From 9d89b6e07ba75e6c8c93dcb18d996ffaacb081cc Mon Sep 17 00:00:00 2001 From: Alex Turner Date: Thu, 22 Feb 2024 22:28:59 +0000 Subject: [PATCH] Spec: auctionBuyerKeys reporting (#117) SHA: b09c9c4888966971d29466c54ab1baf2835a19a9 Reason: push, by alexmturner Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- index.html | 2865 ++++++++++++++++++++++++++++------------------------ 1 file changed, 1533 insertions(+), 1332 deletions(-) diff --git a/index.html b/index.html index e29e2c6..16fb446 100644 --- a/index.html +++ b/index.html @@ -5,9 +5,9 @@ Private Aggregation API - + - + +

Private Aggregation API

-

Unofficial Proposal Draft,

+

Unofficial Proposal Draft,

More details about this document
@@ -733,7 +730,7 @@

Private Aggregation API

-

Copyright © 2023 the Contributors to “Private Aggregation API”. +

Copyright © 2024 the Contributors to “Private Aggregation API”. This document is licensed under the W3C Software License. @@ -934,8 +931,8 @@

[Exposed=(InterestGroupScriptRunnerGlobalScope,SharedStorageWorklet), SecureContext] interface PrivateAggregation { - undefined contributeToHistogram(PAHistogramContribution contribution); - undefined enableDebugMode(optional PADebugModeOptions options = {}); + undefined contributeToHistogram(PAHistogramContribution contribution); + undefined enableDebugMode(optional PADebugModeOptions options = {}); }; dictionary PAHistogramContribution { @@ -1068,12 +1065,12 @@

3. were performed given the entry’s debug scope before the process contributions for a batching scope steps are performed given the entry’s batching scope.

4. Structures

-

4.1. Batching scope

+

4.1. Batching scope

A batching scope is a unique internal value that identifies which PAHistogramContributions should be sent in the same aggregatable report unless their debug details differ.

Unique internal value is not an exported definition. See infra/583.

-

4.2. Debug scope

+

4.2. Debug scope

A debug scope is a unique internal value that identifies which PAHistogramContributions should have their debug details affected by the presence or absence of a call to enableDebugMode() in the same period of execution. @@ -1097,7 +1094,7 @@

An unsigned 64-bit integer or null. The key must be null if enabled is false.

-

4.5. Contribution cache entry

+

4.5. Contribution cache entry

A contribution cache entry is a struct with the following items:
contribution @@ -1867,7 +1864,7 @@

POST - /session/{session id}/private-aggregation/localtestingmode + /session/{session id}/private-aggregation/localtestingmode

The remote end steps are:

@@ -1896,12 +1893,12 @@

SharedStoragePrivateAggregationConfig { - USVString aggregationCoordinatorOrigin; - USVString contextId; + USVString aggregationCoordinatorOrigin; + USVString contextId; }; partial dictionary SharedStorageRunOperationMethodOptions { - SharedStoragePrivateAggregationConfig privateAggregationConfig; + SharedStoragePrivateAggregationConfig privateAggregationConfig; };

The privateAggregation getter steps are @@ -2178,9 +2175,21 @@

Exposed=InterestGroupScriptRunnerGlobalScope, SecureContext] partial interface PrivateAggregation { undefined contributeToHistogramOnEvent( - DOMString event, PAExtendedHistogramContribution contribution); + DOMString event, PAExtendedHistogramContribution contribution); +}; + +dictionary AuctionReportBuyersConfig { + required bigint bucket; + required double scale; +}; + +partial dictionary AuctionAdConfig { + sequence<bigint> auctionReportBuyerKeys; + record<DOMString, AuctionReportBuyersConfig> auctionReportBuyers; }; +

Note: requiredSellerCapabilities is defined in the Protected + Audience spec.

Do we want to align naming with implementation?

The privateAggregation getter steps are to get the privateAggregation given this.

