feat(worker): reject non-canonical-case `/api`, `/auth`, `/live` paths and run the Worker first at the Access phase

Ouverte
  • Quelque chose ne va pas ?
#50 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
48/100
Type d'issue
Fonctionnalité
Clarté
Clairement spécifiée
Activité
Active
Stack technique
react, rust
Domaine
backend, infrastructure, testing

Piste de recherche

Start with crates/thrust-worker/wrangler.toml and the Worker router; read ADR-0011 and ADR-0050 for the asset and Access behavior. Add router-level tests for the listed case variants, valid routes, and asset fallback, then verify the Access-phase config and hashed asset serving under wrangler dev. Done includes answering Q-0050.7 and, after deployment, rerunning the real-edge probes.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

area:infra prio:p1 review:fable-2026-10-19 type:security

Context

crates/thrust-worker/wrangler.toml has no [assets] block yet; static assets arrive with the React build (#44). ADR-0011 (round 26) sets two rules for them. assets.run_worker_first lists both forms of every path the Worker handles (/api, /api/*, /auth, /auth/*, /live, /live/*), and the SPA fallback is not_found_handling = "single-page-application" (adrs/ui/0011-static-asset-hosting.md:76). At the Access phase, Access gates the UI paths and bypasses /api, /auth and /live, which the application authenticates itself (ADR-0090 round 25, adrs/infra/0090-cloudflare-topology.md:88).

Problem

Spike 0004 run 2 (real platform, Access on) found that Access matches bypass paths case-insensitively, while run_worker_first patterns are case-sensitive.

  • So /Api/, /API/ping, /AUTH/callback and /LIVE/echo skipped Access, missed the Worker, and got the 1,712-byte gated root shell with a 200 and no credentials (research/0006 §13.3 line 591, §13.4 line 604; ADR-0050 :117; ADR-0011 :80; ADR-0141 :78 item 1).
  • Access matches whole path segments: the lookalikes /apix, /api-v2 and /apiary/x stayed gated (§13.3, line 574).
  • Case variants of the gated targets stay gated, and the edge normalises dot-segments before Access matches (§13.4, line 597).
  • Q-0050.7 is open (QUESTIONS.md:304). It matters from the Access phase (P1), not at P0.

Proposal

  • Worker first. At the Access phase set run_worker_first = ["/*", "!/assets/*"]; negative patterns win, and a config takes at most 100 patterns (research/0006 §3.6, line 191). The Worker then serves non-API navigations through the ASSETS binding.
  • Reject case variants. Before routing, and before any asset fetch, percent-decode the first path segment. If its lower-case form is api, auth or live but the exact form is not, answer 404 with a body that is not the shell. Compare the first segment, not a string prefix, matching Access's segment rule above, so /apiary/... and slugs such as /Api-team/... still reach the SPA.
  • Cost. Navigations become Worker invocations. At about 5 M requests a month, that stays inside the included 10 M (research/0004 §9; FR-13).
  • Alternative, if the owner prefers no path-scoped bypass: the API on its own hostname, at the price of cross-origin cookies.
  • Answer Q-0050.7 in ADR-0050 and ADR-0011.

Acceptance criteria

  • Router-level tests (axum, per the rust-test-app skill):
    • /Api/x, /API, /aPi/, /AUTH/callback, /Live/x and /%41pi/x answer 404 with a body that is not the shell;
    • /api/..., /auth/... and /live reach their handlers;
    • /apiary/x and /Api-team/x reach the asset fallback.
  • Control: with the check disabled, the case-variant tests fail because the requests reach the asset fallback.
  • The Access-phase environment's wrangler config carries run_worker_first = ["/*", "!/assets/*"], and under wrangler dev a hashed /assets/* file is still served as the file.
  • Re-running spike 0004's case-variant probes on the real edge with Access on returns 404 for every BF3 path. Control: with the check disabled, the run reproduces the 200 shell. The probe scripts are off-repo (spikes/README.md:54; #55).
  • Q-0050.7 is answered, citing FR-13.

References

  • Review: .agents/plans/contrail/reviews/2026-10-19-fable-architecture-review.md (FR-13)
  • research/0006-topology-public-half.md §3.6 (line 191), §13.3 (lines 574, 591), §13.4 (lines 593-609)
  • ADR-0011 (:76, :80), ADR-0050 (:117), ADR-0090 (:88), ADR-0141 (:78)
  • Q-0050.7, Q-0050.2; research/0004-rust-on-workers-binding-matrix.md §9 (traffic and cost)
  • crates/thrust-worker/wrangler.toml (no [assets] block today)

Finding: FR-13

Langage dominant
Rust
Étoiles
0
Forks
0
Merge moyen
1 h 35 min
PR mergées (30 j)
67

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de aRustyDev/thrust

Toutes les issues de aRustyDev/thrust

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.