Add managed LiveRamp RampID integration - #1054
Draft
prk-Jr wants to merge 29 commits into
Draft
Conversation
The bundle imported consentManagementTcf, consentManagementGpp and consentManagementUsp, which only retrieve the consent signal. The activity controls that act on it live in Prebid's tcfControl module, which was not bundled, so a denied purpose changed nothing. Reproduced with the real bundle and shim in JSDOM against a CMP stub denying Purpose 1 and vendor 97: identityLink still issued a credentialed GET to LiveRamp's envelope endpoint, still wrote idl_env and its bookkeeping cookies, and the envelope still reached the ts-eids cookie. The run was identical to the consent-granted one. Server-side gating stops EID forwarding only, not the browser's collection and storage. Import tcfControl alongside the consent collectors and lock the behavior with a regression test that evaluates both production artifacts: denied purposes must produce no vendor call and no storage, granted purposes must still resolve. Note the scope: tcfControl enforces for every bidder and User ID module in the bundle, not only LiveRamp. Regenerating a bundle is a manual step, so this reaches a publisher only when `ts prebid bundle` is re-run.
`[integrations.prebid.liveramp]` combined with a pinned `bundle.user_id_modules` list that lacks identityLinkIdSystem is valid config that builds a bundle unable to serve it. The managed identityLink entry the server injects has no submodule to drive, and the only signal is a browser-side diagnostic. Fail in `ts prebid bundle`, which already reads both keys from the same file. An absent list still takes the generator's default preset, which includes the module.
Three fixes to the setConfig and mergeConfig guards: Skip seeding when getConfig is missing. `hasPrebidJsApi` only requires registerBidAdapter, so getConfig can be absent. The previous fallback read an empty entry list and then seeded the managed entry alone, silently dropping every publisher module already configured. Log and leave the wrappers installed instead, so a later publisher userIds call still gets the managed entry. Build the managed entry per call. Prebid retains what it receives as `submodule.config` for the life of the page, so one shared instance let any mutation there leak into every later normalization. Keep the normalization guard but report the error. Publisher configuration is arbitrary page data and a throwing accessor must not break the publisher's own setConfig call, so the guard stays; it now logs what failed instead of discarding it. The redundant hasUserIdsPath check is dropped since withManagedLiveRampUserId already performs it.
merge_auction_eids_deduplicates_liveramp_and_prefers_resolved_metadata was merge_auction_eids_prefers_server_resolved_metadata_on_conflict with the source string changed. merge_auction_eids is source-agnostic, so it added no coverage. gate_eids_by_consent is all-or-nothing across sources. Rename its test and give it a second source so the name no longer implies per-source gating that does not exist.
The inline closure that mapped PrebidLiveRampConfig into its camel-cased injection struct pushed rustfmt into indenting the whole payload literal an extra level. A From implementation keeps the mapping next to the struct it builds and restores the surrounding formatting.
The degraded-behavior table said only that no EID is forwarded when consent is absent, which read as though nothing happened. Separate the TCF case, where tcfControl now blocks resolution outright, from the US-state case, where the server's forwarding gate is what applies. Add the browser-side footprint the previous text omitted: the credentialed request the page makes to LiveRamp's envelope endpoint, that Trusted Server does not proxy it, the connect-src allowance a strict CSP needs, and every storage entry IdentityLink writes. Note that the submodule prefers an ATS library already on the page, and that this is therefore not a first-party replacement for LiveRamp recognition. Also record that the environment override cannot introduce the subsection, that `ts prebid bundle` rejects a module list without identityLinkIdSystem, that regenerating a bundle now enforces TCF for every bidder and User ID module, and that KV persistence needs a matching [[ec.partners]] entry. Correct the design document's consent section, which assumed the consent-management modules were themselves the enforcement point, and flag the remaining GPP gap.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CI lints trusted-server-cli and trusted-server-openrtb-codegen explicitly because no adapter-scoped alias covers them, but both invocations pin x86_64-unknown-linux-gnu. There was no command a developer could run locally to reproduce them, and CLAUDE.md's CI gate list named only the six adapter aliases, so running the documented gates locally passed while CI failed on a clippy::doc_markdown error in the CLI. Add clippy-cli and clippy-codegen. Both omit --target so they build for the host, and record them in the gate list.
CodeQL flagged js/incomplete-url-substring-sanitization on both assertions. These are not sanitizers — the URLs come from the test's own fetch spy — so the alert is not a vulnerability, but the substring test is still too loose for an assertion: it would also match an unrelated host carrying api.rlcdn.com in its name or query string, letting the granted-consent case count the wrong request. Compare the parsed hostname instead. Verified the test is still non-vacuous: dropping the tcfControl import fails two of its three cases.
