prebid.js 8.5.0 → 8.6.0

package/libraries/mspa/activityControls.js

@@ -8,7 +8,13 @@ import {
 import {gppDataHandler} from '../../src/adapterManager.js';
 
 // default interpretation for MSPA consent(s):
-// https://docs.google.com/document/d/1yPEVx3bBdSkIw-QNkQR5qi1ztmn9zoXk-LaGQB6iw7Q
+// https://docs.prebid.org/features/mspa-usnat.html
+
+const SENSITIVE_DATA_GEO = 7;
+
+function isApplicable(val) {
+  return val != null && val !== 0
+}
 
 export function isBasicConsentDenied(cd) {
   // service provider mode is always consent denied
@@ -18,47 +24,60 @@ export function isBasicConsentDenied(cd) {
     // minors 13+ who have not given consent
     cd.KnownChildSensitiveDataConsents[0] === 1 ||
     // minors under 13 cannot consent
-    cd.KnownChildSensitiveDataConsents[1] !== 0 ||
-    // sensitive category consent impossible without notice
-    (cd.SensitiveDataProcessing.some(element => element === 2) && (cd.SensitiveDataLimitUseNotice !== 1 || cd.SensitiveDataProcessingOptOutNotice !== 1));
+    isApplicable(cd.KnownChildSensitiveDataConsents[1]);
 }
 
-export function isSensitiveNoticeMissing(cd) {
-  return ['SensitiveDataProcessingOptOutNotice', 'SensitiveDataLimitUseNotice'].some(prop => cd[prop] === 2)
+export function sensitiveNoticeIs(cd, value) {
+  return ['SensitiveDataProcessingOptOutNotice', 'SensitiveDataLimitUseNotice'].some(prop => cd[prop] === value)
 }
 
 export function isConsentDenied(cd) {
   return isBasicConsentDenied(cd) ||
-    // user opts out
-    (['SaleOptOut', 'SharingOptOut', 'TargetedAdvertisingOptOut'].some(prop => cd[prop] === 1)) ||
-    // notice not given
-    (['SaleOptOutNotice', 'SharingNotice', 'SharingOptOutNotice', 'TargetedAdvertisingOptOutNotice'].some(prop => cd[prop] === 2)) ||
-    // sale opted in but notice does not apply
-    ((cd.SaleOptOut === 2 && cd.SaleOptOutNotice === 0)) ||
-    // targeted opted in but notice does not apply
-    ((cd.TargetedAdvertisingOptOut === 2 && cd.TargetedAdvertisingOptOutNotice === 0)) ||
-    // sharing opted in but notices do not apply
-    ((cd.SharingOptOut === 2 && (cd.SharingNotice === 0 || cd.SharingOptOutNotice === 0)));
+    ['Sale', 'Sharing', 'TargetedAdvertising'].some(scope => {
+      const oo = cd[`${scope}OptOut`];
+      const notice = cd[`${scope}OptOutNotice`];
+      // user opted out
+      return oo === 1 ||
+      // opt-out notice was not given
+        notice === 2 ||
+      // do not trust CMP if it signals opt-in but no opt-out notice was given
+        (oo === 2 && notice === 0);
+    }) ||
+    // no sharing notice was given ...
+    cd.SharingNotice === 2 ||
+    // ... or the CMP says it was not applicable, while also claiming it got consent
+    (cd.SharingOptOut === 2 && cd.SharingNotice === 0);
 }
 
