Skip to content

Add S3 auth and Fastly IO asset routes #726

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ChristianPavilonis wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

Add S3 auth and Fastly IO asset routes #726

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6e77b6f
Add multi-backend asset proxy routing
ChristianPavilonis May 11, 2026
a401d00
Address asset proxy review feedback
ChristianPavilonis May 11, 2026
8a4a43c
Add S3 auth and Fastly IO asset routes
ChristianPavilonis May 20, 2026
de5347a
Accept env bools for image optimizer settings
ChristianPavilonis May 21, 2026
54b85ba
Bypass Fastly IO for SVG asset routes
ChristianPavilonis Jun 4, 2026
de6a1f8
Fix asset route rebase fallout
ChristianPavilonis Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
188 changes: 105 additions & 83 deletions crates/trusted-server-adapter-fastly/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@
use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
use trusted_server_core::platform::RuntimeServices;
use trusted_server_core::proxy::{
handle_first_party_click, handle_first_party_proxy, handle_first_party_proxy_rebuild,
handle_first_party_proxy_sign,
handle_asset_proxy_request, handle_first_party_click, handle_first_party_proxy,
handle_first_party_proxy_rebuild, handle_first_party_proxy_sign,
};
use trusted_server_core::publisher::{
handle_publisher_request, handle_tsjs_dynamic, stream_publisher_body, PublisherResponse,
Expand Down Expand Up @@ -387,18 +387,22 @@
}

// tsjs endpoints
(Method::GET, "/first-party/proxy") => {
(handle_first_party_proxy(settings, req).await, false)
}
(Method::GET, "/first-party/click") => {
(handle_first_party_click(settings, req).await, false)
}
(Method::GET, "/first-party/sign") | (Method::POST, "/first-party/sign") => {
(handle_first_party_proxy_sign(settings, req).await, false)
}
(Method::POST, "/first-party/proxy-rebuild") => {
(handle_first_party_proxy_rebuild(settings, req).await, false)
}
(Method::GET, "/first-party/proxy") => (
handle_first_party_proxy(settings, runtime_services, req).await,
false,
),
(Method::GET, "/first-party/click") => (
handle_first_party_click(settings, runtime_services, req).await,
false,
),
(Method::GET, "/first-party/sign") | (Method::POST, "/first-party/sign") => (
handle_first_party_proxy_sign(settings, runtime_services, req).await,
false,
),
(Method::POST, "/first-party/proxy-rebuild") => (
handle_first_party_proxy_rebuild(settings, runtime_services, req).await,
false,
),
(m, path) if integration_registry.has_route(&m, path) => {
let result = integration_registry
.handle_proxy(ProxyDispatchInput {
Expand All @@ -407,6 +411,7 @@
settings,
kv: kv_graph.as_ref(),
ec_context: &mut ec_context,
services: runtime_services,
req,
})
.await
Expand All @@ -418,78 +423,95 @@
(result, true)
}

// No known route matched, proxy to publisher origin as fallback
_ => {
log::info!(
"No known route matched for path: {}, proxying to publisher origin",
path
);
// No known route matched, proxy to an asset origin or publisher origin as fallback
(method, _) => {
let matched_asset_route = matches!(method, Method::GET | Method::HEAD)
.then(|| settings.asset_route_for_path(&path))
.flatten();

match handle_publisher_request(
settings,
integration_registry,
runtime_services,
kv_graph.as_ref(),
&mut ec_context,
req,
) {
Ok(PublisherResponse::Stream {
mut response,
body,
params,
}) => {
// Publisher fallback has multiple delivery modes.
// EC finalization is header-only, so it must happen before
// headers are committed on the streaming path.
ec_finalize_response(
settings,
&ec_context,
finalize_kv_graph.as_ref(),
partner_registry,
eids_cookie.as_deref(),
sharedid_cookie.as_deref(),
&mut response,
);
finalize_response(settings, geo_info.as_ref(), &mut response);

let mut streaming_body = response.stream_to_client();
let mut stream_succeeded = false;
if let Err(err) = stream_publisher_body(
if let Some(asset_route) = matched_asset_route {
log::info!(

Check failure

Code scanning / CodeQL

Cleartext logging of sensitive information High

This operation writes
settings.reject_placeholder_secrets()
Loading
to a log file.
This operation writes
settings.validate_admin_handler_passwords()
Loading
to a log file.
"No explicit route matched for path: {}, proxying via asset route prefix {} to {}",
path,
asset_route.prefix,
asset_route.origin_url
);
(
handle_asset_proxy_request(settings, runtime_services, req, asset_route).await,
false,
)
} else {
log::info!(
"No known route matched for path: {}, proxying to publisher origin",
path
);

match handle_publisher_request(
settings,
integration_registry,
runtime_services,
kv_graph.as_ref(),
&mut ec_context,
req,
) {
Ok(PublisherResponse::Stream {
mut response,
body,
&mut streaming_body,
&params,
settings,
integration_registry,
) {
// Headers are already committed. Log and abort rather
// than trying to replace the response mid-stream.
log::error!("Streaming processing failed: {err:?}");
drop(streaming_body);
} else if let Err(err) = streaming_body.finish() {
log::error!("Failed to finish streaming body: {err}");
} else {
stream_succeeded = true;
params,
}) => {
// Publisher fallback has multiple delivery modes.
// EC finalization is header-only, so it must happen before
// headers are committed on the streaming path.
ec_finalize_response(
settings,
&ec_context,
finalize_kv_graph.as_ref(),
partner_registry,
eids_cookie.as_deref(),
sharedid_cookie.as_deref(),
&mut response,
);
finalize_response(settings, geo_info.as_ref(), &mut response);

let mut streaming_body = response.stream_to_client();
let mut stream_succeeded = false;
if let Err(err) = stream_publisher_body(
body,
&mut streaming_body,
&params,
settings,
integration_registry,
) {
// Headers are already committed. Log and abort rather
// than trying to replace the response mid-stream.
log::error!("Streaming processing failed: {err:?}");
drop(streaming_body);
} else if let Err(err) = streaming_body.finish() {
log::error!("Failed to finish streaming body: {err}");
} else {
stream_succeeded = true;
}

let pull_sync_context = if is_real_browser && stream_succeeded {
build_pull_sync_context(&ec_context)
} else {
None
};

return Ok(RouteOutcome {
response: None,
pull_sync_context,
});
}
Ok(PublisherResponse::PassThrough { mut response, body }) => {
response.set_body(body);
(Ok(response), true)
}
Ok(PublisherResponse::Buffered(response)) => (Ok(response), true),
Err(e) => {
log::error!("Failed to proxy to publisher origin: {:?}", e);
(Err(e), true)
}

let pull_sync_context = if is_real_browser && stream_succeeded {
build_pull_sync_context(&ec_context)
} else {
None
};

return Ok(RouteOutcome {
response: None,
pull_sync_context,
});
}
Ok(PublisherResponse::PassThrough { mut response, body }) => {
response.set_body(body);
(Ok(response), true)
}
Ok(PublisherResponse::Buffered(response)) => (Ok(response), true),
Err(e) => {
log::error!("Failed to proxy to publisher origin: {:?}", e);
(Err(e), true)
}
}
}
Expand Down
Loading
Loading