From cf09716727fd581242f9d8f1ea0abaf59e443e76 Mon Sep 17 00:00:00 2001
From: prk-Jr <erbhattprakash@gmail.com>
Date: Thu, 22 Jan 2026 16:40:55 +0530
Subject: [PATCH 1/7] Configure clippy lints

Setup workspace lints to enforce coding standards
and catch issues during development. 303 tests pass.

Resolves: #189
---
 .github/workflows/format.yml                  |  4 ++--
 Cargo.toml                                    | 20 +++++++++++++++++++
 clippy.toml                                   | 12 +++++++++++
 crates/common/Cargo.toml                      |  3 +++
 crates/common/build.rs                        |  2 ++
 crates/common/src/cookies.rs                  |  1 +
 crates/common/src/creative.rs                 |  2 ++
 crates/common/src/fastly_storage.rs           |  1 +
 crates/common/src/geo.rs                      |  2 ++
 crates/common/src/html_processor.rs           |  5 ++++-
 crates/common/src/http_util.rs                | 10 ++++++++--
 crates/common/src/integrations/didomi.rs      |  1 +
 crates/common/src/integrations/lockr.rs       |  6 ++++--
 .../integrations/nextjs/html_post_process.rs  |  1 +
 crates/common/src/integrations/nextjs/mod.rs  |  1 +
 crates/common/src/integrations/nextjs/rsc.rs  |  8 +++++---
 .../integrations/nextjs/rsc_placeholders.rs   |  1 +
 .../integrations/nextjs/script_rewriter.rs    |  1 +
 crates/common/src/integrations/permutive.rs   |  7 ++++---
 crates/common/src/integrations/prebid.rs      |  1 +
 crates/common/src/integrations/registry.rs    | 11 ++++++++++
 crates/common/src/integrations/testlight.rs   |  2 +-
 crates/common/src/openrtb.rs                  |  2 +-
 .../common/src/request_signing/discovery.rs   |  1 +
 .../common/src/request_signing/endpoints.rs   |  6 ++++++
 crates/common/src/request_signing/jwks.rs     |  3 +++
 crates/common/src/request_signing/rotation.rs |  2 ++
 crates/common/src/settings.rs                 |  5 ++++-
 crates/common/src/streaming_processor.rs      | 10 ++++++----
 crates/common/src/streaming_replacer.rs       |  7 +++++--
 crates/common/src/test_support.rs             |  2 ++
 crates/common/src/tsjs.rs                     |  2 ++
 crates/fastly/Cargo.toml                      |  3 +++
 crates/js/Cargo.toml                          |  3 +++
 crates/js/build.rs                            |  2 ++
 crates/js/src/bundle.rs                       |  6 ++++++
 36 files changed, 134 insertions(+), 22 deletions(-)
 create mode 100644 clippy.toml

diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 45ab1aea..8021f2c5 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -41,8 +41,8 @@ jobs:
       - name: Run cargo fmt
         uses: actions-rust-lang/rustfmt@v1
 
-      - name: Run cargo clipply
-        run: cargo clippy --all-targets --all-features
+      - name: Run cargo clippy
+        run: cargo clippy --all-targets --all-features -- -D warnings
 
   format-typescript:
     runs-on: ubuntu-latest
diff --git a/Cargo.toml b/Cargo.toml
index 9545c847..9af3807f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,6 +12,26 @@ default-members = [
     "crates/fastly",
 ]
 
+[workspace.lints.clippy]
+# Correctness
+unwrap_used = "warn"
+expect_used = "allow"
+panic = "warn"
+
+# Style
+module_name_repetitions = "allow"
+must_use_candidate = "warn"
+
+# Pedantic (selective)
+doc_markdown = "warn"
+# missing_errors_doc = "warn"
+# missing_panics_doc = "warn"
+
+# Restriction (selective)
+print_stdout = "warn"
+print_stderr = "warn"
+dbg_macro = "warn"
+
 [profile.release]
 debug = 1
 
diff --git a/clippy.toml b/clippy.toml
new file mode 100644
index 00000000..17f78bc6
--- /dev/null
+++ b/clippy.toml
@@ -0,0 +1,12 @@
+# Clippy configuration for trusted-server
+# See: https://doc.rust-lang.org/clippy/configuration.html
+
+# Cognitive complexity threshold for functions
+cognitive-complexity-threshold = 30
+
+# Maximum number of lines in a function
+too-many-lines-threshold = 200
+
+# Allow module name repetitions in reexports
+allow-expect-in-tests = true
+allow-unwrap-in-tests = true
diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml
index ab3058ce..17a0e04b 100644
--- a/crates/common/Cargo.toml
+++ b/crates/common/Cargo.toml
@@ -8,6 +8,9 @@ edition = "2021"
 publish = false
 license = "Apache-2.0"
 
+[lints]
+workspace = true
+
 [dependencies]
 base64 = { workspace = true }
 brotli = { workspace = true }
diff --git a/crates/common/build.rs b/crates/common/build.rs
index d7b020b2..c8facdda 100644
--- a/crates/common/build.rs
+++ b/crates/common/build.rs
@@ -1,3 +1,5 @@
+#![allow(clippy::unwrap_used, clippy::panic)]
+
 #[path = "src/error.rs"]
 mod error;
 
diff --git a/crates/common/src/cookies.rs b/crates/common/src/cookies.rs
index de78b109..48f397bb 100644
--- a/crates/common/src/cookies.rs
+++ b/crates/common/src/cookies.rs
@@ -62,6 +62,7 @@ pub fn handle_request_cookies(
 ///
 /// Generates a properly formatted cookie with security attributes
 /// for storing the synthetic ID.
+#[must_use]
 pub fn create_synthetic_cookie(settings: &Settings, synthetic_id: &str) -> String {
     format!(
         "synthetic_id={}; Domain={}; Path=/; Secure; SameSite=Lax; Max-Age={}",
diff --git a/crates/common/src/creative.rs b/crates/common/src/creative.rs
index 02041dd9..7cf1cad5 100644
--- a/crates/common/src/creative.rs
+++ b/crates/common/src/creative.rs
@@ -291,6 +291,7 @@ pub(super) fn proxied_attr_value(settings: &Settings, attr_val: Option<String>)
 
 /// Rewrite a full CSS stylesheet body by normalizing url(...) references to the
 /// unified first-party proxy. Relative URLs are left unchanged.
+#[must_use]
 pub fn rewrite_css_body(css: &str, settings: &Settings) -> String {
     rewrite_style_urls(css, settings)
 }
@@ -301,6 +302,7 @@ pub fn rewrite_css_body(css: &str, settings: &Settings) -> String {
 /// - `<iframe src>` (absolute or protocol-relative) → `/first-party/proxy?tsurl=&lt;base-url&gt;&lt;params&gt;&tstoken=&lt;sig&gt;`
 /// - Injects the `tsjs-creative` script once at the top of `<body>` to safeguard click URLs inside creatives
 ///   (served from `/static/tsjs=tsjs-creative.min.js`).
+#[must_use]
 pub fn rewrite_creative_html(markup: &str, settings: &Settings) -> String {
     // No size parsing needed now; all absolute/protocol-relative URLs are proxied uniformly.
     let mut out = Vec::with_capacity(markup.len() + 64);
diff --git a/crates/common/src/fastly_storage.rs b/crates/common/src/fastly_storage.rs
index c4a8241f..c88a3ae1 100644
--- a/crates/common/src/fastly_storage.rs
+++ b/crates/common/src/fastly_storage.rs
@@ -278,6 +278,7 @@ impl FastlyApiClient {
 }
 
 #[cfg(test)]
+#[allow(clippy::print_stdout, clippy::print_stderr)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/geo.rs b/crates/common/src/geo.rs
index f3af0425..8d6b2fde 100644
--- a/crates/common/src/geo.rs
+++ b/crates/common/src/geo.rs
@@ -71,11 +71,13 @@ impl GeoInfo {
     }
 
     /// Returns coordinates as a formatted string "latitude,longitude"
+    #[must_use]
     pub fn coordinates_string(&self) -> String {
         format!("{},{}", self.latitude, self.longitude)
     }
 
     /// Checks if a valid metro code is available (non-zero)
+    #[must_use]
     pub fn has_metro_code(&self) -> bool {
         self.metro_code > 0
     }
diff --git a/crates/common/src/html_processor.rs b/crates/common/src/html_processor.rs
index 1803436e..1bbd5507 100644
--- a/crates/common/src/html_processor.rs
+++ b/crates/common/src/html_processor.rs
@@ -1,6 +1,6 @@
 //! Simplified HTML processor that combines URL replacement and Prebid injection
 //!
-//! This module provides a StreamProcessor implementation for HTML content.
+//! This module provides a `StreamProcessor` implementation for HTML content.
 use std::cell::Cell;
 use std::io;
 use std::rc::Rc;
@@ -94,6 +94,7 @@ pub struct HtmlProcessorConfig {
 
 impl HtmlProcessorConfig {
     /// Create from settings and request parameters
+    #[must_use]
     pub fn from_settings(
         _settings: &Settings,
         integrations: &IntegrationRegistry,
@@ -111,6 +112,7 @@ impl HtmlProcessorConfig {
 }
 
 /// Create an HTML processor with URL replacement and optional Prebid injection
+#[must_use]
 pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcessor {
     let post_processors = config.integrations.html_post_processors();
     let document_state = IntegrationDocumentState::default();
@@ -452,6 +454,7 @@ pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcesso
 }
 
 #[cfg(test)]
+#[allow(clippy::print_stdout, clippy::print_stderr)]
 mod tests {
     use super::*;
     use crate::integrations::{
diff --git a/crates/common/src/http_util.rs b/crates/common/src/http_util.rs
index 132d6bd8..f137a7ec 100644
--- a/crates/common/src/http_util.rs
+++ b/crates/common/src/http_util.rs
@@ -6,7 +6,7 @@ use sha2::{Digest, Sha256};
 
 use crate::settings::Settings;
 
-/// Build a static text response with strong ETag and standard caching headers.
+/// Build a static text response with strong `ETag` and standard caching headers.
 /// Handles If-None-Match to return 304 when appropriate.
 pub fn serve_static_with_etag(body: &str, req: &Request, content_type: &str) -> Response {
     // Compute ETag for conditional caching
@@ -44,6 +44,7 @@ pub fn serve_static_with_etag(body: &str, req: &Request, content_type: &str) ->
 
 /// Encrypts a URL using XChaCha20-Poly1305 with a key derived from the publisher `proxy_secret`.
 /// Returns a Base64 URL-safe (no padding) token: b"x1" || nonce(24) || ciphertext+tag.
+#[must_use]
 pub fn encode_url(settings: &Settings, plaintext_url: &str) -> String {
     // Derive a 32-byte key via SHA-256(secret)
     let key_bytes = Sha256::digest(settings.publisher.proxy_secret.as_bytes());
@@ -71,6 +72,7 @@ pub fn encode_url(settings: &Settings, plaintext_url: &str) -> String {
 }
 
 /// Decrypts and verifies a token produced by `encode_url`. Returns None if invalid.
+#[must_use]
 pub fn decode_url(settings: &Settings, token: &str) -> Option<String> {
     let data = URL_SAFE_NO_PAD.decode(token.as_bytes()).ok()?;
     if data.len() < 2 + 24 + 16 {
@@ -92,11 +94,12 @@ pub fn decode_url(settings: &Settings, token: &str) -> Option<String> {
 }
 
 /// Compute a deterministic signature token (tstoken) for a clear-text URL using the
-/// publisher's proxy_secret. This enables proxy URLs to retain the original URL in
+/// publisher's `proxy_secret`. This enables proxy URLs to retain the original URL in
 /// clear text while still providing integrity/authenticity via a keyed digest.
 ///
 /// Token format: Base64 URL-safe (no padding) of SHA-256("ts-proxy-v2" || secret || url)
 /// - Not intended as a general HMAC; sufficient for validating unmodified URLs under a secret.
+#[must_use]
 pub fn sign_clear_url(settings: &Settings, clear_url: &str) -> String {
     let mut hasher = Sha256::new();
     hasher.update(b"ts-proxy-v2");
@@ -107,6 +110,7 @@ pub fn sign_clear_url(settings: &Settings, clear_url: &str) -> String {
 }
 
 /// Verify a `tstoken` for the given clear-text URL.
+#[must_use]
 pub fn verify_clear_url_signature(settings: &Settings, clear_url: &str, token: &str) -> bool {
     sign_clear_url(settings, clear_url) == token
 }
@@ -118,6 +122,7 @@ pub fn verify_clear_url_signature(settings: &Settings, clear_url: &str, token: &
 /// 2) Base64-decode the `x1||nonce||ciphertext+tag` bytes
 /// 3) Compute SHA-256 over those bytes
 /// 4) Return Base64 URL-safe (no padding) digest as `tstoken`
+#[must_use]
 pub fn compute_encrypted_sha256_token(settings: &Settings, full_url: &str) -> String {
     // Encrypt deterministically using existing helper
     let enc = encode_url(settings, full_url);
@@ -128,6 +133,7 @@ pub fn compute_encrypted_sha256_token(settings: &Settings, full_url: &str) -> St
 }
 
