Change approvedSellers to sellerCapabilities

[caraitto]

sellerCapabilities is more granular and allows only granting permissions for latency stats, or interest group counts.

It can also be extended in the future with additional capabilities.

[dmdabbs]

interestGroupCount: The number of the interest groups which could participate in the auction (i.e. the interest group’s owner was listed in the interestGroupBuyers). This requires the interestGroupCounts sellerCapabilities permission.

The buyer-specified perBuyerGroupLimits may constrain participation. Will this report the IG's count or what may have been limited by perBuyerGroupLimits?

[caraitto]

@dmdabbs IIUC, the question is interestGroupCount should be the number of interest groups, or min(perBuyerGroupLimits, number of interest groups)?

The auction config sets perBuyerGroupLimits, so presumably the seller already knows this value (although the runAdAuction() call may be made from a frame whose origin isn't the seller's -- but this is generally done in partnership with the seller). So, it seems like reporting the unconstrained number of interest groups makes more sense? Alternatively, both could be reported, if there's value in reporting both (they would both be controlled by the interestGroupCounts sellerCapabilities permission, just like bidCount).

[dmdabbs]

So, it seems like reporting the unconstrained number of interest groups makes more sense?

Thanks @caraitto. Yes, I agree. I asked because number of the interest groups which could participate was ambiguous.

[caraitto]

So, it seems like reporting the unconstrained number of interest groups makes more sense?

Thanks @caraitto. Yes, I agree. I asked because number of the interest groups which could participate was ambiguous.

Got it -- I updated the text to make this more clear.

[dmdabbs]

The interestGroup provided to navigator.joinAdInterestGroup() will contain a new field named sellerCapabilities, a dict keyed by seller origin...

Seller/publishers will apreciate these stats, and buyers this control over which sellers may receive them. However, even if only a small circle of ad techs ends up as FLEDGE sellers (unlikely), all a buyer's joinAdInterestGroup() registrations will be burdened with this weight. As it is there are calls to raise the 50kB interest group size limit.

Perhaps consider some buyer origin .well-known uri from which to fetch and cache this permission info.

[caraitto]

The interestGroup provided to navigator.joinAdInterestGroup() will contain a new field named sellerCapabilities, a dict keyed by seller origin...

Seller/publishers will apreciate these stats, and buyers this control over which sellers may receive them. However, even if only a small circle of ad techs ends up as FLEDGE sellers (unlikely), all a buyer's joinAdInterestGroup() registrations will be burdened with this weight. As it is there are calls to raise the 50kB interest group size limit.

Perhaps consider some buyer origin .well-known uri from which to fetch and cache this permission info.

Yes, this feature will require storage for each of the origin strings. Additionally, the permissions themselves will be just a 32-bit bitfield, so 4 bytes per origin, plus 4 bytes for the all-buyers bitfield.

It may be possible to increase the 50kb limit, but we need to ensure the that the total storage usage for all of FLEDGE is workable, especially on low-end phones that don't have much storage. With a 50kb limit, and 1000 interest groups, that's 50mb of storage used just for FLEDGE interest groups, for instance (with a bit more for k-anon data, sqlite indices, etc.). Let's continue that discussion on #402.

[dmdabbs]

Yes, thank you. Until seeing your example I'd glossed over the "list of strings" bit. It is acceptable to omit the https:// and the browser will supply?

[caraitto]

Yes, thank you. Until seeing your example I'd glossed over the "list of strings" bit. It is acceptable to omit the https:// and the browser will supply?

I think it's better to have the origin be explicit, to avoid confusion?

[dmdabbs]

I agree. AFAIK, everywhere else buyers/sellers are specified as a URL. I asked based on Paul's suggested example. Perhaps he omitted the protocol as shorthand.

[caraitto]

I added a clarification for what gets reported when no trusted signals were requested by the interest group.