The contributeToHistogramOnEvent(DOMString @@ -2203,7 +2212,7 @@

baseValue"] is not a valid signal base value, throw a TypeError.

  • -

    If bucket["offset"] is not a bigint, throw a TypeError.

    +

    If bucket["offset"] is not a bigint, throw a TypeError.

  • Let value be contribution["value"].

    @@ -2214,7 +2223,7 @@

    baseValue"] is not a valid signal base value, throw a TypeError.

  • -

    If value["offset"] is a bigint, throw a TypeError.

    +

    If value["offset"] is a bigint, throw a TypeError.

  • Let batchingScope be null.

    @@ -2264,13 +2273,13 @@

    Consider accepting an array of contributions. [Issue #44]

    11.2. WebIDL modifications

    -

    The AuctionAdConfig and AuctionAdInterestGroup dictionaries are +

    The AuctionAdConfig and AuctionAdInterestGroup dictionaries are modified to add a new field:

    dictionary ProtectedAudiencePrivateAggregationConfig {
   USVString aggregationCoordinatorOrigin;
 };
 
-partial dictionary AuctionAdConfig {
+partial dictionary AuctionAdConfig {
   ProtectedAudiencePrivateAggregationConfig privateAggregationConfig;
 };
 
@@ -2278,6 +2287,8 @@ 
    ProtectedAudiencePrivateAggregationConfig privateAggregationConfig;
 };
    +

    Note: sellerCapabilities is defined in the Protected + Audience spec

    11.3. Structures

    11.3.1. Extending auction config

    Extend the auction config struct to add new fields:

    @@ -2290,15 +2301,23 @@

    batching scope map

    A map from a tuple consisting of an origin (an origin) and a coordinator (an aggregation -coordinator or null) to a batching scope.

    +coordinator) to a batching scope.

    Note: Does not include batching scopes for contributions conditional on non-reserved events.

    permissions policy state

    A permissions policy state.

    -
    seller Private Aggregation coordinator (default null) +
    seller Private Aggregation coordinator +
    +

    An aggregation coordinator. Defaults to the default aggregation +coordinator.

    +
    auction report buyer keys +
    +

    A map from buyer origins to bigints.

    +
    auction report buyers
    -

    An aggregation coordinator or null.

    +

    A map from strings to AuctionReportBuyersConfigs.

    +

    Consider replacing the strings above with specific enum types.

    • 11.3.2. Extending interest group

    Extend the interest group struct to add a new @@ -2379,7 +2398,7 @@

    A worklet function

    11.3.7. On event contribution cache

    - An on event contribution cache is a map from string to a list of on event contribution cache entries. + An on event contribution cache is a map from string to a list of on event contribution cache entries.

    11.3.8. Extending InterestGroupScriptRunnerGlobalScope

    Extend the global @@ -2439,9 +2458,57 @@

    validate and convert auction ad config steps are modified to add the following steps just before the last step ("Return auctionConfig"), renumbering the later step as appropriate:

    -
      +
      1. -

        If config[privateAggregationConfig] exists:

        +

        If config["auctionReportBuyerKeys"] exists:

        +
          +
        1. +

          Let interestGroupBuyers be auctionConfig’s interest group buyers.

          +
        2. +

          If interestGroupBuyers is null, set interestGroupBuyers to a new list.

          +
        3. +

          For each index of the range 0 to config["auctionReportBuyerKeys"]'s size, exclusive:

          +
            +
          1. +

            Let key be config["auctionReportBuyerKeys"][index].

            +
          2. +

            If key is not in the range [0, 2128−1], throw a TypeError.

            +
          3. +

            If index is equal to or greater than interestGroupBuyers’ size, continue.

            +

            Note: Continue is used (instead of break) to match validation logic for all given buyer keys.

            +
          4. +

            Let origin be interestGroupBuyers[index].

            +
          5. +

            Set auctionConfig’s auction report buyer +keys[origin] to key.

            +

            Check behavior when an origin is repeated in interestGroupBuyers.

