@osano/osano-cmp-react-native 0.19.0 → 0.19.2

package/src/services/consent.ts

@@ -29,10 +29,9 @@ const CONSENTING_PLATFORM_TAG = IS_OFFICIAL_SAMPLE
 	? `${Platform.OS}.sample-react-native`
 	: `${Platform.OS}.react-native`;
 
-const overrideConfig: Partial<Config> = {
-	// Override config here
-	variant: 'two',
-};
+// Local-testing hook only — any key set here clobbers the fetched config
+// (including the x-osano-* headers), so it must ship empty.
+const overrideConfig: Partial<Config> = {};
 
 export type ConsentPayload = {
 	customerId: string;
@@ -94,6 +93,36 @@ const lastConsentDateKey = (configId: string, userSuffix: string) =>
 const legacyLastConsentDateKey = (userSuffix: string) =>
 	`${STORAGE_KEY}_last_recorded_consent_date${userSuffix}`;
 
+const parseStoredTimestamp = (json: string | null | undefined): string => {
+	if (!json) {
+		return '';
+	}
+	try {
+		return JSON.parse(json) as string;
+	} catch {
+		return '';
+	}
+};
+
+const retrieveTimestampForSuffix = async (
+	configId: string,
+	userSuffix: string,
+): Promise<string> => {
+	try {
+		const scoped = parseStoredTimestamp(
+			await getStorage(lastConsentDateKey(configId, userSuffix)),
+		);
+		if (scoped) {
+			return scoped;
+		}
+		return parseStoredTimestamp(
+			await getStorage(legacyLastConsentDateKey(userSuffix)),
+		);
+	} catch {
+		return '';
+	}
+};
+
 function consentRecordedRemotely(
 	configId: string,
 	success: boolean,
@@ -208,48 +237,47 @@ export const migrateConsentStorage = async (
 		return null;
 	}
 
-	return new Promise<ConsentCategoryType[] | null>((resolve) => {
-		const oldKey = `${STORAGE_KEY}_${cmp.configId}`; // Legacy key without user suffix
-		const oldTimestampKey = `${STORAGE_KEY}_last_recorded_consent_date`; // Legacy timestamp key
+	if (Platform.OS !== 'ios' && Platform.OS !== 'android') {
+		return null;
+	}
 
-		switch (Platform.OS) {
-			case 'ios':
-			case 'android':
-				getStorage(oldKey)
-					.then((oldConsent) => {
-						if (oldConsent) {
-							let consent = JSON.parse(oldConsent) as ConsentCategoryType[];
-							if (consent.length > 0) {
-								consent = formatConsentArray(
-									normalizeDoNotSellConsent(
-										makeConsentFromCategories(consent),
-										{
-											enableDoNotSell: cmp.config.enableDoNotSell,
-											doNotSellCategories: cmp.config.doNotSellCategories,
-										},
-									),
-								);
-								// Store with new user-specific key
-								storeConsent(cmp, consent).then(() => {
-									// Clean up old storage
-									clearStorage(oldKey);
-									clearStorage(oldTimestampKey);
-									resolve(consent);
-								});
-								return;
-							}
-						}
-						resolve(null); // No old consent found
-					})
-					.catch(() => {
-						resolve(null); // Old key not found
-					});
-				break;
-			default:
-				resolve(null);
-				break;
+	const oldKey = `${STORAGE_KEY}_${cmp.configId}`;
+	try {
+		const oldConsent = await getStorage(oldKey);
+		if (!oldConsent) {
+			return null;
 		}
-	});
+		let consent = JSON.parse(oldConsent) as ConsentCategoryType[];
+		if (consent.length === 0) {
+			return null;
+		}
+		consent = formatConsentArray(
+			normalizeDoNotSellConsent(makeConsentFromCategories(consent), {
+				enableDoNotSell: cmp.config.enableDoNotSell,
+				doNotSellCategories: cmp.config.doNotSellCategories,
+			}),
+		);
+		const sourceTimestamp = await retrieveTimestampForSuffix(cmp.configId, '');
+		const parsedSourceTimestamp = new Date(sourceTimestamp);
+		const migrationTimestamp = Number.isNaN(parsedSourceTimestamp.getTime())
+			? new Date(0)
+			: parsedSourceTimestamp;
+		await storeConsent(cmp, consent, undefined, migrationTimestamp);
+		await Promise.all(
+			[
+				oldKey,
+				lastConsentDateKey(cmp.configId, ''),
+				legacyLastConsentDateKey(''),
+			].map(async (key) => {
+				try {
+					await clearStorage(key);
+				} catch {}
+			}),
+		);
+		return consent;
+	} catch {
+		return null;
+	}
 };
 
