Implement server-side ad slot templates with PBS and APS auction#680
Implement server-side ad slot templates with PBS and APS auction#680prk-Jr wants to merge 97 commits into
Conversation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Incorporate all review feedback (aram356 + jevansnyc): cache contract, consent/GDPR gating, async restructuring detail, CreativeOpportunityFormat schema, glob pattern fix, XSS escaping, win notifications, APS params, timeout config key, defineSlot fix, gpt.rs ownership, KV migration path, Phase 2 sketch - Fix Prettier formatting (format-docs CI) - Add implementation plan (12 tasks, TDD, ordered by dependency)
- Incorporate all review feedback (aram356 + jevansnyc): cache contract, consent/GDPR gating, async restructuring detail, CreativeOpportunityFormat schema, glob pattern fix, XSS escaping, win notifications, APS params, timeout config key, defineSlot fix, gpt.rs ownership, KV migration path, Phase 2 sketch - Fix Prettier formatting (format-docs CI) - Add implementation plan (12 tasks, TDD, ordered by dependency)
Replace the head-injected __ts_bids design with a server-cached bid delivery model fetched by the client via a new /ts-bids endpoint. The auction never blocks page rendering — </head> flushes immediately, body parses without waiting for bids, and the client fetches bids in parallel with content paint. Key changes: - §2 Goal: bid delivery decoupled from page rendering; FCP unchanged from no-TS baseline - §4.3 Auction Trigger: drop buffered/streaming dichotomy; single mode forces chunked encoding on all origins (WordPress, NextJS, etc.) - §4.4 Head Injection: only __ts_ad_slots and __ts_request_id injected at <head> open; bid results moved to /ts-bids endpoint - §4.6 Client Residual: __tsAdInit defines slots immediately, fetches bids via /ts-bids, applies targeting and fires refresh() after resolve - §4.7 (new) Caching Behavior: explicit cacheability table for HTML, JS, CSS, tsjs bundle, bid results; Fastly edge HTTP cache leveraged for origin HTML - §5 Request-Time Sequence: full mermaid diagram covering content + creative + burl flow with cache-hit and cache-miss branches; separate text sequences for cache-hit (~80ms FCP, ~900ms ad-visible) and cache-miss (~250ms FCP, ~1,050ms ad-visible) - §6 Performance Summary: cache-hit and cache-miss columns; FCP added as a tracked metric - §7 Implementation Scope: add bid_cache.rs, /ts-bids endpoint, force chunked encoding step - §8 Edge Cases: origin-agnostic entries; new entries for /ts-bids 404 and client-never-fetches-/ts-bids Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pivot from the /ts-bids fetch endpoint + in-process bid_cache design to
inline __ts_bids injection before </body>. The earlier design relied on
shared state that doesn't reliably survive Fastly Compute's per-request Wasm
isolate model — body injection achieves the same FCP property in a single
response with no shared-state requirement.
Key changes:
- §4.3: replace /ts-bids long-poll with bounded </body> hold tied to
A_deadline. Body content above </body> paints first; close-tag held
until auction completes or A_deadline fires (graceful __ts_bids = {}
fallback).
- §4.3: add auction-eligibility gating (consent, bot UA, prefetch hints,
HEAD method, slot match) so auctions fire on real first-page-load
impressions only.
- §4.4: replace __ts_request_id + /ts-bids machinery with two inline
<script> blocks — __ts_ad_slots at <head> open, __ts_bids before
</body> via lol_html el.on_end_tag().
- §4.5: move both nurl and burl to client-side firing from
slotRenderEnded after hb_adid match. Server-side firing rejected to
avoid billing inflation on bids that never render.
- §4.6: replace fetch+Promise pattern with synchronous __ts_bids read.
Add lazy slim-Prebid loader (post-window.load) for scroll/refresh
auctions and Phase B identity warm-up. Add ts_initial=1 slot-ownership
sentinel.
