Merge the Edge Cookie review follow-ups through split/2

Brings upd/split/2-device-geo at 37eadae, which carries the split/1
review follow-ups (0980b73, 0e7f7eb, fb1bc28, cb6f717 and
1b88e42), into split/3-permissions. Two blocks conflicted.

- The build_pull_sync_context doc keeps this branch's statement that
  pull sync needs the sharing permission pair, and adds the follow-up's
  case where no provider this deployment reads owns the identifier.
- In handle_publisher_request the forwarded identifier keeps this
  branch's ec_sharing_allowed() filter, and the follow-up's
  active_kv_key line goes in front of it, so the navigation preload
  reads and compares the row under the canonical key.

One test needed a change without a textual conflict. The follow-up's
auction_endpoint_loads_the_row_under_the_canonical_key built its
context with make_ec_context(Jurisdiction::NonRegulated, ...), and on
this branch that helper takes the permission gate as a bool. The test
now uses this branch's make_non_regulated_ec_context, which opens the
gate in a non-regulated jurisdiction. The other new tests build their
context with EcContext::new_for_test, which on this branch grants
storage and personalized-ad selection, so they pass the sharing gate
unchanged.

Tests. The merged tree passes a native all-targets check, 2,851 core
tests, the Axum, Cloudflare and Spin adapter tests, the permission
signal crate tests, and the Fastly, Cloudflare and Spin wasm checks.

Author: jwrosewell

crates/trusted-server-core/src/auction/endpoints.rs

@@ -305,8 +305,13 @@ pub async fn handle_auction(
     // EC and both KV and partner stores are available. Gate the read on a
     // present registry: without one, `resolve_auction_eids` yields no
     // server-side EIDs, so the snapshot would be an unused billable KV read.
+    // The row is read under the owning provider's canonical form of the
+    // identifier, the key it is stored under, rather than under the identifier
+    // as issued.
     let auction_kv_snapshot = match (kv, ec_id.as_deref(), registry) {
-        (Some(graph), Some(ec_id), Some(_)) => graph.load_snapshot(ec_id),
+        (Some(graph), Some(_), Some(_)) => ec_context
+            .ec_kv_key()
+            .map_or(EcKvSnapshot::NotRead, |kv_key| graph.load_snapshot(&kv_key)),
         _ => EcKvSnapshot::NotRead,
     };
     // Hand the loaded row to the request context so response finalization —
@@ -452,7 +457,13 @@ pub(crate) fn resolve_auction_eids(
 
     let ec_id = ec_context.ec_value()?;
 
-    let Some(entry) = snapshot.entry_for(ec_id) else {
+    // Callers read the snapshot under the identity-graph key, the owning
+    // provider's canonical form of the identifier, so the entry is looked up
+    // under that key rather than under the identifier as issued.
+    let Some(entry) = ec_context
+        .kv_key_for(ec_id)
+        .and_then(|kv_key| snapshot.entry_for(&kv_key))
+    else {
         return Some(Vec::new());
     };
 
