fraiseql_core/security/
mod.rs

1//! Security features
2//!
3//! This module provides core security infrastructure:
4//! - Security profiles (STANDARD, REGULATED)
5//! - Security headers configuration
6//! - Sensitive field masking for PII/regulated data
7//! - Field selection filtering for access control
8//! - Security error types
9//! - Authentication middleware (JWT, Auth0, Clerk)
10//! - OIDC/JWKS support for any OIDC-compliant provider
11//! - Query validation (depth, complexity)
12//! - Audit logging
13//! - TLS enforcement
14//! - Introspection control
15//! - Error formatting
16
17pub mod audit;
18#[cfg(feature = "audit-syslog")]
19pub mod audit_export_syslog;
20#[cfg(feature = "audit-webhook")]
21pub mod audit_export_webhook;
22pub mod auth_middleware;
23pub mod authorizer;
24pub mod error_formatter;
25pub mod errors;
26pub mod field_authorizer;
27pub mod field_filter;
28pub mod field_masking;
29pub mod headers;
30pub mod introspection_enforcer;
31pub mod kms;
32pub mod oidc;
33pub mod profiles;
34pub mod query_validator;
35pub mod rls_policy;
36pub mod security_context;
37pub mod tls_enforcer;
38pub mod validation_audit;
39
40// Re-export key types for convenience
41pub use audit::{
42    AuditEntry, AuditExportConfig, AuditExporter, AuditLevel, AuditLogger, AuditStats,
43    SyslogExportConfig, WebhookExportConfig,
44};
45#[cfg(feature = "audit-syslog")]
46pub use audit_export_syslog::SyslogAuditExporter;
47#[cfg(feature = "audit-webhook")]
48pub use audit_export_webhook::WebhookAuditExporter;
49pub use auth_middleware::{AuthConfig, AuthMiddleware, AuthRequest, AuthenticatedUser, SigningKey};
50pub use authorizer::{Authorizer, AuthzDecision, AuthzRequest, OperationKind};
51pub use error_formatter::{DetailLevel, ErrorFormatter};
52pub use errors::SecurityError;
53pub use field_authorizer::{FieldAuthorizer, FieldAuthzDecision, FieldAuthzRequest};
54pub use field_filter::{FieldAccessError, FieldFilter, FieldFilterBuilder, FieldFilterConfig};
55pub use field_masking::{FieldMasker, FieldSensitivity};
56pub use headers::SecurityHeaders;
57pub use introspection_enforcer::{IntrospectionEnforcer, IntrospectionPolicy};
58pub use kms::{
59    BaseKmsProvider, DataKeyPair, EncryptedData, KeyPurpose, KeyReference, KeyState, KmsError,
60    KmsResult, RotationPolicy, VaultConfig, VaultKmsProvider,
61};
62pub use oidc::{OidcConfig, OidcValidator};
63pub use profiles::SecurityProfile;
64pub use query_validator::{QueryValidator, QueryValidatorConfig};
65pub use rls_policy::{CompiledRLSPolicy, DefaultRLSPolicy, NoRLSPolicy, RLSPolicy, RlsWhereClause};
66pub use security_context::SecurityContext;
67pub use tls_enforcer::{TlsConfig, TlsConnection, TlsEnforcer, TlsVersion};
68pub use validation_audit::{
69    RedactionPolicy, ValidationAuditEntry, ValidationAuditLogger, ValidationAuditLoggerConfig,
70};
71
72pub use crate::graphql::complexity::QueryMetrics;
73
74#[cfg(test)]
75mod tests;
fraiseql_core/security/mod.rs

fraiseql_core/security/
mod.rs
