August release candidate (DO NOT MERGE)

.github/workflows/test.yml

@@ -230,9 +230,14 @@ jobs:
         run: |
           cargo clippy --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --all-targets -- -D warnings
 
+      - name: Set up Chrome for browser fixture tests
+        id: setup-chrome
+        uses: browser-actions/setup-chrome@v1
+
       - name: cargo test
-        run: |
-          cargo test --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')"
+        run: ./scripts/test-cli.sh
+        env:
+          CHROME: ${{ steps.setup-chrome.outputs.chrome-path }}
 
   test-typescript:
     name: vitest

.gitignore

@@ -52,6 +52,7 @@ src/*.html
 
 /guest-profiles
 /benchmark-results/**
+/.worktrees/
 
 # Playwright browser tests
 /crates/trusted-server-integration-tests/browser/node_modules/

CHANGELOG.md

@@ -10,8 +10,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - **Breaking** — Admin Basic-auth coverage now includes `GET /_ts/admin/ec`, `GET /_ts/admin/ec/{id}`, and `GET /_ts/admin/eids`. Existing configurations whose `[[handlers]]` patterns protect only the key-management endpoints now fail startup; broaden coverage before deploying, preferably with a namespace-boundary pattern such as `^/_ts/admin(?:/|$)`. Coverage of the dynamic `/_ts/admin/ec/{id}` route is no longer inferred from ID-shaped samples: the router accepts any segment after `/_ts/admin/ec/` and Basic Auth runs on the raw path before routing, so patterns anchored to the EC ID grammar (for example `^/_ts/admin/ec/[a-f0-9]{64}[.][A-Za-z0-9]{6}$`) are rejected in favor of a prefix-level matcher. Placeholder and well-known weak handler passwords (`changeme`, `password`, `admin`, `replace-with-…`) now fail startup on every handler rather than only on handlers inferred to cover an admin endpoint, because first-match-wins handler selection lets a narrow handler shadow the admin namespace.
+- Publisher HTML uses the browser-only `Cache-Control: private, max-age=60` policy for successful GET document responses and their `304 Not Modified` revalidations when server-side ad templates are structurally inactive, while preserving origin `private`/`no-store` policies and request-scoped bot, prefetch, or consent-denied responses. The `private` directive prevents shared caches that use `Cache-Control` from storing the document. Cookie-bearing responses using the generated inactive policy are finalized as `private, max-age=0`; CDN-specific cache headers remain unchanged and continue to control supporting CDNs independently. Set `[creative_opportunities].enabled = false` to disable publisher HTML and SPA template delivery without disabling direct `POST /auction` callers; an absent configuration, an unmatched slot, or a disabled auction also make the stack structurally inactive. An explicit `enabled = false` is not compatible with older binaries: restore the default, re-push and finalize the config before rolling back.
 - **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout. `aps` entries in Prebid bidder lists are logged and stripped. APS renderer winners now preserve the upstream bid `id`, omit `crid` when APS omits it, and carry `ext.trusted_server.renderer` instead of `adm`; external `/auction` consumers must support this response shape.
 - **Breaking** — All auction paths now forward only a validated publisher-owned page URL as `site.page`, removing query and fragment data. APS OpenRTB omits `site.ref`; the existing Prebid Server path continues to forward the browser `Referer` as `site.ref`. Query-driven sites may lose contextual targeting and per-page reporting signals that previously came from query parameters.
+- Publisher HTML now uses `Cache-Control: max-age=60` when server-side ad templates are inactive, while preserving origin `private`/`no-store` policies and CDN-specific cache headers. Set `[creative_opportunities].enabled = false` to disable publisher HTML and SPA template delivery without disabling direct `POST /auction` callers.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Integration configuration strings are no longer globally reinterpreted as JSON scalars. Operators upgrading should audit `[integrations.*]` settings and use native TOML/typed-config booleans and numbers (for example, `enabled = true`, not `enabled = "true"`); quoted numeric and boolean scalars now fail validation instead of silently converting.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.

Cargo.toml

@@ -54,12 +54,12 @@ criterion = { version = "0.5", default-features = false, features = ["cargo_benc
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.4", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.4", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.4", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.4", default-features = false }
-edgezero-cli = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.4" }
-edgezero-core = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.4", default-features = false }
+edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", rev = "5f3d648c3c6c38fc6e6b22b5c65c66177363aad8", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", rev = "5f3d648c3c6c38fc6e6b22b5c65c66177363aad8", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", rev = "5f3d648c3c6c38fc6e6b22b5c65c66177363aad8", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", rev = "5f3d648c3c6c38fc6e6b22b5c65c66177363aad8", default-features = false }
+edgezero-cli = { git = "https://github.com/stackpop/edgezero", rev = "5f3d648c3c6c38fc6e6b22b5c65c66177363aad8" }
+edgezero-core = { git = "https://github.com/stackpop/edgezero", rev = "5f3d648c3c6c38fc6e6b22b5c65c66177363aad8", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"
@@ -96,6 +96,7 @@ scraper = "0.24.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.149"
 sha2 = "0.10.9"
+similar = "2.7"
 simple_logger = "5"
 spin-sdk = { version = "~6.0", default-features = false, features = ["http", "key-value", "variables"] }
 subtle = "2.6"
@@ -108,6 +109,7 @@ tokio-rustls = "0.26"
 toml = "1.1"
 toml_edit = "0.23.10"
 tower = "0.4"
+tracing = "0.1"
 trusted-server-core = { path = "crates/trusted-server-core" }
 trusted-server-js = { path = "crates/trusted-server-js" }
 trusted-server-openrtb = { path = "crates/trusted-server-openrtb" }

