cb-cookie-manager 0.0.1-security → 1.0.0

package/src/hooks/useSetTrackingPreference.test.tsx

@@ -0,0 +1,82 @@
+import { act, renderHook } from '@testing-library/react';
+import { log } from 'console';
+import Cookies from 'js-cookie';
+import React from 'react';
+
+import config from '../examples/config';
+import { Provider } from '../TrackingManagerContext';
+import { Region, TrackingCategory } from '../types';
+import useSetTrackingPreference from './useSetTrackingPreference';
+
+jest.mock('js-cookie', () => ({
+  __esModule: true,
+  default: {
+    get: jest.fn(),
+    set: jest.fn(),
+    remove: jest.fn(),
+  },
+}));
+
+describe('useSetTrackingPreference', () => {
+  const onError = jest.fn();
+  const onPreferenceChange = jest.fn();
+  const region = Region.DEFAULT;
+  const renderFormHook = () =>
+    renderHook(() => useSetTrackingPreference(), {
+      wrapper: ({ children }: { children: React.ReactNode }) => (
+        <Provider
+          onError={onError}
+          config={config}
+          locale="en"
+          projectName="consumer-www"
+          region={region}
+          log={log}
+          onPreferenceChange={onPreferenceChange}
+        >
+          {children}
+        </Provider>
+      ),
+    });
+
+  it('adds required category if not set', () => {
+    const { result } = renderFormHook();
+    act(() => {
+      result.current({
+        region: Region.DEFAULT,
+        consent: [TrackingCategory.FUNCTIONAL],
+      });
+    });
+
+    expect(onError).toHaveBeenCalled();
+    expect(onPreferenceChange).toHaveBeenCalledWith({
+      region: 'DEFAULT',
+      consent: ['functional', 'necessary'],
+    });
+  });
+
+  it('sets new consent', () => {
+    const mockGet = Cookies.get as jest.MockedFunction<typeof Cookies.get>;
+
+    mockGet.mockImplementation(() => ({
+      cm_default_preferences: JSON.stringify({
+        region: Region.DEFAULT,
+        consent: [TrackingCategory.NECESSARY, TrackingCategory.PERFORMANCE],
+      }),
+    }));
+
+    const { result } = renderFormHook();
+    const newPreference = {
+      region: Region.DEFAULT,
+      consent: [
+        TrackingCategory.NECESSARY,
+        TrackingCategory.PERFORMANCE,
+        TrackingCategory.FUNCTIONAL,
+      ],
+    };
+    act(() => {
+      result.current(newPreference);
+    });
+
+    expect(onPreferenceChange).toHaveBeenCalledWith(newPreference);
+  });
+});

package/src/hooks/useSetTrackingPreference.ts

@@ -0,0 +1,31 @@
+import { useCallback } from 'react';
+
+import { useSetCookie } from '../CookieContext';
+import { useTrackingManager } from '../TrackingManagerContext';
+import { TrackingPreference } from '../types';
+import setTrackingPreference from '../utils/setTrackingPreference';
+import useRequiredCategories from './useRequiredCategories';
+
+const useSetTrackingPreference = (): ((preference: TrackingPreference) => void) => {
+  const { region, onPreferenceChange, onError } = useTrackingManager();
+  const setCookie = useSetCookie();
+  const requiredCategories = useRequiredCategories();
+
+  const changePreference = useCallback(
+    (preference: TrackingPreference) => {
+      const preferencesToSet = preference;
+      requiredCategories.forEach((c) => {
+        if (!preference.consent.includes(c)) {
+          onError(new Error(`Trying to remove category ${c} that is required`));
+          preferencesToSet.consent = [...preference.consent, c];
+        }
+      });
+      setTrackingPreference(setCookie, preferencesToSet, region, onPreferenceChange);
+    },
+    [onError, onPreferenceChange, region, requiredCategories, setCookie]
+  );
+
+  return changePreference;
+};
+
+export default useSetTrackingPreference;

