Floxis: mirror Prebid.js seat/region/partner host logic

AndriusFromLTU · claude · AndriusFromLTU · commit 8763dcd58139 · 2026-06-06T15:21:42.000+03:00
Co-Authored-By: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/src/main/java/org/prebid/server/bidder/floxis/FloxisBidder.java b/src/main/java/org/prebid/server/bidder/floxis/FloxisBidder.java
@@ -25,8 +25,8 @@
 
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Map;
 import java.util.Objects;
+import java.util.regex.Pattern;
 
 public class FloxisBidder implements Bidder<BidRequest> {
 
@@ -37,15 +37,12 @@ public class FloxisBidder implements Bidder<BidRequest> {
     private static final String HOST_MACRO = "{{Host}}";
     private static final String SEAT_MACRO = "{{SeatId}}";
 
-    // Fixed allowlist mapping the bidder's region param to a Floxis RTB host. Routing is
-    // never derived from request-supplied hostnames; an unknown or empty region falls back
-    // to us-e.
-    private static final Map<String, String> REGION_HOSTS = Map.of(
-            "us-e", "rtb-us-e.floxis.tech",
-            "eu", "rtb-eu.floxis.tech",
-            "apac", "rtb-apac.floxis.tech");
-
     private static final String DEFAULT_REGION = "us-e";
+    private static final String DEFAULT_PARTNER = "floxis";
+
+    // region/partner are interpolated into the request host, so each must be a valid DNS label —
+    // otherwise a value carrying URL delimiters could rewrite the request origin.
+    private static final Pattern HOST_LABEL = Pattern.compile("^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$");
 
     private final String endpointUrl;
     private final JacksonMapper mapper;
@@ -61,35 +58,37 @@ public Result<List<HttpRequest<BidRequest>>> makeHttpRequests(BidRequest request
             return Result.withError(BidderError.badInput("no impressions in the bid request"));
         }
 
-        final ExtImpFloxis extImp;
+        final String uri;
         try {
-            extImp = resolveCommonImpExt(request.getImp());
+            uri = resolveUrl(endpointUrl, resolveCommonImpExt(request.getImp()));
         } catch (PreBidException e) {
             return Result.withError(BidderError.badInput(e.getMessage()));
         }
 
         // The request body is forwarded unchanged; no caller-owned struct is mutated.
         return Result.withValue(HttpRequest.<BidRequest>builder()
                 .method(HttpMethod.POST)
-                .uri(resolveUrl(endpointUrl, extImp))
+                .uri(uri)
                 .headers(HttpUtil.headers())
                 .impIds(BidderUtil.impIds(request))
                 .payload(request)
                 .body(mapper.encodeToBytes(request))
                 .build());
     }
 
-    // A single request routes to one Floxis host/seat (the seat is the URL query key). All imps
-    // must therefore share the same seat and region; a mismatch is a misconfigured request rather
-    // than something to silently route on imp[0]'s key.
+    // A single request routes to one Floxis host/seat (the seat is the URL query key, partner+region
+    // the host). All imps must therefore share the same seat, region and partner; a mismatch is a
+    // misconfigured request rather than something to silently route on imp[0]'s key.
     private ExtImpFloxis resolveCommonImpExt(List<Imp> imps) {
         final ExtImpFloxis first = parseImpExt(imps.getFirst());
         for (Imp imp : imps.subList(1, imps.size())) {
             final ExtImpFloxis current = parseImpExt(imp);
             if (!Objects.equals(current.getSeat(), first.getSeat())
-                    || !Objects.equals(current.getRegion(), first.getRegion())) {
+                    || !Objects.equals(current.getRegion(), first.getRegion())
+                    || !Objects.equals(current.getPartner(), first.getPartner())) {
                 throw new PreBidException(
-                        "all impressions must target the same Floxis seat and region; imp %s differs from imp %s"
+                        "all impressions must target the same Floxis seat, region and partner; "
+                                + "imp %s differs from imp %s"
                                 .formatted(imp.getId(), imps.getFirst().getId()));
             }
         }
@@ -104,14 +103,27 @@ private ExtImpFloxis parseImpExt(Imp imp) {
         }
     }
 
