sch-UID2-5966 added identity environment scope to remote config (#1980)

sophia-chen-ttd · Release Workflow · web-flow · commit afec898a77cd · 2025-09-03T16:22:32.000+10:00
* added identity environment scope to remote config

* made public property private

* [CI Pipeline] Released Snapshot version: 5.57.19-alpha-450-SNAPSHOT

---------

Co-authored-by: Release Workflow &lt;unifiedid-admin+release@thetradedesk.com&gt;
diff --git a/conf/local-config.json b/conf/local-config.json
@@ -42,5 +42,6 @@
   "encrypted_files": false,
   "disable_optout_token": true,
   "enable_remote_config": false,
-  "uid_instance_id_prefix": "local-operator"
+  "uid_instance_id_prefix": "local-operator",
+  "identity_environment": "test"
 }
diff --git a/conf/local-e2e-docker-private-config.json b/conf/local-e2e-docker-private-config.json
@@ -32,5 +32,6 @@
   "salts_expired_shutdown_hours": 12,
   "operator_type": "private",
   "enable_remote_config": false,
-  "uid_instance_id_prefix": "local-private-operator"
+  "uid_instance_id_prefix": "local-private-operator",
+  "identity_environment": "test"
 }
diff --git a/conf/local-e2e-docker-public-config.json b/conf/local-e2e-docker-public-config.json
@@ -39,5 +39,6 @@
   "operator_type": "public",
   "disable_optout_token": true,
   "enable_remote_config": false,
-  "uid_instance_id_prefix": "local-public-operator"
+  "uid_instance_id_prefix": "local-public-operator",
+  "identity_environment": "test"
 }
diff --git a/conf/local-e2e-private-config.json b/conf/local-e2e-private-config.json
@@ -43,5 +43,6 @@
   "salts_expired_shutdown_hours": 12,
   "operator_type": "private",
   "enable_remote_config": false,
-  "uid_instance_id_prefix": "local-private-operator"
+  "uid_instance_id_prefix": "local-private-operator",
+  "identity_environment": "test"
 }
diff --git a/conf/local-e2e-public-config.json b/conf/local-e2e-public-config.json
@@ -45,5 +45,6 @@
   "operator_type": "public",
   "disable_optout_token": true,
   "enable_remote_config": false,
-  "uid_instance_id_prefix": "local-public-operator"
+  "uid_instance_id_prefix": "local-public-operator",
+  "identity_environment": "test"
 }
diff --git a/conf/validator-latest-e2e-docker-public-config.json b/conf/validator-latest-e2e-docker-public-config.json
@@ -44,5 +44,6 @@
   },
   "disable_optout_token": true,
   "enable_remote_config": false,
-  "uid_instance_id_prefix": "local-public-operator"
+  "uid_instance_id_prefix": "local-public-operator",
+  "identity_environment": "test"
 }
diff --git a/pom.xml b/pom.xml
@@ -7,7 +7,7 @@
     <groupId>com.uid2</groupId>
     <artifactId>uid2-operator</artifactId>
     <version>5.57.20</version>
-
+  
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <vertx.version>4.5.18</vertx.version>
diff --git a/src/main/java/com/uid2/operator/Const.java b/src/main/java/com/uid2/operator/Const.java
@@ -36,5 +36,7 @@ public class Config extends com.uid2.shared.Const.Config {
         public static final String DisableOptoutTokenProp = "disable_optout_token";
         public static final String EnableRemoteConfigProp = "enable_remote_config";
         public static final String RuntimeConfigMetadataPathProp = "runtime_config_metadata_path";
+
+        public static final String IdentityEnvironmentProp = "identity_environment";
     }
 }
diff --git a/src/main/java/com/uid2/operator/model/IdentityEnvironment.java b/src/main/java/com/uid2/operator/model/IdentityEnvironment.java
@@ -0,0 +1,37 @@
+package com.uid2.operator.model;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.uid2.operator.vertx.ClientInputValidationException;
+
+public enum IdentityEnvironment {
+    TEST(0), INTEG(1), PROD(2);
+
+    private final int value;
+
+    IdentityEnvironment(int value) {
+        this.value = value;
+    }
+
+    public int getValue() {
+        return value;
+    }
+
+    public static IdentityEnvironment fromValue(int value) {
+        return switch (value) {
+            case 0 -> TEST;
+            case 1 -> INTEG;
+            case 2 -> PROD;
+            default -> throw new ClientInputValidationException("Invalid valid for IdentityEnvironment: " + value);
+        };
+    }
+
+    @JsonCreator
+    public static IdentityEnvironment fromString(String value) {
+        return switch (value.toLowerCase()) {
+            case "test" -> TEST;
+            case "integ" -> INTEG;
+            case "prod" -> PROD;
+            default -> throw new ClientInputValidationException("Invalid valid for IdentityEnvironment: " + value);
+        };
+    }
+}
diff --git a/src/main/java/com/uid2/operator/model/IdentityRequest.java b/src/main/java/com/uid2/operator/model/IdentityRequest.java
@@ -4,15 +4,18 @@ public final class IdentityRequest {
     public final PublisherIdentity publisherIdentity;
     public final UserIdentity userIdentity;
     public final OptoutCheckPolicy optoutCheckPolicy;
+    public final IdentityEnvironment identityEnvironment;
 
