lnmp 0.5.16

LNMP (LLM Native Minimal Protocol) - Meta crate providing unified access to all LNMP modules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

//! Secure API Gateway - Showcase Example
//!
//! API gateway that sanitizes and routes untrusted external data.
//! Demonstrates input sanitization, envelopes, transport headers, and routing.
//!
//! Run: `cargo run --example secure_api_gateway`

use lnmp::prelude::*;
use std::time::{SystemTime, UNIX_EPOCH};

fn current_timestamp() -> u64 {
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_millis() as u64
}

/// Simulated external API request
struct ApiRequest {
    endpoint: String,
    user_input: String,
    source_ip: String,
}

fn main() {
    println!("🔒 Secure API Gateway - LNMP Showcase\n");

    // Simulated untrusted API requests
    let requests = [
        ApiRequest {
            endpoint: "/api/users".to_string(),
            user_input: r#"F20=<script>alert("XSS")</script>;F7=true"#.to_string(),
            source_ip: "203.0.113.42".to_string(),
        },
        ApiRequest {
            endpoint: "/api/search".to_string(),
            user_input: r#"F30=' OR '1'='1;F31=DROP TABLE"#.to_string(),
            source_ip: "untrusted-bot".to_string(),
        },
        ApiRequest {
            endpoint: "/api/config".to_string(),
            user_input: "F50=critical-data;F51=admin".to_string(),
            source_ip: "trusted-service".to_string(),
        },
    ];

    // Configure aggressive sanitization for untrusted input
    let sanitize_config = lnmp::sanitize::SanitizationConfig {
        level: lnmp::sanitize::SanitizationLevel::Aggressive,
        auto_quote_strings: true,
        auto_escape_quotes: true,
        normalize_booleans: true,
        normalize_numbers: true,
    };

    println!("🛡️  Processing {} API requests:\n", requests.len());

    for (idx, request) in requests.iter().enumerate() {
        println!("Request #{} - {}", idx + 1, request.endpoint);
        println!("  Source: {}", request.source_ip);
        println!("  Raw input: {}", request.user_input);

        // Step 1: Sanitize untrusted input
        let sanitized = lnmp::sanitize::sanitize_lnmp_text(&request.user_input, &sanitize_config);
        let was_modified = sanitized != request.user_input;

        if was_modified {
            println!("  ⚠️  Input sanitized for security");
            println!("  Sanitized: {}", sanitized);
        } else {
            println!("  ✅ Input clean");
        }

        // Step 2: Parse sanitized LNMP
        let record = match Parser::new_lenient(&sanitized) {
            Ok(mut parser) => match parser.parse_record() {
                Ok(r) => r,
                Err(e) => {
                    println!("  ❌ Parse error: {}", e);
                    continue;
                }
            },
            Err(e) => {
                println!("  ❌ Parser init error: {}", e);
                continue;
            }
        };

        // Step 3: Wrap in operational envelope
        let now = current_timestamp();
        let envelope = lnmp::envelope::EnvelopeBuilder::new(record)
            .timestamp(now)
            .source("api-gateway")
            .trace_id(format!("trace-{}", idx + 1))
            .build();

        // Step 4: Determine routing based on source trust
        let is_trusted = request.source_ip.contains("trusted");
        let priority = if is_trusted { 200 } else { 100 };

        let route = if is_trusted {
            "🚀 FAST_LANE"
        } else {
            "🐌 INSPECTION_QUEUE"
        };

        println!("  Route: {} (priority: {})", route, priority);

        // Step 5: Trace context for observability
        if let Some(trace) = &envelope.metadata.trace_id {
            println!("  Trace ID: {}", trace);
        }

        println!();
    }

    println!("✅ All requests processed!");
    println!("\n💡 Key Features Demonstrated:");
    println!("   • Aggressive input sanitization (XSS/SQL injection protection)");
    println!("   • Lenient parsing for robustness");
    println!("   • Operational envelopes with trace context");
    println!("   • Trust-based routing decisions");
    println!("   • Meta crate integration (lnmp::*)");
}