- §4.7: switch Cache-Control from private, no-store to private,
max-age=0 to preserve browser BFCache eligibility while still
preventing intermediate-cache leaks.
- §4.8 (new): document the EC/KV identity model as load-bearing auction
input — Phase A retrieval at request time, Phase B post-render
enrichment via slim-Prebid userID modules. Add bare-EC first-impression
caveat and auction_eid_count metric. Note federated-consortium
passphrase property and clickstream-compounding speed win.
- §5: update mermaid + cache-hit/miss timelines for bounded body hold;
ad-visible converges to ~870ms (hit) / ~1,020ms (miss).
- §6: drop /ts-bids RTT row; add DCL row; add clickstream-compounding,
TS-overhead, identity-coverage, and confidence-interval framing.
- §7: drop bid_cache.rs and /ts-bids endpoint from scope; add
auction-eligibility gating and slim-Prebid bundle build target. Add
explicit "Deleted" subsection.
- §8: drop /ts-bids edge cases; add SPA/pushState, bare-EC, bot/prefetch,
HEAD, BFCache restoration cases.
- §9.6: server-side GAM downgraded from "Phase 2 commitment" to
aspirational and contingent on Google agreement. §9.8 (slim-Prebid
bundle composition), §9.9 (Privacy Sandbox), §9.10 (per-bidder consent)
added as follow-ups.
Implementation plan at docs/superpowers/plans/2026-04-30-server-side-ad-templates.md
is now stale relative to this spec; needs regenerating before code lands.
…ities.toml Adds the creative_opportunities field to Settings struct to deserialize configuration for the server-side ad auction feature. Includes build.rs stubs for types required during build-time configuration validation. Creates creative-opportunities.toml with example slot configuration and updates trusted-server.toml with the [creative_opportunities] section defining GAM network ID, auction timeout, and price granularity settings. Tests pass with proper TOML parsing of the creative_opportunities section.
…ared auction state
- Add `ad_slots_script: Option<String>` and `ad_bids_state: Arc<RwLock<Option<String>>>` fields to `HtmlProcessorConfig`
- Update `from_settings` to initialize both new fields with safe defaults
- Prepend `ad_slots_script` inside the existing `<head>` handler before integration inserts
- Add `element!("body", ...)` handler that uses `end_tag_handlers()` to inject `__ts_bids` before `</body>`; falls back to empty `{}` when auction state is `None`
- Add `IntegrationRegistry::empty_for_tests()` test helper
- Add three new tests covering all injection paths
…gibility gates; max-age=0 - Make handle_publisher_request async; add orchestrator and slots_file params - Dispatch origin request with send_async before running auction in parallel - Gate auction on GET, no prefetch, no bot, matched slots, TCF purpose-1 consent - Run server-side auction and write bucketed bids to ad_bids_state Arc<RwLock> - Compute ad_slots_script after response headers; set Cache-Control: private, max-age=0 - Fix Stream arm to thread actual ad_slots_script and ad_bids_state through - Add build_auction_request, build_bid_map, build_bids_script, build_ad_slots_script helpers - Update route_tests.rs to pass empty slots_file to route_request
…m slotRenderEnded
- build_bid_map now returns serde_json::Map with full bid objects (hb_pb,
hb_bidder, hb_adid, nurl, burl) instead of a plain CPM string map
- build_bids_script / build_ad_slots_script now emit full <script> tags
using JSON.parse("…") for safe inline embedding; add html_escape_for_script helper
- build_ad_slots_script uses correct property names (gam_unit_path, div_id,
formats, targeting) matching the client-side TSJS bundle expectations
- Replace map_or(false, …) with is_some_and(…) on lines 546, 549, 567
- Add # Panics doc sections to handle_publisher_request and create_html_processor
…nities.toml at startup
… from slotRenderEnded; slim-Prebid lazy loader
- Enable APS and adserver_mock in auction config; set providers and mediator - Increase auction_timeout_ms from 500ms to 3000ms — 500ms was too tight for HTTPS round-trips to mocktioneer, leaving the mediator zero budget - Fix mediation request: send numeric price instead of opaque encoded_price; mocktioneer requires a decoded price field and does not support encoded_price - Expand creative-opportunities slot page_patterns to include /news/**
Define SlotRenderEndedEvent, SlotRenderEvent, and TestWindow types to eliminate all @typescript-eslint/no-explicit-any violations in gpt/index.ts and gpt/index.test.ts. Extend GptWindow with __tsjs_slim_prebid_url so installSlimPrebidLoader avoids the any cast.
