formats.rs

//! Auction request/response format conversions.
//!
//! This module handles:
//! - Parsing incoming tsjs/Prebid.js format requests
//! - Converting internal auction results to `OpenRTB` 2.x responses

use error_stack::{ensure, Report, ResultExt};
use fastly::http::{header, StatusCode};
use fastly::{Request, Response};
use serde::Deserialize;
use serde_json::Value as JsonValue;
use std::collections::HashMap;
use uuid::Uuid;

use crate::auction::context::ContextValue;
use crate::consent::ConsentContext;
use crate::constants::{HEADER_X_TS_EC, HEADER_X_TS_EC_FRESH};
use crate::creative;
use crate::edge_cookie::generate_ec_id;
use crate::error::TrustedServerError;
use crate::openrtb::{to_openrtb_i32, OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt};
use crate::platform::{GeoInfo, RuntimeServices};
use crate::settings::Settings;

use super::orchestrator::OrchestrationResult;
use super::types::{
    AdFormat, AdSlot, AuctionRequest, DeviceInfo, MediaType, OrchestratorExt, ProviderSummary,
    PublisherInfo, SiteInfo, UserInfo,
};

/// Request body format for auction endpoints (tsjs/Prebid.js format).
#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct AdRequest {
    pub ad_units: Vec<AdUnit>,
    pub config: Option<JsonValue>,
}

#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct AdUnit {
    pub code: String,
    pub media_types: Option<MediaTypes>,
    pub bids: Option<Vec<BidConfig>>,
}

/// Bidder configuration from the request.
#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct BidConfig {
    pub bidder: String,
    #[serde(default)]
    pub params: serde_json::Value,
}

#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct MediaTypes {
    pub banner: Option<BannerUnit>,
}

#[derive(Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct BannerUnit {
    pub sizes: Vec<Vec<u32>>,
}

/// Convert tsjs/Prebid.js request format to internal [`AuctionRequest`].
///
/// The `consent` parameter carries decoded consent signals extracted from the
/// incoming request's cookies and headers. It is populated by the caller
/// (the `/auction` endpoint handler) and forwarded through to the
/// [`OpenRTB`][`crate::openrtb::OpenRtbRequest`] bid request.
///
/// The `ec_id` is generated by the caller before the consent pipeline
/// runs, so that KV Store operations can use it as a key.
///
/// # Errors
///
/// Returns an error if:
/// - Fresh EC ID generation fails
/// - Request contains invalid banner sizes (must be [width, height])
pub fn convert_tsjs_to_auction_request(
    body: &AdRequest,
    settings: &Settings,
    services: &RuntimeServices,
    req: &Request,
    consent: ConsentContext,
    ec_id: &str,
    geo: Option<GeoInfo>,
) -> Result<AuctionRequest, Report<TrustedServerError>> {
    let ec_id = ec_id.to_owned();
    let fresh_id =
        generate_ec_id(settings, services).change_context(TrustedServerError::Auction {
            message: "Failed to generate fresh EC ID".to_string(),
        })?;

    // Convert ad units to slots
    let mut slots = Vec::new();
    for unit in &body.ad_units {
        if let Some(media_types) = &unit.media_types {
            if let Some(banner) = &media_types.banner {
                let mut formats = Vec::new();
                for size in &banner.sizes {
                    ensure!(
                        size.len() == 2,
                        TrustedServerError::BadRequest {
                            message: "Invalid banner size; expected [width, height]".to_string(),
                        }
                    );

                    formats.push(AdFormat {
                        width: size[0],
                        height: size[1],
                        media_type: MediaType::Banner,
                    });
                }

                // Extract bidder params from the bids array
                let mut bidders = HashMap::new();
                if let Some(bids) = &unit.bids {
                    for bid in bids {
                        bidders.insert(bid.bidder.clone(), bid.params.clone());
                    }
                }

                slots.push(AdSlot {
                    id: unit.code.clone(),
                    formats,
                    floor_price: None,
                    targeting: HashMap::new(),
                    bidders,
                });
            }
        }
    }

    // Build device info with user-agent (always) and geo (if available)
    let device = Some(DeviceInfo {
        user_agent: req
            .get_header_str("user-agent")
            .map(std::string::ToString::to_string),
        ip: services.client_info.client_ip.map(|ip| ip.to_string()),
        geo,
    });

    // Forward allowed config entries from the JS request into the context map.
    // Only keys listed in `auction.allowed_context_keys` are accepted;
    // unrecognised keys are silently dropped to prevent injection of
    // arbitrary data by a malicious client payload.
    let mut context = HashMap::new();
    if let Some(ref config) = body.config {
        if let Some(obj) = config.as_object() {
            for (key, value) in obj {
                if settings.auction.allowed_context_keys.contains(key) {
                    match serde_json::from_value::<ContextValue>(value.clone()) {
                        Ok(cv) => {
                            context.insert(key.clone(), cv);
                        }
                        Err(_) => {
                            log::debug!(
                                "Auction context: dropping key '{}' with unsupported type",
                                key
                            );
                        }
                    }
                } else {
                    log::debug!("Auction context: dropping disallowed key '{}'", key);
                }
            }
            if !context.is_empty() {
                log::debug!(
                    "Auction request context: {} entries ({})",
                    context.len(),
                    context.keys().cloned().collect::<Vec<_>>().join(", ")
                );
            }
        }
    }

