, state);
+				return acc;
+			},
+			{},
+		);
+		return {
+			version: staticFields.version,
+			...commonConsent,
+			...dynamicConsent,
+			cmpLoaded: cmpStatus === CMPStatusCodes.LOADED,
+			cmpStatus,
+			eventStatus: willShowUi
+				? CMPEventStatus.CMP_UI_SHOWN
+				: hasActed(state, gppSection)
+					? CMPEventStatus.USER_ACTION_COMPLETE
+					: CMPEventStatus.TC_LOADED,
+			currentScreen,
+			displayStatus: isShowingUi
+				? DisplayStatusCodes.VISIBLE
+				: DisplayStatusCodes.HIDDEN,
+			cmpId,
+			cmpVersion,
+			gvlVersion,
+			consentLanguage: Locale.locale.slice(0, 2).toUpperCase(),
+			publisherCC,
+			tcfPolicyVersion: staticFields.tcfPolicyVersion,
+			gdprApplies:
+				gdprApplies !== undefined ? gdprApplies : doesGDPRApply(state),
+			vendor: {
+				consents: getVendorConsents(state, version),
+				legitimateInterests: getVendorLegitimateInterests(state, version),
+			},
+			specialFeatureOptins: getSpecialFeatureOptIns(state, version),
+			purpose: {
+				consents: getPurposeConsents(state, version),
+				legitimateInterests: getPurposesLITransparency(state, version),
+			},
+		};
+	};
+
+/**
+ * TCFAPI formatConsentString implementation
+ * @function
+ * @param {Object} data
+ * @returns {string} Properly formatted TCFData string
+ */
+export const makeFormatConsentString = initOptions => (data, state) => {
+	const {
+		encoder: { encode },
+		coreFieldSequence,
+		staticFields,
+	} = initOptions;
+	const tcData = makeConsentFromOptions(initOptions)(data, state);
+	const segments = getConsentString(state, initOptions).split('.');
+	// Only update the CORE string
+	segments.shift();
+	const [bitFields] = coreFieldSequence.reduce(
+		(
+			[bitString, startBit],
+			[key, numBits, { encode: encodeField }, dataField = key],
+		) => {
+			let value;
+			if (Object.hasOwnProperty.call(staticFields, dataField)) {
+				// We should skip this field
+				const staticValue = staticFields[`${dataField}`];
+				value = staticValue;
+			} else {
+				value = get(tcData, dataField);
+			}
+			const encodedValue = encodeField(value, numBits);
+			return [bitString + encodedValue, startBit + encodedValue.length];
+		},
+		['', 0],
+	);
+	const newCoreString = encode(bitFields);
+	segments.unshift(newCoreString);
+	return segments.join('.');
+};
+
+/**
+ * TCFAPI getConsentDataObject implementation
+ * @function
+ * @param {number} version
+ * @returns {import('./constants').TCData} Properly formatted TCData object
+ */
+export const makeGetConsentDataObject = initOptions => state => {
+	const { defaultTimestamp, version } = initOptions;
+	switch (parseInt(version, 10)) {
+		// Supported versions
+		case 2: {
+			break;
+		}
+
+		default: {
+			throw new Error('Unsupported version');
+		}
+	}
+
+	// `defaultTimestamp` will be used for the created and lastUpdated fields if
+	// a consent timestamp is not available yet.
+	const data = { defaultTimestamp };
+
+	return {
+		...makeConsentFromOptions(initOptions)(data, state),
+		tcString: makeFormatConsentString(initOptions)(data, state),
+	};
+};

package/src/iab/tcf/constants.ts

@@ -0,0 +1,51 @@
+import {
+	type ConsentCategory as ConsentCategoryType,
+	ConsentCategory,
+} from '../../constants';
+
+export const CMPEventStatus = {
+	TC_LOADED: 'tcloaded',
+	CMP_UI_SHOWN: 'cmpuishown',
+	USER_ACTION_COMPLETE: 'useractioncomplete',
+};
+
+export const CMPStatusCodes = {
+	STUB: 'stub',
+	LOADED: 'loaded',
+	ERROR: 'error',
+};
+
+export const DisplayStatusCodes = {
+	VISIBLE: 'visible',
+	HIDDEN: 'hidden',
+	DISABLED: 'disabled',
+};
+
+export const purposeIds = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+export const purposeMap: Record<ConsentCategoryType, number[]> = {
+	[ConsentCategory.ESSENTIAL]: [],
+	[ConsentCategory.ANALYTICS]: [8, 10],
+	[ConsentCategory.STORAGE]: [1],
+	[ConsentCategory.MARKETING]: [2, 7, 9],
+	[ConsentCategory.PERSONALIZATION]: [3, 4, 5, 6],
+	[ConsentCategory.OPT_OUT]: [],
+};
+
+export const consentToPurpose = (
+	consent: Partial<Record<ConsentCategoryType, boolean>> = {},
+	apiVersion = '2',
+) => {
+	if (parseInt(apiVersion, 10) <= 2) {
+		return Object.entries(purposeMap).reduce(
+			(consents, [category, purposes]) => {
+				purposes.forEach(purpose => {
+					consents[`${purpose}`] =
+						!!consent[`${category as ConsentCategoryType}`];
+				});
+				return consents;
+			},
+			{} as Record<number, boolean>,
+		);
+	}
+	return {};
+};

