IABTechLab
diff --git a/‎.env.example‎
Lines changed: 2 additions & 1 deletion b/‎.env.example‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎.gitignore‎
Lines changed: 6 additions & 0 deletions b/‎.gitignore‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎Cargo.lock‎
Lines changed: 8 additions & 0 deletions b/‎Cargo.lock‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎Cargo.toml‎
Lines changed: 1 addition & 0 deletions b/‎Cargo.toml‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎crates/trusted-server-adapter-axum/src/app.rs‎
Lines changed: 95 additions & 6 deletions b/‎crates/trusted-server-adapter-axum/src/app.rs‎
Lines changed: 95 additions & 6 deletions
diff --git a/‎crates/trusted-server-adapter-axum/src/middleware.rs‎
Lines changed: 8 additions & 15 deletions b/‎crates/trusted-server-adapter-axum/src/middleware.rs‎
Lines changed: 8 additions & 15 deletions
diff --git a/‎crates/trusted-server-adapter-axum/src/platform.rs‎
Lines changed: 2 additions & 0 deletions b/‎crates/trusted-server-adapter-axum/src/platform.rs‎
Lines changed: 2 additions & 0 deletions
@@ -37,14 +37,15 @@ TRUSTED_SERVER__REQUEST_SIGNING__ENABLED=false
 
 # Prebid
 TRUSTED_SERVER__INTEGRATIONS__PREBID__ENABLED=false
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid-server.com/openrtb2/auction
+# TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid-server.example.com/openrtb2/auction
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__TIMEOUT_MS=1000
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS=kargo,rubicon,appnexus
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_OVERRIDES='{"bidder-name":{"param1":12345,"param2":"value"}}'
 # Compatibility env shape for bidder -> zone -> params overrides
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_ZONE_OVERRIDES='{"kargo":{"header":{"placementId":"_abc"}}}'
 # Preferred canonical env shape for future generic rules
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_OVERRIDE_RULES='[{"when":{"bidder":"kargo","zone":"header"},"set":{"placementId":"_abc"}}]'
+# TRUSTED_SERVER__INTEGRATIONS__PREBID__SUPPRESS_NURL_BIDDERS=exampleBidder,anotherBidder
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__AUTO_CONFIGURE=false
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__DEBUG=false
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__TEST_MODE=false
 
@@ -53,3 +53,9 @@ src/*.html
 /crates/trusted-server-integration-tests/browser/test-results/
 /crates/trusted-server-integration-tests/browser/playwright-report/
 /crates/trusted-server-integration-tests/browser/.browser-test-state.json
+
+# Defunct pre-rename crate dirs (renamed to crates/trusted-server-*); ignore the
+# leftover local build artifacts (node_modules, target, dist) that remain on disk.
+/crates/js/
+/crates/integration-tests/
+
@@ -55,6 +55,7 @@ fastly = "0.12"
 fern = "0.7.1"
 flate2 = "1.1"
 futures = "0.3"
+glob = "0.3"
 getrandom = "0.2"
 hex = "0.4.3"
 hmac = "0.12.1"
 
@@ -19,7 +19,8 @@ use trusted_server_core::proxy::{
     handle_first_party_proxy_sign,
 };
 use trusted_server_core::publisher::{
-    buffer_publisher_response, handle_publisher_request, handle_tsjs_dynamic,
+    AuctionDispatch, buffer_publisher_response_async, handle_page_bids, handle_publisher_request,
+    handle_tsjs_dynamic, page_bids_preflight_denied,
 };
 use trusted_server_core::request_signing::{
     handle_trusted_server_discovery, handle_verify_signature,
@@ -134,6 +135,34 @@ where
         .unwrap_or_else(|e| http_error(&e)))
 }
 
