Add DataDome server-side protection

crates/trusted-server-adapter-fastly/src/main.rs

@@ -24,7 +24,10 @@ use trusted_server_core::ec::registry::PartnerRegistry;
 use trusted_server_core::ec::EcContext;
 use trusted_server_core::error::TrustedServerError;
 use trusted_server_core::geo::GeoInfo;
-use trusted_server_core::integrations::{IntegrationRegistry, ProxyDispatchInput};
+use trusted_server_core::integrations::{
+    IntegrationRegistry, ProxyDispatchInput, RequestFilterRegistryInput,
+    RequestFilterRegistryOutcome,
+};
 use trusted_server_core::platform::RuntimeServices;
 use trusted_server_core::proxy::{
     handle_asset_proxy_request, handle_first_party_click, handle_first_party_proxy,
@@ -322,6 +325,44 @@ async fn route_request(
         }
     }
 
+    let request_filter_effects = match integration_registry
+        .filter_request(RequestFilterRegistryInput {
+            settings,
+            services: runtime_services,
+            req: &mut req,
+        })
+        .await
+    {
+        Ok(RequestFilterRegistryOutcome::Continue(effects)) => effects,
+        Ok(RequestFilterRegistryOutcome::Respond { response, effects }) => {
+            let mut response = *response;
+            ec_finalize_response(
+                settings,
+                &ec_context,
+                finalize_kv_graph.as_ref(),
+                partner_registry,
+                eids_cookie.as_deref(),
+                sharedid_cookie.as_deref(),
+                &mut response,
+            );
+            finalize_response(settings, geo_info.as_ref(), &mut response);
+            effects.apply_to_response(&mut response);
+            return Ok(RouteOutcome {
+                response: Some(response),
+                pull_sync_context: None,
+            });
+        }
+        Err(e) => {
+            log::error!("Failed to run integration request filters: {:?}", e);
+            let mut response = to_error_response(&e);
+            finalize_response(settings, geo_info.as_ref(), &mut response);
+            return Ok(RouteOutcome {
+                response: Some(response),
+                pull_sync_context: None,
+            });
+        }
+    };
+
     // Get path and method for routing
     let path = req.get_path().to_string();
     let method = req.get_method().clone();
@@ -446,6 +487,7 @@ async fn route_request(
                                 asset_response.into_response_and_body();
                             if let Some(body) = stream_body {
                                 finalize_response(settings, geo_info.as_ref(), &mut response);
+                                request_filter_effects.apply_to_response(&mut response);
                                 asset_cache_policy.apply_after_route_finalization(&mut response);
 
                                 let mut streaming_body = response.stream_to_client();
@@ -502,6 +544,7 @@ async fn route_request(
                             &mut response,
                         );
                         finalize_response(settings, geo_info.as_ref(), &mut response);
+                        request_filter_effects.apply_to_response(&mut response);
 
                         let mut streaming_body = response.stream_to_client();
                         let mut stream_succeeded = false;
@@ -568,6 +611,7 @@ async fn route_request(
     }
 
     finalize_response(settings, geo_info.as_ref(), &mut response);
+    request_filter_effects.apply_to_response(&mut response);
     asset_cache_policy.apply_after_route_finalization(&mut response);
 
     let pull_sync_context = if is_real_browser && organic_route && route_succeeded {

crates/trusted-server-adapter-fastly/src/platform.rs

@@ -521,6 +521,10 @@ pub fn build_runtime_services(
             client_ip: req.get_client_ip_addr(),
             tls_protocol: req.get_tls_protocol().map(str::to_string),
             tls_cipher: req.get_tls_cipher_openssl_name().map(str::to_string),
+            tls_ja4: req.get_tls_ja4().map(str::to_string),
+            h2_fingerprint: req.get_client_h2_fingerprint().map(str::to_string),
+            server_hostname: std::env::var("FASTLY_HOSTNAME").ok(),
+            server_region: std::env::var("FASTLY_REGION").ok(),
         })
         .build()
 }