 // The consent to fall back to when a visitor has no stored consent yet. Flavor 7
@@ -284,6 +312,25 @@ const clearToFirstLoadDefault = async (
 	return seed;
 };
 
+const retrieveStoredConsent = async (
+	cmp: ConsentManager,
+): Promise<ConsentCategoryType[] | null> => {
+	const hashedExtUsrData = hashExtUsrData(
+		cmp.customerId,
+		cmp.configId,
+		cmp.extUsrData,
+	);
+	const userSuffix = hashedExtUsrData ? `_${hashedExtUsrData}` : '';
+	try {
+		const stored = await getStorage(
+			`${STORAGE_KEY}_${cmp.configId}${userSuffix}`,
+		);
+		return stored ? (JSON.parse(stored) as ConsentCategoryType[]) : null;
+	} catch {
+		return null;
+	}
+};
+
 // After an expired/invalid record, settle on a persisted essential-only state.
 // Persisting (rather than only clearing the payload with clearConsent) keeps a
 // subsequent load in this safe state instead of falling back to the first-load
@@ -293,17 +340,47 @@ const clearToFirstLoadDefault = async (
 // storage would otherwise re-seed the first-load default.
 const settleEssentialOnly = (
 	cmp: ConsentManager,
-): Promise<ConsentCategoryType[]> =>
-	storeConsent(cmp, [ConsentCategory.ESSENTIAL]);
+	// Keep invalidation sticky until the visitor records a new choice.
+	consentDate?: string | Date,
+): Promise<ConsentCategoryType[]> => {
+	const categories: ConsentCategoryType[] = [ConsentCategory.ESSENTIAL];
+	if (
+		cmp.config?.isDoNotSellVisible &&
+		(cmp.config.enableDoNotSellDefault ||
+			cmp.consent?.includes(ConsentCategory.OPT_OUT))
+	) {
+		categories.push(ConsentCategory.OPT_OUT);
+	}
+	return storeConsent(cmp, categories, undefined, consentDate);
+};
+
+const markConsentInvalidated = (cmp: ConsentManager) => {
+	cmp.consentInvalidated = true;
+	cmp.consentPromptRequired = true;
+};
 
