userId: a filtered refreshUserIds must not release the auction early

[MO-Thibault]

Type of change

• Bugfix

Description

refreshUserIds({submoduleNames}) can release the auction before submodules it did not name have finished initializing.

cancelAndTry rejects the previous cancel deferred, so the old done — a race that includes cancel.promise — settles immediately. The replacement chain then does done.catch(() => null) against that already-settled race rather than the inner promise still holding the pending work:

if (refresh && initialized) {
  done = cancelAndTry(
    done
      .catch(() => null)     // <- the cancelled race, not the work in flight
      .then(timeConsent)
      .then(checkRefs(() => { /* initSubmodules for the named submodules only */ }))
  );
}

What it waits on instead is initSubmodules for the named submodules. For something like pubProvidedId that is a synchronous storage read, so it resolves almost immediately, getUserIdsAsync resolves with it, and startAuctionHook proceeds:

PbPromise.race([ getIds().catch(() => null), mkDelay(auctionDelay) ])
  .then(() => { addIdData(reqBidsConfigObj); fn.call(this, reqBidsConfigObj); });

This contradicts getUserIdsAsync's own docstring:

@returns a promise that resolves to the same value as getUserIds(), but only once all ID submodules have completed initialization.

and startAuctionHook is its main internal consumer, so the auction stops honouring auctionDelay for every submodule the refresh did not name.

retryOnCancel's INIT_CANCELED handler is not the problem — it retries correctly. The leak is one level down, in the refresh branch.

How it shows up

Publisher running userSync.auctionDelay = 300 with liveIntentId and pubProvidedId. A page-load refreshUserIds({submoduleNames: ['pubProvidedId']}) released the first auction roughly 300ms early, before liveIntentId's network call returned, so its EIDs were absent from that auction's bid requests.

Instrumented browser, LiveIntent's endpoints delayed so its arrival straddled the two auction times:

	kept LiveIntent on auction 1
with the refresh	0 of 9
without it	8 of 9

The auction opened ~294ms earlier in 6 of 6 timed pairs, against the configured 300, with refreshUserIds firing 15-25ms before auctionInit every run.

Confirmed independently in production: a control arm carrying one inert EID purely to trigger the refresh, and nothing else, dropped first-auction LiveIntent presence from 77.1% to 49.7% (n=384 and n=350, z ~8), converging with the untouched arm from the second auction on.

Any publisher combining a non-zero auctionDelay with a filtered refreshUserIds is silently losing their slowest ID module on the first auction, which is typically their most valuable.

The change

Track pending submodule callbacks per submodule name rather than as one blob, and have getUserIdsAsync await the ones still outstanding.

A refresh supersedes the entries for the modules it names. An unfiltered refreshUserIds() therefore clears them all and keeps its current behaviour of unblocking a stuck init, which should still resolve promises returned by refreshUserIds and ... getUserIdsAsync both depend on. A filtered refresh leaves the untouched modules' entries in place, which is the fix.

refreshUserIds' own return value is unchanged. Nothing waits longer than before except getUserIdsAsync, and the auction is still bounded by mkDelay(auctionDelay), so a genuinely stuck submodule cannot hang it.

An earlier attempt chained the refresh off the uncancelled inner promise instead. It broke the two tests above, because an unfiltered forced refresh is meant to escape a stuck init. Per-module tracking is what reconciles the two.

Test

New: should not release the auction when a filtered refresh cancels a pending submodule.

Verified in both directions with gulp test --file test/spec/modules/userId_spec.js:

• with the fix: 130 passed
• source fix reverted, test kept: 129 passed, 1 failed, and the failure is the new test

ESLint clean on both files.

[github-actions]

Tread carefully! This PR adds 3 linter errors (possibly disabled through directives):

• libraries/pubmaticUtils/plugins/floorProvider.js (+1 error)
• modules/showheroes-bsBidAdapter.js (+1 error)
• src/creativeRenderers.js (+1 error)

[github-actions]

Tread carefully! This PR adds 3 linter errors (possibly disabled through directives):

• libraries/pubmaticUtils/plugins/floorProvider.js (+1 error)
• modules/showheroes-bsBidAdapter.js (+1 error)
• src/creativeRenderers.js (+1 error)

[github-actions]

Tread carefully! This PR adds 3 linter errors (possibly disabled through directives):

• libraries/pubmaticUtils/plugins/floorProvider.js (+1 error)
• modules/showheroes-bsBidAdapter.js (+1 error)
• src/creativeRenderers.js (+1 error)

[github-actions]

Tread carefully! This PR adds 4 linter errors (possibly disabled through directives):

• libraries/pubmaticUtils/plugins/floorProvider.js (+1 error)
• modules/showheroes-bsBidAdapter.js (+1 error)
• modules/sspBCBidAdapter.js (+1 error)
• src/creativeRenderers.js (+1 error)

[github-actions]

Tread carefully! This PR adds 4 linter errors (possibly disabled through directives):

• libraries/pubmaticUtils/plugins/floorProvider.js (+1 error)
• modules/showheroes-bsBidAdapter.js (+1 error)
• modules/sspBCBidAdapter.js (+1 error)
• src/creativeRenderers.js (+1 error)

[github-actions]

Tread carefully! This PR adds 4 linter errors (possibly disabled through directives):

• libraries/pubmaticUtils/plugins/floorProvider.js (+1 error)
• modules/showheroes-bsBidAdapter.js (+1 error)
• modules/sspBCBidAdapter.js (+1 error)
• src/creativeRenderers.js (+1 error)

[github-actions]

Tread carefully! This PR adds 4 linter errors (possibly disabled through directives):

• libraries/pubmaticUtils/plugins/floorProvider.js (+1 error)
• modules/showheroes-bsBidAdapter.js (+1 error)
• modules/sspBCBidAdapter.js (+1 error)
• src/creativeRenderers.js (+1 error)