package/src/iab/tcf/index.js

@@ -0,0 +1,7 @@
+import reducer from './reducer';
+import versions from './v2.0';
+
+export default {
+	reducer,
+	versions,
+};

package/src/iab/tcf/reducer.js

@@ -0,0 +1,59 @@
+import { types as ActionTypes } from '../../redux/actions';
+import { genericReducer } from '../../redux/helpers';
+import { merge } from '../../utils';
+import { setGdprApplies } from './actions';
+import { initialState as v2_initialState } from './v2.0/reducer';
+
+export const initialState = merge({}, v2_initialState);
+
+const updateOptions = (state, options) => {
+	const { config } = options || {};
+	const {
+		config: {
+			gdprApplies: providedGdprApplies,
+			iabEnabled: providedIABEnabled,
+		} = {},
+	} = state;
+	const { gdprApplies = providedGdprApplies, iabEnabled = providedIABEnabled } =
+		config || {};
+	const newState = merge(
+		{ ...state },
+		{
+			iab: {
+				tcf: {
+					enabled:
+						typeof iabEnabled === 'string'
+							? iabEnabled === 'true'
+							: !!iabEnabled,
+					gdprApplies:
+						typeof gdprApplies === 'string'
+							? gdprApplies === 'true'
+							: !!gdprApplies,
+				},
+			},
+		},
+	);
+	return newState;
+};
+
+export default genericReducer(initialState, {
+	[ActionTypes.init]: updateOptions,
+	[ActionTypes.updateConfig]: (state, config) =>
+		updateOptions(state, { config }),
+	[setGdprApplies.type]: (state, gdprApplies) => {
+		const newState = merge(
+			{ ...state },
+			{
+				iab: {
+					tcf: {
+						gdprApplies:
+							typeof gdprApplies === 'string'
+								? gdprApplies === 'true'
+								: !!gdprApplies,
+					},
+				},
+			},
+		);
+		return newState;
+	},
+});