 #[cfg(test)]
+#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/integrations/didomi.rs b/crates/common/src/integrations/didomi.rs
index 6c1a2ed0..773dc050 100644
--- a/crates/common/src/integrations/didomi.rs
+++ b/crates/common/src/integrations/didomi.rs
@@ -167,6 +167,7 @@ fn build(settings: &Settings) -> Option<Arc<DidomiIntegration>> {
 }
 
 /// Register the Didomi consent notice integration when enabled.
+#[must_use]
 pub fn register(settings: &Settings) -> Option<IntegrationRegistration> {
     let integration = build(settings)?;
     Some(
diff --git a/crates/common/src/integrations/lockr.rs b/crates/common/src/integrations/lockr.rs
index 014e2265..cc79f697 100644
--- a/crates/common/src/integrations/lockr.rs
+++ b/crates/common/src/integrations/lockr.rs
@@ -44,12 +44,12 @@ pub struct LockrConfig {
     #[validate(length(min = 1))]
     pub app_id: String,
 
-    /// Base URL for Lockr API (default: https://identity.lockr.kr)
+    /// Base URL for Lockr API (default: <https://identity.lockr.kr>)
     #[serde(default = "default_api_endpoint")]
     #[validate(url)]
     pub api_endpoint: String,
 
-    /// SDK URL (default: https://aim.loc.kr/identity-lockr-v1.0.js)
+    /// SDK URL (default: <https://aim.loc.kr/identity-lockr-v1.0.js>)
     #[serde(default = "default_sdk_url")]
     #[validate(url)]
     pub sdk_url: String,
@@ -299,6 +299,7 @@ fn build(settings: &Settings) -> Option<Arc<LockrIntegration>> {
 }
 
 /// Register the Lockr integration.
+#[must_use]
 pub fn register(settings: &Settings) -> Option<IntegrationRegistration> {
     let integration = build(settings)?;
     Some(
@@ -396,6 +397,7 @@ fn default_rewrite_sdk_host() -> bool {
 }
 
 #[cfg(test)]
+#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/integrations/nextjs/html_post_process.rs b/crates/common/src/integrations/nextjs/html_post_process.rs
index f3798725..c6ded2f6 100644
--- a/crates/common/src/integrations/nextjs/html_post_process.rs
+++ b/crates/common/src/integrations/nextjs/html_post_process.rs
@@ -333,6 +333,7 @@ fn find_rsc_push_scripts(html: &str) -> Vec<RscPushScriptRange> {
     since = "0.1.0",
     note = "Use NextJsHtmlPostProcessor for production RSC rewriting. This function re-parses HTML."
 )]
+#[must_use]
 pub fn post_process_rsc_html(
     html: &str,
     origin_host: &str,
diff --git a/crates/common/src/integrations/nextjs/mod.rs b/crates/common/src/integrations/nextjs/mod.rs
index d79e98c2..8ce8222f 100644
--- a/crates/common/src/integrations/nextjs/mod.rs
+++ b/crates/common/src/integrations/nextjs/mod.rs
@@ -56,6 +56,7 @@ fn default_max_combined_payload_bytes() -> usize {
     10 * 1024 * 1024
 }
 
+#[must_use]
 pub fn register(settings: &Settings) -> Option<IntegrationRegistration> {
     let config = match build(settings) {
         Some(config) => {
diff --git a/crates/common/src/integrations/nextjs/rsc.rs b/crates/common/src/integrations/nextjs/rsc.rs
index 534c912e..3b5bea3d 100644
--- a/crates/common/src/integrations/nextjs/rsc.rs
+++ b/crates/common/src/integrations/nextjs/rsc.rs
@@ -3,7 +3,7 @@ use regex::Regex;
 
 use super::shared::RscUrlRewriter;
 
-/// T-chunk header pattern: hex_id:Thex_length,
+/// T-chunk header pattern: `hex_id:Thex_length`,
 static TCHUNK_PATTERN: Lazy<Regex> =
     Lazy::new(|| Regex::new(r"([0-9a-fA-F]+):T([0-9a-fA-F]+),").expect("valid T-chunk regex"));
 
@@ -13,8 +13,8 @@ pub(crate) const RSC_MARKER: &str = "\x00SPLIT\x00";
 /// Default maximum combined payload size for cross-script processing (10 MB).
 pub(crate) const DEFAULT_MAX_COMBINED_PAYLOAD_BYTES: usize = 10 * 1024 * 1024;
 
-/// Maximum reasonable T-chunk length to prevent DoS from malformed input (100 MB).
-/// A T-chunk larger than this is almost certainly malformed and would cause excessive
+/// Maximum reasonable T-chunk length to prevent `DoS` from malformed input (100 MB).
+/// A `T-chunk` larger than this is almost certainly malformed and would cause excessive
 /// memory allocation or iteration.
 const MAX_REASONABLE_TCHUNK_LENGTH: usize = 100 * 1024 * 1024;
 
@@ -328,6 +328,7 @@ fn calculate_unescaped_byte_length_skip_markers(s: &str) -> usize {
 }
 
 /// Process multiple RSC script payloads together, handling cross-script T-chunks.
+#[must_use]
 pub fn rewrite_rsc_scripts_combined(
     payloads: &[&str],
     origin_host: &str,
@@ -479,6 +480,7 @@ pub(crate) fn rewrite_rsc_scripts_combined_with_limit(
 }
 
 #[cfg(test)]
+#[allow(clippy::print_stdout, clippy::print_stderr)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/integrations/nextjs/rsc_placeholders.rs b/crates/common/src/integrations/nextjs/rsc_placeholders.rs
index e26a98fe..e29e2487 100644
--- a/crates/common/src/integrations/nextjs/rsc_placeholders.rs
+++ b/crates/common/src/integrations/nextjs/rsc_placeholders.rs
@@ -102,6 +102,7 @@ impl IntegrationScriptRewriter for NextJsRscPlaceholderRewriter {
 }
 
 #[cfg(test)]
+#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
     use crate::integrations::IntegrationDocumentState;
diff --git a/crates/common/src/integrations/nextjs/script_rewriter.rs b/crates/common/src/integrations/nextjs/script_rewriter.rs
index 4df34935..192eaa47 100644
--- a/crates/common/src/integrations/nextjs/script_rewriter.rs
+++ b/crates/common/src/integrations/nextjs/script_rewriter.rs
@@ -232,6 +232,7 @@ impl UrlRewriter {
 }
 
 #[cfg(test)]
+#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
     use crate::integrations::IntegrationDocumentState;
diff --git a/crates/common/src/integrations/permutive.rs b/crates/common/src/integrations/permutive.rs
index 6d565e85..27cd668f 100644
--- a/crates/common/src/integrations/permutive.rs
+++ b/crates/common/src/integrations/permutive.rs
@@ -41,12 +41,12 @@ pub struct PermutiveConfig {
     #[serde(default)]
     pub project_id: String,
 
-    /// Base URL for Permutive API (default: https://api.permutive.com)
+    /// Base URL for Permutive API (default: <https://api.permutive.com>)
     #[serde(default = "default_api_endpoint")]
     #[validate(url)]
     pub api_endpoint: String,
 
-    /// Base URL for Permutive Secure Signals (default: https://secure-signals.permutive.app)
+    /// Base URL for Permutive Secure Signals (default: <https://secure-signals.permutive.app>)
     #[serde(default = "default_secure_signals_endpoint")]
     #[validate(url)]
     pub secure_signals_endpoint: String,
@@ -85,7 +85,7 @@ impl PermutiveIntegration {
     }
 
     /// Build the Permutive SDK URL from configuration.
-    /// Returns URL like: https://myorg.edge.permutive.app/workspace-12345-web.js
+    /// Returns URL like: <https://myorg.edge.permutive.app/workspace-12345-web.js>
     fn sdk_url(&self) -> String {
         format!(
             "https://{}.edge.permutive.app/{}-web.js",
@@ -521,6 +521,7 @@ fn build(settings: &Settings) -> Option<Arc<PermutiveIntegration>> {
 }
 
 /// Register the Permutive integration.
+#[must_use]
 pub fn register(settings: &Settings) -> Option<IntegrationRegistration> {
     let integration = build(settings)?;
     Some(
diff --git a/crates/common/src/integrations/prebid.rs b/crates/common/src/integrations/prebid.rs
index 51b1b9fd..7a11c99e 100644
--- a/crates/common/src/integrations/prebid.rs
+++ b/crates/common/src/integrations/prebid.rs
@@ -252,6 +252,7 @@ fn build(settings: &Settings) -> Option<Arc<PrebidIntegration>> {
     Some(PrebidIntegration::new(config))
 }
 
+#[must_use]
 pub fn register(settings: &Settings) -> Option<IntegrationRegistration> {
     let integration = build(settings)?;
     Some(
diff --git a/crates/common/src/integrations/registry.rs b/crates/common/src/integrations/registry.rs
index 819890dc..cb6fcc3e 100644
--- a/crates/common/src/integrations/registry.rs
+++ b/crates/common/src/integrations/registry.rs
@@ -116,6 +116,7 @@ impl std::fmt::Debug for IntegrationDocumentState {
 }
 
 impl IntegrationDocumentState {
+    #[must_use]
     pub fn get<T>(&self, integration_id: &'static str) -> Option<Arc<T>>
     where
         T: Any + Send + Sync + 'static,
@@ -487,6 +488,8 @@ pub struct IntegrationRegistry {
 
 impl IntegrationRegistry {
     /// Build a registry from the provided settings.
+    #[must_use]
+    #[allow(clippy::panic, clippy::unwrap_used)]
     pub fn new(settings: &Settings) -> Self {
         let mut inner = IntegrationRegistryInner::default();
 
@@ -561,11 +564,13 @@ impl IntegrationRegistry {
     }
 
     /// Return true when any proxy is registered for the provided route.
+    #[must_use]
     pub fn has_route(&self, method: &Method, path: &str) -> bool {
         self.find_route(method, path).is_some()
     }
 
     /// Dispatch a proxy request when an integration handles the path.
+    #[must_use]
     pub async fn handle_proxy(
         &self,
         method: &Method,
@@ -581,6 +586,7 @@ impl IntegrationRegistry {
     }
 
     /// Give integrations a chance to rewrite HTML attributes.
+    #[must_use]
     pub fn rewrite_attribute(
         &self,
         attr_name: &str,
@@ -613,16 +619,19 @@ impl IntegrationRegistry {
     }
 
     /// Expose registered script/text rewriters for HTML processing.
+    #[must_use]
     pub fn script_rewriters(&self) -> Vec<Arc<dyn IntegrationScriptRewriter>> {
         self.inner.script_rewriters.clone()
     }
 
     /// Expose registered HTML post-processors.
+    #[must_use]
     pub fn html_post_processors(&self) -> Vec<Arc<dyn IntegrationHtmlPostProcessor>> {
         self.inner.html_post_processors.clone()
     }
 
     /// Provide a snapshot of registered integrations and their hooks.
+    #[must_use]
     pub fn registered_integrations(&self) -> Vec<IntegrationMetadata> {
         let mut map: BTreeMap<&'static str, IntegrationMetadata> = BTreeMap::new();
 
@@ -653,6 +662,7 @@ impl IntegrationRegistry {
     }
 
     #[cfg(test)]
+    #[must_use]
     pub fn from_rewriters(
         attribute_rewriters: Vec<Arc<dyn IntegrationAttributeRewriter>>,
         script_rewriters: Vec<Arc<dyn IntegrationScriptRewriter>>,
@@ -673,6 +683,7 @@ impl IntegrationRegistry {
     }
 
     #[cfg(test)]
+    #[must_use]
     pub fn from_routes(routes: Vec<(Method, &str, RouteValue)>) -> Self {
         let mut get_router = Router::new();
         let mut post_router = Router::new();
diff --git a/crates/common/src/integrations/testlight.rs b/crates/common/src/integrations/testlight.rs
index 31aaac2a..7b11f98f 100644
--- a/crates/common/src/integrations/testlight.rs
+++ b/crates/common/src/integrations/testlight.rs
@@ -108,7 +108,7 @@ fn build(settings: &Settings) -> Option<Arc<TestlightIntegration>> {
 
     Some(TestlightIntegration::new(config))
 }
-
+#[must_use]
 pub fn register(settings: &Settings) -> Option<IntegrationRegistration> {
     let integration = build(settings)?;
     Some(
diff --git a/crates/common/src/openrtb.rs b/crates/common/src/openrtb.rs
index c73f974f..2544e491 100644
--- a/crates/common/src/openrtb.rs
+++ b/crates/common/src/openrtb.rs
@@ -1,7 +1,7 @@
 use serde::Serialize;
 use serde_json::Value;
 
