Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

tab-ads

Package Overview
Dependencies
Maintainers
1
Versions
56
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

tab-ads

An NPM package to manage ads logic for Tab for a Cause

  • 1.1.24
  • latest
  • Source
  • npm
  • Socket score

Version published
Maintainers
1
Created
Source

Build Status codecov npm

tab-ads

A module to manage ads on Tab for a Cause

Overview

The goal of this module is to move ads-specific Tab for a Cause logic out of the app code. It is responsible for:

  • defining the ad units that are available to show on Tab for a Cause
  • managing each bidder partner's configuration
  • calling for bids, ending the auction, fetching ads from the ad server, and displaying them
  • providing information on the winning ad for each ad slot

Some of the motivation for this module is to handle bidder partners that are not part of the Prebid ecosystem or need to run outside Prebid. (In a way, it's like a mini Prebid in which Prebid is one of the bidder partners.)

API

fetchAds(config): fetch ads for specified ad units. See config.js for config options.

AdComponent: returns a React AdComponent, which handles ad display.

getAvailableAdUnits: returns an object of available ad units (leaderboard, rectangleAdPrimary, and rectangleAdSecondary). See getAvailableAdUnits.js.

In addition, the module sets window.tabAds with two properties useful for debugging:

  • getAllWinningBids: a function that returns information on the winning ad for each ad slot
  • adDataStore: storage of each bidder partner's raw and formatted bid responses, as well as Google Ad Manager's slot events

HTML Tags

We must include the following scripts immediately after the <body> tag and before calling tab-ads:

<!--
  Google Publisher Tag
-->
<script type="text/javascript">/* eslint-disable */
  var googletag = window.googletag || {}
  googletag.cmd = googletag.cmd || []
  googletag.cmd.push(() => {
    googletag.pubads().disableInitialLoad()
    googletag.pubads().setTagForChildDirectedTreatment(0)
  })
  var gads = document.createElement('script')
  gads.async = true
  gads.type = 'text/javascript'
  var useSSL = document.location.protocol === 'https:'
  gads.src = (useSSL ? 'https:' : 'http:') +
    '//www.googletagservices.com/tag/js/gpt.js'
  var head = document.getElementsByTagName('head')[0]
  head.appendChild(gads)
</script>

<!--
  Amazon apstag
-->
<script>/* eslint-disable */
try {
  !function(a9,a,p,s,t,A,g){if(a[a9])return;function q(c,r){a[a9]._Q.push([c,r])}a[a9]={init:function(){q("i",arguments)},fetchBids:function(){q("f",arguments)},setDisplayBids:function(){},targetingKeys:function(){return[]},_Q:[]};A=p.createElement(s);A.async=!0;A.src=t;g=p.getElementsByTagName(s)[0];g.parentNode.insertBefore(A,g)}("apstag",window,document,"script","//c.amazon-adsystem.com/aax2/apstag.js");
} catch(e) {
  console.error(e)
}
</script>

We could consider adding a getAdCodeForHTMLBody() function to tab-ads, which apps could use to insert scripts into the page.

Building Prebid from Source

We build Prebid.js from source and keep the built Prebid code in source control. We do this because:

  1. We can build Prebid to include only the required modules. This reduces the JS bundle size.
  2. We can patch Prebid to ensure it works as expected in the context of a new tab page. Our users may view the new tab page within an iframe that has a chrome-extension:// or moz-extension:// protocol, and this can break bidders that need to know the correct domain and referrer.

To build a new version of Prebid: yarn run prebid:build

To modify the Prebid patches:

  • modify files as needed in ./node_modules/prebid.js/*
  • add tests for the patches in prebidPatches.test.js
  • run prebid:create-patches to update the patches file
  • run yarn run prebid:build to put those patches into effect in the build Prebid file

Verifying Prebid Bidder Requests

In the new tab page iframe context, we need to ensure that Prebid bidders send the correct page URL and referrer info. We don't have automated tests for this yet. To verify, we need to load the page in a new tab page iframe and inspect each partner's network request.

We should check this every time we upgrade Prebid.

Here's what to check for each partner, assuming the iframed page is https://example.com/newtab/:

PartnerRequest URLWhat to check
Magnitehttps://fastlane.rubiconproject.com/a/api/fastlane.jsonQuery param rf is https://example.com/newtab/
Media.nethttps://prebid.media.net/rtb/prebidPayload site.domain is example.com and site.page is https://example.com/newtab/
OpenXhttps://tabforacause-d.openx.net/w/1.0/arjQuery param ju is https://example.com/newtab/
Pulsepointhttps://bid.contextweb.com/header/ortbPayload site.page and site.ref are both https://example.com/newtab/
Sonobiapex.go.sonobi.com/trinity.jsonQuery param ref is https://example.com/newtab/
Unrulyhttps://targeting.unrulymedia.com/unruly_prebidPayload refererInfo.referer is https://example.com/newtab/

GDPR and CCPA: We should manually ensure that data privacy preferences are passed to ad partners. We use tab-cmp as our consent management platform. See tab-cmp's "Ad Partners" sections of its test checklist for what to verify in ad partner requests.

Testing In-Progress Builds in Local Projects

It's often helpful to test development builds of tab-ads in other local projects.

  1. Install yalc: yarn global add yalc
  2. In tab-ads: run yarn run dev:publish
  3. In the consuming project: run yalc add tab-ads

FAQs

Package last updated on 16 Dec 2023

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc