Sync EdgeZero PR #257 updates by aram356 · Pull Request #761 · IABTechLab/trusted-server

aram356 · 2026-06-10T06:08:53Z

Summary

Syncs this branch with the EdgeZero tooling/dependency updates and standardizes
crate naming, rebased on top of main. Since this branch was opened, main
landed its own HTTP-types migration (PR 12 / PR 13 — #624, #626) and additional
features (DataDome server-side protection #769, configurable integration proxy
paths #759, image proxy fixes, and several test-coverage additions). The
overlapping work has been reconciled in favor of main's newer architecture,
so this PR now carries only the changes that are genuinely additive over main.

EdgeZero dependency + toolchain

Point the edgezero-* git dependencies at the upstream main branch
(rather than a pinned rev), so this app tracks current EdgeZero.
Bump fastly / log-fastly to 0.12 to match the version EdgeZero main
pins.
Forward-port to the newer EdgeZero / Fastly APIs:
- edgezero_core::body::Body::into_bytes() now returns Option<Bytes>
  (None only for streaming bodies). Buffered-body call sites use
  .unwrap_or_default(), preserving prior Bytes semantics. For
  size-bounded reads, Body::into_bytes_bounded(max) is now available.
- Fastly 0.12's get_tls_protocol() / get_tls_cipher_openssl_name() now
  return Result<Option<&str>>; adapter call sites use .ok().flatten().
Update tool pins: Rust 1.91.1 → 1.95.0 (rust-toolchain.toml +
.tool-versions), Fastly CLI 13.3.0 → 15.1.0, Viceroy 0.16.4 → 0.17.0,
add Wasmtime 44.0.1.

Crate naming

Standardize every crate on the trusted-server-* prefix:
- crates/js → crates/trusted-server-js
- crates/openrtb → crates/trusted-server-openrtb
- crates/openrtb-codegen → crates/trusted-server-openrtb-codegen
- crates/integration-tests → crates/trusted-server-integration-tests
- Package names, workspace members, and internal references updated to match.
Refresh clippy.toml to the EdgeZero-style configuration.

Reconciliation decisions (vs. the original PR intent)

Integration HTTP code: main's HTTP-types migration supersedes this
branch's older fastly::-based integration code, so the conflicted files take
main's versions (the http:: / async EdgeZero platform surface).
Clippy lint posture: the original branch enabled a strict
restriction = "deny" workspace posture. That produced large, unrelated churn
against main's current code, so the workspace lint levels stay at
main's posture. (clippy.toml config is still refreshed; clippy -D warnings is green.)
Lockfiles: root Cargo.lock and the excluded
trusted-server-integration-tests/Cargo.lock are resynced to EdgeZero main
- Fastly 0.12 and pass --locked.

Known limitation (tracked separately)

trusted-server-core is not yet platform-agnostic: it still has an
unconditional fastly dependency, with the coupling in compat.rs (a
fastly::Request ↔ http::Request bridge) and backend.rs
(fastly::backend::Backend). Only trusted-server-adapter-fastly exists today;
the workspace declares (currently unused) edgezero-adapter-axum /
edgezero-adapter-cloudflare, and there is no Spin adapter. Extracting the
Fastly coupling out of core so it can run on the other EdgeZero adapters
(Cloudflare Workers, Spin, Axum) is intentionally out of scope for this PR
and will be done separately.

Verification

References stackpop/edgezero#257

…r-257

Point the edgezero dependencies at the upstream main branch and bump fastly/log-fastly to 0.12 to match edgezero's pinned version. Forward-port the body and TLS APIs to the newer surface: - Body::into_bytes() now returns Option<Bytes>; buffered-body call sites use unwrap_or_default() to preserve prior semantics. - fastly 0.12 get_tls_protocol()/get_tls_cipher_openssl_name() return Result<Option<&str>>; adapter call sites use .ok().flatten(). Resync the excluded integration-tests lockfile to the same versions.

