Module security_config 

The unified configuration surface: the reference SecurityConfig (guard_core/_security_config_fields.py, 129 fields) fieldized for the Rust family.

Every field carries the reference default in SecurityConfig::default and every reference constraint in SecurityConfig::validate (the pydantic gt/ge/le bounds, the IP-or-CIDR list parsing, and the cross-field agent rules). Validation collects every violation into one SecurityConfigError (the reference raises per-field pydantic errors; the engine answers with the full problem list, fail-closed).

The four seams the reference types as callables/handlers map onto engine-native types:

Python field	Rust type
geo_ip_handler: GeoIPHandler	Arc<dyn GeoIpHandler> (crate::geo)
custom_request_check	CustomRequestFn (crate::custom_checks)
auth_verifier	AuthVerifier (crate::headers_auth)
cloud_ip_store: CloudIpStoreProtocol	Arc<dyn CloudRangeStore> (crate::cloud_fetch)
on_block	OnBlockHook (crate::payload)
on_error	OnErrorFn (crate::payload)
custom_response_modifier	ResponseModifierFn (crate::payload)

The agent_* group is carried as data (the fields exist here for parity; the wiring into guard-agent-rs’s AgentConfig is the adapter lane’s R5 seam).

Example

use guard_core_engine::security_config::SecurityConfig;

let mut config = SecurityConfig::default();
assert!(config.validate().is_ok());

config.auto_ban_threshold = 0;
let error = config.validate().unwrap_err();
assert!(error
    .problems
    .iter()
    .any(|problem| problem.contains("auto_ban_threshold")));

Structs

SecurityConfig

The unified configuration surface (the reference SecurityConfig).

SecurityConfigError

Every reference violation at once: the config error SecurityConfig::validate fails closed with.

Enums

BufferOverflowPolicy

The agent buffer overflow posture (the reference Literal['drop', 'block', 'raise']), None defers to the agent’s own default.

LogFormat

The log-line format knob (the reference Literal['text', 'json']).

LogLevel

A log-severity knob value (the reference Literal['INFO', 'DEBUG', 'WARNING', 'ERROR', 'CRITICAL']).

Constants

ALL_DETECTION_CATEGORIES

The reference detection-category set (ALL_DETECTION_CATEGORIES, 19 categories) - SecurityConfig::enabled_detection_categories’s default.