-/// Minimal subset of OpenRTB 2.x bid request used by Trusted Server.
+/// Minimal subset of `OpenRTB` 2.x bid request used by Trusted Server.
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "lowercase")]
 pub struct OpenRtbRequest {
diff --git a/crates/common/src/request_signing/discovery.rs b/crates/common/src/request_signing/discovery.rs
index b5de8370..964027e3 100644
--- a/crates/common/src/request_signing/discovery.rs
+++ b/crates/common/src/request_signing/discovery.rs
@@ -18,6 +18,7 @@ pub struct TrustedServerDiscovery {
 
 impl TrustedServerDiscovery {
     /// Creates a new discovery document with the given JWKS
+    #[must_use]
     pub fn new(jwks_value: serde_json::Value) -> Self {
         Self {
             version: "1.0".to_string(),
diff --git a/crates/common/src/request_signing/endpoints.rs b/crates/common/src/request_signing/endpoints.rs
index c3073ac2..21b9c134 100644
--- a/crates/common/src/request_signing/endpoints.rs
+++ b/crates/common/src/request_signing/endpoints.rs
@@ -319,6 +319,12 @@ pub fn handle_deactivate_key(
 }
 
 #[cfg(test)]
+#[allow(
+    clippy::print_stdout,
+    clippy::print_stderr,
+    clippy::unwrap_used,
+    clippy::panic
+)]
 mod tests {
     use super::*;
     use fastly::http::{Method, StatusCode};
diff --git a/crates/common/src/request_signing/jwks.rs b/crates/common/src/request_signing/jwks.rs
index abbf20cd..121fd02d 100644
--- a/crates/common/src/request_signing/jwks.rs
+++ b/crates/common/src/request_signing/jwks.rs
@@ -19,6 +19,7 @@ pub struct Keypair {
 }
 
 impl Keypair {
+    #[must_use]
     pub fn generate() -> Self {
         let mut csprng = OsRng;
 
@@ -31,6 +32,7 @@ impl Keypair {
         }
     }
 
+    #[must_use]
     pub fn get_jwk(&self, kid: String) -> Jwk {
         let public_key_bytes = self.verifying_key.as_bytes();
 
@@ -72,6 +74,7 @@ pub fn get_active_jwks() -> Result<String, TrustedServerError> {
 }
 
 #[cfg(test)]
+#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
     use ed25519_dalek::{Signer, Verifier};
diff --git a/crates/common/src/request_signing/rotation.rs b/crates/common/src/request_signing/rotation.rs
index fd77dcaf..fe3d34e3 100644
--- a/crates/common/src/request_signing/rotation.rs
+++ b/crates/common/src/request_signing/rotation.rs
@@ -163,12 +163,14 @@ impl KeyRotationManager {
     }
 }
 
+#[must_use]
 pub fn generate_date_based_kid() -> String {
     use chrono::Utc;
     format!("ts-{}", Utc::now().format("%Y-%m-%d"))
 }
 
 #[cfg(test)]
+#[allow(clippy::print_stdout, clippy::print_stderr)]
 mod tests {
     use crate::request_signing::Keypair;
 
diff --git a/crates/common/src/settings.rs b/crates/common/src/settings.rs
index 4a41b1ec..839a78e4 100644
--- a/crates/common/src/settings.rs
+++ b/crates/common/src/settings.rs
@@ -27,7 +27,7 @@ pub struct Publisher {
 }
 
 impl Publisher {
-    /// Extracts the host (including port if present) from the origin_url.
+    /// Extracts the host (including port if present) from the `origin_url`.
     ///
     /// # Examples
     ///
@@ -42,6 +42,7 @@ impl Publisher {
     /// assert_eq!(publisher.origin_host(), "origin.example.com:8080");
     /// ```
     #[allow(dead_code)]
+    #[must_use]
     pub fn origin_host(&self) -> String {
         Url::parse(&self.origin_url)
             .ok()
@@ -198,6 +199,7 @@ pub struct Rewrite {
 impl Rewrite {
     /// Checks if a URL should be excluded from rewriting based on domain matching
     #[allow(dead_code)]
+    #[must_use]
     pub fn is_excluded(&self, url: &str) -> bool {
         // Parse URL to extract host
         let Ok(parsed) = url::Url::parse(url) else {
@@ -425,6 +427,7 @@ where
 }
 
 #[cfg(test)]
+#[allow(clippy::print_stderr, clippy::unwrap_used)]
 mod tests {
     use super::*;
     use regex::Regex;
diff --git a/crates/common/src/streaming_processor.rs b/crates/common/src/streaming_processor.rs
index eb5d6081..a039d18e 100644
--- a/crates/common/src/streaming_processor.rs
+++ b/crates/common/src/streaming_processor.rs
@@ -38,6 +38,7 @@ pub enum Compression {
 
 impl Compression {
     /// Detect compression from content-encoding header
+    #[must_use]
     pub fn from_content_encoding(encoding: &str) -> Self {
         match encoding.to_lowercase().as_str() {
             "gzip" => Self::Gzip,
@@ -436,10 +437,10 @@ impl<P: StreamProcessor> StreamingPipeline<P> {
     }
 }
 
-/// Adapter to use lol_html HtmlRewriter as a StreamProcessor
-/// Important: Due to lol_html's ownership model, we must accumulate input
+/// Adapter to use `lol_html` `HtmlRewriter` as a `StreamProcessor`
+/// Important: Due to `lol_html`'s ownership model, we must accumulate input
 /// and process it all at once when the stream ends. This is a limitation
-/// of the lol_html library's API design.
+/// of the `lol_html` library's API design.
 pub struct HtmlRewriterAdapter {
     settings: lol_html::Settings<'static, 'static>,
     accumulated_input: Vec<u8>,
@@ -447,6 +448,7 @@ pub struct HtmlRewriterAdapter {
 
 impl HtmlRewriterAdapter {
     /// Create a new HTML rewriter adapter
+    #[must_use]
     pub fn new(settings: lol_html::Settings<'static, 'static>) -> Self {
         Self {
             settings,
@@ -513,7 +515,7 @@ impl StreamProcessor for HtmlRewriterAdapter {
     }
 }
 
-/// Adapter to use our existing StreamingReplacer as a StreamProcessor
+/// Adapter to use our existing `StreamingReplacer` as a `StreamProcessor`
 use crate::streaming_replacer::StreamingReplacer;
 
 impl StreamProcessor for StreamingReplacer {
diff --git a/crates/common/src/streaming_replacer.rs b/crates/common/src/streaming_replacer.rs
index 9b975c51..1bfa370e 100644
--- a/crates/common/src/streaming_replacer.rs
+++ b/crates/common/src/streaming_replacer.rs
@@ -31,6 +31,7 @@ impl StreamingReplacer {
     /// # Arguments
     ///
     /// * `replacements` - List of string replacements to perform
+    #[must_use]
     pub fn new(replacements: Vec<Replacement>) -> Self {
         // Calculate the maximum pattern length we need to buffer
         let max_pattern_length = replacements.iter().map(|r| r.find.len()).max().unwrap_or(0);
@@ -48,6 +49,7 @@ impl StreamingReplacer {
     ///
     /// * `find` - The string to find
     /// * `replace_with` - The string to replace it with
+    #[must_use]
     pub fn new_single(find: &str, replace_with: &str) -> Self {
         Self::new(vec![Replacement {
             find: find.to_string(),
@@ -146,10 +148,11 @@ impl StreamingReplacer {
 }
 
 // Note: The stream_process function has been removed in favor of using
-// StreamingPipeline from the streaming_processor module, which provides
+// `StreamingPipeline` from the `streaming_processor` module, which provides
 // a more comprehensive solution with compression support.
 
-/// Helper function to create a StreamingReplacer for URL replacements
+/// Helper function to create a `StreamingReplacer` for URL replacements
+#[must_use]
 pub fn create_url_replacer(
     origin_host: &str,
     origin_url: &str,
diff --git a/crates/common/src/test_support.rs b/crates/common/src/test_support.rs
index 3b2f85c7..dc2bea4b 100644
--- a/crates/common/src/test_support.rs
+++ b/crates/common/src/test_support.rs
@@ -2,6 +2,7 @@
 pub mod tests {
     use crate::settings::Settings;
 
+    #[must_use]
     pub fn crate_test_settings_str() -> String {
         r#"
             [[handlers]]
@@ -35,6 +36,7 @@ pub mod tests {
             "#.to_string()
     }
 
+    #[must_use]
     pub fn create_test_settings() -> Settings {
         let toml_str = crate_test_settings_str();
         Settings::from_toml(&toml_str).expect("Invalid config")
diff --git a/crates/common/src/tsjs.rs b/crates/common/src/tsjs.rs
index 26690da4..d15b9133 100644
--- a/crates/common/src/tsjs.rs
+++ b/crates/common/src/tsjs.rs
@@ -22,11 +22,13 @@ fn script_tag_for(bundle: TsjsBundle, attrs: &str) -> String {
 }
 
 /// `/static` URL for the unified bundle with cache-busting hash.
+#[must_use]
 pub fn unified_script_src() -> String {
     script_src_for(TsjsBundle::Unified)
 }
 
 /// `<script>` tag for injecting the unified bundle.
+#[must_use]
 pub fn unified_script_tag() -> String {
     script_tag_for(TsjsBundle::Unified, "id=\"trustedserver-js\"")
 }
diff --git a/crates/fastly/Cargo.toml b/crates/fastly/Cargo.toml
index 35824a5a..42fae0c2 100644
--- a/crates/fastly/Cargo.toml
+++ b/crates/fastly/Cargo.toml
@@ -3,6 +3,9 @@ name = "trusted-server-fastly"
 version = "0.1.0"
 edition = "2021"
 
+[lints]
+workspace = true
+
 [dependencies]
 chrono = { workspace = true }
 error-stack = { workspace = true }
diff --git a/crates/js/Cargo.toml b/crates/js/Cargo.toml
index 1ebd7550..1917e9b8 100644
--- a/crates/js/Cargo.toml
+++ b/crates/js/Cargo.toml
@@ -6,6 +6,9 @@ description = "Trusted Server tsjs — TypeScript-built JS embedded in a Rust cr
 license = "Apache-2.0"
 build = "build.rs"
 
+[lints]
+workspace = true
+
 [lib]
 name = "trusted_server_js"
 path = "src/lib.rs"
diff --git a/crates/js/build.rs b/crates/js/build.rs
index 26d12a17..28410f7e 100644
--- a/crates/js/build.rs
+++ b/crates/js/build.rs
@@ -1,3 +1,5 @@
+#![allow(clippy::unwrap_used, clippy::panic)]
+
 use std::env;
 use std::fs;
 use std::path::{Path, PathBuf};
diff --git a/crates/js/src/bundle.rs b/crates/js/src/bundle.rs
index ef29249c..5f747ec8 100644
--- a/crates/js/src/bundle.rs
+++ b/crates/js/src/bundle.rs
@@ -31,10 +31,12 @@ const ALL_BUNDLES: [TsjsBundle; TSJS_BUNDLE_COUNT] = [TsjsBundle::Unified];
 impl TsjsBundle {
     pub const COUNT: usize = TSJS_BUNDLE_COUNT;
 
+    #[must_use]
     pub const fn filename(self) -> &'static str {
         METAS[self as usize].filename
     }
 
+    #[must_use]
     pub fn minified_filename(self) -> String {
         let base = self.filename();
         match base.strip_suffix(".js") {
@@ -60,19 +62,23 @@ impl TsjsBundle {
         })
     }
 
+    #[must_use]
     pub fn from_filename(name: &str) -> Option<Self> {
         Self::filename_map().get(name).copied()
     }
 }
 
+#[must_use]
 pub fn bundle_hash(bundle: TsjsBundle) -> String {
     hash_bundle(bundle.bundle())
 }
 
+#[must_use]
 pub fn bundle_for_filename(name: &str) -> Option<&'static str> {
     TsjsBundle::from_filename(name).map(|bundle| bundle.bundle())
 }
 
+#[must_use]
 pub fn bundle_hash_for_filename(name: &str) -> Option<String> {
     TsjsBundle::from_filename(name).map(|bundle| hash_bundle(bundle.bundle()))
 }

From 18b76bba7219d75fbb7b862428b5c72e3900bd48 Mon Sep 17 00:00:00 2001
From: prk-Jr <erbhattprakash@gmail.com>
Date: Thu, 22 Jan 2026 19:05:35 +0530
Subject: [PATCH 2/7] Add error and panic documentation

Comprehensive documentation of error and panic conditions improves API
clarity and enables gradual enforcement of missing_errors_doc and
missing_panics_doc lints. This establishes a foundation for better
error handling practices across the codebase.

