@osano/osano-cmp-react-native 0.19.0 → 0.19.1

package/src/index.tsx

@@ -2,6 +2,7 @@ import React, { memo, useCallback, useEffect, useMemo, useRef } from 'react';
 import { Platform, UIManager } from 'react-native';
 import {
 	CLEAR_CONSENT,
+	SAVE_BEGIN,
 	reload,
 	setConfig,
 	setLocale,
@@ -105,7 +106,13 @@ export const Osano: React.FunctionComponent<
 						}),
 					);
 				}
-				return recordConsent(consentManager.current, consentedCategories);
+				dispatch({ type: SAVE_BEGIN, payload: consentedCategories });
+				return recordConsent(consentManager.current, consentedCategories).then(
+					(recordedConsent) => {
+						consentManager.current.triggerGoogleConsentUpdate(recordedConsent);
+						return recordedConsent;
+					},
+				);
 			},
 			[],
 		);
@@ -208,6 +215,7 @@ export const Osano: React.FunctionComponent<
 				})
 				.then((reloadProps) => {
 					// We need to reset the state when the configId or customerId changes
+					const consentInvalidated = consentManager.current.consentInvalidated;
 					dispatch(
 						reload({
 							// Pass config so init-time opt-out normalization runs on the
@@ -217,8 +225,14 @@ export const Osano: React.FunctionComponent<
 							configId: reloadProps.configId,
 							customerId: reloadProps.customerId,
 							consent: reloadProps.consent,
+							// Signals the IAB TCF middleware to wipe (not rehydrate) the
+							// stored TC string on this RELOAD; see its RELOAD handler.
+							consentInvalidated,
 						}),
 					);
+					if (consentManager.current.consentPromptRequired) {
+						dispatch(showDialog());
+					}
 					return reloadProps;
 				})
 				.catch(() => {

package/src/reducer.ts

@@ -127,6 +127,10 @@ export function reducer(state: OsanoState, action: OsanoAction): OsanoState {
 				...state,
 				consent,
 				savedConsent: { ...consent } as Record<ConsentCategoryType, boolean>,
+				// The user just re-consented, so the invalidation is resolved. Clear
+				// the marker so a later SET_CONFIG rehydrates this freshly-saved TCF
+				// payload instead of wiping it (the IAB middleware wipes while set).
+				consentInvalidated: false,
 			};
 		}
 		case CLEAR_CONSENT: {

package/src/services/consent.ts

@@ -94,6 +94,36 @@ const lastConsentDateKey = (configId: string, userSuffix: string) =>
 const legacyLastConsentDateKey = (userSuffix: string) =>
 	`${STORAGE_KEY}_last_recorded_consent_date${userSuffix}`;
 
+const parseStoredTimestamp = (json: string | null | undefined): string => {
+	if (!json) {
+		return '';
+	}
+	try {
+		return JSON.parse(json) as string;
+	} catch {
+		return '';
+	}
+};
+
+const retrieveTimestampForSuffix = async (
+	configId: string,
+	userSuffix: string,
+): Promise<string> => {
+	try {
+		const scoped = parseStoredTimestamp(
+			await getStorage(lastConsentDateKey(configId, userSuffix)),
+		);
+		if (scoped) {
+			return scoped;
+		}
+		return parseStoredTimestamp(
+			await getStorage(legacyLastConsentDateKey(userSuffix)),
+		);
+	} catch {
+		return '';
+	}
+};
+
 function consentRecordedRemotely(
 	configId: string,
 	success: boolean,
@@ -208,48 +238,47 @@ export const migrateConsentStorage = async (
 		return null;
 	}
 
-	return new Promise<ConsentCategoryType[] | null>((resolve) => {
-		const oldKey = `${STORAGE_KEY}_${cmp.configId}`; // Legacy key without user suffix
-		const oldTimestampKey = `${STORAGE_KEY}_last_recorded_consent_date`; // Legacy timestamp key
+	if (Platform.OS !== 'ios' && Platform.OS !== 'android') {
+		return null;
+	}
 
