Rewrite publisher origin URLs in proxied response headers

[dhruv8sh]

Summary

• Publisher pages had origin URLs rewritten in the body but not in response headers. Browsers then followed Location/Refresh off the appliance, preloaded Link targets straight from the origin, and blocked rewritten resources under a CSP that only allowed the origin.
• Response headers now get the same origin-to-serving-host mapping as the body. Location, Content-Location, Refresh and Link (including imagesrcset) are rewritten. For CSP, a serving-host source is added beside each origin source, and no origin source is removed. Each response's own header values are rewritten, so per-page policies survive; this is not one static replacement.
• An origin redirect to the current URL under a different scheme (for example, an http:// origin forcing HTTPS) is left unchanged so it can't loop. Same-scheme redirects to the current URL, such as after a form POST, are still rewritten.

Changes

File	Change
crates/trusted-server-core/src/response_header_rewrite.rs	New module that rewrites URLs in Location, Content-Location, Refresh, Link (<target> and quoted imagesrcset) and CSP/CSP-Report-Only. CSP is additive with de-duplication, and report-uri/report-to are skipped. Includes the scheme-change loop guard and unit tests.
crates/trusted-server-core/src/publisher.rs	Calls the rewrite on every publisher route, right after the origin response and before the template-cache gate, so cached templates replay the rewritten policy headers. Adds handler tests: a 302 with an HTML body, a bodiless 301, scheme-upgrade and same-scheme redirects to the current URL, and a template-cache hit replaying the rewritten CSP/Link. Updates two schema-version pins.
crates/trusted-server-core/src/platform/template_cache.rs	Bumps TEMPLATE_SCHEMA_VERSION from 5 to 6, so templates stored with origin-only policy metadata are not replayed after deploy. Updates the golden-key test.
crates/trusted-server-core/src/lib.rs	Registers the module (pub(crate)).
docs/guide/configuration.md	Documents the header behavior, the loop exception, that [response_headers] still overrides the rewrite, and that host rewriting cannot authorize inline inserts that lack a nonce.

Closes

Closes #1128

Test plan

• cargo test-fastly && cargo test-axum (also cargo test-cloudflare, cargo test-spin, and the parity integration test)
• cargo clippy-fastly && cargo clippy-axum (also clippy-cloudflare, clippy-cloudflare-wasm, clippy-spin-native, clippy-spin-wasm)
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (Node 24.12.0, per .tool-versions)
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format (plus the markdown check outside docs/)
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: mutation check. Moving the rewrite after the template-cache policy capture makes the cache-hit replay test fail.

Not yet done: re-running the issue's browser checks (Chrome against the Axum dev server) for Location, Refresh, Link preload and the CSP img-src case.

Checklist

• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed

[prk-Jr]

Summary

Solid, well-tested change. Rewrites origin URLs in Location, Content-Location, Refresh, Link, and both CSP headers; Set-Cookie/Vary untouched. Host matching is strict and case-insensitive, multi-value headers preserve order, and the rewrite runs before template-cache capture (with the schema bump to 6) in the shared handle_publisher_request path used by all adapters. No blocking findings.

Non-blocking

• 🤔 Loop-guard escape logs only at debug (inline, suggestion)
• 🤔 Same-URL cookie-setting redirect can loop when the cookie has Domain=<origin host> (inline)
• 🌱 CSP :* / explicit default-port sources not matched (inline)
• ⛏ Docs row omits report-to (inline, suggestion)

📌 Out of scope

Set-Cookie Domain, Reporting-Endpoints/Report-To, and Access-Control-Allow-Origin still pass through unchanged. Leaving report endpoints alone matches the report-uri choice; the Set-Cookie Domain gap (see inline comment) is worth a follow-up issue. Asset-proxy routes (handle_asset_proxy_request) also bypass this rewrite, consistent with the docs saying "publisher response".

📝 Note

The PR checklist says "Uses tracing macros", but the code correctly uses log — only the checklist wording is off.

Verification

• cargo fmt --all -- --check ✅
• cargo clippy-fastly ✅ (no warnings)
• cargo test -p trusted-server-core (host) ✅ 2916 passed, 0 failed (includes 18 new response_header_rewrite tests and 5 new publisher tests)
• Both suggestions scratch-verified (fmt/clippy/tests; docs prettier check)
• CI: all 20 checks passing

[ChristianPavilonis]

Review summary

Reviewed 7871acdd56324d20c182e0c3093e5bd535dd96e9 against 80483011e30a446ac741b4423e36f8d142c5d2ac, branch fix/rewrite-origin-urls-in-response-headers into main. Approving with two P2 edge-case findings posted inline.

Inspected all five changed files and traced the rewrite through publisher response modes, cache capture/replay, all four adapters, and final header overrides. Cache-hit, repeated-policy-header, and previous-schema rejection tests confirm rewritten policy replay for the tested core cache implementation.

Validation and review context

• cargo test -p trusted-server-core response_header_rewrite --locked: 18 passed. Initial compilation timed out; rerun completed.
• cargo test -p trusted-server-core publisher::tests --locked: 372 passed.
• cargo test -p trusted-server-core platform::template_cache --locked: 32 passed.
• cargo test -p trusted-server-core --locked --quiet: 2,916 unit tests passed; 4 doctests passed, 5 ignored.
• cargo fmt --all -- --check: passed.
• An exact-module scratch executable and two node --input-type=module Chromium fixtures reproduced the inline findings.
• CI: All 20 reported checks passed; none reported failed or skipped.
• Existing feedback: Inspected the review, inline comments, unresolved threads, replies, and issue comments. Neither finding duplicates existing feedback.
• Residual risk: Browser fixtures exercised the exact rewrite module, not a deployed adapter. Adapter suites, production Fastly cache, and lint checks were not rerun locally.
• Revision remained unchanged; working tree is clean. No repository files were edited and no review work was delegated.