prk-Jr
changed the title
Set gam_network_id to 88059007 (autoblog production network). Update atf_sidebar_ad slot to /88059007/autoblog/news with div_id ad-atf_sidebar-0-_r_2_ (desktop ATF sidebar, 300x250); restrict page_patterns to article paths only (/20**, /news/**) since that div does not exist on the homepage. Add homepage_header_ad slot targeting /88059007/autoblog/homepage with ad-header-0-_R_jpalubtak5lb_ for 970x90/728x90/970x250 leaderboard formats. Reduce auction_timeout_ms from 3000 to 500 to cap TTFB at the spec-recommended ceiling.
Both handle_publisher_request and handle_page_bids now run the full four-step EID pipeline (resolve_client_auction_eids → resolve_auction_eids → merge_auction_eids → gate_eids_by_consent) matching the client-side /auction endpoint. Previously both paths called parse_ts_eids_cookie, which read only the ts-eids browser cookie and skipped the KV identity graph lookup entirely. AuctionDispatch gains a registry field so the partner registry reaches handle_publisher_request without exceeding the seven-argument limit. handle_page_bids gains kv and registry parameters for the same reason. parse_ts_eids_cookie is moved to #[cfg(test)] as it is now test-only.
The file only emitted a rerun-if-changed watch for creative-opportunities.toml, which was deleted when slot config was consolidated into trusted-server.toml. Config validation now runs entirely in trusted-server-core/build.rs.
…atch Aligns log (0.4.29 → 0.4.32) and serde_json (1.0.149 → 1.0.150) with the versions already pulled into crates/integration-tests/Cargo.lock.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…mespace Replace all references to the deleted `creative-opportunities.toml` file with the `[creative_opportunities]` section in `trusted-server.toml`. Update all `window.__ts_*` global name references to the current `window.tsjs.*` namespace (tsjs.bids, tsjs.adSlots, tsjs.adInit).
Add `suppress_nurl: bool` (default `false`) to `PrebidIntegrationConfig`. When `true`, strips `nurl` and `burl` from PBS bids at parse time, preventing client-side double-firing via `sendBeacon` when PBS fires win notifications server-side (ext.prebid.events.enabled). Update `adserver_mock` test-bidder response to include example `nurl`/`burl` values so the win-notification pipeline is exercisable in unit tests.
ChristianPavilonis
left a comment
ChristianPavilonis
left a comment
There was a problem hiding this comment.
Automated review: I reviewed PR #680 at def951a against main. CI is green, but I found blocking privacy/security and correctness issues in the new server-side ad-template paths. In particular, the publisher/page-bids auction paths can forward persistent identifiers after EC consent is denied, the default config now enables automatic outbound ad calls to real endpoints, and the GPT/Prebid refresh paths can duplicate requests or reuse stale targeting. Details are inline.
ChristianPavilonis
left a comment
ChristianPavilonis
left a comment
There was a problem hiding this comment.
Summary
Reviewed the current branch PR #680 at 80fe39220 against main. I found several remaining issues that should be addressed in this PR because they affect the new server-side ad-template auction behavior: consent gating, the auction kill switch, PBS URL compatibility, SPA refresh flow, timeout budgets, and stale GPT targeting.
Per discussion, the raw browser-cookie forwarding concern is not included in this PR review and is tracked separately in #763.
Findings submitted inline: 0 P0, 4 P1, 1 P2, 1 P3. One additional P2 is included below because the affected provider timeout lines are not part of the final PR diff.
