Preserve outbound cache tags and borrowed readiness

.github/workflows/codeql.yml

@@ -15,7 +15,6 @@ on:
   push:
     branches: ["main"]
   pull_request:
-    branches: ["main"]
   schedule:
     - cron: "40 17 * * 3"
 

.github/workflows/format.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
 
 permissions:
   contents: read

.github/workflows/test.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
 
 permissions:
   contents: read

crates/edgezero-adapter-axum/tests/contract.rs

@@ -1105,26 +1105,33 @@ async fn authority_override_changes_host_only_and_cache_bypass_adds_no_origin_he
                 .get(CACHE_CONTROL)
                 .and_then(|value| value.to_str().ok())
                 .unwrap_or("absent");
-            format!("{host}|{cache_control}")
+            let tag = headers.get("surrogate-key").map_or("absent", |_| "present");
+            format!("{host}|{cache_control}|{tag}")
         }),
     ))
     .await;
     let client = HttpClient::with_client(AxumOutboundClient::try_new().expect("client"));
-    let request = OutboundRequest::get(format!("{origin}/"))
-        .expect("request")
-        .host_authority_override("virtual.example:8443")
-        .expect("authority override")
-        .cache_policy(OutboundCachePolicy::Bypass);
-
-    let body = client
-        .send(request)
-        .await
-        .expect("response")
-        .into_bytes_bounded(1_024)
-        .await
-        .expect("response body");
-
-    assert_eq!(body, "virtual.example:8443|absent");
+    for policy in [
+        OutboundCachePolicy::Bypass,
+        OutboundCachePolicy::PlatformDefault,
+        OutboundCachePolicy::PlatformDefaultWithSurrogateKey(HeaderValue::from_static(
+            "example-all example-reader-0123",
+        )),
+    ] {
+        let request = OutboundRequest::get(format!("{origin}/"))
+            .expect("request")
+            .host_authority_override("virtual.example.com:8443")
+            .expect("authority override")
+            .cache_policy(policy);
+        let body = client
+            .send(request)
+            .await
+            .expect("response")
+            .into_bytes_bounded(1_024)
+            .await
+            .expect("response body");
+        assert_eq!(body, "virtual.example.com:8443|absent|absent");
+    }
 }
 
 #[tokio::test]

crates/edgezero-adapter-cloudflare/src/outbound.rs

@@ -581,7 +581,7 @@
         url: &str,
         headers: &HeaderMap,
         request_body: Option<JsValue>,
         cache_policy: OutboundCachePolicy,
     ) -> Result<WorkerRequest, EdgeError> {
         let mut init = RequestInit::new();
         init.with_headers(build_headers(headers)?)
@@ -2231,6 +2231,39 @@
             assert_eq!(before.body().as_bytes(), after.body().as_bytes());
         }
 
+        #[wasm_bindgen_test]
+        fn tagged_default_keeps_worker_default_cache_mode_without_wire_tags() {
+            for (policy, expected) in [
+                (OutboundCachePolicy::PlatformDefault, "default"),
+                (
+                    OutboundCachePolicy::PlatformDefaultWithSurrogateKey(HeaderValue::from_static(
+                        "example-all example-reader-0123",
+                    )),
+                    "default",
+                ),
+                (OutboundCachePolicy::Bypass, "no-store"),
+            ] {
+                let request = build_worker_request(
+                    &Method::GET,
+                    "https://origin.example.com/resource",
+                    &HeaderMap::new(),
+                    None,
+                    policy,
+                )
+                .expect("Workers request");
+                let mode = Reflect::get(request.inner().as_ref(), &JsValue::from_str("cache"))
+                    .expect("cache mode");
+                assert_eq!(mode.as_string().as_deref(), Some(expected));
+                assert!(
+                    request
+                        .headers()
+                        .get("surrogate-key")
+                        .expect("header")
+                        .is_none()
+                );
+            }
+        }
+
         #[wasm_bindgen_test]
         fn provider_diagnostics_preserve_preparation_errors_without_changing_sources() {
             let mut headers = HeaderMap::new();
@@ -3763,6 +3796,28 @@
 
     use super::*;
 
