Use request-scoped EdgeZero HTTP and body ownership

Cargo.toml

@@ -56,12 +56,12 @@ cssparser = "0.36"
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
-edgezero-cli = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11" }
-edgezero-core = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.11", default-features = false }
+edgezero-adapter-axum = { git = "https://github.com/IABTechLab/edgezero", rev = "456313675b6a85e11acea870240f6a6d869f1137", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/IABTechLab/edgezero", rev = "456313675b6a85e11acea870240f6a6d869f1137", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/IABTechLab/edgezero", rev = "456313675b6a85e11acea870240f6a6d869f1137", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/IABTechLab/edgezero", rev = "456313675b6a85e11acea870240f6a6d869f1137", default-features = false }
+edgezero-cli = { git = "https://github.com/IABTechLab/edgezero", rev = "456313675b6a85e11acea870240f6a6d869f1137" }
+edgezero-core = { git = "https://github.com/IABTechLab/edgezero", rev = "456313675b6a85e11acea870240f6a6d869f1137", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"
@@ -108,7 +108,7 @@ serde_yaml_ng = "0.10"
 sha2 = "0.11"
 similar = "2.7"
 simple_logger = "5"
-spin-sdk = { version = "~7.0", default-features = false, features = ["http", "key-value", "variables"] }
+spin-sdk = { version = "=7.0.0", git = "https://github.com/stackpop/spin-rust-sdk.git", rev = "6c59ed5b4fcb377072763aee0b27a3abdd8edb72", default-features = false, features = ["http", "key-value", "variables"] }
 subtle = "2.6"
 temp-env = "0.3.6"
 tempfile = "3.24"

crates/trusted-server-adapter-axum/Cargo.toml

@@ -25,7 +25,6 @@ edgezero-core = { workspace = true }
 error-stack = { workspace = true }
 futures = { workspace = true }
 log = { workspace = true }
-reqwest = { workspace = true }
 simple_logger = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "sync", "time"] }
 trusted-server-core = { workspace = true }

crates/trusted-server-adapter-axum/src/app.rs

@@ -155,14 +155,20 @@ fn legacy_admin_alias_denied() -> Response {
 async fn execute_handler<F, Fut>(
     state: Arc<AppState>,
     ctx: RequestContext,
+    body_limit: Option<usize>,
     handler: F,
 ) -> Result<Response, EdgeError>
 where
     F: FnOnce(Arc<AppState>, RuntimeServices, Request) -> Fut,
     Fut: Future<Output = Result<Response, Report<TrustedServerError>>>,
 {
     let services = state.services_for_request(&ctx);
-    let mut req = ctx.into_request();
+    if ctx.method() == Method::POST
+        && let Some(limit) = body_limit
+    {
+        ctx.body_bytes(limit).await?;
+    }
+    let mut req = ctx.into_request()?;
     if let Err(error) = trusted_server_core::integrations::gpt_diagnostics::prepare_request(
         &state.settings,
         &mut req,
@@ -284,6 +290,7 @@ fn fallback_handler(
         Box::pin(execute_handler(
             state,
             ctx,
+            None,
             |state, services, req| async move { dispatch_fallback(&state, &services, req).await },
         ))
     }
@@ -453,6 +460,21 @@ fn named_route_handler(
         Box::pin(execute_handler(
             state,
             ctx,
+            match handler {
+                NamedRouteHandler::VerifySignature => {
+                    Some(trusted_server_core::request_signing::endpoints::VERIFY_MAX_BODY_BYTES)
+                }
+                NamedRouteHandler::Auction => {
+                    Some(trusted_server_core::auction::endpoints::MAX_AUCTION_BODY_SIZE)
+                }
+                NamedRouteHandler::FirstPartySign => {
+                    Some(trusted_server_core::proxy::SIGN_MAX_BODY_BYTES)
+                }
+                NamedRouteHandler::FirstPartyProxyRebuild => {
+                    Some(trusted_server_core::proxy::REBUILD_MAX_BODY_BYTES)
+                }
+                _ => None,
+            },
             move |state, services, req| async move {
                 match handler {
                     NamedRouteHandler::TrustedServerDiscovery => {
@@ -619,16 +641,16 @@ impl Hooks for TrustedServerApp {
         "TrustedServer"
     }
 
-    fn routes() -> RouterService {
+    fn routes() -> Result<RouterService, EdgeError> {
         let state = match build_state() {
             Ok(s) => s,
             Err(ref e) => {
                 log::error!("failed to build application state: {:?}", e);
-                return startup_error_router(e);
+                return Ok(startup_error_router(e));
             }
         };
 
-        build_router(&state)
+        Ok(build_router(&state))
     }
 }
 
@@ -725,7 +747,7 @@ fn build_router(state: &Arc<AppState>) -> RouterService {
     router.build()
 }
 
