@@ -192,28 +192,42 @@ impl DerefMut for IntegrationSettings {
192192 }
193193}
194194
195- /// Edge Cookie configuration.
195+ /// Edge Cookie (EC) configuration.
196+ ///
197+ /// Mapped from the `[ec]` TOML section. Controls EC identity generation,
198+ /// KV store names, and partner registry.
196199#[ allow( unused) ]
197200#[ derive( Debug , Default , Clone , Deserialize , Serialize , Validate ) ]
198- pub struct EdgeCookie {
199- #[ validate( custom( function = EdgeCookie :: validate_secret_key) ) ]
200- pub secret_key : Redacted < String > ,
201+ pub struct Ec {
202+ /// Publisher passphrase used as HMAC key for EC generation.
203+ #[ validate( custom( function = Ec :: validate_passphrase) ) ]
204+ pub passphrase : Redacted < String > ,
205+
206+ /// Fastly KV store name for the EC identity graph.
207+ /// Required for Stories 3+ (KV identity graph).
208+ #[ serde( default ) ]
209+ pub ec_store : Option < String > ,
210+
211+ /// Fastly KV store name for the partner registry.
212+ /// Required for Story 4+ (partner registry).
213+ #[ serde( default ) ]
214+ pub partner_store : Option < String > ,
201215}
202216
203- impl EdgeCookie {
217+ impl Ec {
204218 /// Known placeholder values that must not be used in production.
205- pub const SECRET_KEY_PLACEHOLDERS : & [ & str ] = & [ "secret-key" , "secret_key" , "trusted-server" ] ;
219+ pub const PASSPHRASE_PLACEHOLDERS : & [ & str ] = & [ "secret-key" , "secret_key" , "trusted-server" ] ;
206220
207- /// Returns `true` if `secret_key ` matches a known placeholder value
221+ /// Returns `true` if `passphrase ` matches a known placeholder value
208222/// (case-insensitive).
209223#[ must_use]
210- pub fn is_placeholder_secret_key ( secret_key : & str ) -> bool {
211- Self :: SECRET_KEY_PLACEHOLDERS
224+ pub fn is_placeholder_passphrase ( passphrase : & str ) -> bool {
225+ Self :: PASSPHRASE_PLACEHOLDERS
212226 . iter ( )
213- . any ( |p| p. eq_ignore_ascii_case ( secret_key ) )
227+ . any ( |p| p. eq_ignore_ascii_case ( passphrase ) )
214228 }
215229
216- /// Validates that the secret key is not empty.
230+ /// Validates that the passphrase is not empty.
217231///
218232/// Placeholder detection is intentionally **not** performed here because
219233/// this validator runs at build time (via `from_toml_and_env`) when the
@@ -222,10 +236,10 @@ impl EdgeCookie {
222236///
223237/// # Errors
224238///
225- /// Returns a validation error if the secret key is empty.
226- pub fn validate_secret_key ( secret_key : & Redacted < String > ) -> Result < ( ) , ValidationError > {
227- if secret_key . expose ( ) . is_empty ( ) {
228- return Err ( ValidationError :: new ( "empty_secret_key " ) ) ;
239+ /// Returns a validation error if the passphrase is empty.