-    private static String resolveHost(String region) {
-        final String host = region == null ? null : REGION_HOSTS.get(region);
-        return host != null ? host : REGION_HOSTS.get(DEFAULT_REGION);
+    // Bidding host: the supply partner's regional subdomain (floxis itself has no partner prefix).
+    private static String resolveBidHost(String region, String partner) {
+        final String resolvedRegion = isBlank(region) ? DEFAULT_REGION : region;
+        final String resolvedPartner = isBlank(partner) ? DEFAULT_PARTNER : partner;
+        if (!HOST_LABEL.matcher(resolvedRegion).matches() || !HOST_LABEL.matcher(resolvedPartner).matches()) {
+            throw new PreBidException(
+                    "invalid Floxis region or partner; both must be DNS labels: region=%s partner=%s"
+                            .formatted(resolvedRegion, resolvedPartner));
+        }
+        return resolvedPartner.equals(DEFAULT_PARTNER)
+                ? resolvedRegion + ".floxis.tech"
+                : resolvedPartner + "-" + resolvedRegion + ".floxis.tech";
+    }
+
+    private static boolean isBlank(String value) {
+        return value == null || value.isEmpty();
     }
 
     private static String resolveUrl(String endpoint, ExtImpFloxis extImp) {
         return endpoint
-                .replace(HOST_MACRO, resolveHost(extImp.getRegion()))
+                .replace(HOST_MACRO, resolveBidHost(extImp.getRegion(), extImp.getPartner()))
                 .replace(SEAT_MACRO, HttpUtil.encodeUrl(extImp.getSeat()));
     }
 
diff --git a/src/main/java/org/prebid/server/proto/openrtb/ext/request/floxis/ExtImpFloxis.java b/src/main/java/org/prebid/server/proto/openrtb/ext/request/floxis/ExtImpFloxis.java
@@ -10,4 +10,7 @@ public class ExtImpFloxis {
 
     @JsonProperty("region")
     String region;
+
+    @JsonProperty("partner")
+    String partner;
 }
diff --git a/src/main/resources/static/bidder-params/floxis.json b/src/main/resources/static/bidder-params/floxis.json
@@ -12,8 +12,13 @@
     },
     "region": {
       "type": "string",
-      "enum": ["us-e", "eu", "apac"],
-      "description": "The Floxis RTB region; defaults to us-e when omitted"
+      "pattern": "^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$",
+      "description": "The Floxis region (DNS label, interpolated into the bidding host); defaults to us-e when omitted"
+    },
+    "partner": {
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$",
+      "description": "The white-label partner (DNS label, interpolated into the bidding host); defaults to floxis when omitted"
     }
   },
   "required": ["seat"]
diff --git a/src/test/java/org/prebid/server/bidder/floxis/FloxisBidderTest.java b/src/test/java/org/prebid/server/bidder/floxis/FloxisBidderTest.java
@@ -90,7 +90,7 @@ public void makeHttpRequestsShouldUrlEscapeSeatAndUseEuHost() {
         assertThat(result.getErrors()).isEmpty();
         assertThat(result.getValue()).hasSize(1)
                 .extracting(HttpRequest::getUri)
-                .containsExactly("https://rtb-eu.floxis.tech/pbs?seat=a+b%26c");
+                .containsExactly("https://eu.floxis.tech/pbs?seat=a+b%26c");
     }
 