-		switch (Platform.OS) {
-			case 'ios':
-			case 'android':
-				getStorage(oldKey)
-					.then((oldConsent) => {
-						if (oldConsent) {
-							let consent = JSON.parse(oldConsent) as ConsentCategoryType[];
-							if (consent.length > 0) {
-								consent = formatConsentArray(
-									normalizeDoNotSellConsent(
-										makeConsentFromCategories(consent),
-										{
-											enableDoNotSell: cmp.config.enableDoNotSell,
-											doNotSellCategories: cmp.config.doNotSellCategories,
-										},
-									),
-								);
-								// Store with new user-specific key
-								storeConsent(cmp, consent).then(() => {
-									// Clean up old storage
-									clearStorage(oldKey);
-									clearStorage(oldTimestampKey);
-									resolve(consent);
-								});
-								return;
-							}
-						}
-						resolve(null); // No old consent found
-					})
-					.catch(() => {
-						resolve(null); // Old key not found
-					});
-				break;
-			default:
-				resolve(null);
-				break;
+	const oldKey = `${STORAGE_KEY}_${cmp.configId}`;
+	try {
+		const oldConsent = await getStorage(oldKey);
+		if (!oldConsent) {
+			return null;
 		}
-	});
+		let consent = JSON.parse(oldConsent) as ConsentCategoryType[];
+		if (consent.length === 0) {
+			return null;
+		}
+		consent = formatConsentArray(
+			normalizeDoNotSellConsent(makeConsentFromCategories(consent), {
+				enableDoNotSell: cmp.config.enableDoNotSell,
+				doNotSellCategories: cmp.config.doNotSellCategories,
+			}),
+		);
+		const sourceTimestamp = await retrieveTimestampForSuffix(cmp.configId, '');
+		const parsedSourceTimestamp = new Date(sourceTimestamp);
+		const migrationTimestamp = Number.isNaN(parsedSourceTimestamp.getTime())
+			? new Date(0)
+			: parsedSourceTimestamp;
+		await storeConsent(cmp, consent, undefined, migrationTimestamp);
+		await Promise.all(
+			[
+				oldKey,
+				lastConsentDateKey(cmp.configId, ''),
+				legacyLastConsentDateKey(''),
+			].map(async (key) => {
+				try {
+					await clearStorage(key);
+				} catch {}
+			}),
+		);
+		return consent;
+	} catch {
+		return null;
+	}
 };
 
 // The consent to fall back to when a visitor has no stored consent yet. Flavor 7
@@ -284,6 +313,25 @@ const clearToFirstLoadDefault = async (
 	return seed;
 };
 
+const retrieveStoredConsent = async (
+	cmp: ConsentManager,
+): Promise<ConsentCategoryType[] | null> => {
+	const hashedExtUsrData = hashExtUsrData(
+		cmp.customerId,
+		cmp.configId,
+		cmp.extUsrData,
+	);
+	const userSuffix = hashedExtUsrData ? `_${hashedExtUsrData}` : '';
+	try {
+		const stored = await getStorage(
+			`${STORAGE_KEY}_${cmp.configId}${userSuffix}`,
+		);
+		return stored ? (JSON.parse(stored) as ConsentCategoryType[]) : null;
+	} catch {
+		return null;
+	}
+};
+
 // After an expired/invalid record, settle on a persisted essential-only state.
 // Persisting (rather than only clearing the payload with clearConsent) keeps a
 // subsequent load in this safe state instead of falling back to the first-load
@@ -293,17 +341,47 @@ const clearToFirstLoadDefault = async (
 // storage would otherwise re-seed the first-load default.
 const settleEssentialOnly = (
 	cmp: ConsentManager,
-): Promise<ConsentCategoryType[]> =>
-	storeConsent(cmp, [ConsentCategory.ESSENTIAL]);
+	// Keep invalidation sticky until the visitor records a new choice.
+	consentDate?: string | Date,
+): Promise<ConsentCategoryType[]> => {
+	const categories: ConsentCategoryType[] = [ConsentCategory.ESSENTIAL];
+	if (
+		cmp.config?.isDoNotSellVisible &&
+		(cmp.config.enableDoNotSellDefault ||
+			cmp.consent?.includes(ConsentCategory.OPT_OUT))
+	) {
+		categories.push(ConsentCategory.OPT_OUT);
+	}
+	return storeConsent(cmp, categories, undefined, consentDate);
+};
+
+const markConsentInvalidated = (cmp: ConsentManager) => {
+	cmp.consentInvalidated = true;
+	cmp.consentPromptRequired = true;
+};
 
