Address cache policy review feedback

Author: ChristianPavilonis

crates/trusted-server-adapter-cloudflare/wrangler.ci.toml

@@ -4,6 +4,9 @@ compatibility_date = "2024-09-23"
 compatibility_flags = ["nodejs_compat"]
 # No [build] section — bundle is pre-built in CI; wrangler dev must not rebuild.
 
+[cache]
+enabled = true
+
 [[kv_namespaces]]
 binding = "TRUSTED_SERVER_KV"
 id = "ci-local-kv"

crates/trusted-server-adapter-cloudflare/wrangler.toml

@@ -6,6 +6,9 @@ main = "build/index.js"
 compatibility_date = "2024-09-23"
 compatibility_flags = ["nodejs_compat"]
 
+[cache]
+enabled = true
+
 [build]
 command = "bash build.sh"
 

crates/trusted-server-adapter-fastly/src/app.rs

@@ -95,7 +95,7 @@ use edgezero_core::router::RouterService;
 use error_stack::Report;
 use trusted_server_core::auction::AuctionTelemetrySink;
 use trusted_server_core::auction::endpoints::handle_auction;
-use trusted_server_core::auction::{build_orchestrator, AuctionOrchestrator};
+use trusted_server_core::auction::{AuctionOrchestrator, build_orchestrator};
 use trusted_server_core::cache_policy::EdgeCacheHeader;
 use trusted_server_core::constants::{COOKIE_SHAREDID, COOKIE_TS_EIDS};
 use trusted_server_core::ec::EcContext;

crates/trusted-server-adapter-fastly/src/main.rs

@@ -334,10 +334,11 @@ fn send_edgezero_response(
         effects.apply_to_response(&mut response);
     }
 
-    // Final cache guard: EC finalization and request-filter effects may have
-    // added a per-user Set-Cookie after `apply_finalize_headers` ran, so
-    // re-apply the privacy downgrade before send.
+    // Final cache guards: EC finalization and request-filter effects may have
+    // added a per-user Set-Cookie or a private/no-store directive after
+    // `apply_finalize_headers` and normalized asset policy reapplication ran.
     crate::middleware::enforce_set_cookie_cache_privacy(&mut response);
+    crate::middleware::enforce_uncacheable_cache_privacy(&mut response);
 
     let (parts, body) = response.into_parts();
 

crates/trusted-server-adapter-fastly/src/middleware.rs

@@ -235,7 +235,9 @@ pub(crate) fn apply_finalize_headers(
 /// entry point (`main.rs`) can re-apply it after
 /// [`ec_finalize_response`](trusted_server_core::ec::finalize::ec_finalize_response)
 /// writes the EC identity `Set-Cookie`, using the single shared implementation.
-pub(crate) use trusted_server_core::response_privacy::enforce_set_cookie_cache_privacy;
+pub(crate) use trusted_server_core::response_privacy::{
+    enforce_set_cookie_cache_privacy, enforce_uncacheable_cache_privacy,
+};
 
 // ---------------------------------------------------------------------------
 // Tests
@@ -496,6 +498,29 @@ mod tests {
         );
     }
 
+    #[test]
+    fn enforce_uncacheable_cache_privacy_handles_late_filter_headers() {
+        let mut response = response_with_headers(&[
+            ("cache-control", "private, max-age=0"),
+            ("surrogate-control", "max-age=600"),
+        ]);
+
+        enforce_uncacheable_cache_privacy(&mut response);
+
+        assert_eq!(
+            response
+                .headers()
+                .get("cache-control")
+                .and_then(|value| value.to_str().ok()),
+            Some("private, max-age=0"),
+            "should preserve the late private directive"
+        );
+        assert!(
+            response.headers().get("surrogate-control").is_none(),
+            "should strip the normalized edge header after late filter effects"
+        );
+    }
+
     // ---------------------------------------------------------------------------
     // FinalizeResponseMiddleware::handle tests
     // ---------------------------------------------------------------------------

