tor-browser

ContextId.sys.mjs (8127B)

---

/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs";
import {
 ContextIdCallback,
 ContextIdComponent,
} from "moz-src:///toolkit/components/uniffi-bindgen-gecko-js/components/generated/RustContextId.sys.mjs";

const CONTEXT_ID_PREF = "browser.contextual-services.contextId";
const CONTEXT_ID_TIMESTAMP_PREF =
 "browser.contextual-services.contextId.timestamp-in-seconds";
const CONTEXT_ID_ROTATION_DAYS_PREF =
 "browser.contextual-services.contextId.rotation-in-days";
const CONTEXT_ID_RUST_COMPONENT_ENABLED_PREF =
 "browser.contextual-services.contextId.rust-component.enabled";
const SHUTDOWN_TOPIC = "profile-before-change";

const lazy = {};

ChromeUtils.defineESModuleGetters(lazy, {
 ObliviousHTTP: "resource://gre/modules/ObliviousHTTP.sys.mjs",
});

XPCOMUtils.defineLazyPreferenceGetter(
 lazy,
 "CURRENT_CONTEXT_ID",
 CONTEXT_ID_PREF,
 ""
);

XPCOMUtils.defineLazyPreferenceGetter(
 lazy,
 "UNIFIED_ADS_ENDPOINT",
 "browser.newtabpage.activity-stream.unifiedAds.endpoint",
 ""
);

XPCOMUtils.defineLazyPreferenceGetter(
 lazy,
 "OHTTP_RELAY_URL",
 "browser.newtabpage.activity-stream.discoverystream.ohttp.relayURL",
 ""
);

XPCOMUtils.defineLazyPreferenceGetter(
 lazy,
 "OHTTP_CONFIG_URL",
 "browser.newtabpage.activity-stream.discoverystream.ohttp.configURL",
 ""
);

class JsContextIdCallback extends ContextIdCallback {
 constructor(dispatchEvent) {
   super();
   this.dispatchEvent = dispatchEvent;
 }

 persist(newContextId, creationTimestamp) {
   Services.prefs.setCharPref(CONTEXT_ID_PREF, newContextId);
   Services.prefs.setIntPref(CONTEXT_ID_TIMESTAMP_PREF, creationTimestamp);
   this.dispatchEvent(new CustomEvent("ContextId:Persisted"));
 }

 rotated(oldContextId) {
   GleanPings.contextIdDeletionRequest.setEnabled(true);

   Glean.contextualServices.contextId.set(oldContextId);
   GleanPings.contextIdDeletionRequest.submit();
   ContextId.sendMARSDeletionRequest(oldContextId);
 }
}

/**
* A class that manages and (optionally) rotates the context ID, which is a
* a unique identifier used by Contextual Services.
*/
export class _ContextId extends EventTarget {
 #comp = null;
 #rotationDays = 0;
 #rustComponentEnabled = false;
 #observer = null;

 constructor() {
   super();

   this.#rustComponentEnabled = Services.prefs.getBoolPref(
     CONTEXT_ID_RUST_COMPONENT_ENABLED_PREF,
     false
   );

   if (this.#rustComponentEnabled) {
     // We intentionally read this once at construction, and cache the result.
     // This is because enabling or disabling rotation may affect external
     // uses of _ContextId which (for example) send the context_id UUID to
     // Shredder in the context-id-deletion-request ping (which we only want to
     // do when rotation is disabled), and that sort of thing tends to get set
     // once during startup.
     this.#rotationDays = Services.prefs.getIntPref(
       CONTEXT_ID_ROTATION_DAYS_PREF,
       0
     );
     // Note that we're setting `running_in_test_automation` to true
     // all of the time. This is because we don't want the ContextID
     // component to be responsible for sending the DELETE request to MARS,
     // since it doesn't know to do it over OHTTP. We'll send the DELETE
     // request ourselves over OHTTP at rotation time.
     this.#comp = ContextIdComponent.init(
       lazy.CURRENT_CONTEXT_ID,
       Services.prefs.getIntPref(CONTEXT_ID_TIMESTAMP_PREF, 0),
       true /* running_in_test_automation */,
       new JsContextIdCallback(this.dispatchEvent.bind(this))
     );
     this.#observer = (subject, topic, data) => {
       this.observe(subject, topic, data);
     };