 const retrieveConsent = async (cmp: ConsentManager) => {
-	// If stored consent has aged past its expiration window (production
-	// per-country interval, or the debug testing override), settle on a persisted
-	// essential-only state so callers see essential-only and a later load stays
-	// here (mirrors Android's clearExpiredConsent() + essential-only
-	// getConsentedCategories()).
-	if (await isConsentExpired(cmp)) {
-		return settleEssentialOnly(cmp);
+	// Invalidate stored consent for either independent reason — the record
+	// predates the forceReconsent stamp, or it aged past its expiration window —
+	// and settle on essential-only. Only read the timestamp when there is a stamp
+	// or window to evaluate, so a no-signal load skips the read as the previous
+	// expiry-only path did. `consentInvalidated` (read in index.tsx) drives the
+	// auto re-prompt; it is set only for a previously recorded consent, never on
+	// the first-run path.
+	const forceSeconds = effectiveForceReconsentSeconds(cmp);
+	const expirationSeconds = await effectiveExpirationSeconds(cmp);
+	if (forceSeconds !== null || expirationSeconds !== null) {
+		const timestamp = await retrieveLastConsentTimestamp(cmp);
+		const expired = isTimestampExpired(timestamp, expirationSeconds);
+		const forced = predatesForceReconsent(cmp, timestamp);
+		if (expired || forced) {
+			const storedConsent = await retrieveStoredConsent(cmp);
+			if (storedConsent?.length) {
+				cmp.consent = storedConsent;
+				markConsentInvalidated(cmp);
+				return settleEssentialOnly(cmp, timestamp);
+			}
+		}
 	}
 	return new Promise<ConsentCategoryType[]>((resolve) => {
 		const resConsent = (consentJson: string | null | undefined) => {
@@ -337,7 +414,15 @@ const retrieveConsent = async (cmp: ConsentManager) => {
 						// Try migration if new key not found
 						const migratedConsent = await migrateConsentStorage(cmp);
 						if (migratedConsent) {
-							resolve(migratedConsent);
+							const timestamp = await retrieveLastConsentTimestamp(cmp);
+							const expired = isTimestampExpired(timestamp, expirationSeconds);
+							const forced = predatesForceReconsent(cmp, timestamp);
+							if (expired || forced) {
+								markConsentInvalidated(cmp);
+								resolve(await settleEssentialOnly(cmp, timestamp));
+							} else {
+								resolve(migratedConsent);
+							}
 						} else {
 							// No consent found, seed the first-load default
 							clearToFirstLoadDefault(cmp).then(resolve);
@@ -365,33 +450,7 @@ const retrieveLastConsentTimestamp = async (
 		cmp.extUsrData,
 	);
 	const userSuffix = hashedExtUsrData ? `_${hashedExtUsrData}` : '';
-
-	const parse = (json: string | null | undefined): string => {
-		if (!json) {
-			return '';
-		}
-		try {
-			return JSON.parse(json) as string;
-		} catch {
-			return '';
-		}
-	};
-
-	try {
-		const scoped = parse(
-			await getStorage(lastConsentDateKey(cmp.configId, userSuffix)),
-		);
-		if (scoped) {
-			return scoped;
-		}
-		// Fall back to the legacy un-scoped key for installs written before the
-		// timestamp was scoped by configId.
-		return parse(await getStorage(legacyLastConsentDateKey(userSuffix)));
-	} catch {
-		// Fail closed: a storage rejection resolves to no timestamp instead of
-		// hanging the consent load.
-		return '';
-	}
+	return retrieveTimestampForSuffix(cmp.configId, userSuffix);
 };
 
 /**
@@ -436,6 +495,72 @@ const isTimestampExpired = (
 	return Date.now() - consentedAtMs > seconds * 1000;
 };
 
+/**
+ * Resolves the effective `forceReconsent` signal in whole seconds, validating
+ * before trusting it. The raw field ships over the network and is human-edited,
+ * so treat any malformed value as "no signal" (null) rather than invalidating
+ * every consent:
+ *
+ *   - absent / null       → null (no signal)
+ *   - <= 0                → null (guards zero and negatives)
+ *   - in the future       → null (clock skew, or a value mistakenly stamped in
+ *                           milliseconds, which reads as ~1000× "now" ⇒ future)
+ *
+ * Failing toward *not* invalidating means the worst a bad value causes is a
+ * missed prompt, never a permanent lockout.
+ */
+export const effectiveForceReconsentSeconds = (
+	cmp: ConsentManager,
+): number | null => {
+	const raw: unknown = cmp.config?.forceReconsent;
+	if (raw == null) {
+		return null;
+	}
+	const seconds =
+		typeof raw === 'number'
+			? raw
+			: typeof raw === 'string' && raw.trim() !== ''
+				? Number(raw)
+				: Number.NaN;
+	if (!Number.isFinite(seconds) || seconds <= 0) {
+		return null;
+	}
+	if (seconds > Math.floor(Date.now() / 1000)) {
+		return null;
+	}
+	return seconds;
+};
+
+/**
+ * True when a consent record predates the server's `forceReconsent` stamp.
+ * `timestamp` is the recorded-consent instant (stored as an ISO/ms string).
+ *
+ * Unit alignment is the subtle part: the signal is in SECONDS and the timestamp
+ * is in MILLISECONDS, so the signal is scaled up (`* 1000`). The boundary is
+ * strict `<` — consent recorded exactly at the stamp instant stays valid.
+ *
+ * A missing/unparseable timestamp fails closed (returns false), so first-run
+ * (no timestamp) is not wrongly invalidated. `storeConsent` always co-stamps,
+ * so a consented-but-timestampless record is unreachable here anyway.
+ */
+export const predatesForceReconsent = (
+	cmp: ConsentManager,
+	timestamp: string | number | Date | null | undefined,
+): boolean => {
+	const forceSeconds = effectiveForceReconsentSeconds(cmp);
+	if (forceSeconds === null) {
+		return false;
+	}
+	if (!timestamp) {
+		return false;
+	}
+	const consentedAtMs = new Date(timestamp).getTime();
+	if (Number.isNaN(consentedAtMs)) {
+		return false;
+	}
+	return consentedAtMs < forceSeconds * 1000;
+};
+
 /**
  * Returns true when the locally stored consent has aged past its expiration
  * window (see {@link effectiveExpirationSeconds}).
@@ -455,6 +580,8 @@ export const recordConsent = (
 	cmp: ConsentManager,
 	consent?: ConsentCategoryType[],
 ) => {
+	cmp.consentInvalidated = false;
+	cmp.consentPromptRequired = false;
 	const payload = createConsentRecordPayload(cmp, consent);
 	return API.post(`${CONSENT_URI}/record`, payload, {
 		referrer: cmp.consentingDomain,
@@ -539,18 +666,22 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 
 		// Evaluate the remote record against the server's own timestamp (when the
 		// visitor actually consented), not "now", so an already-expired remote
-		// record is never restored and re-dated as fresh.
+		// record is never restored and re-dated as fresh. A record that predates
+		// the server's forceReconsent stamp is stale for the same reason — applying
+		// it would silently re-grant the very consent the signal invalidated.
 		const seconds = await effectiveExpirationSeconds(cmp);
-		const remoteExpired = isTimestampExpired(lastConsentTimestamp, seconds);
+		const remoteForced = predatesForceReconsent(cmp, lastConsentTimestamp);
+		const remoteStale =
+			isTimestampExpired(lastConsentTimestamp, seconds) || remoteForced;
 
