@osano/osano-cmp-react-native 0.18.5 → 0.18.6

package/src/ConsentManager.ts

@@ -1,5 +1,6 @@
 import { NativeModules, Platform } from 'react-native';
 import { CLEAR_CONSENT, CLOSE } from './actions';
+import { isDoNotSellVisible } from './doNotSell';
 import {
 	ConsentCategory,
 	mappedJurisdictions,
@@ -52,6 +53,9 @@ export const DEFAULT_CONFIG: Config = {
 	],
 	ccpaApplies: false,
 	ccpaRelaxed: false,
+	enableDoNotSell: false,
+	enableDoNotSellDefault: false,
+	doNotSellCategories: [],
 	configId: '',
 	country: 'us',
 	crossDomain: false,
@@ -273,6 +277,15 @@ export class ConsentConfig extends EventEmitter {
 	get ccpaApplies(): boolean {
 		return this._config.ccpaApplies;
 	}
+	get enableDoNotSell(): boolean {
+		return !!this._config.enableDoNotSell;
+	}
+	get enableDoNotSellDefault(): boolean {
+		return !!this._config.enableDoNotSellDefault;
+	}
+	get doNotSellCategories(): string[] {
+		return this._config.doNotSellCategories ?? [];
+	}
 	get forceManagePreferences(): boolean {
 		return this._config.forceManagePreferences;
 	}
@@ -531,11 +544,13 @@ export class ConsentConfig extends EventEmitter {
 				false)
 		);
 	}
-	get shouldRenderOptOut(): boolean {
-		return (
-			!this._config.iab?.hideOptOut &&
-			!!(this._config.iab?.usp?.ccpaApplies ?? this.browsingFromUS)
-		);
+	/** Whether the "Do Not Sell / Share" opt-out toggle should render. */
+	get isDoNotSellVisible(): boolean {
+		return isDoNotSellVisible({
+			enableDoNotSell: this.enableDoNotSell,
+			ccpaApplies: this._config.iab?.usp?.ccpaApplies,
+			browsingFromUS: this.browsingFromUS,
+		});
 	}
 
 	get iabVendorCount(): number {

package/src/constants.ts

@@ -39,9 +39,8 @@ export function makeConsentFromCategories(
 			boolean
 		>,
 	);
-	if (consent[ConsentCategory.OPT_OUT]) {
-		consent[ConsentCategory.MARKETING] = false;
-	}
+	// Opt-out precedence is applied by normalizeDoNotSellConsent (config-aware),
+	// not here — this pure helper can't see the configured governed categories.
 	return consent;
 }
 