@@ -625,6 +636,7 @@ mod tests {
     use crate::auction::types::{AuctionRequest, AuctionResponse};
     use crate::consent::jurisdiction::Jurisdiction;
     use crate::consent::types::ConsentContext;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingProvider};
     use crate::error::IntoHttpResponse as _;
     use crate::openrtb::Uid;
     use crate::platform::test_support::{
@@ -809,6 +821,84 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn auction_endpoint_loads_the_row_under_the_canonical_key() {
+        // The identity graph stores a row under the owning provider's
+        // canonical form of the identifier. Loaded and resolved under the
+        // identifier as issued, a provider whose canonical form differs from
+        // the cookie value found no row, so the auction carried no server-side
+        // EIDs and the context kept a snapshot bound to the wrong key.
+        let settings = create_test_settings();
+        let had_eids = Arc::new(std::sync::Mutex::new(None));
+        let mut orchestrator = AuctionOrchestrator::new(AuctionConfig {
+            enabled: true,
+            providers: AuctionConfig::legacy_provider_map(&["eid_capturing_provider"]),
+            timeout_ms: 2000,
+            mediator: None,
+            ..Default::default()
+        });
+        orchestrator.register_provider(Arc::new(EidCapturingProvider {
+            had_eids: Arc::clone(&had_eids),
+        }));
+        let registry = PartnerRegistry::from_config(&[counting_test_partner("ssp.example.com")])
+            .expect("should build partner registry");
+        let graph = KvIdentityGraph::in_memory("canonical-auction-store");
+        graph
+            .create(
+                CANONICAL_KV_KEY,
+                &crate::ec::kv_types::KvEntry::minimal(
+                    "ssp.example.com",
+                    "partner-uid-123",
+                    1_741_824_000,
+                ),
+            )
+            .expect("should seed the row under the canonical key");
+        let mut ec_context = make_non_regulated_ec_context(Some(CANONICAL_COOKIE_VALUE))
+            .with_provider_for_test(Arc::new(CanonicalizingProvider));
+        let req = Request::builder()
+            .method("POST")
+            .uri("https://test-publisher.com/auction")
+            .body(EdgeBody::from(
+                serde_json::to_vec(&json!({
+                    "adUnits": [
+                        {
+                            "code": "div-gpt-ad-1",
+                            "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+                        }
+                    ]
+                }))
+                .expect("should serialize body"),
+            ))
+            .expect("should build auction request");
+
+        // The capturing provider records whether the request carried EIDs and
+        // then fails its launch, which is all this test needs. The request
+        // carries no client EIDs, so any EID it records came from the graph.
+        let _ = handle_auction(
+            &settings,
+            &orchestrator,
+            Some(&graph),
+            Some(&registry),
+            &mut ec_context,
+            &noop_services(),
+            req,
+        )
+        .await;
+
+        assert!(
+            ec_context
+                .kv_snapshot()
+                .entry_for(CANONICAL_KV_KEY)
+                .is_some(),
+            "the endpoint should load the row stored under the canonical key"
+        );
+        assert_eq!(
+            *had_eids.lock().expect("should lock captured eids"),
+            Some(true),
+            "the auction should carry the canonical row's partner ID as an EID"
+        );
+    }
+
     /// Provider that fails the test if it is ever contacted. Used to prove the
     /// `/auction` consent gate short-circuits before any outbound bid request.
     struct PanicOnBidProvider;

crates/trusted-server-core/src/ec/admin.rs

@@ -197,8 +197,11 @@ pub fn deny_admin_diagnostic_fallback(req: &Request<EdgeBody>) -> Option<Respons
 /// Successful admin EC lookup payload.
 #[derive(Debug, Serialize)]
 struct AdminEcLookupResponse {
-    /// The EC ID that was looked up.
+    /// The EC ID as requested, from the path or the `ts-ec` cookie.
     ec_id: String,
+    /// The identity-graph key the entry was read from, being the canonical form
+    /// of `ec_id` that [`AcceptedProviders::canonical_kv_key`] returns.
+    kv_key: String,
     /// Platform KV store name the entry was read from.
     store: String,
     /// Store generation marker for the entry.
@@ -283,22 +286,33 @@ pub fn handle_admin_ec_lookup(
         return Ok(admin_ec_lookup_not_supported());
     };
 
-    let ec_id = match requested_ec_id(req, &AcceptedProviders::active(provider)) {
-        Ok(ec_id) => ec_id,
+    let requested = match requested_ec_id(req, &AcceptedProviders::active(provider)) {
+        Ok(requested) => requested,
         Err(response) => return Ok(*response),
     };
 
-    let Some(lookup) = kv.lookup_raw(&ec_id)? else {
-        log::info!("Admin EC lookup: no entry for '{}'", log_id(&ec_id));
+    // Read the row under the owning provider's canonical form of the
+    // identifier, the key the row is stored under, rather than under the
+    // identifier as requested. The two differ whenever the canonical form is
+    // not the requested string itself, for example for a built-in HMAC
+    // identifier requested with its hash in uppercase.
+    let Some(lookup) = kv.lookup_raw(&requested.kv_key)? else {
+        log::info!(
+            "Admin EC lookup: no entry for '{}'",
+            log_id(&requested.ec_id)
+        );
         return Ok(json_error(
             StatusCode::NOT_FOUND,
             "EC entry not found (KV reads are eventually consistent; a very \
              recent entry may not be visible yet)",
         ));
     };
 
