dwara_core/security/
mod.rs

1//! Security bounded context: establishing and enforcing caller identity.
2//!
3//! Listener/upstream TLS machinery ([`tls`]), request authentication
4//! ([`authn`]), request authorization ([`authz`]), OAuth2
5//! client-credentials proxying ([`oauth2`], DW-035), OpenID Connect
6//! discovery / introspection / token exchange / auth-code+PKCE
7//! ([`oidc`], DW-034), FIPS 140-3 mode enforcement ([`fips`],
8//! DW-111), post-quantum TLS hybrid key exchange ([`pq`], DW-105),
9//! bot detection hooks ([`bot_hooks`], DW-109), signed URL request
10//! authentication ([`signed_url`], DW-109), and upstream TLS
11//! certificate pinning ([`cert_pinning`], DW-109). May depend on
12//! config, state, and observability.
13
14pub mod authn;
15pub mod authz;
16// DW-060: Cedar + OPA authorization. Feature-gated behind the
17// `cedar` cargo feature (default OFF).
18pub mod cedar;
19// DW-111: FIPS 140-3 mode enforcement. The module compiles in every
20// build; when the `fips` cargo feature is OFF, all functions are inert
21// (FipsMode::Disabled, no self-test, no primitive restriction).
22pub mod fips;
23pub mod geoip;
24pub mod oauth2;
25pub mod oidc;
26// DW-105: Post-quantum TLS (X25519+ML-KEM hybrid key exchange). The
27// module compiles in every build; when the `pq` cargo feature is OFF,
28// all functions are inert (PqMode::Disabled, no kx group manipulation).
29pub mod pq;
30pub mod tls;
31// DW-109: Bot detection hooks. Part of the default build (no feature
32// gate): a simple regex-based pre-request and post-response check,
33// like WAF-lite (DW-051). The engine compiles bot hooks from config
34// and evaluates requests against them.
35pub mod bot_hooks;
36// DW-109: Signed URL request authentication. Feature-gated behind
37// the `signed_url` cargo feature (default OFF). The verifier
38// extracts the signature from the query string, recomputes the
39// HMAC-SHA256 over the canonical request, and checks the expiry.
40pub mod signed_url;
41// DW-109: Upstream TLS certificate pinning (SPKI hash). Feature-gated
42// behind the `cert_pinning` cargo feature (default OFF). The verifier
43// computes SHA-256 of the upstream cert's SubjectPublicKeyInfo and
44// compares against the configured pin.
45pub mod cert_pinning;
46
47// SEC-02: ACME / Let's Encrypt automation. The config block is always
48// accepted by the parser (additive-only); the runtime client is behind
49// the `acme` cargo feature (default OFF). When the feature is OFF the
50// block is inert (validation warns).
51pub mod acme;
dwara_core/security/mod.rs

dwara_core/security/
mod.rs