    Ok(AuctionRequest {
        id: Uuid::new_v4().to_string(),
        slots,
        publisher: PublisherInfo {
            domain: settings.publisher.domain.clone(),
            page_url: Some(format!("https://{}", settings.publisher.domain)),
        },
        user: UserInfo {
            id: ec_id,
            fresh_id,
            consent: Some(consent),
        },
        device,
        site: Some(SiteInfo {
            domain: settings.publisher.domain.clone(),
            page: format!("https://{}", settings.publisher.domain),
        }),
        context,
    })
}

/// Convert `OrchestrationResult` to `OpenRTB` response format.
///
/// Returns rewritten creative HTML directly in the `adm` field for inline delivery.
///
/// # Errors
///
/// Returns an error if:
/// - A winning bid is missing a price
/// - The response serialization fails
pub fn convert_to_openrtb_response(
    result: &OrchestrationResult,
    settings: &Settings,
    auction_request: &AuctionRequest,
) -> Result<Response, Report<TrustedServerError>> {
    // Build OpenRTB-style seatbid array
    let mut seatbids = Vec::with_capacity(result.winning_bids.len());

    for (slot_id, bid) in &result.winning_bids {
        let price = bid.price.ok_or_else(|| {
            Report::new(TrustedServerError::Auction {
                message: format!(
                    "Winning bid for slot '{}' from '{}' has no decoded price",
                    slot_id, bid.bidder
                ),
            })
        })?;

        let bid_context = format!(
            "auction {} slot {} bidder {}",
            auction_request.id, slot_id, bid.bidder
        );
        let width = to_openrtb_i32(bid.width, "width", &bid_context);
        let height = to_openrtb_i32(bid.height, "height", &bid_context);

        // Process creative HTML if present - — sanitize dangerous markup first, then rewrite URLs.
        let creative_html = if let Some(ref raw_creative) = bid.creative {
            let sanitized = creative::sanitize_creative_html(raw_creative);
            let rewritten = creative::rewrite_creative_html(settings, &sanitized);

            log::debug!(
                "Processed creative for auction {} slot {} ({} → {} → {} bytes)",
                auction_request.id,
                slot_id,
                raw_creative.len(),
                sanitized.len(),
                rewritten.len()
            );

            rewritten
        } else {
            // No creative provided (e.g., from mediation layer that returns iframe URLs)
            log::warn!(
                "No creative HTML for auction {} slot {} - mediation should have provided creative",
                auction_request.id,
                slot_id
            );
            String::new()
        };

        let openrtb_bid = OpenRtbBid {
            id: Some(format!("{}-{}", bid.bidder, slot_id)),
            impid: Some(slot_id.to_string()),
            price: Some(price),
            adm: Some(creative_html),
            crid: Some(format!("{}-creative", bid.bidder)),
            w: width,
            h: height,
            adomain: bid.adomain.clone().unwrap_or_default(),
            ..Default::default()
        };

        seatbids.push(SeatBid {
            seat: Some(bid.bidder.clone()),
            bid: vec![openrtb_bid],
            ..Default::default()
        });
    }

    // Determine strategy name for response metadata
    let strategy_name = if settings.auction.has_mediator() {
        "parallel_mediation"
    } else {
        "parallel_only"
    };

    // Build per-provider summaries from the orchestration result
    let provider_details: Vec<ProviderSummary> = result
        .provider_responses
        .iter()
        .map(ProviderSummary::from)
        .collect();

    let response_body = OpenRtbResponse {
        id: Some(auction_request.id.to_string()),
        seatbid: seatbids,
        ext: ResponseExt {
            orchestrator: OrchestratorExt {
                strategy: strategy_name.to_string(),
                providers: result.provider_responses.len(),
                total_bids: result.total_bids(),
                time_ms: result.total_time_ms,
                provider_details,
            },
        }
        .to_ext(),
        ..Default::default()
    };

    let body_bytes =
        serde_json::to_vec(&response_body).change_context(TrustedServerError::Auction {
            message: "Failed to serialize auction response".to_string(),
        })?;

    Ok(Response::from_status(StatusCode::OK)
        .with_header(header::CONTENT_TYPE, "application/json")
        .with_header(HEADER_X_TS_EC, &auction_request.user.id)
        .with_header(HEADER_X_TS_EC_FRESH, &auction_request.user.fresh_id)
        .with_body(body_bytes))
}