package/src/doNotSell.ts

@@ -0,0 +1,122 @@
+import {
+	ConsentCategory,
+	type ConsentCategoryType,
+	OsanoCategories,
+} from './constants';
+
+// "Do Not Sell / Share" opt-out logic as pure functions, shared by the service
+// layer, reducer, and selectors.
+
+/**
+ * Visible only when `enableDoNotSell` is set and CCPA applies: `ccpaApplies`
+ * when the config provides it, else the US geo fallback (explicit `false` hides
+ * it).
+ */
+export const isDoNotSellVisible = (opts: {
+	enableDoNotSell?: boolean;
+	ccpaApplies?: boolean | null;
+	browsingFromUS?: boolean;
+}): boolean =>
+	!!opts.enableDoNotSell && (opts.ccpaApplies ?? !!opts.browsingFromUS);
+
+/**
+ * The governed categories: config's `doNotSellCategories`, upper-cased and
+ * mapped, falling back to Marketing. ESSENTIAL and OPT_OUT are never governed —
+ * governing OPT_OUT would make it toggle itself off. Tolerant of malformed
+ * input (a non-array, or null/non-string elements from remote/cached config) so
+ * a bad field can't crash the consent UI.
+ */
+export const resolveDoNotSellCategories = (
+	categories?: string[],
+): ConsentCategoryType[] => {
+	const list = Array.isArray(categories) ? categories : [];
+	const mapped = list
+		.filter((category): category is string => typeof category === 'string')
+		.map((category) => category.toUpperCase())
+		.filter(
+			(category): category is ConsentCategoryType =>
+				(OsanoCategories as string[]).includes(category) &&
+				category !== ConsentCategory.ESSENTIAL &&
+				category !== ConsentCategory.OPT_OUT,
+		);
+	return mapped.length ? mapped : [ConsentCategory.MARKETING];
+};
+
+/**
+ * Opt-out precedence: when opted out, forces the governed categories off.
+ * Config-aware, so custom `doNotSellCategories` are honored. No-op when
+ * Do-Not-Sell is off or not opted out.
+ */
+export const normalizeDoNotSellConsent = <
+	T extends Record<ConsentCategoryType, boolean | undefined>,
+>(
+	consent: T,
+	opts: { enableDoNotSell?: boolean; doNotSellCategories?: string[] },
+): T => {
+	if (!opts.enableDoNotSell || !consent[ConsentCategory.OPT_OUT]) {
+		return consent;
+	}
+	const governed = resolveDoNotSellCategories(opts.doNotSellCategories);
+	const result: T = { ...consent };
+	for (const category of governed) {
+		result[category] = false as T[ConsentCategoryType];
+	}
+	return result;
+};
+
+/**
+ * Seeds the Do-Not-Sell default into a starting selection (no-op unless
+ * enabled): default-on opts out and drops the governed categories; default-off
+ * consents them with no opt-out signal.
+ */
+export const applyDoNotSellDefault = (
+	categories: ConsentCategoryType[],
+	opts: {
+		enableDoNotSell?: boolean;
+		enableDoNotSellDefault?: boolean;
+		doNotSellCategories?: string[];
+	},
+): ConsentCategoryType[] => {
+	if (!opts.enableDoNotSell) {
+		return categories;
+	}
+	const governed = resolveDoNotSellCategories(opts.doNotSellCategories);
+	const result: ConsentCategoryType[] = categories.filter(
+		(category) => category !== ConsentCategory.OPT_OUT,
+	);
+	if (opts.enableDoNotSellDefault) {
+		return [
+			...result.filter((category) => !governed.includes(category)),
+			ConsentCategory.OPT_OUT,
+		];
+	}
+	for (const category of governed) {
+		if (!result.includes(category)) {
+			result.push(category);
+		}
+	}
+	return result;
+};
+
+/**
+ * Categories to force off to keep the opt-out and its governed categories
+ * mutually exclusive: opt-out on clears the governed ones; a governed one on
+ * clears the opt-out. Empty when disabled or toggling off.
+ */
+export const doNotSellSideEffects = (
+	category: ConsentCategoryType,
+	isConsented: boolean,
+	opts: { enableDoNotSell?: boolean; doNotSellCategories?: string[] },
+): ConsentCategoryType[] => {
+	if (!opts.enableDoNotSell || !isConsented) {
+		return [];
+	}
+	const governed = resolveDoNotSellCategories(opts.doNotSellCategories);
+	if (category === ConsentCategory.OPT_OUT) {
+		return governed;
+	}
+	if (governed.includes(category)) {
+		return [ConsentCategory.OPT_OUT];
+	}
+	return [];
+};

package/src/index.tsx

@@ -19,6 +19,7 @@ import {
 	makeConsentFromCategories,
 	type ConsentCategoryType,
 } from './constants';
+import { normalizeDoNotSellConsent } from './doNotSell';
 import { OsanoPublicContext } from './context';
 import { usePrevious } from './hooks/usePrevious';
 import useThunkReducer, { type Store } from './hooks/useThunkReducer';
@@ -97,7 +98,11 @@ export const Osano: React.FunctionComponent<
 					 */
 					const categories = Array.isArray(category) ? category : [category];
 					consentedCategories = formatConsentArray(
-						makeConsentFromCategories(categories),
+						normalizeDoNotSellConsent(makeConsentFromCategories(categories), {
+							enableDoNotSell: consentManager.current.config.enableDoNotSell,
+							doNotSellCategories:
+								consentManager.current.config.doNotSellCategories,
+						}),
 					);
 				}
 				return recordConsent(consentManager.current, consentedCategories);
@@ -205,6 +210,10 @@ export const Osano: React.FunctionComponent<
 					// We need to reset the state when the configId or customerId changes
 					dispatch(
 						reload({
+							// Pass config so init-time opt-out normalization runs on the
+							// stored consent even in headless consumers, where SET_CONFIG's
+							// UI effect never fires.
+							config: consentManager.current.config,
 							configId: reloadProps.configId,
 							customerId: reloadProps.customerId,
 							consent: reloadProps.consent,