            +
          +
        +
      2. +

        If config["auctionReportBuyers"] exists:

        +
          +
        1. +

          For each reportType → reportBuyerConfig of config["auctionReportBuyers"]:

          +
            +
          1. +

            If « "interestGroupCount", "bidCount", +"totalGenerateBidLatency", "totalSignalsFetchLatency" » does not contain reportType, continue.

            +

            Note: No error is thrown to allow forward compatibility if + additional report types are added later.

            +

            Should these strings be dash delimited?

            +
          2. +

            If reportBuyerConfig["bucket"] is not in the range [0, 2128−1], throw a TypeError.

            +

            Consider validating the case where the bucket used (after + summing) is too large. Currently, the implementation appears to + overflow. See protected-audience/1040.

            +
          3. +

            Set auctionConfig’s auction report +buyers[reportType] to reportBuyerConfig.

            +
          +
        +

        Handle auctionReportBuyerDebugModeConfig here.

        +
      3. +

        If config[privateAggregationConfig] exists:

        1. Let aggregationCoordinator be the result of obtaining the Private @@ -2465,8 +2532,6 @@

          Process the Private Aggregation contributions for an auction given auctionConfig and leadingBidInfo.

    -

    Need to handle auctionReportBuyers and auctionReportBuyerKeys here or - in the Protected Audience API spec.

    The evaluate a script steps are modified in two ways. First, we add the following steps after step 11 ("If evaluationStatus is an abrupt completion..."), renumbering later steps as appropriate:

    @@ -2497,21 +2562,10 @@

    seller Private Aggregation coordinator.

  • -

    Let batchingScopeMap be auctionConfig’s batching -scope map.

    +

    If aggregationCoordinator is null, set aggregationCoordinator to +the default aggregation coordinator.

  • -

    Let mapTuple = (origin, aggregationCoordinator).

    -
  • -

    If batchingScopeMap[mapTuple] does not exist:

    -
      -
    1. -

      Set batchingScopeMap[mapTuple] to a new batching scope.

      -
    2. -

      If aggregationCoordinator is not null, set the aggregation -coordinator for a batching scope given aggregationCoordinator and batchingScopeMap[mapTuple].

      -
    -
  • -

    Return batchingScopeMap[mapTuple].

    +

    Return the result of running get or create a batching scope given origin, aggregationCoordinator and auctionConfig.

    get debug scope steps
    @@ -2535,10 +2589,10 @@

    per-bid or seller on event contribution cache[ig].

  • -

    For each event → entries of onEventContributionCache:

    +

    For each event → entries of onEventContributionCache:

    1. -

      For each onEventEntry of entries:

      +

      For each onEventEntry of entries:

      1. If onEventEntry’s debug scope is debugScope, set onEventEntry’s debug details to debugDetails.

        @@ -2615,13 +2669,13 @@

        map whose keys are strings, jump to +

        If value is not a map whose keys are strings, jump to the step labeled Abort update.

      2. -

        If value["aggregationCoordinatorOrigin"] exists:

        +

        If value["aggregationCoordinatorOrigin"] exists:

        1. -

          If value["aggregationCoordinatorOrigin"] is not a string, +

          If value["aggregationCoordinatorOrigin"] is not a string, jump to the step labeled Abort update.

        2. Let aggregationCoordinator be the result of obtaining the Private @@ -2647,7 +2701,7 @@

          leading bid is not null, set winnerOrigin to leadingBidInfo’s leading bid’s interest group’s owner.

        3. -

          For each ig → onEventContributionCache of auctionConfig’s per-bid or seller on event contribution +

          For each ig → onEventContributionCache of auctionConfig’s per-bid or seller on event contribution cache:

          1. @@ -2657,7 +2711,7 @@

            owner.

          2. -

            For each event → entries of onEventContributionCache:

            +

            For each event → entries of onEventContributionCache:

            1. If event is "reserved.win" or does not start with "reserved.":

              @@ -2669,7 +2723,7 @@

              reserved.loss" and origin is winnerOrigin, return.

