Refactoring UserIdentity logics

src/main/java/com/uid2/operator/model/AdvertisingTokenInput.java

@@ -9,13 +9,18 @@ public class AdvertisingTokenInput extends VersionedToken {
     public final OperatorIdentity operatorIdentity;
     public final SourcePublisher sourcePublisher;
     public final RawUidIdentity rawUidIdentity;
+    public final int privacyBits;
+    public final Instant establishedAt;
 
     public AdvertisingTokenInput(TokenVersion version, Instant createdAt, Instant expiresAt, OperatorIdentity operatorIdentity,
-                                 SourcePublisher sourcePublisher, RawUidIdentity rawUidIdentity) {
+                                 SourcePublisher sourcePublisher, RawUidIdentity rawUidIdentity, int privacyBits,
+                                 Instant establishedAt) {
         super(version, createdAt, expiresAt);
         this.operatorIdentity = operatorIdentity;
         this.sourcePublisher = sourcePublisher;
         this.rawUidIdentity = rawUidIdentity;
+        this.privacyBits = privacyBits;
+        this.establishedAt = establishedAt;
     }
 }
 

src/main/java/com/uid2/operator/model/IdentityRequest.java

@@ -1,12 +1,32 @@
 package com.uid2.operator.model;
 
 import com.uid2.operator.model.userIdentity.HashedDiiIdentity;
+import com.uid2.operator.util.PrivacyBits;
+
+import java.time.Instant;
 
 public final class IdentityRequest {
     public final SourcePublisher sourcePublisher;
     public final HashedDiiIdentity hashedDiiIdentity;
     public final OptoutCheckPolicy optoutCheckPolicy;
 
+    public final int privacyBits;
+    public final Instant establishedAt;
+
+    public IdentityRequest(
+            SourcePublisher sourcePublisher,
+            HashedDiiIdentity hashedDiiIdentity,
+            OptoutCheckPolicy tokenGeneratePolicy,
+            int privacyBits,
+            Instant establishedAt)
+    {
+        this.sourcePublisher = sourcePublisher;
+        this.hashedDiiIdentity = hashedDiiIdentity;
+        this.optoutCheckPolicy = tokenGeneratePolicy;
+        this.privacyBits = privacyBits;
+        this.establishedAt = establishedAt;
+    }
+
     public IdentityRequest(
             SourcePublisher sourcePublisher,
             HashedDiiIdentity hashedDiiIdentity,
@@ -15,6 +35,8 @@ public IdentityRequest(
         this.sourcePublisher = sourcePublisher;
         this.hashedDiiIdentity = hashedDiiIdentity;
         this.optoutCheckPolicy = tokenGeneratePolicy;
+        this.privacyBits = PrivacyBits.DEFAULT_PRIVACY_BIT_VALUE;
+        this.establishedAt = Instant.now();
     }
 
     public boolean shouldCheckOptOut() {

src/main/java/com/uid2/operator/model/IdentityResponse.java

@@ -1,6 +1,7 @@
 package com.uid2.operator.model;
 
 import com.uid2.shared.model.TokenVersion;
+import io.vertx.core.json.JsonObject;
 
 import java.time.Instant;
 
@@ -52,4 +53,25 @@ public Instant getRefreshFrom() {
     public boolean isOptedOut() {
         return advertisingToken == null || advertisingToken.isEmpty();
     }
+
+    // for v1/v2 token/generate and token/refresh and client/generate (CSTG) endpoints
+    public JsonObject toJsonV1() {
+        final JsonObject json = new JsonObject();
+        json.put("advertising_token", getAdvertisingToken());
+        json.put("refresh_token", getRefreshToken());
+        json.put("identity_expires", getIdentityExpires().toEpochMilli());
+        json.put("refresh_expires", getRefreshExpires().toEpochMilli());
+        json.put("refresh_from", getRefreshFrom().toEpochMilli());
+        return json;
+    }
+
+    // for the original/legacy token/generate and token/refresh endpoint
+    public JsonObject toJsonV0() {
+        final JsonObject json = new JsonObject();
+        json.put("advertisement_token", getAdvertisingToken());
+        json.put("advertising_token", getAdvertisingToken());
+        json.put("refresh_token", getRefreshToken());
+
+        return json;
+    }
 }

src/main/java/com/uid2/operator/model/RefreshTokenInput.java

@@ -9,12 +9,16 @@ public class RefreshTokenInput extends VersionedToken {
     public final OperatorIdentity operatorIdentity;
     public final SourcePublisher sourcePublisher;
     public final FirstLevelHashIdentity firstLevelHashIdentity;
+    // by default, inherited from the previous refresh token's privacy bits
+    public final int privacyBits;
+
 