     public IdentityRequest(
             PublisherIdentity publisherIdentity,
             UserIdentity userIdentity,
-            OptoutCheckPolicy tokenGeneratePolicy)
+            OptoutCheckPolicy tokenGeneratePolicy,
+            IdentityEnvironment identityEnvironment)
     {
         this.publisherIdentity = publisherIdentity;
         this.userIdentity = userIdentity;
         this.optoutCheckPolicy = tokenGeneratePolicy;
+        this.identityEnvironment = identityEnvironment;
     }
 
     public boolean shouldCheckOptOut() {
diff --git a/src/main/java/com/uid2/operator/model/MapRequest.java b/src/main/java/com/uid2/operator/model/MapRequest.java
@@ -6,15 +6,18 @@ public final class MapRequest {
     public final UserIdentity userIdentity;
     public final OptoutCheckPolicy optoutCheckPolicy;
     public final Instant asOf;
+    public final IdentityEnvironment identityEnvironment;
 
     public MapRequest(
             UserIdentity userIdentity,
             OptoutCheckPolicy optoutCheckPolicy,
-            Instant asOf)
+            Instant asOf,
+            IdentityEnvironment identityEnvironment)
     {
         this.userIdentity = userIdentity;
         this.optoutCheckPolicy = optoutCheckPolicy;
         this.asOf = asOf;
+        this.identityEnvironment = identityEnvironment;
     }
 
     public boolean shouldCheckOptOut() {
diff --git a/src/main/java/com/uid2/operator/service/IUIDOperatorService.java b/src/main/java/com/uid2/operator/service/IUIDOperatorService.java
@@ -13,18 +13,18 @@ public interface IUIDOperatorService {
 
     IdentityTokens generateIdentity(IdentityRequest request, Duration refreshIdentityAfter, Duration refreshExpiresAfter, Duration identityExpiresAfter);
 
-    RefreshResponse refreshIdentity(RefreshToken token, Duration refreshIdentityAfter, Duration refreshExpiresAfter, Duration identityExpiresAfter);
+    RefreshResponse refreshIdentity(RefreshToken token, Duration refreshIdentityAfter, Duration refreshExpiresAfter, Duration identityExpiresAfter, IdentityEnvironment env);
 
     MappedIdentity mapIdentity(MapRequest request);
 
     @Deprecated
-    MappedIdentity map(UserIdentity userIdentity, Instant asOf);
+    MappedIdentity map(UserIdentity userIdentity, Instant asOf, IdentityEnvironment env);
 
     List<SaltEntry> getModifiedBuckets(Instant sinceTimestamp);
 
-    void invalidateTokensAsync(UserIdentity userIdentity, Instant asOf, String uidTraceId, Handler<AsyncResult<Instant>> handler);
+    void invalidateTokensAsync(UserIdentity userIdentity, Instant asOf, String uidTraceId, IdentityEnvironment env, Handler<AsyncResult<Instant>> handler);
 