            2. -

              For each onEventEntry of entries:

              +

              For each onEventEntry of entries:

              1. Let filledInContribution be the result of filling in the @@ -2681,12 +2735,12 @@

                debug details in the FencedFrameConfig as appropriate.

                -

                Note: Each non-reserved event will have a different batching scope.

                +

                Note: Each non-reserved event will have a different batching scope.

                Once protected-audience/616 and any successors are landed, align integration and fill in fenced frame’s report a private aggregation event.

              2. -

                Continue.

                +

                Continue.

            3. Let entry be a new contribution cache entry with the items:

              @@ -2714,7 +2768,94 @@

              For each (origin, aggregationCoordinator) → batchingScope of auctionConfig’s batching scope map:

              +

              Let sellerBatchingScope be the result of getting or creating a batching scope given auctionConfig’s seller, auctionConfig’s seller Private Aggregation coordinator, and auctionConfig.

              +
            4. +

              Let auctionReportBuyersDebugScope be a new debug scope.

              +
            5. +

              For each reportType → reportBuyerConfig of auctionConfig’s auction report buyers:

              +
                +
              1. +

                For each buyerOrigin → buyerOffset of auctionConfig’s auction report buyer keys:

                +
                  +
                1. +

                  Let bucket be the sum of buyerOffset and reportBuyerConfig’s bucket.

                  +

                  Handle overflow here or in validation. See protected-audience/1040.

                  +
                2. +

                  Let value be the result (a double) of switching on reportType:

                  +
                  +
                  "interestGroupCount" +
                  +

                  The number of interest groups in the user agent's interest group set whose owner is buyerOrigin.

                  +
                  "bidCount" +
                  +

                  The number of valid bids generated by interest groups whose owner is buyerOrigin.

                  +
                  "totalGenerateBidLatency" +
                  +

                  The sum of execution time in milliseconds for all generateBid() calls in the auction for interest groups whose owner is buyerOrigin.

                  +
                  "totalSignalsFetchLatency" +
                  +

                  The total time spent fetching trusted buyer signals in +milliseconds, or 0 if the interest group didn’t fetch any +trusted signals.

                  +
                  None of the above values +
                  +

                  Assert: false

                  +

                  Note: This enum value is validated in validate and convert auction ad + config.

                  +
                  +

                  More formally spec the values here.

                  +
                3. +

                  Set value to the result of multiplying reportBuyerConfig’s scale with value.

                  +
                4. +

                  Set value to the maximum of 0.0 and value.

                  +
                5. +

                  Set value to the result of converting value to an integer by +truncating its fractional part.

                  +
                6. +

                  Set value to the minimum of value and 231−1.

                  +
                7. +

                  Let contribution be a new PAHistogramContribution with the +items:

                  +
                  +
                  bucket +
                  +

                  bucket

                  +
                  value +
                  +

                  value

                  +
                  +
                8. +

                  For each ig of the user agent's interest group set whose owner is buyerOrigin:

                  +
                    +
                  1. +

                    If seller capabilities don’t allow this reporting, continue.

                    +

                    Align behavior with seller capabilities handling once protected-audience/966 is resolved.

                    +
                  2. +

                    Let entry be a new contribution cache entry with the items:

                    +
                    +
                    contribution +
                    +

                    contribution

                    +
                    batching scope +
                    +

                    sellerBatchingScope

                    +
                    debug scope +
                    +

                    auctionReportBuyersDebugScope

                    +
                    +
                  3. +

                    Append entry to +the contribution cache.

                    +
                  +
                +
              +

              Handle auctionReportBuyerDebugModeConfig here, may need to pass an + override to mark a debug scope complete and possibly refactor to merge + handling with enableDebugMode().

              +
            6. +

              Mark a debug scope complete given auctionReportBuyersDebugScope.

