Flipp: abide by privacy concerns when using flippExt userKey

adapters/flipp/flipp.go

@@ -7,6 +7,7 @@ import (
 	"net/url"
 	"strings"
 
+	"github.com/SirDataFR/iabtcfv2"
 	"github.com/buger/jsonparser"
 	"github.com/gofrs/uuid"
 	"github.com/prebid/openrtb/v19/openrtb2"
@@ -123,7 +124,7 @@ func (a *adapter) processImp(request *openrtb2.BidRequest, imp openrtb2.Imp) (*a
 	var userKey string
 	if request.User != nil && request.User.ID != "" {
 		userKey = request.User.ID
-	} else if flippExtParams.UserKey != "" {
+	} else if flippExtParams.UserKey != "" && paramsUserKeyPermitted(request) {
 		userKey = flippExtParams.UserKey
 	} else {
 		uid, err := uuid.NewV4()
@@ -223,3 +224,35 @@ func buildBid(decision *InlineModel, impId string) *openrtb2.Bid {
 	}
 	return bid
 }
+
+func paramsUserKeyPermitted(request *openrtb2.BidRequest) bool {
+	if request.Regs != nil {
+		if request.Regs.COPPA == 1 {
+			return false
+		}
+		if request.Regs.GDPR != nil && *request.Regs.GDPR == 1 {
+			return false
+		}
+	}
+	if request.Ext != nil {
+		var extData struct {
+			TransmitEids bool `json:"transmitEids"`
+		}
+		if err := json.Unmarshal(request.Ext, &extData); err == nil {
+			if !extData.TransmitEids {
+				return false
+			}
+		}
+	}
+	if request.User != nil && request.User.Consent != "" {
+		tcModel, err := iabtcfv2.Decode(request.User.Consent)
+		if err != nil {
+			fmt.Printf("%v", err)
+			return true
+		}
+		if !tcModel.IsPurposeAllowed(4) {
+			return false
+		}
+	}
+	return true
+}

adapters/flipp/flipp_test.go

@@ -1,11 +1,17 @@
 package flipp
 
 import (
+	"encoding/json"
 	"testing"
+	"time"
 
+	"github.com/SirDataFR/iabtcfv2"
+	"github.com/aws/smithy-go/ptr"
+	"github.com/prebid/openrtb/v19/openrtb2"
 	"github.com/prebid/prebid-server/v2/adapters/adapterstest"
 	"github.com/prebid/prebid-server/v2/config"
 	"github.com/prebid/prebid-server/v2/openrtb_ext"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestJsonSamples(t *testing.T) {
@@ -19,3 +25,76 @@ func TestJsonSamples(t *testing.T) {
 
 	adapterstest.RunJSONBidderTest(t, "flipptest", bidder)
 }
+
+func TestParamsUserKeyPermitted(t *testing.T) {
+
+	t.Run("Coppa is in effect", func(t *testing.T) {
+		request := &openrtb2.BidRequest{
+			Regs: &openrtb2.Regs{
+				COPPA: 1,
+			},
+		}
+		result := paramsUserKeyPermitted(request)
+		assert.New(t)
+		assert.False(t, result, "param user key not permitted because coppa is in effect")
+	})
+	t.Run("The Global Privacy Control is set", func(t *testing.T) {
+		request := &openrtb2.BidRequest{
+			Regs: &openrtb2.Regs{
+				GDPR: ptr.Int8(1),
+			},
+		}
+		result := paramsUserKeyPermitted(request)
+		assert.New(t)
+		assert.False(t, result, "param user key not permitted because Global Privacy Control is set")
+	})
+	t.Run("TCF purpose 4 is in scope and doesn't have consent", func(t *testing.T) {
+		tcData := &iabtcfv2.TCData{
+			CoreString: &iabtcfv2.CoreString{
+				PublisherCC:       "test",
+				Version:           2,
+				Created:           time.Now(),
+				LastUpdated:       time.Now(),
+				CmpId:             92,
+				CmpVersion:        1,
+				ConsentScreen:     1,
+				ConsentLanguage:   "EN",
+				VendorListVersion: 32,
+				TcfPolicyVersion:  2,
+				PurposesConsent: map[int]bool{
+					1: true,
+					2: true,
+					3: true,
+				},
+			},
+		}
+		segmentValue := tcData.CoreString.Encode()
+		user := &openrtb2.User{
+			Consent: segmentValue,
+		}
+		request := &openrtb2.BidRequest{
+			User: user,
+		}
+		result := paramsUserKeyPermitted(request)
+		assert.New(t)
+		assert.False(t, result, "param user key not permitted because TCF purpose 4 is in scope and doesn't have consent")
+	})
+	t.Run("The Prebid transmitEids activity is disallowed", func(t *testing.T) {
+		extData := struct {
+			TransmitEids bool `json:"transmitEids"`
+		}{
+			TransmitEids: false,
+		}
+		ext, err := json.Marshal(extData)
+		if err != nil {
+			t.Fatalf("failed to marshal ext data: %v", err)
+		}
+		request := &openrtb2.BidRequest{
+			Ext: ext,
+		}
+
+		result := paramsUserKeyPermitted(request)
+		assert.New(t)
+		assert.False(t, result, "param user key not permitted because Prebid transmitEids activity is disallowed")
+	})
+}

go.mod

@@ -39,6 +39,8 @@ require (
 )
 
 require (
+	github.com/SirDataFR/iabtcfv2 v1.2.0 // indirect
+	github.com/aws/smithy-go v1.15.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect

go.sum

@@ -59,6 +59,8 @@ github.com/IABTechLab/adscert v0.34.0/go.mod h1:pCLd3Up1kfTrH6kYFUGGeavxIc1f6Tvv
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
 github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/SirDataFR/iabtcfv2 v1.2.0 h1:IMVoOYqoAdZanTHDznjyM1Yf7P9P8orviFM9ESfXxpU=
+github.com/SirDataFR/iabtcfv2 v1.2.0/go.mod h1:wBEfrSz6AcFCRtxRSGPj8XB4Ut4ntjkM32zV4V/byTk=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -73,6 +75,8 @@ github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgI
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.36.29/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
+github.com/aws/smithy-go v1.15.0 h1:PS/durmlzvAFpQHDs4wi4sNNP9ExsqZh6IlfdHXgKK8=
+github.com/aws/smithy-go v1.15.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/benbjohnson/clock v1.3.0 h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A=
 github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -210,6 +214,7 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=