P2 — Provider payload timeouts ignore the effective auction budget
crates/trusted-server-core/src/integrations/prebid.rs:1171 and crates/trusted-server-core/src/integrations/aps.rs:367 still use provider config timeouts in the payload (tmax / APS timeout), while the Fastly backend timeout is capped to context.timeout_ms. When creative_opportunities.auction_timeout_ms is lower than the provider timeout, providers are told they have more time than the edge will actually wait, which can turn useful partial bids into edge timeouts. Please use the effective context.timeout_ms in provider payloads and add tests where provider config is 1000ms but auction context is 500ms.
aram356
left a comment
aram356
left a comment
There was a problem hiding this comment.
Summary
Server-side ad slot templates with PBS/APS auction — a large, well-tested feature (44 files, +12,746/−395). The XSS escaping, single-injection guard, consent gating, and price-bucket math are solid. Findings cluster around win/billing beacon correctness (the headline issue), a runtime slot-id validation gap, and JS test hygiene. Inline comments carry most findings; cross-cutting items are below.
Blocking
🔧 wrench
- Win/billing beacons over-fire / double-fire —
gpt_bootstrap.js:95andgpt/index.ts:440(inline). validate_slot_iddead at runtime — env-injected slot ids unvalidated,creative_opportunities.rs:270(inline).- JS test file leaks global
addEventListener; suites duplicated across two dirs —gpt/index.test.ts:10(inline). installSpaAuctionHookhas zero coverage —gpt/index.ts:475(inline).
❓ question
- Prebid stored-request fan-out behavioral change —
prebid.rs:974(inline). - page-bids
pathquery param not normalized before glob match —publisher.rs:1584(inline). - Cache-Control
max-age=0vs claimedno-store—publisher.rs:1214(inline).
Non-blocking (not pinnable to a single diff line)
🤔 thinking
- collect vs parallel auction paths may diverge —
auction/orchestrator.rscollect path callsprovider.parse_response(...)whilerun_providers_parallelcallsparse_response_with_context(...). If any provider's context-aware parse does extra work (consent/settings-driven), the async and parallel paths produce different bids for the same upstream response. Confirm the plainparse_responseis an equivalent superset, or thread context through the collect loop too.
🌱 seedling
- No per-iteration deadline check in the collect select-loop —
auction/orchestrator.rscollect_dispatched_auctionrelies entirely on each backend's dispatch-time timeout cap, whereasrun_providers_parallelre-checkselapsed >= deadlineafter eachselect(). The invariant holds today (dispatch caps each provider at the remaining budget), but the two paths diverge silently; mirror the guard for defense-in-depth.
♻️ refactor
adserver_mock.rs:101carries request-scopedbid_indexviaMutexon a sharedArcprovider — same pattern flagged inline onaps.rs:289; migrate toparse_response_with_context.
⛏ nitpick
platform_response_to_fastlyis infallible but returnsResult—auction/orchestrator.rs:497; every call site handles anErrthat can never fire. Returnfastly::Responsedirectly or document the forward-compat intent.- Redundant constructors —
PriceGranularity::dense()(returnsSelf::Dense, and the enum alreadyDefaults toDense) andMediaType::banner()add public API surface over the variant literals for no benefit.
