Spin ClientInfo, the Spin part of EZI-3 #485

Summary

Spin ClientInfo, the Spin part of EZI-3.

Behavior

One accessor returns the trusted client IP, and one the JA4 fingerprint where a trusted provider supplies it (#283), on every adapter, Fastly and Axum first. JA4 is an EdgeZero abstraction, ctx.ja4(), that each adapter fills from its own source: Fastly from runtime TLS, Cloudflare from Bot Management, Axum from a trusted proxy header such as CloudFront's CloudFront-Viewer-JA4-Fingerprint set by a hop EdgeZero's checked ingress trusts, and Spin never (NotExposed). Trusted Server reads JA4 only through it.

Acceptance criteria

• The same accessors work on each adapter as its part lands, and a JA4 header from an untrusted peer reads as absent

Dependencies

Blocked by:

• ClientInfo contract: portable client IP and TLS metadata #475 ClientInfo contract: portable client IP and TLS metadata (new in this plan)

Blocks:

• Integration-branch tag with the Spin parts #493 Integration-branch tag with the Spin parts (new in this plan)
• As a developer I want to access client metadata in handlers #89 As a developer I want to access client metadata in handlers

Related

• Needed by Server-side identity on every adapter trusted-server#1558, server-side identity on every adapter. Planned in wave 15 (after the MVP: Spin); priority P3, size S.
• Requirement EZI-3 in the design.