package/src/iab/tcf/selectors.js

@@ -0,0 +1,151 @@
+import { consentToPurpose, purposeIds } from './constants';
+import {
+	getConsent,
+	getCountryCode,
+	getSavedConsent,
+} from '../../redux/selectors';
+
+import { GDPR_COUNTRIES } from '@osano-cmp';
+import { ScreenIds } from '../../constants';
+import { get } from '../../utils';
+import { isBrowsingFrom } from '../gpp/selectors';
+
+export const DOMAIN = 'iab.tcf';
+
+export const isIABEnabled = state => !!get(state, 'config.iabEnabled');
+
+export const getStore = state => get(state, DOMAIN, {});
+export const getApiData = (state, apiVersion = 2) =>
+	get(getStore(state), [`v${parseInt(apiVersion, 10)}`], {});
+
+export const getCurrentScreen = state =>
+	get(state, 'ui.currentScreen', ScreenIds.None);
+
+// Expects that `iab.tcf.gdprApplies` will always be a boolean under real usage.
+// The fallback (`GDPR_COUNTRIES.includes`) is meant ONLY for preview (webapp).
+export const doesGDPRApply = state =>
+	!!get(
+		getStore(state),
+		'gdprApplies',
+		GDPR_COUNTRIES.includes(getCountryCode(state)),
+	);
+
+export const getConsentLanguage = state => {
+	return get(state, 'config.lang', 'en').slice(0, 2).toUpperCase();
+};
+export const getConsentString = (state, { gppSection, tcString }) => {
+	return get(state, ['iab', 'consentStrings', gppSection], tcString);
+};
+export const getPublisherCountryCode = state =>
+	// This must be a Two-Letter code
+	(
+		get(getStore(state), 'publisherCC') ||
+		getCountryCode(state) ||
+		'US'
+	).toUpperCase();
+
+// API Specific Data
+export const getPublisherLegitimateInterests = (/* state, apiVersion */) => {
+	// Placeholder
+	return {};
+};
+export const getPurposeIds = () => [...purposeIds];
+export const getPurposeOptOuts = (state, apiVersion) =>
+	get(getApiData(state, apiVersion), 'purposeOptouts') || {};
+export const getPurposeConsents = (state, apiVersion) => {
+	const consent = getSavedConsent(state) || getConsent(state);
+	const optOutPurposes = getPurposeOptOuts(state, apiVersion);
+	return Object.entries(consentToPurpose(consent, apiVersion)).reduce(
+		(purposeConsents, [purposeId, hasConsented]) => {
+			purposeConsents[`${purposeId}`] =
+				hasConsented && !optOutPurposes[`${purposeId}`];
+			return purposeConsents;
+		},
+		{},
+	);
+};
+// Established legitimate interest per purpose
+export const getPurposesLITransparency = (state, apiVersion) => {
+	/*
+	 *  PurposesLITransparency
+	 *  For the purposes of a TCString, this indicates that the end user
+	 *  has been given notification of the consent purposes and the
+	 *  opportunity to accept or deny them, or object individually.
+	 */
+	const purposeConsents = getPurposeConsents(state, apiVersion);
+	const purposeLITransparency = {};
+	const optOutPurposes = getPurposeOptOuts(state, apiVersion);
+	Object.entries(purposeConsents).forEach(([purposeId]) => {
+		// We are only indicating that the user has been given transparency
+		if (!optOutPurposes[`${purposeId}`]) {
+			// If a user has not specifically objected, we mark the purpose true
+			purposeLITransparency[`${purposeId}`] = true;
+		}
+	});
+	/**
+	 * Purpose 1 is never allowed to be true for legitimate interest transparency
+	 */
+	delete purposeLITransparency[`${1}`];
+	return purposeLITransparency;
+};
+export const getSpecialFeatureOptIns = (state, apiVersion) =>
+	get(getApiData(state, apiVersion), 'specialFeatureOptins') || {};
+export const getVendors = (state, apiVersion) =>
+	get(getApiData(state, apiVersion), 'vendors') || {};
+export const getVendorData = (state, { apiVersion, vendorId }) =>
+	get(getVendors(state, apiVersion), `${vendorId}`) || {};
+export const getVendorIds = (state, apiVersion) =>
+	Object.keys(getVendors(state, apiVersion)).map(vendorId =>
+		parseInt(vendorId, 10),
+	) || [];
+export const getVendorOptOuts = (state, apiVersion) =>
+	get(getApiData(state, apiVersion), 'vendorOptouts') || {};
+export const getVendorListError = (state, apiVersion) =>
+	get(getApiData(state, apiVersion), 'vendorListError', 0);
+export const getVendorListVersion = (state, apiVersion) =>
+	get(getApiData(state, apiVersion), 'vendorListVersion');
+
+// This is the same value as v2.0/constants.js/gppSection but duplicating it
+// prevents having to import that file which keeps the bundle size a lot
+// smaller.
+const TCF_GPP_SECTION = 'tcfeuv2';
+export const getStorageConsent = state => {
+	return {
+		iab: {
+			v2: {
+				p: getPurposeOptOuts(state, '2.0'),
+				v: getVendorOptOuts(state, '2.0'),
+			},
+			// If we rename this property, we need to update the reducer
+			// (src/iab/tcf/v2.0/reducer.js) for `setConsent` which extracts it
+			// so that we honor previously-saved values.
+			euconsent: getConsentString(state, { gppSection: TCF_GPP_SECTION }),
+		},
+	};
+};
+
+/**
+ * Indicates if any action has been taken by the user in regards to consent
+ *
+ * @param {import('../../redux/selectors.js').ReduxState} state
+ * @param {string} gppSection The gppSection location in Redux that we store the TCString in.
+ * @returns {boolean} TRUE if a consent action has been taken, FALSE if it has not
+ */
+export const hasActed = (state, gppSection) =>
+	!!get(state, ['iab', 'hasActed', gppSection]);
+export const hasConsentedToSpecialFeature = (
+	state,
+	{ apiVersion, specialFeatureId },
+) => !!getSpecialFeatureOptIns(state, apiVersion)[`${specialFeatureId}`];
+export const hasOptedOutOfVendor = (state, { apiVersion, vendorId }) =>
+	!!getVendorOptOuts(state, apiVersion)[`${vendorId}`];
+export const hasOptedOutOfPurpose = (state, { apiVersion, purposeId }) =>
+	!!getPurposeOptOuts(state, apiVersion)[`${purposeId}`];
+
+export const isTcfApplicable = state =>
+	(doesGDPRApply(state) || isBrowsingFrom(state, 'ca')) &&
+	!!get(getStore(state), 'enabled', isIABEnabled(state));
+export const isVendorListLoaded = (state, apiVersion) =>
+	!!get(getApiData(state, apiVersion), 'vendorListLoaded');
+export const isVendorListLoading = (state, apiVersion) =>
+	!!get(getApiData(state, apiVersion), 'vendorListLoading');

package/src/iab/tcf/tcfcav1-api.js

@@ -0,0 +1,39 @@
+import { get } from '../../utils';
+import { makeGetConsentDataObject } from './consent';
+
+export default function makeApi(initOptions) {
+	const getConsentDataObject = makeGetConsentDataObject(initOptions);
+	const buildTcData = state => {
+		const consentDataObj = getConsentDataObject(state);
+		return initOptions.coreFieldSequence.reduce(
+			(tcData, [tcDataField, length, , consentDataField, formatter]) => {
+				const value = get(consentDataObj, consentDataField);
+				tcData[`${tcDataField}`] = formatter ? formatter(value, length) : value;
+				return tcData;
+			},
+			{},
+		);
+	};
+
+	function bind(store) {
+		return function tcfApi(command, callback, parameter) {
+			const state = store.getState();
+			switch (command) {
+				case 'getField': {
+					const field = parameter;
+					const tcData = buildTcData(state);
+					return tcData[`${field}`];
+				}
+
+				case 'getSection': {
+					const tcData = buildTcData(state);
+					return tcData;
+				}
+			}
+		};
+	}
+
+	return {
+		bind,
+	};
+}