Datadome server-side validation

.github/actions/setup-integration-test-env/action.yml

@@ -45,6 +45,15 @@ runs:
       shell: bash
       run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
+    - name: Retrieve Viceroy version
+      id: viceroy-version
+      if: ${{ inputs.install-viceroy == 'true' }}
+      shell: bash
+      # `.tool-versions` is the single source of truth for the Viceroy pin.
+      # The pin matters because upstream Viceroy > v0.16.4 has bumped MSRV
+      # beyond the rustc pin in `rust-toolchain.toml`.
+      run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
     - name: Set up Rust toolchain
       uses: actions-rust-lang/setup-rust-toolchain@v1
       with:
@@ -58,12 +67,12 @@ runs:
       uses: actions/cache@v4
       with:
         path: ~/.cargo/bin/viceroy
-        key: viceroy-${{ runner.os }}-v0.16.4
+        key: viceroy-${{ runner.os }}-v${{ steps.viceroy-version.outputs.viceroy-version }}
 
     - name: Install Viceroy
       if: ${{ inputs.install-viceroy == 'true' && steps.cache-viceroy.outputs.cache-hit != 'true' }}
       shell: bash
-      run: cargo install --git https://github.com/fastly/Viceroy --tag v0.16.4 viceroy
+      run: cargo install --git https://github.com/fastly/Viceroy --tag v${{ steps.viceroy-version.outputs.viceroy-version }} viceroy
 
     - name: Build WASM binary
       if: ${{ inputs.build-wasm == 'true' }}

.github/workflows/test.yml

@@ -21,27 +21,32 @@ jobs:
         run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
         shell: bash
 
+      - name: Retrieve Viceroy version
+        id: viceroy-version
+        # `.tool-versions` is the single source of truth so this workflow and
+        # `.github/actions/setup-integration-test-env/action.yml` can't drift.
+        # The pin matters because upstream Viceroy > v0.16.4 has bumped MSRV
+        # beyond the rustc pin in `rust-toolchain.toml`.
+        run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        shell: bash
+
       - name: Set up Rust toolchain
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           toolchain: ${{ steps.rust-version.outputs.rust-version }}
           target: wasm32-wasip1
           cache-shared-key: cargo-${{ runner.os }}
 
-      - name: Get Viceroy cache key
-        id: viceroy-rev
-        run: echo "sha=$(git ls-remote https://github.com/fastly/Viceroy HEAD | cut -f1)" >> $GITHUB_OUTPUT
-
       - name: Cache Viceroy binary
         id: cache-viceroy
         uses: actions/cache@v4
         with:
           path: ~/.cargo/bin/viceroy
-          key: viceroy-${{ runner.os }}-${{ steps.viceroy-rev.outputs.sha }}
+          key: viceroy-${{ runner.os }}-v${{ steps.viceroy-version.outputs.viceroy-version }}
 
-      - name: Install Viceroy (from main since 0.14.3 is broken)
+      - name: Install Viceroy
         if: steps.cache-viceroy.outputs.cache-hit != 'true'
-        run: cargo install --git https://github.com/fastly/Viceroy viceroy
+        run: cargo install --git https://github.com/fastly/Viceroy --tag v${{ steps.viceroy-version.outputs.viceroy-version }} viceroy
 
       - name: Run tests
         run: cargo test --workspace

.tool-versions

@@ -1,3 +1,4 @@
 fastly 13.3.0
 rust 1.91.1
 nodejs 24.12.0
+viceroy 0.16.4

crates/trusted-server-adapter-fastly/Cargo.toml

@@ -8,6 +8,7 @@ workspace = true
 
 [dependencies]
 async-trait = { workspace = true }
+base64 = { workspace = true }
 chrono = { workspace = true }
 edgezero-adapter-fastly = { workspace = true, features = ["fastly"] }
 edgezero-core = { workspace = true }
@@ -17,7 +18,10 @@ fern = { workspace = true }
 futures = { workspace = true }
 log = { workspace = true }
 log-fastly = { workspace = true }
-trusted-server-core = {workspace = true}
+serde = { workspace = true }
+serde_json = { workspace = true }
+trusted-server-core = { workspace = true }
+urlencoding = { workspace = true }
 
 [dev-dependencies]
 edgezero-core = { workspace = true, features = ["test-utils"] }

crates/trusted-server-adapter-fastly/src/logging.rs

@@ -0,0 +1,80 @@
+//! Fastly-specific logger wiring for the trusted-server adapter.
+
+use chrono::{SecondsFormat, Utc};
+use log_fastly::Logger;
+
+/// Extracts the final `::` segment from a Rust module path for use as a log label.
+///
+/// When the input has no `::` separator, returns the full target. When the
+/// separator is at the trailing position (e.g. `"foo::"`), returns the head
+/// segment (`"foo"`) to avoid emitting an empty label.
+fn target_label(target: &str) -> &str {
+    match target.rsplit_once("::") {
+        Some((head, "")) => head,
+        Some((_, last)) => last,
+        None => target,
+    }
+}
+
+/// Initialises the Fastly-backed `fern` logger and installs it as the global logger.
+///
+/// Log records are forwarded to the `tslog` Fastly endpoint and echoed to stdout.
+/// Each line is prefixed with an RFC 3339 timestamp, level, and the final segment
+/// of the record's target module path.
+///
+/// # Panics
+///
+/// Panics if the Fastly logger cannot be built or if the global logger has already
+/// been set.
+pub(crate) fn init_logger() {
+    let logger = Logger::builder()
+        .default_endpoint("tslog")
+        .echo_stdout(true)
+        .max_level(log::LevelFilter::Info)
+        .build()
+        .expect("should build Logger");
+
+    fern::Dispatch::new()
+        .format(|out, message, record| {
+            out.finish(format_args!(
+                "{} {} [{}] {}",
+                Utc::now().to_rfc3339_opts(SecondsFormat::Millis, true),
+                record.level(),
+                target_label(record.target()),
+                message
+            ));
+        })
+        .chain(Box::new(logger) as Box<dyn log::Log>)
+        .apply()
+        .expect("should initialize logger");
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn target_label_extracts_correct_segment() {
+        assert_eq!(
+            target_label("trusted_server_adapter_fastly::proxy"),
+            "proxy",
+            "should handle standard single-separator case"
+        );
+        assert_eq!(
+            target_label("foo::bar::baz"),
+            "baz",
+            "should handle multiple separators"
+        );
+        assert_eq!(
+            target_label("no_separators_here"),
+            "no_separators_here",
+            "should handle inputs without ::"
+        );
+        assert_eq!(target_label(""), "", "should handle empty strings");
+        assert_eq!(
+            target_label("trailing::"),
+            "trailing",
+            "should strip separator when trailing segment is empty"
+        );
+    }
+}