Sync public snapshot from freebuff-private

Author: github-actions[bot]

common/src/util/__tests__/axiom-only-log.test.ts

@@ -9,6 +9,7 @@ import {
   ADS_FIRST_PARTY_SETTLEMENT_EVENT,
   ADS_FIRST_PARTY_VIEW_ACK_EVENT,
   ADS_EXTERNAL_CONVERSION_CLICK_ID_SHAPES,
+  ADS_EXTERNAL_CONVERSION_SELECTED_RAILS,
   ADS_EXTERNAL_CONVERSION_POSTBACK_EVENT,
   ADS_CAMPAIGN_INGRESS_EVIDENCE_EVENT,
   ADS_ADVERTISER_REPORTING_READ_EVENT,
@@ -1078,11 +1079,15 @@ describe('getAxiomOnlyLogEvent', () => {
     )
   })
 
-  test('keeps external conversion postbacks content- and identifier-free', () => {
+  test('keeps only advertiser correlation and content-free dimensions on conversion postbacks', () => {
     expect(
       getAxiomOnlyLogEvent({
         axiomEvent: ADS_EXTERNAL_CONVERSION_POSTBACK_EVENT,
-        channel: 'client',
+        channel: 's2s',
+        selected_rail: 'identity_email',
+        email_present: false,
+        email_hash_present: true,
+        email_hash_valid: true,
         outcome: 'accepted',
         rejection_reason: 'none',
         event_type: 'signup_completed',
@@ -1099,14 +1104,21 @@ describe('getAxiomOnlyLogEvent', () => {
         advertiser_id: 'advertiser-private',
         user_id: 'user-private',
         email: 'private@example.com',
+        em: 'a'.repeat(64),
+        userData: { em: 'a'.repeat(64) },
         url: 'https://partner.example/private',
         body: { private: true },
         error: new Error('private failure'),
       }),
     ).toEqual({
       event: ADS_EXTERNAL_CONVERSION_POSTBACK_EVENT,
       data: {
-        channel: 'client',
+        channel: 's2s',
+        advertiser_id: 'advertiser-private',
+        selected_rail: 'identity_email',
+        email_present: false,
+        email_hash_present: true,
+        email_hash_valid: true,
         outcome: 'accepted',
         rejection_reason: 'none',
         event_type: 'signup_completed',
@@ -1144,13 +1156,44 @@ describe('getAxiomOnlyLogEvent', () => {
     const result = getAxiomOnlyLogEvent({
       ...base,
       click_id_shape: 'bfc_1.private-raw-click-value',
-      advertiser_id: 'advertiser-private',
+      advertiser_id: 'advertiser-1',
       api_key: 'fbadv_private',
     })
     expect(result?.data).not.toHaveProperty('click_id_shape')
     expect(JSON.stringify(result)).not.toContain('private')
   })
 
+  test('accepts only closed selected rails and boolean identity presence flags', () => {
+    const base = { axiomEvent: ADS_EXTERNAL_CONVERSION_POSTBACK_EVENT }
+    for (const selectedRail of ADS_EXTERNAL_CONVERSION_SELECTED_RAILS) {
+      expect(
+        getAxiomOnlyLogEvent({
+          ...base,
+          selected_rail: selectedRail,
+          email_present: true,
+          email_hash_present: false,
+          email_hash_valid: false,
+        })?.data,
+      ).toEqual({
+        selected_rail: selectedRail,
+        email_present: true,
+        email_hash_present: false,
+        email_hash_valid: false,
+      })
+    }
+    for (const invalid of ['private@example.com', 'a'.repeat(64), 42, null]) {
+      const result = getAxiomOnlyLogEvent({
+        ...base,
+        selected_rail: invalid,
+        email_present: invalid,
+        email_hash_present: invalid,
+        email_hash_valid: invalid,
+        advertiser_id: { raw: 'private-id' },
+      })
+      expect(result?.data).toEqual({})
+    }
+  })
+
   test('drops a non-string channel from the postback census', () => {
     const result = getAxiomOnlyLogEvent({
       axiomEvent: ADS_EXTERNAL_CONVERSION_POSTBACK_EVENT,

common/src/util/axiom-only-log.ts

@@ -105,7 +105,7 @@ export const ADS_EXTERNAL_CONVERSION_POSTBACK_EVENT =
 /**
  * Why an authenticated S2S postback failed the click-id shape guard before
  * body validation. Values describe only the failed predicate; the presented
- * value, API key, advertiser, campaign, IP and request body stay out of Axiom.
+ * value, API key, campaign, IP and request body stay out of Axiom.
  */
 export const ADS_EXTERNAL_CONVERSION_CLICK_ID_SHAPES = [
   'missing',
@@ -116,9 +116,17 @@ export const ADS_EXTERNAL_CONVERSION_CLICK_ID_SHAPES = [
 ] as const
 export type AdsExternalConversionClickIdShape =
   (typeof ADS_EXTERNAL_CONVERSION_CLICK_ID_SHAPES)[number]
+/** Selected ingress branch, including requests rejected before a lookup. */
+export const ADS_EXTERNAL_CONVERSION_SELECTED_RAILS = [
+  'click_id',
+  'identity_email',
+  'none',
+] as const
+export type AdsExternalConversionSelectedRail =
+  (typeof ADS_EXTERNAL_CONVERSION_SELECTED_RAILS)[number]
 /**
- * Durable campaign-health evidence. Unlike the content-free postback census,
- * this stream intentionally carries opaque advertiser/campaign identifiers so
+ * Durable campaign-health evidence. This stream also carries an opaque
+ * campaign identifier, beyond the postback census's authenticated advertiser, so
  * the health reader can distinguish independent ingress binding from a join
  * learned only after click resolution. Raw click ids, event ids, credentials,
  * email, IP and user-agent data are never fields on this event.
@@ -1067,13 +1075,23 @@ export function createFirstPartyViewAckTelemetry(
   }
 }
 
-/** Keep the advertiser postback stream safe to aggregate. In particular this
- * must not grow into an attribution/debugging record: the database owns that
- * drill-down and Axiom receives only bounded operational dimensions. */
+/** Keep the advertiser postback stream safe to aggregate. The authenticated
+ * advertiser id correlates integration health; all other fields describe
+ * bounded operational dimensions. Emails, hashes and click/event identifiers
+ * stay out of Axiom. */
 const ADS_EXTERNAL_CONVERSION_POSTBACK_FIELDS = {
   // Which ingress reported: 's2s' (key-authenticated postback) or 'client'
   // (the keyless browser endpoint). Two-valued, never a partner identifier.
   channel: 'string',
+  // Server-resolved after authentication, never a request-body field.
+  advertiser_id: 'string',
+  selected_rail: 'string',
+  // Raw canonical field presence, including fields ignored by click-id routing.
+  // Presence does not imply the supplied email or hash was valid.
+  email_present: 'boolean',
+  email_hash_present: 'boolean',
+  // Whether canonical `em` contains an accepted SHA-256 digest or digest array.
+  email_hash_valid: 'boolean',
   outcome: 'string',
   rejection_reason: 'string',
   click_id_shape: 'string',
@@ -1105,6 +1123,14 @@ function sanitizeExternalConversionPostbackFields(
   ) {
     delete data.click_id_shape
   }
+  if (
+    typeof data.selected_rail === 'string' &&
+    !(ADS_EXTERNAL_CONVERSION_SELECTED_RAILS as readonly string[]).includes(
+      data.selected_rail,
+    )
+  ) {
+    delete data.selected_rail
+  }
   return data
 }