CI Status
- cargo fmt: PASS
- cargo clippy: PASS
- cargo test: PASS
- vitest (JS): PASS
- CodeQL / integration / browser-integration: PASS
- Fail closed on consent: add consent_allows_server_side_auction() helper requiring effective TCF/GPP Purpose 1 for GDPR and unknown jurisdictions (or any request carrying an EU TCF signal); used by both the publisher navigation auction and /__ts/page-bids - Pass the adapter's geo-aware EcContext into handle_page_bids so the jurisdiction decision sees real geo instead of always-unknown - Make [auction].enabled a real kill switch for the automatic publisher navigation ad stack and the /__ts/page-bids auction - Normalize Prebid server_url: use it as-is when it already ends with /openrtb2/auction, otherwise append the path (backward compatible) - Advertise the effective auction budget in provider payloads: PBS tmax and APS timeout now use the orchestrator-capped context.timeout_ms instead of raw provider config - Add a one-shot adInitRefreshInProgress bypass so slim-Prebid's refresh wrapper passes adInit()'s internal refresh straight to GPT instead of clearing server-side targeting with a duplicate client-side auction - Sweep stale TS targeting (hb_*, ts_initial, route keys) from all previously TS-touched GPT slots before applying a new SPA route - Map the GPT slot element ID (container div) in the inline bootstrap's divToSlotId so container-backed slots fire nurl/burl beacons
- Dedupe win/billing beacons: fire each bid's nurl/burl at most once, keyed by slot + bid identity in shared tsjs state so the inline bootstrap and bundle listeners can never double-fire; unify the ourBidWon check (hb_adid confirmation with hb_bidder fallback for APS bids) across both implementations - Wire validate_slot_id into Settings::prepare_runtime so every load path (including env-injected slots on runtime-config adapters) rejects invalid slot IDs; build.rs settings stub gains a no-op - Normalize the client-controlled page-bids path parameter: strip query/fragment and force a leading slash before glob matching - Document the deliberate Cache-Control private, max-age=0 choice (BFCache eligibility per design spec section 4.7, not no-store) - Align orchestrator collect path with the parallel path: use parse_response_with_context for providers and the mediator, and add a defense-in-depth deadline check to the collect select-loop - Migrate adserver_mock off request-scoped Mutex state: the SSP bid index is rebuilt in parse_response_with_context from the context's provider responses; document why APS's slot_id_map cannot follow yet - Make platform_response_to_fastly infallible; drop the dead error arms - Remove redundant PriceGranularity::dense and MediaType::banner constructors in favor of Default-based serde field defaults - Clarify that the Prebid stored-request fallback cannot fire for the client /auction path (every ad unit carries a trustedServer entry) - Consolidate GPT JS suites under test/integrations/gpt/, replace the leaked module-scope addEventListener patch with a restored wrapper, and add installSpaAuctionHook coverage (pushState/replaceState/ popstate, stale-response guard, non-OK response, idempotence)
The edge injects adSlots and bids only when the server-side ad stack
runs for the request. When it is gated off (kill switch, consent
fail-closed, bots, prefetch), page code reading window.tsjs.bids or
window.tsjs.adSlots previously threw on undefined and could blank
SPA rendering. Core init now defaults them to {} / [] without
clobbering edge-injected values that arrive before the bundle.
Also flip the committed [auction] enabled default to true: with all
provider integrations disabled and no slot templates in the checked-in
config, the flag alone dispatches nothing, and the kill switch now
actually gating the ad stack means a false default breaks every
local/dev setup that enables a provider without noticing the flag.
|
All findings from the two latest reviews are addressed in d3d43bc, 0f4dd86, and aa43944. Inline threads have individual replies; the items below had no inline thread. @ChristianPavilonis — P2 provider payload timeouts (review body): Fixed in d3d43bc. PBS @aram356 — blocking:
@aram356 — questions:
@aram356 — non-blocking:
Deliberately deferred: gating aa43944 additionally defaults CI: cargo fmt / clippy |
…tes-impl # Conflicts: # crates/trusted-server-adapter-fastly/src/main.rs # crates/trusted-server-core/build.rs # crates/trusted-server-core/src/publisher.rs # crates/trusted-server-core/src/settings.rs
| @@ -630,6 +661,16 @@ fn finalize_response(settings: &Settings, geo_info: Option<&GeoInfo>, response: | |||
| } | |||
|
|
|||
| for (key, value) in &settings.response_headers { | |||
There was a problem hiding this comment.