package/src/reducer.ts

@@ -24,6 +24,7 @@ import {
 	OsanoCategories,
 	type ConsentCategoryType,
 } from './constants';
+import { doNotSellSideEffects, normalizeDoNotSellConsent } from './doNotSell';
 import type { Disclosure, OsanoAction, OsanoState } from './types/store';
 import {
 	getFinalOptOutValue,
@@ -36,11 +37,17 @@ import { ConsentConfig } from './ConsentManager';
 
 export const init = (initialArgs: OsanoState & any): OsanoState => {
 	const { consent, ...reloadProps } = initialArgs;
-	const consentRecord = consent
-		? Array.isArray(consent)
-			? makeConsentFromCategories(consent)
-			: { ...consent }
-		: initialState.consent;
+	const consentRecord = normalizeDoNotSellConsent(
+		consent
+			? Array.isArray(consent)
+				? makeConsentFromCategories(consent)
+				: { ...consent }
+			: initialState.consent,
+		{
+			enableDoNotSell: reloadProps.config?.enableDoNotSell,
+			doNotSellCategories: reloadProps.config?.doNotSellCategories,
+		},
+	);
 	return {
 		...initialState,
 		...reloadProps,
@@ -109,11 +116,17 @@ export function reducer(state: OsanoState, action: OsanoAction): OsanoState {
 		 */
 		case SAVE_BEGIN: {
 			const consentedCategories: ConsentCategoryType[] = action.payload;
-			const consent = makeConsentFromCategories(consentedCategories);
+			const consent = normalizeDoNotSellConsent(
+				makeConsentFromCategories(consentedCategories),
+				{
+					enableDoNotSell: state.config?.enableDoNotSell,
+					doNotSellCategories: state.config?.doNotSellCategories,
+				},
+			);
 			return {
 				...state,
 				consent,
-				savedConsent: { ...consent },
+				savedConsent: { ...consent } as Record<ConsentCategoryType, boolean>,
 			};
 		}
 		case CLEAR_CONSENT: {
@@ -144,64 +157,48 @@ export function reducer(state: OsanoState, action: OsanoAction): OsanoState {
 		}
 		case SET_ALL_CONSENT: {
 			const acceptOrDeny = action.payload;
-			return setAllConsent(acceptOrDeny)(state);
+			const next = setAllConsent(acceptOrDeny)(state);
+			return {
+				...next,
+				consent: normalizeDoNotSellConsent(next.consent, {
+					enableDoNotSell: state.config?.enableDoNotSell,
+					doNotSellCategories: state.config?.doNotSellCategories,
+				}),
+			};
 		}
 		case TOGGLE_CATEGORY: {
-			const { category, value } = action.payload;
+			// The action creator accepts either the shorthand string form
+			// (toggleCategory(ConsentCategory.X)) or an explicit { category, value }.
+			const { category, value } =
+				typeof action.payload === 'string'
+					? { category: action.payload, value: undefined }
+					: action.payload;
 			if (typeof category !== 'string') {
 				return state;
 			}
+			const key = category as ConsentCategoryType;
 
-			// don't turn MARKETING on if OPT_OUT is already on
-			if (
-				category === ConsentCategory.MARKETING &&
-				state.consent[ConsentCategory.OPT_OUT] === true
-			) {
-				return state;
-			}
+			// Resolve the new value: an explicit boolean, otherwise flip the current
+			// value (an unset category defaults to on).
+			const current = state.consent[key];
+			const newValue =
+				typeof value === 'boolean'
+					? value
+					: current !== undefined
+						? !current
+						: true;
 
-			// turn MARKETING off if turning on OPT_OUT
-			if (
-				category === ConsentCategory.OPT_OUT &&
-				value === true &&
-				state.consent[ConsentCategory.MARKETING]
-			) {
-				return {
-					...state,
-					consent: {
-						...state.consent,
-						[ConsentCategory.MARKETING]: false,
-						[category as ConsentCategoryType]: value,
-					},
-				};
-			}
+			// Keep the opt-out and its governed categories mutually exclusive.
+			const forcedOff = doNotSellSideEffects(key, newValue, {
+				enableDoNotSell: state.config?.enableDoNotSell,
+				doNotSellCategories: state.config?.doNotSellCategories,
+			});
 