 		// If extUsrData is not null and not empty, always use remote consent (cross-device consent enabled)
 		if (extUsrData && extUsrData.trim() !== '') {
-			if (remoteExpired) {
-				// The authoritative remote record has expired; settle on a persisted
-				// essential-only state rather than restoring stale consent, so a
-				// subsequent load stays here instead of falling back to the
-				// first-load default.
-				return settleEssentialOnly(cmp);
+			if (remoteStale) {
+				// The authoritative remote record is stale (expired or predates the
+				// stamp); settle essential-only and flag the invalidation rather than
+				// restoring it.
+				markConsentInvalidated(cmp);
+				return settleEssentialOnly(cmp, lastConsentTimestamp);
 			}
 			const remoteConsentCategories = formatConsentArray(
 				normalizeDoNotSellConsent(
@@ -573,6 +704,7 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 				true,
 				lastConsentTimestamp,
 			);
+			cmp.consentPromptRequired = false;
 			return remoteConsentCategories;
 		}
 
@@ -580,7 +712,7 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 		const internalTimestamp = await retrieveLastConsentTimestamp(cmp);
 		try {
 			if (
-				!remoteExpired &&
+				!remoteStale &&
 				(new Date(lastConsentTimestamp) > new Date(internalTimestamp) ||
 					internalTimestamp === '')
 			) {
@@ -598,6 +730,7 @@ export const fetchConsent = async (cmp: ConsentManager) => {
 					true,
 					lastConsentTimestamp,
 				);
+				cmp.consentPromptRequired = false;
 
 				return remoteConsentCategories;
 			}

package/src/types/consent-config.d.ts

@@ -56,7 +56,11 @@ export type Config = {
 	customerId: string;
 	domains: Array<string>;
 	forceManagePreferences: boolean;
-	forceReconsent?: Date;
+	// Server-stamped Unix timestamp in whole SECONDS. When present, consent
+	// recorded before this instant is treated as no longer valid, re-prompting the
+	// visitor. Read-only on the client (the server authors it); absent/undefined
+	// means "no signal". See src/services/consent.ts effectiveForceReconsentSeconds.
+	forceReconsent?: number;
 	gdprApplies?: boolean;
 	googleConsent: boolean;
 	gpcSupport: boolean;

package/src/types/store.d.ts

@@ -30,6 +30,11 @@ export type OsanoState = {
 	scrollToType: string;
 	scrollToId: number;
 	stack: string[];
+	// Transient marker set by a RELOAD whose consent was invalidated (expired or
+	// predating the forceReconsent stamp). The IAB TCF middleware reads it on
+	// RELOAD/SET_CONFIG to wipe stale TC strings instead of rehydrating them.
+	// Reset on SAVE_BEGIN (the user re-consented) and on the next clean load.
+	consentInvalidated?: boolean;
 };
 