Resolves: #189
---
 Cargo.toml                                    |  4 +-
 crates/common/src/backend.rs                  | 11 +++++
 crates/common/src/fastly_storage.rs           | 46 +++++++++++++++++++
 crates/common/src/http_util.rs                |  4 ++
 crates/common/src/integrations/registry.rs    | 24 ++++++++++
 crates/common/src/proxy.rs                    | 16 +++++++
 crates/common/src/publisher.rs                |  6 +++
 .../common/src/request_signing/endpoints.rs   | 16 +++++++
 crates/common/src/request_signing/jwks.rs     |  5 ++
 crates/common/src/request_signing/rotation.rs | 25 ++++++++++
 crates/common/src/request_signing/signing.rs  | 20 ++++++++
 crates/common/src/settings.rs                 | 20 ++++++++
 crates/common/src/settings_data.rs            | 16 +++----
 crates/common/src/streaming_processor.rs      | 12 +++++
 crates/common/src/synthetic.rs                | 11 +++++
 crates/common/src/test_support.rs             |  5 ++
 16 files changed, 230 insertions(+), 11 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 9af3807f..05c6c475 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -24,8 +24,8 @@ must_use_candidate = "warn"
 
 # Pedantic (selective)
 doc_markdown = "warn"
-# missing_errors_doc = "warn"
-# missing_panics_doc = "warn"
+missing_errors_doc = "warn"
+missing_panics_doc = "warn"
 
 # Restriction (selective)
 print_stdout = "warn"
diff --git a/crates/common/src/backend.rs b/crates/common/src/backend.rs
index ba5a1c84..798131f4 100644
--- a/crates/common/src/backend.rs
+++ b/crates/common/src/backend.rs
@@ -11,6 +11,10 @@ use crate::error::TrustedServerError;
 /// The backend name is derived from the scheme and `host[:port]` to avoid collisions across
 /// http/https or different ports. If a backend with the derived name already exists,
 /// this function logs and reuses it.
+///
+/// # Errors
+///
+/// Returns an error if the host is empty or if backend creation fails (except for `NameInUse` which reuses the existing backend).
 pub fn ensure_origin_backend(
     scheme: &str,
     host: &str,
@@ -75,6 +79,13 @@ pub fn ensure_origin_backend(
     }
 }
 
+/// Ensures a dynamic backend exists for the given origin URL.
+///
+/// Parses the URL and delegates to `ensure_origin_backend` to create or reuse a backend.
+///
+/// # Errors
+///
+/// Returns an error if the URL cannot be parsed or lacks a host, or if backend creation fails.
 pub fn ensure_backend_from_url(origin_url: &str) -> Result<String, Report<TrustedServerError>> {
     let parsed_url = Url::parse(origin_url).change_context(TrustedServerError::Proxy {
         message: format!("Invalid origin_url: {}", origin_url),
diff --git a/crates/common/src/fastly_storage.rs b/crates/common/src/fastly_storage.rs
index c88a3ae1..c8c0b49a 100644
--- a/crates/common/src/fastly_storage.rs
+++ b/crates/common/src/fastly_storage.rs
@@ -17,6 +17,11 @@ impl FastlyConfigStore {
         }
     }
 
+    /// Retrieves a configuration value from the store.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the key is not found in the config store.
     pub fn get(&self, key: &str) -> Result<String, TrustedServerError> {
         // TODO use try_open and return the error
         let store = ConfigStore::open(&self.store_name);
@@ -42,6 +47,12 @@ impl FastlySecretStore {
         }
     }
 
+    /// Retrieves a secret value from the store.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the secret store cannot be opened, the key is not found,
+    /// or the secret plaintext cannot be retrieved.
     pub fn get(&self, key: &str) -> Result<Vec<u8>, TrustedServerError> {
         let store =
             SecretStore::open(&self.store_name).map_err(|_| TrustedServerError::Configuration {
@@ -65,6 +76,11 @@ impl FastlySecretStore {
             .map(|bytes| bytes.into_iter().collect())
     }
 
+    /// Retrieves a secret value from the store and decodes it as a UTF-8 string.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the secret cannot be retrieved or is not valid UTF-8.
     pub fn get_string(&self, key: &str) -> Result<String, TrustedServerError> {
         let bytes = self.get(key)?;
         String::from_utf8(bytes).map_err(|e| TrustedServerError::Configuration {
@@ -79,10 +95,20 @@ pub struct FastlyApiClient {
 }
 
 impl FastlyApiClient {
+    /// Creates a new Fastly API client using the default secret store.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the secret store cannot be opened or the API key cannot be retrieved.
     pub fn new() -> Result<Self, TrustedServerError> {
         Self::from_secret_store("api-keys", "api_key")
     }
 
+    /// Creates a new Fastly API client from a specified secret store.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the API backend cannot be ensured or the API key cannot be retrieved.
     pub fn from_secret_store(store_name: &str, key_name: &str) -> Result<Self, TrustedServerError> {
         ensure_backend_from_url("https://api.fastly.com").map_err(|e| {
             TrustedServerError::Configuration {
@@ -139,6 +165,11 @@ impl FastlyApiClient {
         })
     }
 
+    /// Updates a configuration item in a Fastly config store.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the API request fails or returns a non-OK status.
     pub fn update_config_item(
         &self,
         store_id: &str,
@@ -176,6 +207,11 @@ impl FastlyApiClient {
         }
     }
 
+    /// Creates a secret in a Fastly secret store.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the API request fails or returns a non-OK status.
     pub fn create_secret(
         &self,
         store_id: &str,
@@ -213,6 +249,11 @@ impl FastlyApiClient {
         }
     }
 
+    /// Deletes a configuration item from a Fastly config store.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the API request fails or returns a non-OK/NO_CONTENT status.
     pub fn delete_config_item(&self, store_id: &str, key: &str) -> Result<(), TrustedServerError> {
         let path = format!("/resources/stores/config/{}/item/{}", store_id, key);
 
@@ -241,6 +282,11 @@ impl FastlyApiClient {
         }
     }
 
+    /// Deletes a secret from a Fastly secret store.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the API request fails or returns a non-OK/NO_CONTENT status.
     pub fn delete_secret(
         &self,
         store_id: &str,
diff --git a/crates/common/src/http_util.rs b/crates/common/src/http_util.rs
index f137a7ec..527f6d1c 100644
--- a/crates/common/src/http_util.rs
+++ b/crates/common/src/http_util.rs
@@ -44,6 +44,10 @@ pub fn serve_static_with_etag(body: &str, req: &Request, content_type: &str) ->
 
 /// Encrypts a URL using XChaCha20-Poly1305 with a key derived from the publisher `proxy_secret`.
 /// Returns a Base64 URL-safe (no padding) token: b"x1" || nonce(24) || ciphertext+tag.
+///
+/// # Panics
+///
+/// Panics if encryption fails (which should not happen under normal circumstances).
 #[must_use]
 pub fn encode_url(settings: &Settings, plaintext_url: &str) -> String {
     // Derive a 32-byte key via SHA-256(secret)
diff --git a/crates/common/src/integrations/registry.rs b/crates/common/src/integrations/registry.rs
index cb6fcc3e..4d033be2 100644
--- a/crates/common/src/integrations/registry.rs
+++ b/crates/common/src/integrations/registry.rs
@@ -117,6 +117,11 @@ impl std::fmt::Debug for IntegrationDocumentState {
 
 impl IntegrationDocumentState {
     #[must_use]
+    /// Retrieves a value stored for an integration.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the inner lock is poisoned.
     pub fn get<T>(&self, integration_id: &'static str) -> Option<Arc<T>>
     where
         T: Any + Send + Sync + 'static,
@@ -131,6 +136,11 @@ impl IntegrationDocumentState {
         })
     }
 
+    /// Retrieves or initializes a value for an integration.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the inner lock is poisoned.
     pub fn get_or_insert_with<T>(
         &self,
         integration_id: &'static str,
@@ -158,6 +168,11 @@ impl IntegrationDocumentState {
         value
     }
 
+    /// Clears all stored values.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the inner lock is poisoned.
     pub fn clear(&self) {
         let mut guard = self
             .inner
@@ -488,6 +503,10 @@ pub struct IntegrationRegistry {
 
 impl IntegrationRegistry {
     /// Build a registry from the provided settings.
+    ///
+    /// # Panics
+    ///
+    /// Panics if an integration route registration fails due to duplicate routes or invalid paths.
     #[must_use]
     #[allow(clippy::panic, clippy::unwrap_used)]
     pub fn new(settings: &Settings) -> Self {
@@ -684,6 +703,11 @@ impl IntegrationRegistry {
 
     #[cfg(test)]
     #[must_use]
+    /// Test helper to create a registry from routes.
+    ///
+    /// # Panics
+    ///
+    /// Panics if route registration fails due to duplicate or invalid paths.
     pub fn from_routes(routes: Vec<(Method, &str, RouteValue)>) -> Self {
         let mut get_router = Router::new();
         let mut post_router = Router::new();
diff --git a/crates/common/src/proxy.rs b/crates/common/src/proxy.rs
index 64b72bce..02de0ab9 100644
--- a/crates/common/src/proxy.rs
+++ b/crates/common/src/proxy.rs
@@ -527,6 +527,10 @@ async fn proxy_with_redirects(
 /// - If the response is an image or the request `Accept` indicates images, ensures a
 ///   generic `image/*` content type if origin omitted it, and logs likely 1×1 pixels
 ///   using simple size/URL heuristics. No special response (still proxied).
+///
+/// # Errors
+///
+/// Returns an error if the signed target cannot be reconstructed or validation fails.
 pub async fn handle_first_party_proxy(
     settings: &Settings,
     req: Request,
@@ -556,6 +560,10 @@ pub async fn handle_first_party_proxy(
 /// content, it validates the URL and issues a 302 redirect to the reconstructed
 /// target URL. This avoids parsing/downloading the content and lets the browser
 /// navigate directly to the destination under first-party control.
+///
+/// # Errors
+///
+/// Returns an error if the signed target cannot be reconstructed or validation fails.
 pub async fn handle_first_party_click(
     settings: &Settings,
     req: Request,
@@ -644,6 +652,10 @@ pub async fn handle_first_party_click(
 /// in the signature so the signed URL cannot be replayed indefinitely. Returns JSON
 /// `{ href, base }` where `href` is the signed `/first-party/proxy?...` path and `base`
 /// is the normalized clear URL.
+///
+/// # Errors
+///
+/// Returns an error if JSON parsing fails, the URL cannot be parsed, or the URL uses an unsupported scheme.
 pub async fn handle_first_party_proxy_sign(
     settings: &Settings,
     mut req: Request,
@@ -747,6 +759,10 @@ struct ProxyRebuildResp {
 /// Body: { tsclick: "/first-party/click?tsurl=...&a=1", add: {"b":"2"}, del: ["c"] }
 /// - Only allows adding new parameters or removing existing ones.
 /// - Base tsurl cannot change.
+///
+/// # Errors
+///
+/// Returns an error if JSON parsing fails, the URL is invalid, or the request body cannot be read.
 pub async fn handle_first_party_proxy_rebuild(
     settings: &Settings,
     mut req: Request,
diff --git a/crates/common/src/publisher.rs b/crates/common/src/publisher.rs
index 60415366..7c913282 100644
--- a/crates/common/src/publisher.rs
+++ b/crates/common/src/publisher.rs
@@ -76,6 +76,12 @@ fn detect_request_scheme(req: &Request) -> String {
 
 /// Unified tsjs static serving: `/static/tsjs=<filename>`
 /// Accepts: `tsjs-core(.min).js`, `tsjs-ext(.min).js`, `tsjs-creative(.min).js`
+///
+/// Returns 404 for invalid paths or missing bundle files; otherwise serves the requested bundle.
+///
+/// # Errors
+///
+/// This function never returns an error; the Result type is for API consistency.
 pub fn handle_tsjs_dynamic(
     _settings: &Settings,
     req: Request,
diff --git a/crates/common/src/request_signing/endpoints.rs b/crates/common/src/request_signing/endpoints.rs
index 21b9c134..505d05c4 100644
--- a/crates/common/src/request_signing/endpoints.rs
+++ b/crates/common/src/request_signing/endpoints.rs
@@ -18,6 +18,10 @@ use crate::settings::Settings;
 /// This endpoint provides a standardized discovery mechanism following the IAB
 /// Data Subject Rights framework pattern. It returns JWKS keys and API endpoints
 /// in a single discoverable location.
+///
+/// # Errors
+///
+/// Returns an error if JWKS cannot be retrieved, parsed, or serialized.
 pub fn handle_trusted_server_discovery(
     _settings: &Settings,
     _req: Request,
@@ -65,6 +69,10 @@ pub struct VerifySignatureResponse {
 