ChristianPavilonis

Automated review: I reviewed PR #761 against main, focusing on the EdgeZero/Fastly API update, crate/path renames, build and CI wiring, and the touched runtime code paths. CI is green and I did not find any blocking correctness, security, data-loss, authorization, or severe compatibility issues. I left one low-severity documentation/operational comment.

The wrapper script lives at crates/trusted-server-openrtb/generate.sh, not in the codegen crate. Point the example at the actual script path.

ChristianPavilonis

Automated review: I reviewed PR #761 against main, focusing on the EdgeZero/Fastly API migration, Body/TLS API call sites, crate renames, CI/script path updates, lockfiles, OpenRTB regeneration paths, and touched runtime/security-sensitive code. CI is green, existing CodeQL/README feedback has already been addressed or is non-blocking, and I did not find any blocking correctness, security, data-loss, authorization, or severe compatibility issues in this pass.

ChristianPavilonis

Review Summary

😃 Approved. I reviewed PR #761 against main, with another pass over the rename/tooling/doc fallout after the EdgeZero/Fastly sync. CI is green.

🔧 I left a few non-blocking inline doc suggestions using GitHub suggestion blocks so they can be applied directly.

📝 One additional cleanup is worth doing but could not be attached as an inline suggestion because those files are not part of the PR diff: tracked Claude helper files still reference the deleted crates/js/lib path (for example .claude/commands/check-ci.md, .claude/commands/verify.md, .claude/agents/verify-app.md, .claude/agents/build-validator.md). Please replace remaining crates/js references with crates/trusted-server-js so local/agent verification helpers keep working after the crate rename.

… paths Apply the approving review's inline doc suggestions and the crate-rename cleanup: - integration-guide: describe directory-based entrypoint discovery (src/integrations/<id>/index.ts) instead of arbitrary .ts files, and point the Testlight key file at testlight/index.ts. - creative-processing: fix the generated bundle output directory to crates/trusted-server-js/dist (not lib/dist). - .claude helper commands/agents: replace remaining crates/js references with crates/trusted-server-js so local/agent verification helpers keep working after the crate rename.

aram356 · 2026-06-22T18:12:01Z

Addressed the review-summary cleanup in 32f45d5: replaced the remaining crates/js references with crates/trusted-server-js across the tracked Claude helper files so local/agent verification keeps working after the crate rename. Beyond the four called out (.claude/commands/check-ci.md, .claude/commands/verify.md, .claude/agents/verify-app.md, .claude/agents/build-validator.md), I also updated .claude/commands/test-all.md, .claude/commands/test-crate.md, .claude/agents/pr-creator.md, .claude/agents/pr-reviewer.md, and .claude/agents/repo-explorer.md for consistency. No remaining crates/js references under .claude/.

Reconcile main (Osano CMP mirror #773, fastly extraction out of core, EC/storage refactors) with this branch's EdgeZero/fastly-0.12 bump. Resolution decisions: - Keep this branch's dependency bump: fastly/log-fastly 0.12 and edgezero git deps tracking branch=main (over main's pinned rev + 0.11.12), plus the trusted-server-* crate renames. - Take main's newer runtime code for conflicted files (EC http:: migration, settings, geo, testlight, adapter restructure), then forward-port it to the edgezero-main / fastly-0.12 API surface: - Body::into_bytes() now returns Option<Bytes>; buffered sites use unwrap_or_default() (batch_sync, pull_sync, identify/testlight tests). - fastly 0.12 get_tls_protocol()/get_tls_cipher_openssl_name() return Result<Option>; call sites use .ok().flatten(). - edgezero-main moved adapter symbols into submodules (request::into_core_request, config_store::FastlyConfigStore, context::FastlyRequestContext) and made router oneshot()/IntoResponse into_response() fallible; dispatch and test sites updated accordingly. - Accept main's deletion of core storage/secret_store.rs (fastly removal). - Fix a directory-rename gap: main added Osano JS under the old crates/js path; relocated into crates/trusted-server-js so the bundle is discovered. Verified: cargo fmt/clippy/test --workspace, wasm release build, JS vitest + format. All green.

