yaissaoui / magento2-fastly-list-snippets

v1.0.0 2026-10-30 12:04 UTC

Requires

• php: >=8.2
• fastly/magento2: *
• magento/framework: >=103.0.6
• magento/module-backend: *
• magento/module-config: *
• magento/module-ui: *

MIT

• Yassine AISSAOUI

• magento
• snippets
• fastly
• waf
• magento2
• adobe-commerce
• vcl

Published on Packagist.org on 2026-10-30 13:17 UTC

README

See every VCL snippet running on your Fastly service, right from the Magento admin. Read-only.

The official Fastly module only shows the custom snippets stored in var/vcl_snippets_custom/. Snippets added directly on the Fastly service (security patches, Next-Gen WAF, support, Fastly console) are invisible in Magento, yet they run on every request. When one of them returns a 403 Access Denied on an admin save, Magento has nothing to show.

This module adds that missing view. It is an add-on for fastly/magento2, not a replacement, and it is not affiliated with Fastly, Inc.

Features

• Admin grid of all the snippets of the active version, or of one of the last 10 versions.
• Origin of each snippet: Magento (uploaded by the Fastly module, name starting with magentomodule_) or Outside Magento.
• Admin path check: flags the rules written for /admin that do not cover your real admin path (custom admin path included).
• Keyword search in names and VCL code, filters on every column, sorting.
• VCL popup with line numbers, search, "matching lines only" and copy.
• Summary in the Fastly configuration, and a fastly:snippets:list CLI command.
• Read-only by design: the module only sends GET requests to the Fastly API.

Requirements

• Magento Open Source or Adobe Commerce 2.4.6 or later
• PHP 8.2 or later
• fastly/magento2, with the Fastly service ID and API token configured

Installation

With Composer:

composer require yaissaoui/magento2-fastly-list-snippets
bin/magento module:enable Fastly_ListSnippets
bin/magento setup:upgrade
bin/magento cache:flush

Or copy the module to app/code/Fastly/ListSnippets and run the last three commands. In production mode, also run bin/magento setup:di:compile and bin/magento setup:static-content:deploy.

Usage

Admin

System > Tools > Fastly VCL Snippets

• The messages on top show the connection test, the active version, the number of snippets outside Magento and the admin path checked.
• Search 403, admin or req.url to find the rule that blocks a request.
• Filter Admin path on Does not cover the admin path to list the risky rules.
• Pick a Version to see the snippets of a previous version, and compare before and after a change.
• Refresh from Fastly reloads the data from the Fastly API.

The Fastly configuration (Stores > Configuration > Advanced > System > Full Page Cache > Fastly Configuration) gets a read-only summary with a link to the grid:

Access uses the same ACL as the Fastly configuration: Magento_Config::config_system.

Command line

# All snippets of the active version
bin/magento fastly:snippets:list

# Only the snippets created outside Magento
bin/magento fastly:snippets:list --origin=external

# The VCL of one snippet
bin/magento fastly:snippets:list --name=adobe_rce_patch --show-content

The rules that do not cover the admin path are printed after the table:

adobe_rce_patch does not cover /backoffice: (?i)^/admin

The command returns 1 when the Fastly API is not configured or cannot be reached.

How the admin path check works

The admin path is read from backend/frontName in app/etc/env.php, or from the custom admin path (admin/url/use_custom_path).

A snippet is flagged when one of its regular expressions contains admin, matches /admin/ and does not match /<your admin path>/. For example, with an admin on /backoffice:

if (req.method == "POST" && req.url !~ "(?i)^/admin") {
    # also applies to /backoffice: admin saves are handled like public requests
}

The check is informative only. Snippets created outside Magento must be fixed where they were created (Fastly console, or your hosting provider support).

Cache

The Fastly API responses are cached for 5 minutes in the Magento application cache, with the FASTLY_LIST_SNIPPETS tag. Use Refresh from Fastly, or bin/magento cache:flush.

Contributing

Contributions are welcome! Bug reports, ideas and pull requests are all appreciated.

1. Open an issue to report a bug or discuss a feature.
2. Fork the repository and create a branch from main.
3. Keep the module read-only: only GET requests to the Fastly API.
4. Follow the Magento coding standard (vendor/bin/phpcs --standard=Magento2).
5. Test on Magento 2.4.6 or later, then open a pull request with a short description and, for UI changes, a screenshot.

Author

Yassine AISSAOUI (@yaissaoui, [e-mail])

License

MIT