Load integration app config at runtime

Author: ChristianPavilonis

Cargo.lock

@@ -25,6 +25,7 @@ edgezero-core = { workspace = true }
 error-stack = { workspace = true }
 futures = { workspace = true }
 log = { workspace = true }
+serde_json = { workspace = true }
 trusted-server-core = { path = "../trusted-server-core" }
 trusted-server-js = { path = "../trusted-server-js" }
 worker = { version = "0.8", default-features = false, features = ["http"], optional = true }

crates/trusted-server-adapter-cloudflare/Cargo.toml

@@ -10,6 +10,8 @@ use edgezero_core::router::RouterService;
 use error_stack::Report;
 use trusted_server_core::auction::endpoints::handle_auction;
 use trusted_server_core::auction::{AuctionOrchestrator, build_orchestrator};
+#[cfg(target_arch = "wasm32")]
+use trusted_server_core::config_payload::settings_from_config_blob;
 use trusted_server_core::ec::EcContext;
 use trusted_server_core::error::{IntoHttpResponse as _, TrustedServerError};
 use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
@@ -34,6 +36,14 @@ use crate::platform::build_runtime_services;
 // AppState
 // ---------------------------------------------------------------------------
 
+#[cfg(target_arch = "wasm32")]
+static CLOUDFLARE_CONFIG_JSON: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+
+#[cfg(target_arch = "wasm32")]
+pub fn set_cloudflare_config_json(value: String) {
+    let _ = CLOUDFLARE_CONFIG_JSON.set(value);
+}
+
 /// Application state built once at startup and shared across all requests.
 pub struct AppState {
     settings: Arc<Settings>,
@@ -48,10 +58,37 @@ pub struct AppState {
 /// Returns an error when settings, the auction orchestrator, or the integration
 /// registry fail to initialise.
 fn build_state() -> Result<Arc<AppState>, Report<TrustedServerError>> {
+    #[cfg(target_arch = "wasm32")]
+    if let Some(settings) = settings_from_cloudflare_config_json()? {
+        return build_state_with_settings(settings);
+    }
+
     let settings = Settings::from_toml(include_str!("../../../trusted-server.example.toml"))?;
     build_state_with_settings(settings)
 }
 
+#[cfg(target_arch = "wasm32")]
+fn settings_from_cloudflare_config_json() -> Result<Option<Settings>, Report<TrustedServerError>> {
+    let Some(raw_config) = CLOUDFLARE_CONFIG_JSON.get() else {
+        return Ok(None);
+    };
+    let value: serde_json::Value = serde_json::from_str(raw_config).map_err(|error| {
+        Report::new(TrustedServerError::Configuration {
+            message: "invalid Cloudflare TRUSTED_SERVER_CONFIG JSON".to_string(),
+        })
+        .attach(format!("failed to parse TRUSTED_SERVER_CONFIG: {error}"))
+    })?;
+    let envelope = value
+        .get("app_config")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(|| {
+            Report::new(TrustedServerError::Configuration {
+                message: "Cloudflare TRUSTED_SERVER_CONFIG missing app_config".to_string(),
+            })
+        })?;
+    settings_from_config_blob(envelope).map(Some)
+}
+
 /// Build the application state from explicit settings.
 ///
 /// # Errors

crates/trusted-server-adapter-cloudflare/src/app.rs

@@ -18,6 +18,10 @@ use worker::{Context, Env, Request, Response, Result, event};
 #[cfg(target_arch = "wasm32")]
 #[event(fetch)]
 pub async fn main(req: Request, env: Env, ctx: Context) -> Result<Response> {
+    if let Ok(config) = env.var("TRUSTED_SERVER_CONFIG") {
+        app::set_cloudflare_config_json(config.to_string());
+    }
+
     match edgezero_adapter_cloudflare::run_app::<app::TrustedServerApp>(req, env, ctx).await {
         Ok(resp) => Ok(resp),
         Err(e) => {

crates/trusted-server-adapter-cloudflare/src/lib.rs

@@ -171,6 +171,7 @@ fn inject_generated_config_stores(
 
 fn generated_config_store_blocks(envelope_json: &str, edgezero_enabled: bool) -> String {
     let edgezero_enabled_value = if edgezero_enabled { "true" } else { "false" };
+    let edgezero_rollout_pct = if edgezero_enabled { "100" } else { "0" };
     format!(
         r#"        # Generated by generate-viceroy-config. Do not edit generated output.
         [local_server.config_stores.app_config]
@@ -182,7 +183,8 @@ fn generated_config_store_blocks(envelope_json: &str, edgezero_enabled: bool) ->
         [local_server.config_stores.trusted_server_config]
             format = "inline-toml"
         [local_server.config_stores.trusted_server_config.contents]
-            edgezero_enabled = "{edgezero_enabled_value}""#
+            edgezero_enabled = "{edgezero_enabled_value}"
+            edgezero_rollout_pct = "{edgezero_rollout_pct}""#
     )
 }
 