-			if (typeof value === 'boolean') {
-				return {
-					...state,
-					consent: {
-						...state.consent,
-						[category as ConsentCategoryType]: value,
-					},
-				};
+			const consent = { ...state.consent, [key]: newValue };
+			for (const forced of forcedOff) {
+				consent[forced] = false;
 			}
-			if (state.consent[category as ConsentCategoryType] !== undefined) {
-				return {
-					...state,
-					consent: {
-						...state.consent,
-						[category as ConsentCategoryType]:
-							!state.consent[category as ConsentCategoryType],
-					},
-				};
-			}
-			return {
-				...state,
-				consent: {
-					...state.consent,
-					[category as ConsentCategoryType]: true,
-				},
-			};
+			return { ...state, consent };
 		}
 		case SHOW_DIALOG:
 			return {

package/src/selectors.ts

@@ -5,6 +5,7 @@ import {
 } from './constants';
 import type { Disclosure, OsanoState } from './types/store';
 
+import { resolveDoNotSellCategories } from './doNotSell';
 import { get } from './utils';
 
 export const isCategoryAccepted = (
@@ -14,14 +15,36 @@ export const isCategoryAccepted = (
 
 export const isAnalyticsAlwaysAllowed = (state: OsanoState) =>
 	!!state.config?.type.analyticsAlways;
+
+export const isBrowsingFromUS = (state: OsanoState) =>
+	!!state.config?.browsingFromUS;
+
+export const isDoNotSellEnabled = (state: OsanoState) =>
+	!!state.config?.enableDoNotSell;
+
+// Whether to render the "Do Not Sell / Share" opt-out toggle. Delegates to the
+// config's visibility rule (tenant flag AND ccpaApplies/US).
+export const shouldRenderOptOut = (state: OsanoState) =>
+	!!state.config?.isDoNotSellVisible;
+
+// The categories the opt-out governs (config's doNotSellCategories, defaulting
+// to Marketing). ESSENTIAL and OPT_OUT are never governed.
+const isGovernedByOptOut = (state: OsanoState, category: ConsentCategoryType) =>
+	resolveDoNotSellCategories(state.config?.doNotSellCategories).includes(
+		category,
+	);
+
 export const isCategoryDisabled = (
 	state: OsanoState,
 	category: ConsentCategoryType,
 ) =>
 	category === ConsentCategory.ESSENTIAL ||
 	(category === ConsentCategory.OPT_OUT && isGPCSupportEnabled(state)) ||
-	(category === ConsentCategory.MARKETING &&
-		(state.config?.shouldRenderOptOut || isGPCSupportEnabled(state)) &&
+	// A governed category is locked off while the opt-out is active. Keyed off the
+	// configured governed categories, so a non-governed category (e.g. Marketing
+	// when the tenant governs Analytics) stays enabled.
+	(isGovernedByOptOut(state, category) &&
+		(shouldRenderOptOut(state) || isGPCSupportEnabled(state)) &&
 		isCategoryAccepted(state, ConsentCategory.OPT_OUT));
 
 export const isDrawerOpen = (state: OsanoState) => state.stack.length > 0;

package/src/services/consent.ts

@@ -9,6 +9,7 @@ import {
 	formatConsentArray,
 	makeConsentFromCategories,
 } from '../constants';
+import { applyDoNotSellDefault, normalizeDoNotSellConsent } from '../doNotSell';
 import { clearStorage, getStorage, setStorage } from '../native/OsanoCmp';
 import { getConsentExpirationSeconds } from './gdprMappings';
 import type { Config } from '../types/consent-config';
@@ -220,7 +221,13 @@ export const migrateConsentStorage = async (
 							let consent = JSON.parse(oldConsent) as ConsentCategoryType[];
 							if (consent.length > 0) {
 								consent = formatConsentArray(
-									makeConsentFromCategories(consent),
+									normalizeDoNotSellConsent(
+										makeConsentFromCategories(consent),
+										{
+											enableDoNotSell: cmp.config.enableDoNotSell,
+											doNotSellCategories: cmp.config.doNotSellCategories,
+										},
+									),
 								);
 								// Store with new user-specific key
 								storeConsent(cmp, consent).then(() => {
@@ -247,10 +254,23 @@ export const migrateConsentStorage = async (
 
