Skip to content

Dump full SSAT prebid responses in ts-debug auction comment#890

Open
prk-Jr wants to merge 3 commits into
mainfrom
feat/ssat-write-prebid-response-debug
Open

Dump full SSAT prebid responses in ts-debug auction comment#890
prk-Jr wants to merge 3 commits into
mainfrom
feat/ssat-write-prebid-response-debug

Conversation

@prk-Jr

@prk-Jr prk-Jr commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • The server-side auction (SSAT) stream path only emitted a summary line in the ts-debug HTML comment (ssp/mediator/winning/time), so an operator seeing winning=0 could not tell whether prebid returned nothing, errored, or bid below the floor.
  • Dump the full provider_responses (and mediator_response) into the comment so the SSAT surfaces the same prebid server response detail an operator gets from the /auction endpoint — status, every bid, and metadata (which carries PBS ext.errors / ext.debug.httpcalls when prebid debug=true).
  • Bid creative and provider metadata are attacker/partner-influenced, so the embedded JSON has its HTML-comment terminators neutralized to keep the dump inside the comment and out of the live DOM.

Changes

File Change
crates/trusted-server-core/src/publisher.rs prepend_auction_debug_comment now serializes provider_responses + mediator_response as JSON into the ts-debug comment; neutralizes --> / --!> in the payload; adds a unit test asserting status is surfaced and terminators are neutralized (exactly one closing -->).

Closes

Closes #889

Test plan

  • cargo fmt --all -- --check
  • cargo test-fastly (new test auction_debug_comment_dumps_provider_status_and_neutralises_terminators passes; cargo check-fastly clean)
  • cargo test-axum — deferred to CI
  • cargo clippy-fastly && cargo clippy-axum — deferred to CI
  • JS tests / format — n/a (no JS change)
  • Docs format — n/a (no docs change)

Notes

  • The dump is gated behind the existing [debug].auction_html_comment flag — off by default.
  • On a winning auction the dump includes Bid.creative (full ad markup) inline and can be large; intended for debugging, not steady-state production.

Checklist

  • Changes follow CLAUDE.md conventions
  • No unwrap() in production code — use expect("should ...")
  • Uses log macros (not println!)
  • New code has tests
  • No secrets or credentials committed

The server-side auction stream path only emitted a summary counter
(ssp/mediator/winning/time), so an operator seeing winning=0 could not
tell whether prebid returned nothing, errored, or bid below the floor.

Serialize the full provider_responses (and mediator_response) into the
ts-debug HTML comment so the SSAT surfaces the same prebid server
response detail available from the /auction endpoint. Bid creative and
metadata are attacker/partner-influenced, so neutralize the '-->' and
'--!>' comment terminators before embedding to keep the dump inside the
comment and out of the live DOM.
@prk-Jr prk-Jr self-assigned this Jul 10, 2026
prk-Jr and others added 2 commits July 11, 2026 00:51
When Prebid Server returns a non-2xx status, the parser returned a bare
AuctionResponse::error with empty metadata — indistinguishable in the
ts-debug dump from a transport, parse, or timeout failure, all of which
tag error_type. An operator seeing status=error with metadata={} had no
way to know the upstream HTTP code without log access.

Attach error_type=http_status, the status code, and a 512-byte body
snippet to the error response metadata so the auction dump shows exactly
why prebid errored (e.g. a 4xx from a PBS rejecting the request).
@prk-Jr prk-Jr requested review from ChristianPavilonis and aram356 and removed request for aram356 July 10, 2026 20:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

For SSAT acution write responses from prebid server

1 participant