Apply wasm header hooks to php fallback

Author: eldryoth

CHANGELOG.md

@@ -28,6 +28,12 @@ behavior when the change improves security or project direction.
   under the existing plugin fail-mode and admission-budget behavior.
 - Keep sensitive headers such as `Authorization`, `Cookie`, and `Set-Cookie`
   outside the current Wasm host-call ABI.
+- Apply vhost-level Wasm header hooks and fallback response header policy to
+  PHP-FPM fallback responses, closing the only fallback path that skipped the
+  new hook family.
+- Classify Wasm header-hook path context from the matched pre-rewrite request
+  path so route tiering remains consistent when `strip_prefix` or rewrite
+  policy changes the upstream target.
 
 ## 1.7.1 - 2026-07-04
 

crates/fluxheim-server/src/native_http1_route_proxy_handler.rs

@@ -152,13 +152,17 @@ impl NativeHttp1Handler for NativeHttp1RouteProxy {
                     .request_headers
                     .apply(&mut request, Some(&header_context));
                 #[cfg(feature = "wasm")]
-                if let Some(response) =
-                    wasm_request_header_rejection(&route.wasm_hooks, &mut request).await
+                let wasm_response_context = NativeWasmHeaderContext::from_path(&path);
+                #[cfg(feature = "wasm")]
+                if let Some(response) = wasm_request_header_rejection(
+                    &route.wasm_hooks,
+                    &mut request,
+                    wasm_response_context,
+                )
+                .await
                 {
                     return response;
                 }
-                #[cfg(feature = "wasm")]
-                let wasm_response_context = NativeWasmHeaderContext::from_request(&request);
                 let response = route.handle(request).await;
                 #[cfg(feature = "wasm")]
                 let mut response = response;
@@ -178,25 +182,77 @@ impl NativeHttp1Handler for NativeHttp1RouteProxy {
             if let Some(php) = &self.fallback_php
                 && let Some(resolved) = php.resolve_for_fallback(&path)
             {
-                return php.handle_resolved(request, path, resolved).await;
+                #[cfg(feature = "wasm")]
+                let wasm_response_context = NativeWasmHeaderContext::from_path(&path);
+                #[cfg(feature = "wasm")]
+                if let Some(response) = wasm_request_header_rejection(
+                    &self.wasm_hooks,
+                    &mut request,
+                    wasm_response_context,
+                )
+                .await
+                {
+                    return response;
+                }
+                let mut response = php.handle_resolved(request, path, resolved).await;
+                self.fallback_response_headers.apply(&mut response);
+                #[cfg(feature = "wasm")]
+                if let Some(failure) = wasm_response_header_failure(
+                    &self.wasm_hooks,
+                    wasm_response_context,
+                    &mut response,
+                )
+                .await
+                {
+                    return failure;
+                }
+                return response;
             }
             if let Some(response) = self.fallback_web_response(&request, &path) {
                 return self.apply_wasm_response_headers(request, response).await;
             }
             #[cfg(feature = "php-fpm")]
             if let Some(php) = &self.fallback_php {
-                return php.handle(request).await;
+                #[cfg(feature = "wasm")]
+                let wasm_response_context = NativeWasmHeaderContext::from_path(&path);
+                #[cfg(feature = "wasm")]
+                if let Some(response) = wasm_request_header_rejection(
+                    &self.wasm_hooks,
+                    &mut request,
+                    wasm_response_context,
+                )
+                .await
+                {
+                    return response;
+                }
+                let mut response = php.handle(request).await;
+                self.fallback_response_headers.apply(&mut response);
+                #[cfg(feature = "wasm")]
+                if let Some(failure) = wasm_response_header_failure(
+                    &self.wasm_hooks,
+                    wasm_response_context,
+                    &mut response,
+                )
+                .await
+                {
+                    return failure;
+                }
+                return response;
             }
             if let Some(proxy) = &self.fallback {
                 self.apply_traceparent(&mut request);
                 #[cfg(feature = "wasm")]
-                if let Some(response) =
-                    wasm_request_header_rejection(&self.wasm_hooks, &mut request).await
+                let wasm_response_context = NativeWasmHeaderContext::from_path(&path);
+                #[cfg(feature = "wasm")]
+                if let Some(response) = wasm_request_header_rejection(
+                    &self.wasm_hooks,
+                    &mut request,
+                    wasm_response_context,
+                )
+                .await
                 {
                     return response;
                 }
-                #[cfg(feature = "wasm")]
-                let wasm_response_context = NativeWasmHeaderContext::from_request(&request);
                 let response = proxy.handle(request).await;
                 #[cfg(feature = "wasm")]
                 let mut response = response;

