SharedID cleanup: legacy path, cross-source dedupe, re-filing, SID-6 gate, template-cache deny list #1584

Summary

SharedID cleanup: legacy path, cross-source dedupe, re-filing, SID-6 gate, template-cache deny list.

Part of #1558, server-side identity on every adapter. Plan ID T3, planned in wave 4 (MVP: Fastly and Axum); priority P1, size M. Design: spec; order and dependencies: plan.

Requirements

SID-1 Cookie name from config

The server reads SharedID from the cookie named by the publisher's Prebid storage.name, held in managed_user_ids[].storage.name. Prebid has no default; _sharedid and _pubcid are common.

SID-2 Opt-out

A _pubcid_optout cookie stops SharedID reads, storage, sending, creation and write-back. Prebid also reads the opt-out from localStorage, which the server cannot see, so the injected script copies a localStorage _pubcid_optout into the cookie (T20).

SID-3 One canonical EID

SharedID is stored and sent as source pubcid.org, atype 1, once.

SID-6 EID consent

Reading SharedID into the record, storing it, sending it and writing it back each need EID permission (TCF Purposes 1 and 4, through the consent module's EID predicate in consent/mod.rs), in addition to EC permission and the SID-2 opt-out. EC permission alone (consent_allows_ec, Purpose 1) is not enough. Where consent is required but missing, permission is denied.

WB-5 Cacheable pages

An unchanged cookie gets no Set-Cookie, and a response carrying Set-Cookie is not stored in a shared cache.

Current state

What the code does today, from the design's survey at the revisions it names:

• SID-1: main reads only sharedId (constants.rs:10), Prebid's module name, on Fastly for the record and on every adapter for /_ts/admin/eids.
• SID-3: a pubcid.org partner already stores and sends the right EID from ts-eids and the body; the sharedId cookie path is hard-wired to sharedid.org (ec/prebid_eids.rs:241); browser-written records default to atype 3; the outbound merge dedupes only within one source.
• WB-5: main enforces the cache rule on every adapter (response_privacy.rs:122-148) and does not re-set ts-ec, but re-sets the ts-ec-pull-complete marker about hourly, which Mirror provider EIDs to a cookie and run pull sync as an identity provider #1489 retires; the deny list names only sharedId.

Acceptance criteria

• SID-1: With storage.name = "_pubcid" a _pubcid cookie is read on every supported adapter, and a cookie named sharedId is not
• SID-2: With _pubcid_optout present nothing SharedID-related is read, stored, sent, created or written, and a localStorage-only opt-out stops creation from the next request on
• SID-3: A bidder request built from cookie, ts-eids, body and record that carry the same UUID has exactly one EID {source: "pubcid.org", atype: 1}
• SID-6: On each supported adapter, with a populated record, an absent or different browser cookie, Purpose 1 granted and Purpose 4 denied, no SharedID is read, sent or written back
• WB-5: A returning reader with unchanged cookies gets no Set-Cookie, and the template-cache deny list uses the configured SharedID name

Dependencies

Blocked by:

• PR Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2 #1488 Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2

Blocks:

• Create and write back SharedID in the shared app #1593 Create and write back SharedID in the shared app (new in this plan)

Related pull requests

• Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2 #1488 Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2: must merge first.

  Fixes the plan asks of Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2 #1488

  Take Run server-side identity collection on the Axum dev server #1566's 0a2a00aaf, which reads the SharedID name from managed_user_ids, defaults the source to pubcid.org and keeps the stored value (still open here: sharedid.rs:46-59, common.rs:94,110,129-136). Take 0c13d4272: the blanket reject_providers_without_a_kind (config.rs:348) makes ts config validate, push and diff reject every enabled provider. SID-6 holds for the provider path. LiveRamp's Custom ID waits on DEC-9, which gates enabling LiveRamp, not this merge. Answer its open threads.