Automated review: P1 — operator response headers can re-enable shared caching for per-user HTML
handle_publisher_request strips Surrogate-Control / Fastly-Surrogate-Control when it marks assembled HTML as Cache-Control: private, max-age=0, because the body can now contain per-user window.tsjs.bids and targeting state. However, finalize_response later reapplies every configured [response_headers] entry and only protects Cache-Control. If an operator has a global Surrogate-Control = "max-age=..." or Fastly-Surrogate-Control, this line re-adds it after the publisher path removed it, making a bid-injected HTML response eligible for shared surrogate caching.
Please treat surrogate cache headers like Cache-Control when the response already has a private cache directive: skip/remove Surrogate-Control and Fastly-Surrogate-Control in this loop, and add a route test showing private HTML/page-bids responses cannot regain those headers from settings.response_headers.
| ); | ||
| } | ||
|
|
||
| let winning_bids = if auction_enabled |
There was a problem hiding this comment.
Automated review: P2 — /__ts/page-bids is a side-effecting GET with no same-origin gate
Once these conditions pass, this public GET endpoint runs real PBS/APS auctions and forwards request-derived data (IP/UA/geo, consent signals, and any cookies browser policy permits) to partners. The TS client fetch does not send a custom header, and the server does not check Fetch Metadata, so a third-party page can trigger this endpoint from the user's browser even though it cannot read the JSON response. That still burns SSP quota and causes outbound partner calls unrelated to a real same-origin SPA navigation.
Please add a same-origin/CSRF-style gate before dispatching the auction, e.g. require Sec-Fetch-Site to be same-origin/same-site (or absent only for known legacy clients) and/or have the TS client send a non-simple X-TSJS-Page-Bids: 1 header. Requests failing the gate should return 403 or at least skip run_auction; add tests for missing/cross-site metadata.
| /// Deserialized as raw JSON values so build.rs can validate slot IDs | ||
| /// without pulling in the full runtime type. Uses `vec_from_seq_or_map` | ||
| /// so env var JSON blobs (strings) deserialize correctly. | ||
| #[serde( |
There was a problem hiding this comment.
Automated review: P2 — build-time validation no longer checks the runtime slot schema
The build script deserializes creative-opportunity slots as raw JSON and then validates only id presence/shape. That means cargo build can succeed and write target/trusted-server-out.toml for slots that the runtime schema will reject later (for example missing formats, malformed page_patterns, wrong provider field types). The deployed WASM would then fail settings load at request time instead of failing in CI/build.
Please validate slot_raw against a build-time schema that mirrors CreativeOpportunitySlot's required fields/types, or restructure the build script stubs so it can reuse the real runtime deserializer for creative-opportunity slots, while still preserving the env-var JSON blob support.
5 participants
Summary
[creative_opportunities]intrusted-server.toml. Matching slots are selected from the incoming document URL at the edge, andwindow.tsjs.adSlotsis injected at<head>open so initial GPT setup does not need a separate slot-discovery request.window.tsjs.bidsbefore</body>.window.tsjs.adInitGPT runtime path. It readswindow.tsjs.adSlotsandwindow.tsjs.bidssynchronously, defines or reuses GPT slots, applies slot-level andhb_*targeting, setsts_initial=1, refreshes the initial slots, and firesnurl/burlonly afterslotRenderEndedconfirms the TS bid won viahb_adid.[integrations.prebid].suppress_nurl_bidders, while retaining the deployment-wide[integrations.prebid].suppress_nurlcompatibility switch.window.tsjs.adSlots/ GPT metadata instead of placeholder refresh sizes.ts-eidscookie written by TSJS, gates EIDs by consent, and forwards them as OpenRTBuser.ext.eidsto PBS.ClientInfointo the server-side PBS request so bidders see the browser client context rather than the Fastly edge context.GET /__ts/page-bidshook, which updateswindow.tsjs.adSlots/window.tsjs.bidsand re-runswindow.tsjs.adInit()afterpushState,replaceState, orpopstatenavigations.What the server-side auction sends to PBS