package/src/hooks/useTrackingPreference.ts

@@ -0,0 +1,15 @@
+import { useTrackingManager } from '../TrackingManagerContext';
+import { TrackingPreference } from '../types';
+import getDefaultTrackingPreference from '../utils/getDefaultTrackingPreference';
+import { useSavedTrackingPreference } from './useSavedTrackingPreference';
+
+const useTrackingPreference = (): TrackingPreference => {
+  const preference = useSavedTrackingPreference();
+  const { region, config } = useTrackingManager();
+
+  if (!preference) return getDefaultTrackingPreference(region, config);
+
+  return preference;
+};
+
+export default useTrackingPreference;

package/src/index.ts

@@ -0,0 +1,20 @@
+export { TRACKER_CATEGORIES } from './constants';
+export { useCookie } from './CookieContext';
+export { default as useHasConsent } from './hooks/useHasConsent';
+export { default as useRequiredCategories } from './hooks/useRequiredCategories';
+export {
+  useSavedTrackingPreference,
+  useSavedTrackingPreferenceFromMobileApp,
+} from './hooks/useSavedTrackingPreference';
+export { default as useSetTrackingPreference } from './hooks/useSetTrackingPreference';
+export { default as useTrackingPreference } from './hooks/useTrackingPreference';
+export { Provider } from './TrackingManagerContext';
+export { useTrackingManager } from './TrackingManagerContext';
+export { Framework, Region, TrackerType, TrackingCategory, TrackingPreference } from './types';
+export { default as areCookiesEnabled } from './utils/areCookiesEnabled';
+export { default as getDefaultTrackingPreference } from './utils/getDefaultTrackingPreference';
+export { default as isOptOut } from './utils/isOptOut';
+export {
+  getIsMobileAppFromQueryParams,
+  persistMobileAppPreferences,
+} from './utils/persistMobileAppPreferences';

package/src/types.ts

@@ -0,0 +1,71 @@
+import { CookieAttributes } from 'js-cookie';
+
+export type ErrorFunction = (error: Error, metadata?: { [key: string]: any }) => void;
+
+export type SetCookieFunction = (value: any, options?: CookieAttributes) => void;
+
+export type LogFunction = (str: string, options?: Record<string, any>) => void;
+
+export enum Region {
+  EU = 'EU',
+  DEFAULT = 'DEFAULT',
+}
+
+export enum TrackingCategory {
+  FUNCTIONAL = 'functional',
+  NECESSARY = 'necessary',
+  TARGETING = 'targeting',
+  PERFORMANCE = 'performance',
+  DELETE_IF_SEEN = 'delete-if-seen',
+}
+
+export type TrackingPreference = {
+  region: Region;
+  consent: Array<TrackingCategory>;
+};
+
+export enum Framework {
+  OPT_OUT = 'optOut',
+  OPT_IN = 'optIn',
+}
+
+export type GeolocationRule = { region: Region; framework: Framework };
+
+export enum TrackerType {
+  COOKIE = 'cookie',
+  QUERY = 'query',
+  PIXEL = 'pixel',
+  BEACON = 'beacon',
+}
+
+export type Tracker = {
+  id: string;
+  type: TrackerType;
+  regex?: string;
+};
+
+export type ConfigCategoryInfo = {
+  id: TrackingCategory;
+  trackers: Array<Tracker>;
+  required?: boolean;
+};
+
+export type Config = {
+  categories: Array<ConfigCategoryInfo>;
+};
+
+export type TrackingManagerDependencies = {
+  onError: ErrorFunction;
+  projectName: string;
+  locale: string;
+  region: Region;
+  onPreferenceChange?: (preference: TrackingPreference) => void;
+  config: Config;
+  shadowMode?: boolean;
+  log: LogFunction;
+};
+
+export type AdTrackingPreference = {
+  value: boolean;
+  updated_at?: number;
+};