@@ -241,6 +243,10 @@ mod tests {
             generated.contains("edgezero_enabled = \"true\""),
             "should include enabled rollout flag"
         );
+        assert!(
+            generated.contains("edgezero_rollout_pct = \"100\""),
+            "should include full rollout for enabled EdgeZero config"
+        );
         assert!(
             generated.contains("[local_server.config_stores.jwks_store]"),
             "should preserve following template content"
@@ -257,6 +263,10 @@ mod tests {
             generated.contains("edgezero_enabled = \"false\""),
             "should include disabled rollout flag"
         );
+        assert!(
+            generated.contains("edgezero_rollout_pct = \"0\""),
+            "should include zero rollout for legacy config"
+        );
     }
 
     #[test]

crates/trusted-server-integration-tests/Cargo.lock

@@ -0,0 +1,40 @@
+use error_stack::Report;
+use edgezero_core::blob_envelope::BlobEnvelope;
+use trusted_server_core::config::validate_settings_for_deploy;
+use trusted_server_core::settings::Settings;
+
+use crate::common::runtime::{TestError, TestResult};
+
+const GENERATED_AT: &str = "2026-06-23T00:00:00Z";
+const APP_CONFIG: &str = include_str!("../../fixtures/configs/trusted-server.integration.toml");
+
+pub fn integration_app_config_envelope(origin_port: u16) -> TestResult<String> {
+    let origin_url = format!("http://127.0.0.1:{origin_port}");
+    let mut settings = Settings::from_toml(APP_CONFIG).map_err(|report| {
+        Report::new(TestError::ConfigGeneration)
+            .attach(format!("invalid Trusted Server integration config: {report:?}"))
+    })?;
+    settings.publisher.origin_url = origin_url;
+    validate_settings_for_deploy(&settings).map_err(|report| {
+        Report::new(TestError::ConfigGeneration)
+            .attach(format!("invalid generated integration config: {report:?}"))
+    })?;
+
+    let data = serde_json::to_value(&settings).map_err(|error| {
+        Report::new(TestError::ConfigGeneration)
+            .attach(format!("failed to serialize integration settings: {error}"))
+    })?;
+    let envelope = BlobEnvelope::new(data, GENERATED_AT.to_string());
+    serde_json::to_string(&envelope).map_err(|error| {
+        Report::new(TestError::ConfigGeneration)
+            .attach(format!("failed to serialize integration app-config envelope: {error}"))
+    })
+}
+
+pub fn cloudflare_config_json(origin_port: u16) -> TestResult<String> {
+    let envelope = integration_app_config_envelope(origin_port)?;
+    serde_json::to_string(&serde_json::json!({ "app_config": envelope })).map_err(|error| {
+        Report::new(TestError::ConfigGeneration)
+            .attach(format!("failed to serialize Cloudflare config binding: {error}"))
+    })
+}

crates/trusted-server-integration-tests/src/bin/generate-viceroy-config.rs

@@ -1,3 +1,4 @@
 pub mod assertions;
+pub mod config;
 pub mod ec;
 pub mod runtime;

crates/trusted-server-integration-tests/tests/common/config.rs

@@ -52,7 +52,10 @@ pub enum TestError {
     #[display("JSON field assertion failed: {field}")]
     JsonFieldMismatch { field: String },
 
-    // Resource errors
+    // Resource/config errors
+    #[display("Failed to generate runtime configuration")]
+    ConfigGeneration,
+
     #[display("No available port found")]
     NoPortAvailable,
 }

crates/trusted-server-integration-tests/tests/common/mod.rs

@@ -1,5 +1,6 @@
+use crate::common::config::integration_app_config_envelope;
 use crate::common::runtime::{
-    RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError, TestResult,
+    RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError, TestResult, origin_port,
 };
 use error_stack::ResultExt as _;
 use std::io::{BufRead as _, BufReader};
@@ -31,8 +32,11 @@ impl RuntimeEnvironment for AxumDevServer {
         let binary = self.binary_path();
         let port = super::find_available_port().unwrap_or(AXUM_DEFAULT_PORT);
 
+        let app_config = integration_app_config_envelope(origin_port())?;
+
         let mut child = Command::new(&binary)
             .env("PORT", port.to_string())
+            .env("TRUSTED_SERVER_CONFIG_APP_CONFIG_APP_CONFIG", app_config)
             .stdout(Stdio::null())
             .stderr(Stdio::piped())
             .spawn()