-export function isTransmitUfpdConsentDenied(cd) {
-  // SensitiveDataProcessing[1-5,11]=1 OR SensitiveDataProcessing[6,7,9,10,12]<>0 OR
-  const mustBeZero = [6, 7, 9, 10, 12];
-  const mustBeZeroSubtractedVector = mustBeZero.map((number) => number - 1);
-  const SensitiveDataProcessingMustBeZero = cd.SensitiveDataProcessing.filter(index => mustBeZeroSubtractedVector.includes(index));
-  const cannotBeOne = [1, 2, 3, 4, 5, 11];
-  const cannotBeOneSubtractedVector = cannotBeOne.map((number) => number - 1);
-  const SensitiveDataProcessingCannotBeOne = cd.SensitiveDataProcessing.filter(index => cannotBeOneSubtractedVector.includes(index));
-  return isConsentDenied(cd) ||
-    isSensitiveNoticeMissing(cd) ||
-    SensitiveDataProcessingCannotBeOne.some(val => val === 1) ||
-    SensitiveDataProcessingMustBeZero.some(val => val !== 0);
-}
+export const isTransmitUfpdConsentDenied = (() => {
+  // deny anything that smells like: genetic, biometric, state/national ID, financial, union membership,
+  // or personal communication data
+  const cannotBeInScope = [6, 7, 9, 10, 12].map(el => --el);
+  // require consent for everything else (except geo, which is treated separately)
+  const allExceptGeo = Array.from(Array(12).keys()).filter((el) => el !== SENSITIVE_DATA_GEO)
+  const mustHaveConsent = allExceptGeo.filter(el => !cannotBeInScope.includes(el));
+
+  return function (cd) {
+    return isConsentDenied(cd) ||
+      // no notice about sensitive data was given
+      sensitiveNoticeIs(cd, 2) ||
+      // extra-sensitive data is applicable
+      cannotBeInScope.some(i => isApplicable(cd.SensitiveDataProcessing[i])) ||
+      // user opted out for not-as-sensitive data
+      mustHaveConsent.some(i => cd.SensitiveDataProcessing[i] === 1) ||
+      // CMP says it has consent, but did not give notice about it
+      (sensitiveNoticeIs(cd, 0) && allExceptGeo.some(i => cd.SensitiveDataProcessing[i] === 2))
+  }
+})();
 
 export function isTransmitGeoConsentDenied(cd) {
-  return isBasicConsentDenied(cd) ||
-    isSensitiveNoticeMissing(cd) ||
-    cd.SensitiveDataProcessing[7] === 1
+  const geoConsent = cd.SensitiveDataProcessing[SENSITIVE_DATA_GEO];
+  return geoConsent === 1 ||
+    isBasicConsentDenied(cd) ||
+    // no sensitive data notice was given
+    sensitiveNoticeIs(cd, 2) ||
+    // do not trust CMP if it says it has consent for geo but didn't show a sensitive data notice
+    (sensitiveNoticeIs(cd, 0) && geoConsent === 2)
 }
 
 const CONSENT_RULES = {

package/modules/adgenerationBidAdapter.js

@@ -28,7 +28,7 @@ export const spec = {
   buildRequests: function (validBidRequests, bidderRequest) {
     // convert Native ORTB definition to old-style prebid native definition
     validBidRequests = convertOrtbRequestToProprietaryNative(validBidRequests);
-    const ADGENE_PREBID_VERSION = '1.6.0';
+    const ADGENE_PREBID_VERSION = '1.6.1';
     let serverRequests = [];
     for (let i = 0, len = validBidRequests.length; i < len; i++) {
       const validReq = validBidRequests[i];
@@ -59,9 +59,9 @@ export const spec = {
       data = tryAppendQueryString(data, 'adgext_id5_id_link_type', id5LinkType);
       data = tryAppendQueryString(data, 'adgext_imuid', imuid);
       data = tryAppendQueryString(data, 'adgext_uid2', validReq.userId ? validReq.userId.uid2 : null);
-      data = tryAppendQueryString(data, 'gpid', gpid ? encodeURIComponent(gpid) : null);
+      data = tryAppendQueryString(data, 'gpid', gpid || null);
       data = tryAppendQueryString(data, 'uach', sua ? JSON.stringify(sua) : null);
-      data = tryAppendQueryString(data, 'schain', validReq.schain ? encodeURIComponent(JSON.stringify(validReq.schain)) : null);
+      data = tryAppendQueryString(data, 'schain', validReq.schain ? JSON.stringify(validReq.schain) : null);
 