Contributor
|
Flagging a design-guidance conflict before this goes further, with a concrete way to resolve it. This PR puts a named vendor into That runs against the project's own provider guidance. The pluggable providers design spec ( The awkward part is the sequencing. The seam that would host this cleanly is sitting reviewed-ready in #1043 (the pluggable Edge Cookie provider seam) and #1045 (the permission model), which restructure the very files this PR edits: Suggested way forward, which I think helps this PR rather than blocks it:
Happy to do the adaptation work myself if that is useful: the provider seam is mine and I can put up the RampID-as-provider version against #1043 quickly. Raised with AI assistance under my direction; the file and line references above were checked against the current diff. |
…ules
`trusted-server-core` named a single identity vendor: `PrebidLiveRampConfig`,
`PrebidLiveRampStorageType`, `validate_liveramp_placement_id`, and defaults
encoding LiveRamp's own recommendations. Which identity vendor a deployment
uses is an operator configuration choice, so core should not carry it.
Replace `[integrations.prebid.liveramp]` with an array of opaque entries:
[[integrations.prebid.managed_user_ids]]
name = "identityLink"
params = { pid = "999", notUse3P = false }
[integrations.prebid.managed_user_ids.storage]
type = "cookie"
name = "idl_env"
Core validates only what Prebid.js needs to address a module — a usable entry
name and storage key, positive expiry and refresh, unique names — and forwards
`params` without inspecting them. Values that were typed defaults in core
(`idl_env`, 15 days, 1800 seconds) are now operator-supplied, because each is a
property of the selected module rather than of Trusted Server. `expires` gains
no upper bound for the same reason.
The browser shim follows: `withManagedUserIds` keys on each configured name
instead of a hardcoded `identityLink`, so any Prebid User ID module works
without a code change. Entries are deep-cloned rather than spread, since
`params` now accepts nested tables and Prebid retains what it receives as
`submodule.config` for the life of the page.
Also bundle Prebid's `tcfControl` alongside the `consentManagement*` modules.
Without it a TC string that denies a purpose changed nothing: User ID
submodules still wrote storage and still called their vendor endpoints.
Drop the `ts prebid bundle` guard that cross-checked `[...liveramp]` against
`identityLinkIdSystem`. Pairing a managed entry with its bundle module is the
operator's responsibility; a name-to-module table in the CLI would be vendor
knowledge that duplicates the registry the bundle generator already reads and
would go stale against newly released Prebid modules. Documented as unvalidated.
Verified end to end in a browser against a running adapter: config reaches
`window.__tsjs_prebid.managedUserIds` verbatim, the shim installs and defends
the entry against publisher `setConfig`/`mergeConfig` overrides while
preserving unrelated entries, and an envelope flows opaquely through
`getUserIdsAsEids` to OpenRTB `user.ext.eids` and the `ts-eids` cookie.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
liveramp.comEIDs through the existing auction, consent, edge-cookie, and EC/KV paths, with generated-artifact coverage for exact default TCF behavior.Status
Code complete; live LiveRamp validation pending IABTechLab/uid2-optout#385.
Changes
.cargo/config.tomlCLAUDE.mdcrates/trusted-server-cli/src/prebid_bundle.rsidentityLinkIdSystem.crates/trusted-server-core/src/consent/mod.rscrates/trusted-server-core/src/ec/prebid_eids.rscrates/trusted-server-core/src/integrations/prebid.rscrates/trusted-server-js/lib/build-prebid-external.mjstcfControlwith generated Prebid artifacts.crates/trusted-server-js/lib/src/integrations/prebid/index.tscrates/trusted-server-js/lib/test/build-prebid-external.test.mjscrates/trusted-server-js/lib/test/integrations/prebid/index.test.tscrates/trusted-server-js/lib/test/integrations/prebid/user_id_modules.test.tscrates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjsuserSyncupdates and auction EID output.crates/trusted-server-js/lib/test/prebid-consent-enforcement.test.mjsdocs/guide/configuration.mddocs/guide/integrations/prebid.mddocs/superpowers/plans/2026-08-21-liveramp-integration.mddocs/superpowers/specs/2026-08-21-liveramp-integration-design.mdtrusted-server.example.tomlCloses
Closes #355
Test plan
cargo test-fastly && cargo test-axum && cargo test-cloudflare && cargo test-spincargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm && cargo clippy-cli && cargo clippy-codegencargo fmt --all -- --checkcd crates/trusted-server-js/lib && npx vitest runcd crates/trusted-server-js/lib && node build-all.mjscd crates/trusted-server-js/lib && npm run lint && npm run format./scripts/test-cli.shcd docs && npm run formatcargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1fastly compute serveHardening note
This change does not add config-derived regular-expression or pattern compilation. Invalid enabled LiveRamp configuration is rejected by typed validation and covered by Rust and CLI regression tests.
Checklist
unwrap()calls were introduced in production code.Acceptance boundary
RampID identity envelopes traverse the existing Prebid auction path; ATS Direct audience segments are not passed by this implementation.