Struct RouteWaf 

pub struct RouteWaf {
    pub enabled: bool,
    pub dry_run: bool,
    pub filters: Vec<String>,
    pub max_body_inspect_bytes: u64,
    pub custom_patterns: Vec<String>,
}

Route-scoped WAF-lite config (DW-051, routes[].waf).

A lightweight, heuristic-based web application filter: regex pattern matching for SQL injection, XSS, and path traversal signatures across the request path, query string, selected headers (User-Agent, Referer, Cookie, X-Forwarded-For), and body (when the content type is JSON or form-urlencoded, up to max_body_inspect_bytes). This is NOT a full WAF — it is a first-line traffic filter that rejects obvious attack signatures before authentication or rate limiting. Per-route opt-in; routes without a waf block are never inspected.

Fields

enabled: bool

Master switch. Default false: the WAF block is inert even when present (allows staged rollout). When true, the configured filter categories run on every request the route matches.

dry_run: bool

Audit-log-only mode (dry-run synergy, DW-041): when true, the WAF evaluates every filter and LOGS matches (a dwara::policy warn event + the dwara_waf_total{outcome="logged"} counter) but does NOT block — the request continues to the upstream. Lets an operator observe what the WAF would catch before enforcing it. Default false: matches are blocked with 403.

filters: Vec<String>

Which filter categories to run. An empty or absent list defaults to all three (sqli, xss, path_traversal). Validation rejects an enabled WAF with an explicit non-empty list containing an unknown category name.

max_body_inspect_bytes: u64

Maximum number of body bytes to inspect (0 = do not inspect the body at all; 1..=1048576 = inspect up to this many bytes). Default 131072 (128 KiB). Bodies larger than this limit are inspected only up to the limit (a malicious payload beyond the limit is not caught — the trade-off for a bounded inspection cost). Validation rejects values > 1048576 (1 MiB).

custom_patterns: Vec<String>

Optional custom regex pattern overrides (additional patterns appended to the built-in signatures for each filter category). Each entry is a regex string compiled at config publish time; an invalid regex fails validation. When absent, only the built-in signatures are used.

Trait Implementations

impl Clone for RouteWaf

fn clone(&self) -> RouteWaf

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RouteWaf

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RouteWaf

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for RouteWaf

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for RouteWaf

fn eq(&self, other: &RouteWaf) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for RouteWaf

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RouteWaf