 const retrieveConsent = async (cmp: ConsentManager) => {
-	// If stored consent has aged past its expiration window (production
-	// per-country interval, or the debug testing override), settle on a persisted
-	// essential-only state so callers see essential-only and a later load stays
-	// here (mirrors Android's clearExpiredConsent() + essential-only
-	// getConsentedCategories()).
-	if (await isConsentExpired(cmp)) {
-		return settleEssentialOnly(cmp);
+	// Invalidate stored consent for either independent reason — the record
+	// predates the forceReconsent stamp, or it aged past its expiration window —
+	// and settle on essential-only. Only read the timestamp when there is a stamp
+	// or window to evaluate, so a no-signal load skips the read as the previous
+	// expiry-only path did. `consentInvalidated` (read in index.tsx) drives the
+	// auto re-prompt; it is set only for a previously recorded consent, never on
+	// the first-run path.
+	const forceSeconds = effectiveForceReconsentSeconds(cmp);
+	const expirationSeconds = await effectiveExpirationSeconds(cmp);
+	if (forceSeconds !== null || expirationSeconds !== null) {
+		const timestamp = await retrieveLastConsentTimestamp(cmp);
+		const expired = isTimestampExpired(timestamp, expirationSeconds);
+		const forced = predatesForceReconsent(cmp, timestamp);
+		if (expired || forced) {
+			const storedConsent = await retrieveStoredConsent(cmp);
+			if (storedConsent?.length) {
+				cmp.consent = storedConsent;
+				markConsentInvalidated(cmp);
+				return settleEssentialOnly(cmp, timestamp);
+			}
+		}
 	}
 	return new Promise<ConsentCategoryType[]>((resolve) => {
 		const resConsent = (consentJson: string | null | undefined) => {
@@ -337,7 +415,15 @@ const retrieveConsent = async (cmp: ConsentManager) => {
 						// Try migration if new key not found
 						const migratedConsent = await migrateConsentStorage(cmp);
 						if (migratedConsent) {
-							resolve(migratedConsent);
+							const timestamp = await retrieveLastConsentTimestamp(cmp);
+							const expired = isTimestampExpired(timestamp, expirationSeconds);
+							const forced = predatesForceReconsent(cmp, timestamp);
+							if (expired || forced) {
+								markConsentInvalidated(cmp);
+								resolve(await settleEssentialOnly(cmp, timestamp));
+							} else {
+								resolve(migratedConsent);
+							}
 						} else {
 							// No consent found, seed the first-load default
 							clearToFirstLoadDefault(cmp).then(resolve);
@@ -365,33 +451,7 @@ const retrieveLastConsentTimestamp = async (
 		cmp.extUsrData,
 	);
 	const userSuffix = hashedExtUsrData ? `_${hashedExtUsrData}` : '';
-
-	const parse = (json: string | null | undefined): string => {
-		if (!json) {
-			return '';
-		}
-		try {
-			return JSON.parse(json) as string;
-		} catch {
-			return '';
-		}
-	};
-
-	try {
-		const scoped = parse(
-			await getStorage(lastConsentDateKey(cmp.configId, userSuffix)),
-		);
-		if (scoped) {
-			return scoped;
-		}
-		// Fall back to the legacy un-scoped key for installs written before the
-		// timestamp was scoped by configId.
-		return parse(await getStorage(legacyLastConsentDateKey(userSuffix)));
-	} catch {
-		// Fail closed: a storage rejection resolves to no timestamp instead of
-		// hanging the consent load.
-		return '';
-	}
+	return retrieveTimestampForSuffix(cmp.configId, userSuffix);
 };
 
 /**
@@ -436,6 +496,72 @@ const isTimestampExpired = (
 	return Date.now() - consentedAtMs > seconds * 1000;
 };
 
