Module decorators 

The reference decorator system (guard_core/decorators/*.py): the SecurityDecorator registry and its mixin method surface, ported method for method.

Python applies decorators to route functions and stamps a route id on the callable; Rust has no runtime function attributes, so the idiom is a named route id: every mixin method takes the route id the application chose (the reference derives it from module.qualname, the stand-in is the caller’s stable name, by convention "<METHOD> <path>"), and the registry hands the RouteConfig carrier to the adapters’ with_route_configs resolvers. Semantics are the reference’s, exactly:

• first touch creates the route’s RouteConfig with enable_suspicious_detection seeded from the config’s enable_penetration_detection and bumps the revision (BaseSecurityDecorator._ensure_route_config),
• every mutation is revision-tracked (RouteConfigRevision),
• bypass keeps only the reference VALID_BYPASS_CHECKS names and drops the rest (the unknowns are returned to the caller, the reference logs them),
• block_clouds with no argument blocks every VALID_CLOUD_PROVIDERS entry; named entries outside the reference set are ignored and returned,
• require_auth/api_key_auth conflict with require_authorization_header and fail closed (DecoratorError),
• return_monitor/behavior_analysis validate every return_pattern compiles (the reference _validate_return_pattern_body_scan’s compile half),
• honeypot_detection registers the reference’s honeypot validator (form and JSON trap-field probe over the buffered body, POST/PUT/ PATCH only, 403 "Forbidden").

Structs

DecoratorError

Why a decorator factory refused a value: the reference raises ValueError on the auth-conflict combinations and on an uncompilable return_pattern.

SecurityDecorator

The decorator registry (SecurityDecorator): the config it reads its defaults from, the per-route RouteConfigs, and the revision counter every mutation bumps.

Constants

VALID_BYPASS_CHECKS

The reference VALID_BYPASS_CHECKS: the names [SecurityDecorator:: bypass] keeps.

VALID_CLOUD_PROVIDERS

The reference VALID_CLOUD_PROVIDERS (CloudProvider = Literal["AWS", "GCP", "Azure", "DigitalOcean", "Linode", "Vultr"]).