user.idts-eccookie or generated EC identityuser.consent/user.ext.consentuser.ext.eidsts-eidscookie plus EC identity resolutionuser.ext.ec_freshdevice.uaUser-Agentheaderdevice.ipClientInfo.client_ipdevice.geodevice.dnttrueif setDNT: 1headerdevice.languageAccept-Languageheadersite.domain/site.pagesite.refRefererheaderregs.gdpr/regs.us_privacy/regs.gppimp.*[creative_opportunities]slot templates and Prebid configtmax[creative_opportunities].auction_timeout_ms, falling back to[auction].timeout_msChanges
trusted-server.toml[creative_opportunities]slot templates and documents Prebid nurl suppression knobs..env.example/ docsSUPPRESS_NURL_BIDDERS.crates/trusted-server-core/src/creative_opportunities.rscrates/trusted-server-core/src/settings.rs/build.rstrusted-server.toml.crates/trusted-server-core/src/publisher.rswindow.tsjs.adSlotsandwindow.tsjs.bids, applies cache-control safeguards, handles page-bids responses, and forwards client context.crates/trusted-server-core/src/html_processor.rstsjs.bidsinjection.crates/trusted-server-core/src/auction/*crates/trusted-server-core/src/integrations/prebid.rsnurl/burlpropagation, and per-bidder suppression.crates/trusted-server-core/src/integrations/aps.rscrates/trusted-server-core/src/integrations/adserver_mock.rscrates/trusted-server-core/src/integrations/gpt.rs/gpt_bootstrap.jswindow.tsjs.adInitbootstrap path.crates/js/lib/src/integrations/gpt/index.tswindow.tsjs.adSlots,window.tsjs.bids, render-confirmed beacon firing, SPA updates, slim-Prebid loading, and Prebid creative rendering bridge.crates/js/lib/src/integrations/prebid/index.tscrates/trusted-server-adapter-fastly/src/main.rsCloses
Closes #677
Closes #697
Closes #698
Closes #699
Closes #700
Closes #702
Test plan
Automated
cargo test --workspacecargo clippy --workspace --all-targets --all-features -- -D warningscargo fmt --all -- --checkgit diff --checkcd crates/js/lib && node build-all.mjscd crates/js/lib && npm run lintcd crates/js/lib && npm run formatcd docs && npm run formatcd crates/js/lib && npx vitest runcurrently fails before test discovery in this workspace withERR_REQUIRE_ESMfromhtml-encoding-snifferrequiring@exodus/bytes/encoding-lite.js; no local JS test assertions execute under that failure mode.Manual end-to-end (browser DevTools console)
The steps below build on each other. Use a URL whose path matches one of the configured
[[creative_opportunities.slot]]page_patterns.Step 1 - Verify slot config is injected at
<head>openExpected: an array of slot objects. Each entry has
id,gam_unit_path,div_id,formats, andtargeting. Note thediv_idvalue from one matching slot for step 3.Step 2 - Verify server-side auction results are injected before
</body>Expected: an object keyed by slot ID. Winning slots include
hb_bidder,hb_pb, and, for Prebid cache-backed bids,hb_adid/ cache fields.Step 3 - Verify
window.tsjs.adInitwired GPT targetingReplace
SLOT_DIV_IDwith thediv_idfrom step 1.Expected: the slot has the configured GAM unit path and targeting includes
hb_pb,hb_bidder, any slot-level keys such aspos/zone, andts_initial: ["1"].Step 4 - Verify slot matching is page-pattern-aware
Navigate to a different configured path, for example
/when homepage slots are configured, and repeat step 2.Expected:
window.tsjs.bidsis keyed by the slots matching that page, not by slots from the previous page type.Step 5 - Confirm no duplicate bids injection
View page source and search for
.bids=JSON.parse.Expected: exactly one
window.tsjs.bidsassignment before</body>on pages where an auction ran.Pending (GAM line items required)
Creative delivery requires standard GAM line items targeting
hb_pb,hb_bidder, and related Prebid keys. That setup is outside this PR.Checklist
unwrap()in production codelogmacros instead ofprintln!