              +
            7. +

              For each (origin, aggregationCoordinator) → batchingScope of auctionConfig’s batching scope map:

              1. Process contributions for a batching scope given batchingScope, origin, "protected-audience" and null.

                @@ -2722,8 +2863,28 @@

                Verify interaction with component auctions.

                Use [=map/For each=] where possible.

                +

                To get or create a batching scope given an origin origin, an aggregation coordinator aggregationCoordinator and an auction config auctionConfig, perform the following +steps. They return a batching scope.

                +
                  +
                1. +

                  Let batchingScopeMap be auctionConfig’s batching scope +map.

                  +
                2. +

                  Let tuple be (origin, aggregationCoordinator).

                  +
                3. +

                  If batchingScopeMap[tuple] does not exist:

                  +
                    +
                  1. +

                    Set batchingScopeMap[tuple] to a new batching scope.

                    +
                  2. +

                    If aggregationCoordinator is not null, set the aggregation +coordinator for a batching scope given aggregationCoordinator and batchingScopeMap[tuple].

                    +
                  +
                4. +

                  Return batchingScopeMap[tuple].

                  +

                To fill in the contribution given a PAExtendedHistogramContribution contribution and a leading bid info leadingBidInfo, perform the -following steps. They return a PAHistogramContribution.

                +following steps. They return a PAHistogramContribution.

                1. Let bucket be contribution["bucket"].

                  @@ -2736,12 +2897,12 @@

                  PASignalValue, set value to the result of filling in the signal value given value, 2128−1 and leadingBidInfo.

                2. -

                  Return a new PAHistogramContribution with the items:

                  +

                  Return a new PAHistogramContribution with the items:

                  -
                  bucket +
                  bucket

                  bucket

                  -
                  value +
                  value

                  value

                  @@ -2750,23 +2911,23 @@

                  leading bid info leadingBidInfo, perform the following steps. They return an integer.

                  1. -

                    Assert: value["baseValue"] is a valid signal base +

                    Assert: value["baseValue"] is a valid signal base value.

                  2. Let returnValue be the result of determining a signal’s numeric value given value["baseValue"] and leadingBidInfo.

                  3. -

                    If value["scale"] exists, set returnValue to +

                    If value["scale"] exists, set returnValue to the result of multiplying value["scale"] with returnValue.

                  4. Set returnValue to the result of converting returnValue to an integer by truncating its fractional part.

                  5. -

                    If value["offset"] exists, set returnValue to +

                    If value["offset"] exists, set returnValue to the result of adding returnValue to value["offset"].

                  6. Clamp returnValue to the range [0, maxAllowed] and return the result.

                  -

                  To determine a signal’s numeric value given a signal base value signalBaseValue and a leading bid info leadingBidInfo, perform the following steps. They return a double.

                  +

                  To determine a signal’s numeric value given a signal base value signalBaseValue and a leading bid info leadingBidInfo, perform the following steps. They return a double.

                  1. If signalBaseValue is "winning-bid":

                    @@ -2854,7 +3015,7 @@

                    Assert: false

                    +

                    Assert: false

                    Note: this enum value is validated in scoreAd().

                    Verify this once protected-audience/627 is resolved.

                    Once protected-audience/594 lands, update this mapping to align.

                    @@ -2882,17 +3043,17 @@

                    obtain the Private Aggregation coordinator given a ProtectedAudiencePrivateAggregationConfig config, perform the following -steps. They return an aggregation coordinator, null or a DOMException.

                    +steps. They return an aggregation coordinator, null or a DOMException.

                    1. If config["aggregationCoordinatorOrigin"] -does not exist, return null.

                      +does not exist, return null.

                    2. Return the result of obtaining the Private Aggregation coordinator given config["aggregationCoordinatorOrigin"].

                    To obtain the Private Aggregation coordinator given a USVString originString, -perform the following steps. They return an aggregation coordinator or a DOMException.

                    +perform the following steps. They return an aggregation coordinator or a DOMException.

