EIDs in OpenRTB 2.6 user.eids; every EID-absence test checks both user.eids and user.ext.eids #1583

Summary

EIDs in OpenRTB 2.6 user.eids; every EID-absence test checks both user.eids and user.ext.eids.

Part of #1558, server-side identity on every adapter. Plan ID T2, planned in wave 5 (MVP: Fastly and Axum); priority P1, size M. Design: spec; order and dependencies: plan.

Requirements

SID-4 OpenRTB placement

EIDs go in user.eids for OpenRTB 2.6, and in user.ext.eids only for a named downstream that needs it.

Current state

What the code does today, from the design's survey at the revisions it names:

• SID-4: every builder writes only user.ext.eids (auction/openrtb.rs:372, integrations/prebid.rs:2882, integrations/aps.rs:1131).

Acceptance criteria

• SID-4: The bidder, Prebid Server and APS requests carry user.eids, and every test that asserts EIDs are absent checks both fields

Dependencies

Blocked by:

• PR Mirror provider EIDs to a cookie and run pull sync as an identity provider #1489 Mirror provider EIDs to a cookie and run pull sync as an identity provider

Related pull requests

• Mirror provider EIDs to a cookie and run pull sync as an identity provider #1489 Mirror provider EIDs to a cookie and run pull sync as an identity provider: must merge first.

  Fixes the plan asks of Mirror provider EIDs to a cookie and run pull sync as an identity provider #1489

  Cap every mirrored ID's expiry at 30 days where the mirror is built (mirror.rs:236-247), not in validation, because SID-5 keeps SharedID Never in the record. An unstated expiry still becomes Expiry::Never (coordinator/validate.rs:135-138), pull sync is its only production source (pull_sync.rs:145), and such IDs reach the cookie with no exp under a one-year Max-Age. The 30-day clamp on stated expiries comes from Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2 #1488. Answer its open threads, including the one on any_due skipping cookie-read opt-outs.