240+ pub fn validate_passphrase ( passphrase : & Redacted < String > ) -> Result < ( ) , ValidationError > {
241+ if passphrase . expose ( ) . is_empty ( ) {
242+ return Err ( ValidationError :: new ( "empty_passphrase " ) ) ;
229243 }
230244 Ok ( ( ) )
231245 }
@@ -331,7 +345,7 @@ pub struct Settings {
331345 pub publisher : Publisher ,
332346 #[ serde( default ) ]
333347 #[ validate( nested) ]
334- pub edge_cookie : EdgeCookie ,
348+ pub ec : Ec ,
335349 #[ serde( default ) ]
336350 pub integrations : IntegrationSettings ,
337351 #[ serde( default , deserialize_with = "vec_from_seq_or_map" ) ]
@@ -427,8 +441,8 @@ impl Settings {
427441pub fn reject_placeholder_secrets ( & self ) -> Result < ( ) , Report < TrustedServerError > > {
428442 let mut insecure_fields: Vec < & str > = Vec :: new ( ) ;
429443
430- if EdgeCookie :: is_placeholder_secret_key ( self . edge_cookie . secret_key . expose ( ) ) {
431- insecure_fields. push ( "edge_cookie.secret_key " ) ;
444+ if Ec :: is_placeholder_passphrase ( self . ec . passphrase . expose ( ) ) {
445+ insecure_fields. push ( "ec.passphrase " ) ;
432446 }
433447 if Publisher :: is_placeholder_proxy_secret ( self . publisher . proxy_secret . expose ( ) ) {
434448 insecure_fields. push ( "publisher.proxy_secret" ) ;
@@ -717,7 +731,7 @@ mod tests {
717731 settings. publisher. origin_url,
718732 "https://origin.test-publisher.com"
719733 ) ;
720- assert_eq ! ( settings. edge_cookie . secret_key . expose( ) , "test-secret-key" ) ;
734+ assert_eq ! ( settings. ec . passphrase . expose( ) , "test-secret-key" ) ;
721735
722736 settings. validate ( ) . expect ( "Failed to validate settings" ) ;
723737 }
@@ -752,32 +766,32 @@ mod tests {
752766 }
753767
754768 #[ test]
755- fn is_placeholder_secret_key_rejects_all_known_placeholders ( ) {
756- for placeholder in EdgeCookie :: SECRET_KEY_PLACEHOLDERS {
769+ fn is_placeholder_passphrase_rejects_all_known_placeholders ( ) {
770+ for placeholder in Ec :: PASSPHRASE_PLACEHOLDERS {
757771 assert ! (
758- EdgeCookie :: is_placeholder_secret_key ( placeholder) ,
759- "should detect placeholder secret_key '{placeholder}'"
772+ Ec :: is_placeholder_passphrase ( placeholder) ,
773+ "should detect placeholder passphrase '{placeholder}'"
760774 ) ;
761775 }
762776 }
763777
764778 #[ test]
765- fn is_placeholder_secret_key_is_case_insensitive ( ) {
779+ fn is_placeholder_passphrase_is_case_insensitive ( ) {
766780 assert ! (
767- EdgeCookie :: is_placeholder_secret_key ( "SECRET-KEY" ) ,
768- "should detect case-insensitive placeholder secret_key "
781+ Ec :: is_placeholder_passphrase ( "SECRET-KEY" ) ,
782+ "should detect case-insensitive placeholder passphrase "
769783 ) ;
770784 assert ! (
771- EdgeCookie :: is_placeholder_secret_key ( "Trusted-Server" ) ,
772- "should detect mixed-case placeholder secret_key "
785+ Ec :: is_placeholder_passphrase ( "Trusted-Server" ) ,
786+ "should detect mixed-case placeholder passphrase "
773787 ) ;
774788 }
775789
776790 #[ test]
777- fn is_placeholder_secret_key_accepts_non_placeholder ( ) {
791+ fn is_placeholder_passphrase_accepts_non_placeholder ( ) {
778792 assert ! (
779- !EdgeCookie :: is_placeholder_secret_key ( "test-secret-key" ) ,
780- "should accept non-placeholder secret_key "
793+ !Ec :: is_placeholder_passphrase ( "test-secret-key" ) ,
794+ "should accept non-placeholder passphrase "
781795 ) ;
782796 }
783797
@@ -1419,8 +1433,8 @@ mod tests {
14191433 origin_url = "https://origin.test-publisher.com"
14201434 proxy_secret = "unit-test-proxy-secret"
14211435
1422- [edge_cookie ]
1423- secret_key = "test-secret-key"
1436+ [ec ]
1437+ passphrase = "test-secret-key"
14241438
14251439 [request_signing]
14261440 config_store_id = "test-config-store-id"
0 commit comments