Axum: add safe production diagnostics and trusted-proxy handling #397

Description

Main native service can render internal error strings (crates/edgezero-adapter-axum/src/service.rs:194) and lacks a checked incoming-proxy production policy. PR #275 owns safe public error/response completion; PR #409 adds checked proxy metadata and native diagnostics on the #406/#407 stack. This is runtime integration with existing observability work.

Steps to reproduce

Inject fictional sentinel secrets into conversion/router/upstream errors and inspect public responses and ordinary logs. Send Forwarded/X-Forwarded-* from trusted and untrusted peers, including malformed chains; exercise post-header stream failures, rejections and draining.

Expected behavior

Only checked production metadata affects host/scheme/client facts. Correlated, privacy-safe request/terminal/lifecycle records use established completion boundaries; custom app logging ownership is respected.

Impact

Unchecked forwarding input can spoof metadata, while raw internal failures can leak application/provider details. New logging must not expose bodies, secrets or sensitive query values.

Proposed fix

Review/integrate #409 on accepted #275 error/completion contracts, coordinating #392/#393 state. Reuse one bounded forwarding parser/default-no-trust boundary and exactly-once observer path. Keep metrics/tracing vendor work and application authorization separate. Optional #389 timing must fit the established monotonic origin and lifecycle rather than add competing finalization.

Done when

• Re-audit the accepted PR feat: implement portable outbound HTTP and request lifecycle contracts #275 implementation and record which checks are already covered. Add only residual changes and missing production acceptance evidence.
• A sentinel secret in conversion, router, or upstream errors never appears in the client response or ordinary request logs; internal diagnostics retain only explicitly permitted detail.
• Request completion and failure records correlate status, duration, and request identity, including stream failures after headers are sent.
• Custom logging ownership does not install a competing logger/subscriber.
• Spoofed Forwarded/X-Forwarded-* headers from untrusted peers cannot change effective production metadata; accepted trusted-proxy cases still work.
• Tests cover trusted proxy matching, header precedence, malformed forwarding values, and direct-peer fallback.
• Operators have a documented way to observe active work, rejections, and shutdown, using the existing observability contracts.
• No secret values or body payloads become metric labels or diagnostic fields.

Related

• Parent Make the Axum adapter production-ready for self-hosted deployments #391. Implementation PR feat(axum): add safe diagnostics and trusted proxy metadata #409; stack Add configurable Axum buffered JSON body limits #407 → Add Axum production startup and bounded shutdown #406 → feat: implement portable outbound HTTP and request lifecycle contracts #275 / Implement portable outbound HTTP and request lifecycle contracts #436.
• Axum ClientInfo #92 client metadata, Complete portable request observability #118–Support distributed trace propagation #122 observability; Add a shared request-timing collector and opt-in attachment middleware #446 / PR feat(core): add shared request timing collector and middleware #389 optional timing.
• Axum: scaffold hardened production application Dockerfiles #398–Axum: document Docker, Kubernetes, and managed-cloud deployments #400 consume the verified diagnostics/proxy-trust contract.