Align SharedID with Prebid's cookie name, source and retention

Cargo.toml

@@ -37,6 +37,7 @@ publish = false
 version = "0.1.0"
 
 [workspace.dependencies]
+aes-gcm = { version = "0.11", default-features = false, features = ["aes", "alloc"] }
 anyhow = "1"
 assert_cmd = "2"
 async-stream = "0.3"

crates/trusted-server-adapter-fastly/src/app.rs

@@ -122,7 +122,7 @@ use trusted_server_core::ec::eid_types::UnixSeconds;
 use trusted_server_core::ec::identify::{cors_preflight_identify, handle_identify};
 use trusted_server_core::ec::kv::KvIdentityGraph;
 use trusted_server_core::ec::page_load::NavigationPermit;
-use trusted_server_core::ec::provider::ClientSignals;
+use trusted_server_core::ec::provider::{ClientSignals, RequestCookies};
 use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::ec::{EcContext, EcKvSnapshot, EidSyncSource};
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
@@ -395,6 +395,7 @@ pub(crate) struct AfterResponseLookups {
     pub(crate) ec_id: String,
     pub(crate) client_ip: Option<IpAddr>,
     pub(crate) user_agent: Option<String>,
+    pub(crate) cookie_header: String,
 }
 
 /// Identity work a navigation hands to the entry point.
@@ -427,6 +428,7 @@ pub(crate) fn take_navigation_lookups() -> NavigationLookups {
 struct ProviderRequestSignals<'a> {
     client_ip: Option<IpAddr>,
     user_agent: Option<&'a str>,
+    cookie_header: String,
 }
 
 impl<'a> ProviderRequestSignals<'a> {
@@ -439,10 +441,23 @@ impl<'a> ProviderRequestSignals<'a> {
                 .headers()
                 .get(header::USER_AGENT)
                 .and_then(|value| value.to_str().ok()),
+            cookie_header: joined_cookie_header(req),
         }
     }
 }
 
+/// Joins every `Cookie` header on the request into one `; `-separated value.
+///
+/// HTTP/2 and HTTP/3 clients may split cookies across several headers.
+fn joined_cookie_header(req: &Request) -> String {
+    req.headers()
+        .get_all(header::COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .collect::<Vec<_>>()
+        .join("; ")
+}
+
 /// Captures the request signals for after-response identity lookups on a
 /// permitted publisher navigation.
 ///
@@ -461,6 +476,7 @@ fn prepare_after_response_lookups(
         ec_id,
         client_ip: signals.client_ip,
         user_agent: signals.user_agent.map(str::to_owned),
+        cookie_header: signals.cookie_header,
     })
 }
 
@@ -502,6 +518,7 @@ async fn dispatch_identity_lookups(
                     user_agent: signals.user_agent,
                 },
                 publisher_domain: &state.settings.publisher.domain,
+                cookies: RequestCookies::new(&signals.cookie_header),
                 rate_limiter: &limiter,
                 now: UnixSeconds::new(now),
             },
@@ -1630,7 +1647,7 @@ mod tests {
     use trusted_server_core::ec::provider::{
         EidLevelFields, EidShape, IdentityProvider, LookupInput, LookupOutcome,
         ProviderCapabilities, ProviderEid, ProviderError, ProviderExpiry, ProviderRequest,
-        ProviderResponse, ProviderUid, SourceCapability, SourceInput,
+        ProviderResponse, ProviderUid, RequestCookies, SourceCapability, SourceInput,
     };
     use trusted_server_core::ec::registry::PartnerRegistry;
     use trusted_server_core::error::TrustedServerError;
@@ -2799,6 +2816,29 @@ mod tests {
         request
     }
 
+    #[test]
+    fn provider_cookies_join_every_cookie_header() {
+        // Arrange: HTTP/2 clients may split cookies across headers.
+        let mut request = navigation_request("/article");
+        let headers = request.headers_mut();
+        headers.append(header::COOKIE, HeaderValue::from_static("a=1; b=2"));
+        headers.append(header::COOKIE, HeaderValue::from_static("vendor_id=c-1"));
+
+        // Act
+        let joined = super::joined_cookie_header(&request);
+
+        // Assert
+        assert_eq!(
+            joined, "a=1; b=2; vendor_id=c-1",
+            "should join every Cookie header"
+        );
+        assert_eq!(
+            RequestCookies::new(&joined).get("vendor_id"),
+            Some("c-1"),
+            "should let providers read a cookie from a later header"
+        );
+    }
+
     fn take_finalize_state(response: &mut Response) -> super::EcFinalizeState {
         response
             .extensions_mut()

crates/trusted-server-adapter-fastly/src/main.rs

@@ -25,7 +25,7 @@ use trusted_server_core::ec::eid_types::UnixSeconds;
 use trusted_server_core::ec::finalize::ec_finalize_response;
 use trusted_server_core::ec::kv::KvIdentityGraph;
 use trusted_server_core::ec::page_load::NavigationPermit;
-use trusted_server_core::ec::provider::ClientSignals;
+use trusted_server_core::ec::provider::{ClientSignals, RequestCookies};
 use trusted_server_core::ec::pull_sync::{
     PullSyncContext, build_pull_sync_context, dispatch_pull_sync,
 };
@@ -801,6 +801,7 @@ pub(crate) fn run_after_response_lookups(
                 user_agent: lookups.user_agent.as_deref(),
             },
             publisher_domain: &settings.publisher.domain,
+            cookies: RequestCookies::new(&lookups.cookie_header),
             rate_limiter: &limiter,
             now: UnixSeconds::new(now),
         },

crates/trusted-server-cli/Cargo.toml

@@ -57,8 +57,10 @@ toml = { workspace = true }
 toml_edit = { workspace = true }
 tracing = { workspace = true }
 trusted-server-core = { workspace = true }
+trusted-server-identity-providers = { workspace = true }
 url = { workspace = true }
 uuid = { workspace = true }
+validator = { workspace = true }
 which = { workspace = true }
 
 # `ts dev lint domains` and `ts dev install-hooks` drive all git access through