feat(cloudfront): OAC + cache, origin request, response headers, continuous deployment policies

[vieiralucas]

Summary

• Origin Access Control: full CRUD + List with ETag/If-Match concurrency
• Cache Policy: full CRUD + List with ?Type=managed|custom filter
• Origin Request Policy: full CRUD + List
• Response Headers Policy: full CRUD + List
• Continuous Deployment Policy: full CRUD + List
• AWS-managed cache, origin-request, response-headers policies pre-seeded by their well-known IDs (Managed-CachingOptimized etc.) and reject Update/Delete with IllegalUpdate/IllegalDelete
• +30 ops (cloudfront 29 -> 59, total 2,077 -> 2,107)

Test plan

• cargo test -p fakecloud-cloudfront — 16 unit tests pass
• cargo test -p fakecloud-e2e --test cloudfront_policies — 6 E2E tests pass
• FAKECLOUD_RUN_CONFORMANCE=1 cargo test -p fakecloud-conformance --test cloudfront_policies — 30 conformance tests pass
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo fmt --all clean
• README + website docs updated to reflect new ops + managed-policy seeding

---

Summary by cubic

Adds CloudFront OAC and Cache/Origin Request/Response Headers/Continuous Deployment policies with full CRUD + List. Seeds AWS‑managed policies, enforces ETag/If-Match, fixes managed Response Headers policy IDs and by‑X ListDistributions response roots, validates Name on Update, and bumps CloudFront ops 29→59 (total 2,107).

• New Features
  • Full CRUD + List for OAC, CachePolicy, OriginRequestPolicy, ResponseHeadersPolicy, ContinuousDeploymentPolicy.
  • ETag/If-Match concurrency and separate Get* and Get*Config endpoints.
  • AWS‑managed Cache/OriginRequest/ResponseHeaders policies pre-seeded; Update/Delete return IllegalUpdate/IllegalDelete; ListCachePolicies supports ?Type=managed|custom.

^{Written for commit b29585b. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 10.44003% with 1038 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...rates/fakecloud-cloudfront/src/policies_service.rs	0.00%	898 Missing ⚠️
crates/fakecloud-cloudfront/src/policies.rs	46.66%	128 Missing ⚠️
crates/fakecloud-cloudfront/src/service.rs	52.94%	8 Missing ⚠️
crates/fakecloud-cloudfront/src/state.rs	0.00%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

2 issues found across 10 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-cloudfront/src/policies.rs">

<violation number="1" location="crates/fakecloud-cloudfront/src/policies.rs:603">
P2: Duplicate managed response-headers policy ID causes one seeded policy to overwrite another.</violation>
</file>

<file name="crates/fakecloud-cloudfront/src/policies_service.rs">

<violation number="1" location="crates/fakecloud-cloudfront/src/policies_service.rs:315">
P2: Update handlers miss the non-empty `Name` validation used by create handlers, so invalid policy names can be persisted via update.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}