package/src/utils/areCookiesEnabled.ts

@@ -0,0 +1,13 @@
+import Cookies from 'js-cookie';
+
+const TEST_COOKIE = 'test_cookie';
+
+const areCookiesEnabled = (): boolean => {
+  Cookies.set(TEST_COOKIE, 'test');
+  const result = !!Cookies.get(TEST_COOKIE);
+  Cookies.remove(TEST_COOKIE);
+
+  return result;
+};
+
+export default areCookiesEnabled;

package/src/utils/getAllCookies.test.ts

@@ -0,0 +1,35 @@
+import Cookies from 'js-cookie';
+
+import getAllCookies from './getAllCookies';
+
+jest.mock('js-cookie', () => ({
+  __esModule: true,
+  default: {
+    get: jest.fn(),
+    set: jest.fn(),
+    remove: jest.fn(),
+  },
+}));
+
+describe('getAllCookies', () => {
+  it('deseralizes cookies of all types', () => {
+    const mockGet = Cookies.get as jest.MockedFunction<typeof Cookies.get>;
+    const value = {
+      region: 'DEFAULT',
+      consent: ['necessary', 'performance'],
+    };
+    const cookies = {
+      cm_default_preferences: JSON.stringify(value),
+      some_cookie: 'iamastring',
+      another_cookie: '5',
+      array_cookie: JSON.stringify(['item1', 'item2']),
+    };
+    mockGet.mockImplementation(jest.fn(() => cookies));
+    expect(getAllCookies({})).toEqual({
+      cm_default_preferences: value,
+      some_cookie: 'iamastring',
+      another_cookie: 5,
+      array_cookie: ['item1', 'item2'],
+    });
+  });
+});

package/src/utils/getAllCookies.ts

@@ -0,0 +1,68 @@
+import Cookies from 'js-cookie';
+
+export const deserializeCookies = (cookies: Record<string, string>) => {
+  const parsedCookies: Record<string, any> = {};
+
+  Object.keys(cookies).forEach((c) => {
+    try {
+      parsedCookies[c] = JSON.parse(cookies[c]);
+    } catch (e) {
+      parsedCookies[c] = cookies[c];
+    }
+  });
+  return parsedCookies;
+};
+
+export default function getAllCookies(initialCookies?: Record<string, string>) {
+  if (typeof window === 'undefined' && initialCookies) {
+    return deserializeCookies(initialCookies);
+  }
+  return deserializeCookies(Cookies.get() || {});
+}
+
+export function areRecordsEqual(
+  record1: Record<string, any>,
+  record2: Record<string, any>
+): boolean {
+  // Check if the number of keys is the same
+  const keys1 = Object.keys(record1);
+  const keys2 = Object.keys(record2);
+
+  if (keys1.length !== keys2.length) {
+    return false;
+  }
+
+  // Check if all keys and their values are equal
+  for (const key of keys1) {
+    if (!deepEqual(record1[key], record2[key])) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function deepEqual(value1: any, value2: any): boolean {
+  if (typeof value1 !== typeof value2) {
+    return false;
+  }
+
+  if (typeof value1 === 'object' && value1 !== null) {
+    const keys1 = Object.keys(value1);
+    const keys2 = Object.keys(value2);
+
+    if (keys1.length !== keys2.length) {
+      return false;
+    }
+
+    for (const key of keys1) {
+      if (!deepEqual(value1[key], value2[key])) {
+        return false;
+      }
+    }
+  } else if (value1 !== value2) {
+    return false;
+  }
+
+  return true;
+}

package/src/utils/getDefaultTrackingPreference.test.ts

@@ -0,0 +1,16 @@
+import config from '../examples/config';
+import { Region } from '../types';
+import getDefaultTrackingPreference from './getDefaultTrackingPreference';
+
+describe('getDefaultTrackingPreference', () => {
+  it('returns the correct default preferences', () => {
+    expect(getDefaultTrackingPreference(Region.DEFAULT, config)).toEqual({
+      region: Region.DEFAULT,
+      consent: ['necessary', 'performance', 'functional', 'targeting'],
+    });
+    expect(getDefaultTrackingPreference(Region.EU, config)).toEqual({
+      region: Region.EU,
+      consent: ['necessary'],
+    });
+  });
+});

