Cover Wasm cache-store header rejection paths

Author: eldryoth

CHANGELOG.md

@@ -27,6 +27,8 @@ behavior when the change improves security or project direction.
   longer-lived origin response.
 - Add live listener tests proving fixed stored response-header metadata appears
   on cache HIT and forbidden stored-header IDs fail closed.
+- Add live listener coverage proving duplicate stored-header mutations fail
+  closed, plus unit coverage for stored-header mutation-count caps.
 - Add a checked-in Wasm cache-policy example plus a config template for the
   bounded `1.7.5` cache ABI.
 - Add live listener coverage that compiles the checked-in example sources and

crates/fluxheim-server/src/native_http1_route_proxy_tests/wasm.rs

@@ -1396,6 +1396,16 @@ async fn native_wasm_cache_store_forbidden_tag_fails_closed() {
         .assert_service_unavailable();
 }
 
+#[tokio::test]
+async fn native_wasm_cache_store_duplicate_header_fails_closed() {
+    wasm_cache_store_failure_response(
+        WasmPluginBody::CacheStoreDuplicateHeader,
+        "header-duplicate",
+    )
+    .await
+    .assert_service_unavailable();
+}
+
 #[tokio::test]
 async fn native_wasm_cache_store_deny_wins_over_earlier_skip() {
     let fixture = WasmRouteFixture::new(&[
@@ -1526,6 +1536,7 @@ async fn wasm_cache_store_failure_response(
         "ttl" => &[("/static/store-ttl.png", "hidden")],
         "ttl-duplicate" => &[("/static/store-ttl-duplicate.png", "hidden")],
         "tag" => &[("/static/store-tag.png", "hidden")],
+        "header-duplicate" => &[("/static/store-header-duplicate.png", "hidden")],
         _ => &[("/static/store-failure.png", "hidden")],
     };
     let path = responses[0].0;
@@ -1618,6 +1629,7 @@ enum WasmPluginBody {
     CacheStoreForbiddenTag,
     CacheStoreHeader,
     CacheStoreForbiddenHeader,
+    CacheStoreDuplicateHeader,
     CacheLookupPolicyExample,
     CacheStorePolicyExample,
     Trap,
@@ -1882,6 +1894,23 @@ impl WasmPluginBody {
                 "#
                 .to_owned()
             }
+            Self::CacheStoreDuplicateHeader => {
+                r#"
+                (module
+                  (import "fluxheim_policy_v1" "set_cache_store_header" (func $set_cache_store_header (param i32 i32) (result i32)))
+                  (func (export "fluxheim_cache_store") (result i32)
+                    i32.const 1
+                    i32.const 1
+                    call $set_cache_store_header
+                    drop
+                    i32.const 1
+                    i32.const 2
+                    call $set_cache_store_header
+                    drop
+                    i32.const 0))
+                "#
+                .to_owned()
+            }
             Self::CacheLookupPolicyExample => {
                 include_str!("../../../../examples/wasm/cache-lookup-policy.wat").to_owned()
             }
@@ -1958,7 +1987,8 @@ fn wasm_plugin_phases(body: WasmPluginBody) -> Vec<fluxheim_config::WasmPluginPh
         | WasmPluginBody::CacheStoreDuplicateTtl
         | WasmPluginBody::CacheStoreForbiddenTag
         | WasmPluginBody::CacheStoreHeader
-        | WasmPluginBody::CacheStoreForbiddenHeader => {
+        | WasmPluginBody::CacheStoreForbiddenHeader
+        | WasmPluginBody::CacheStoreDuplicateHeader => {
             vec![fluxheim_config::WasmPluginPhase::CacheStore]
         }
         WasmPluginBody::CacheLookupPolicyExample => {

crates/fluxheim-server/src/native_http1_route_wasm.rs

@@ -1650,3 +1650,42 @@ impl NativeWasmAdmissionScope {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cache_store_metadata_merge_caps_stored_headers_without_dropping_tags() {
+        let mut target = NativeProxyCacheStoreMetadata {
+            ttl_override: None,
+            cache_tags: Vec::new(),
+            response_headers: vec![
+                ("x-one", "1"),
+                ("x-two", "2"),
+                ("x-three", "3"),
+                ("x-four", "4"),
+            ],
+        };
+        let source = NativeProxyCacheStoreMetadata {
+            ttl_override: Some(Duration::from_secs(1)),
+            cache_tags: vec!["wasm-policy"],
+            response_headers: vec![("x-five", "5")],
+        };
+
+        merge_wasm_cache_store_metadata(&mut target, source);
+
+        assert_eq!(target.ttl_override, Some(Duration::from_secs(1)));
+        assert_eq!(target.cache_tags, vec!["wasm-policy"]);
+        assert_eq!(
+            target.response_headers.len(),
+            MAX_WASM_CACHE_STORE_HEADER_MUTATIONS
+        );
+        assert!(
+            !target
+                .response_headers
+                .iter()
+                .any(|(name, _)| *name == "x-five")
+        );
+    }
+}

release-notes/RELEASE_NOTES_1.7.5.md

@@ -39,6 +39,8 @@ mutate arbitrary cached response headers.
 - Add live native HTTP/1 listener coverage proving a plugin can set the fixed
   stored response header on cache HIT and that forbidden header IDs fail
   closed.
+- Add negative coverage proving duplicate stored-header mutations fail closed
+  and stored-header mutation caps are enforced.
 - Add `examples/wasm/cache-lookup-policy.wat`,
   `examples/wasm/cache-store-policy.wat`, and a matching config template for
   the bounded cache-policy ABI.