+// ---------------------------------------------------------------------------
+// EC context
+// ---------------------------------------------------------------------------
+
+/// Builds the geo-aware [`EcContext`] for consent-gated endpoints (`/auction`,
+/// `/__ts/page-bids`, and the publisher fallback).
+///
+/// Mirrors the Fastly entry point: `EcContext::default()` leaves jurisdiction
+/// Unknown, which fails the auction consent gate closed even for consented
+/// users. Geo comes from the platform (a no-op on the local Axum dev server, so
+/// jurisdiction stays Unknown there unless the request carries TCF consent). A
+/// malformed consent string is logged and falls back to the default
+/// (fail-closed) context rather than being silently swallowed.
+fn build_ec_context(state: &AppState, services: &RuntimeServices, req: &Request) -> EcContext {
+    let geo_info = services
+        .geo()
+        .lookup(services.client_info().client_ip)
+        .unwrap_or_else(|e| {
+            log::warn!("geo lookup failed: {e}");
+            None
+        });
+    EcContext::read_from_request_with_geo(&state.settings, req, services, geo_info.as_ref())
+        .unwrap_or_else(|e| {
+            log::warn!("EC context read failed: {e:?}");
+            EcContext::default()
+        })
+}
+
 // ---------------------------------------------------------------------------
 // Fallback dispatcher (tsjs / integration proxy / publisher)
 // ---------------------------------------------------------------------------
@@ -171,9 +200,34 @@ async fn dispatch_fallback(
             });
     }
 
-    handle_publisher_request(&state.settings, &state.registry, services, req)
-        .await
-        .and_then(|pr| buffer_publisher_response(pr, &method, &state.settings, &state.registry))
+    // Run the server-side auction with the configured creative-opportunity
+    // slots; `handle_publisher_request` matches them against the request path.
+    let mut ec_context = build_ec_context(state, services, &req);
+    let auction = AuctionDispatch {
+        orchestrator: &state.orchestrator,
+        slots: state.settings.creative_opportunity_slots(),
+        registry: None,
+    };
+    let publisher_response = handle_publisher_request(
+        &state.settings,
+        services,
+        None,
+        &mut ec_context,
+        auction,
+        req,
+    )
+    .await?;
+    // Async finalize so the dispatched auction is collected and its bids are
+    // injected before `</body>` (the sync buffer path would drop them).
+    buffer_publisher_response_async(
+        publisher_response,
+        &method,
+        &state.settings,
+        &state.registry,
+        &state.orchestrator,
+        services,
+    )
+    .await
 }
 
 fn fallback_handler(
@@ -202,6 +256,7 @@ enum NamedRouteHandler {
     /// reach the publisher fallback (which would leak admin credentials).
     LegacyAdminDenied,
     Auction,
+    PageBids,
     FirstPartyProxy,
     FirstPartyClick,
     FirstPartySign,
@@ -224,7 +279,7 @@ const LEGACY_ADMIN_DENY_METHODS: &[Method] = &[
     Method::DELETE,
 ];
 