package/src/utils/getDefaultTrackingPreference.ts

@@ -0,0 +1,28 @@
+import { Config, Region, TrackingCategory, TrackingPreference } from '../types';
+import isOptOut from './isOptOut';
+
+const getDefaultTrackingPreference = (region: Region, config: Config): TrackingPreference => {
+  // In opt in regions, we only allow required trackers
+
+  if (!isOptOut(region)) {
+    const categories = config.categories
+      .map((c) => {
+        if (c.required) {
+          return c.id;
+        }
+      })
+      .filter((c) => !!c) as TrackingCategory[];
+    return { region, consent: categories };
+  }
+
+  const categories = config.categories
+    .map((c) => c.id)
+    .filter((id) => id !== TrackingCategory.DELETE_IF_SEEN);
+
+  return {
+    region,
+    consent: categories,
+  };
+};
+
+export default getDefaultTrackingPreference;

package/src/utils/getDomain.test.ts

@@ -0,0 +1,16 @@
+import { getDomainWithoutSubdomain } from './getDomain';
+
+describe('getDomain', () => {
+  it('returns the correct domain', () => {
+    Object.defineProperty(window, 'location', {
+      value: { hostname: 'www.coinbase.com' },
+      writable: true,
+    });
+    expect(getDomainWithoutSubdomain()).toEqual('.coinbase.com');
+    window.location.hostname = 'pro.coinbase.com';
+    expect(getDomainWithoutSubdomain()).toEqual('.coinbase.com');
+    window.location.hostname = 'coinbase-dev.cbhq.net';
+
+    expect(getDomainWithoutSubdomain()).toEqual('.cbhq.net');
+  });
+});

package/src/utils/getDomain.ts

@@ -0,0 +1,19 @@
+export function getHostname(): string | undefined {
+  if (typeof window !== 'undefined') {
+    return window.location.hostname;
+  }
+}
+
+export function getDomainWithoutSubdomain(): string | undefined {
+  const hostname = getHostname();
+  if (!hostname) {
+    return;
+  }
+
+  if (hostname === 'localhost') {
+    return hostname;
+  }
+
+  const [, ...domain] = hostname.split('.');
+  return `.${domain.join('.')}`;
+}

package/src/utils/getTrackerCategory.test.ts

@@ -0,0 +1,34 @@
+import config from '../examples/config';
+import { TrackingCategory } from '../types';
+import getTrackerCategory from './getTrackerCategory';
+
+const exampleSimpleTrackers = {
+  locale: TrackingCategory.NECESSARY,
+  device_id: TrackingCategory.PERFORMANCE,
+  mode: TrackingCategory.FUNCTIONAL,
+  gclid: TrackingCategory.TARGETING,
+};
+
+const exampleDynamicTrackers = {
+  'idundefined.com': TrackingCategory.TARGETING,
+  id_ac7a5c3da45e3612b44543a702e42b01: TrackingCategory.TARGETING,
+  id_132e62b5953ce8d568137d5887b6b7ab_classic: TrackingCategory.TARGETING,
+  id_ac7a5c3da45e3612b44543a702e42b01_classic: TrackingCategory.TARGETING,
+  id_5e21e8a10d7c1553bc75ce1ff6d49a3f_realtime: TrackingCategory.TARGETING,
+  id_4031eff2d750cfe4385594be339acc56_realtime: TrackingCategory.TARGETING,
+  'id_4031eff2d750cfe4385594be339acc56_realtimecoinbase.com': TrackingCategory.TARGETING,
+  'id_132e62b5953ce8d568137d5887b6b7abcoinbase.com': TrackingCategory.TARGETING,
+};
+
+describe('getTrackerCategory', () => {
+  it('matches simple trackers via id', () => {
+    for (const [tracker, categoryId] of Object.entries(exampleSimpleTrackers)) {
+      expect(getTrackerCategory(tracker, config)?.id).toEqual(categoryId);
+    }
+  });
+  it('matches dynamic trackers not matching ids via regex', () => {
+    for (const [tracker, categoryId] of Object.entries(exampleDynamicTrackers)) {
+      expect(getTrackerCategory(tracker, config)?.id).toEqual(categoryId);
+    }
+  });
+});

