Added validation that vendor list is not deleted in requested GVL

Author: Lightwood13

src/main/java/org/prebid/server/privacy/gdpr/vendorlist/LiveVendorListService.java

@@ -93,17 +93,12 @@ private VendorList processResponse(HttpClientResponse response) {
     Set<Integer> extractDeletedVendorIds(VendorList vendorList) {
         final Instant now = clock.instant();
         return vendorList.getVendors().values().stream()
-                .filter(vendor -> isDeletedAt(vendor, now))
+                .filter(vendor -> VendorListUtil.vendorIsDeletedAt(vendor, now))
                 .map(Vendor::getId)
                 .filter(Objects::nonNull)
                 .collect(Collectors.toUnmodifiableSet());
     }
 
-    private static boolean isDeletedAt(Vendor vendor, Instant now) {
-        final Instant deletedDate = vendor.getDeletedDate();
-        return deletedDate != null && deletedDate.isBefore(now);
-    }
-
     private Void updateDeletedVendorIds(Set<Integer> ids) {
         deletedVendorIds = ids;
         metrics.updatePrivacyTcfVendorListLatestOkMetric();

src/main/java/org/prebid/server/privacy/gdpr/vendorlist/VendorListUtil.java

@@ -9,6 +9,7 @@
 import org.prebid.server.privacy.gdpr.vendorlist.proto.VendorList;
 
 import java.io.IOException;
+import java.time.Instant;
 import java.util.Collection;
 
 public class VendorListUtil {
@@ -47,4 +48,9 @@ private static boolean vendorsAreValid(Collection<Vendor> vendors) {
                         && vendor.getFeatures() != null
                         && vendor.getSpecialFeatures() != null);
     }
+
+    public static boolean vendorIsDeletedAt(Vendor vendor, Instant now) {
+        final Instant deletedDate = vendor.getDeletedDate();
+        return deletedDate != null && deletedDate.isBefore(now);
+    }
 }

src/main/java/org/prebid/server/privacy/gdpr/vendorlist/VersionedVendorListService.java

@@ -4,6 +4,8 @@
 import io.vertx.core.Future;
 import org.prebid.server.privacy.gdpr.vendorlist.proto.Vendor;
 
+import java.time.Clock;
+import java.time.Instant;
 import java.util.Map;
 import java.util.Objects;
 import java.util.stream.Collectors;
@@ -13,14 +15,17 @@ public class VersionedVendorListService {
     private final VendorListService vendorListServiceV2;
     private final VendorListService vendorListServiceV3;
     private final LiveVendorListService liveVendorListService;
+    private final Clock clock;
 
     public VersionedVendorListService(VendorListService vendorListServiceV2,
                                       VendorListService vendorListServiceV3,
-                                      LiveVendorListService liveVendorListService) {
+                                      LiveVendorListService liveVendorListService,
+                                      Clock clock) {
 
         this.vendorListServiceV2 = Objects.requireNonNull(vendorListServiceV2);
         this.vendorListServiceV3 = Objects.requireNonNull(vendorListServiceV3);
         this.liveVendorListService = Objects.requireNonNull(liveVendorListService);
+        this.clock = Objects.requireNonNull(clock);
     }
 
     public Future<Map<Integer, Vendor>> forConsent(TCString consent) {
@@ -35,7 +40,9 @@ public Future<Map<Integer, Vendor>> forConsent(TCString consent) {
     }
 
     private Map<Integer, Vendor> filterDeletedVendors(Map<Integer, Vendor> vendors) {
+        Instant now = clock.instant();
         return vendors.entrySet().stream()
+                .filter(entry -> !VendorListUtil.vendorIsDeletedAt(entry.getValue(), now))
                 .filter(entry -> !liveVendorListService.isDeleted(entry.getKey()))
                 .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
     }

src/main/java/org/prebid/server/spring/config/PrivacyServiceConfiguration.java

@@ -171,10 +171,11 @@ LiveVendorListService liveVendorListService(
     @Bean
     VersionedVendorListService versionedVendorListService(VendorListService vendorListServiceV2,
                                                           VendorListService vendorListServiceV3,
-                                                          LiveVendorListService liveVendorListService) {
+                                                          LiveVendorListService liveVendorListService,
+                                                          Clock clock) {
 
         return new VersionedVendorListService(
-                vendorListServiceV2, vendorListServiceV3, liveVendorListService);
+                vendorListServiceV2, vendorListServiceV3, liveVendorListService, clock);
     }
 
     @Bean

src/test/java/org/prebid/server/privacy/gdpr/vendorlist/VersionedVendorListServiceTest.java

@@ -10,6 +10,9 @@
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.prebid.server.privacy.gdpr.vendorlist.proto.Vendor;
 
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneOffset;
 import java.util.Map;
 import java.util.concurrent.ThreadLocalRandom;
 
@@ -23,6 +26,8 @@
 @ExtendWith(MockitoExtension.class)
 public class VersionedVendorListServiceTest {
 
+    private static final Instant NOW = Instant.parse("2024-06-01T12:00:00Z");
+
     private VersionedVendorListService target;
 
     @Mock
@@ -35,7 +40,7 @@ public class VersionedVendorListServiceTest {
     @BeforeEach
     public void setUp() {
         target = new VersionedVendorListService(
-                vendorListServiceV2, vendorListServiceV3, liveVendorListService);
+                vendorListServiceV2, vendorListServiceV3, liveVendorListService, Clock.fixed(NOW, ZoneOffset.UTC));
     }
 
     @Test
@@ -74,6 +79,33 @@ public void versionedVendorListServiceShouldTreatTcfPolicyGreaterOrEqualFourAsVe
         verify(vendorListServiceV3).forVersion(12);
     }
 
+    @Test
+    public void forConsentShouldRemoveVendorsMarkedDeletedInRequestedGvl() {
+        // given
+        final Vendor deletedVendor = Vendor.empty(1).toBuilder()
+                .deletedDate(Instant.parse("2024-01-01T00:00:00Z"))
+                .build();
+        final Vendor activeVendor = Vendor.empty(52);
+        final Map<Integer, Vendor> vendorList = Map.of(1, deletedVendor, 52, activeVendor);
+        final TCString consent = TCStringEncoder.newBuilder()
+                .version(2)
+                .tcfPolicyVersion(3)
+                .vendorListVersion(12)
+                .toTCString();
+
+        given(vendorListServiceV2.forVersion(anyInt())).willReturn(Future.succeededFuture(vendorList));
+        given(liveVendorListService.isDeleted(anyInt())).willReturn(false);
+
+        // when and then
+        assertThat(target.forConsent(consent))
+                .isSucceeded()
+                .unwrap()
+                .satisfies(result -> {
+                    assertThat(result).containsOnlyKeys(52);
+                    assertThat(result.get(52)).isSameAs(activeVendor);
+                });
+    }
+
     @Test
     public void forConsentShouldRemoveVendorsMarkedDeletedInLiveGvl() {
         // given