-fn named_routes() -> [NamedRoute; 11] {
+fn named_routes() -> [NamedRoute; 12] {
     [
         NamedRoute {
             path: "/.well-known/trusted-server.json",
@@ -270,6 +325,13 @@ fn named_routes() -> [NamedRoute; 11] {
             primary_methods: &[Method::POST],
             handler: NamedRouteHandler::Auction,
         },
+        // GET runs the SPA re-auction; OPTIONS is denied in-handler as a CORS
+        // preflight guard for this side-effecting endpoint.
+        NamedRoute {
+            path: "/__ts/page-bids",
+            primary_methods: &[Method::GET, Method::OPTIONS],
+            handler: NamedRouteHandler::PageBids,
+        },
         NamedRoute {
             path: "/first-party/proxy",
             primary_methods: &[Method::GET],
@@ -328,7 +390,10 @@ fn named_route_handler(
                     }
                     NamedRouteHandler::LegacyAdminDenied => Ok(legacy_admin_alias_denied()),
                     NamedRouteHandler::Auction => {
-                        let ec_context = EcContext::default();
+                        // Build the geo-aware EC context so the auction consent
+                        // gate sees the caller's jurisdiction — `EcContext::default()`
+                        // fails it closed for consented users.
+                        let ec_context = build_ec_context(&state, &services, &req);
                         handle_auction(
                             &state.settings,
                             &state.orchestrator,
@@ -340,6 +405,30 @@ fn named_route_handler(
                         )
                         .await
                     }
+                    NamedRouteHandler::PageBids => {
+                        // SPA re-auction endpoint. `OPTIONS` is a CORS preflight
+                        // for this side-effecting GET and is always denied so the
+                        // GET handler's `X-TSJS-Page-Bids` gate stays trustworthy.
+                        if req.method() == Method::OPTIONS {
+                            Ok(page_bids_preflight_denied())
+                        } else {
+                            let ec_context = build_ec_context(&state, &services, &req);
+                            let auction = AuctionDispatch {
+                                orchestrator: &state.orchestrator,
+                                slots: state.settings.creative_opportunity_slots(),
+                                registry: None,
+                            };
+                            handle_page_bids(
+                                &state.settings,
+                                &services,
+                                None,
+                                auction,
+                                &ec_context,
+                                req,
+                            )
+                            .await
+                        }
+                    }
                     NamedRouteHandler::FirstPartyProxy => {
                         handle_first_party_proxy(&state.settings, &services, req).await
                     }
 
@@ -3,7 +3,7 @@ use std::sync::Arc;
 use async_trait::async_trait;
 use edgezero_core::context::RequestContext;
 use edgezero_core::error::EdgeError;
-use edgezero_core::http::{HeaderName, HeaderValue, Response};
+use edgezero_core::http::{HeaderValue, Response};
 use edgezero_core::middleware::{Middleware, Next};
 use trusted_server_core::auth::enforce_basic_auth;
 use trusted_server_core::constants::HEADER_X_GEO_INFO_AVAILABLE;
@@ -88,26 +88,19 @@ impl Middleware for AuthMiddleware {
 ///
 /// Unlike the Fastly variant, geo is always unavailable so `X-Geo-Info-Available: false`
 /// is unconditionally emitted. Fastly-specific headers are omitted.
-/// Operator-configured `settings.response_headers` are applied last and can override
-/// any managed header.
+/// Operator-configured `settings.response_headers` are applied last (with the
+/// shared cookie cache-privacy hardening) and can override any managed header.
 pub(crate) fn apply_finalize_headers(settings: &Settings, response: &mut Response) {
     response.headers_mut().insert(
         HEADER_X_GEO_INFO_AVAILABLE,
         HeaderValue::from_static("false"),
     );
 
-    for (key, value) in &settings.response_headers {
-        let header_name = HeaderName::from_bytes(key.as_bytes());
-        let header_value = HeaderValue::from_str(value);
-        if let (Ok(header_name), Ok(header_value)) = (header_name, header_value) {
-            response.headers_mut().insert(header_name, header_value);
-        } else {
-            log::warn!(
-                "Skipping invalid configured response header value for {}",
-                key
-            );
-        }
-    }
+    // Cookie-bearing responses stay private to shared caches and operator
+    // headers cannot re-enable caching for uncacheable per-user payloads.
+    trusted_server_core::response_privacy::apply_response_headers_with_cache_privacy(
+        settings, response,
+    );
 }
 
 // ---------------------------------------------------------------------------
 
@@ -642,6 +642,7 @@ mod tests {
             port: None,
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
+            between_bytes_timeout: Duration::from_secs(15),
             host_header_override: None,
         };
         let name1 = backend.predict_name(&spec).expect("should return a name");
@@ -661,6 +662,7 @@ mod tests {
             port: None,
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
+            between_bytes_timeout: Duration::from_secs(15),
             host_header_override: None,
         };
         assert_eq!(