Support Sourcepoint GPP consent for EC generation

.github/actions/setup-integration-test-env/action.yml

@@ -80,7 +80,7 @@ runs:
       env:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret
+        TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 

.github/workflows/test.yml

@@ -55,7 +55,7 @@ jobs:
         env:
           TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:8080
           TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-          TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret
+          TRUSTED_SERVER__EC__PASSPHRASE: integration-test-ec-secret-padded-32
           TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
         run: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
 

crates/integration-tests/fixtures/configs/viceroy-template.toml

@@ -25,11 +25,29 @@
             key = "placeholder"
             data = "placeholder"
 
-        # Pre-seeded EC row for KV-backed EC lifecycle tests.
+        # Pre-seeded EC rows for KV-backed EC lifecycle tests. Each scenario
+        # uses a separate row so withdrawal tombstones do not leak across
+        # sequential scenario execution in the same Viceroy instance.
         [[local_server.kv_stores.ec_identity_store]]
             key = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test01"
             data = '{"v":1,"created":1700000000,"consent":{"ok":true,"updated":1700000000},"geo":{"country":"US","region":"CA"}}'
 
+        [[local_server.kv_stores.ec_identity_store]]
+            key = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.test02"
+            data = '{"v":1,"created":1700000000,"consent":{"ok":true,"updated":1700000000},"geo":{"country":"US","region":"CA"}}'
+
+        [[local_server.kv_stores.ec_identity_store]]
+            key = "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc.test03"
+            data = '{"v":1,"created":1700000000,"consent":{"ok":true,"updated":1700000000},"geo":{"country":"US","region":"CA"}}'
+
+        [[local_server.kv_stores.ec_identity_store]]
+            key = "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd.test04"
+            data = '{"v":1,"created":1700000000,"consent":{"ok":true,"updated":1700000000},"geo":{"country":"US","region":"CA"}}'
+
+        [[local_server.kv_stores.ec_identity_store]]
+            key = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.test05"
+            data = '{"v":1,"created":1700000000,"consent":{"ok":true,"updated":1700000000},"geo":{"country":"US","region":"CA"}}'
+
         [[local_server.kv_stores.ec_partner_store]]
             key = "placeholder"
             data = "placeholder"

crates/integration-tests/tests/frameworks/scenarios.rs

@@ -500,16 +500,17 @@ impl EcScenario {
 /// US Privacy signal that explicitly allows storage in the default Viceroy
 /// integration-test geo (US-CA).
 const ALLOW_US_PRIVACY_COOKIE: &str = "1YNN";
-const SEEDED_EC_ID: &str =
-    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test01";
-
 fn allow_ec_generation(client: &EcTestClient) {
     client.set_cookie("us_privacy", ALLOW_US_PRIVACY_COOKIE);
 }
 
-fn use_seeded_ec(client: &EcTestClient) -> String {
-    client.set_cookie("ts-ec", SEEDED_EC_ID);
-    normalize_ec_id(SEEDED_EC_ID)
+fn seeded_ec_id(hex_digit: char, suffix: &str) -> String {
+    format!("{}.{suffix}", hex_digit.to_string().repeat(64))
+}
+
+fn use_seeded_ec(client: &EcTestClient, ec_id: &str) -> String {
+    client.set_cookie("ts-ec", ec_id);
+    normalize_ec_id(ec_id)
 }
 
 /// Full lifecycle: seeded EC → batch sync → identify (Bearer auth) with scoped UID.
@@ -518,7 +519,8 @@ fn use_seeded_ec(client: &EcTestClient) -> String {
 fn ec_full_lifecycle(base_url: &str) -> TestResult<()> {
     let client = EcTestClient::new(base_url);
     allow_ec_generation(&client);
-    let ec_id = use_seeded_ec(&client);
+    let seeded_ec_id = seeded_ec_id('a', "test01");
+    let ec_id = use_seeded_ec(&client, &seeded_ec_id);
     log::info!("EC full lifecycle: using seeded EC ID = {ec_id}");
 
     // 2. Batch sync writes partner UID (partner "inttest" is in config)
@@ -576,7 +578,8 @@ fn ec_full_lifecycle(base_url: &str) -> TestResult<()> {
 fn ec_consent_withdrawal(base_url: &str) -> TestResult<()> {
     let client = EcTestClient::new(base_url);
     allow_ec_generation(&client);
-    let ec_id = use_seeded_ec(&client);
+    let seeded_ec_id = seeded_ec_id('b', "test02");
+    let ec_id = use_seeded_ec(&client, &seeded_ec_id);
     log::info!("EC consent withdrawal: using seeded EC = {ec_id}");
 