                    1. Let url be the result of running the URL parser on originString.

                      @@ -2947,7 +3108,7 @@

                      12.1.5. Temporary debugging mechanism

                      -

                      The enableDebugMode() method allows for many +

                      The enableDebugMode() method allows for many of the protections of this API to be bypassed to ease testing and integration. Specifically, the contents of the payload, i.e. the histogram contributions, are revealed in the clear when the debug mode is enabled. Optionally, a debug key @@ -2955,7 +3116,7 @@

                      Tie enableDebugMode() to +

                      Tie enableDebugMode() to third-party cookie eligibility. [Issue #57]

                      12.1.6. Privacy parameters

                      The amount of information exposed by this API is a product of the privacy @@ -2969,8 +3130,8 @@

                      consume budget if permitted algorithm contain data about a user’s web activity. As such, user controls to delete this data are required, see clearing storage.

                      -

                      On the other hand, the context ID map, the contribution cache and the debug scope map only contain short-lived data tied to particular batching -scopes and debug scopes, so controls are not required.

                      +

                      On the other hand, the context ID map, the contribution cache and the debug scope map only contain short-lived data tied to particular batching +scopes and debug scopes, so controls are not required.

                      12.3. Reporting delay concerns

                      Delaying sending reports after API invocation can enable side-channel leakage in some situations.

                      @@ -3043,11 +3204,11 @@

                      13. Security considerations

                      This section is non-normative.

                      13.1. Same-origin policy

                      -

                      Writes to the aggregatable report cache, context ID map, contribution -cache and debug scope map are separated by the reporting origin and -the data included in any report with a given reporting origin are generated -with only data from that origin.

                      -

                      One notable exception is the consume budget if permitted algorithm which is implementation-defined and can consider contribution history from other origins. For example, the algorithm could consider all history from a +

                      Writes to the aggregatable report cache, context ID map, contribution +cache and debug scope map are separated by the reporting origin and +the data included in any report with a given reporting origin are generated +with only data from that origin.

                      +

                      One notable exception is the consume budget if permitted algorithm which is implementation-defined and can consider contribution history from other origins. For example, the algorithm could consider all history from a particular site. This would be an explicit relaxation of the same-origin policy as multiple origins would be able to influence the API’s behavior. One particular risk of these kinds of shared limits is the introduction of denial of @@ -3055,7 +3216,7 @@

                      same site. User agents should consider these tradeoffs when choosing the consume +security risk is lessened if the set of origins limited are all same site. User agents should consider these tradeoffs when choosing the consume budget if permitted algorithm.

                      13.2. Protecting the histogram contributions

                      As discussed above, the processing of @@ -3063,11 +3224,11 @@

                      HPKE, a modern encryption -specification. Additionally, each user agent is encouraged to require +specification. Additionally, each user agent is encouraged to require regular key rotation by the aggregation service. This limits the amount of data encrypted with the same key and thus the amount of vulnerable data in the case of a key being compromised.

                      -

                      While not specified here, each user agent is strongly encouraged to consider +

                      While not specified here, each user agent is strongly encouraged to consider the security of any aggregation service design before allowing its public keys to be returned by obtain the public key for encryption.

                      @@ -3124,6 +3285,11 @@

                      attempt to deliver a report, in § 8.3
                    2. attempt to queue reports for sending, in § 8.3
                    3. auction config, in § 11.3.8 +
                    4. auction report buyer keys, in § 11.3.1 +
                    5. auctionReportBuyerKeys, in § 11.1 +
                    6. auction report buyers, in § 11.3.1 +
                    7. auctionReportBuyers, in § 11.1 +
                    8. AuctionReportBuyersConfig, in § 11.1
                    9. automation local testing mode enabled, in § 9
                    10. baseValue, in § 11.1
                    11. Batching scope, in § 4 @@ -3138,6 +3304,7 @@

                      dict-member for AuctionReportBuyersConfig, in § 11.1
                    12. dict-member for PAExtendedHistogramContribution, in § 11.1
                    13. dict-member for PAHistogramContribution, in § 2 @@ -3189,6 +3356,7 @@

