Skip to content

Add pluggable native Geo providers and protected CloudFront ingress #439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ChristianPavilonis wants to merge 5 commits into
base: feat/native-celld-stores
Choose a base branch
from
Draft

Add pluggable native Geo providers and protected CloudFront ingress #439

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d5ec14e
feat(core): add portable Geo provider contracts
ChristianPavilonis Oct 22, 2026
5da2000
feat(axum): resolve pluggable Geo through checked native ingress
ChristianPavilonis Oct 22, 2026
56eab85
test(core): separate legacy Geo dispatch regression
ChristianPavilonis Oct 22, 2026
3c784b7
docs: record complete Geo implementation and verification
ChristianPavilonis Oct 22, 2026
e50149c
test(axum): simplify JSON privacy upload helper
ChristianPavilonis Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 34 additions & 2 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ on:
push:
branches: [main]
pull_request:
# Native-store PRs are currently stacked on the outbound HTTP specification.
branches: [main, docs/outbound-http-spec]
# Keep checks active for native-store and Geo stacked PRs.
branches: [main, docs/outbound-http-spec, feat/native-celld-stores]

permissions:
contents: read
Expand Down Expand Up @@ -118,6 +118,38 @@ jobs:
- name: Native store dependency isolation
run: bash scripts/check_native_store_dependency_contract.sh

- name: Geo dependency isolation
run: bash scripts/check_geo_dependency_contract.sh

- name: Immutable core Geo outcome
run: scripts/run_test_nonzero.sh geo_owned_outcome_survives_public_request_mutation cargo test --offline --locked -p edgezero-core --lib geo_

- name: Native Geo disabled implementation and policy unit contracts
run: |
scripts/run_test_nonzero.sh geo_protected_policy_reuses_network_bounds cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum --lib geo::
scripts/run_test_nonzero.sh geo_unavailable_selection_fails_before_runner_resources cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum --lib geo_

- name: Native Geo supplied-provider unit contract without built-in
run: scripts/run_test_nonzero.sh source_admission_precedes_header_inspection_and_provider_calls cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum --lib source_admission_precedes_header_inspection_and_provider_calls

- name: Native Geo enabled implementation and managed dispatch unit contracts
run: |
scripts/run_test_nonzero.sh geo_cloudfront_parsing_matches_spec cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features geo-cloudfront --lib geo::
scripts/run_test_nonzero.sh geo_managed_resolution_runs_once_from_owned_ingress cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features geo-cloudfront --lib geo_
cargo test --offline --locked -p edgezero-adapter-axum --features geo-cloudfront --lib service::tests

- name: Native Geo disabled built-in hosting (loopback only)
run: scripts/run_test_nonzero.sh geo_hosting_rejects_unavailable_cloudfront cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum,test-utils --test production_hosting geo_hosting_rejects_unavailable_cloudfront

- name: Native Geo supplied provider without built-in (loopback only)
run: scripts/run_test_nonzero.sh geo_hosting_supplied_provider_without_builtin cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum,test-utils --test production_hosting geo_hosting_supplied_provider_without_builtin

- name: Native Geo real-peer hosting (loopback only)
run: scripts/run_test_nonzero.sh geo_hosting_proves_real_peer_and_shared_outcome cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features geo-cloudfront,test-utils --test production_hosting geo_hosting_proves_real_peer_and_shared_outcome

- name: Native Geo public examples
run: cargo test --offline --locked -p edgezero-adapter-axum --features geo-cloudfront --doc

- name: Native AWS provider and startup contracts (loopback only)
run: |
cargo test --offline --locked -p edgezero-store-aws --no-default-features --features appconfig-agent --lib
Expand Down
4 changes: 4 additions & 0 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,12 +70,14 @@ fern = "0.7"
flate2 = { version = "=1.1.9", default-features = false, features = ["rust_backend"] }
futures = { version = "0.3", features = ["std", "executor"] }
futures-util = { version = "0.3", features = ["alloc", "io"] }
getrandom = "0.4.2"
handlebars = "6"
http = "=1.4.2"
http-body = "1"
http-body-util = "0.1"
hyper = { version = "=1.12.0", features = ["http1", "server"] }
hyper-util = { version = "0.1", features = ["tokio"] }
ipnet = "2.12.0"
log = "0.4"
libc = "0.2"
miniz_oxide = { version = "=0.8.9", default-features = false, features = ["simd", "with-alloc"] }
Expand All @@ -91,6 +93,7 @@ simd-adler32 = { version = "=0.3.9", default-features = false }
# file (`<spin.toml dir>/.spin/sqlite_key_value.db`) using the schema
# vendored from spinframework/spin's `crates/key-value-spin/src/store.rs`.
rusqlite = { version = "0.32", default-features = false, features = ["bundled"] }
rustls = { version = "=0.23.40", default-features = false, features = ["std", "tls12", "aws_lc_rs"] }
ryu = "1"
serde = { version = "1", features = ["derive"] }
serde_json = "=1.0.150"
Expand Down
7 changes: 7 additions & 0 deletions crates/edgezero-adapter-axum/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ axum = [
"dep:tokio",
"dep:tower",
"dep:futures-util",
"dep:getrandom",
"dep:ipnet",
"dep:http-body",
"dep:hyper",
"dep:hyper-util",
Expand All @@ -32,6 +34,7 @@ aws-stores = ["aws-appconfig-agent", "aws-secrets-manager"]
aws-dynamodb = ["axum", "edgezero-store-aws/dynamodb-kv"]
celld-config = ["axum", "edgezero-store-celld/config"]
celld-kv = ["axum", "edgezero-store-celld/kv"]
geo-cloudfront = ["axum"]
cli = [
"native-bindings",
"dep:edgezero-adapter",
Expand All @@ -54,6 +57,8 @@ bytes = { workspace = true }
ctor = { workspace = true, optional = true }
futures = { workspace = true }
futures-util = { workspace = true, optional = true }
getrandom = { workspace = true, optional = true }
ipnet = { workspace = true, optional = true }
http = { workspace = true }
http-body = { workspace = true, optional = true }
hyper = { workspace = true, optional = true }
Expand Down Expand Up @@ -115,6 +120,8 @@ flate2 = { workspace = true }
http-body = { workspace = true }
hyper = { workspace = true }
hyper-util = { workspace = true }
rustls = { workspace = true }
serde = { workspace = true }
tempfile = { workspace = true }
tokio = { workspace = true, features = ["io-util", "macros", "net", "rt", "rt-multi-thread", "test-util"] }
tokio-rustls = { workspace = true }
Loading
Loading