 /// Will verify a signature given a payload and kid
 /// Useful for testing integration with signatures
+///
+/// # Errors
+///
+/// Returns an error if the request body cannot be parsed as JSON or if verification fails.
 pub fn handle_verify_signature(
     _settings: &Settings,
     mut req: Request,
@@ -132,6 +140,10 @@ pub struct RotateKeyResponse {
 }
 
 /// Rotates the current active kid by generating and saving a new one
+///
+/// # Errors
+///
+/// Returns an error if the request signing settings are missing, JSON parsing fails, or key rotation fails.
 pub fn handle_rotate_key(
     settings: &Settings,
     mut req: Request,
@@ -232,6 +244,10 @@ pub struct DeactivateKeyResponse {
 }
 
 /// Deactivates an active key
+///
+/// # Errors
+///
+/// Returns an error if the request signing settings are missing, JSON parsing fails, or key deactivation fails.
 pub fn handle_deactivate_key(
     settings: &Settings,
     mut req: Request,
diff --git a/crates/common/src/request_signing/jwks.rs b/crates/common/src/request_signing/jwks.rs
index 121fd02d..6cb8c58a 100644
--- a/crates/common/src/request_signing/jwks.rs
+++ b/crates/common/src/request_signing/jwks.rs
@@ -53,6 +53,11 @@ impl Keypair {
     }
 }
 
+/// Retrieves active JSON Web Keys from the config store.
+///
+/// # Errors
+///
+/// Returns an error if the config store cannot be accessed or if active keys cannot be retrieved.
 pub fn get_active_jwks() -> Result<String, TrustedServerError> {
     let store = FastlyConfigStore::new("jwks_store");
     let active_kids_str = store.get("active-kids")?;
diff --git a/crates/common/src/request_signing/rotation.rs b/crates/common/src/request_signing/rotation.rs
index fe3d34e3..24a53679 100644
--- a/crates/common/src/request_signing/rotation.rs
+++ b/crates/common/src/request_signing/rotation.rs
@@ -28,6 +28,11 @@ pub struct KeyRotationManager {
 }
 
 impl KeyRotationManager {
+    /// Creates a new key rotation manager.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the API client cannot be initialized.
     pub fn new(
         config_store_id: impl Into<String>,
         secret_store_id: impl Into<String>,
@@ -46,6 +51,11 @@ impl KeyRotationManager {
         })
     }
 
+    /// Rotates the signing key by generating a new keypair and storing it.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if key storage or update operations fail.
     pub fn rotate_key(&self, kid: Option<String>) -> Result<KeyRotationResult, TrustedServerError> {
         let new_kid = kid.unwrap_or_else(generate_date_based_kid);
 
@@ -118,6 +128,11 @@ impl KeyRotationManager {
             })
     }
 
+    /// Lists all active key IDs.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the active keys cannot be retrieved from the config store.
     pub fn list_active_keys(&self) -> Result<Vec<String>, TrustedServerError> {
         let active_kids_str = self.config_store.get("active-kids")?;
 
@@ -130,6 +145,11 @@ impl KeyRotationManager {
         Ok(active_kids)
     }
 
+    /// Deactivates a key by removing it from the active keys list.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if this would deactivate the last active key, or if the update fails.
     pub fn deactivate_key(&self, kid: &str) -> Result<(), TrustedServerError> {
         let mut active_kids = self.list_active_keys()?;
 
@@ -144,6 +164,11 @@ impl KeyRotationManager {
         self.update_active_kids(&active_kids)
     }
 
+    /// Deletes a key by deactivating it and removing it from storage.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if deactivation fails or if the key cannot be deleted from storage.
     pub fn delete_key(&self, kid: &str) -> Result<(), TrustedServerError> {
         self.deactivate_key(kid)?;
 
diff --git a/crates/common/src/request_signing/signing.rs b/crates/common/src/request_signing/signing.rs
index 6420a120..bd1ae0a3 100644
--- a/crates/common/src/request_signing/signing.rs
+++ b/crates/common/src/request_signing/signing.rs
@@ -9,6 +9,11 @@ use ed25519_dalek::{Signature, Signer as Ed25519Signer, SigningKey, Verifier, Ve
 use crate::error::TrustedServerError;
 use crate::fastly_storage::{FastlyConfigStore, FastlySecretStore};
 
+/// Retrieves the current active key ID from the config store.
+///
+/// # Errors
+///
+/// Returns an error if the config store cannot be accessed or the current-kid key is not found.
 pub fn get_current_key_id() -> Result<String, TrustedServerError> {
     let store = FastlyConfigStore::new("jwks_store");
     store.get("current-kid")
@@ -40,6 +45,11 @@ pub struct RequestSigner {
 }
 
 impl RequestSigner {
+    /// Creates a `RequestSigner` from the current key ID stored in config.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the key ID cannot be retrieved or the key cannot be parsed.
     pub fn from_config() -> Result<Self, TrustedServerError> {
         let config_store = FastlyConfigStore::new("jwks_store");
         let key_id = config_store.get("current-kid")?;
@@ -54,6 +64,11 @@ impl RequestSigner {
         })
     }
 
+    /// Signs a payload using the Ed25519 signing key.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if signing fails.
     pub fn sign(&self, payload: &[u8]) -> Result<String, TrustedServerError> {
         let signature_bytes = self.key.sign(payload).to_bytes();
 
@@ -61,6 +76,11 @@ impl RequestSigner {
     }
 }
 
+/// Verifies a signature using the public key associated with the given key ID.
+///
+/// # Errors
+///
+/// Returns an error if the JWK cannot be retrieved, parsed, or if signature verification fails.
 pub fn verify_signature(
     payload: &[u8],
     signature_b64: &str,
diff --git a/crates/common/src/settings.rs b/crates/common/src/settings.rs
index 839a78e4..d8e7d9a4 100644
--- a/crates/common/src/settings.rs
+++ b/crates/common/src/settings.rs
@@ -78,6 +78,11 @@ pub trait IntegrationConfig: DeserializeOwned + Validate {
 }
 
 impl IntegrationSettings {
+    /// Inserts a configuration value for an integration.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the configuration cannot be serialized to JSON.
     #[cfg_attr(not(test), allow(dead_code))]
     pub fn insert_config<T>(
         &mut self,
@@ -116,6 +121,11 @@ impl IntegrationSettings {
         }
     }
 
+    /// Retrieves and validates a typed configuration for an integration.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the configuration cannot be parsed from JSON or fails validation.
     pub fn get_typed<T>(
         &self,
         integration_id: &str,
@@ -180,6 +190,11 @@ pub struct Synthetic {
 }
 
 impl Synthetic {
+    /// Validates that the secret key is not the placeholder value.
+    ///
+    /// # Errors
+    ///
+    /// Returns a validation error if the secret key is `"secret_key"` (the placeholder).
     pub fn validate_secret_key(secret_key: &str) -> Result<(), ValidationError> {
         match secret_key {
             "secret_key" => Err(ValidationError::new("Secret key is not valid")),
@@ -349,6 +364,11 @@ impl Settings {
             .find(|handler| handler.matches_path(path))
     }
 
+    /// Retrieves the integration configuration of a specific type.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the integration configuration exists but cannot be deserialized as the requested type.
     pub fn integration_config<T>(
         &self,
         integration_id: &str,
diff --git a/crates/common/src/settings_data.rs b/crates/common/src/settings_data.rs
index 7061ca2d..09d5768c 100644
--- a/crates/common/src/settings_data.rs
+++ b/crates/common/src/settings_data.rs
@@ -8,15 +8,13 @@ use crate::settings::Settings;
 const SETTINGS_DATA: &[u8] = include_bytes!("../../../target/trusted-server-out.toml");
 
 /// Creates a new [`Settings`] instance from the embedded configuration file.
-// /
-// / Loads the configuration from the embedded `trusted-server.toml` file
-// / and applies any environment variable overrides.
-// /
-// / # Errors
-// /
-// / - [`TrustedServerError::InvalidUtf8`] if the embedded TOML file contains invalid UTF-8
-// / - [`TrustedServerError::Configuration`] if the configuration is invalid or missing required fields
-// / - [`TrustedServerError::InsecureSecretKey`] if the secret key is set to the default value
+/// Loads the configuration from the embedded `trusted-server.toml` file
+/// and applies any environment variable overrides.
+///
+/// # Errors
+///
+/// - [`TrustedServerError::InvalidUtf8`] if the embedded TOML file contains invalid UTF-8
+/// - [`TrustedServerError::Configuration`] if the configuration is invalid or missing required fields
 pub fn get_settings() -> Result<Settings, Report<TrustedServerError>> {
     let toml_bytes = SETTINGS_DATA;
     let toml_str = str::from_utf8(toml_bytes).change_context(TrustedServerError::InvalidUtf8 {
diff --git a/crates/common/src/streaming_processor.rs b/crates/common/src/streaming_processor.rs
index a039d18e..3dfd1986 100644
--- a/crates/common/src/streaming_processor.rs
+++ b/crates/common/src/streaming_processor.rs
@@ -21,6 +21,10 @@ pub trait StreamProcessor {
     ///
     /// # Returns
     /// Processed data or error
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if processing fails (e.g., I/O errors, encoding issues).
     fn process_chunk(&mut self, chunk: &[u8], is_last: bool) -> Result<Vec<u8>, io::Error>;
 
     /// Reset the processor state (useful for reuse)
@@ -77,11 +81,19 @@ pub struct StreamingPipeline<P: StreamProcessor> {
 
 impl<P: StreamProcessor> StreamingPipeline<P> {
     /// Create a new streaming pipeline
+    ///
+    /// # Errors
+    ///
+    /// No errors are returned by this constructor.
     pub fn new(config: PipelineConfig, processor: P) -> Self {
         Self { config, processor }
     }
 
     /// Process a stream from input to output
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the compression transformation is unsupported or if reading/writing fails.
     pub fn process<R: Read, W: Write>(
         &mut self,
         input: R,
diff --git a/crates/common/src/synthetic.rs b/crates/common/src/synthetic.rs
index d84a95ef..5ae78aa2 100644
--- a/crates/common/src/synthetic.rs
+++ b/crates/common/src/synthetic.rs
@@ -118,6 +118,17 @@ pub fn get_synthetic_id(req: &Request) -> Result<Option<String>, Report<TrustedS
     Ok(None)
 }
 
+/// Gets or creates a synthetic ID from the request.
+///
+/// Attempts to retrieve an existing synthetic ID from:
+/// 1. The `x-psid-ts` header
+/// 2. The `synthetic_id` cookie
+///
+/// If neither exists, generates a new synthetic ID.
+///
+/// # Errors
+///
+/// Returns an error if template rendering fails during generation or if ID generation fails.
 pub fn get_or_generate_synthetic_id(
     settings: &Settings,
     req: &Request,
diff --git a/crates/common/src/test_support.rs b/crates/common/src/test_support.rs
index dc2bea4b..5e0d8f97 100644
--- a/crates/common/src/test_support.rs
+++ b/crates/common/src/test_support.rs
@@ -37,6 +37,11 @@ pub mod tests {
     }
 
     #[must_use]
+    /// Creates test settings from embedded TOML configuration.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the embedded TOML configuration is invalid.
     pub fn create_test_settings() -> Settings {
         let toml_str = crate_test_settings_str();
         Settings::from_toml(&toml_str).expect("Invalid config")

From 200c31f5430effd578363f7f9cecd958f78b08b2 Mon Sep 17 00:00:00 2001
From: prk-Jr <erbhattprakash@gmail.com>
Date: Tue, 27 Jan 2026 19:15:15 +0530
Subject: [PATCH 3/7] Tighten clippy lints and improve error handling

The default lint configuration was permissive, allowing unwrap() and
panic() in production code. This change enforces stricter error handling
by denying these patterns and requiring explicit expect() messages.

IntegrationRegistry::new() previously panicked on configuration errors,
making startup failures hard to diagnose. Returning Result allows the
caller to log meaningful context before returning an error response.