package/src/utils/getTrackerCategory.ts

@@ -0,0 +1,11 @@
+import { Config, ConfigCategoryInfo } from '../types';
+import trackerMatches from './trackerMatches';
+
+const getTrackerCategory = (trackerId: string, config: Config): ConfigCategoryInfo | undefined => {
+  const category = config.categories.find((category) =>
+    category.trackers.find((tracker) => trackerMatches(tracker, trackerId))
+  );
+  return category;
+};
+
+export default getTrackerCategory;

package/src/utils/getTrackerInfo.test.ts

@@ -0,0 +1,11 @@
+import config from '../examples/config';
+import getTrackerInfo from './getTrackerInfo';
+
+describe('getTrackerInfo', () => {
+  it('should return undefined if tracker is not found', () => {
+    expect(getTrackerInfo('unknown', config)).toBeUndefined();
+  });
+  it('should return tracker info if tracker is found', () => {
+    expect(getTrackerInfo('locale', config)).toEqual({ id: 'locale', type: 'cookie' });
+  });
+});

package/src/utils/getTrackerInfo.ts

@@ -0,0 +1,10 @@
+import { Config } from '../types';
+import getTrackerCategory from './getTrackerCategory';
+import trackerMatches from './trackerMatches';
+
+const getTrackerInfo = (trackerId: string, config: Config) => {
+  const trackingCategory = getTrackerCategory(trackerId, config);
+  return trackingCategory?.trackers.find((tracker) => trackerMatches(tracker, trackerId));
+};
+
+export default getTrackerInfo;

package/src/utils/hasConsent.test.ts

@@ -0,0 +1,64 @@
+import { REQUIRED_COOKIE_MANAGER_COOKIES } from '../constants';
+import config from '../examples/config';
+import { Region, TrackingCategory, TrackingPreference } from '../types';
+import hasConsent from './hasConsent';
+
+describe('hasConsent', () => {
+  let preference: TrackingPreference;
+  beforeEach(() => {
+    preference = {
+      region: Region.DEFAULT,
+      consent: [
+        TrackingCategory.NECESSARY,
+        TrackingCategory.PERFORMANCE,
+        TrackingCategory.FUNCTIONAL,
+        TrackingCategory.TARGETING,
+      ],
+    };
+  });
+
+  it('defaults to false if cookie is uncategorized', () => {
+    expect(hasConsent('random_cookie', config, preference)).toEqual(false);
+  });
+
+  it('returns true for required cookie', () => {
+    preference = {
+      region: Region.DEFAULT,
+      consent: [TrackingCategory.PERFORMANCE],
+    };
+
+    expect(hasConsent('logged_in', config, preference)).toEqual(true);
+  });
+
+  it('returns true for cookies that are required to function', () => {
+    preference = {
+      region: Region.DEFAULT,
+      consent: [TrackingCategory.PERFORMANCE],
+    };
+    REQUIRED_COOKIE_MANAGER_COOKIES.map((c) => {
+      expect(hasConsent(c, config, preference)).toEqual(true);
+    });
+  });
+
+  it('returns the correct consent', () => {
+    preference = {
+      region: Region.DEFAULT,
+      consent: [TrackingCategory.PERFORMANCE],
+    };
+    // Default
+    expect(hasConsent('device_id', config, preference)).toEqual(true);
+    expect(hasConsent('locale', config, preference)).toEqual(true);
+
+    // EU
+    preference = {
+      region: Region.EU,
+      consent: [TrackingCategory.PERFORMANCE],
+    };
+    expect(hasConsent('device_id', config, preference)).toEqual(true);
+    preference = {
+      region: Region.EU,
+      consent: [TrackingCategory.FUNCTIONAL],
+    };
+    expect(hasConsent('g_clid', config, preference)).toEqual(false);
+  });
+});