-    boolean advertisingTokenMatches(String advertisingToken, UserIdentity userIdentity, Instant asOf);
+    boolean advertisingTokenMatches(String advertisingToken, UserIdentity userIdentity, Instant asOf, IdentityEnvironment env);
 
     Instant getLatestOptoutEntry(UserIdentity userIdentity, Instant asOf);
 }
diff --git a/src/main/java/com/uid2/operator/service/UIDOperatorService.java b/src/main/java/com/uid2/operator/service/UIDOperatorService.java
@@ -103,12 +103,12 @@ public IdentityTokens generateIdentity(IdentityRequest request, Duration refresh
         if (request.shouldCheckOptOut() && getGlobalOptOutResult(firstLevelHashIdentity, false).isOptedOut()) {
             return IdentityTokens.LogoutToken;
         } else {
-            return this.generateIdentity(request.publisherIdentity, firstLevelHashIdentity, refreshIdentityAfter, refreshExpiresAfter, identityExpiresAfter);
+            return this.generateIdentity(request.publisherIdentity, firstLevelHashIdentity, refreshIdentityAfter, refreshExpiresAfter, identityExpiresAfter, request.identityEnvironment);
         }
     }
 
     @Override
-    public RefreshResponse refreshIdentity(RefreshToken token, Duration refreshIdentityAfter, Duration refreshExpiresAfter, Duration identityExpiresAfter) {
+    public RefreshResponse refreshIdentity(RefreshToken token, Duration refreshIdentityAfter, Duration refreshExpiresAfter, Duration identityExpiresAfter, IdentityEnvironment env) {
         this.validateTokenDurations(refreshIdentityAfter, refreshExpiresAfter, identityExpiresAfter);
         // should not be possible as different scopes should be using different keys, but just in case
         if (token.userIdentity.identityScope != this.identityScope) {
@@ -135,7 +135,7 @@ public RefreshResponse refreshIdentity(RefreshToken token, Duration refreshIdent
             final Duration durationSinceLastRefresh = Duration.between(token.createdAt, now);
 
             if (!optedOut) {
-                IdentityTokens identityTokens = this.generateIdentity(token.publisherIdentity, token.userIdentity, refreshIdentityAfter, refreshExpiresAfter, identityExpiresAfter);
+                IdentityTokens identityTokens = this.generateIdentity(token.publisherIdentity, token.userIdentity, refreshIdentityAfter, refreshExpiresAfter, identityExpiresAfter, env);
 
                 return RefreshResponse.createRefreshedResponse(identityTokens, durationSinceLastRefresh, isCstg);
             } else {
@@ -154,14 +154,14 @@ public MappedIdentity mapIdentity(MapRequest request) {
         if (request.shouldCheckOptOut() && getGlobalOptOutResult(firstLevelHashIdentity, false).isOptedOut()) {
             return MappedIdentity.LogoutIdentity;
         } else {
-            return getMappedIdentity(firstLevelHashIdentity, request.asOf);
+            return getMappedIdentity(firstLevelHashIdentity, request.asOf, request.identityEnvironment);
         }
     }
 
     @Override
-    public MappedIdentity map(UserIdentity userIdentity, Instant asOf) {
+    public MappedIdentity map(UserIdentity userIdentity, Instant asOf, IdentityEnvironment env) {
         final UserIdentity firstLevelHashIdentity = getFirstLevelHashIdentity(userIdentity, asOf);
-        return getMappedIdentity(firstLevelHashIdentity, asOf);
+        return getMappedIdentity(firstLevelHashIdentity, asOf, env);
     }
 
     @Override
@@ -180,9 +180,9 @@ private ISaltProvider.ISaltSnapshot getSaltProviderSnapshot(Instant asOf) {
     }
 
     @Override
-    public void invalidateTokensAsync(UserIdentity userIdentity, Instant asOf, String uidTraceId, Handler<AsyncResult<Instant>> handler) {
+    public void invalidateTokensAsync(UserIdentity userIdentity, Instant asOf, String uidTraceId, IdentityEnvironment env,  Handler<AsyncResult<Instant>> handler) {
         final UserIdentity firstLevelHashIdentity = getFirstLevelHashIdentity(userIdentity, asOf);
-        final MappedIdentity mappedIdentity = getMappedIdentity(firstLevelHashIdentity, asOf);
+        final MappedIdentity mappedIdentity = getMappedIdentity(firstLevelHashIdentity, asOf, env);
 
         this.optOutStore.addEntry(firstLevelHashIdentity, mappedIdentity.advertisingId, uidTraceId, this.uidInstanceIdProvider.getInstanceId(), r -> {
             if (r.succeeded()) {
@@ -194,9 +194,9 @@ public void invalidateTokensAsync(UserIdentity userIdentity, Instant asOf, Strin
     }
 
