Expand description
Runtime-, transport-, provider-, and database-neutral security contracts.
The crate turns Part 27’s threat model into typed, fail-closed boundaries. Authentication
adapters establish AuthenticationEvidence; authoritative services consume only a
ValidatedAuthContext. External inputs pass explicit budgets, outbound destinations are
checked after DNS resolution, durable operation identities bind immutable semantics, and
security telemetry remains payload-free and low-cardinality.
Structs§
- Archive
Entry - Archive entry metadata validated before extraction.
- Authentication
Evidence - Authentication evidence produced by a trusted authentication adapter.
- Authentication
Policy - Authentication policy enforced before protected traffic enters domain authorization.
- Authority
Epoch Guard - Authority rollback guard retained by clients and trusted stores.
- Authorized
Resource - Resource whose trusted ownership matched the authenticated tenant.
- Egress
Policy - Egress policy applied to every initial URL and every redirect.
- Input
Shape - Measured shape supplied by a bounded decoder.
- Operation
Binding - Immutable semantic binding for one operation identity.
- Operation
Replay Guard - Bounded reference replay registry. Durable ledgers implement the same comparison contract.
- Protocol
Limits - Bounds applied before or during parsing externally controlled input.
- Secret
String - Secret text that zeroizes on drop, never serializes, and always redacts
Debug/Display. - Security
Event - Typed, payload-free security events for audit and immediate alert routing.
- Security
Event Id - Stable identity of one security event.
- Security
Invariant - Stable Part 27 invariant registry entry.
- Security
Policy - Complete security policy with explicit safe profiles.
- Side
Effect Safety - Tenant
Binding - Proof that a client claim was checked against server-derived identity.
- Tenant
Resource - Tenant ownership resolved from a trusted repository lookup.
- Upload
Limits - Bounds for uploaded blobs and archive expansion.
- Validated
Auth Context - Validated identity. Fields remain private so callers cannot construct trusted context directly.
- Validated
Outbound Target - Destination checked against DNS answers. Revalidate immediately before every connection.
Enums§
- Archive
Entry Kind - Assurance
Level - Authentication strength used for step-up decisions.
- Attacker
Class - Attacker classes that every subsystem threat review must consider.
- Auth
Method - Server-observed authentication mechanism.
- Browser
Control - Mandatory browser control that a host adapter must enforce.
- Deployment
Control - Deployment control required by a security profile.
- Device
State - Current server-side device state.
- Epoch
Disposition - Outbound
Scheme - Replay
Disposition - Resource
Kind - Identifier category used without exposing the underlying business identifier.
- Security
Asset - Critical assets enumerated by the normative threat model.
- Security
Error - Security
Error Code - Stable client-safe error codes; variants do not carry secrets or internal details.
- Security
Event Kind - Security
Level - Deployment security posture. These are architecture profiles, not certifications.
- Security
Metric - Metric series allowed by core. Identity values belong in access-controlled logs/traces.
- Security
Severity - Side
Effect Risk - Side-effect risk category used to enforce explicit idempotency/reconciliation.
- Trust
Boundary - Explicit boundary where data must be authenticated, authorized, and bounded again.
Constants§
- ATTACKER_
CLASSES - MAX_
SECURITY_ IDENTIFIER_ BYTES - Maximum length of issuer, audience, host, and stable reason identifiers.
- SECURITY_
ASSETS - SECURITY_
INVARIANTS - SECURITY_
SCHEMA_ VERSION - Schema version for serialized security policy and event contracts.
- TRUST_
BOUNDARIES