userId: a filtered refreshUserIds must not release the auction early

.devcontainer/postCreate.sh

@@ -1,5 +1,8 @@
 echo "Post Create Starting"
 
+export NVM_DIR="/usr/local/share/nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
+
 nvm install
 nvm use
 npm install gulp-cli -g

.github/actions/combine-coverage/action.yml

@@ -0,0 +1,47 @@
+name: Combine coverage
+description: Combine and cache coverage results
+inputs:
+  cache-key:
+    description: cache key to use
+  lcov:
+    description: output LCOV file name
+  source-artifact:
+    description: Source code artifact name
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore from cache
+      id: restore
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ runner.temp }}/coverage.info
+        key: ${{ inputs.cache-key }}
+    - name: Restore source
+      if: ${{ steps.restore.outputs.cache-hit != 'true' }}
+      uses: ./.github/actions/load
+      with:
+        name: ${{ inputs.source-artifact }}
+    - name: Combine coverage results
+      if: ${{ steps.restore.outputs.cache-hit != 'true' }}
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install lcov -y
+        find build/coverage/chunks  -name 'lcov.info' -printf ' -a %p' | xargs lcov -o ${{ runner.temp }}/coverage.info
+    - name: Save to cache
+      if: ${{ steps.restore.outputs.cache-hit != 'true' }}
+      uses: actions/cache/save@v5
+      with:
+        path: ${{ runner.temp }}/coverage.info
+        key: ${{ inputs.cache-key }}
+    - name: Rename file
+      shell: bash
+      run: |
+        mv "${{ runner.temp }}/coverage.info" "${{ inputs.lcov }}"
+    - name: Save as artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ inputs.lcov }}
+        path: ${{ inputs.lcov }}
+
+

.github/actions/install-deb/action.yml

@@ -0,0 +1,35 @@
+name: Install deb
+description: Download and install a .deb package
+inputs:
+  url:
+    description: URL to the .deb file
+    required: true
+  name:
+    description: A local name for the package. Required if using this action multiple times in the same context.
+    default: package.deb
+    required: false
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore deb
+      id: deb-restore
+      uses: actions/cache/restore@v5
+      with:
+        path: "${{ runner.temp }}/${{ inputs.name }}"
+        key: ${{ inputs.url }}
+    - name: Download deb
+      if: ${{ steps.deb-restore.outputs.cache-hit != 'true'  }}
+      shell: bash
+      run: |
+        wget --no-verbose "${{ inputs.url }}" -O "${{ runner.temp }}/${{ inputs.name }}"
+    - name: Cache deb
+      if: ${{ steps.deb-restore.outputs.cache-hit != 'true' }}
+      uses: actions/cache/save@v5
+      with:
+        path: "${{ runner.temp }}/${{ inputs.name }}"
+        key: ${{ inputs.url }}
+    - name: Install deb
+      shell: bash
+      run: |
+        sudo apt-get install -y --allow-downgrades "${{ runner.temp }}/${{ inputs.name }}"

.github/actions/load/action.yml

@@ -0,0 +1,49 @@
+name: Load working directory
+description: Load working directory saved with "actions/save"
+inputs:
+  name:
+    description: The name used with actions/save
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version-file: '.nvmrc'
+    - uses: actions/github-script@v9
+      id: platform
+      with:
+        result-encoding: string
+        script: |
+          const os = require('os');
+          return os.platform();
+    - name: 'Clear working directory'
+      shell: bash
+      run: |
+        rm -r "$(pwd)"/*
+    - name: Download artifact
+      id: download
+      continue-on-error: true
+      uses: actions/download-artifact@v7
+      with:
+        path: '${{ runner.temp }}'
+        name: '${{ inputs.name }}'
+    - name: Delay before retrying download
+      if: steps.download.outcome != 'success'
+      shell: bash
+      run: sleep 10
+    - name: Retry downloading artifact
+      if: steps.download.outcome != 'success'
+      uses: actions/download-artifact@v7
+      with:
+        path: '${{ runner.temp }}'
+        name: '${{ inputs.name }}'
+    - name: 'Untar working directory'
+      shell: bash
+      run: |
+        wdir="$(pwd)"
+        parent="$(dirname "$wdir")"
+        target="$(basename "$wdir")"
+        export MSYS=winsymlinks:lnk
+        tar ${{ steps.platform.outputs.result == 'win32' && '--force-local' || '' }} -C "$parent" -xf '${{ runner.temp }}/${{ inputs.name }}.tar' "$target"

