uid2: add refreshUid2Token protocol client - #328
Conversation
PRODUCT-3938
| const cryptoKey = await crypto.subtle.importKey("raw", keyBytes, { name: "AES-GCM" }, false, ["decrypt"]); | ||
| const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv: nonce }, cryptoKey, ciphertext); | ||
| const parsed = JSON.parse(new TextDecoder().decode(decrypted)); | ||
| return parsed.body?.advertising_token ? (parsed.body as Uid2RefData) : null; |
There was a problem hiding this comment.
Here we return null for either a opt-out, a non-ok response or a success with a missing the advertising_token. Maybe we should have clearer distinct results.
| identity_expires: number; | ||
| }; | ||
|
|
||
| const UID2_REFRESH_ENDPOINT = "https://prod.uidapi.com/v2/token/refresh"; |
There was a problem hiding this comment.
We might want to have this be an arg to refreshUid2Token instead of hardcoded
There was a problem hiding this comment.
Or at least an arg with a default like endpoint = UID2_REFRESH_ENDPOINT
|
Other addons had an update to the README.md. We probably want one here also |
| async function refreshUid2Token(refreshToken: string, refreshResponseKey: string): Promise<Uid2RefData | null> { | ||
| const response = await fetch(UID2_REFRESH_ENDPOINT, { | ||
| method: "POST", | ||
| headers: { "Content-Type": "application/json" }, |
There was a problem hiding this comment.
The return type seems to be a raw refresh-token string so "Content-Type": "text/plain" would be more accurate.
| const cryptoKey = await crypto.subtle.importKey("raw", keyBytes, { name: "AES-GCM" }, false, ["decrypt"]); | ||
| const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv: nonce }, cryptoKey, ciphertext); | ||
| const parsed = JSON.parse(new TextDecoder().decode(decrypted)); | ||
| return parsed.body?.advertising_token ? (parsed.body as Uid2RefData) : null; |
There was a problem hiding this comment.
Here we only validate on one field advertising_token before casting to Uid2RefData. We might want to do further check for things like missing refresh_expires or refresh_token.
2 participants
Why
UID2 tokens expire and must be refreshed client-side against the UID2 operator. web-sdk has no refresh client;
refreshUid2Tokenis duplicated in 18 solutions bundles.What Changed
lib/addons/uid2-refresh.tsexportingrefreshUid2Token(refreshToken, refreshResponseKey)— POSTs the refresh token to the UID2 operator, AES-GCM-decrypts the response (12-byte nonce prefix,refresh_response_key), returns the body or null on non-OK / opt-out / missingadvertising_token. Malformed responses throw; error policy stays with the caller.Uid2RefDatatype — the response body and the_refshape on cached EIDs.How to Test
Unit tests cover a webcrypto round-trip, raw-body POST, non-OK, opt-out, missing token, and undecryptable payload.
Notes
First of three PRs for the addon: protocol client, then cache apply, then the
refreshStaleUid2sorchestrator.Breaking change
Requires release