+    #[cfg(feature = "test-utils")]
+    #[test]
+    fn tagged_default_is_an_accepted_cache_noop() {
+        use edgezero_core::outbound::validate_for_dispatch;
+        let request = edgezero_core::OutboundRequest::get("https://origin.example.com/resource")
+            .expect("request")
+            .cache_policy(
+                edgezero_core::OutboundCachePolicy::PlatformDefaultWithSurrogateKey(
+                    HeaderValue::from_static("example-all"),
+                ),
+            );
+        super::validate_supported_options(&request).expect("metadata ignored on Workers");
+        for mode in [
+            edgezero_core::OutboundSendMode::Send,
+            edgezero_core::OutboundSendMode::Begin,
+            edgezero_core::OutboundSendMode::Batch,
+        ] {
+            validate_for_dispatch(&request, mode).expect("valid metadata");
+        }
+        assert!(!request.headers().contains_key("surrogate-key"));
+    }
+
     #[derive(Default)]
     struct AppendSink(BTreeMap<String, Vec<String>>);
 

crates/edgezero-adapter-fastly/src/outbound.rs

@@ -1129,8 +1129,12 @@ mod fastly_impl {
         for (name, value) in headers {
             request.append_header(name.as_str(), value.as_bytes());
         }
-        if cache_policy == OutboundCachePolicy::Bypass {
-            request.set_pass(true);
+        match cache_policy {
+            OutboundCachePolicy::Bypass => request.set_pass(true),
+            OutboundCachePolicy::PlatformDefault => {}
+            OutboundCachePolicy::PlatformDefaultWithSurrogateKey(value) => {
+                request.set_surrogate_key(value);
+            }
         }
         request
     }
@@ -2033,9 +2037,80 @@ mod fastly_impl {
             }
         }
 
