Skip to content

Harden the Fastly SDK migration guard against silently-skipped source files #791

Open
Task
Open
Harden the Fastly SDK migration guard against silently-skipped source files#791
Task

Description

@prk-Jr
prk-Jr
opened on Jun 22, 2026

Description

crates/trusted-server-core/src/migration_guards.rs scans a hand-maintained list of include_str! source files for Fastly SDK references. An added core Rust file can escape the guard if nobody updates that list. The historical PR review that prompted this issue identified two unlisted DataDome files; the gap is broader now.

Reproducible evidence

At HEAD 666953a0d, a read-only inventory of crates/trusted-server-core/src/**/*.rs versus the include_str!("...rs") entries in migration_guards.rs found 26 unlisted files, excluding migration_guards.rs itself. These include integrations/datadome/protection.rs, integrations/datadome/protection_scope.rs, auction/openrtb.rs, cache_policy.rs, and config.rs. The count is a snapshot; recalculate it when implementing. The existing test scans only checked_sources(). The original issue refers to allowlisted_sources(), but no such function exists at this HEAD; ec/kv.rs and ec/rate_limiter.rs are present in checked_sources(). Confirm whether any source still needs an explicit SDK exception before adding an allowlist.

The original review also recorded a prototype in which build.rs generated a source inventory for an XOR membership test, including a passing negative case. It was reverted as too heavy for that PR; it is historical evidence, not a required design.

Expected behavior

Every core .rs source is checked for forbidden Fastly SDK use, except any explicitly justified SDK exception, and adding an unclassified file fails CI.

Actual behavior

Files absent from the hand-maintained inventory are not checked by this guard.

Proposed fix

Make the inventory complete and add a build-time or test-time completeness assertion that works under the wasm/Viceroy test target. Require each source to appear exactly once in the checked inventory or a justified exception set, if such a set is needed. Keep migration_guards.rs exempt because it contains the banned pattern in the guard itself. Choose the simplest mechanism that makes newly added files fail CI until classified.

Done when

  • All current core .rs files are classified exactly once, with any SDK exceptions explained.
  • A test fails when a new core .rs file is omitted, and fails when a file is listed twice.
  • The guard catches a Fastly SDK reference in a newly classified source.
  • Target-matched Fastly tests and lint, plus formatting, pass.

Context

Follow-up from the review of feature/edgezero-pr15-remove-fastly-core.

Activity

  1. prk-Jr
    self-assigned this
    on Jun 22, 2026
  2. prk-Jr
    added the
    Task
    issue type on Jun 22, 2026
  3. prk-Jr
    added a parent issue on Jun 22, 2026

  4. aram356 commented on Sep 24, 2026

    @aram356
    aram356
    on Sep 24, 2026
    Collaborator

    Current state on main at a4e01eb.

    migration_guards.rs now has a single list. allowlisted_sources() was removed in #643 (00cf849), which moved ec/kv.rs and ec/rate_limiter.rs into checked_sources(). That list names 97 files, all of which still exist. 25 of the 123 .rs files under crates/trusted-server-core/src are not in it (excluding migration_guards.rs itself). That is the two DataDome files named above plus 23 more:

    Integrations:

    • integrations/datadome/protection.rs
    • integrations/datadome/protection_scope.rs
    • integrations/js_asset_proxy.rs
    • integrations/osano.rs

    Everything else:

    • auction/openrtb.rs
    • auction/openrtb/test_executor.rs
    • auction/openrtb/tests.rs
    • auction/plan.rs
    • auction/profile.rs
    • auction/routing.rs
    • auction/telemetry.rs
    • cache_policy.rs
    • config.rs
    • config_payload.rs
    • cookies/template_cache_policy.rs
    • creative_opportunities.rs
    • ec/admin.rs
    • ec/kv_backend.rs
    • platform/backend_naming.rs
    • platform/template_assembly.rs
    • platform/template_cache.rs
    • price_bucket.rs
    • response_privacy.rs
    • secret_resolution.rs
    • tester_cookie.rs

    To regenerate the list from the repository root:

    comm -23 \
  <(cd crates/trusted-server-core/src && git ls-files '*.rs' | grep -vx migration_guards.rs | sort) \
  <(grep -o 'include_str!("[^"]*")' crates/trusted-server-core/src/migration_guards.rs \
      | sed 's/include_str!("\(.*\)")/\1/' | sort)

    One point for the automation item: core no longer has a fastly dependency on either target, so a use fastly in any core file would fail to compile until someone adds the dependency back.

    $ cargo tree -p trusted-server-core -e normal,build --target wasm32-wasip1 -i fastly
error: package ID specification `fastly` did not match any packages

    The same holds for the host target. A CI step that fails when fastly appears in core's dependency graph covers every current and future file, needs no inventory and no build.rs, and avoids the wasm std::fs limit mentioned above. The text scan would then only matter if the dependency came back.

  5. aram356
    unassigned
    prk-Jr
    on Sep 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Task

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions