Struct RequestValidator 

pub struct RequestValidator;

Shared validation facade routed through by HTTP handlers, MCP tools, and CLI subcommands (issue #966, Wave-2 Tier-C1).

Each method bundles the field-level + cross-field checks for a single request shape. Behavior is identical to chaining the per-field free functions in the order they appear inside the method body — RequestValidator is the canonical surface for adding NEW cross-field rules without forcing every caller to re-audit its inline validator sequence.

NSA CSI MCP Security mapping

Primary defense against NSA concern (i) Tool parameter injection (real-world issue) and implementation of NSA recommendation (c) Validate parameters per the NSA Cybersecurity Information document on MCP security (U/OO/6030316-26 | PP-26-1834, May 2026, Version 1.0). Every wire-entry layer — HTTP routes (EXPECTED_PRODUCTION_ROUTES_COUNT=89 in src/lib.rs), MCP tools (Profile::full().expected_tool_count()=74 per src/profile.rs), CLI subcommands (EXPECTED_CLI_SUBCOMMANDS_DEFAULT=80 / _SAL=82 in src/lib.rs) — routes DTO-bundling validation through RequestValidator so adding a new cross-field invariant is one struct-method edit rather than 3+ audited per-surface edits. The typed ValidationError { field, reason } carries explicit field attribution while preserving byte-equal wire-side error messages for v0.6.x backwards compatibility. Mapping anchor: request_validator_input_validation in docs/compliance/_inventory/v0.7.0-capabilities.json; narrative in docs/compliance/nsa-csi-mcp.html §3.9 (concern i) and §4.3 (recommendation c).

Example

use crate::validate::RequestValidator;

// Inside an HTTP handler:
RequestValidator::validate_create(&body)?;

// Inside an MCP tool:
RequestValidator::validate_link_triple(&source_id, &target_id, &relation)
    .map_err(|e| e.to_string())?;

Implementations

impl RequestValidator

pub fn validate_create(req: &CreateMemory) -> Result<(), ValidationError>

Full CreateMemory request validation (HTTP POST /api/v1/memories, MCP memory_store, CLI store). Delegates to the free-function validate_create to preserve the existing field order and error wording.

Errors

Returns the first per-field failure as a ValidationError.

pub fn validate_update(req: &UpdateMemory) -> Result<(), ValidationError>

Full UpdateMemory request validation (HTTP PUT /api/v1/memories/{id}, MCP memory_update, CLI update). Validates only the fields that are Some(_) per the UpdateMemory partial-update contract.

Errors

Returns the first per-field failure as a ValidationError.

pub fn validate_memory(req: &Memory) -> Result<(), ValidationError>

Full Memory validation (import / federation receive / admin restore paths). Validates every required field on the row itself — stricter than validate_create because the import row carries timestamps, IDs, etc. that the create surface stamps server-side.

Errors

Returns the first per-field failure as a ValidationError.

pub fn validate_link_triple( source_id: &str, target_id: &str, relation: &str, ) -> Result<(), ValidationError>

Link creation triple validation. Matches the legacy validate_link free function exactly.

Errors

Returns the first per-field failure as a ValidationError.

pub fn validate_consolidate( ids: &[String], title: &str, summary: &str, namespace: &str, ) -> Result<(), ValidationError>

Memory-consolidation request validation. Mirrors validate_consolidate exactly.

Errors

Returns the first per-field failure as a ValidationError.

pub fn validate_id(id: &str) -> Result<(), ValidationError>

Single-field id validation, surfaced through the facade for consistency with the other entry points. Used by GET/DELETE handlers that don’t have a richer DTO.

Errors

Returns ValidationError tagged with field = "id".

pub fn validate_namespace(ns: &str) -> Result<(), ValidationError>

Single-field namespace validation.

Errors

Returns ValidationError tagged with field = "namespace".

pub fn validate_agent_id(agent_id: &str) -> Result<(), ValidationError>

Wire-side agent_id validation (rejects shape violations AND the reserved internal sentinel set per issue #977).

Errors

Returns ValidationError tagged with field = "agent_id".

pub fn validate_id_and_namespace( id: &str, ns: &str, ) -> Result<(), ValidationError>

Two-of-a-kind bundle: validate an id AND a namespace in one call. Saves a ? per surface site where both come off the same request body (the dominant duplication pattern observed in the pre-#966 handler/MCP audit — validate_id and validate_namespace co-occur on >20 sites).

Errors

Returns the first failure (id-first, then namespace).

pub fn validate_owner_write( id: &str, ns: &str, agent_id: &str, ) -> Result<(), ValidationError>

Three-of-a-kind bundle: validate id + namespace + agent_id together. Pre-#966 this was the canonical “ownership-checked write path” preamble; the facade lets new handlers express the intent as one call.

Errors

Returns the first failure in declaration order.

pub fn validate_confidence_and_priority( confidence: f64, priority: i32, ) -> Result<(), ValidationError>

Confidence (0.0..=1.0) + priority (1..=10) cross-field bundle. Mirrors the inline pair inside validate_create; surfaced here so callers that synthesize a custom DTO (e.g. the bulk_create postgres handler) get the same numeric gates without re-implementing them.

Errors

Returns the first failure (confidence-first, then priority).