     Services.obs.addObserver(this.#observer, SHUTDOWN_TOPIC);
   }
 }

 /**
  * nsIObserver implementation.
  *
  * @param {nsISupports} _subject
  * @param {string} topic
  * @param {string} _data
  */
 observe(_subject, topic, _data) {
   if (topic == SHUTDOWN_TOPIC) {
     // Unregister ourselves as the callback to avoid leak assertions.
     this.#comp.unsetCallback();
     Services.obs.removeObserver(this.#observer, SHUTDOWN_TOPIC);
   }
 }

 /**
  * Returns the stored context ID for this profile, if one exists. If one
  * doesn't exist, one is generated and then returned. In the event that
  * context ID rotation is in effect, then this may return a different
  * context ID if we've determined it's time to rotate. This means that
  * consumers _should not_ cache the context ID, but always request it.
  *
  * @returns {Promise<string>}
  *   The context ID for this profile.
  */
 async request() {
   if (this.#rustComponentEnabled) {
     return this.#comp.request(this.#rotationDays);
   }

   // Fallback to the legacy behaviour of just returning the pref, or
   // generating / returning a UUID if the pref is false-y.
   if (!lazy.CURRENT_CONTEXT_ID) {
     let _contextId = Services.uuid.generateUUID().toString();
     Services.prefs.setStringPref(CONTEXT_ID_PREF, _contextId);
   }

   return Promise.resolve(lazy.CURRENT_CONTEXT_ID);
 }

 /**
  * Forces the rotation of the context ID. This should be used by callers when
  * some surface that uses the context ID is disabled. This is only supported
  * with the Rust backend, and is a no-op when the Rust backend is not enabled.
  *
  * @returns {Promise<undefined>}
  */
 async forceRotation() {
   if (this.#rustComponentEnabled) {
     return this.#comp.forceRotation();
   }
   return Promise.resolve();
 }

 /**
  * Returns true if context ID rotation is enabled.
  *
  * @returns {boolean}
  */
 get rotationEnabled() {
   return this.#rustComponentEnabled && this.#rotationDays > 0;
 }

 /**
  * A compatibility shim that only works if rotationEnabled is false which
  * returns the context ID synchronously. This will throw if rotationEnabled
  * is true - so callers should ensure that rotationEnabled is false before
  * using this. This will eventually be removed.
  */
 requestSynchronously() {
   if (this.rotationEnabled) {
     throw new Error(
       "Cannot request context ID synchronously when rotation is enabled."
     );
   }

   return lazy.CURRENT_CONTEXT_ID;
 }

 /**
  * For now, the context_id application-services component does not know how
  * to send the MARS deletion request over OHTTP, so we do it ourselves
  * manually, using the New Tab unified ads preferences. This will eventually
  * go away once the context_id component knows how to use OHTTP itself.
  *
  * @param {string} oldContextId
  *   The old context_id being rotated away from.
  * @returns {Promise<undefined>}
  */
 async sendMARSDeletionRequest(oldContextId) {
   if (
     !lazy.UNIFIED_ADS_ENDPOINT ||
     !lazy.OHTTP_RELAY_URL ||
     !lazy.OHTTP_CONFIG_URL
   ) {
     return;
   }

   const endpoint = `${lazy.UNIFIED_ADS_ENDPOINT}v1/delete_user`;
   const body = {
     context_id: oldContextId,
   };
   const headers = new Headers();
   headers.append("content-type", "application/json");

   const config = await lazy.ObliviousHTTP.getOHTTPConfig(
     lazy.OHTTP_CONFIG_URL
   );

   if (!config) {
     console.error(
       new Error(
         `OHTTP was configured for ${endpoint} but we couldn't fetch a valid config`
       )
     );
   }

   // We don't actually use this AbortController, but ObliviousHTTP wants it.
   const controller = new AbortController();
   const { signal } = controller;

   const response = await lazy.ObliviousHTTP.ohttpRequest(
     lazy.OHTTP_RELAY_URL,
     config,
     endpoint,
     {
       method: "DELETE",
       headers,
       body: JSON.stringify(body),
       credentials: "omit",
       signal,
     }
   );

   if (!response.ok) {
     console.error(new Error(`Unexpected status (${response.status})`));
   }
 }
}

export const ContextId = new _ContextId();