+/**
+ * Resolves the effective `forceReconsent` signal in whole seconds, validating
+ * before trusting it. The raw field ships over the network and is human-edited,
+ * so treat any malformed value as "no signal" (null) rather than invalidating
+ * every consent:
+ *
+ *   - absent / null       → null (no signal)
+ *   - <= 0                → null (guards zero and negatives)
+ *   - in the future       → null (clock skew, or a value mistakenly stamped in
+ *                           milliseconds, which reads as ~1000× "now" ⇒ future)
+ *
+ * Failing toward *not* invalidating means the worst a bad value causes is a
+ * missed prompt, never a permanent lockout.
+ */
+export const effectiveForceReconsentSeconds = (
+	cmp: ConsentManager,
+): number | null => {
+	const raw: unknown = cmp.config?.forceReconsent;
+	if (raw == null) {
+		return null;
+	}
+	const seconds =
+		typeof raw === 'number'
+			? raw
+			: typeof raw === 'string' && raw.trim() !== ''
+				? Number(raw)
+				: Number.NaN;
+	if (!Number.isFinite(seconds) || seconds <= 0) {
+		return null;
+	}
+	if (seconds > Math.floor(Date.now() / 1000)) {
+		return null;
+	}
+	return seconds;
+};
+
+/**
+ * True when a consent record predates the server's `forceReconsent` stamp.
+ * `timestamp` is the recorded-consent instant (stored as an ISO/ms string).
+ *
+ * Unit alignment is the subtle part: the signal is in SECONDS and the timestamp
+ * is in MILLISECONDS, so the signal is scaled up (`* 1000`). The boundary is
+ * strict `<` — consent recorded exactly at the stamp instant stays valid.
+ *
+ * A missing/unparseable timestamp fails closed (returns false), so first-run
+ * (no timestamp) is not wrongly invalidated. `storeConsent` always co-stamps,
+ * so a consented-but-timestampless record is unreachable here anyway.
+ */
+export const predatesForceReconsent = (
+	cmp: ConsentManager,
+	timestamp: string | number | Date | null | undefined,
+): boolean => {
+	const forceSeconds = effectiveForceReconsentSeconds(cmp);
+	if (forceSeconds === null) {
+		return false;
+	}
+	if (!timestamp) {
+		return false;
+	}
+	const consentedAtMs = new Date(timestamp).getTime();
+	if (Number.isNaN(consentedAtMs)) {
+		return false;
+	}
+	return consentedAtMs < forceSeconds * 1000;
+};
+
 /**
  * Returns true when the locally stored consent has aged past its expiration
  * window (see {@link effectiveExpirationSeconds}).
@@ -455,6 +581,8 @@ export const recordConsent = (
 	cmp: ConsentManager,
 	consent?: ConsentCategoryType[],
 ) => {
+	cmp.consentInvalidated = false;
+	cmp.consentPromptRequired = false;
 	const payload = createConsentRecordPayload(cmp, consent);
 	return API.post(`${CONSENT_URI}/record`, payload, {
 		referrer: cmp.consentingDomain,
@@ -539,18 +667,22 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 
 		// Evaluate the remote record against the server's own timestamp (when the
 		// visitor actually consented), not "now", so an already-expired remote
-		// record is never restored and re-dated as fresh.
+		// record is never restored and re-dated as fresh. A record that predates
+		// the server's forceReconsent stamp is stale for the same reason — applying
+		// it would silently re-grant the very consent the signal invalidated.
 		const seconds = await effectiveExpirationSeconds(cmp);
-		const remoteExpired = isTimestampExpired(lastConsentTimestamp, seconds);
+		const remoteForced = predatesForceReconsent(cmp, lastConsentTimestamp);
+		const remoteStale =
+			isTimestampExpired(lastConsentTimestamp, seconds) || remoteForced;
 
 		// If extUsrData is not null and not empty, always use remote consent (cross-device consent enabled)
 		if (extUsrData && extUsrData.trim() !== '') {
-			if (remoteExpired) {
-				// The authoritative remote record has expired; settle on a persisted
-				// essential-only state rather than restoring stale consent, so a
-				// subsequent load stays here instead of falling back to the
-				// first-load default.
-				return settleEssentialOnly(cmp);
+			if (remoteStale) {
+				// The authoritative remote record is stale (expired or predates the
+				// stamp); settle essential-only and flag the invalidation rather than
+				// restoring it.
+				markConsentInvalidated(cmp);
+				return settleEssentialOnly(cmp, lastConsentTimestamp);
 			}
 			const remoteConsentCategories = formatConsentArray(
 				normalizeDoNotSellConsent(
@@ -573,6 +705,7 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 				true,
 				lastConsentTimestamp,
 			);
+			cmp.consentPromptRequired = false;
 			return remoteConsentCategories;
 		}
 
@@ -580,7 +713,7 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 		const internalTimestamp = await retrieveLastConsentTimestamp(cmp);
 		try {
 			if (
-				!remoteExpired &&
+				!remoteStale &&
 				(new Date(lastConsentTimestamp) > new Date(internalTimestamp) ||
 					internalTimestamp === '')
 			) {
@@ -598,6 +731,7 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 					true,
 					lastConsentTimestamp,
 				);
+				cmp.consentPromptRequired = false;
 
 				return remoteConsentCategories;
 			}

package/src/types/consent-config.d.ts

@@ -56,7 +56,11 @@ export type Config = {
 	customerId: string;
 	domains: Array<string>;
 	forceManagePreferences: boolean;
-	forceReconsent?: Date;
+	// Server-stamped Unix timestamp in whole SECONDS. When present, consent
+	// recorded before this instant is treated as no longer valid, re-prompting the
+	// visitor. Read-only on the client (the server authors it); absent/undefined
+	// means "no signal". See src/services/consent.ts effectiveForceReconsentSeconds.
+	forceReconsent?: number;
 	gdprApplies?: boolean;
 	googleConsent: boolean;
 	gpcSupport: boolean;

package/src/types/store.d.ts

@@ -30,6 +30,11 @@ export type OsanoState = {
 	scrollToType: string;
 	scrollToId: number;
 	stack: string[];
+	// Transient marker set by a RELOAD whose consent was invalidated (expired or
+	// predating the forceReconsent stamp). The IAB TCF middleware reads it on
+	// RELOAD/SET_CONFIG to wipe stale TC strings instead of rehydrating them.
+	// Reset on SAVE_BEGIN (the user re-consented) and on the next clean load.
+	consentInvalidated?: boolean;
 };
 
 export type ActionCreator<S, T> = (payload?: T) => OsanoAction<S, T>;