privacy_sandbox_settings.h 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef COMPONENTS_PRIVACY_SANDBOX_PRIVACY_SANDBOX_SETTINGS_H_
  5. #define COMPONENTS_PRIVACY_SANDBOX_PRIVACY_SANDBOX_SETTINGS_H_
  6. #include "base/gtest_prod_util.h"
  7. #include "base/memory/raw_ptr.h"
  8. #include "base/observer_list.h"
  9. #include "base/time/time.h"
  10. #include "components/keyed_service/core/keyed_service.h"
  11. #include "components/prefs/pref_change_registrar.h"
  12. #include "components/privacy_sandbox/canonical_topic.h"
  13. #include "third_party/abseil-cpp/absl/types/optional.h"
  14. class HostContentSettingsMap;
  15. class PrefService;
  16. class GURL;
  17. namespace content_settings {
  18. class CookieSettings;
  19. }
  20. namespace url {
  21. class Origin;
  22. }
  23. namespace privacy_sandbox {
  24. // A service which acts as a intermediary between Privacy Sandbox APIs and the
  25. // preferences and content settings which define when they are allowed to be
  26. // accessed. Privacy Sandbox APIs, regardless of where they live (renderer,
  27. // browser, network etc), must consult this service to determine when
  28. // they are allowed to run. While a basic on/off control is provided by this
  29. // service, embedders are expected to achieve fine-grained control though
  30. // the underlying preferences and content settings separately.
  31. class PrivacySandboxSettings : public KeyedService {
  32. public:
  33. class Observer {
  34. public:
  35. virtual void OnTopicsDataAccessibleSinceUpdated() {}
  36. // Fired when Trust Token blocking has changed because of a change to the
  37. // Privacy Sandbox preference. Does not account for changes to third-party
  38. // cookie blocking, which may result in the Privacy Sandbox being disabled.
  39. // Trust tokens thus additionally independently consult Cookie settings.
  40. // TODO(crbug.com/1304132): Unify this so Trust Tokens only need to consult
  41. // a single source of truth.
  42. virtual void OnTrustTokenBlockingChanged(bool blocked) {}
  43. };
  44. class Delegate {
  45. public:
  46. virtual ~Delegate() = default;
  47. // Allows the delegate to restirct access to the Privacy Sandbox. When
  48. // the Privacy Sandbox is restricted, all API access is disabled. This is
  49. // consulted on every access check, and it is acceptable for this to change
  50. // return value over the life of the service.
  51. virtual bool IsPrivacySandboxRestricted() = 0;
  52. };
  53. PrivacySandboxSettings(
  54. std::unique_ptr<Delegate> delegate,
  55. HostContentSettingsMap* host_content_settings_map,
  56. scoped_refptr<content_settings::CookieSettings> cookie_settings,
  57. PrefService* pref_service,
  58. bool incognito_profile);
  59. ~PrivacySandboxSettings() override;
  60. // Returns whether the Topics API is allowed at all. If false, Topics API
  61. // calculations should not occur. If true, the more specific function,
  62. // IsTopicsApiAllowedForContext(), should be consulted for the relevant
  63. // context.
  64. bool IsTopicsAllowed() const;
  65. // Determines whether the Topics API is allowable in a particular context.
  66. // |top_frame_origin| is used to check for content settings which could both
  67. // affect 1P and 3P contexts.
  68. bool IsTopicsAllowedForContext(
  69. const GURL& url,
  70. const absl::optional<url::Origin>& top_frame_origin) const;
  71. // Returns whether |topic| can be either considered as a top topic for the
  72. // current epoch, or provided to a website as a previous / current epochs
  73. // site assigned topic.
  74. bool IsTopicAllowed(const CanonicalTopic& topic);
  75. // Sets |topic| to |allowed|. Whether a topic is allowed or not is made
  76. // available through IsTopicAllowed().
  77. void SetTopicAllowed(const CanonicalTopic& topic, bool allowed);
  78. // Removes all Topic settings with creation times between |start_time|
  79. // and |end_time|. This allows for integration with the existing browsing data
  80. // remover, such as the one powering Clear Browser Data.
  81. void ClearTopicSettings(base::Time start_time, base::Time end_time);
  82. // Returns the point in time from which history is eligible to be used when
  83. // calculating a user's Topics API topics. Reset when a user clears all
  84. // cookies, or when the browser restarts with "Clear on exit" enabled. The
  85. // returned time will have been fuzzed for local privacy, and so may be in the
  86. // future, in which case no history is eligible.
  87. base::Time TopicsDataAccessibleSince() const;
  88. // Determines whether Conversion Measurement is allowable in a particular
  89. // context. Should be called at both impression & conversion. At each of these
  90. // points |top_frame_origin| is the same as either the impression origin or
  91. // the conversion origin respectively.
  92. bool IsConversionMeasurementAllowed(
  93. const url::Origin& top_frame_origin,
  94. const url::Origin& reporting_origin) const;
  95. // Called before sending the associated conversion report to
  96. // |reporting_origin|. Re-checks that |reporting_origin| is allowable as a 3P
  97. // on both |impression_origin| and |conversion_origin|.