…r-257 Bring in main #797 (tester cookie clear endpoint) and forward-port its new code to the edgezero-main / fastly-0.12 surface: - Wrap the two new block_on(router.oneshot(...)) test sites with the fallible-oneshot .expect() pattern. Also finish the crates/js -> crates/trusted-server-js rename fallout that main's design docs and a sourcepoint.rs comment still referenced, so no crates/js path remains anywhere in the tree. Verified: cargo fmt/clippy/test --workspace, JS vitest, docs prettier. All green.

The Integration Tests CI job runs scripts/check-integration-dependency-versions.sh, which requires the excluded trusted-server-integration-tests crate to resolve the same shared direct-dependency versions as the workspace. Regenerating its lockfile during the EdgeZero sync picked up log 0.4.33 while the workspace stays on 0.4.32. Downgrade log in the integration lockfile so the parity check passes.

The EdgeZero entry-point step in integration-tests.yml still pointed at the pre-rename crates/integration-tests path for both --manifest-path and VICEROY_CONFIG_PATH, so the job failed with 'manifest path does not exist'. Point them at crates/trusted-server-integration-tests to match the rename (the legacy integration-tests job already used the new path).

The merge resolution kept this branch's looser toml = "1.0" requirement; main uses "1.1". Both resolve to the same locked 1.1.x, so the lockfile is unchanged, but match main to avoid widening the version range.

The integration-tests lockfile was regenerated fresh during the EdgeZero sync and picked up newer patch/minor versions of crates that also resolve through trusted-server-core (http, bytes, uuid, lol_html, config, brotli, chrono, regex, time, etc.), so the tests linked slightly different versions than the production build ships. Pin those shared transitive crates back to the workspace-resolved versions (45 crates aligned). Six remain newer (js-sys, num-conv, wasm-bindgen family) because the integration crate's own dependency tree constrains them to a higher version; those cannot be downgraded without breaking resolution. The CI direct-dependency parity check still passes and the crate compiles --locked on the host target.

Extend check-integration-dependency-versions.sh with a lockfile-based transitive parity check: every (name, version) the workspace lockfile resolves must also be present in the integration lockfile for any shared crate, so the integration tests exercise the same dependency versions the production build ships. This catches accidental drift when the integration lockfile is regenerated and silently bumps shared crates to newer versions than production uses (the failure mode that produced the original log/http drift during the EdgeZero sync). A small documented allowlist exempts crates the integration crate's own dependency tree forces to a different version (js-sys / wasm-bindgen family and num-conv, pulled newer by reqwest's wasm tooling; itertools, whose workspace 0.10.x line the integration tree never resolves). Also align four more shared transitives that were previously skipped as multi-version (bitflags, getrandom, hashbrown, syn) down to the workspace versions, so the enforced allowlist stays minimal. The check is parsed directly from the lockfiles (no cargo invocation), and a negative test confirms it flags an injected http drift and passes after restore.

Resolve conflicts from the EdgeZero PR #257 sync on main (#761): - Cargo.toml: adopt main's crate renames, fastly/log-fastly 0.12, and edgezero tracking the upstream main branch; keep the branch's glob dep. - publisher.rs: keep both sides' new tests; forward-port test body extraction to the Option-returning Body::into_bytes API and drop the now-unused response_body_string helper superseded by the branch tests. - auction/endpoints.rs: unwrap_or_default the Option-returning into_bytes. - Relocate the new GPT SPA tests into the renamed crates/trusted-server-js tree and refresh stale crates/js doc-comment paths. - Take main's CI-validated integration-tests lockfile (deps unchanged on the branch).