crates/trusted-server-core/src/proxy.rs

@@ -12,7 +12,9 @@ use std::time::Duration;
 use web_time::{SystemTime, UNIX_EPOCH};
 
 use crate::cache_policy::{
-    apply_no_store_private_to_headers, CachePolicy, EdgeCacheHeader, NO_STORE_PRIVATE_CACHE_CONTROL,
+    CachePolicy, EdgeCacheHeader, NO_STORE_PRIVATE_CACHE_CONTROL,
+    apply_no_store_private_to_headers, cache_control_headers_are_private_or_no_store,
+    remove_edge_cache_headers,
 };
 use crate::constants::{
     HEADER_ACCEPT, HEADER_ACCEPT_ENCODING, HEADER_ACCEPT_LANGUAGE, HEADER_REFERER,
@@ -125,7 +127,11 @@ impl AssetProxyCachePolicy {
             Self::OriginControlled => {}
             Self::NoStorePrivate => apply_no_store_cache_control(response),
             Self::Normalized(policy) => {
-                policy.apply_to_headers(response.headers_mut(), edge_header)
+                if cache_control_headers_are_private_or_no_store(response.headers()) {
+                    remove_edge_cache_headers(response.headers_mut());
+                } else {
+                    policy.apply_to_headers(response.headers_mut(), edge_header);
+                }
             }
         }
     }
@@ -3751,7 +3757,7 @@ mod tests {
     }
 
     #[test]
-    fn handle_asset_proxy_request_applies_configured_normalized_cache_policy() {
+    fn handle_asset_proxy_request_replaces_third_party_cache_policy_for_rehosted_asset() {
         futures::executor::block_on(async {
             let stub = Arc::new(StubHttpClient::new());
             stub.push_response_with_headers(
@@ -3801,7 +3807,7 @@ mod tests {
             assert_eq!(
                 response_header(&response, header::CACHE_CONTROL),
                 Some("public, max-age=31536000, immutable"),
-                "core response should apply browser cache policy immediately"
+                "configured rehost policy should replace the third-party no-store directive"
             );
             assert!(
                 response.headers().get("surrogate-control").is_none(),
@@ -3823,6 +3829,43 @@ mod tests {
         });
     }
 
+    #[test]
+    fn normalized_asset_policy_preserves_final_private_or_no_store_directives() {
+        for cache_control in ["private, max-age=0", "no-store"] {
+            let mut response = edge_response_builder()
+                .header(header::CACHE_CONTROL, cache_control)
+                .header("surrogate-control", "max-age=31536000")
+                .header("cdn-cache-control", "max-age=31536000")
+                .header("cloudflare-cdn-cache-control", "max-age=31536000")
+                .body(EdgeBody::empty())
+                .expect("should build asset response");
+
+            AssetProxyCachePolicy::Normalized(CachePolicy::public_immutable(Duration::from_secs(
+                31_536_000,
+            )))
+            .apply_after_route_finalization(&mut response, EdgeCacheHeader::SurrogateControl);
+
+            assert_eq!(
+                response
+                    .headers()
+                    .get(header::CACHE_CONTROL)
+                    .and_then(|value| value.to_str().ok()),
+                Some(cache_control),
+                "final privacy directive should veto normalized cache policy"
+            );
+            assert!(
+                [
+                    "surrogate-control",
+                    "cdn-cache-control",
+                    "cloudflare-cdn-cache-control",
+                ]
+                .iter()
+                .all(|name| !response.headers().contains_key(*name)),
+                "final privacy directive should remove every edge-cache header"
+            );
+        }
+    }
+
     #[test]
     fn handle_asset_proxy_request_leaves_non_matching_assets_origin_controlled() {
         futures::executor::block_on(async {

crates/trusted-server-core/src/publisher.rs

@@ -41,7 +41,7 @@ use crate::auction::types::{
     AuctionContext, AuctionRequest, Bid, DeviceInfo, PublisherInfo, SiteInfo, UserInfo,
 };
 use crate::cache_policy::{
-    cache_control_headers_are_private_or_no_store, CachePolicy, EdgeCacheHeader,
+    CachePolicy, EdgeCacheHeader, cache_control_headers_are_private_or_no_store,
 };
 use crate::consent::{consent_allows_server_side_auction, gate_eids_by_consent};
 use crate::constants::{COOKIE_TS_EIDS, HEADER_X_COMPRESS_HINT};

crates/trusted-server-core/src/response_privacy.rs

@@ -17,13 +17,21 @@ use crate::cache_policy::{
 };
 use crate::settings::Settings;
 