                      get a debug details, in § 8.1
                    14. get batching scope steps, in § 4.3
                    15. get debug scope steps, in § 4.3 +
                    16. get or create a batching scope, in § 11.5
                    17. get the privateAggregation, in § 8.1
                    18. highest-scoring-other-bid, in § 11.3.4
                    19. interest group, in § 11.3.9 @@ -3248,7 +3416,12 @@

                      report-result, in § 11.3.5
                    20. report time, in § 4.6
                    21. report-win, in § 11.3.5 -
                    22. scale, in § 11.1 +
                    23. + scale +
                    24. Scoping details, in § 4.2
                    25. scoping details, in § 2
                    26. score-ad, in § 11.3.5 @@ -3371,6 +3544,7 @@

                      append (for set)
                    27. assert
                    28. boolean +
                    29. break
                    30. byte sequence
                    31. concatenation
                    32. contain @@ -3445,7 +3619,10 @@

                      interest group
                    33. interest group (for InterestGroupBiddingScriptRunnerGlobalScope)
                    34. interest group (for generated bid) +
                    35. interest group buyers +
                    36. interest group set
                    37. interest group update +
                    38. interestGroupBuyers
                    39. joinAdInterestGroup(group)
                    40. k-anonymity threshold
                    41. leading bid @@ -3515,6 +3692,8 @@

                      getter steps
                    42. long
                    43. read only +
                    44. record +
                    45. sequence
                    46. this
                    47. throw
                    48. undefined @@ -3628,6 +3807,16 @@

                      I DOMString event, PAExtendedHistogramContribution contribution); }; +dictionary AuctionReportBuyersConfig { + required bigint bucket; + required double scale; +}; + +partial dictionary AuctionAdConfig { + sequence<bigint> auctionReportBuyerKeys; + record<DOMString, AuctionReportBuyersConfig> auctionReportBuyers; +}; + dictionary ProtectedAudiencePrivateAggregationConfig { USVString aggregationCoordinatorOrigin; }; @@ -3683,11 +3872,16 @@

                      Ensure errors are of an appropriate type, e.g. InvalidAccessError is deprecated. ↵

    • Consider accepting an array of contributions. [Issue #44] ↵
    +
    Consider replacing the strings above with specific enum types. ↵
    Can this value be used in reportWin() or reportResult()? ↵
    +
    Check behavior when an origin is repeated in interestGroupBuyers. ↵
    +
    Should these strings be dash delimited? ↵
    +
    Consider validating the case where the bucket used (after + summing) is too large. Currently, the implementation appears to + overflow. See protected-audience/1040. ↵
    +
    Handle auctionReportBuyerDebugModeConfig here. ↵
    Make all map indexing links (throughout the spec) where possible, i.e. matching this section. ↵
    -
    Need to handle auctionReportBuyers and auctionReportBuyerKeys here or - in the Protected Audience API spec. ↵
    Once protected-audience/615 is resolved, align the above monkey patch with how access to other functions is prevented in InterestGroupScriptRunnerGlobalScopes until the script’s initial execution is complete. ↵
    @@ -3696,6 +3890,12 @@

    Once protected-audience/616 and any successors are landed, align integration and fill in fenced frame’s report a private aggregation event. ↵ +
    Handle overflow here or in validation. See protected-audience/1040. ↵
    +
    More formally spec the values here. ↵
    +
    Align behavior with seller capabilities handling once protected-audience/966 is resolved. ↵
    +
    Handle auctionReportBuyerDebugModeConfig here, may need to pass an + override to mark a debug scope complete and possibly refactor to merge + handling with enableDebugMode(). ↵
    Verify interaction with component auctions. ↵
    Use [=map/For each=] where possible. ↵
    Consider disallowing this in the latter two worklet functions. ↵
    @@ -3707,698 +3907,8 @@

    Tie enableDebugMode() to third-party cookie eligibility. [Issue #57] ↵ - - - + + - \ No newline at end of file