crates/fluxheim-server/src/native_http1_route_proxy_tests/php_fpm.rs

@@ -169,7 +169,10 @@ async fn native_route_proxy_php_route_executes_fastcgi_responder() {
 #[cfg(feature = "php-fpm")]
 #[tokio::test]
 async fn native_route_proxy_vhost_php_takes_precedence_over_static_web_for_php_paths() {
-    let fpm = fastcgi_responder(b"Status: 200 OK\r\nContent-Type: text/plain\r\n\r\nphp-ok").await;
+    let fpm = fastcgi_responder(
+        b"Status: 200 OK\r\nContent-Type: text/plain\r\nX-Powered-By: php\r\n\r\nphp-ok",
+    )
+    .await;
     let root = tempfile::TempDir::new().unwrap();
     std::fs::write(
         root.path().join("wp-login.php"),
@@ -211,6 +214,7 @@ async fn native_route_proxy_vhost_php_takes_precedence_over_static_web_for_php_p
         "unexpected php response: {php_response:?}"
     );
     assert!(php_response.ends_with("php-ok"));
+    assert_eq!(response_header(&php_response, "x-powered-by"), None);
     assert!(!php_response.contains("<?php"));
     assert!(
         static_response.starts_with("HTTP/1.1 200 OK\r\n"),

crates/fluxheim-server/src/native_http1_route_proxy_tests/wasm.rs

@@ -231,11 +231,12 @@ async fn native_wasm_access_decision_enforces_global_admission_budget() {
 #[tokio::test]
 async fn native_wasm_request_and_response_headers_use_bounded_host_calls() {
     let fixture = WasmRouteFixture::new(&[("headers", WasmPluginBody::HeaderPolicy)]);
-    let upstream = upstream_expect_policy_header().await;
+    let upstream = upstream_expect_policy_header("/item").await;
     let mut config = fixture
         .config_with_attachments(upstream, vec![wasm_attachment_all("headers", "route", 100)]);
     config.vhosts[0].routes[0].path_exact = None;
     config.vhosts[0].routes[0].path_prefix = Some("/gold".to_owned());
+    config.vhosts[0].routes[0].strip_prefix = Some("/gold".to_owned());
     config.vhosts[0].routes[0].redirect = None;
     config.vhosts[0].routes[0].proxy = Some(fluxheim_config::ProxyConfig {
         upstreams: vec![upstream.to_string()],
@@ -284,6 +285,59 @@ async fn native_wasm_forbidden_header_mutation_fails_closed() {
     assert!(response.ends_with("wasm request-headers trap\n"));
 }
 
+#[cfg(feature = "php-fpm")]
+#[tokio::test]
+async fn native_wasm_response_headers_apply_to_php_fpm_fallback() {
+    let fixture = WasmRouteFixture::new(&[("headers", WasmPluginBody::HeaderPolicy)]);
+    let fpm = fastcgi_responder(
+        b"Status: 200 OK\r\nContent-Type: text/plain\r\nX-Powered-By: php\r\n\r\nphp-policy",
+    )
+    .await;
+    let root = tempfile::TempDir::new().unwrap();
+    std::fs::create_dir(root.path().join("gold")).unwrap();
+    std::fs::write(
+        root.path().join("gold").join("index.php"),
+        b"<?php echo 'ok';",
+    )
+    .unwrap();
+    let mut vhost = native_route_proxy_test_vhost();
+    vhost.php = fluxheim_config::PhpConfig {
+        enabled: true,
+        root: Some(root.path().to_path_buf()),
+        fpm: fluxheim_config::PhpFpmConfig {
+            tcp: Some(fpm.to_string()),
+            allow_private_tcp_upstreams: true,
+            ..Default::default()
+        },
+        ..Default::default()
+    };
+    let mut config = fluxheim_config::Config {
+        vhosts: vec![vhost],
+        ..Default::default()
+    };
+    config.server.default_vhost = Some("route.test".to_owned());
+    config.wasm = fluxheim_config::WasmConfig {
+        enabled: true,
+        plugin_roots: vec![fixture.root.clone()],
+        plugins: fixture.plugins.clone(),
+        attachments: vec![wasm_vhost_attachment_all("headers", 100)],
+        ..Default::default()
+    };
+    let router =
+        NativeHttp1HostRouter::from_config(&config, DownstreamHttp1Policy::default(), 0).unwrap();
+    let proxy = router_listener(router).await;
+
+    let response = downstream_get(proxy, "/gold/index.php").await;
+
+    assert!(response.starts_with("HTTP/1.1 200 OK\r\n"));
+    assert_eq!(
+        response_header(&response, "x-fluxheim-policy-branch").as_deref(),
+        Some("gold")
+    );
+    assert_eq!(response_header(&response, "x-powered-by"), None);
+    assert!(response.ends_with("php-policy"));
+}
+
 struct WasmRouteFixture {
     _directory: TempDir,
     root: PathBuf,
@@ -477,6 +531,20 @@ fn wasm_attachment_all(
     attachment
 }
 