README.md

@@ -41,7 +41,7 @@ ts config init
 ts config validate
 
 # Audit a public page with Chrome/Chromium to bootstrap a draft config
-ts audit https://publisher.example
+ts audit generate https://publisher.example
 
 # Run tests (Fastly/WASM crates — requires Viceroy)
 cargo test-fastly

crates/trusted-server-adapter-axum/src/middleware.rs

@@ -7,6 +7,7 @@ use edgezero_core::http::{HeaderValue, Response};
 use edgezero_core::middleware::{Middleware, Next};
 use trusted_server_core::auth::enforce_basic_auth;
 use trusted_server_core::constants::HEADER_X_GEO_INFO_AVAILABLE;
+use trusted_server_core::http_util::sanitize_trusted_client_ip_headers;
 use trusted_server_core::settings::Settings;
 
 // ---------------------------------------------------------------------------
@@ -35,7 +36,11 @@ impl FinalizeResponseMiddleware {
 
 #[async_trait(?Send)]
 impl Middleware for FinalizeResponseMiddleware {
-    async fn handle(&self, ctx: RequestContext, next: Next<'_>) -> Result<Response, EdgeError> {
+    async fn handle(&self, mut ctx: RequestContext, next: Next<'_>) -> Result<Response, EdgeError> {
+        sanitize_trusted_client_ip_headers(
+            ctx.request_mut(),
+            self.settings.trusted_client_ip.as_ref(),
+        );
         let mut response = next.run(ctx).await?;
         apply_finalize_headers(&self.settings, &mut response);
         Ok(response)
@@ -111,15 +116,35 @@ pub(crate) fn apply_finalize_headers(settings: &Settings, response: &mut Respons
 mod tests {
     use super::*;
 
+    use std::collections::HashMap;
+    use std::sync::Mutex;
+
     use edgezero_core::body::Body;
-    use edgezero_core::http::response_builder;
+    use edgezero_core::context::RequestContext;
+    use edgezero_core::http::{Method, request_builder, response_builder};
+    use edgezero_core::middleware::Next;
+    use edgezero_core::params::PathParams;
+    use futures::executor::block_on;
+    use trusted_server_core::redacted::Redacted;
+    use trusted_server_core::settings::TrustedClientIpConfig;
 
     fn empty_response() -> Response {
         response_builder()
             .body(Body::empty())
             .expect("should build empty test response")
     }
 
+    fn empty_ctx() -> RequestContext {
+        let req = request_builder()
+            .method(Method::GET)
+            .uri("/test")
+            .header("x-reader-ip", "198.51.100.7")
+            .header("x-reader-ip-auth", "fictional-shared-secret-0123456789")
+            .body(Body::empty())
+            .expect("should build test request");
+        RequestContext::new(req, PathParams::new(HashMap::new()))
+    }
+
     fn settings_with_response_headers(headers: Vec<(&str, &str)>) -> Settings {
         let mut s = Settings::from_toml(
             r#"
@@ -197,4 +222,36 @@ mod tests {
             "should apply operator-configured response headers"
         );
     }
+
+    #[test]
+    fn finalize_middleware_strips_configured_trust_headers_before_routing() {
+        let mut settings = settings_with_response_headers(vec![]);
+        settings.trusted_client_ip = Some(TrustedClientIpConfig {
+            ip_header: "x-reader-ip".to_owned(),
+            auth_header: "x-reader-ip-auth".to_owned(),
+            shared_secret: Redacted::new("fictional-shared-secret-0123456789".to_owned()),
+        });
+        let middleware = FinalizeResponseMiddleware::new(Arc::new(settings));
+        let observed = Arc::new(Mutex::new(None));
+        let handler_observed = Arc::clone(&observed);
+        let handler = Arc::new(move |ctx: RequestContext| {
+            let handler_observed = Arc::clone(&handler_observed);
+            async move {
+                *handler_observed.lock().expect("should lock observation") = Some((
+                    ctx.request().headers().contains_key("x-reader-ip"),
+                    ctx.request().headers().contains_key("x-reader-ip-auth"),
+                ));
+                Ok::<Response, EdgeError>(empty_response())
+            }
+        });
+
+        block_on(middleware.handle(empty_ctx(), Next::new(&[], &*handler)))
+            .expect("should run middleware");
+
+        assert_eq!(
+            *observed.lock().expect("should lock observation"),
+            Some((false, false)),
+            "should remove both configured trust headers before the handler"
+        );
+    }
 }