-    log::info!("Admin EC lookup: returning entry for '{}'", log_id(&ec_id));
-    let payload = build_lookup_response(registry, kv.store_name(), ec_id, &lookup);
+    log::info!(
+        "Admin EC lookup: returning entry for '{}'",
+        log_id(&requested.ec_id)
+    );
+    let payload = build_lookup_response(registry, kv.store_name(), requested, &lookup);
     let body =
         serde_json::to_string(&payload).change_context(TrustedServerError::Configuration {
             message: "failed to serialize admin EC lookup response".to_owned(),
@@ -341,19 +355,34 @@ fn cookie_ec_id(req: &Request<EdgeBody>) -> Result<String, Box<Response<EdgeBody
     })
 }
 
-/// Resolves the EC ID to look up from the path or the `ts-ec` cookie.
+/// An EC ID resolved for lookup, with the identity-graph key its row is stored
+/// under.
+#[derive(Debug)]
+struct RequestedEcId {
+    /// The EC ID as requested, from the path or the `ts-ec` cookie.
+    ec_id: String,
+    /// The canonical form of `ec_id` that
+    /// [`AcceptedProviders::canonical_kv_key`] returns, which the row is stored
+    /// under.
+    kv_key: String,
+}
+
+/// Resolves the EC ID to look up from the path or the `ts-ec` cookie, with the
+/// identity-graph key its row is stored under.
 ///
 /// The identifier is validated in two parts: the global cookie bounds, then
 /// the provider that owns its `{code}~` prefix, so an operator can look up an
 /// identifier created by whichever provider this deployment reads rather than
-/// only a built-in HMAC one.
+/// only a built-in HMAC one. The same check supplies the key, the canonical
+/// form of the identifier that [`AcceptedProviders::canonical_kv_key`]
+/// returns.
 ///
 /// Returns the (boxed) error response to send directly when no valid ID is
 /// available.
 fn requested_ec_id(
     req: &Request<EdgeBody>,
     accepted_providers: &AcceptedProviders<'_>,
-) -> Result<String, Box<Response<EdgeBody>>> {
+) -> Result<RequestedEcId, Box<Response<EdgeBody>>> {
     let remainder = req
         .uri()
         .path()
@@ -367,16 +396,16 @@ fn requested_ec_id(
         remainder.to_owned()
     };
 
-    if !accepted_providers.accepts(&ec_id) {
+    let Some(kv_key) = accepted_providers.canonical_kv_key(&ec_id) else {
         return Err(Box::new(json_error(
             StatusCode::BAD_REQUEST,
             "invalid EC ID: not an identifier any provider this deployment reads \
              issued (the built-in HMAC provider issues hmac~{64hex}.{6alnum} and \
              still reads the bare legacy form)",
         )));
-    }
+    };
 
-    Ok(ec_id)
+    Ok(RequestedEcId { ec_id, kv_key })
 }
 
 /// Builds the success payload from a raw KV lookup.
@@ -386,11 +415,12 @@ fn requested_ec_id(
 fn build_lookup_response(
     registry: &PartnerRegistry,
     store_name: &str,
-    ec_id: String,
+    requested: RequestedEcId,
     lookup: &EcKvLookup,
 ) -> AdminEcLookupResponse {
     let mut payload = AdminEcLookupResponse {
-        ec_id,
+        ec_id: requested.ec_id,
+        kv_key: requested.kv_key,
         store: store_name.to_owned(),
         generation: lookup.generation,
         tombstone: None,
@@ -694,6 +724,7 @@ mod tests {
     use crate::ec::kv_backend::test_support::InMemoryEcKv;
     use crate::ec::kv_backend::{EcKvStore as _, EcKvWrite, EcKvWriteMode};
     use crate::ec::kv_types::KvPartnerId;
+    use crate::ec::tests::{CANONICAL_COOKIE_VALUE, CANONICAL_KV_KEY, CanonicalizingProvider};
     use crate::redacted::Redacted;
     use crate::settings::EcPartner;
 