     public RefreshTokenInput(TokenVersion version, Instant createdAt, Instant expiresAt, OperatorIdentity operatorIdentity,
-                             SourcePublisher sourcePublisher, FirstLevelHashIdentity firstLevelHashIdentity) {
+                             SourcePublisher sourcePublisher, FirstLevelHashIdentity firstLevelHashIdentity, int privacyBits) {
         super(version, createdAt, expiresAt);
         this.operatorIdentity = operatorIdentity;
         this.sourcePublisher = sourcePublisher;
         this.firstLevelHashIdentity = firstLevelHashIdentity;
+        this.privacyBits = privacyBits;
     }
 }

src/main/java/com/uid2/operator/model/userIdentity/FirstLevelHashIdentity.java

@@ -10,10 +10,15 @@
 public class FirstLevelHashIdentity extends UserIdentity {
     public final byte[] firstLevelHash;
 
-    public FirstLevelHashIdentity(IdentityScope identityScope, IdentityType identityType, byte[] firstLevelHash, int privacyBits,
-                                  Instant establishedAt, Instant refreshedAt) {
-        super(identityScope, identityType, privacyBits, establishedAt, refreshedAt);
+    // for brand new token generation, it should be the time it is generated
+    // if the first level hash is from token/refresh call, it will be when the raw UID was originally created in the earliest token generation
+    public final Instant establishedAt;
+
+    public FirstLevelHashIdentity(IdentityScope identityScope, IdentityType identityType, byte[] firstLevelHash,
+                                  Instant establishedAt) {
+        super(identityScope, identityType);
         this.firstLevelHash = firstLevelHash;
+        this.establishedAt = establishedAt;
     }
 
     public boolean matches(FirstLevelHashIdentity that) {

src/main/java/com/uid2/operator/model/userIdentity/HashedDiiIdentity.java

@@ -10,9 +10,8 @@
 public class HashedDiiIdentity extends UserIdentity {
     public final byte[] hashedDii;
 
-    public HashedDiiIdentity(IdentityScope identityScope, IdentityType identityType, byte[] hashedDii, int privacyBits,
-                             Instant establishedAt, Instant refreshedAt) {
-        super(identityScope, identityType, privacyBits, establishedAt, refreshedAt);
+    public HashedDiiIdentity(IdentityScope identityScope, IdentityType identityType, byte[] hashedDii) {
+        super(identityScope, identityType);
         this.hashedDii = hashedDii;
     }
 }

src/main/java/com/uid2/operator/model/userIdentity/RawUidIdentity.java

@@ -10,9 +10,8 @@
 public class RawUidIdentity extends UserIdentity {
     public final byte[] rawUid;
 
-    public RawUidIdentity(IdentityScope identityScope, IdentityType identityType, byte[] rawUid, int privacyBits,
-                          Instant establishedAt, Instant refreshedAt) {
-        super(identityScope, identityType, privacyBits, establishedAt, refreshedAt);
+    public RawUidIdentity(IdentityScope identityScope, IdentityType identityType, byte[] rawUid) {
+        super(identityScope, identityType);
         this.rawUid = rawUid;
     }
 

src/main/java/com/uid2/operator/model/userIdentity/UserIdentity.java

@@ -10,15 +10,9 @@ public abstract class UserIdentity {
 
     public final IdentityScope identityScope;
     public final IdentityType identityType;
-    public final int privacyBits;
-    public final Instant establishedAt;
-    public final Instant refreshedAt;
 
-    public UserIdentity(IdentityScope identityScope, IdentityType identityType, int privacyBits, Instant establishedAt, Instant refreshedAt) {
+    public UserIdentity(IdentityScope identityScope, IdentityType identityType) {
         this.identityScope = identityScope;
         this.identityType = identityType;
-        this.privacyBits = privacyBits;
-        this.establishedAt = establishedAt;
-        this.refreshedAt = refreshedAt;
     }
 }

src/main/java/com/uid2/operator/service/EncryptedTokenEncoder.java

@@ -41,7 +41,7 @@ private byte[] encodeIntoAdvertisingTokenV2(AdvertisingTokenInput t, KeysetKey m
 
         Buffer b2 = Buffer.buffer();
         b2.appendLong(t.expiresAt.toEpochMilli());
-        encodeSiteIdentityV2(b2, t.sourcePublisher, t.rawUidIdentity, siteKey);
+        encodeSiteIdentityV2(b2, t.sourcePublisher, t.rawUidIdentity, siteKey, t.privacyBits, t.establishedAt);
 
         final byte[] encryptedId = AesCbc.encrypt(b2.getBytes(), masterKey).getPayload();
 