       // native以外にvideo等の対応が入った場合は要修正
       if (!validReq.mediaTypes || !validReq.mediaTypes.native) {

package/modules/adsinteractiveBidAdapter.js

@@ -6,8 +6,8 @@ import { registerBidder } from '../src/adapters/bidderFactory.js';
 import { BANNER } from '../src/mediaTypes.js';
 
 const ADSINTERACTIVE_CODE = 'adsinteractive';
-const USER_SYNC_URL_IMAGE = 'https://pb.adsinteractive.com/img';
-const USER_SYNC_URL_IFRAME = 'https://pb.adsinteractive.com/sync';
+const USER_SYNC_URL_IMAGE = 'https://sync.adsinteractive.com/img';
+const USER_SYNC_URL_IFRAME = 'https://sync.adsinteractive.com/sync';
 
 export const spec = {
   code: ADSINTERACTIVE_CODE,

package/modules/appnexusBidAdapter.js

@@ -788,7 +788,7 @@ function bidToTag(bid) {
     tag.keywords = auKeywords;
   }
 
-  let gpid = deepAccess(bid, 'ortb2Imp.ext.data.pbadslot');
+  let gpid = deepAccess(bid, 'ortb2Imp.ext.gpid') || deepAccess(bid, 'ortb2Imp.ext.data.pbadslot');
   if (gpid) {
     tag.gpid = gpid;
   }

package/modules/criteoBidAdapter.js

@@ -10,6 +10,7 @@ import { getRefererInfo } from '../src/refererDetection.js';
 import { hasPurpose1Consent } from '../src/utils/gpdr.js';
 import { Renderer } from '../src/Renderer.js';
 import { OUTSTREAM } from '../src/video.js';
+import { ajax } from '../src/ajax.js';
 
 const GVLID = 91;
 export const ADAPTER_VERSION = 36;
@@ -306,6 +307,23 @@ export const spec = {
       adapter.handleSetTargeting(bid);
     }
   },
+
+  /**
+   * @param {BidRequest[]} bidRequests
+   */
+  onDataDeletionRequest: (bidRequests) => {
+    const id = readFromAllStorages(BUNDLE_COOKIE_NAME);
+    if (id) {
+      deleteFromAllStorages(BUNDLE_COOKIE_NAME);
+    }
+    ajax('https://privacy.criteo.com/api/privacy/datadeletionrequest',
+      null,
+      JSON.stringify({ publisherUserId: id }),
+      {
+        contentType: 'application/json',
+        method: 'POST'
+      });
+  }
 };
 
 function readFromAllStorages(name) {

package/modules/cwireBidAdapter.js

@@ -2,6 +2,7 @@ import {registerBidder} from '../src/adapters/bidderFactory.js';
 import {getStorageManager} from '../src/storageManager.js';
 import {BANNER} from '../src/mediaTypes.js';
 import {generateUUID, getParameterByName, isNumber, logError, logInfo} from '../src/utils.js';
+import {hasPurpose1Consent} from '../src/utils/gpdr.js';
 
 // ------------------------------------
 const BIDDER_CODE = 'cwire';
@@ -230,5 +231,23 @@ export const spec = {
     navigator.sendBeacon(EVENT_ENDPOINT, JSON.stringify(event))
   },
 
+  getUserSyncs: function(syncOptions, serverResponses, gdprConsent, uspConsent) {
+    logInfo('Collecting user-syncs: ', JSON.stringify({syncOptions, gdprConsent, uspConsent, serverResponses}));
+
+    const syncs = []
+    if (hasPurpose1Consent(gdprConsent)) {
+      logInfo('GDPR purpose 1 consent was given, adding user-syncs')
+      let type = (syncOptions.pixelEnabled) ? 'image' : null ?? (syncOptions.iframeEnabled) ? 'iframe' : null
+      if (type) {
+        syncs.push({
+          type: type,
+          url: 'https://ib.adnxs.com/getuid?https://prebid.cwi.re/v1/cookiesync?xandrId=$UID'
+        })
+      }
+    }
+    logInfo('Collected user-syncs: ', JSON.stringify({syncs}))
+    return syncs
+  }
+
 };
 registerBidder(spec);