     @Test
@@ -105,7 +105,7 @@ public void makeHttpRequestsShouldUseApacHost() {
         assertThat(result.getErrors()).isEmpty();
         assertThat(result.getValue()).hasSize(1)
                 .extracting(HttpRequest::getUri)
-                .containsExactly("https://rtb-apac.floxis.tech/pbs?seat=seat-apac");
+                .containsExactly("https://apac.floxis.tech/pbs?seat=seat-apac");
     }
 
     @Test
@@ -120,7 +120,7 @@ public void makeHttpRequestsShouldUseUseHostForExplicitUsE() {
         assertThat(result.getErrors()).isEmpty();
         assertThat(result.getValue()).hasSize(1)
                 .extracting(HttpRequest::getUri)
-                .containsExactly("https://rtb-us-e.floxis.tech/pbs?seat=abc");
+                .containsExactly("https://us-e.floxis.tech/pbs?seat=abc");
     }
 
     @Test
@@ -135,11 +135,11 @@ public void makeHttpRequestsShouldDefaultToUseHostWhenRegionMissing() {
         assertThat(result.getErrors()).isEmpty();
         assertThat(result.getValue()).hasSize(1)
                 .extracting(HttpRequest::getUri)
-                .containsExactly("https://rtb-us-e.floxis.tech/pbs?seat=abc");
+                .containsExactly("https://us-e.floxis.tech/pbs?seat=abc");
     }
 
     @Test
-    public void makeHttpRequestsShouldDefaultToUseHostWhenRegionUnknown() {
+    public void makeHttpRequestsShouldUseArbitraryValidRegionLabelAsSubdomain() {
         // given
         final BidRequest bidRequest = givenBidRequest(imp -> imp.ext(givenImpExt("abc", "mars")));
 
@@ -150,7 +150,50 @@ public void makeHttpRequestsShouldDefaultToUseHostWhenRegionUnknown() {
         assertThat(result.getErrors()).isEmpty();
         assertThat(result.getValue()).hasSize(1)
                 .extracting(HttpRequest::getUri)
-                .containsExactly("https://rtb-us-e.floxis.tech/pbs?seat=abc");
+                .containsExactly("https://mars.floxis.tech/pbs?seat=abc");
+    }
+
+    @Test
+    public void makeHttpRequestsShouldReturnBadInputWhenRegionIsNotAValidHostLabel() {
+        // given
+        final BidRequest bidRequest = givenBidRequest(imp -> imp.ext(givenImpExt("abc", "evil.com/x?")));
+
+        // when
+        final Result<List<HttpRequest<BidRequest>>> result = target.makeHttpRequests(bidRequest);
+
+        // then
+        assertThat(result.getValue()).isEmpty();
+        assertThat(result.getErrors()).hasSize(1)
+                .allSatisfy(error -> assertThat(error.getType()).isEqualTo(BidderError.Type.bad_input));
+    }
+
+    @Test
+    public void makeHttpRequestsShouldUsePartnerPrefixedHostWhenPartnerProvided() {
+        // given
+        final BidRequest bidRequest = givenBidRequest(imp -> imp.ext(givenImpExt("abc", "us-e", "acme")));
+
+        // when
+        final Result<List<HttpRequest<BidRequest>>> result = target.makeHttpRequests(bidRequest);
+
+        // then
+        assertThat(result.getErrors()).isEmpty();
+        assertThat(result.getValue()).hasSize(1)
+                .extracting(HttpRequest::getUri)
+                .containsExactly("https://acme-us-e.floxis.tech/pbs?seat=abc");
+    }
+
+    @Test
+    public void makeHttpRequestsShouldReturnBadInputWhenPartnerIsNotAValidHostLabel() {
+        // given
+        final BidRequest bidRequest = givenBidRequest(imp -> imp.ext(givenImpExt("abc", "us-e", "evil.com/x?")));
+
+        // when
+        final Result<List<HttpRequest<BidRequest>>> result = target.makeHttpRequests(bidRequest);
+
+        // then
+        assertThat(result.getValue()).isEmpty();
+        assertThat(result.getErrors()).hasSize(1)
+                .allSatisfy(error -> assertThat(error.getType()).isEqualTo(BidderError.Type.bad_input));
     }
 