     // GPC overrides the allow cookie in US-CA, so this is an explicit
@@ -623,7 +626,8 @@ fn ec_identify_without_ec(base_url: &str) -> TestResult<()> {
 fn ec_identify_consent_denied(base_url: &str) -> TestResult<()> {
     let client = EcTestClient::new(base_url);
     allow_ec_generation(&client);
-    let _ec_id = use_seeded_ec(&client);
+    let seeded_ec_id = seeded_ec_id('c', "test03");
+    let _ec_id = use_seeded_ec(&client, &seeded_ec_id);
 
     // Identify with GPC=1 — in the default US-CA test geo, GPC is an explicit
     // denial that must override the allow cookie. Per spec §11.4, consent is
@@ -647,7 +651,8 @@ fn ec_identify_consent_denied(base_url: &str) -> TestResult<()> {
 fn ec_concurrent_partner_syncs(base_url: &str) -> TestResult<()> {
     let client = EcTestClient::new(base_url);
     allow_ec_generation(&client);
-    let ec_id = use_seeded_ec(&client);
+    let seeded_ec_id = seeded_ec_id('d', "test04");
+    let ec_id = use_seeded_ec(&client, &seeded_ec_id);
     log::info!("EC concurrent syncs: using seeded EC = {ec_id}");
 
     // Batch sync both partners (both are pre-configured in trusted-server.toml)
@@ -705,7 +710,8 @@ fn ec_concurrent_partner_syncs(base_url: &str) -> TestResult<()> {
 fn ec_batch_sync_happy_path(base_url: &str) -> TestResult<()> {
     let client = EcTestClient::new(base_url);
     allow_ec_generation(&client);
-    let ec_id = use_seeded_ec(&client);
+    let seeded_ec_id = seeded_ec_id('e', "test05");
+    let ec_id = use_seeded_ec(&client, &seeded_ec_id);
     log::info!("EC batch sync happy path: using seeded ec_id = {ec_id}");
 
     // Batch sync writes a UID for this EC ID (partner "inttest" is in config)

crates/js/lib/build-all.mjs

@@ -13,6 +13,10 @@
  *     names to include in the bundle (e.g. "rubicon,appnexus,openx").
  *     Each name must have a corresponding {name}BidAdapter.js module in
  *     the prebid.js package. Default: "rubicon".
+ *
+ *   TSJS_PREBID_USER_ID_MODULES — Comma-separated list of Prebid.js User ID
+ *     submodules to include (e.g. "connectId,criteo,uid2").
+ *     Modules must exist in prebid.js/modules with a matching JS/TS file.
  */
 
 import fs from 'node:fs';
@@ -35,6 +39,40 @@ const ADAPTERS_FILE = path.join(
   'prebid',
   '_adapters.generated.ts',
 );
+const USER_IDS_FILE = path.join(
+  integrationsDir,
+  'prebid',
+  '_user_ids.generated.ts',
+);
+
+const DEFAULT_PREBID_USER_ID_MODULES = '';
+
+/**
+ * Some User ID module names need explicit mapping instead of the default
+ * `name + 'IdSystem'` convention.
+ */
+const USER_ID_MODULE_OVERRIDES = {
+  connectId: ['connectIdSystem'],
+  identityLink: ['identityLinkIdSystem'],
+  sharedId: ['sharedIdSystem'],
+  unifiedId: ['unifiedIdSystem'],
+  liveIntent: ['liveIntentIdSystem'],
+  criteo: ['criteoIdSystem'],
+  uid2: ['uid2IdSystem'],
+};
+
+/**
+ * Check whether a candidate file uses CommonJS `require`, which is not supported
+ * by this browser bundle output mode.
+ */
+function hasRequireSyntax(filePath) {
+  try {
+    const source = fs.readFileSync(filePath, 'utf8');
+    return /\brequire\s*\(/.test(source);
+  } catch {
+    return false;
+  }
+}
 
 /**
  * Generate `_adapters.generated.ts` with import statements for each adapter
@@ -105,7 +143,114 @@ function generatePrebidAdapters() {
   console.log('[build-all] Prebid adapters:', adapterNames);
 }
 
