Add a pluggable Edge Cookie provider seam with the built-in HMAC provider

crates/edgecookie/README.md

@@ -0,0 +1,9 @@
+# Edge Cookie providers
+
+Vendor Edge Cookie provider crates live here, one per vendor, for example
+`crates/edgecookie/<vendor>`. Each implements the `EdgeCookieProvider` trait
+from `trusted-server-core` and is wired in by an adapter.
+
+The built-in default provider (HMAC over the client IP) ships in
+`trusted-server-core` (`ec::provider`), so no crate is needed for it. This
+directory is a placeholder until a vendor provider is added.

crates/trusted-server-adapter-axum/src/middleware.rs

@@ -135,6 +135,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )

crates/trusted-server-adapter-axum/tests/routes.rs

@@ -33,6 +33,9 @@ fn test_router() -> edgezero_core::router::RouterService {
             proxy_secret = "integration-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )

crates/trusted-server-adapter-cloudflare/src/middleware.rs

@@ -151,6 +151,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )

crates/trusted-server-adapter-cloudflare/tests/routes.rs

@@ -36,6 +36,9 @@ fn test_router() -> RouterService {
             proxy_secret = "route-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )
@@ -85,6 +88,9 @@ fn make_router() -> RouterService {
             proxy_secret = "integration-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )

crates/trusted-server-adapter-fastly/src/app.rs

@@ -1284,6 +1284,9 @@ mod tests {
                 allowed_domains = ["*.example", "*.example.com"]
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-passphrase-at-least-32-bytes!!"
 
                 [request_signing]
@@ -1353,6 +1356,9 @@ mod tests {
             allowed_domains = ["*.example", "*.example.com"]
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -1717,6 +1723,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )
@@ -2172,6 +2181,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]
@@ -2297,6 +2309,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]

crates/trusted-server-adapter-fastly/src/main.rs

@@ -501,6 +501,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]

crates/trusted-server-adapter-fastly/src/middleware.rs

@@ -297,6 +297,9 @@ mod tests {
             proxy_secret = "unit-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
 
             [request_signing]

crates/trusted-server-adapter-spin/src/middleware.rs

@@ -178,6 +178,9 @@ mod tests {
                 proxy_secret = "unit-test-proxy-secret"
 
                 [ec]
+                provider = "hmac"
+
+                [ec.providers.hmac]
                 passphrase = "test-secret-key-32-bytes-minimum"
             "#,
         )

crates/trusted-server-adapter-spin/tests/routes.rs

@@ -35,6 +35,9 @@ fn test_router() -> RouterService {
             proxy_secret = "route-test-proxy-secret"
 
             [ec]
+            provider = "hmac"
+
+            [ec.providers.hmac]
             passphrase = "test-secret-key-32-bytes-minimum"
         "#,
     )

crates/trusted-server-core/src/config.rs

@@ -338,6 +338,9 @@ origin_url = "https://origin.example.com"
 proxy_secret = "change-me-proxy-secret"
 
 [ec]
+provider = "hmac"
+
+[ec.providers.hmac]
 passphrase = "production-secret-key-32-bytes-min"
 
 [[handlers]]

crates/trusted-server-core/src/config_payload.rs

@@ -154,7 +154,9 @@ mod tests {
     fn strings_that_look_like_json_scalars_round_trip_as_strings() {
         let mut original = test_settings();
         original.publisher.proxy_secret = Redacted::new("1234567890".to_string());
-        original.ec.passphrase = Redacted::new("12345678901234567890123456789012".to_string());
+        original.ec.providers.hmac = Some(crate::settings::HmacProviderConfig {
+            passphrase: Redacted::new("12345678901234567890123456789012".to_string()),
+        });
         original.handlers[0].password = Redacted::new("true".to_string());
 
         let reconstructed = settings_from_config_blob(&envelope_json(&original))
@@ -166,8 +168,22 @@ mod tests {
             "numeric-looking proxy secret should remain a string"
         );
         assert_eq!(
-            reconstructed.ec.passphrase.expose(),
-            original.ec.passphrase.expose(),
+            reconstructed
+                .ec
+                .providers
+                .hmac
+                .as_ref()
+                .expect("should reconstruct the hmac provider")
+                .passphrase
+                .expose(),
+            original
+                .ec
+                .providers
+                .hmac
+                .as_ref()
+                .expect("should keep the hmac provider")
+                .passphrase
+                .expose(),
             "numeric-looking passphrase should remain a string"
         );
         assert_eq!(