     @Override
-    public boolean advertisingTokenMatches(String advertisingToken, UserIdentity userIdentity, Instant asOf) {
+    public boolean advertisingTokenMatches(String advertisingToken, UserIdentity userIdentity, Instant asOf, IdentityEnvironment env) {
         final UserIdentity firstLevelHashIdentity = getFirstLevelHashIdentity(userIdentity, asOf);
-        final MappedIdentity mappedIdentity = getMappedIdentity(firstLevelHashIdentity, asOf);
+        final MappedIdentity mappedIdentity = getMappedIdentity(firstLevelHashIdentity, asOf, env);
 
         final AdvertisingToken token = this.encoder.decodeAdvertisingToken(advertisingToken);
         return Arrays.equals(mappedIdentity.advertisingId, token.userIdentity.id);
@@ -221,7 +221,7 @@ private byte[] getFirstLevelHash(byte[] identityHash, Instant asOf) {
         return TokenUtils.getFirstLevelHash(identityHash, getSaltProviderSnapshot(asOf).getFirstLevelSalt());
     }
 
-    private MappedIdentity getMappedIdentity(UserIdentity firstLevelHashIdentity, Instant asOf) {
+    private MappedIdentity getMappedIdentity(UserIdentity firstLevelHashIdentity, Instant asOf, IdentityEnvironment env) {
         final SaltEntry rotatingSalt = getSaltProviderSnapshot(asOf).getRotatingSalt(firstLevelHashIdentity.id);
         final byte[] advertisingId = getAdvertisingId(firstLevelHashIdentity, rotatingSalt.currentSalt());
         final byte[] previousAdvertisingId = getPreviousAdvertisingId(firstLevelHashIdentity, rotatingSalt, asOf);
@@ -259,10 +259,10 @@ private long getRefreshFrom(SaltEntry rotatingSalt, Instant asOf) {
         return refreshFrom;
     }
 
-    private IdentityTokens generateIdentity(PublisherIdentity publisherIdentity, UserIdentity firstLevelHashIdentity, Duration refreshIdentityAfter, Duration refreshExpiresAfter, Duration identityExpiresAfter) {
+    private IdentityTokens generateIdentity(PublisherIdentity publisherIdentity, UserIdentity firstLevelHashIdentity, Duration refreshIdentityAfter, Duration refreshExpiresAfter, Duration identityExpiresAfter, IdentityEnvironment env) {
         final Instant nowUtc = EncodingUtils.NowUTCMillis(this.clock);
 
-        final MappedIdentity mappedIdentity = getMappedIdentity(firstLevelHashIdentity, nowUtc);
+        final MappedIdentity mappedIdentity = getMappedIdentity(firstLevelHashIdentity, nowUtc, env);
         final UserIdentity advertisingIdentity = new UserIdentity(firstLevelHashIdentity.identityScope, firstLevelHashIdentity.identityType,
                 mappedIdentity.advertisingId, firstLevelHashIdentity.privacyBits, firstLevelHashIdentity.establishedAt, nowUtc);
 
diff --git a/src/main/java/com/uid2/operator/store/RuntimeConfig.java b/src/main/java/com/uid2/operator/store/RuntimeConfig.java
@@ -6,6 +6,7 @@
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
 import com.fasterxml.jackson.databind.annotation.JsonNaming;
 import com.fasterxml.jackson.databind.annotation.JsonPOJOBuilder;
+import com.uid2.operator.model.IdentityEnvironment;
 
