Module dynamic_rules 

The dynamic-rules carrier: the reference DynamicRules wire model and its manager-side logic (handlers/_dynamic_rule_*.py + _dynamic_rules.py).

The carrier holds the wire model, the last-known snapshot envelope, the update gating, the event matcher, and the config application. Sources, piece by piece:

• the model: _dynamic_rules.py DynamicRules (the same field set the guard-agent wire model carries; the defaults land verbatim - ttl = 300, ip_ban_duration = 3600, emergency_mode = false);
• the snapshot envelope: dump_last_known_rules_snapshot / load_last_known_rules_snapshot (the schema_version guard rejects unsupported versions at load);
• the gating: DynamicRuleManager._should_update_rules (a new rule id always updates; a same-id rule only when its version advances), _has_rule_expired / _reject_if_already_expired;
• the correlation: DynamicRuleManager.match_event (the IP, country, and event-type arms the enricher reads);
• the application: DynamicRuleApplicationMixin landings on the unified config - uppercased country sets, the global/window/endpoint rate tiers, the VALID_CLOUD_PROVIDERS-validated cloud set (the AWS:!region scoping survives verbatim), the ReDoS-validated user agent list (rejected patterns surface in the outcome), the feature toggles, and the emergency-mode activation with the halved auto-ban threshold (max(1, threshold / 2)).

The module is pure: the bans, unbans, and pattern additions come back in the AppliedDynamicRules outcome for the caller’s stateful seams (the ban manager, the pattern store), while the config-mutating half lands directly on the SecurityConfig the caller owns.

Structs

AppliedDynamicRules

What applying one rule produced.

DynamicRules

The reference DynamicRules wire model, field for field (the same shape the guard-agent models carry).

LastKnownRulesSnapshot

The reference snapshot envelope (LastKnownRulesSnapshot): the schema version beside the mirrored rules.

SnapshotError

A snapshot load failure (the version guard and the JSON decode).

Constants

LAST_KNOWN_RULES_SNAPSHOT_SCHEMA_VERSION

LAST_KNOWN_RULES_SNAPSHOT_SCHEMA_VERSION (the envelope guard).

Functions

apply_to_config

The config-mutating half of _apply_rules + DynamicRuleApplicationMixin.

apply_to_config_with_validation_cache

apply_to_config with the optional disk-backed validation cache.

dump_last_known_rules_snapshot

dump_last_known_rules_snapshot: the versioned JSON envelope.

expired_identity

_reject_if_already_expired’s de-duplication key: the same expired rule logs its warning once.

has_expired

_has_rule_expired: past expires_at at now (an absent expiry never expires).

load_last_known_rules_snapshot

load_last_known_rules_snapshot: the version-guarded decode.

matches_event

match_event: the enrichment correlation.

should_update

_should_update_rules: the first rule always updates; a same-id rule only when its version advances (a stale replay never re-applies).