Additional pedantic lints (needless_pass_by_value, redundant_closure)
help catch common inefficiencies during development.
---
 Cargo.toml                                    | 10 +++--
 clippy.toml                                   | 32 ++++++++++++--
 crates/common/build.rs                        |  8 ++--
 crates/common/src/html_processor.rs           |  4 +-
 crates/common/src/integrations/didomi.rs      |  2 +-
 .../integrations/nextjs/html_post_process.rs  | 16 +++++--
 crates/common/src/integrations/nextjs/mod.rs  | 12 +++---
 crates/common/src/integrations/nextjs/rsc.rs  |  2 +-
 .../integrations/nextjs/rsc_placeholders.rs   |  4 +-
 crates/common/src/integrations/prebid.rs      |  4 +-
 crates/common/src/integrations/registry.rs    | 42 +++++++++++++------
 crates/common/src/proxy.rs                    |  6 +--
 crates/common/src/publisher.rs                |  8 ++--
 crates/common/src/request_signing/jwks.rs     |  2 +-
 crates/common/src/settings.rs                 |  2 +-
 crates/fastly/src/error.rs                    |  2 +-
 crates/fastly/src/main.rs                     | 14 +++++--
 crates/js/build.rs                            | 12 +++++-
 crates/js/src/bundle.rs                       |  2 +-
 19 files changed, 127 insertions(+), 57 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 05c6c475..5133b733 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,10 +13,10 @@ default-members = [
 ]
 
 [workspace.lints.clippy]
-# Correctness
-unwrap_used = "warn"
-expect_used = "allow"
-panic = "warn"
+# Correctness - Force explicit error handling in production code
+unwrap_used = "deny"
+expect_used = "allow"  # Allow expect with context message
+panic = "deny"
 
 # Style
 module_name_repetitions = "allow"
@@ -26,6 +26,8 @@ must_use_candidate = "warn"
 doc_markdown = "warn"
 missing_errors_doc = "warn"
 missing_panics_doc = "warn"
+needless_pass_by_value = "warn"  # Encourage borrowing over ownership
+redundant_closure_for_method_calls = "warn"
 
 # Restriction (selective)
 print_stdout = "warn"
diff --git a/clippy.toml b/clippy.toml
index 17f78bc6..4c562adc 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -1,12 +1,38 @@
 # Clippy configuration for trusted-server
 # See: https://doc.rust-lang.org/clippy/configuration.html
 
-# Cognitive complexity threshold for functions
+# =============================================================================
+# Complexity Thresholds
+# =============================================================================
+
+# Cognitive complexity threshold for functions (default: 25)
+# Set to 30 to accommodate existing complex HTML/RSC processing functions
+# like `create_html_processor` and `rewrite_rsc_scripts_combined`.
+# Consider refactoring functions that exceed this threshold.
 cognitive-complexity-threshold = 30
 
-# Maximum number of lines in a function
+# Maximum number of lines in a function (default: 100)
+# Set to 200 to allow larger handler functions that process HTTP requests
+# with multiple validation steps. Prefer extracting helpers when possible.
 too-many-lines-threshold = 200
 
-# Allow module name repetitions in reexports
+# =============================================================================
+# Test Allowances
+# =============================================================================
+
+# Allow expect() in tests for clearer failure messages than unwrap()
 allow-expect-in-tests = true
+
+# Allow unwrap() in tests where panicking on failure is acceptable
 allow-unwrap-in-tests = true
+
+# =============================================================================
+# Future Considerations
+# =============================================================================
+#
+# As the codebase matures, consider tightening these thresholds:
+# - cognitive-complexity-threshold = 25 (default)
+# - too-many-lines-threshold = 100 (default)
+#
+# Additional lints to consider enabling in Cargo.toml:
+# - missing_const_for_fn = "warn"
diff --git a/crates/common/build.rs b/crates/common/build.rs
index c8facdda..fbe8373e 100644
--- a/crates/common/build.rs
+++ b/crates/common/build.rs
@@ -28,7 +28,7 @@ fn rerun_if_changed() {
     let settings_json = serde_json::to_value(&default_settings).unwrap();
 
     let mut env_vars = HashSet::new();
-    collect_env_vars(&settings_json, &mut env_vars, vec![]);
+    collect_env_vars(&settings_json, &mut env_vars, &[]);
 
     // Print rerun-if-env-changed for each variable
     let mut sorted_vars: Vec<_> = env_vars.into_iter().collect();
@@ -59,10 +59,10 @@ fn merge_toml() {
     fs::write(dest_path, merged_toml).unwrap_or_else(|_| panic!("Failed to write {:?}", dest_path));
 }
 
-fn collect_env_vars(value: &Value, env_vars: &mut HashSet<String>, path: Vec<String>) {
+fn collect_env_vars(value: &Value, env_vars: &mut HashSet<String>, path: &[String]) {
     if let Value::Object(map) = value {
         for (key, val) in map {
-            let mut new_path = path.clone();
+            let mut new_path = path.to_owned();
             new_path.push(key.to_uppercase());
 
             match val {
@@ -78,7 +78,7 @@ fn collect_env_vars(value: &Value, env_vars: &mut HashSet<String>, path: Vec<Str
                 }
                 Value::Object(_) => {
                     // Recurse into nested objects
-                    collect_env_vars(val, env_vars, new_path);
+                    collect_env_vars(val, env_vars, &new_path);
                 }
                 _ => {}
             }
diff --git a/crates/common/src/html_processor.rs b/crates/common/src/html_processor.rs
index 1bbd5507..ad3ea92a 100644
--- a/crates/common/src/html_processor.rs
+++ b/crates/common/src/html_processor.rs
@@ -571,7 +571,7 @@ mod tests {
     #[test]
     fn test_html_processor_config_from_settings() {
         let settings = create_test_settings();
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = HtmlProcessorConfig::from_settings(
             &settings,
             &registry,
@@ -677,7 +677,7 @@ mod tests {
             )
             .expect("should insert testlight config");
 
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let mut config = create_test_config();
         config.integrations = registry;
 
diff --git a/crates/common/src/integrations/didomi.rs b/crates/common/src/integrations/didomi.rs
index 773dc050..457a39bf 100644
--- a/crates/common/src/integrations/didomi.rs
+++ b/crates/common/src/integrations/didomi.rs
@@ -273,7 +273,7 @@ mod tests {
             .insert_config(DIDOMI_INTEGRATION_ID, &config(true))
             .expect("should insert config");
 
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         assert!(registry.has_route(&Method::GET, "/integrations/didomi/consent/loader.js"));
         assert!(registry.has_route(&Method::POST, "/integrations/didomi/consent/api/events"));
         assert!(!registry.has_route(&Method::GET, "/other"));
diff --git a/crates/common/src/integrations/nextjs/html_post_process.rs b/crates/common/src/integrations/nextjs/html_post_process.rs
index c6ded2f6..fdd78eed 100644
--- a/crates/common/src/integrations/nextjs/html_post_process.rs
+++ b/crates/common/src/integrations/nextjs/html_post_process.rs
@@ -39,7 +39,9 @@ impl IntegrationHtmlPostProcessor for NextJsHtmlPostProcessor {
             .document_state
             .get::<Mutex<NextJsRscPostProcessState>>(NEXTJS_INTEGRATION_ID)
         {
-            let guard = state.lock().unwrap_or_else(|e| e.into_inner());
+            let guard = state
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
             if !guard.payloads.is_empty() {
                 return true;
             }
@@ -56,7 +58,9 @@ impl IntegrationHtmlPostProcessor for NextJsHtmlPostProcessor {
             .document_state
             .get::<Mutex<NextJsRscPostProcessState>>(NEXTJS_INTEGRATION_ID)
             .map(|state| {
-                let mut guard = state.lock().unwrap_or_else(|e| e.into_inner());
+                let mut guard = state
+                    .lock()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner);
                 guard.take_payloads()
             })
             .unwrap_or_default();
@@ -488,7 +492,13 @@ fn post_process_rsc_html_in_place_with_limit(
 }
 
 #[cfg(test)]
-#[allow(deprecated)] // Tests use deprecated post_process_rsc_html for legacy API coverage
+#[allow(
+    deprecated, // Tests use deprecated post_process_rsc_html for legacy API coverage
+    clippy::print_stdout,
+    clippy::print_stderr,
+    clippy::panic,
+    clippy::unwrap_used
+)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/integrations/nextjs/mod.rs b/crates/common/src/integrations/nextjs/mod.rs
index 8ce8222f..522dae01 100644
--- a/crates/common/src/integrations/nextjs/mod.rs
+++ b/crates/common/src/integrations/nextjs/mod.rs
@@ -143,7 +143,7 @@ mod tests {
                 }),
             )
             .expect("should update nextjs config");
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = config_from_settings(&settings, &registry);
         let processor = create_html_processor(config);
         let pipeline_config = PipelineConfig {
@@ -206,7 +206,7 @@ mod tests {
                 }),
             )
             .expect("should update nextjs config");
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = config_from_settings(&settings, &registry);
         let processor = create_html_processor(config);
         let pipeline_config = PipelineConfig {
@@ -254,7 +254,7 @@ mod tests {
                 }),
             )
             .expect("should update nextjs config");
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = config_from_settings(&settings, &registry);
         let processor = create_html_processor(config);
         let pipeline_config = PipelineConfig {
@@ -305,7 +305,7 @@ mod tests {
                 }),
             )
             .expect("should update nextjs config");
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = config_from_settings(&settings, &registry);
         let processor = create_html_processor(config);
         let pipeline_config = PipelineConfig {
@@ -371,7 +371,7 @@ mod tests {
             )
             .expect("should update nextjs config");
 
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = config_from_settings(&settings, &registry);
         let processor = create_html_processor(config);
         let pipeline_config = PipelineConfig {
@@ -443,7 +443,7 @@ mod tests {
                 }),
             )
             .expect("should update nextjs config");
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = config_from_settings(&settings, &registry);
         let processor = create_html_processor(config);
         // Use small chunk size to force fragmentation
diff --git a/crates/common/src/integrations/nextjs/rsc.rs b/crates/common/src/integrations/nextjs/rsc.rs
index 3b5bea3d..3120d57c 100644
--- a/crates/common/src/integrations/nextjs/rsc.rs
+++ b/crates/common/src/integrations/nextjs/rsc.rs
@@ -476,7 +476,7 @@ pub(crate) fn rewrite_rsc_scripts_combined_with_limit(
     let remaining = &combined[last_end..];
     result.push_str(rewriter.rewrite(remaining).as_ref());
 
-    result.split(RSC_MARKER).map(|s| s.to_string()).collect()
+    result.split(RSC_MARKER).map(String::from).collect()
 }
 
 #[cfg(test)]
diff --git a/crates/common/src/integrations/nextjs/rsc_placeholders.rs b/crates/common/src/integrations/nextjs/rsc_placeholders.rs
index e29e2487..b5ca8c69 100644
--- a/crates/common/src/integrations/nextjs/rsc_placeholders.rs
+++ b/crates/common/src/integrations/nextjs/rsc_placeholders.rs
@@ -87,7 +87,9 @@ impl IntegrationScriptRewriter for NextJsRscPlaceholderRewriter {
             .get_or_insert_with(NEXTJS_INTEGRATION_ID, || {
                 Mutex::new(NextJsRscPostProcessState::default())
             });
-        let mut guard = state.lock().unwrap_or_else(|e| e.into_inner());
+        let mut guard = state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
 
         let placeholder_index = guard.payloads.len();
         let placeholder = rsc_payload_placeholder(placeholder_index);
diff --git a/crates/common/src/integrations/prebid.rs b/crates/common/src/integrations/prebid.rs
index 7a11c99e..f068de2a 100644
--- a/crates/common/src/integrations/prebid.rs
+++ b/crates/common/src/integrations/prebid.rs
@@ -799,7 +799,7 @@ mod tests {
                 }),
             )
             .expect("should update prebid config");
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = config_from_settings(&settings, &registry);
         let processor = create_html_processor(config);
         let pipeline_config = PipelineConfig {
@@ -849,7 +849,7 @@ mod tests {
                 }),
             )
             .expect("should update prebid config");
-        let registry = IntegrationRegistry::new(&settings);
+        let registry = IntegrationRegistry::new(&settings).expect("should create registry");
         let config = config_from_settings(&settings, &registry);
         let processor = create_html_processor(config);
         let pipeline_config = PipelineConfig {
diff --git a/crates/common/src/integrations/registry.rs b/crates/common/src/integrations/registry.rs
index 4d033be2..956c9252 100644
--- a/crates/common/src/integrations/registry.rs
+++ b/crates/common/src/integrations/registry.rs
@@ -504,12 +504,15 @@ pub struct IntegrationRegistry {
 impl IntegrationRegistry {
     /// Build a registry from the provided settings.
     ///
+    /// # Errors
+    ///
+    /// Returns an error if route registration fails due to duplicate routes or invalid paths.
+    ///
     /// # Panics
     ///
-    /// Panics if an integration route registration fails due to duplicate routes or invalid paths.
-    #[must_use]
-    #[allow(clippy::panic, clippy::unwrap_used)]
-    pub fn new(settings: &Settings) -> Self {
+    /// Panics if a route path ends with `/*` but `strip_suffix` unexpectedly fails (invariant violation).
+    #[allow(clippy::unwrap_used)]
+    pub fn new(settings: &Settings) -> Result<Self, Report<TrustedServerError>> {
         let mut inner = IntegrationRegistryInner::default();
 
         for builder in crate::integrations::builders() {
@@ -520,7 +523,13 @@ impl IntegrationRegistry {
 