@@ -53,9 +53,10 @@ private byte[] encodeIntoAdvertisingTokenV2(AdvertisingTokenInput t, KeysetKey m
     private byte[] encodeIntoAdvertisingTokenV3(AdvertisingTokenInput t, KeysetKey masterKey, KeysetKey siteKey) {
         final Buffer sitePayload = Buffer.buffer(69);
         encodePublisherRequesterV3(sitePayload, t.sourcePublisher);
-        sitePayload.appendInt(t.rawUidIdentity.privacyBits);
-        sitePayload.appendLong(t.rawUidIdentity.establishedAt.toEpochMilli());
-        sitePayload.appendLong(t.rawUidIdentity.refreshedAt.toEpochMilli());
+        sitePayload.appendInt(t.privacyBits);
+        sitePayload.appendLong(t.establishedAt.toEpochMilli());
+        // this is the refreshedAt field in the spec - but effectively it is the time this advertising token is generated
+        sitePayload.appendLong(t.createdAt.toEpochMilli());
         sitePayload.appendBytes(t.rawUidIdentity.rawUid); // 32 or 33 bytes
 
         final Buffer masterPayload = Buffer.buffer(130);
@@ -126,8 +127,9 @@ private RefreshTokenInput decodeRefreshTokenV2(Buffer b) {
                 TokenVersion.V2, createdAt, validTill,
                 new OperatorIdentity(0, OperatorType.Service, 0, 0),
                 new SourcePublisher(siteId, 0, 0),
-                new FirstLevelHashIdentity(IdentityScope.UID2, IdentityType.Email, identity, privacyBits,
-                        Instant.ofEpochMilli(establishedMillis), null));
+                new FirstLevelHashIdentity(IdentityScope.UID2, IdentityType.Email, identity,
+                        Instant.ofEpochMilli(establishedMillis)),
+                privacyBits);
     }
 
     private RefreshTokenInput decodeRefreshTokenV3(Buffer b, byte[] bytes) {
@@ -160,7 +162,8 @@ private RefreshTokenInput decodeRefreshTokenV3(Buffer b, byte[] bytes) {
 
         return new RefreshTokenInput(
                 TokenVersion.V3, createdAt, expiresAt, operatorIdentity, sourcePublisher,
-                new FirstLevelHashIdentity(identityScope, identityType, firstLevelHash, privacyBits, establishedAt, null));
+                new FirstLevelHashIdentity(identityScope, identityType, firstLevelHash, establishedAt),
+                privacyBits);
     }
 
     @Override
@@ -228,8 +231,9 @@ public AdvertisingTokenInput decodeAdvertisingTokenV2(Buffer b) {
                     Instant.ofEpochMilli(expiresMillis),
                     new OperatorIdentity(0, OperatorType.Service, 0, masterKeyId),
                     new SourcePublisher(siteId, siteKeyId, 0),
-                    new RawUidIdentity(IdentityScope.UID2, IdentityType.Email, rawUid, privacyBits,
-                            Instant.ofEpochMilli(establishedMillis), null)
+                    new RawUidIdentity(IdentityScope.UID2, IdentityType.Email, rawUid),
+                    privacyBits,
+                    Instant.ofEpochMilli(establishedMillis)
             );
 
         } catch (Exception e) {
@@ -252,6 +256,7 @@ public AdvertisingTokenInput decodeAdvertisingTokenV3orV4(Buffer b, byte[] bytes
         final SourcePublisher sourcePublisher = decodeSourcePublisherV3(sitePayload, 0);
         final int privacyBits = sitePayload.getInt(16);
         final Instant establishedAt = Instant.ofEpochMilli(sitePayload.getLong(20));
+        // refreshedAt is currently not used
         final Instant refreshedAt = Instant.ofEpochMilli(sitePayload.getLong(28));
         final byte[] rawUid = sitePayload.slice(36, sitePayload.length()).getBytes();
         final IdentityScope identityScope = rawUid.length == 32 ? IdentityScope.UID2 : decodeIdentityScopeV3(rawUid[0]);
@@ -269,7 +274,8 @@ public AdvertisingTokenInput decodeAdvertisingTokenV3orV4(Buffer b, byte[] bytes
 
         return new AdvertisingTokenInput(
                 tokenVersion, createdAt, expiresAt, operatorIdentity, sourcePublisher,
-                new RawUidIdentity(identityScope, identityType, rawUid, privacyBits, establishedAt, refreshedAt)
+                new RawUidIdentity(identityScope, identityType, rawUid),
+                privacyBits, establishedAt
         );
     }
 