     @Test
@@ -171,7 +214,7 @@ public void makeHttpRequestsShouldRouteOnceAndForwardAllImpsWhenSeatAndRegionMat
         assertThat(result.getErrors()).isEmpty();
         assertThat(result.getValue()).hasSize(1)
                 .extracting(HttpRequest::getUri)
-                .containsExactly("https://rtb-eu.floxis.tech/pbs?seat=seat-eu");
+                .containsExactly("https://eu.floxis.tech/pbs?seat=seat-eu");
         assertThat(result.getValue())
                 .extracting(HttpRequest::getPayload)
                 .flatExtracting(BidRequest::getImp)
@@ -197,7 +240,7 @@ public void makeHttpRequestsShouldReturnErrorWhenImpsTargetDifferentSeat() {
         assertThat(result.getValue()).isEmpty();
         assertThat(result.getErrors()).hasSize(1)
                 .containsOnly(BidderError.badInput(
-                        "all impressions must target the same Floxis seat and region; "
+                        "all impressions must target the same Floxis seat, region and partner; "
                                 + "imp imp-2 differs from imp imp-1"));
     }
 
@@ -219,7 +262,29 @@ public void makeHttpRequestsShouldReturnErrorWhenImpsTargetDifferentRegion() {
         assertThat(result.getValue()).isEmpty();
         assertThat(result.getErrors()).hasSize(1)
                 .containsOnly(BidderError.badInput(
-                        "all impressions must target the same Floxis seat and region; "
+                        "all impressions must target the same Floxis seat, region and partner; "
+                                + "imp imp-2 differs from imp imp-1"));
+    }
+
+    @Test
+    public void makeHttpRequestsShouldReturnErrorWhenImpsTargetDifferentPartner() {
+        // given
+        final BidRequest bidRequest = BidRequest.builder()
+                .id("req-1")
+                .imp(asList(
+                        givenImp(imp -> imp.id("imp-1").ext(givenImpExt("seat-eu", "eu", "acme"))),
+                        givenImp(imp -> imp.id("imp-2").ext(givenImpExt("seat-eu", "eu", "other")))))
+                .site(Site.builder().id("271").build())
+                .build();
+
+        // when
+        final Result<List<HttpRequest<BidRequest>>> result = target.makeHttpRequests(bidRequest);
+
+        // then
+        assertThat(result.getValue()).isEmpty();
+        assertThat(result.getErrors()).hasSize(1)
+                .containsOnly(BidderError.badInput(
+                        "all impressions must target the same Floxis seat, region and partner; "
                                 + "imp imp-2 differs from imp imp-1"));
     }
 
@@ -448,7 +513,12 @@ private static Imp givenImp(UnaryOperator<Imp.ImpBuilder> impCustomizer) {
     }
 
     private static com.fasterxml.jackson.databind.node.ObjectNode givenImpExt(String seat, String region) {
-        return mapper.valueToTree(ExtPrebid.of(null, ExtImpFloxis.of(seat, region)));
+        return givenImpExt(seat, region, null);
+    }
+
+    private static com.fasterxml.jackson.databind.node.ObjectNode givenImpExt(String seat, String region,
+                                                                             String partner) {
+        return mapper.valueToTree(ExtPrebid.of(null, ExtImpFloxis.of(seat, region, partner)));
     }
 
     private static BidResponse givenBidResponse(Bid bid) {

Original file line number	Diff line number	Diff line change
`@@ -10,4 +10,7 @@ public class ExtImpFloxis {`
`10`	`10`
`11`	`11`	`@JsonProperty("region")`
`12`	`12`	`String region;`
	`13`	`+`
	`14`	`+ @JsonProperty("partner")`
	`15`	`+ String partner;`
`13`	`16`	`}`