+        #[test]
+        fn tagged_cache_metadata_reaches_sdk_from_send_begin_and_batch_without_ttl() {
+            let trace = NativeSdkTrace::new(Duration::ZERO);
+            for mode in [
+                OutboundSendMode::Send,
+                OutboundSendMode::Begin,
+                OutboundSendMode::Batch,
+            ] {
+                let request =
+                    OutboundRequest::get("https://origin.example.com/resource?signature=a%2Fb")
+                        .expect("request")
+                        .header("authorization", "fixture-signature")
+                        .expect("signature")
+                        .cache_policy(OutboundCachePolicy::PlatformDefaultWithSurrogateKey(
+                            HeaderValue::from_static("example-all example-reader-0123"),
+                        ));
+                let dispatch = match mode {
+                    OutboundSendMode::Send => testing::dispatch(request, trace.time()),
+                    OutboundSendMode::Begin => testing::begin_dispatch(request, trace.time()),
+                    OutboundSendMode::Batch => testing::batch_dispatch(
+                        request,
+                        trace.time(),
+                        Deadline::after(Duration::from_secs(1)),
+                    ),
+                    OutboundSendMode::Follow => panic!("covered by redirect replay tests"),
+                };
+                let (parts, context) = dispatch.into_parts();
+                assert_eq!(context.mode(), mode);
+                let native = build_fastly_request(
+                    &parts.method,
+                    &parts.uri,
+                    &parts.headers,
+                    parts.cache_policy,
+                );
+                assert!(native.get_header("surrogate-key").is_none());
+                assert_eq!(
+                    native
+                        .get_header("authorization")
+                        .expect("signature")
+                        .as_bytes(),
+                    b"fixture-signature"
+                );
+                let rendered = format!("{native:?}");
+                assert!(rendered.contains("cache_override: Override"), "{rendered}");
+                assert!(
+                    rendered.contains("example-all example-reader-0123"),
+                    "{rendered}"
+                );
+                assert!(rendered.contains("ttl: None"), "{rendered}");
+                assert!(
+                    rendered.contains("stale_while_revalidate: None"),
+                    "{rendered}"
+                );
+                assert!(rendered.contains("stale_if_error: None"), "{rendered}");
+                assert!(!rendered.contains("cache_override: Pass"), "{rendered}");
+            }
+            for (policy, expected) in [
+                (OutboundCachePolicy::Bypass, "cache_override: Pass"),
+                (OutboundCachePolicy::PlatformDefault, "cache_override: None"),
+            ] {
+                let native = build_fastly_request(
+                    &Method::HEAD,
+                    &"https://origin.example.com/".parse().expect("URI"),
+                    &HeaderMap::new(),
+                    policy,
+                );
+                assert!(format!("{native:?}").contains(expected));
+                assert!(native.get_header("surrogate-key").is_none());
+            }
+        }
+
         fn sdk_cache_selection(
             mode: OutboundSendMode,
-            policy: OutboundCachePolicy,
+            policy: &OutboundCachePolicy,
             method: Method,
         ) {
             use edgezero_core::OutboundScopeOwner;
@@ -2053,7 +2128,7 @@ mod fastly_impl {
                     .expect("target"),
             )
             .expect("request")
-            .cache_policy(policy)
+            .cache_policy(policy.clone())
             .timeout(Duration::from_secs(1));
             let dispatch = callback.with(|| match mode {
                 OutboundSendMode::Batch => testing::batch_dispatch(
@@ -2078,7 +2153,7 @@ mod fastly_impl {
                 &prepared.parts.method,
                 &prepared.parts.uri,
                 &prepared.parts.headers,
-                policy,
+                policy.clone(),
             );
             native.set_before_send(|_| Ok(()));
             native.set_body(Vec::<u8>::new());
@@ -2097,7 +2172,8 @@ mod fastly_impl {
                 cause: FastlyFailureCause::HttpCacheApiUnsupported,
             });
             match policy {
-                OutboundCachePolicy::PlatformDefault => {
+                OutboundCachePolicy::PlatformDefault
+                | OutboundCachePolicy::PlatformDefaultWithSurrogateKey(_) => {
                     let error = outcome
                         .expect("SDK rejects unsupported guest caching")
                         .expect_err("cache API unavailable in pinned Viceroy");
@@ -2127,7 +2203,18 @@ mod fastly_impl {
         fn buffered_send_and_batch_preserve_sdk_cache_selection() {
             for mode in [OutboundSendMode::Send, OutboundSendMode::Batch] {
                 for method in [Method::HEAD, Method::GET] {
-                    sdk_cache_selection(mode, OutboundCachePolicy::PlatformDefault, method);
+                    sdk_cache_selection(
+                        mode,
+                        &OutboundCachePolicy::PlatformDefault,
+                        method.clone(),
+                    );
+                    sdk_cache_selection(
+                        mode,
+                        &OutboundCachePolicy::PlatformDefaultWithSurrogateKey(
+                            HeaderValue::from_static("example-all"),
+                        ),
+                        method,
+                    );
                 }
             }
         }
@@ -2136,7 +2223,7 @@ mod fastly_impl {
         fn buffered_send_and_batch_bypass_unsupported_guest_cache_hooks() {
             for mode in [OutboundSendMode::Send, OutboundSendMode::Batch] {
                 for method in [Method::HEAD, Method::GET] {
-                    sdk_cache_selection(mode, OutboundCachePolicy::Bypass, method);
+                    sdk_cache_selection(mode, &OutboundCachePolicy::Bypass, method);
                 }
             }
         }
@@ -4306,7 +4393,7 @@ mod fastly_impl {
                     &plan.parts.method,
                     &plan.parts.uri,
                     &plan.parts.headers,
-                    plan.parts.cache_policy,
+                    plan.parts.cache_policy.clone(),
                 );
                 assert_eq!(native.get_method(), &method);
                 assert_eq!(native.get_url_str(), target);

crates/edgezero-adapter-fastly/src/outbound/testing.rs

@@ -1,5 +1,6 @@
 //! Obtain opaque test inputs through the real facade, never by reconstructing core policies.
 