-/// Runtime edge-cache headers stripped from private or cookie-bearing responses.
-pub use crate::cache_policy::EDGE_CACHE_HEADER_NAMES as SURROGATE_CACHE_HEADERS;
-
 fn cache_control_is_private_or_no_store(response: &Response) -> bool {
     cache_control_headers_are_private_or_no_store(response.headers())
 }
 
+/// Removes runtime edge-cache headers from a response finalized as uncacheable.
+///
+/// Call this after any late response-header mutations so a final `private` or
+/// `no-store` directive cannot coexist with an independently authoritative edge
+/// cache header.
+pub fn enforce_uncacheable_cache_privacy(response: &mut Response) {
+    if cache_control_is_private_or_no_store(response) {
+        remove_edge_cache_headers(response.headers_mut());
+    }
+}
+
 /// Forces cookie-bearing responses to stay private to shared caches.
 ///
 /// Any response that sets a per-user cookie (notably the EC identity cookie)
@@ -71,9 +79,7 @@ pub fn apply_response_headers_with_cache_privacy(settings: &Settings, response:
     enforce_set_cookie_cache_privacy(response);
 
     let response_is_uncacheable = cache_control_is_private_or_no_store(response);
-    if response_is_uncacheable {
-        remove_edge_cache_headers(response.headers_mut());
-    }
+    enforce_uncacheable_cache_privacy(response);
 
     for (key, value) in &settings.response_headers {
         if response_is_uncacheable
@@ -99,9 +105,7 @@ pub fn apply_response_headers_with_cache_privacy(settings: &Settings, response:
         response.headers_mut().insert(header_name, header_value);
     }
 
-    if cache_control_is_private_or_no_store(response) {
-        remove_edge_cache_headers(response.headers_mut());
-    }
+    enforce_uncacheable_cache_privacy(response);
 
     // Operator headers can themselves introduce Set-Cookie (alongside public
     // edge-cache headers) onto a previously cookieless response, which the
@@ -116,6 +120,8 @@ mod tests {
 
     use edgezero_core::http::response_builder;
 
+    use crate::cache_policy::EDGE_CACHE_HEADER_NAMES;
+
     fn settings_with_response_headers(headers: &[(&str, &str)]) -> Settings {
         let mut s = Settings::from_toml(
             r#"
@@ -267,6 +273,34 @@ mod tests {
         );
     }
 
+    #[test]
+    fn final_uncacheable_guard_strips_edge_headers_without_a_cookie() {
+        let mut response = response_builder()
+            .header(header::CACHE_CONTROL, "no-store")
+            .header("surrogate-control", "max-age=600")
+            .header("cdn-cache-control", "max-age=600")
+            .header("cloudflare-cdn-cache-control", "max-age=600")
+            .body(edgezero_core::body::Body::empty())
+            .expect("should build response");
+
+        enforce_uncacheable_cache_privacy(&mut response);
+
+        assert_eq!(
+            response
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|value| value.to_str().ok()),
+            Some("no-store"),
+            "final guard should preserve the uncacheable directive"
+        );
+        assert!(
+            EDGE_CACHE_HEADER_NAMES
+                .iter()
+                .all(|name| !response.headers().contains_key(*name)),
+            "final guard should remove every edge-cache header"
+        );
+    }
+
     #[test]
     fn applies_operator_headers_on_cookieless_response() {
         let settings = settings_with_response_headers(&[("x-operator", "value")]);