 // The consent to fall back to when a visitor has no stored consent yet. Flavor 7
 // shows analytics enabled on first load; every other flavor stays essential-only.
-const firstLoadConsent = (cmp: ConsentManager): ConsentCategoryType[] =>
-	cmp.config?.analyticsDefaultsOnAtFirstLoad
-		? [ConsentCategory.ESSENTIAL, ConsentCategory.ANALYTICS]
-		: [ConsentCategory.ESSENTIAL];
+// The Do-Not-Sell default is then applied, but only when the opt-out would
+// actually be visible (tenant flag + CCPA/US), so we never seed an OPT_OUT the
+// user cannot see or control.
+const firstLoadConsent = (cmp: ConsentManager): ConsentCategoryType[] => {
+	let categories: ConsentCategoryType[] = [ConsentCategory.ESSENTIAL];
+	if (cmp.config?.analyticsDefaultsOnAtFirstLoad) {
+		categories.push(ConsentCategory.ANALYTICS);
+	}
+	if (cmp.config?.isDoNotSellVisible) {
+		categories = applyDoNotSellDefault(categories, {
+			enableDoNotSell: cmp.config.enableDoNotSell,
+			enableDoNotSellDefault: cmp.config.enableDoNotSellDefault,
+			doNotSellCategories: cmp.config.doNotSellCategories,
+		});
+	}
+	return categories;
+};
 
 // Clear any stale storage, then seed the first-load default. Because this only
 // runs when there is no stored consent, a returning visitor's saved opt-out is
@@ -442,7 +462,13 @@ export const recordConsent = (
 		.then(() => consent ?? cmp.consent ?? [ConsentCategory.ESSENTIAL])
 		.then((consentCategories) => {
 			consentCategories = formatConsentArray(
-				makeConsentFromCategories(consentCategories),
+				normalizeDoNotSellConsent(
+					makeConsentFromCategories(consentCategories),
+					{
+						enableDoNotSell: cmp.config.enableDoNotSell,
+						doNotSellCategories: cmp.config.doNotSellCategories,
+					},
+				),
 			);
 			storeConsent(cmp, consentCategories, true);
 			return consentCategories;
@@ -526,8 +552,19 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 				// first-load default.
 				return settleEssentialOnly(cmp);
 			}
-			const remoteConsentCategories = consented.map(
-				(category) => ConsentCategory[category as keyof typeof ConsentCategory],
+			const remoteConsentCategories = formatConsentArray(
+				normalizeDoNotSellConsent(
+					makeConsentFromCategories(
+						consented.map(
+							(category) =>
+								ConsentCategory[category as keyof typeof ConsentCategory],
+						),
+					),
+					{
+						enableDoNotSell: cmp.config.enableDoNotSell,
+						doNotSellCategories: cmp.config.doNotSellCategories,
+					},
+				),
 			);
 			// Preserve the server timestamp so restoring can't re-date the record.
 			await storeConsent(
@@ -550,7 +587,10 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 				// Remote consent is newer, unexpired, or we haven't recorded any
 				// consent yet. Store it, preserving the server timestamp.
 				const remoteConsentCategories = formatConsentArray(
-					makeConsentFromCategories(consented),
+					normalizeDoNotSellConsent(makeConsentFromCategories(consented), {
+						enableDoNotSell: cmp.config.enableDoNotSell,
+						doNotSellCategories: cmp.config.doNotSellCategories,
+					}),
 				);
 				await storeConsent(
 					cmp,

package/src/types/consent-config.d.ts

@@ -44,6 +44,12 @@ export type Config = {
 	categories: ConsentCategoryType[];
 	ccpaApplies: boolean;
 	ccpaRelaxed: boolean;
+	// "Do Not Sell / Share" opt-out controls. `enableDoNotSell` gates whether the
+	// opt-out toggle renders; `enableDoNotSellDefault` seeds it on at first load;
+	// `doNotSellCategories` lists the categories the opt-out applies to.
+	enableDoNotSell: boolean;
+	enableDoNotSellDefault: boolean;
+	doNotSellCategories: string[];
 	configId: string;
 	country: string;
 	crossDomain: boolean;

package/src/views/Drawer/Drawer.ConsentCategories.tsx

@@ -50,6 +50,7 @@ import {
 	getStack,
 	isCategoryAccepted,
 	isCategoryDisabled,
+	shouldRenderOptOut,
 } from '../../selectors';
 import type { Disclosure } from '../../types/store';
 import DrawerHeader from './Drawer.Header';
@@ -598,7 +599,7 @@ export const ConsentCategoriesDrawer: React.FC = () => {
 		return 'none';
 	}, [previousStack, stack]);
 	const useTcf = config?.tcfIsApplicable;
-	const needsOptOut = config?.shouldRenderOptOut;
+	const needsOptOut = shouldRenderOptOut(state);
 	const categories: ConsentCategoryItem[] = useMemo(() => {
 		const newCategories: ConsentCategoryItem[] = (
 			useTcf ? config.iabCategories : config?.categories || []