                         // Convert /* wildcard to matchit's {*rest} syntax
                         let matchit_path = if route.path.ends_with("/*") {
-                            format!("{}/{{*rest}}", route.path.strip_suffix("/*").unwrap())
+                            format!(
+                                "{}/{{*rest}}",
+                                route
+                                    .path
+                                    .strip_suffix("/*")
+                                    .expect("path should end with '/*'")
+                            )
                         } else {
                             route.path.to_string()
                         };
@@ -543,10 +552,12 @@ impl IntegrationRegistry {
                         };
 
                         if let Err(e) = router.insert(&matchit_path, value) {
-                            panic!(
-                                "Integration route registration failed for {} {}: {:?}",
-                                route.method, route.path, e
-                            );
+                            return Err(Report::new(TrustedServerError::Configuration {
+                                message: format!(
+                                    "Integration route registration failed for {} {}: {:?}",
+                                    route.method, route.path, e
+                                ),
+                            }));
                         }
 
                         inner.routes.push((route, registration.integration_id));
@@ -564,9 +575,9 @@ impl IntegrationRegistry {
             }
         }
 
-        Self {
+        Ok(Self {
             inner: Arc::new(inner),
-        }
+        })
     }
 
     fn find_route(&self, method: &Method, path: &str) -> Option<&RouteValue> {
@@ -718,7 +729,10 @@ impl IntegrationRegistry {
         for (method, path, value) in routes {
             // Convert /* wildcard to matchit's {*rest} syntax
             let matchit_path = if path.ends_with("/*") {
-                format!("{}/{{*rest}}", path.strip_suffix("/*").unwrap())
+                format!(
+                    "{}/{{*rest}}",
+                    path.strip_suffix("/*").expect("path should end with '/*'")
+                )
             } else {
                 path.to_string()
             };
@@ -732,7 +746,9 @@ impl IntegrationRegistry {
                 _ => continue,
             };
 
-            router.insert(&matchit_path, value).unwrap();
+            router
+                .insert(&matchit_path, value)
+                .expect("route registration should succeed");
         }
 
         Self {
diff --git a/crates/common/src/proxy.rs b/crates/common/src/proxy.rs
index 02de0ab9..ee9607ab 100644
--- a/crates/common/src/proxy.rs
+++ b/crates/common/src/proxy.rs
@@ -95,7 +95,7 @@ fn copy_proxy_forward_headers(src: &Request, dst: &mut Request) {
 
 // Transform the backend response into the final response sent to the client.
 // Handles HTML and CSS rewrites and image content-type normalization.
-fn rebuild_text_response(beresp: Response, content_type: &'static str, body: String) -> Response {
+fn rebuild_text_response(beresp: &Response, content_type: &'static str, body: String) -> Response {
     let status = beresp.get_status();
     let headers: Vec<(header::HeaderName, HeaderValue)> = beresp
         .get_headers()
@@ -151,14 +151,14 @@ fn finalize_proxied_response(
         // HTML: rewrite and serve as HTML (safe to read as string)
         let body = beresp.take_body_str();
         let rewritten = crate::creative::rewrite_creative_html(&body, settings);
-        return rebuild_text_response(beresp, "text/html; charset=utf-8", rewritten);
+        return rebuild_text_response(&beresp, "text/html; charset=utf-8", rewritten);
     }
 
     if ct.contains("text/css") {
         // CSS: rewrite url(...) references in stylesheets (safe to read as string)
         let body = beresp.take_body_str();
         let rewritten = crate::creative::rewrite_css_body(&body, settings);
-        return rebuild_text_response(beresp, "text/css; charset=utf-8", rewritten);
+        return rebuild_text_response(&beresp, "text/css; charset=utf-8", rewritten);
     }
 
     // Image handling: set generic content-type if missing and log pixel heuristics
diff --git a/crates/common/src/publisher.rs b/crates/common/src/publisher.rs
index 7c913282..2e0fb4cc 100644
--- a/crates/common/src/publisher.rs
+++ b/crates/common/src/publisher.rs
@@ -84,7 +84,7 @@ fn detect_request_scheme(req: &Request) -> String {
 /// This function never returns an error; the Result type is for API consistency.
 pub fn handle_tsjs_dynamic(
     _settings: &Settings,
-    req: Request,
+    req: &Request,
 ) -> Result<Response, Report<TrustedServerError>> {
     const PREFIX: &str = "/static/tsjs=";
     let path = req.get_path();
@@ -99,7 +99,7 @@ pub fn handle_tsjs_dynamic(
         return Ok(Response::from_status(StatusCode::NOT_FOUND).with_body("Not Found"));
     };
 
-    let mut resp = serve_static_with_etag(body, &req, "application/javascript; charset=utf-8");
+    let mut resp = serve_static_with_etag(body, req, "application/javascript; charset=utf-8");
     resp.set_header(HEADER_X_COMPRESS_HINT, "on");
     Ok(resp)
 }
@@ -119,7 +119,7 @@ struct ProcessResponseParams<'a> {
 /// Process response body in streaming fashion with compression preservation
 fn process_response_streaming(
     body: Body,
-    params: ProcessResponseParams,
+    params: &ProcessResponseParams,
 ) -> Result<Body, Report<TrustedServerError>> {
     // Check if this is HTML content
     let is_html = params.content_type.contains("text/html");
@@ -346,7 +346,7 @@ pub fn handle_publisher_request(
             content_type: &content_type,
             integration_registry,
         };
-        match process_response_streaming(body, params) {
+        match process_response_streaming(body, &params) {
             Ok(processed_body) => {
                 // Set the processed body back
                 response.set_body(processed_body);
diff --git a/crates/common/src/request_signing/jwks.rs b/crates/common/src/request_signing/jwks.rs
index 6cb8c58a..3c16b563 100644
--- a/crates/common/src/request_signing/jwks.rs
+++ b/crates/common/src/request_signing/jwks.rs
@@ -64,7 +64,7 @@ pub fn get_active_jwks() -> Result<String, TrustedServerError> {
 
     let active_kids: Vec<&str> = active_kids_str
         .split(',')
-        .map(|s| s.trim())
+        .map(str::trim)
         .filter(|s| !s.is_empty())
         .collect();
 
diff --git a/crates/common/src/settings.rs b/crates/common/src/settings.rs
index d8e7d9a4..ed519156 100644
--- a/crates/common/src/settings.rs
+++ b/crates/common/src/settings.rs
@@ -423,7 +423,7 @@ where
             } else {
                 let parts = if txt.contains(',') {
                     txt.split(',')
-                        .map(|p| p.trim())
+                        .map(str::trim)
                         .filter(|p| !p.is_empty())
                         .collect::<Vec<_>>()
                 } else {
diff --git a/crates/fastly/src/error.rs b/crates/fastly/src/error.rs
index b5c19c33..a055ecba 100644
--- a/crates/fastly/src/error.rs
+++ b/crates/fastly/src/error.rs
@@ -7,7 +7,7 @@ use fastly::Response;
 use trusted_server_common::error::{IntoHttpResponse, TrustedServerError};
 
 /// Converts a [`TrustedServerError`] into an HTTP error response.
-pub fn to_error_response(report: Report<TrustedServerError>) -> Response {
+pub fn to_error_response(report: &Report<TrustedServerError>) -> Response {
     // Get the root error for status code and message
     let root_error = report.current_context();
 
diff --git a/crates/fastly/src/main.rs b/crates/fastly/src/main.rs
index 183fea91..6ca0bb8e 100644
--- a/crates/fastly/src/main.rs
+++ b/crates/fastly/src/main.rs
@@ -29,11 +29,17 @@ fn main(req: Request) -> Result<Response, Error> {
         Ok(s) => s,
         Err(e) => {
             log::error!("Failed to load settings: {:?}", e);
-            return Ok(to_error_response(e));
+            return Ok(to_error_response(&e));
         }
     };
     log::info!("Settings {settings:?}");
-    let integration_registry = IntegrationRegistry::new(&settings);
+    let integration_registry = match IntegrationRegistry::new(&settings) {
+        Ok(r) => r,
+        Err(e) => {
+            log::error!("Failed to create integration registry: {:?}", e);
+            return Ok(to_error_response(&e));
+        }
+    };
 
     futures::executor::block_on(route_request(settings, integration_registry, req))
 }
@@ -60,7 +66,7 @@ async fn route_request(
     let result = match (method, path.as_str()) {
         // Serve the tsjs library
         (Method::GET, path) if path.starts_with("/static/tsjs=") => {
-            handle_tsjs_dynamic(&settings, req)
+            handle_tsjs_dynamic(&settings, &req)
         }
 
         // Discovery endpoint for trusted-server capabilities and JWKS
@@ -111,7 +117,7 @@ async fn route_request(
     };
 
     // Convert any errors to HTTP error responses
-    let mut response = result.unwrap_or_else(to_error_response);
+    let mut response = result.unwrap_or_else(|e| to_error_response(&e));
 
     for (key, value) in &settings.response_headers {
         response.set_header(key, value);
diff --git a/crates/js/build.rs b/crates/js/build.rs
index 28410f7e..15417160 100644
--- a/crates/js/build.rs
+++ b/crates/js/build.rs
@@ -45,7 +45,11 @@ fn main() {
                     .arg("install")
                     .current_dir(&ts_dir)
                     .status();
-                if !status.as_ref().map(|s| s.success()).unwrap_or(false) {
+                if !status
+                    .as_ref()
+                    .map(std::process::ExitStatus::success)
+                    .unwrap_or(false)
+                {
                     println!(
                         "cargo:warning=tsjs: npm install failed; using existing dist if available"
                     );
@@ -73,7 +77,11 @@ fn main() {
                 .args(["run", "build:custom"])
                 .current_dir(&ts_dir)
                 .status();
-            if !status.as_ref().map(|s| s.success()).unwrap_or(false) {
+            if !status
+                .as_ref()
+                .map(std::process::ExitStatus::success)
+                .unwrap_or(false)
+            {
                 panic!("tsjs: npm run build:custom failed - refusing to use stale bundle");
             }
         }
diff --git a/crates/js/src/bundle.rs b/crates/js/src/bundle.rs
index 5f747ec8..3ad93d9a 100644
--- a/crates/js/src/bundle.rs
+++ b/crates/js/src/bundle.rs
@@ -75,7 +75,7 @@ pub fn bundle_hash(bundle: TsjsBundle) -> String {
 
 #[must_use]
 pub fn bundle_for_filename(name: &str) -> Option<&'static str> {
-    TsjsBundle::from_filename(name).map(|bundle| bundle.bundle())
+    TsjsBundle::from_filename(name).map(TsjsBundle::bundle)
 }
 
 #[must_use]

From 3bc62daad13d3029a00d696d8f0636b4abf104ad Mon Sep 17 00:00:00 2001
From: prk-Jr <erbhattprakash@gmail.com>
Date: Tue, 27 Jan 2026 21:35:08 +0530
Subject: [PATCH 4/7] Centralize test lint allows at crate level

---
 crates/common/src/fastly_storage.rs                   |  1 -
 crates/common/src/html_processor.rs                   |  1 -
 crates/common/src/http_util.rs                        |  1 -
 crates/common/src/integrations/lockr.rs               |  1 -
 .../src/integrations/nextjs/html_post_process.rs      |  8 +-------
 crates/common/src/integrations/nextjs/rsc.rs          |  1 -
 .../src/integrations/nextjs/rsc_placeholders.rs       |  1 -
 .../common/src/integrations/nextjs/script_rewriter.rs |  1 -
 crates/common/src/integrations/registry.rs            |  1 -
 crates/common/src/lib.rs                              | 11 +++++++++++
 crates/common/src/request_signing/endpoints.rs        |  6 ------
 crates/common/src/request_signing/jwks.rs             |  1 -
 crates/common/src/request_signing/rotation.rs         |  1 -
 crates/common/src/settings.rs                         |  1 -
 14 files changed, 12 insertions(+), 24 deletions(-)

diff --git a/crates/common/src/fastly_storage.rs b/crates/common/src/fastly_storage.rs
index c8c0b49a..1e3bde06 100644
--- a/crates/common/src/fastly_storage.rs
+++ b/crates/common/src/fastly_storage.rs
@@ -324,7 +324,6 @@ impl FastlyApiClient {
 }
 
 #[cfg(test)]
-#[allow(clippy::print_stdout, clippy::print_stderr)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/html_processor.rs b/crates/common/src/html_processor.rs
index ad3ea92a..e3d827fb 100644
--- a/crates/common/src/html_processor.rs
+++ b/crates/common/src/html_processor.rs
@@ -454,7 +454,6 @@ pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcesso
 }
 
 #[cfg(test)]
-#[allow(clippy::print_stdout, clippy::print_stderr)]
 mod tests {
     use super::*;
     use crate::integrations::{
diff --git a/crates/common/src/http_util.rs b/crates/common/src/http_util.rs
index 527f6d1c..1bfa4441 100644
--- a/crates/common/src/http_util.rs
+++ b/crates/common/src/http_util.rs
@@ -137,7 +137,6 @@ pub fn compute_encrypted_sha256_token(settings: &Settings, full_url: &str) -> St
 }
 