+use futures_util::FutureExt as _;
 use futures_util::future::pending;
 use std::cell::RefCell;
 use std::iter::repeat_with;
@@ -9,6 +10,7 @@ use std::sync::atomic::{AtomicBool, Ordering};
 use std::task::{Context, Waker};
 use std::time::Duration;
 
+use edgezero_core::http::HeaderValue;
 use edgezero_core::{
     Deadline, EdgeError, HttpClient, IndependentOutboundProgress, MonotonicClock, MonotonicInstant,
     OutboundBatch, OutboundBatchContext, OutboundDispatchRequest, OutboundExchangeOwner,
@@ -25,6 +27,7 @@ std::thread_local! {
 enum CaptureMode {
     BatchContext,
     BatchRequest,
+    BeginRequest,
     Dispatch,
 }
 
@@ -50,7 +53,10 @@ impl Capture {
 }
 
 impl OutboundHttpClient for Capture {
-    fn begin(&self, _: OutboundDispatchRequest) -> Result<OutboundPending, EdgeError> {
+    fn begin(&self, request: OutboundDispatchRequest) -> Result<OutboundPending, EdgeError> {
+        if matches!(self.mode, CaptureMode::BeginRequest) {
+            DISPATCH.with(|saved| saved.replace(Some(request)));
+        }
         Err(EdgeError::internal(anyhow::anyhow!(
             "capture fixture does not begin exchanges"
         )))
@@ -71,7 +77,9 @@ impl OutboundHttpClient for Capture {
     fn start_batch_until(&self, batch: OutboundPreparedBatch) -> OutboundBatch {
         let (context, mut requests) = batch.into_slots();
         match self.mode {
-            CaptureMode::Dispatch => return OutboundBatch::cutoff(context),
+            CaptureMode::BeginRequest | CaptureMode::Dispatch => {
+                return OutboundBatch::cutoff(context);
+            }
             CaptureMode::BatchRequest => {
                 assert_eq!(requests.len(), 1, "one captured request");
                 DISPATCH
@@ -120,6 +128,20 @@ pub(super) fn dispatch(request: OutboundRequest, time: OutboundTime) -> Outbound
     })
 }
 
+pub(super) fn begin_dispatch(
+    request: OutboundRequest,
+    time: OutboundTime,
+) -> OutboundDispatchRequest {
+    let client = HttpClient::with_client(Capture::new(time, CaptureMode::BeginRequest));
+    assert!(matches!(client.begin(request).now_or_never(), Some(Err(_))));
+    DISPATCH.with(|saved| {
+        saved
+            .borrow_mut()
+            .take()
+            .expect("facade prepared begun request")
+    })
+}
+
 pub(crate) fn batch_context(slot_count: usize) -> OutboundBatchContext {
     batch_context_at(slot_count, instant(), Duration::from_secs(60))
 }
@@ -141,6 +163,24 @@ pub(super) fn batch_dispatch(
     })
 }
 
+#[test]
+fn captured_begun_request_keeps_tag_metadata_and_mode() {
+    let request = OutboundRequest::get("https://origin.example.com/resource")
+        .expect("request")
+        .cache_policy(
+            edgezero_core::OutboundCachePolicy::PlatformDefaultWithSurrogateKey(
+                HeaderValue::from_static("example-all"),
+            ),
+        );
+    let captured = begin_dispatch(request, batch_context(1).time().clone());
+    let (parts, context) = captured.into_parts();
+    assert_eq!(context.mode(), OutboundSendMode::Begin);
+    assert!(
+        matches!(parts.cache_policy, edgezero_core::OutboundCachePolicy::PlatformDefaultWithSurrogateKey(value) if value.as_bytes() == b"example-all")
+    );
+    assert!(!parts.headers.contains_key("surrogate-key"));
+}
+
 #[test]
 fn captured_batch_request_keeps_the_facade_mode_and_budget() {
     let start = instant();