  98. bool ShouldSendConversionReport(const url::Origin& impression_origin,
  99. const url::Origin& conversion_origin,
  100. const url::Origin& reporting_origin) const;
  101. // Sets the ability for |top_frame_etld_plus1| to join the profile to interest
  102. // groups to |allowed|. This information is stored in preferences, and is made
  103. // available to the API via IsFledgeJoiningAllowed(). |top_frame_etld_plus1|
  104. // should in most circumstances be a valid eTLD+1, but hosts are accepted to
  105. // allow for shifts in private registries. Entries are converted into wildcard
  106. // subdomain ContentSettingsPattern before comparison.
  107. void SetFledgeJoiningAllowed(const std::string& top_frame_etld_plus1,
  108. bool allowed);
  109. // Clears any FLEDGE joining block settings with creation times between
  110. // |start_time| and |end_time|.
  111. void ClearFledgeJoiningAllowedSettings(base::Time start_time,
  112. base::Time end_time);
  113. // Determines whether the user may be joined to FLEDGE interest groups on, or
  114. // by, |top_frame_origin|. This is an additional check that must be
  115. // combined with the more generic IsFledgeAllowed().
  116. bool IsFledgeJoiningAllowed(const url::Origin& top_frame_origin) const;
  117. // Determine whether |auction_party| can register an interest group, or sell /
  118. // buy in an auction, on |top_frame_origin|.
  119. bool IsFledgeAllowed(const url::Origin& top_frame_origin,
  120. const url::Origin& auction_party);
  121. // Filter |auction_parties| down to those that may participate as a buyer for
  122. // auctions run on |top_frame_origin|. Logically equivalent to calling
  123. // IsFledgeAllowed() for each element of |auction_parties|.
  124. std::vector<GURL> FilterFledgeAllowedParties(
  125. const url::Origin& top_frame_origin,
  126. const std::vector<GURL>& auction_parties);
  127. // Determines whether Shared Storage is allowable in a particular context.
  128. // `top_frame_origin` can be the same as `accessing_origin` in the case of a
  129. // top-level document calling Shared Storage.
  130. bool IsSharedStorageAllowed(const url::Origin& top_frame_origin,
  131. const url::Origin& accessing_origin) const;
  132. // Determines whether the Private Aggregation API is allowable in a particular
  133. // context. `top_frame_origin` is the associated top-frame origin of the
  134. // calling context.
  135. bool IsPrivateAggregationAllowed(const url::Origin& top_frame_origin,
  136. const url::Origin& reporting_origin) const;
  137. // Returns whether the profile has the Privacy Sandbox enabled. This consults
  138. // the main preference, as well as the delegate to check whether the sandbox
  139. // is restricted. It does not consider any cookie settings. A return value of
  140. // false means that no Privacy Sandbox operations can occur. A return value of
  141. // true must be followed up with the appropriate IsXAllowed() call.
  142. bool IsPrivacySandboxEnabled() const;
  143. // Disables the Privacy Sandbox completely if |enabled| is false, if |enabled|
  144. // is true, more granular checks will still be performed, and the delegate
  145. // consulted, to determine if specific APIs are available in specific
  146. // contexts.
  147. void SetPrivacySandboxEnabled(bool enabled);
  148. // Returns whether Trust Tokens are "generally" available. A return value of
  149. // false is authoritative, while a value of true must be followed by the
  150. // appropriate context specific check.
  151. bool IsTrustTokensAllowed();
  152. // Returns whether the Privacy Sandbox is being restricted by the associated
  153. // delegate. Forwards directly to the corresponding delegate function.
  154. // Virtual to allow mocking in tests.
  155. virtual bool IsPrivacySandboxRestricted();
  156. // Called when there's a broad cookies clearing action. For example, this
  157. // should be called on "Clear browsing data", but shouldn't be called on the
  158. // Clear-Site-Data header, as it's restricted to a specific site.
  159. void OnCookiesCleared();
  160. // Called when the main privacy sandbox preference is changed.
  161. void OnPrivacySandboxPrefChanged();
  162. void AddObserver(Observer* observer);
  163. void RemoveObserver(Observer* observer);
  164. // Overrides the internal delegate for test purposes.
  165. void SetDelegateForTesting(std::unique_ptr<Delegate> delegate);
  166. protected:
  167. // Protected default constructor to allow mocking in tests.
  168. PrivacySandboxSettings();
  169. // Determines based on the current features, preferences and provided
  170. // |cookie_settings| whether Privacy Sandbox APIs are generally allowable for
  171. // |url| on |top_frame_origin|. Individual APIs may perform additional checks
  172. // for allowability (such as incognito) ontop of this. |cookie_settings| is
  173. // provided as a parameter to allow callers to cache it between calls.
  174. bool IsPrivacySandboxEnabledForContext(
  175. const GURL& url,
  176. const absl::optional<url::Origin>& top_frame_origin) const;
  177. void SetTopicsDataAccessibleFromNow() const;
  178. private:
  179. base::ObserverList<Observer>::Unchecked observers_;
  180. std::unique_ptr<Delegate> delegate_;
  181. raw_ptr<HostContentSettingsMap> host_content_settings_map_;
  182. scoped_refptr<content_settings::CookieSettings> cookie_settings_;
  183. raw_ptr<PrefService> pref_service_;
  184. PrefChangeRegistrar pref_change_registrar_;
  185. bool incognito_profile_;
  186. };
  187. } // namespace privacy_sandbox
  188. #endif // COMPONENTS_PRIVACY_SANDBOX_PRIVACY_SANDBOX_SETTINGS_H_