@@ -304,7 +310,8 @@ public byte[] encodeIntoRefreshTokenV2(RefreshTokenInput t, KeysetKey serviceKey
         // give an extra minute for clients which are trying to refresh tokens close to or at the refresh expiry timestamp
         b.appendLong(t.expiresAt.plusSeconds(60).toEpochMilli());
         b.appendInt(serviceKey.getId());
-        final byte[] encryptedIdentity = encryptIdentityV2(t.sourcePublisher, t.firstLevelHashIdentity, serviceKey);
+        final byte[] encryptedIdentity = encryptIdentityV2(t.sourcePublisher, t.firstLevelHashIdentity, serviceKey,
+                t.privacyBits);
         b.appendBytes(encryptedIdentity);
         return b.getBytes();
     }
@@ -315,7 +322,7 @@ public byte[] encodeIntoRefreshTokenV3(RefreshTokenInput t, KeysetKey serviceKey
         refreshPayload.appendLong(t.createdAt.toEpochMilli());
         encodeOperatorIdentityV3(refreshPayload, t.operatorIdentity);
         encodePublisherRequesterV3(refreshPayload, t.sourcePublisher);
-        refreshPayload.appendInt(t.firstLevelHashIdentity.privacyBits);
+        refreshPayload.appendInt(t.privacyBits);
         refreshPayload.appendLong(t.firstLevelHashIdentity.establishedAt.toEpochMilli());
         refreshPayload.appendByte(encodeIdentityTypeV3(t.firstLevelHashIdentity.identityScope, t.firstLevelHashIdentity.identityType));
         refreshPayload.appendBytes(t.firstLevelHashIdentity.firstLevelHash);
@@ -330,9 +337,9 @@ public byte[] encodeIntoRefreshTokenV3(RefreshTokenInput t, KeysetKey serviceKey
     }
 
     private void encodeSiteIdentityV2(Buffer b, SourcePublisher sourcePublisher, RawUidIdentity rawUidIdentity,
-                                      KeysetKey siteEncryptionKey) {
+                                      KeysetKey siteEncryptionKey, int privacyBits, Instant establishedAt) {
         b.appendInt(siteEncryptionKey.getId());
-        final byte[] encryptedIdentity = encryptIdentityV2(sourcePublisher, rawUidIdentity, siteEncryptionKey);
+        final byte[] encryptedIdentity = encryptIdentityV2(sourcePublisher, rawUidIdentity, siteEncryptionKey, privacyBits, establishedAt);
         b.appendBytes(encryptedIdentity);
     }
 
@@ -364,15 +371,16 @@ private String generateAdvertisingTokenString(AdvertisingTokenInput advertisingT
         return bytesToBase64Token(advertisingTokenBytes, advertisingTokenInput.version);
     }
 
-    private byte[] encryptIdentityV2(SourcePublisher sourcePublisher, FirstLevelHashIdentity firstLevelHashIdentity, KeysetKey key) {
-        return encryptIdentityV2(sourcePublisher, firstLevelHashIdentity.firstLevelHash, firstLevelHashIdentity.privacyBits,
+    private byte[] encryptIdentityV2(SourcePublisher sourcePublisher, FirstLevelHashIdentity firstLevelHashIdentity,
+                                     KeysetKey key, int privacyBits) {
+        return encryptIdentityV2(sourcePublisher, firstLevelHashIdentity.firstLevelHash, privacyBits,
                 firstLevelHashIdentity.establishedAt, key);
     }
 
     private byte[] encryptIdentityV2(SourcePublisher sourcePublisher, RawUidIdentity rawUidIdentity,
-                                     KeysetKey key) {
-        return encryptIdentityV2(sourcePublisher, rawUidIdentity.rawUid, rawUidIdentity.privacyBits,
-                rawUidIdentity.establishedAt, key);
+                                     KeysetKey key, int privacyBits, Instant establishedAt) {
+        return encryptIdentityV2(sourcePublisher, rawUidIdentity.rawUid, privacyBits,
+                establishedAt, key);
     }
 
 

src/main/java/com/uid2/operator/service/InputUtil.java

@@ -261,14 +261,11 @@ public boolean isValid() {
             return valid;
         }
 
-        public HashedDiiIdentity toHashedDiiIdentity(IdentityScope identityScope, int privacyBits, Instant establishedAt) {
+        public HashedDiiIdentity toHashedDiiIdentity(IdentityScope identityScope) {
             return new HashedDiiIdentity(
                     identityScope,
                     this.identityType,
-                    getIdentityInput(),
-                    privacyBits,
-                    establishedAt,
-                    establishedAt);
+                    getIdentityInput());
         }
     }