@@ -204,28 +204,42 @@ impl DerefMut for IntegrationSettings {
204204 }
205205}
206206
207- /// Edge Cookie configuration.
207+ /// Edge Cookie (EC) configuration.
208+ ///
209+ /// Mapped from the `[ec]` TOML section. Controls EC identity generation,
210+ /// KV store names, and partner registry.
208211#[ allow( unused) ]
209212#[ derive( Debug , Default , Clone , Deserialize , Serialize , Validate ) ]
210- pub struct EdgeCookie {
211- #[ validate( custom( function = EdgeCookie :: validate_secret_key) ) ]
212- pub secret_key : Redacted < String > ,
213+ pub struct Ec {
214+ /// Publisher passphrase used as HMAC key for EC generation.
215+ #[ validate( custom( function = Ec :: validate_passphrase) ) ]
216+ pub passphrase : Redacted < String > ,
217+
218+ /// Fastly KV store name for the EC identity graph.
219+ /// Required for Stories 3+ (KV identity graph).
220+ #[ serde( default ) ]
221+ pub ec_store : Option < String > ,
222+
223+ /// Fastly KV store name for the partner registry.
224+ /// Required for Story 4+ (partner registry).
225+ #[ serde( default ) ]
226+ pub partner_store : Option < String > ,
213227}
214228
215- impl EdgeCookie {
229+ impl Ec {
216230 /// Known placeholder values that must not be used in production.
217- pub const SECRET_KEY_PLACEHOLDERS : & [ & str ] = & [ "secret-key" , "secret_key" , "trusted-server" ] ;
231+ pub const PASSPHRASE_PLACEHOLDERS : & [ & str ] = & [ "secret-key" , "secret_key" , "trusted-server" ] ;
218232
219- /// Returns `true` if `secret_key ` matches a known placeholder value
233+ /// Returns `true` if `passphrase ` matches a known placeholder value
220234/// (case-insensitive).
221235#[ must_use]
222- pub fn is_placeholder_secret_key ( secret_key : & str ) -> bool {
223- Self :: SECRET_KEY_PLACEHOLDERS
236+ pub fn is_placeholder_passphrase ( passphrase : & str ) -> bool {
237+ Self :: PASSPHRASE_PLACEHOLDERS
224238 . iter ( )
225- . any ( |p| p. eq_ignore_ascii_case ( secret_key ) )
239+ . any ( |p| p. eq_ignore_ascii_case ( passphrase ) )
226240 }
227241
228- /// Validates that the secret key is not empty.
242+ /// Validates that the passphrase is not empty.
229243///
230244/// Placeholder detection is intentionally **not** performed here because
231245/// this validator runs at build time (via `from_toml_and_env`) when the
@@ -234,10 +248,10 @@ impl EdgeCookie {
234248///
235249/// # Errors
236250///
237- /// Returns a validation error if the secret key is empty.
238- pub fn validate_secret_key ( secret_key : & Redacted < String > ) -> Result < ( ) , ValidationError > {
239- if secret_key . expose ( ) . is_empty ( ) {
240- return Err ( ValidationError :: new ( "empty_secret_key " ) ) ;
251+ /// Returns a validation error if the passphrase is empty.