package/src/utils/hasConsent.ts

@@ -0,0 +1,32 @@
+import { REQUIRED_COOKIE_MANAGER_COOKIES } from '../constants';
+import { Config, TrackingPreference } from '../types';
+import getTrackerCategory from './getTrackerCategory';
+
+/**
+ * Used for determining if a specific tracker has user consent.
+ * It follows the following logic in order:
+ * 1) If we don't have a tracker category in the config then dont allow
+ * 2) If cookie is in a required category then allow
+ * 3) If cookie is required for cookie manager to function then allow
+ * 4) Determine consent from user consent preferences
+ */
+const hasConsent = (
+  tracker: string,
+  config: Config,
+  trackingPreference: TrackingPreference
+): boolean => {
+  const trackingCategory = getTrackerCategory(tracker, config);
+
+  if (REQUIRED_COOKIE_MANAGER_COOKIES.includes(tracker)) {
+    return true;
+  }
+  if (!trackingCategory) {
+    return false;
+  }
+  if (trackingCategory.required) {
+    return true;
+  }
+  return trackingPreference.consent.includes(trackingCategory.id);
+};
+
+export default hasConsent;

package/src/utils/isMaxKBSize.test.ts

@@ -0,0 +1,10 @@
+import isMaxKBSize from './isMaxKBSize';
+
+describe('isMaxKBSize', () => {
+  it('returns true when string exceeds max kb size', () => {
+    expect(isMaxKBSize('helloooooooo', 0.01)).toEqual(true);
+  });
+  it('returns false when string does not max kb size', () => {
+    expect(isMaxKBSize('hello', 0.01)).toEqual(false);
+  });
+});

package/src/utils/isMaxKBSize.ts

@@ -0,0 +1,7 @@
+import { KB } from '../constants';
+
+const isMaxKBSize = (str: string, max: number) => {
+  return Buffer.from(str).length / KB > max;
+};
+
+export default isMaxKBSize;

package/src/utils/isOptOut.test.ts

@@ -0,0 +1,14 @@
+import { Region } from '../types';
+import isOptOut from './isOptOut';
+
+describe('isOptOut', () => {
+  it('uses default rule if there is no rule for a region', () => {
+    // @ts-expect-error we are deliberately passing a wrong value
+    expect(isOptOut('US')).toEqual(true);
+  });
+
+  it('returns the correct value', () => {
+    expect(isOptOut(Region.EU)).toEqual(false);
+    expect(isOptOut(Region.DEFAULT)).toEqual(true);
+  });
+});

package/src/utils/isOptOut.ts

@@ -0,0 +1,28 @@
+import { GEOLOCATION_RULES } from '../constants';
+import { Framework, Region } from '../types';
+
+/**
+ * Used for determining the if current region is using the optOut framework
+ * It follows the following logic in order:
+ * 1) If there's no geolocation rule for the specified region
+ *  then use the rule for DEFAULT region
+ *  - Otherwise use the DEFAULT_FRAMEWORK
+ * 2) Use geolocation rule
+ */
+
+/**
+ * optIn: Users must opt in to tracking (EU)
+ * optOut: Users must opt out of tracking (non-EU)
+ * We use the most restrictive framework (optIn) if we don't know the framework
+ */
+
+const isOptOut = (region: Region) => {
+  const rule = GEOLOCATION_RULES.find((r) => r.region === region);
+
+  if (!rule) {
+    return true;
+  }
+  return rule.framework === Framework.OPT_OUT;
+};
+
+export default isOptOut;