Implement server-side ad slot templates with PBS and APS auction

.env.example

@@ -37,14 +37,15 @@ TRUSTED_SERVER__REQUEST_SIGNING__ENABLED=false
 
 # Prebid
 TRUSTED_SERVER__INTEGRATIONS__PREBID__ENABLED=false
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid-server.com/openrtb2/auction
+# TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid-server.example.com/openrtb2/auction
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__TIMEOUT_MS=1000
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS=kargo,rubicon,appnexus
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_OVERRIDES='{"bidder-name":{"param1":12345,"param2":"value"}}'
 # Compatibility env shape for bidder -> zone -> params overrides
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_ZONE_OVERRIDES='{"kargo":{"header":{"placementId":"_abc"}}}'
 # Preferred canonical env shape for future generic rules
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_OVERRIDE_RULES='[{"when":{"bidder":"kargo","zone":"header"},"set":{"placementId":"_abc"}}]'
+# TRUSTED_SERVER__INTEGRATIONS__PREBID__SUPPRESS_NURL_BIDDERS=exampleBidder,anotherBidder
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__AUTO_CONFIGURE=false
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__DEBUG=false
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__TEST_MODE=false

.gitignore

@@ -51,3 +51,9 @@ src/*.html
 /crates/trusted-server-integration-tests/browser/test-results/
 /crates/trusted-server-integration-tests/browser/playwright-report/
 /crates/trusted-server-integration-tests/browser/.browser-test-state.json
+
+# Defunct pre-rename crate dirs (renamed to crates/trusted-server-*); ignore the
+# leftover local build artifacts (node_modules, target, dist) that remain on disk.
+/crates/js/
+/crates/integration-tests/
+

Cargo.toml

@@ -56,6 +56,7 @@ fastly = "0.12"
 fern = "0.7.1"
 flate2 = "1.1"
 futures = "0.3"
+glob = "0.3"
 hex = "0.4.3"
 hmac = "0.12.1"
 http = "1.4.0"

crates/trusted-server-adapter-axum/src/app.rs

@@ -19,7 +19,7 @@ use trusted_server_core::proxy::{
     handle_first_party_proxy_sign,
 };
 use trusted_server_core::publisher::{
-    buffer_publisher_response, handle_publisher_request, handle_tsjs_dynamic,
+    AuctionDispatch, buffer_publisher_response, handle_publisher_request, handle_tsjs_dynamic,
 };
 use trusted_server_core::request_signing::{
     handle_trusted_server_discovery, handle_verify_signature,
@@ -166,9 +166,24 @@ async fn dispatch_fallback(
             });
     }
 
-    handle_publisher_request(&state.settings, &state.registry, services, req)
-        .await
-        .and_then(|pr| buffer_publisher_response(pr, &method, &state.settings, &state.registry))
+    // Server-side auction is deferred for the EdgeZero adapters: pass no slots
+    // so `handle_publisher_request` dispatches no auction.
+    let mut ec_context = EcContext::default();
+    let auction = AuctionDispatch {
+        orchestrator: &state.orchestrator,
+        slots: &[],
+        registry: None,
+    };
+    handle_publisher_request(
+        &state.settings,
+        services,
+        None,
+        &mut ec_context,
+        auction,
+        req,
+    )
+    .await
+    .and_then(|pr| buffer_publisher_response(pr, &method, &state.settings, &state.registry))
 }
 
 fn fallback_handler(

crates/trusted-server-adapter-axum/src/platform.rs

@@ -642,6 +642,7 @@ mod tests {
             port: None,
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
+            between_bytes_timeout: Duration::from_secs(15),
             host_header_override: None,
         };
         let name1 = backend.predict_name(&spec).expect("should return a name");
@@ -661,6 +662,7 @@ mod tests {
             port: None,
             certificate_check: true,
             first_byte_timeout: Duration::from_secs(15),
+            between_bytes_timeout: Duration::from_secs(15),
             host_header_override: None,
         };
         assert_eq!(

crates/trusted-server-adapter-cloudflare/src/app.rs

@@ -19,7 +19,8 @@ use trusted_server_core::proxy::{
     handle_first_party_proxy_sign,
 };
 use trusted_server_core::publisher::{
-    PublisherResponse, buffer_publisher_response, handle_publisher_request, handle_tsjs_dynamic,
+    AuctionDispatch, PublisherResponse, buffer_publisher_response, handle_publisher_request,
+    handle_tsjs_dynamic,
 };
 use trusted_server_core::request_signing::{
     handle_deactivate_key, handle_rotate_key, handle_trusted_server_discovery,
@@ -296,11 +297,24 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
                         }))
                     })
             } else {
-                handle_publisher_request(&state.settings, &state.registry, &services, req)
-                    .await
-                    .and_then(|pr| {
-                        resolve_publisher_response(pr, &method, &state.settings, &state.registry)
-                    })
+                let mut ec_context = EcContext::default();
+                let auction = AuctionDispatch {
+                    orchestrator: &state.orchestrator,
+                    slots: &[],
+                    registry: None,
+                };
+                handle_publisher_request(
+                    &state.settings,
+                    &services,
+                    None,
+                    &mut ec_context,
+                    auction,
+                    req,
+                )
+                .await
+                .and_then(|pr| {
+                    resolve_publisher_response(pr, &method, &state.settings, &state.registry)
+                })
             };
 
             Ok(result.unwrap_or_else(|e| http_error(&e)))

crates/trusted-server-adapter-fastly/Cargo.toml

@@ -21,6 +21,7 @@ log = { workspace = true }
 log-fastly = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+toml = { workspace = true }
 trusted-server-core = { workspace = true }
 url = { workspace = true }
 urlencoding = { workspace = true }

crates/trusted-server-adapter-fastly/src/app.rs

@@ -715,16 +715,35 @@ async fn dispatch_fallback(
         // be opened, matching legacy behavior.
         match runtime_services_for_consent_route(&state.settings, services) {
             Ok(publisher_services) => {
-                handle_publisher_request(&state.settings, &state.registry, &publisher_services, req)
-                    .await
-                    .and_then(|pub_response| {
-                        buffer_publisher_response(
-                            pub_response,
-                            &method,
-                            &state.settings,
-                            &state.registry,
-                        )
-                    })
+                // Server-side auction is not yet wired into the EdgeZero buffered
+                // finalize path (`buffer_publisher_response` runs the
+                // synchronous pipeline, which does not collect dispatched SSP
+                // bids). Pass no slots so `handle_publisher_request` dispatches no
+                // auction and no bid requests are wasted. The legacy path runs the
+                // full server-side auction; wiring it here is deferred to the
+                // EdgeZero cutover.
+                let auction = trusted_server_core::publisher::AuctionDispatch {
+                    orchestrator: &state.orchestrator,
+                    slots: &[],
+                    registry: None,
+                };
+                handle_publisher_request(
+                    &state.settings,
+                    &publisher_services,
+                    ec.kv_graph.as_ref(),
+                    &mut ec.ec_context,
+                    auction,
+                    req,
+                )
+                .await
+                .and_then(|pub_response| {
+                    buffer_publisher_response(
+                        pub_response,
+                        &method,
+                        &state.settings,
+                        &state.registry,
+                    )
+                })
             }
             Err(e) => Err(e),
         }