Skip to content

Stackup RTD Module: disclose sessionStorage cache keys and fix ortb2 data block merge collapse#15319

Open
Anton-stackup wants to merge 4 commits into
prebid:masterfrom
StackUp-ai:stackup-rtd-storage-disclosure
Open

Stackup RTD Module: disclose sessionStorage cache keys and fix ortb2 data block merge collapse#15319
Anton-stackup wants to merge 4 commits into
prebid:masterfrom
StackUp-ai:stackup-rtd-storage-disclosure

Conversation

@Anton-stackup

@Anton-stackup Anton-stackup commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Type of change

  • Bugfix

  • Feature

  • New bidder adapter

  • Updated bidder adapter

  • Code style update (formatting, local variables)

  • Refactoring (no functional changes, no api changes)

  • Build related changes

  • CI related changes

  • Does this change affect user-facing APIs or examples documented on http://prebid.org?

  • Other

Description of change

The module caches ORTB enrichment in sessionStorage under the key
pattern stackup:enrich:v1:*. Without a device storage disclosure,
storageControl denies accessDevice in strict mode, disabling the
cache and logging warnings on every read/write.

This PR:

  • adds disclosureURL: "local://modules/stackupRtdProvider.json" to the
    RTD submodule object
  • adds the local disclosure file listing the stackup:enrich:v1:* web
    storage identifier (TCF purposes 1 and 4)

Runtime enforcement (modules/storageControl.ts) reads module metadata,
so the disclosure must be declared statically; the runtime
discloseStorageUse() call only feeds the reporting API.

Metadata regen is expected as part of the build.

This PR also fixes a merge bug in how enrichment blocks are folded into
the global ortb2 object. Site content and user data blocks were being
de-duplicated by their provider name alone. Because Stack Up delivers
several blocks under a single provider name — one per taxonomy and, for
user data, one per audience dimension such as profile, purchase intent,
interests, and industry — keying on name alone caused each block to
overwrite the previous one. The result was that only the last block in
each array survived, silently discarding every earlier dimension.

The merge now identifies blocks by the combination of provider name,
segment taxonomy, and audience dimension, so sibling blocks that share a
name are kept as distinct entries. All contextual and audience segments
returned by the API are now preserved in the bid request instead of
collapsing to a single block.

It also swaps the strict [segtax: 502] -only check for an allowlist (4, 501, 502, 600); blocks with an unrecognised taxonomy are now skipped instead of rejecting the whole response.

Other information

Copilot AI review requested due to automatic review settings July 7, 2026 06:45

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Stackup RTD provider to declare its device storage usage statically via a disclosure URL, and adds the corresponding local disclosure document so storageControl can allow the module’s sessionStorage cache keys in strict mode.

Changes:

  • Add disclosureURL: "local://modules/stackupRtdProvider.json" to the Stackup RTD submodule metadata so runtime enforcement can find the disclosure.
  • Add a local disclosure file declaring the stackup:enrich:v1:* web storage identifier and associated TCF purposes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
modules/stackupRtdProvider.ts Declares a disclosureURL for the RTD submodule so storageControl can statically resolve storage disclosures.
metadata/disclosures/modules/stackupRtdProvider.json Adds the local device storage disclosure document for the Stackup RTD sessionStorage key pattern.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@barecheck

barecheck Bot commented Jul 7, 2026

Copy link
Copy Markdown

Barecheck - Code coverage report

Total: 96.56%

Your code coverage diff: 0.00% ▴

Uncovered files and lines
FileLines
modules/stackupRtdProvider.ts265-267, 305-306, 328, 436, 499-500, 504, 507-509, 511, 514, 517-518, 524-526, 529-531, 536, 538, 597, 677, 680

Distinguish site.content.data and user.data blocks by name + segtax +
dimension instead of name alone. StackUP emits multiple blocks under a
single provider name (e.g. several segtax:501 user dimensions all named
data.stackup-ai.com); keying on name alone caused siblings to overwrite
each other, leaving only the last block.
@Anton-stackup Anton-stackup changed the title Stackup RTD Module: disclose sessionStorage cache keys Stackup RTD Module: disclose sessionStorage cache keys and fix ortb2 data block merge collapse Jul 7, 2026
Anton-stackup and others added 2 commits July 7, 2026 13:28
Replace the strict segtax === 502 check with an allowlist of the
taxonomies StackUP emits: 4 (IAB Audience), 501 (legacy audience),
502 (content), 600 (publisher FPD). Validation now skips blocks with an
unrecognised segtax instead of rejecting the whole payload, and such
blocks are filtered out before merge so only allowlisted taxonomies
reach ortb2. Broaden the segtax type to a StackupSegtax union and update
tests and docs to cover the 600/4 blocks and the drop-unknown behavior.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants