Merge the Edge Cookie review follow-ups through split/3

Brings upd/split/3-permissions at e3bb4b9 into split/4-client-resolve.
That carries the split/1 review follow-ups (0980b73, 0e7f7eb,
fb1bc28, cb6f717 and 1b88e42), their merge into split/3 under
that branch's permission gate, and split/3's be0ed2d, which lets the
Cloudflare and Spin startup tests from main's #1016 load under the
single-jurisdiction rule. This branch carries the same four settings
blocks, so it takes that fix here.

The merge had no conflicts. The resolve endpoint already applies a
provider's response headers only with the 200 that sets the cookie or
the 204 when the provider creates nothing, which is the rule cb6f717
brings to organic generation, so nothing in resolve.rs changes.

Tests. The merged tree passes a native all-targets check, 2,885 core
tests, the Axum, Cloudflare and Spin adapter tests, the permission
signal crate tests, and the Fastly, Cloudflare and Spin wasm checks.

Author: jwrosewell

crates/trusted-server-adapter-cloudflare/src/app.rs

@@ -811,6 +811,9 @@ mod tests {
 
                 [ec]
                 passphrase = "fictional-secret-key-32-bytes-minimum"
+
+                [geo]
+                assume_single_jurisdiction = true
             "#,
         )
         .expect("should parse startup test settings");
@@ -859,6 +862,9 @@ mod tests {
 
                 [ec]
                 passphrase = "fictional-secret-key-32-bytes-minimum"
+
+                [geo]
+                assume_single_jurisdiction = true
             "#,
         )
         .expect("should parse startup test settings");
@@ -903,6 +909,9 @@ mod tests {
 
                 [ec]
                 passphrase = "fictional-secret-key-32-bytes-minimum"
+
+                [geo]
+                assume_single_jurisdiction = true
             "#,
         )
         .expect("should parse startup test settings");

crates/trusted-server-adapter-spin/src/app.rs

@@ -1021,6 +1021,9 @@ mod tests {
 
                 [ec]
                 passphrase = "fictional-secret-key-32-bytes-minimum"
+
+                [geo]
+                assume_single_jurisdiction = true
             "#,
         )
         .expect("should parse startup test settings");

crates/trusted-server-core/src/auction/endpoints.rs

@@ -305,8 +305,13 @@ pub async fn handle_auction(
     // EC and both KV and partner stores are available. Gate the read on a
     // present registry: without one, `resolve_auction_eids` yields no
     // server-side EIDs, so the snapshot would be an unused billable KV read.
+    // The row is read under the owning provider's canonical form of the
+    // identifier, the key it is stored under, rather than under the identifier
+    // as issued.
     let auction_kv_snapshot = match (kv, ec_id.as_deref(), registry) {
-        (Some(graph), Some(ec_id), Some(_)) => graph.load_snapshot(ec_id),
+        (Some(graph), Some(_), Some(_)) => ec_context
+            .ec_kv_key()
+            .map_or(EcKvSnapshot::NotRead, |kv_key| graph.load_snapshot(&kv_key)),
         _ => EcKvSnapshot::NotRead,
     };
     // Hand the loaded row to the request context so response finalization —
@@ -452,7 +457,13 @@ pub(crate) fn resolve_auction_eids(
 
     let ec_id = ec_context.ec_value()?;
 
-    let Some(entry) = snapshot.entry_for(ec_id) else {
+    // Callers read the snapshot under the identity-graph key, the owning
+    // provider's canonical form of the identifier, so the entry is looked up
+    // under that key rather than under the identifier as issued.
+    let Some(entry) = ec_context
+        .kv_key_for(ec_id)
+        .and_then(|kv_key| snapshot.entry_for(&kv_key))
+    else {
         return Some(Vec::new());
     };
 
@@ -625,6 +636,7 @@ mod tests {
     use crate::auction::types::{AuctionRequest, AuctionResponse};
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::ConsentContext;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingProvider};
     use crate::error::IntoHttpResponse as _;
     use crate::openrtb::Uid;
     use crate::platform::test_support::{
@@ -809,6 +821,84 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn auction_endpoint_loads_the_row_under_the_canonical_key() {
+        // The identity graph stores a row under the owning provider's
+        // canonical form of the identifier. Loaded and resolved under the
+        // identifier as issued, a provider whose canonical form differs from
+        // the cookie value found no row, so the auction carried no server-side
+        // EIDs and the context kept a snapshot bound to the wrong key.
+        let settings = create_test_settings();
+        let had_eids = Arc::new(std::sync::Mutex::new(None));
+        let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: true,
+            providers: AuctionConfig::legacy_provider_map(&["eid_capturing_provider"]),
+            timeout_ms: 2000,
+            mediator: None,
+            ..Default::default()
+        });
+        orchestrator.register_provider(Arc::new(EidCapturingProvider {
+            had_eids: Arc::clone(&had_eids),
+        }));
+        let registry = PartnerRegistry::from_config(&[counting_test_partner("ssp.example.com")])
+            .expect("should build partner registry");
+        let graph = KvIdentityGraph::in_memory("canonical-auction-store");
+        graph
+            .create(
+                CANONICAL_KV_KEY,
+                &crate::ec::kv_types::KvEntry::minimal(
+                    "ssp.example.com",
+                    "partner-uid-123",
+                    1_741_824_000,
+                ),
+            )
+            .expect("should seed the row under the canonical key");
+        let mut ec_context = make_non_regulated_ec_context(Some(CANONICAL_COOKIE_VALUE))
+            .with_provider_for_test(Arc::new(CanonicalizingProvider));
+        let req = Request::builder()
+            .method("POST")
+            .uri("https://test-publisher.com/auction")
+            .body(EdgeBody::from(
+                serde_json::to_vec(&json!({
+                    "adUnits": [
+                        {
+                            "code": "div-gpt-ad-1",
+                            "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+                        }
+                    ]
+                }))
+                .expect("should serialize body"),
+            ))
+            .expect("should build auction request");
+
+        // The capturing provider records whether the request carried EIDs and
+        // then fails its launch, which is all this test needs. The request
+        // carries no client EIDs, so any EID it records came from the graph.
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            Some(&graph),
+            Some(&registry),
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+
+        assert!(
+            ec_context
+                .kv_snapshot()
+                .entry_for(CANONICAL_KV_KEY)
+                .is_some(),
+            "the endpoint should load the row stored under the canonical key"
+        );
+        assert_eq!(
+            *had_eids.lock().expect("should lock captured eids"),
+            Some(true),
+            "the auction should carry the canonical row's partner ID as an EID"
+        );
+    }
+
     /// Provider that fails the test if it is ever contacted. Used to prove the
     /// `/auction` consent gate short-circuits before any outbound bid request.
     struct PanicOnBidProvider;