 export type ActionCreator<S, T> = (payload?: T) => OsanoAction<S, T>;

package/src/utils/Translator.ts

@@ -100,6 +100,8 @@ export default class Translator extends EventEmitter {
 	private _langLoadFailureSubscription?: EventSubscription;
 
 	private _loading: Record<string, Promise<string | undefined>> = {};
+	private _loadedCustomerId?: string;
+	private _loadedConfigId?: string;
 	load(
 		desiredLocale?: string,
 		onLangLoadSuccess?: () => void,
@@ -114,6 +116,16 @@ export default class Translator extends EventEmitter {
 		const locale = allLocales.shift();
 		const customerId = this._consentManager.customerId;
 		const configId = this._consentManager.configId;
+		// Overrides are keyed only by locale — stale copy from a previous
+		// customer/config would survive the switch and skip the refetch below.
+		if (
+			customerId !== this._loadedCustomerId ||
+			configId !== this._loadedConfigId
+		) {
+			this._overrides = {};
+			this._loadedCustomerId = customerId;
+			this._loadedConfigId = configId;
+		}
 		this._langLoadFailureSubscription =
 			onLangLoadFailure && this.on('langLoadFailure', onLangLoadFailure);
 		this._langLoadSuccessSubscription =
@@ -284,40 +296,38 @@ export default class Translator extends EventEmitter {
 		const pathStr = Array.isArray(path) ? path.join('.') : path;
 		const fallback =
 			typeof defaultPhrase === 'string' ? defaultPhrase : `${pathStr}`;
-		const phrases = locales[`${locale}`];
-		const override = this._overrides[`${locale}`];
 
 		let translation: string | number | LocalizedStrings | undefined;
 
-		// Priority-based translation lookup
-		const searchPaths = [
-			// Mobile Customer-specific
-			[override, `mobile.${pathStr}`],
-			// Web Customer-specific
-			[override, pathStr],
-			// Mobile Global
-			[phrases, `mobile.${pathStr}`],
-			// Web Global
-			[phrases, pathStr],
-		] as [Record<string, string>, string][];
-		// Search in customer-specific overrides first, then global phrases
+		// load() stores phrases under whatever locale it managed to fetch (e.g.
+		// en-us.json may 403 while en.json exists), so search every fallback
+		// bucket. Overrides beat built-in phrases only within the active language
+		// — customer copy loaded via the English fallback must not repaint a
+		// non-English UI.
+		const normalized = locale.toLowerCase().replace(/_/g, '-');
+		const lookupLocales = [
+			...new Set([locale, ...Translator.fallbackLanguages(normalized)]),
+		].filter((lookupLocale): lookupLocale is string => !!lookupLocale);
+		const baseLanguage = normalized.split('-')[0];
+		const overrideLocales = lookupLocales.filter(
+			(lookupLocale) =>
+				lookupLocale === locale || lookupLocale.split('-')[0] === baseLanguage,
+		);
+		const searchPaths: [LocalizedStrings | undefined, string][] = [];
+		for (const lookupLocale of overrideLocales) {
+			const override = this._overrides[`${lookupLocale}`];
+			searchPaths.push([override, `mobile.${pathStr}`], [override, pathStr]);
+		}
+		for (const lookupLocale of lookupLocales) {
+			const phrases = locales[`${lookupLocale}`];
+			searchPaths.push([phrases, `mobile.${pathStr}`], [phrases, pathStr]);
+		}
 		for (const [source, searchPath] of searchPaths) {
 			if (source) {
 				translation = get(source, searchPath);
 				if (translation) break;
 			}
 		}
-		// Base translatedResourceBundle (fallback to default locale)
-		if (translation == null && locale !== Translator.DEFAULT_LANGUAGE) {
-			const defaultPhrases = locales[Translator.DEFAULT_LANGUAGE];
-			if (defaultPhrases) {
-				translation = get(
-					defaultPhrases,
-					`mobile.${pathStr}`,
-					get(defaultPhrases, pathStr),
-				);
-			}
-		}
 		// Use fallback if nothing found
 		if (!translation) {
 			translation = fallback;