 @JsonDeserialize(builder = RuntimeConfig.Builder.class)
 public class RuntimeConfig {
@@ -15,6 +16,7 @@ public class RuntimeConfig {
     private final Integer sharingTokenExpirySeconds;
     private final Integer maxBidstreamLifetimeSeconds;
     private final Integer maxSharingLifetimeSeconds;
+    private final IdentityEnvironment identityEnvironment;
 
     public Integer getIdentityTokenExpiresAfterSeconds() {
         return identityTokenExpiresAfterSeconds;
@@ -48,17 +50,23 @@ public Integer getSharingTokenExpirySeconds() {
         return sharingTokenExpirySeconds;
     }
 
+    public IdentityEnvironment getIdentityEnvironment() {
+        return identityEnvironment;
+    }
+
     private RuntimeConfig(Builder builder) {
         this.identityTokenExpiresAfterSeconds = builder.identityTokenExpiresAfterSeconds;
         this.refreshTokenExpiresAfterSeconds = builder.refreshTokenExpiresAfterSeconds;
         this.refreshIdentityTokenAfterSeconds = builder.refreshIdentityTokenAfterSeconds;
         this.sharingTokenExpirySeconds = builder.sharingTokenExpirySeconds;
         this.maxBidstreamLifetimeSeconds = builder.maxBidstreamLifetimeSeconds;
         this.maxSharingLifetimeSeconds = builder.maxSharingLifetimeSeconds;
+        this.identityEnvironment = builder.identityEnvironment;
 
         validateIdentityRefreshTokens();
         validateBidstreamLifetime();
         validateSharingTokenExpiry();
+        validateIdentityEnvironment();
     }
     
     public RuntimeConfig.Builder toBuilder() {
@@ -68,7 +76,8 @@ public RuntimeConfig.Builder toBuilder() {
                 .withRefreshIdentityTokenAfterSeconds(this.refreshIdentityTokenAfterSeconds)
                 .withSharingTokenExpirySeconds(this.sharingTokenExpirySeconds)
                 .withMaxBidstreamLifetimeSeconds(this.maxBidstreamLifetimeSeconds)
-                .withMaxSharingLifetimeSeconds(this.maxSharingLifetimeSeconds);
+                .withMaxSharingLifetimeSeconds(this.maxSharingLifetimeSeconds)
+                .withIdentityEnvironment(this.identityEnvironment);
     }
     
     private void validateIdentityRefreshTokens() {
@@ -104,6 +113,12 @@ private void validateSharingTokenExpiry() {
             throw new IllegalArgumentException("sharing_token_expiry_seconds is required");
         }
     }
+
+    private void validateIdentityEnvironment() {
+        if (this.identityEnvironment == null) {
+            throw new IllegalArgumentException("identity_environment is required");
+        }
+    }
     
     @JsonPOJOBuilder
     @JsonIgnoreProperties(ignoreUnknown = true)
@@ -121,6 +136,8 @@ public static class Builder {
         private Integer maxBidstreamLifetimeSeconds;
         @JsonProperty
         private Integer maxSharingLifetimeSeconds;
+        @JsonProperty
+        private IdentityEnvironment identityEnvironment;
 
         public Builder withIdentityTokenExpiresAfterSeconds(Integer identityTokenExpiresAfterSeconds) {
             this.identityTokenExpiresAfterSeconds = identityTokenExpiresAfterSeconds;
@@ -152,6 +169,11 @@ public Builder withMaxSharingLifetimeSeconds(Integer maxSharingLifetimeSeconds)
             return this;
         }
 
+        public Builder withIdentityEnvironment(IdentityEnvironment identityEnvironment) {
+            this.identityEnvironment = identityEnvironment;
+            return this;
+        }
+
         public RuntimeConfig build() {
             return new RuntimeConfig(this);
         }
diff --git a/src/main/java/com/uid2/operator/vertx/UIDOperatorVerticle.java b/src/main/java/com/uid2/operator/vertx/UIDOperatorVerticle.java
diff --git a/src/test/java/com/uid2/operator/RuntimeConfigStoreTest.java b/src/test/java/com/uid2/operator/RuntimeConfigStoreTest.java
diff --git a/src/test/java/com/uid2/operator/UIDOperatorServiceTest.java b/src/test/java/com/uid2/operator/UIDOperatorServiceTest.java
diff --git a/src/test/java/com/uid2/operator/UIDOperatorVerticleTest.java b/src/test/java/com/uid2/operator/UIDOperatorVerticleTest.java
diff --git a/src/test/java/com/uid2/operator/benchmark/IdentityMapBenchmark.java b/src/test/java/com/uid2/operator/benchmark/IdentityMapBenchmark.java
diff --git a/src/test/java/com/uid2/operator/benchmark/TokenEndecBenchmark.java b/src/test/java/com/uid2/operator/benchmark/TokenEndecBenchmark.java
diff --git a/src/test/java/com/uid2/operator/store/RuntimeConfigTest.java b/src/test/java/com/uid2/operator/store/RuntimeConfigTest.java