@@ -1576,10 +1607,17 @@ mod tests {
         let coded = format!("hmac~{}", test_ec_id());
         let request = request_with_method(http::Method::GET, &format!("/_ts/admin/ec/{coded}"));
 
-        let ec_id = requested_ec_id(&request, &AcceptedProviders::active(None))
+        let requested = requested_ec_id(&request, &AcceptedProviders::active(None))
             .unwrap_or_else(|_| panic!("should accept a coded HMAC identifier in the path"));
 
-        assert_eq!(ec_id, coded, "should look up the identifier as given");
+        assert_eq!(
+            requested.ec_id, coded,
+            "should report the identifier as given"
+        );
+        assert_eq!(
+            requested.kv_key, coded,
+            "a lowercase HMAC identifier should be its own identity-graph key"
+        );
     }
 
     #[test]
@@ -1592,9 +1630,12 @@ mod tests {
 
         let opaque = "t0op~Opaque_Value_MixedCase";
         let request = request_with_method(http::Method::GET, &format!("/_ts/admin/ec/{opaque}"));
-        let ec_id = requested_ec_id(&request, &accepted)
+        let requested = requested_ec_id(&request, &accepted)
             .unwrap_or_else(|_| panic!("should accept the active provider's identifier"));
-        assert_eq!(ec_id, opaque, "should look up the identifier as given");
+        assert_eq!(
+            requested.ec_id, opaque,
+            "should report the identifier as given"
+        );
 
         // A code no configured provider reads stays a 400, even in the built-in
         // HMAC shape, so one deployment cannot inspect another's identifiers.
@@ -1608,4 +1649,76 @@ mod tests {
             "an unread provider code should be a 400"
         );
     }
+
+    #[test]
+    fn ec_lookup_reads_the_row_under_the_canonical_key() {
+        // The identity graph stores a row under the owning provider's
+        // canonical form of the identifier. Read under the identifier as
+        // requested, the lookup answered 404 for a row that exists whenever a
+        // provider's canonical form differs from the cookie value.
+        let kv = kv_with_entry(CANONICAL_KV_KEY, &sample_entry());
+        let req =
+            get_request_with_cookie("/_ts/admin/ec", &format!("ts-ec={CANONICAL_COOKIE_VALUE}"));
+
+        let response = handle_admin_ec_lookup(
+            Some(&kv),
+            &test_registry(),
+            Some(&CanonicalizingProvider),
+            &req,
+        )
+        .expect("should handle lookup");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "the cookie value should find the row stored under the canonical key"
+        );
+        let json = response_json(response);
+        assert_eq!(
+            json["ec_id"], CANONICAL_COOKIE_VALUE,
+            "should report the identifier as requested"
+        );
+        assert_eq!(
+            json["kv_key"], CANONICAL_KV_KEY,
+            "should report the key the entry was read from"
+        );
+        assert_eq!(
+            json["entry"]["ids"]["bidstream.example"]["uid"], "uid-live",
+            "should return the entry stored under the canonical key"
+        );
+    }
+
+    #[test]
+    fn ec_lookup_given_an_uppercase_hmac_hash_reads_the_lowercase_row() {
+        // The built-in HMAC provider issues lowercase hex, and its canonical
+        // form lowercases the hash, so its row key is the identifier it issued.
+        // An operator who pastes that identifier with the hash in uppercase is
+        // still asking for the same row.
+        let ec_id = format!("hmac~{}", test_ec_id());
+        let kv = kv_with_entry(&ec_id, &sample_entry());
+        let uppercase = format!("hmac~{}.abc123", "A".repeat(64));
+        let provider = crate::ec::tests::hmac_provider();
+        let req = get_request(&format!("/_ts/admin/ec/{uppercase}"));
+
+        let response =
+            handle_admin_ec_lookup(Some(&kv), &test_registry(), Some(provider.as_ref()), &req)
+                .expect("should handle lookup");
+
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "an uppercase hash should find the row stored under the lowercase key"
+        );
+        let json = response_json(response);
+        assert_eq!(
+            json["ec_id"],
+            uppercase.as_str(),
+            "should report the identifier as requested"
+        );
+        assert_eq!(
+            json["kv_key"],
+            ec_id.as_str(),
+            "should report the lowercase key the entry was read from"
+        );
+    }
 }