expand_trusted_server_bidders leaks the zone key into every bidder's PBS params #927

Description

PR #910 review identified a legacy Prebid Server expansion path that copies the entire trustedServer slot object into each configured bidder's PBS params when bidderParams is absent. A zone-only object could therefore become a nonempty bidder object containing the Trusted Server orchestration key zone; dropping empty or non-object bidder params would not catch it.

The cited implementation is now historical for the production path. On current main, expand_trusted_server_bidders, ZONE_KEY, and PrebidAuctionProvider are all gated with #[cfg(test)]; PrebidAuctionProvider is documented as retained for parity tests. The active config-first path routes bids through auction/plan.rs, auction/routing.rs, and the planned orchestrator. This issue needs an active-path reproduction before a production leak can be claimed.

Historical evidence

The legacy helper still has this fallback in crates/trusted-server-core/src/integrations/prebid.rs:

.unwrap_or_else(|| {
    if per_bidder.is_some() {
        Json::Object(Default::default())
    } else {
        params.clone()
    }
})

The original #927 report showed a zone-only slot producing bidder objects shaped like { "zone": "header" } and linked the behavior to PR #910. That observation was made against the old PBS path; it does not establish current wire behavior.

Expected behavior

Trusted Server orchestration fields such as zone do not appear in provider bidder params unless the provider protocol explicitly defines them there.

Actual behavior

The legacy test-only helper still copies the entire object. Current production behavior has not been established by this issue.

Proposed decision

Trace a zone-only request through the active config-first route and inspect the outbound provider request. If the field reaches the wire, remove it at the correct routing boundary while retaining legitimate bidder params. If the active path already excludes it, close this as a legacy-path report or narrow it to parity-test cleanup.

Done when

• An active-path test shows what a zone-only trustedServer slot sends to each configured provider.
• If zone leaks, a regression test proves the fix excludes it while valid bidder params still reach the provider.
• If it does not leak, record that evidence and resolve the obsolete production claim.

Related

• PR Suppress fabricated empty Prebid bidder params #910: earlier empty and non-object bidder-param handling.
• crates/trusted-server-core/src/integrations/prebid.rs: historical helper and override engine.