.github/actions/npm-ci/action.yml

@@ -0,0 +1,23 @@
+name: NPM install
+description: Run npm install and cache dependencies
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore dependencies
+      id: restore-modules
+      uses: actions/cache/restore@v5
+      with:
+        path: "node_modules"
+        key: node_modules-${{ hashFiles('package-lock.json') }}
+    - name: Run npm ci
+      if: ${{ steps.restore-modules.outputs.cache-hit != 'true'  }}
+      shell: bash
+      run: |
+        npm ci
+    - name: Cache dependencies
+      if: ${{ steps.restore-modules.outputs.cache-hit != 'true' }}
+      uses: actions/cache/save@v5
+      with:
+        path: "node_modules"
+        key: node_modules-${{ hashFiles('package-lock.json') }}

.github/actions/polyfills/action.yml

@@ -0,0 +1,45 @@
+name: polyfills
+description: Manage cached polyfills.json
+inputs:
+  sha:
+    description: commit SHA
+    required: true
+  output:
+    description: Output file name
+  input:
+    description: Input file name
+    default: ''
+  fail-on-cache-miss:
+    description: Fail on cache miss
+    default: 'false'
+outputs:
+  cache-hit:
+    description: true if polyfills.json was found in cache
+    value: ${{ steps.restore.outputs.cache-hit == 'true' }}
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore from cache
+      id: restore
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ runner.temp }}/polyfills.json
+        key: polyfills-${{ inputs.sha }}
+        fail-on-cache-miss: ${{ inputs.fail-on-cache-miss }}
+    - name: Rename file
+      if: ${{ inputs.input != '' && steps.restore.outputs.cache-hit != 'true' }}
+      shell: bash
+      run: |
+        cp "${{ inputs.input }}" ${{ runner.temp }}/polyfills.json
+    - name: Save to cache
+      if: ${{ inputs.input != '' && steps.restore.outputs.cache-hit != 'true' }}
+      id: save
+      uses: actions/cache/save@v5
+      with:
+        path: ${{ runner.temp }}/polyfills.json
+        key: polyfills-${{ inputs.sha }}
+    - name: Rename file
+      if: ${{ inputs.output != '' && (steps.restore.outputs.cache-hit == 'true' || inputs.input != '') }}
+      shell: bash
+      run: |
+        mv "${{ runner.temp }}/polyfills.json" "${{ inputs.output }}"

.github/actions/save/action.yml

@@ -0,0 +1,41 @@
+name: Save working directory
+description: Save working directory, preserving permissions
+inputs:
+  prefix:
+    description: Prefix to use for autogenerated names
+    required: false
+  name:
+    description: a name to reference with actions/load
+    required: false
+outputs:
+  name:
+    description: a name to reference with actions/load
+    value: ${{ fromJSON(steps.platform.outputs.result).name }}
+
+runs:
+  using: 'composite'
+  steps:
+    - uses: actions/github-script@v9
+      id: platform
+      with:
+        script: |
+          const os = require('os');
+          const crypto = require("crypto");
+          const id = crypto.randomBytes(16).toString("hex");          
+          return {       
+             name: ${{ inputs.name && format('"{0}"', inputs.name) || format('"{0}" + id', inputs.prefix || '') }},
+             platform: os.platform(),
+          }
+    - name: Tar working directory
+      shell: bash
+      run: |
+        wdir="$(pwd)"
+        parent="$(dirname "$wdir")"
+        target="$(basename "$wdir")"
+        tar ${{ fromJSON(steps.platform.outputs.result).platform == 'win32' && '--force-local' || '' }} -C "$parent" -cf "${{ runner.temp }}/${{ fromJSON(steps.platform.outputs.result).name }}.tar" "$target"
+    - name: Upload artifact
+      uses: actions/upload-artifact@v7
+      with:
+        path: '${{ runner.temp }}/${{ fromJSON(steps.platform.outputs.result).name }}.tar'
+        name: ${{ fromJSON(steps.platform.outputs.result).name }}
+        overwrite: true