252+ pub fn validate_passphrase ( passphrase : & Redacted < String > ) -> Result < ( ) , ValidationError > {
253+ if passphrase . expose ( ) . is_empty ( ) {
254+ return Err ( ValidationError :: new ( "empty_passphrase " ) ) ;
241255 }
242256 Ok ( ( ) )
243257 }
@@ -343,7 +357,7 @@ pub struct Settings {
343357 pub publisher : Publisher ,
344358 #[ serde( default ) ]
345359 #[ validate( nested) ]
346- pub edge_cookie : EdgeCookie ,
360+ pub ec : Ec ,
347361 #[ serde( default ) ]
348362 pub integrations : IntegrationSettings ,
349363 #[ serde( default , deserialize_with = "vec_from_seq_or_map" ) ]
@@ -439,8 +453,8 @@ impl Settings {
439453pub fn reject_placeholder_secrets ( & self ) -> Result < ( ) , Report < TrustedServerError > > {
440454 let mut insecure_fields: Vec < & str > = Vec :: new ( ) ;
441455
442- if EdgeCookie :: is_placeholder_secret_key ( self . edge_cookie . secret_key . expose ( ) ) {
443- insecure_fields. push ( "edge_cookie.secret_key " ) ;
456+ if Ec :: is_placeholder_passphrase ( self . ec . passphrase . expose ( ) ) {
457+ insecure_fields. push ( "ec.passphrase " ) ;
444458 }
445459 if Publisher :: is_placeholder_proxy_secret ( self . publisher . proxy_secret . expose ( ) ) {
446460 insecure_fields. push ( "publisher.proxy_secret" ) ;
@@ -722,7 +736,7 @@ mod tests {
722736 settings. publisher. origin_url,
723737 "https://origin.test-publisher.com"
724738 ) ;
725- assert_eq ! ( settings. edge_cookie . secret_key . expose( ) , "test-secret-key" ) ;
739+ assert_eq ! ( settings. ec . passphrase . expose( ) , "test-secret-key" ) ;
726740
727741 settings. validate ( ) . expect ( "Failed to validate settings" ) ;
728742 }
@@ -757,32 +771,32 @@ mod tests {
757771 }
758772
759773 #[ test]
760- fn is_placeholder_secret_key_rejects_all_known_placeholders ( ) {
761- for placeholder in EdgeCookie :: SECRET_KEY_PLACEHOLDERS {
774+ fn is_placeholder_passphrase_rejects_all_known_placeholders ( ) {
775+ for placeholder in Ec :: PASSPHRASE_PLACEHOLDERS {
762776 assert ! (
763- EdgeCookie :: is_placeholder_secret_key ( placeholder) ,
764- "should detect placeholder secret_key '{placeholder}'"
777+ Ec :: is_placeholder_passphrase ( placeholder) ,
778+ "should detect placeholder passphrase '{placeholder}'"
765779 ) ;
766780 }
767781 }
768782
769783 #[ test]
770- fn is_placeholder_secret_key_is_case_insensitive ( ) {
784+ fn is_placeholder_passphrase_is_case_insensitive ( ) {
771785 assert ! (
772- EdgeCookie :: is_placeholder_secret_key ( "SECRET-KEY" ) ,
773- "should detect case-insensitive placeholder secret_key "
786+ Ec :: is_placeholder_passphrase ( "SECRET-KEY" ) ,
787+ "should detect case-insensitive placeholder passphrase "
774788 ) ;
775789 assert ! (
776- EdgeCookie :: is_placeholder_secret_key ( "Trusted-Server" ) ,
777- "should detect mixed-case placeholder secret_key "
790+ Ec :: is_placeholder_passphrase ( "Trusted-Server" ) ,
791+ "should detect mixed-case placeholder passphrase "
778792 ) ;
779793 }
780794
781795 #[ test]
782- fn is_placeholder_secret_key_accepts_non_placeholder ( ) {
796+ fn is_placeholder_passphrase_accepts_non_placeholder ( ) {
783797 assert ! (
784- !EdgeCookie :: is_placeholder_secret_key ( "test-secret-key" ) ,
785- "should accept non-placeholder secret_key "
798+ !Ec :: is_placeholder_passphrase ( "test-secret-key" ) ,
799+ "should accept non-placeholder passphrase "
786800 ) ;
787801 }
788802
@@ -1398,8 +1412,8 @@ mod tests {
13981412 origin_url = "https://origin.test-publisher.com"
13991413 proxy_secret = "unit-test-proxy-secret"
14001414
1401- [edge_cookie ]
1402- secret_key = "test-secret-key"
1415+ [ec ]
1416+ passphrase = "test-secret-key"
14031417
14041418 [request_signing]
14051419 config_store_id = "test-config-store-id"
0 commit comments