Harden Cloudflare runtime config loading

Author: ChristianPavilonis

crates/trusted-server-adapter-cloudflare/src/app.rs

@@ -58,20 +58,28 @@ pub struct AppState {
 /// Returns an error when settings, the auction orchestrator, or the integration
 /// registry fail to initialise.
 fn build_state() -> Result<Arc<AppState>, Report<TrustedServerError>> {
-    #[cfg(target_arch = "wasm32")]
-    if let Some(settings) = settings_from_cloudflare_config_json()? {
-        return build_state_with_settings(settings);
-    }
-
-    let settings = Settings::from_toml(include_str!("../../../trusted-server.example.toml"))?;
+    let settings = load_startup_settings()?;
     build_state_with_settings(settings)
 }
 
 #[cfg(target_arch = "wasm32")]
-fn settings_from_cloudflare_config_json() -> Result<Option<Settings>, Report<TrustedServerError>> {
-    let Some(raw_config) = CLOUDFLARE_CONFIG_JSON.get() else {
-        return Ok(None);
-    };
+fn load_startup_settings() -> Result<Settings, Report<TrustedServerError>> {
+    settings_from_cloudflare_config_json()
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn load_startup_settings() -> Result<Settings, Report<TrustedServerError>> {
+    Settings::from_toml(include_str!("../../../trusted-server.example.toml"))
+}
+
+#[cfg(target_arch = "wasm32")]
+fn settings_from_cloudflare_config_json() -> Result<Settings, Report<TrustedServerError>> {
+    let raw_config = CLOUDFLARE_CONFIG_JSON.get().ok_or_else(|| {
+        Report::new(TrustedServerError::Configuration {
+            message: "Cloudflare TRUSTED_SERVER_CONFIG is required".to_string(),
+        })
+        .attach("set TRUSTED_SERVER_CONFIG to JSON containing the app_config blob envelope")
+    })?;
     let value: serde_json::Value = serde_json::from_str(raw_config).map_err(|error| {
         Report::new(TrustedServerError::Configuration {
             message: "invalid Cloudflare TRUSTED_SERVER_CONFIG JSON".to_string(),
@@ -86,7 +94,7 @@ fn settings_from_cloudflare_config_json() -> Result<Option<Settings>, Report<Tru
                 message: "Cloudflare TRUSTED_SERVER_CONFIG missing app_config".to_string(),
             })
         })?;
-    settings_from_config_blob(envelope).map(Some)
+    settings_from_config_blob(envelope)
 }
 
 /// Build the application state from explicit settings.

crates/trusted-server-adapter-cloudflare/wrangler.ci.toml

@@ -9,6 +9,6 @@ binding = "TRUSTED_SERVER_KV"
 id = "ci-local-kv"
 
 [vars]
-# Settings are baked into the WASM binary at build time; this JSON only needs
-# to satisfy any runtime config-store lookups (e.g. request-signing keys).
+# Placeholder replaced by the integration test harness with a JSON object that
+# contains the runtime Trusted Server app-config blob envelope.
 TRUSTED_SERVER_CONFIG = "{}"

crates/trusted-server-adapter-cloudflare/wrangler.toml

@@ -17,8 +17,7 @@ binding = "TRUSTED_SERVER_KV"
 id = "REPLACE_WITH_YOUR_KV_NAMESPACE_ID"
 
 [vars]
-# TRUSTED_SERVER_CONFIG is consumed by the edgezero layer as a JSON-encoded env
-# var binding. At runtime it is bridged to PlatformConfigStore via
-# ConfigStoreHandleAdapter — replace the placeholder values with your publisher
-# settings before deploying.
-TRUSTED_SERVER_CONFIG = '{"publisher.domain":"your-publisher.com"}'
+# TRUSTED_SERVER_CONFIG is required at startup. Replace this intentionally
+# invalid placeholder with JSON containing an `app_config` blob envelope before
+# deploying or running `wrangler dev` against real traffic.
+TRUSTED_SERVER_CONFIG = '{"app_config":""}'