+/**
+ * Generate `_user_ids.generated.ts` with import statements for each User ID
+ * submodule listed in TSJS_PREBID_USER_ID_MODULES.
+ *
+ * Invalid module names (those without a matching module file in
+ * prebid.js) are logged and skipped.
+ */
+function generatePrebidUserIdModules() {
+  const raw = process.env.TSJS_PREBID_USER_ID_MODULES || DEFAULT_PREBID_USER_ID_MODULES;
+  const names = raw
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  const modulesDir = path.join(
+    __dirname,
+    'node_modules',
+    'prebid.js',
+    'modules',
+  );
+  const modulesPublicDir = path.join(
+    __dirname,
+    'node_modules',
+    'prebid.js',
+    'dist',
+    'src',
+    'public',
+  );
+
+  const imports = [];
+  const loadedModuleNames = [];
+
+  for (const rawName of names) {
+    const candidateNames = USER_ID_MODULE_OVERRIDES[rawName]
+      ? [...USER_ID_MODULE_OVERRIDES[rawName]]
+      : [
+          `${rawName}IdSystem`,
+          `${rawName}System`,
+          rawName,
+        ];
+
+    let imported = false;
+    let skippedForUnsupportedSyntax = false;
+    for (const candidate of candidateNames) {
+      const moduleFile = `${candidate}.js`;
+      const modulePath = path.join(modulesDir, moduleFile);
+      const publicModulePath = path.join(modulesPublicDir, moduleFile);
+
+      const moduleFilePaths = [modulePath, publicModulePath].filter(fs.existsSync);
+      if (moduleFilePaths.length === 0) {
+        continue;
+      }
+
+      if (moduleFilePaths.some((candidatePath) => hasRequireSyntax(candidatePath))) {
+        console.error(
+          `[build-all] WARNING: Prebid user ID module "${rawName}" uses require() and is not supported in the TSJS bundle, skipping`,
+        );
+        skippedForUnsupportedSyntax = true;
+        break;
+      }
+
+      const importLine = `import 'prebid.js/modules/${moduleFile}';`;
+      if (!imports.includes(importLine)) {
+        imports.push(importLine);
+        loadedModuleNames.push(rawName);
+      } else if (!loadedModuleNames.includes(rawName)) {
+        loadedModuleNames.push(rawName);
+      }
+      imported = true;
+      break;
+    }
+
+    if (!imported && !skippedForUnsupportedSyntax) {
+      console.error(
+        `[build-all] WARNING: Prebid user ID module "${rawName}" not found, skipping`,
+      );
+    }
+  }
+
+  if (names.length > 0 && imports.length === 0) {
+    console.error(
+      '[build-all] WARNING: No valid Prebid user ID modules found, browser will rely on server-only IDs',
+    );
+  }
+
+  const content = [
+    '// Auto-generated by build-all.mjs — manual edits will be overwritten at build time.',
+    '//',
+    '// Controls which Prebid.js user ID modules are included in the bundle.',
+    '// Set the TSJS_PREBID_USER_ID_MODULES environment variable to a comma-separated',
+    '// list of module names (e.g. "connectId,criteo,sharedId") before building.',
+    `// Default: "${DEFAULT_PREBID_USER_ID_MODULES}"`,
+    '',
+    ...imports,
+    '',
+  ].join('\n');
+
+  fs.writeFileSync(USER_IDS_FILE, content);
+
+  if (names.length > 0) {
+    console.log('[build-all] Prebid user ID modules:', loadedModuleNames);
+  } else {
+    console.log('[build-all] Prebid user ID modules: []');
+  }
+}
+
 generatePrebidAdapters();
+generatePrebidUserIdModules();
 
 // ---------------------------------------------------------------------------
 

crates/js/lib/src/integrations/prebid/_user_ids.generated.ts

@@ -0,0 +1,13 @@
+// Auto-generated by build-all.mjs — manual edits will be overwritten at build time.
+//
+// Controls which Prebid.js user ID modules are included in the bundle.
+// Set the TSJS_PREBID_USER_ID_MODULES environment variable to a comma-separated
+// list of module names (e.g. "connectId,criteo,sharedId") before building.
+// Default: ""
+
+import 'prebid.js/modules/connectIdSystem.js';
+import 'prebid.js/modules/criteoIdSystem.js';
+import 'prebid.js/modules/identityLinkIdSystem.js';
+import 'prebid.js/modules/uid2IdSystem.js';
+import 'prebid.js/modules/sharedIdSystem.js';
+import 'prebid.js/modules/unifiedIdSystem.js';

crates/js/lib/src/integrations/prebid/index.ts

@@ -21,10 +21,13 @@ import 'prebid.js/modules/userId.js';
 // Client-side bid adapters — self-register with prebid.js on import.
 // The set of adapters is controlled by the TSJS_PREBID_ADAPTERS env var at
 // build time. See _adapters.generated.ts (written by build-all.mjs).
+// User ID submodules are controlled by TSJS_PREBID_USER_ID_MODULES.
+// See _user_ids.generated.ts.
 // When a bidder is listed in `client_side_bidders` in trusted-server.toml,
 // the requestBids shim leaves its bids untouched and the corresponding
 // adapter handles them natively in the browser.
 import './_adapters.generated';
+import './_user_ids.generated';
 
 import { log } from '../../core/log';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
@@ -451,6 +454,8 @@ function fitAuctionEidsToCookie(eids: AuctionEid[]): AuctionEid[] | undefined {
 function syncPrebidEidsCookie(): void {
   try {
     if (typeof pbjs.getUserIdsAsEids !== 'function') {
+      // Without Prebid EIDs to forward, stale auction fallback IDs must not persist.
+      clearPrebidEidsCookie();
       return;
     }