Original file line number	Diff line number	Diff line change
`@@ -42,5 +42,6 @@`
`42`	`42`	`"encrypted_files": false,`
`43`	`43`	`"disable_optout_token": true,`
`44`	`44`	`"enable_remote_config": false,`
`45`		`- "uid_instance_id_prefix": "local-operator"`
	`45`	`+ "uid_instance_id_prefix": "local-operator",`
	`46`	`+ "identity_environment": "test"`
`46`	`47`	`}`
Original file line number	Diff line number	Diff line change
`@@ -32,5 +32,6 @@`
`32`	`32`	`"salts_expired_shutdown_hours": 12,`
`33`	`33`	`"operator_type": "private",`
`34`	`34`	`"enable_remote_config": false,`
`35`		`- "uid_instance_id_prefix": "local-private-operator"`
	`35`	`+ "uid_instance_id_prefix": "local-private-operator",`
	`36`	`+ "identity_environment": "test"`
`36`	`37`	`}`
Original file line number	Diff line number	Diff line change
`@@ -39,5 +39,6 @@`
`39`	`39`	`"operator_type": "public",`
`40`	`40`	`"disable_optout_token": true,`
`41`	`41`	`"enable_remote_config": false,`
`42`		`- "uid_instance_id_prefix": "local-public-operator"`
	`42`	`+ "uid_instance_id_prefix": "local-public-operator",`
	`43`	`+ "identity_environment": "test"`
`43`	`44`	`}`
Original file line number	Diff line number	Diff line change
`@@ -43,5 +43,6 @@`
`43`	`43`	`"salts_expired_shutdown_hours": 12,`
`44`	`44`	`"operator_type": "private",`
`45`	`45`	`"enable_remote_config": false,`
`46`		`- "uid_instance_id_prefix": "local-private-operator"`
	`46`	`+ "uid_instance_id_prefix": "local-private-operator",`
	`47`	`+ "identity_environment": "test"`
`47`	`48`	`}`
Original file line number	Diff line number	Diff line change
`@@ -45,5 +45,6 @@`
`45`	`45`	`"operator_type": "public",`
`46`	`46`	`"disable_optout_token": true,`
`47`	`47`	`"enable_remote_config": false,`
`48`		`- "uid_instance_id_prefix": "local-public-operator"`
	`48`	`+ "uid_instance_id_prefix": "local-public-operator",`
	`49`	`+ "identity_environment": "test"`
`49`	`50`	`}`
Original file line number	Diff line number	Diff line change
`@@ -44,5 +44,6 @@`
`44`	`44`	`},`
`45`	`45`	`"disable_optout_token": true,`
`46`	`46`	`"enable_remote_config": false,`
`47`		`- "uid_instance_id_prefix": "local-public-operator"`
	`47`	`+ "uid_instance_id_prefix": "local-public-operator",`
	`48`	`+ "identity_environment": "test"`
`48`	`49`	`}`
Original file line number	Diff line number	Diff line change
`@@ -36,5 +36,7 @@ public class Config extends com.uid2.shared.Const.Config {`
`36`	`36`	`public static final String DisableOptoutTokenProp = "disable_optout_token";`
`37`	`37`	`public static final String EnableRemoteConfigProp = "enable_remote_config";`
`38`	`38`	`public static final String RuntimeConfigMetadataPathProp = "runtime_config_metadata_path";`
	`39`	`+`
	`40`	`+ public static final String IdentityEnvironmentProp = "identity_environment";`
`39`	`41`	`}`
`40`	`42`	`}`