middleware/cargo_compat: Implement feature flag for 200 OK status code enforcement

Author: Turbo87

src/config/server.rs

@@ -56,6 +56,10 @@ pub struct Server {
     pub cdn_user_agent: String,
     pub balance_capacity: BalanceCapacityConfig,
 
+    /// Instructs the `cargo_compat` middleware to always reply with `200 OK`
+    /// for all endpoints that are relevant for cargo.
+    pub use_cargo_compat_status_codes: bool,
+
     /// Should the server serve the frontend assets in the `dist` directory?
     pub serve_dist: bool,
 
@@ -221,6 +225,8 @@ impl Server {
             cdn_user_agent: var("WEB_CDN_USER_AGENT")?
                 .unwrap_or_else(|| "Amazon CloudFront".into()),
             balance_capacity: BalanceCapacityConfig::from_environment()?,
+            use_cargo_compat_status_codes: !var("CARGO_COMPAT_STATUS_CODES")?
+                .is_some_and(|v| v == "n"),
             serve_dist: true,
             serve_html: true,
             content_security_policy: Some(content_security_policy.parse()?),

src/middleware.rs

@@ -62,8 +62,9 @@ pub fn apply_axum_middleware(state: AppState, router: Router<()>) -> Router {
             from_fn(debug::debug_requests)
         }));
 
+    let only_200 = state.config.use_cargo_compat_status_codes;
     let middlewares_2 = tower::ServiceBuilder::new()
-        .layer(from_fn(cargo_compat::middleware))
+        .layer(from_fn_with_state(only_200, cargo_compat::middleware))
         .layer(from_fn_with_state(state.clone(), session::attach_session))
         .layer(from_fn_with_state(
             state.clone(),

src/middleware/cargo_compat.rs

@@ -1,11 +1,12 @@
-use axum::extract::{MatchedPath, Request};
+use axum::extract::{MatchedPath, Request, State};
 use axum::middleware::Next;
 use axum::response::{IntoResponse, Response};
 use axum::{Extension, Json};
 use http::{header, Method, StatusCode};
 
 /// Convert plain text errors into JSON errors and adjust status codes.
 pub async fn middleware(
+    State(use_cargo_compat_status_codes): State<bool>,
     matched_path: Option<Extension<MatchedPath>>,
     req: Request,
     next: Next,
@@ -19,7 +20,7 @@ pub async fn middleware(
     if is_api_request {
         res = ensure_json_errors(res).await;
     }
-    if is_cargo_endpoint {
+    if use_cargo_compat_status_codes && is_cargo_endpoint {
         // cargo until 1.34.0 expected crates.io to always return 200 OK for
         // all requests, even if they failed. If a different status code was
         // returned, cargo would show the raw JSON response to the user, instead
@@ -95,7 +96,7 @@ async fn convert_to_json_response(res: Response) -> anyhow::Result<Response> {
 mod tests {
     use super::*;
     use axum::body::Body;
-    use axum::middleware::from_fn;
+    use axum::middleware::from_fn_with_state;
     use axum::routing::{get, put};
     use axum::Router;
     use bytes::Bytes;
@@ -121,7 +122,7 @@ mod tests {
                 "/api/v1/crates/:crate_id/owners",
                 get(|| async { StatusCode::INTERNAL_SERVER_ERROR }),
             )
-            .layer(from_fn(middleware))
+            .layer(from_fn_with_state(true, middleware))
     }
 
     async fn request(path: &str) -> anyhow::Result<(Parts, Bytes)> {

src/tests/util/test_app.rs

@@ -427,6 +427,7 @@ fn simple_config() -> config::Server {
         version_id_cache_ttl: Duration::from_secs(5 * 60),
         cdn_user_agent: "Amazon CloudFront".to_string(),
         balance_capacity,
+        use_cargo_compat_status_codes: true,
 
         // The frontend code is not needed for the backend tests.
         serve_dist: false,