package/modules/growthCodeAnalyticsAdapter.js

@@ -30,8 +30,8 @@ let bidRequestTimeout = 0;
 let analyticsType = 'endpoint';
 
 let growthCodeAnalyticsAdapter = Object.assign(adapter({url: url, analyticsType}), {
-  track({eventType, eventData}) {
-    eventData = eventData ? JSON.parse(JSON.stringify(eventData)) : {};
+  track({eventType, args}) {
+    let eventData = args ? JSON.parse(JSON.stringify(args)) : {};
     let data = {};
     if (!trackEvents.includes(eventType)) return;
     switch (eventType) {
@@ -98,6 +98,11 @@ let growthCodeAnalyticsAdapter = Object.assign(adapter({url: url, analyticsType}
         break;
       }
 
+      case CONSTANTS.EVENTS.NO_BID: {
+        data = eventData
+        break;
+      }
+
       default:
         return;
     }

package/modules/newspassid.md

@@ -0,0 +1,76 @@
+---
+Module Name: NewspassId Bidder Adapter
+Module Type: Bidder Adapter
+Maintainer: techsupport@newspassid.com
+layout: bidder
+title: Newspass ID
+description: LMC Newspass ID Prebid JS Bidder Adapter
+biddercode: newspassid
+gdpr_supported: false
+gvl_id: none
+usp_supported: true
+coppa_supported: false
+schain_supported: true
+dchain_supported: false
+userIds: criteo, id5Id, tdid, identityLink, liveIntentId, parrableId, pubCommonId, lotamePanoramaId, sharedId, fabrickId
+media_types: banner
+safeframes_ok: true
+deals_supported: true
+floors_supported: false
+fpd_supported: false
+pbjs: true
+pbs: false
+prebid_member: false
+multiformat_supported: will-bid-on-any
+---
+
+### Description
+
+LMC Newspass ID Prebid JS Bidder Adapter that connects to the NewspassId demand source(s).
+
+The Newspass bid adapter supports Banner mediaTypes ONLY.
+This is intended for USA audiences only, and does not support GDPR
+
+
+### Bid Params
+
+{: .table .table-bordered .table-striped }
+
+| Name      | Scope    | Description               | Example    | Type     |
+|-----------|----------|---------------------------|------------|----------|
+| `siteId`    | required | The site ID.  		   | `"NPID0000001"` | `string` |
+| `publisherId`    | required | The publisher ID.  | `"4204204201"` | `string` |
+| `placementId`    | required | The placement ID.  | `"0420420421"` | `string` |
+| `customData`     | optional | publisher key-values used for targeting | `[{"settings":{},"targeting":{"key1": "value1", "key2": "value2"}}], ` | `array` |
+ 
+### Test Parameters
+
+
+A test ad unit that will consistently return test creatives:
+
+```
+
+//Banner adUnit
+
+adUnits = [{
+                    code: 'id-of-your-banner-div',
+			        mediaTypes: {
+			          banner: {
+			            sizes: [[300, 250], [300,600]]
+			          }
+			        },
+                    bids: [{
+                        bidder: 'newspassid',
+                        params: {
+                            publisherId: 'NEWSPASS0001', /* an ID to identify the publisher account  - required */
+                            siteId: '4204204201', /* An ID used to identify a site within a publisher account - required */
+                            placementId: '8000000015', /* an ID used to identify the piece of inventory - required - for appnexus test use 13144370. */
+							customData: [{"settings": {}, "targeting": {"key": "value", "key2": ["value1", "value2"]}}],/* optional array with 'targeting' placeholder for passing publisher specific key-values for targeting. */                            
+                        }
+                    }]
+                }];
+```
+
+### Note:
+
+Please contact us at techsupport@newspassid.com for any assistance testing your implementation before going live into production.

