Harden Wasm cache policy key handling

Author: eldryoth

CHANGELOG.md

@@ -21,6 +21,8 @@ behavior when the change improves security or project direction.
   response-header exposure.
 - Add live listener tests proving separate mobile and desktop cache variants
   MISS independently and HIT the original variant on repeat.
+- Add live listener tests proving Wasm-selected cache-key components isolate
+  fixed-slice range-cache objects for ranged responses.
 - Add live listener tests proving a plugin TTL override expires an otherwise
   longer-lived origin response.
 - Add live listener tests proving fixed stored response-header metadata appears
@@ -35,11 +37,16 @@ behavior when the change improves security or project direction.
 
 - Reject unknown cache-key component IDs, unknown values, duplicate labels, and
   component counts above the hard cap through the plugin fail mode.
+- Enforce duplicate-label rejection and the aggregate component cap across the
+  full `cache-lookup` hook chain.
 - Reject unknown TTL IDs, duplicate TTL overrides, unknown tag IDs, and tag
   counts above the hard cap through the plugin fail mode.
 - Reject unknown stored-header IDs, duplicate stored-header mutations, and
   stored-header mutation counts above the hard cap through the plugin fail
   mode.
+- Scope cache-store tag and stored-header mutation caps independently, and
+  reject oversized cache-store candidates before cloning response bodies for
+  stored-header metadata.
 - Keep arbitrary request headers, raw cache-key bytes, request bodies, cached
   objects, arbitrary TTLs, arbitrary tag strings, arbitrary response-header
   inspection, and arbitrary stored response headers unavailable in this slice.

crates/fluxheim-server/src/native_http1_proxy_load_balanced.rs

@@ -99,7 +99,14 @@ impl NativeHttp1Proxy {
                 }
             }
             if proxy_cache_status.is_none()
-                && let Some(slice) = cache.slice_response(&request, self).await
+                && let Some(slice) = cache
+                    .slice_response(
+                        &request,
+                        self,
+                        #[cfg(feature = "wasm")]
+                        &wasm_cache_key_components,
+                    )
+                    .await
             {
                 return self.finish_response(
                     &request,

crates/fluxheim-server/src/native_http1_proxy_memory_cache/lookup.rs

@@ -98,10 +98,6 @@ impl NativeProxyMemoryCache {
         }
     }
 
-    pub(super) fn key(&self, request: &NativeHttp1Request) -> Option<String> {
-        self.key_with_components(request, &[])
-    }
-
     pub(super) fn key_with_components(
         &self,
         request: &NativeHttp1Request,

crates/fluxheim-server/src/native_http1_proxy_memory_cache/slice.rs

@@ -14,6 +14,8 @@ use crate::native_http1_proxy_cache_slice::{
     native_slice_cache_key, native_slice_identity, native_slice_not_satisfiable_response,
     native_slice_object_from_entry, native_slice_request_within_policy,
 };
+#[cfg(feature = "wasm")]
+use crate::native_http1_proxy_memory_cache::NativeProxyCacheKeyComponent;
 use crate::{NativeHttp1Request, NativeHttp1Response};
 use fluxheim_cache::{
     CacheRequestView, CacheSliceBounds, request_cache_bypass_reason, resolve_client_slice_ranges,
@@ -27,17 +29,24 @@ impl NativeProxyMemoryCache {
         &self,
         request: &NativeHttp1Request,
         proxy: &NativeHttp1Proxy,
+        #[cfg(feature = "wasm")] key_components: &[NativeProxyCacheKeyComponent],
     ) -> Option<NativeCacheSliceResponse> {
         if !self.config.range.enabled || !self.config.range.slice.enabled {
             return None;
         }
+        let base_key = self.key_with_components(
+            request,
+            #[cfg(feature = "wasm")]
+            key_components,
+            #[cfg(not(feature = "wasm"))]
+            &[],
+        )?;
         if request_cache_bypass_reason(request, &self.config).is_some()
-            || self.cache_pass_should_bypass(&self.key(request)?)
+            || self.cache_pass_should_bypass(&base_key)
         {
             return None;
         }
         let slice_request = selected_cache_slice_range_request(request, &self.config)?;
-        let base_key = self.key(request)?;
         let slice_size = self.config.range.slice.size_bytes.as_u64();
         let (total, first_slice, first_filled) = self
             .discover_slice_total(&base_key, request, proxy, slice_size)

crates/fluxheim-server/src/native_http1_proxy_memory_cache/store.rs

@@ -198,17 +198,17 @@ impl NativeProxyMemoryCache {
         mode: NativeCacheStoreMode,
         metadata: NativeProxyCacheStoreMetadata,
     ) -> Result<(), &'static str> {
+        let body_len = response.body().len() as u64;
+        if body_len > self.config.max_object_bytes.as_u64() {
+            return Err("object-too-large");
+        }
         let stored_response;
         let response = if metadata.response_headers.is_empty() {
             response
         } else {
             stored_response = native_cache_store_response_with_metadata(response, &metadata);
             &stored_response
         };
-        let body_len = response.body().len() as u64;
-        if body_len > self.config.max_object_bytes.as_u64() {
-            return Err("object-too-large");
-        }
         let headers = native_response_header_map(response);
         let vary_fields = match cache_vary_policy(&headers, &self.config) {
             VaryCachePolicy::None => None,

crates/fluxheim-server/src/native_http1_proxy_static_dispatch.rs

@@ -92,7 +92,14 @@ impl NativeHttp1Proxy {
                 }
             }
             if proxy_cache_status.is_none()
-                && let Some(slice) = cache.slice_response(&request, self).await
+                && let Some(slice) = cache
+                    .slice_response(
+                        &request,
+                        self,
+                        #[cfg(feature = "wasm")]
+                        &wasm_cache_key_components,
+                    )
+                    .await
             {
                 return self.finish_response(
                     &request,