crates/trusted-server-integration-tests/tests/environments/cloudflare.rs

@@ -2,7 +2,7 @@ use crate::common::config::cloudflare_config_json;
 use crate::common::runtime::{
     RuntimeEnvironment, RuntimeProcess, RuntimeProcessHandle, TestError, TestResult, origin_port,
 };
-use error_stack::ResultExt as _;
+use error_stack::{Report, ResultExt as _};
 use std::io::{BufRead as _, BufReader};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
@@ -25,6 +25,7 @@ pub struct CloudflareWorkers;
 const CLOUDFLARE_DEFAULT_PORT: u16 = 8787;
 const CI_CONFIG_TEMPLATE: &str = "wrangler.ci.toml";
 const GENERATED_CI_CONFIG: &str = "wrangler.integration.generated.toml";
+const TRUSTED_SERVER_CONFIG_PLACEHOLDER: &str = "TRUSTED_SERVER_CONFIG = \"{}\"";
 
 fn write_generated_ci_config(wrangler_dir: &Path) -> TestResult<String> {
     let template_path = wrangler_dir.join(CI_CONFIG_TEMPLATE);
@@ -35,10 +36,7 @@ fn write_generated_ci_config(wrangler_dir: &Path) -> TestResult<String> {
             template_path.display()
         ))?;
     let config_json = cloudflare_config_json(origin_port())?;
-    let generated = template.replace(
-        "TRUSTED_SERVER_CONFIG = \"{}\"",
-        &format!("TRUSTED_SERVER_CONFIG = '''{config_json}'''"),
-    );
+    let generated = inject_cloudflare_config(&template, &config_json)?;
     let output_path = wrangler_dir.join(GENERATED_CI_CONFIG);
     std::fs::write(&output_path, generated)
         .change_context(TestError::RuntimeSpawn)
@@ -49,6 +47,20 @@ fn write_generated_ci_config(wrangler_dir: &Path) -> TestResult<String> {
     Ok(GENERATED_CI_CONFIG.to_string())
 }
 
+fn inject_cloudflare_config(template: &str, config_json: &str) -> TestResult<String> {
+    let placeholder_count = template.matches(TRUSTED_SERVER_CONFIG_PLACEHOLDER).count();
+    if placeholder_count != 1 {
+        return Err(Report::new(TestError::RuntimeSpawn).attach(format!(
+            "Cloudflare CI wrangler config must contain exactly one `{TRUSTED_SERVER_CONFIG_PLACEHOLDER}` placeholder, found {placeholder_count}"
+        )));
+    }
+
+    Ok(template.replace(
+        TRUSTED_SERVER_CONFIG_PLACEHOLDER,
+        &format!("TRUSTED_SERVER_CONFIG = '''{config_json}'''"),
+    ))
+}
+
 impl RuntimeEnvironment for CloudflareWorkers {
     fn id(&self) -> &'static str {
         "cloudflare"
@@ -182,3 +194,43 @@ impl Drop for CloudflareHandle {
         let _ = self.child.wait();
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn inject_cloudflare_config_replaces_single_placeholder() {
+        let template = format!("[vars]\n{TRUSTED_SERVER_CONFIG_PLACEHOLDER}\n");
+
+        let generated = inject_cloudflare_config(&template, r#"{"app_config":"blob"}"#)
+            .expect("should inject Cloudflare config");
+
+        assert!(
+            generated.contains("TRUSTED_SERVER_CONFIG = '''{\"app_config\":\"blob\"}'''"),
+            "should inject generated config JSON"
+        );
+        assert!(
+            !generated.contains(TRUSTED_SERVER_CONFIG_PLACEHOLDER),
+            "should remove placeholder"
+        );
+    }
+
+    #[test]
+    fn inject_cloudflare_config_rejects_missing_placeholder() {
+        let result = inject_cloudflare_config("[vars]\n", r#"{"app_config":"blob"}"#);
+
+        assert!(result.is_err(), "should reject missing placeholder");
+    }
+
+    #[test]
+    fn inject_cloudflare_config_rejects_duplicate_placeholders() {
+        let template = format!(
+            "[vars]\n{TRUSTED_SERVER_CONFIG_PLACEHOLDER}\n{TRUSTED_SERVER_CONFIG_PLACEHOLDER}\n"
+        );
+
+        let result = inject_cloudflare_config(&template, r#"{"app_config":"blob"}"#);
+
+        assert!(result.is_err(), "should reject duplicate placeholders");
+    }
+}