+fn wasm_vhost_attachment_all(plugin: &str, priority: u32) -> fluxheim_config::WasmAttachmentConfig {
+    fluxheim_config::WasmAttachmentConfig {
+        plugin: plugin.to_owned(),
+        vhost: "route.test".to_owned(),
+        route: None,
+        phases: vec![
+            fluxheim_config::WasmPluginPhase::RequestHeaders,
+            fluxheim_config::WasmPluginPhase::ResponseHeaders,
+        ],
+        priority,
+        admission: None,
+    }
+}
+
 fn wasm_attachment_phase(
     plugin: &str,
     route: &str,
@@ -540,7 +608,7 @@ async fn router_listener(router: NativeHttp1HostRouter) -> std::net::SocketAddr
     addr
 }
 
-async fn upstream_expect_policy_header() -> std::net::SocketAddr {
+async fn upstream_expect_policy_header(expected_path: &'static str) -> std::net::SocketAddr {
     let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
     let addr = listener.local_addr().unwrap();
     tokio::spawn(async move {
@@ -559,7 +627,7 @@ async fn upstream_expect_policy_header() -> std::net::SocketAddr {
         }
         let request = String::from_utf8(request).unwrap();
         assert!(
-            request.starts_with("GET /gold/item HTTP/1.1\r\n"),
+            request.starts_with(&format!("GET {expected_path} HTTP/1.1\r\n")),
             "unexpected upstream request: {request:?}"
         );
         assert!(
@@ -584,3 +652,71 @@ async fn upstream_expect_policy_header() -> std::net::SocketAddr {
     });
     addr
 }
+
+#[cfg(feature = "php-fpm")]
+async fn fastcgi_responder(stdout: &'static [u8]) -> std::net::SocketAddr {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let mut request_id = 1_u16;
+        let mut params_done = false;
+        let mut stdin_done = false;
+        while !(params_done && stdin_done) {
+            let (record_type, id, content) = read_fastcgi_record(&mut stream).await;
+            request_id = id;
+            match record_type {
+                4 if content.is_empty() => params_done = true,
+                5 if content.is_empty() => stdin_done = true,
+                _ => {}
+            }
+        }
+        write_fastcgi_record(&mut stream, 6, request_id, stdout)
+            .await
+            .unwrap();
+        write_fastcgi_record(&mut stream, 6, request_id, b"")
+            .await
+            .unwrap();
+        write_fastcgi_record(&mut stream, 3, request_id, &[0, 0, 0, 0, 0, 0, 0, 0])
+            .await
+            .unwrap();
+        stream.shutdown().await.unwrap();
+    });
+    addr
+}
+
+#[cfg(feature = "php-fpm")]
+async fn read_fastcgi_record(stream: &mut tokio::net::TcpStream) -> (u8, u16, Vec<u8>) {
+    let mut header = [0_u8; 8];
+    stream.read_exact(&mut header).await.unwrap();
+    let record_type = header[1];
+    let request_id = u16::from_be_bytes([header[2], header[3]]);
+    let content_len = u16::from_be_bytes([header[4], header[5]]) as usize;
+    let padding_len = header[6] as usize;
+    let mut content = vec![0_u8; content_len];
+    if content_len > 0 {
+        stream.read_exact(&mut content).await.unwrap();
+    }
+    if padding_len > 0 {
+        let mut padding = vec![0_u8; padding_len];
+        stream.read_exact(&mut padding).await.unwrap();
+    }
+    (record_type, request_id, content)
+}
+
+#[cfg(feature = "php-fpm")]
+async fn write_fastcgi_record(
+    stream: &mut tokio::net::TcpStream,
+    record_type: u8,
+    request_id: u16,
+    content: &[u8],
+) -> std::io::Result<()> {
+    let len = u16::try_from(content.len()).unwrap();
+    let mut header = [0_u8; 8];
+    header[0] = 1;
+    header[1] = record_type;
+    header[2..4].copy_from_slice(&request_id.to_be_bytes());
+    header[4..6].copy_from_slice(&len.to_be_bytes());
+    stream.write_all(&header).await?;
+    stream.write_all(content).await
+}

