Repository navigation
Include PR 1498 relay support on the compatible baseline - #1545
ChristianPavilonis wants to merge 1 commit into
Conversation
Port only the feature delta from f22a83f, without its newer-main ancestry. Retain default-off configuration and Purpose 2/vendor enforcement. Reuse the existing guarded CMP setter correction from d827b6c73938308fc68b54b1100cedcde6d92acf after reproducing the opt-in ownership regression. Preserve publisher-denial controls and use the measured baseline shim budget.
prk-Jr
left a comment
prk-Jr
left a comment
There was a problem hiding this comment.
Approving. I found no blocking issues in the relay consent change.
What I verified at c7f8ca7e1:
- Default off. With the flag omitted or false, the publisher's consent configuration is left unchanged (production-artifact test). With it on, Purpose 2 is still enforced, a publisher
gvlMapping.trustedServerrestores the vendor check, and unrelated bidders stay blocked. - Storage rule. When the publisher sets no rules, the shim writes a rule list containing only
basicAds. Prebid 10.26tcfControlfalls back to its default for any purpose missing from the list, so the Purpose 1 storage rule still applies. - Re-applying
consentManagement. Reconfiguring starts a fresh CMP lookup but does not clear existing consent data, so there is no window where consent is empty. The update only happens once, because later calls find the relay already exempt. - Ownership protection. As a negative control, I routed relay updates straight to
setConfig, skipping the automatic owner's guard. Both deferred-CMP publisher-takeover tests then fail, so the regression tests catch the stale-grant leak. - Template cache. The cache fingerprint hashes the full serialized settings, so the new field is covered.
Local runs:
- 45 tests across the relay, artifact and consent-enforcement suites pass.
- ESLint is clean on the changed files.
- 226 core Prebid Rust tests pass.
cargo clippy -p trusted-server-core --all-targets --all-features -D warningsis clean.
CI note: the browser integration tests job failed on runner infrastructure. DNS resolution of the Ubuntu package mirror failed during the Playwright install, so Chromium never installed and every spec failed in 0–2 ms. Those specs never ran against this change, so please re-run the job before merging.
Non-blocking: docs/guide/configuration.md has a Prebid field table (around line 1729) that doesn't list relay_soft_vendor_exception. Only the integration guide and trusted-server.example.toml mention it. Worth adding a row there so the configuration reference is complete.
| expect(consentManagement.gdpr).toEqual(publisherConsentManagement.gdpr); | ||
| }); | ||
|
|
||
| it('keeps automatic CMP ownership while preparing a nonempty relay auction', async () => { |
There was a problem hiding this comment.
Non-blocking (test strength): this test still passes when relay rule updates bypass the automatic owner's guard. I checked by replacing applyRelayConsentConfig with a direct originalSetConfig(value) call. Only the deferred-response takeover cases below fail under that change, so this test doesn't detect the regression it's named for.
Two options:
- Assert something that changes when the guard is skipped, for example that the relay-created CMP subscription is registered through the guarded API, or that a stale callback is dropped after a later publisher takeover.
- Fold this case into the takeover
it.eachbelow.
|
not sure why codex made this pr |
Summary
Exact source and review base
Source PR1498:
f22a83fceac98767979ac0dd406701e4a000c1db, branchcodex/1497-prebid-gdpr-relay, basemain. That PR's head/base/readiness are not rewritten by this port.This baseline port:
c7f8ca7e1ad09bdbae8de40ceaa50d658ef5b7dc, treeb3cb8e8dd02390d9822880bee38196cd538520dc.Base:
baseline/aws-examples-20261110, existing top unit #1540 atee7f68fcf25cc2954ffc0204301c0c264f1ce558.This is the eleventh baseline review unit for draft integration #1541. The preceding ten heads/bases stay unchanged. EdgeZero remains the historical public83d/draft431 pairing; no current-main forwarding integration or refreshed462 claim.
Changes
integrations/prebid.rsprebid/index.ts,relay_consent.tsrelay_consent.test.ts,prebid-artifact-integration.test.mjsprebid-consent-enforcement.test.mjstrusted-server.example.tomlNo dependency versions, EdgeZero pin, toolchain, transport, timeout policy, grants, runtime wrapper or Terraform changes.
Why the port includes the existing ownership correction
The replayed current1498 feature fails the built-artifact privacy regressions when explicitly enabled: after a legitimate public static denial, stale CMP grant callbacks cause a stubbed identity request and
idl_envwrite. The original red receipt is retained; this is not inferred from a source scan.Existing correction
d827b6c73938308fc68b54b1100cedcde6d92acfapplies to the baseline without source conflicts. Internal updates use the same existing automatic owner's guarded callback registration and captured publisher setter; public configuration still retires that owner, andfinallyrestores the API. No new consent owner, epoch/ledger, public bypass, retry or timer. Normal/deferred/error regressions now observe zero stubbed vendor requests and no identity cookie after denial.The source PR's newer-main54KB shim limit is not copied. The actual baseline shim plus relay/ownership correction measures41,948 characters; its narrow42,500 budget retains the Prebid-free assertions and comparison against the separate200KB+ Prebid artifact. Both the original41KB failure and the measured correction remain in the receipts.
Closes
Refs #1498, #1497 and #1530. This port does not close the source PR or the overall baseline tracker.
Spec
Not a new design. This ports the existing1498 behavior and reuses the existing automatic-ownership correctness fix with executed regression coverage. Historical design/review records remain tied to their original inputs, not backdated approval of this combined baseline source.
Test plan
sha256:8878057fb97f2e1d13ca1049acd18c4d7d21f67d5b1403851d29f898019fa435, linux/amd64 UID/GID10001; startup rejection, health/auth/TSJS, read-only root/writable mounts and in-flight SIGTERM drain. No image push.Limits
Testing opt-in remains false by default; do not treat this as production privacy approval, live browser/CMP acceptance, downstream vendor acceptance or cloud qualification. No real vendor requests are sent by these JSDOM fixtures. Actual caller signals and downstream consent responsibilities remain unchanged; broader relay data-policy work is not silently included.
Original checkouts, current-main PRs, source1498 and the preceding ten baseline units remain preserved. No deployment, live input switch, main merge, old-RC closure, new worker or excluded1499 implementation.