package/modules/newspassidBidAdapter.js

@@ -1,15 +1,24 @@
-import {contains, deepAccess, deepSetValue, isArray, logError, logInfo, logWarn, parseUrl} from '../src/utils.js';
-import {registerBidder} from '../src/adapters/bidderFactory.js';
-import {BANNER, NATIVE} from '../src/mediaTypes.js';
+import {
+  logInfo,
+  logError,
+  deepAccess,
+  logWarn,
+  deepSetValue,
+  isArray,
+  contains,
+  parseUrl,
+  generateUUID
+} from '../src/utils.js';
+import { registerBidder } from '../src/adapters/bidderFactory.js';
+import { BANNER, NATIVE } from '../src/mediaTypes.js';
 import {config} from '../src/config.js';
 import {getPriceBucketString} from '../src/cpmBucketManager.js';
 import {getRefererInfo} from '../src/refererDetection.js';
-
 const BIDDER_CODE = 'newspassid';
 const ORIGIN = 'https://bidder.newspassid.com' // applies only to auction & cookie
 const AUCTIONURI = '/openrtb2/auction';
 const NEWSPASSCOOKIESYNC = '/static/load-cookie.html';
-const NEWSPASSVERSION = '1.0.1';
+const NEWSPASSVERSION = '1.1.4';
 export const spec = {
   version: NEWSPASSVERSION,
   code: BIDDER_CODE,
@@ -155,7 +164,7 @@ export const spec = {
       let placementId = placementIdOverrideFromGetParam || this.getPlacementId(npBidRequest); // prefer to use a valid override param, else the bidRequest placement Id
       obj.id = npBidRequest.bidId; // this causes an error if we change it to something else, even if you update the bidRequest object: "WARNING: Bidder newspass made bid for unknown request ID: mb7953.859498327448. Ignoring."
       obj.tagid = placementId;
-      let parsed = parseUrl(getRefererInfo().page);
+      let parsed = parseUrl(this.getRefererInfo().page);
       obj.secure = parsed.protocol === 'https' ? 1 : 0;
       let arrBannerSizes = [];
       if (!npBidRequest.hasOwnProperty('mediaTypes')) {
@@ -189,7 +198,6 @@ export const spec = {
       deepSetValue(obj, 'ext.prebid', {'storedrequest': {'id': placementId}});
       obj.ext['newspassid'] = {};
       obj.ext['newspassid'].adUnitCode = npBidRequest.adUnitCode; // eg. 'mpu'
-      obj.ext['newspassid'].transactionId = npBidRequest.transactionId; // this is the transactionId PER adUnit, common across bidders for this unit
       if (npBidRequest.params.hasOwnProperty('customData')) {
         obj.ext['newspassid'].customData = npBidRequest.params.customData;
       }
@@ -216,6 +224,10 @@ export const spec = {
       if (!schain && deepAccess(npBidRequest, 'schain')) {
         schain = npBidRequest.schain;
       }
+      let gpid = deepAccess(npBidRequest, 'ortb2Imp.ext.gpid');
+      if (gpid) {
+        deepSetValue(obj, 'ext.gpid', gpid);
+      }
       return obj;
     });
     let extObj = {};
@@ -240,7 +252,7 @@ export const spec = {
     let userExtEids = deepAccess(validBidRequests, '0.userIdAsEids', []); // generate the UserIDs in the correct format for UserId module
     npRequest.site = {
       'publisher': {'id': htmlParams.publisherId},
-      'page': getRefererInfo().page,
+      'page': this.getRefererInfo().page,
       'id': htmlParams.siteId
     };
     npRequest.test = config.getConfig('debug') ? 1 : 0;
@@ -259,12 +271,9 @@ export const spec = {
     }
     if (singleRequest) {
       logInfo('buildRequests starting to generate response for a single request');
-      // TODO: fix auctionId & transactionId leak: https://github.com/prebid/Prebid.js/issues/9781
-      npRequest.id = bidderRequest.auctionId; // Unique ID of the bid request, provided by the exchange.
-      npRequest.auctionId = bidderRequest.auctionId; // not sure if this should be here?
+      npRequest.id = generateUUID(); // Unique ID of the bid request, provided by the exchange. (REQUIRED)
       npRequest.imp = tosendtags;
       npRequest.ext = extObj;