 #[cfg(test)]
-#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/integrations/lockr.rs b/crates/common/src/integrations/lockr.rs
index cc79f697..02b2f0d4 100644
--- a/crates/common/src/integrations/lockr.rs
+++ b/crates/common/src/integrations/lockr.rs
@@ -397,7 +397,6 @@ fn default_rewrite_sdk_host() -> bool {
 }
 
 #[cfg(test)]
-#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/integrations/nextjs/html_post_process.rs b/crates/common/src/integrations/nextjs/html_post_process.rs
index fdd78eed..c85bf517 100644
--- a/crates/common/src/integrations/nextjs/html_post_process.rs
+++ b/crates/common/src/integrations/nextjs/html_post_process.rs
@@ -492,13 +492,7 @@ fn post_process_rsc_html_in_place_with_limit(
 }
 
 #[cfg(test)]
-#[allow(
-    deprecated, // Tests use deprecated post_process_rsc_html for legacy API coverage
-    clippy::print_stdout,
-    clippy::print_stderr,
-    clippy::panic,
-    clippy::unwrap_used
-)]
+#[allow(deprecated)] // Tests use deprecated post_process_rsc_html for legacy API coverage
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/integrations/nextjs/rsc.rs b/crates/common/src/integrations/nextjs/rsc.rs
index 3120d57c..704aa56f 100644
--- a/crates/common/src/integrations/nextjs/rsc.rs
+++ b/crates/common/src/integrations/nextjs/rsc.rs
@@ -480,7 +480,6 @@ pub(crate) fn rewrite_rsc_scripts_combined_with_limit(
 }
 
 #[cfg(test)]
-#[allow(clippy::print_stdout, clippy::print_stderr)]
 mod tests {
     use super::*;
 
diff --git a/crates/common/src/integrations/nextjs/rsc_placeholders.rs b/crates/common/src/integrations/nextjs/rsc_placeholders.rs
index b5ca8c69..1aa0b391 100644
--- a/crates/common/src/integrations/nextjs/rsc_placeholders.rs
+++ b/crates/common/src/integrations/nextjs/rsc_placeholders.rs
@@ -104,7 +104,6 @@ impl IntegrationScriptRewriter for NextJsRscPlaceholderRewriter {
 }
 
 #[cfg(test)]
-#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
     use crate::integrations::IntegrationDocumentState;
diff --git a/crates/common/src/integrations/nextjs/script_rewriter.rs b/crates/common/src/integrations/nextjs/script_rewriter.rs
index 192eaa47..4df34935 100644
--- a/crates/common/src/integrations/nextjs/script_rewriter.rs
+++ b/crates/common/src/integrations/nextjs/script_rewriter.rs
@@ -232,7 +232,6 @@ impl UrlRewriter {
 }
 
 #[cfg(test)]
-#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
     use crate::integrations::IntegrationDocumentState;
diff --git a/crates/common/src/integrations/registry.rs b/crates/common/src/integrations/registry.rs
index 956c9252..5ae49dbd 100644
--- a/crates/common/src/integrations/registry.rs
+++ b/crates/common/src/integrations/registry.rs
@@ -511,7 +511,6 @@ impl IntegrationRegistry {
     /// # Panics
     ///
     /// Panics if a route path ends with `/*` but `strip_suffix` unexpectedly fails (invariant violation).
-    #[allow(clippy::unwrap_used)]
     pub fn new(settings: &Settings) -> Result<Self, Report<TrustedServerError>> {
         let mut inner = IntegrationRegistryInner::default();
 
diff --git a/crates/common/src/lib.rs b/crates/common/src/lib.rs
index b9f5fd57..0b31377a 100644
--- a/crates/common/src/lib.rs
+++ b/crates/common/src/lib.rs
@@ -21,6 +21,17 @@
 //! - [`test_support`]: Testing utilities and mocks
 //! - [`why`]: Debugging and introspection utilities
 
+#![cfg_attr(
+    test,
+    allow(
+        clippy::print_stdout,
+        clippy::print_stderr,
+        clippy::panic,
+        clippy::dbg_macro,
+        clippy::unwrap_used,
+    )
+)]
+
 pub mod auth;
 pub mod backend;
 pub mod constants;
diff --git a/crates/common/src/request_signing/endpoints.rs b/crates/common/src/request_signing/endpoints.rs
index 505d05c4..2c3d5f4c 100644
--- a/crates/common/src/request_signing/endpoints.rs
+++ b/crates/common/src/request_signing/endpoints.rs
@@ -335,12 +335,6 @@ pub fn handle_deactivate_key(
 }
 
 #[cfg(test)]
-#[allow(
-    clippy::print_stdout,
-    clippy::print_stderr,
-    clippy::unwrap_used,
-    clippy::panic
-)]
 mod tests {
     use super::*;
     use fastly::http::{Method, StatusCode};
diff --git a/crates/common/src/request_signing/jwks.rs b/crates/common/src/request_signing/jwks.rs
index 3c16b563..2b89c9a5 100644
--- a/crates/common/src/request_signing/jwks.rs
+++ b/crates/common/src/request_signing/jwks.rs
@@ -79,7 +79,6 @@ pub fn get_active_jwks() -> Result<String, TrustedServerError> {
 }
 
 #[cfg(test)]
-#[allow(clippy::panic, clippy::unwrap_used)]
 mod tests {
     use super::*;
     use ed25519_dalek::{Signer, Verifier};
diff --git a/crates/common/src/request_signing/rotation.rs b/crates/common/src/request_signing/rotation.rs
index 24a53679..affc84d4 100644
--- a/crates/common/src/request_signing/rotation.rs
+++ b/crates/common/src/request_signing/rotation.rs
@@ -195,7 +195,6 @@ pub fn generate_date_based_kid() -> String {
 }
 
 #[cfg(test)]
-#[allow(clippy::print_stdout, clippy::print_stderr)]
 mod tests {
     use crate::request_signing::Keypair;
 
diff --git a/crates/common/src/settings.rs b/crates/common/src/settings.rs
index ed519156..d30f5beb 100644
--- a/crates/common/src/settings.rs
+++ b/crates/common/src/settings.rs
@@ -447,7 +447,6 @@ where
 }
 
 #[cfg(test)]
-#[allow(clippy::print_stderr, clippy::unwrap_used)]
 mod tests {
     use super::*;
     use regex::Regex;

From b27f98400d1353dc144cde3b833e61bade29d729 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Wed, 28 Jan 2026 18:56:06 +0530
Subject: [PATCH 5/7] Add future lint considerations

Add needless_pass_by_value and redundant_closure_for_method_calls
to the list of lints to consider enabling as the codebase matures.
---
 clippy.toml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/clippy.toml b/clippy.toml
index 4c562adc..07564932 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -29,10 +29,12 @@ allow-unwrap-in-tests = true
 # =============================================================================
 # Future Considerations
 # =============================================================================
-#
+# 
 # As the codebase matures, consider tightening these thresholds:
 # - cognitive-complexity-threshold = 25 (default)
 # - too-many-lines-threshold = 100 (default)
 #
 # Additional lints to consider enabling in Cargo.toml:
+# - needless_pass_by_value = "warn"
+# - redundant_closure_for_method_calls = "warn"
 # - missing_const_for_fn = "warn"

From 25548587ad9a2d9ad7d3945c454c1fd0f5e0da50 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Wed, 28 Jan 2026 19:07:45 +0530
Subject: [PATCH 6/7] Wrap URL in angle brackets for doc_markdown lint

Fixes clippy::doc_markdown by wrapping the example URL in the
origin_override field documentation with angle brackets.
---
 crates/common/src/integrations/lockr.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/common/src/integrations/lockr.rs b/crates/common/src/integrations/lockr.rs
index 295110b5..83c10dfa 100644
--- a/crates/common/src/integrations/lockr.rs
+++ b/crates/common/src/integrations/lockr.rs
@@ -69,7 +69,7 @@ pub struct LockrConfig {
 
     /// Override the Origin header sent to Lockr API.
     /// Use this when running locally or from a domain not registered with Lockr.
-    /// Example: "https://www.example.com"
+    /// Example: "<https://www.example.com>"
     #[serde(default)]
     #[validate(url)]
     pub origin_override: Option<String>,

From a0e54983f73225ab75f10aec3e2260d85ad830c5 Mon Sep 17 00:00:00 2001
From: prk-Jr <prakashsagwara@gmail.com>
Date: Wed, 28 Jan 2026 21:23:27 +0530
Subject: [PATCH 7/7] Resolve clippy lint errors after merging main

---
 crates/common/src/creative.rs  | 2 ++
 crates/common/src/proxy.rs     | 4 ++--
 crates/common/src/publisher.rs | 2 +-
 crates/fastly/src/main.rs      | 2 +-
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/crates/common/src/creative.rs b/crates/common/src/creative.rs
index 3036c805..04e45900 100644
--- a/crates/common/src/creative.rs
+++ b/crates/common/src/creative.rs
@@ -291,6 +291,7 @@ pub(super) fn proxied_attr_value(settings: &Settings, attr_val: Option<String>)
 
 /// Rewrite a full CSS stylesheet body by normalizing url(...) references to the
 /// unified first-party proxy. Relative URLs are left unchanged.
+#[must_use]
 pub fn rewrite_css_body(settings: &Settings, css: &str) -> String {
     rewrite_style_urls(settings, css)
 }
@@ -301,6 +302,7 @@ pub fn rewrite_css_body(settings: &Settings, css: &str) -> String {
 /// - `<iframe src>` (absolute or protocol-relative) → `/first-party/proxy?tsurl=&lt;base-url&gt;&lt;params&gt;&tstoken=&lt;sig&gt;`
 /// - Injects the `tsjs-creative` script once at the top of `<body>` to safeguard click URLs inside creatives
 ///   (served from `/static/tsjs=tsjs-creative.min.js`).
+#[must_use]
 pub fn rewrite_creative_html(settings: &Settings, markup: &str) -> String {
     // No size parsing needed now; all absolute/protocol-relative URLs are proxied uniformly.
     let mut out = Vec::with_capacity(markup.len() + 64);
diff --git a/crates/common/src/proxy.rs b/crates/common/src/proxy.rs
index 48664f7e..d87ae358 100644
--- a/crates/common/src/proxy.rs
+++ b/crates/common/src/proxy.rs
@@ -151,14 +151,14 @@ fn finalize_proxied_response(
         // HTML: rewrite and serve as HTML (safe to read as string)
         let body = beresp.take_body_str();
         let rewritten = crate::creative::rewrite_creative_html(settings, &body);
-        return rebuild_text_response(beresp, "text/html; charset=utf-8", rewritten);
+        return rebuild_text_response(&beresp, "text/html; charset=utf-8", rewritten);
     }
 
     if ct.contains("text/css") {
         // CSS: rewrite url(...) references in stylesheets (safe to read as string)
         let body = beresp.take_body_str();
         let rewritten = crate::creative::rewrite_css_body(settings, &body);
-        return rebuild_text_response(beresp, "text/css; charset=utf-8", rewritten);
+        return rebuild_text_response(&beresp, "text/css; charset=utf-8", rewritten);
     }
 
     // Image handling: set generic content-type if missing and log pixel heuristics
diff --git a/crates/common/src/publisher.rs b/crates/common/src/publisher.rs
index 30c594bf..58907cc6 100644
--- a/crates/common/src/publisher.rs
+++ b/crates/common/src/publisher.rs
@@ -82,7 +82,7 @@ fn detect_request_scheme(req: &Request) -> String {
 /// # Errors
 ///
 /// This function never returns an error; the Result type is for API consistency.
-pub fn handle_tsjs_dynamic(req: Request) -> Result<Response, Report<TrustedServerError>> {
+pub fn handle_tsjs_dynamic(req: &Request) -> Result<Response, Report<TrustedServerError>> {
     const PREFIX: &str = "/static/tsjs=";
     let path = req.get_path();
     if !path.starts_with(PREFIX) {
diff --git a/crates/fastly/src/main.rs b/crates/fastly/src/main.rs
index 0350c948..2f26271f 100644
--- a/crates/fastly/src/main.rs
+++ b/crates/fastly/src/main.rs
@@ -65,7 +65,7 @@ async fn route_request(
     // Match known routes and handle them
     let result = match (method, path.as_str()) {
         // Serve the tsjs library
-        (Method::GET, path) if path.starts_with("/static/tsjs=") => handle_tsjs_dynamic(req),
+        (Method::GET, path) if path.starts_with("/static/tsjs=") => handle_tsjs_dynamic(&req),
 
         // Discovery endpoint for trusted-server capabilities and JWKS
         (Method::GET, "/.well-known/trusted-server.json") => {