-fn trace_metadata(state: &AppState, request: &Request) -> TraceMetadata {
+fn trace_metadata(state: &AppState, request: &edgezero_core::http::RequestParts) -> TraceMetadata {
     if let Some(services) = &state.services {
         let client_info = services.client_info().clone();
         let geo = client_info.client_ip.and_then(|client_ip| {
@@ -738,7 +760,9 @@ fn trace_metadata(state: &AppState, request: &Request) -> TraceMetadata {
     }
     TraceMetadata {
         client_info: ClientInfo {
-            client_ip: AxumRequestContext::get(request)
+            client_ip: request
+                .extensions
+                .get::<AxumRequestContext>()
                 .and_then(|context| context.remote_addr)
                 .map(|peer| peer.ip()),
             ..ClientInfo::default()

crates/trusted-server-adapter-axum/src/lib.rs

@@ -8,5 +8,5 @@
 pub mod app;
 /// Request middleware (auth, response finalisation).
 pub mod middleware;
-/// Platform-trait implementations backed by env vars and `reqwest`.
+/// Platform services backed by environment values and the request's `EdgeZero` client.
 pub mod platform;

crates/trusted-server-adapter-axum/src/main.rs

@@ -1,5 +1,5 @@
 use edgezero_adapter_axum::dev_server::{AxumDevServer, AxumDevServerConfig};
-use edgezero_core::app::Hooks as _;
+use edgezero_core::app::{App, Hooks as _};
 use log::LevelFilter;
 use trusted_server_adapter_axum::app::TrustedServerApp;
 
@@ -32,14 +32,21 @@ fn main() {
         Some(port) => AxumDevServerConfig {
             addr: std::net::SocketAddr::from(([127, 0, 0, 1], port)),
             enable_ctrl_c: true,
+            ..AxumDevServerConfig::default()
         },
         // Normal development path: read bind address from axum.toml.
         None => AxumDevServerConfig::default(),
     };
 
     log::info!("Listening on http://{}", config.addr);
-    let router = TrustedServerApp::routes();
-    if let Err(err) = AxumDevServer::with_config(router, config).run() {
+    let router = match TrustedServerApp::routes() {
+        Ok(router) => router,
+        Err(error) => {
+            log::error!("trusted-server-adapter-axum initialization fails: {error}");
+            std::process::exit(1);
+        }
+    };
+    if let Err(err) = AxumDevServer::with_config(App::new(router), config).run() {
         log::error!("trusted-server-adapter-axum failed: {err}");
         std::process::exit(1);
     }

crates/trusted-server-adapter-axum/src/middleware.rs

@@ -5,9 +5,9 @@ use edgezero_core::context::RequestContext;
 use edgezero_core::error::EdgeError;
 use edgezero_core::http::{HeaderValue, Response};
 use edgezero_core::middleware::{Middleware, Next};
-use trusted_server_core::auth::enforce_basic_auth;
+use trusted_server_core::auth::enforce_basic_auth_parts;
 use trusted_server_core::constants::HEADER_X_GEO_INFO_AVAILABLE;
-use trusted_server_core::http_util::sanitize_trusted_client_ip_headers;
+use trusted_server_core::http_util::sanitize_trusted_client_ip_header_map;
 use trusted_server_core::settings::Settings;
 
 // ---------------------------------------------------------------------------
@@ -38,8 +38,8 @@ impl SanitizeRequestMiddleware {
 #[async_trait(?Send)]
 impl Middleware for SanitizeRequestMiddleware {
     async fn handle(&self, mut ctx: RequestContext, next: Next<'_>) -> Result<Response, EdgeError> {
-        sanitize_trusted_client_ip_headers(
-            ctx.request_mut(),
+        sanitize_trusted_client_ip_header_map(
+            ctx.headers_mut(),
             self.settings.trusted_client_ip.as_ref(),
         );
         next.run(ctx).await
@@ -106,7 +106,7 @@ impl AuthMiddleware {
 #[async_trait(?Send)]
 impl Middleware for AuthMiddleware {
     async fn handle(&self, mut ctx: RequestContext, next: Next<'_>) -> Result<Response, EdgeError> {
-        match enforce_basic_auth(&self.settings, ctx.request_mut()) {
+        match enforce_basic_auth_parts(&self.settings, ctx.parts_mut()) {
             Ok(Some(response)) => return Ok(response),
             Ok(None) => {}
             Err(report) => {
@@ -275,8 +275,8 @@ mod tests {
             let handler_observed = Arc::clone(&handler_observed);
             async move {
                 *handler_observed.lock().expect("should lock observation") = Some((
-                    ctx.request().headers().contains_key("x-reader-ip"),
-                    ctx.request().headers().contains_key("x-reader-ip-auth"),
+                    ctx.headers().contains_key("x-reader-ip"),
+                    ctx.headers().contains_key("x-reader-ip-auth"),
                 ));
                 Ok::<Response, EdgeError>(empty_response())
             }