-      deepSetValue(npRequest, 'source.tid', bidderRequest.auctionId);// RTB 2.5 : tid is Transaction ID that must be common across all participants in this bid request (e.g., potentially multiple exchanges).
       deepSetValue(npRequest, 'user.ext.eids', userExtEids);
       var ret = {
         method: 'POST',
@@ -280,12 +289,9 @@ export const spec = {
     let arrRet = tosendtags.map(imp => {
       logInfo('buildRequests starting to generate non-single response, working on imp : ', imp);
       let npRequestSingle = Object.assign({}, npRequest);
-      imp.ext['newspassid'].pageAuctionId = bidderRequest['auctionId']; // make a note in the ext object of what the original auctionId was, in the bidderRequest object
-      npRequestSingle.id = imp.ext['newspassid'].transactionId; // Unique ID of the bid request, provided by the exchange.
-      npRequestSingle.auctionId = imp.ext['newspassid'].transactionId; // not sure if this should be here?
+      npRequestSingle.id = generateUUID();
       npRequestSingle.imp = [imp];
       npRequestSingle.ext = extObj;
-      deepSetValue(npRequestSingle, 'source.tid', bidderRequest.auctionId);// RTB 2.5 : tid is Transaction ID that must be common across all participants in this bid request (e.g., potentially multiple exchanges).
       deepSetValue(npRequestSingle, 'user.ext.eids', userExtEids);
       logInfo('buildRequests RequestSingle (for non-single) = ', npRequestSingle);
       return {
@@ -305,6 +311,7 @@ export const spec = {
     logInfo(`interpretResponse time: ${startTime}. buildRequests done -> interpretResponse start was ${startTime - this.propertyBag.buildRequestsEnd}ms`);
     logInfo(`serverResponse, request`, JSON.parse(JSON.stringify(serverResponse)), JSON.parse(JSON.stringify(request)));
     serverResponse = serverResponse.body || {};
+    let aucId = serverResponse.id; // this will be correct for single requests and non-single
     if (!serverResponse.hasOwnProperty('seatbid')) {
       return [];
     }
@@ -351,7 +358,7 @@ export const spec = {
           logInfo(`newspassid.enhancedAdserverTargeting is set to false, no per-bid keys will be sent to adserver.`);
         }
         let {seat: winningSeat, bid: winningBid} = this.getWinnerForRequestBid(thisBid.bidId, serverResponse.seatbid);
-        adserverTargeting['np_auc_id'] = String(request.bidderRequest.auctionId);
+        adserverTargeting['np_auc_id'] = String(aucId);
         adserverTargeting['np_winner'] = String(winningSeat);
         adserverTargeting['np_bid'] = 'true';
         if (enhancedAdserverTargeting) {
@@ -490,10 +497,29 @@ export const spec = {
     return null;
   },
   getGetParametersAsObject() {
-    let parsed = parseUrl(getRefererInfo().page);
+    let parsed = parseUrl(this.getRefererInfo().location); // was getRefererInfo().page but this is not backwards compatible
     logInfo('getGetParametersAsObject found:', parsed.search);
     return parsed.search;
   },
+  getRefererInfo() {
+    if (getRefererInfo().hasOwnProperty('location')) {
+      logInfo('FOUND location on getRefererInfo OK (prebid >= 7); will use getRefererInfo for location & page');
+      return getRefererInfo();
+    } else {
+      logInfo('DID NOT FIND location on getRefererInfo (prebid < 7); will use legacy code that ALWAYS worked reliably to get location & page ;-)');
+      try {
+        return {
+          page: top.location.href,
+          location: top.location.href
+        };
+      } catch (e) {
+        return {
+          page: window.location.href,
+          location: window.location.href
+        };
+      }
+    }
+  },
   blockTheRequest() {
     let npRequest = config.getConfig('newspassid.np_request');
     if (typeof npRequest == 'boolean' && !npRequest) {