.github/actions/unzip-artifact/action.yml

@@ -0,0 +1,52 @@
+name: Unzip artifact
+description: Download and unzip artifact from a triggering workflow
+inputs:
+  name:
+    description: Artifact name
+outputs:
+  exists:
+    description: true if the artifact was found
+    value: ${{ steps.download.outputs.result }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Delay waiting for artifacts to be ready'
+      shell: bash
+      run: sleep 10
+    - name: 'Download artifact'
+      id: download
+      uses: actions/github-script@v9
+      with:
+        result-encoding: string
+        script: |
+          let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
+             owner: context.repo.owner,
+             repo: context.repo.repo,
+             run_id: context.payload.workflow_run.id,
+          });
+          let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
+            return artifact.name == "${{ inputs.name }}"
+          })[0];
+          if (matchArtifact == null) {
+            return "false"
+          }
+          let download = await github.rest.actions.downloadArtifact({
+             owner: context.repo.owner,
+             repo: context.repo.repo,
+             artifact_id: matchArtifact.id,
+             archive_format: 'zip',
+          });
+          const fs = require('fs');
+          const path = require('path');
+          const temp = '${{ runner.temp }}/artifacts';
+          if (!fs.existsSync(temp)){
+            fs.mkdirSync(temp);
+          }
+          fs.writeFileSync(path.join(temp, 'artifact.zip'), Buffer.from(download.data));
+          return "true";
+
+    - name: 'Unzip artifact'
+      shell: bash
+      if: ${{ steps.download.outputs.result == 'true' }}
+      run: unzip "${{ runner.temp }}/artifacts/artifact.zip" -d "${{ runner.temp }}/artifacts"

.github/actions/wait-for-browserstack/action.yml

@@ -0,0 +1,28 @@
+name: Wait for browserstack sessions
+description: Wait until enough browserstack sessions have become available
+inputs:
+  sessions:
+    description: Number of sessions needed to continue
+    default: "6"
+runs:
+  using: 'composite'
+  steps:
+    - shell: bash
+      run: |
+        while            
+          status=$(curl -u "${BROWSERSTACK_USERNAME}:${BROWSERSTACK_ACCESS_KEY}" \
+            -X GET "https://api-cloud.browserstack.com/automate/plan.json" 2> /dev/null)
+          echo "Response: $status"
+          running=$(jq -e '.parallel_sessions_running' <<< $status || echo "0")
+          max_running=$(jq -e '.parallel_sessions_max_allowed' <<< $status || echo "-1")
+          queued=$(jq -e '.queued_sessions' <<< $status || echo "0")
+          max_queued=$(jq -e '.queued_sessions_max_allowed' <<< $status || echo "0")
+          spare=$(( ${max_running} + ${max_queued} - ${running} - ${queued} ))
+          required=${{ inputs.sessions }}
+          echo "Browserstack status: ${running} sessions running, ${queued} queued, ${spare} free"
+          (( ${required} > ${spare} ))
+        do
+          delay=$(( 60 + $(shuf -i 1-60 -n 1) ))
+          echo "Waiting for ${required} sessions to free up, checking again in ${delay}s"
+          sleep $delay
+        done

.github/codeql/queries/autogen_fpDOMMethod.qll

@@ -0,0 +1,23 @@
+// this file is autogenerated, see fingerprintApis.mjs
+
+class DOMMethod extends string {
+
+  float weight; 
+  string type; 
+
+  DOMMethod() {
+
+      ( this = "toDataURL"  and weight = 31.74  and type = "HTMLCanvasElement" )
+       or 
+      ( this = "getChannelData"  and weight = 996.5  and type = "AudioBuffer" )
+  }  
+
+  float getWeight() {
+    result = weight
+  }
+
+  string getType() {
+    result = type
+  }
+
+}