peczenyj / GDPR-IAB-TCFv2 / 25525224521

96%

main: 96%

push

github

feat(validator): emit ReasonLegitimateInterestNotPermittedForPurpose for TCF carve-out (Phase 6.3) (#67)

The TCF spec forbids the legitimate-interest legal basis for Purpose 1
at any policy version, and for Purposes 3-6 at TcfPolicyVersion >= 4
(TCF v2.2+). Previously the Validator delegated to the parser and
emitted the generic ReasonVendorNotAllowedLegitimateInterest, which
could not be told apart from "vendor missing the LI bit".

The Validator now detects the carve-out itself before delegating and
pushes a Failure with code ReasonLegitimateInterestNotPermittedForPurpose,
matching the Go validator's signal so downstream callers can react to
"spec forbids this" specifically.

Notes:
* Limited to non-flexible purposes in legitimate_interest_purpose_ids.
  Flexible-purpose interaction with publisher restrictions is left for
  Phase 6.4.
* Existing t/06-validator.t case for the P1 carve-out updated to match
  the new message; the old "purpose 1 (legitimate interest)" wording is
  gone for this code path.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

10 of 11 new or added lines in 1 file covered. (90.91%)

1042 of 1090 relevant lines covered (95.6%)

10991.93 hits per line