crates/fluxheim-server/src/native_http1_route_wasm.rs

@@ -273,11 +273,11 @@ impl NativeWasmHooks {
     pub(crate) async fn apply_request_headers(
         &self,
         request: &mut NativeHttp1Request,
+        context: NativeWasmHeaderContext,
     ) -> Result<(), NativeWasmHeaderError> {
         if self.request_headers.is_empty() {
             return Ok(());
         }
-        let context = NativeWasmHeaderContext::from_request(request);
         for hook in &self.request_headers {
             let mutations = hook
                 .run_header_mutations(
@@ -344,8 +344,9 @@ pub(crate) async fn wasm_access_rejection_status(
 pub(crate) async fn wasm_request_header_rejection(
     hooks: &NativeWasmHooks,
     request: &mut NativeHttp1Request,
+    context: NativeWasmHeaderContext,
 ) -> Option<NativeHttp1Response> {
-    match hooks.apply_request_headers(request).await {
+    match hooks.apply_request_headers(request, context).await {
         Ok(()) => None,
         Err(NativeWasmHeaderError::Failed(phase, outcome)) => Some(
             NativeHttp1Response::new(
@@ -586,6 +587,12 @@ struct NativeWasmHeaderMutations {
 }
 
 impl NativeWasmHeaderContext {
+    pub(crate) fn from_path(path: &str) -> Self {
+        Self {
+            path_class: wasm_path_class(path),
+        }
+    }
+
     pub(crate) fn from_request(request: &NativeHttp1Request) -> Self {
         let path_class = request_path_and_query(request)
             .map(|(path, _)| wasm_path_class(&path))

docs/modularity-exceptions.md

@@ -25,7 +25,7 @@ line adds broader Wasm phases.
 | `crates/fluxheim-config/src/config_tests_wasm.rs` | 531 | Wasm validation coverage is intentionally broad for the first live-hook release. | Split attachment-order, admission-budget, and reload-classification cases into focused Wasm test modules. |
 | `crates/fluxheim-config/src/config_wasm.rs` | 840 | The first live Wasm schema keeps validation, defaults, attachment planning, and admission limits together while the API settles. | Split into `config_wasm_limits`, `config_wasm_attachments`, and `config_wasm_validate` modules after 1.7.1 behavior is locked. |
 | `crates/fluxheim-wasm/src/manifest.rs` | 502 | Manifest parsing and validation grew with ABI/runtime compatibility checks. | Move manifest validation helpers and tests into focused modules. |
-| `crates/fluxheim-server/src/native_http1_route_proxy_tests/wasm.rs` | 586 | Live Wasm hook coverage now includes access decisions plus request/response header mutation in one fixture file. | Split access-decision and header-hook live tests into separate modules before adding routing/cache Wasm phases. |
-| `crates/fluxheim-server/src/native_http1_route_wasm.rs` | 805 | The native hook bridge now owns registry lookup, admission, access decisions, and the first bounded header host-call ABI. | Split header host-call state/mutation helpers into a focused `native_http1_route_wasm_headers` module. |
+| `crates/fluxheim-server/src/native_http1_route_proxy_tests/wasm.rs` | 722 | Live Wasm hook coverage now includes access decisions, request/response header mutation, rewrite-context behavior, and PHP-FPM fallback coverage in one fixture file. | Split access-decision, header-hook, and PHP-FPM fallback live tests into separate modules before adding routing/cache Wasm phases. |
+| `crates/fluxheim-server/src/native_http1_route_wasm.rs` | 812 | The native hook bridge now owns registry lookup, admission, access decisions, and the first bounded header host-call ABI. | Split header host-call state/mutation helpers into a focused `native_http1_route_wasm_headers` module. |
 | `crates/fluxheim-wasm/src/runtime.rs` | 634 | Runtime construction now includes compile caching, host bindings, and execution policy checks. | Split compile-cache, execution, and host-call helpers into separate runtime submodules. |
 | `src/metrics.rs` | 505 | Root metrics compatibility wrappers remain just over the target after native/Wasm additions. | Move remaining Wasm metric wiring into the observability crate or a focused root adapter. |

release-notes/RELEASE_NOTES_1.7.2.md

@@ -25,6 +25,13 @@ bodies, filesystem access, network access, or admin APIs.
 - Add fail-closed coverage for forbidden header mutations. Invalid host-call
   IDs trap the plugin invocation and return `503` unless the plugin is
   explicitly configured for fail-open behavior on a non-security phase.
+- Apply vhost-level Wasm header hooks to PHP-FPM fallback responses as well as
+  route, static, and generic proxy paths.
+- Apply the shared fallback response header policy to PHP-FPM fallback
+  responses, including the default `x-powered-by` removal.
+- Compute Wasm header-hook path context from the matched pre-rewrite request
+  path so path-class policy stays stable when a route strips or rewrites the
+  upstream target.
 
 ## Security Notes
 
@@ -36,6 +43,9 @@ bodies, filesystem access, network access, or admin APIs.
   the current Wasm host-call surface.
 - Built-in Fluxheim ACLs and the `access-decision` chain still run before
   header hooks. Wasm header hooks cannot override built-in access policy.
+- PHP-FPM fallback traffic now goes through the same vhost-level header-hook
+  and fallback response-header post-processing as other fallback response
+  paths.
 - The `wasm` feature remains optional and is still rejected with
   `privacy-mode`.