The EdgeZero sync (#761) renamed crates/js and crates/integration-tests to crates/trusted-server-*. The old directories still hold local-only build artifacts (node_modules, target, dist) whose gitignore rules moved with the rename, so git now sees them as untracked. Ignore the defunct paths until the directories are removed from disk.

aram356 marked this pull request as draft June 10, 2026 06:10

aram356 self-assigned this Jun 10, 2026

aram356 force-pushed the chore/sync-edgezero-pr-257 branch from f078d3b to 396d270 Compare June 10, 2026 06:11

github-advanced-security AI found potential problems Jun 10, 2026

View reviewed changes

Comment thread crates/trusted-server-adapter-fastly/src/backend.rs Fixed

Comment thread crates/trusted-server-adapter-fastly/src/backend.rs Fixed

Comment thread crates/trusted-server-adapter-fastly/src/backend.rs Fixed

Comment thread crates/trusted-server-adapter-fastly/src/backend.rs Fixed

aram356 force-pushed the chore/sync-edgezero-pr-257 branch 3 times, most recently from 41e7268 to b6c4a79 Compare June 10, 2026 19:09

Sync EdgeZero PR 257 updates

159c731

aram356 force-pushed the chore/sync-edgezero-pr-257 branch from b6c4a79 to 159c731 Compare June 11, 2026 08:04

aram356 changed the title ~~Sync EdgeZero PR #257 strict clippy updates~~ Sync EdgeZero PR #257 updates Jun 11, 2026

aram356 added 6 commits June 11, 2026 13:37

Merge main into EdgeZero sync branch

a51e98d

Formatting

5b3b1aa

Merge remote-tracking branch 'origin/main' into chore/sync-edgezero-p…

1961433

…r-257

Merge remote-tracking branch 'origin/main' into chore/sync-edgezero-p…

beee624

…r-257

Sync integration-tests lockfile to edgezero 170b74b and fastly 0.11

3aa2623

aram356 marked this pull request as ready for review June 17, 2026 01:38

aram356 requested review from ChristianPavilonis and prk-Jr June 17, 2026 01:38

ChristianPavilonis reviewed Jun 17, 2026

View reviewed changes

Comment thread crates/trusted-server-openrtb/README.md Outdated

Fix OpenRTB regeneration command in README

4c4e6a0

The wrapper script lives at crates/trusted-server-openrtb/generate.sh, not in the codegen crate. Point the example at the actual script path.

aram356 requested a review from ChristianPavilonis June 17, 2026 07:19

ChristianPavilonis reviewed Jun 17, 2026

View reviewed changes

ChristianPavilonis approved these changes Jun 18, 2026

View reviewed changes

Comment thread docs/guide/integration-guide.md Outdated

Comment thread docs/guide/integration-guide.md Outdated

Comment thread docs/guide/creative-processing.md Outdated

aram356 added 2 commits June 22, 2026 00:28

Merge branch 'main' into chore/sync-edgezero-pr-257

450d0f8

prk-Jr approved these changes Jun 22, 2026

View reviewed changes

aram356 added 2 commits June 22, 2026 13:57

aram356 added 5 commits June 22, 2026 14:30

Align toml dependency requirement with main (1.1)

3b02e46

The merge resolution kept this branch's looser toml = "1.0" requirement; main uses "1.1". Both resolve to the same locked 1.1.x, so the lockfile is unchanged, but match main to avoid widening the version range.

aram356 merged commit 5447648 into main Jun 22, 2026
14 checks passed

aram356 deleted the chore/sync-edgezero-pr-257 branch June 22, 2026 22:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sync EdgeZero PR #257 updates#761

Sync EdgeZero PR #257 updates#761
aram356 merged 17 commits into
mainfrom
chore/sync-edgezero-pr-257

aram356 commented Jun 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ChristianPavilonis left a comment

Uh oh!

Uh oh!

ChristianPavilonis left a comment

Uh oh!

ChristianPavilonis left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aram356 commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

aram356 commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

EdgeZero dependency + toolchain

Crate naming

Reconciliation decisions (vs. the original PR intent)

Known limitation (tracked separately)

Verification

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ChristianPavilonis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ChristianPavilonis left a comment

Choose a reason for hiding this comment

Uh oh!

ChristianPavilonis left a comment

Choose a reason for hiding this comment

Review Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aram356 commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

aram356 commented Jun 10, 2026 •

edited

Loading