oxigdal_security/
lib.rs

1//! Enterprise security features for OxiGDAL.
2//!
3//! This crate provides comprehensive security features including:
4//! - End-to-end encryption (at rest and in transit)
5//! - Access control (RBAC and ABAC)
6//! - Data lineage tracking
7//! - Audit logging
8//! - Multi-tenancy support
9//! - Data anonymization
10//! - Compliance reporting (GDPR, HIPAA, FedRAMP)
11//! - Security scanning
12//!
13//! # Cargo features
14//!
15//! - `enterprise` (default): the full server-side surface listed above
16//!   (async audit/lineage/multitenancy, encryption at rest, scanning, ...).
17//! - `tls` (default): TLS-in-transit support via the pure-Rust OxiTLS stack;
18//!   implies `enterprise`.
19//! - `attestation` (default): lightweight, wasm-friendly crypto dependencies
20//!   (blake3 hash chain / Merkle root / Ed25519 session seal) for
21//!   tamper-evident session ledgers. The attestation module itself lands in a
22//!   follow-up work package; today the feature only enables its dependencies.
23//!
24//! With `--no-default-features` the crate exposes only [`SecurityConfig`] and
25//! the [`error`] module.
26
27#![deny(clippy::unwrap_used)]
28#![deny(clippy::panic)]
29#![warn(missing_docs)]
30
31#[cfg(feature = "enterprise")]
32pub mod access_control;
33#[cfg(feature = "enterprise")]
34pub mod anonymization;
35#[cfg(feature = "attestation")]
36pub mod attestation;
37#[cfg(feature = "enterprise")]
38pub mod audit;
39#[cfg(feature = "enterprise")]
40pub mod compliance;
41#[cfg(feature = "enterprise")]
42pub mod encryption;
43pub mod error;
44#[cfg(feature = "enterprise")]
45pub mod lineage;
46#[cfg(feature = "enterprise")]
47pub mod multitenancy;
48#[cfg(feature = "enterprise")]
49pub mod scanning;
50
51pub use error::{Result, SecurityError};
52
53/// Security configuration.
54#[derive(Debug, Clone)]
55pub struct SecurityConfig {
56    /// Enable encryption.
57    pub encryption_enabled: bool,
58    /// Enable access control.
59    pub access_control_enabled: bool,
60    /// Enable audit logging.
61    pub audit_logging_enabled: bool,
62    /// Enable lineage tracking.
63    pub lineage_tracking_enabled: bool,
64    /// Enable multi-tenancy.
65    pub multitenancy_enabled: bool,
66}
67
68impl Default for SecurityConfig {
69    fn default() -> Self {
70        Self {
71            encryption_enabled: true,
72            access_control_enabled: true,
73            audit_logging_enabled: true,
74            lineage_tracking_enabled: true,
75            multitenancy_enabled: false,
76        }
77    }
78}
79
80impl SecurityConfig {
81    /// Create a new security configuration.
82    pub fn new() -> Self {
83        Self::default()
84    }
85
86    /// Enable encryption.
87    pub fn with_encryption(mut self, enabled: bool) -> Self {
88        self.encryption_enabled = enabled;
89        self
90    }
91
92    /// Enable access control.
93    pub fn with_access_control(mut self, enabled: bool) -> Self {
94        self.access_control_enabled = enabled;
95        self
96    }
97
98    /// Enable audit logging.
99    pub fn with_audit_logging(mut self, enabled: bool) -> Self {
100        self.audit_logging_enabled = enabled;
101        self
102    }
103
104    /// Enable lineage tracking.
105    pub fn with_lineage_tracking(mut self, enabled: bool) -> Self {
106        self.lineage_tracking_enabled = enabled;
107        self
108    }
109
110    /// Enable multi-tenancy.
111    pub fn with_multitenancy(mut self, enabled: bool) -> Self {
112        self.multitenancy_enabled = enabled;
113        self
114    }
115
116    /// Create a secure configuration with all features enabled.
117    pub fn secure() -> Self {
118        Self {
119            encryption_enabled: true,
120            access_control_enabled: true,
121            audit_logging_enabled: true,
122            lineage_tracking_enabled: true,
123            multitenancy_enabled: true,
124        }
125    }
126
127    /// Create a minimal configuration.
128    pub fn minimal() -> Self {
129        Self {
130            encryption_enabled: true,
131            access_control_enabled: false,
132            audit_logging_enabled: false,
133            lineage_tracking_enabled: false,
134            multitenancy_enabled: false,
135        }
136    }
137}
138
139#[cfg(test)]
140mod tests {
141    use super::*;
142
143    #[test]
144    fn test_security_config() {
145        let config = SecurityConfig::new()
146            .with_encryption(true)
147            .with_access_control(true);
148
149        assert!(config.encryption_enabled);
150        assert!(config.access_control_enabled);
151    }
152
153    #[test]
154    fn test_secure_config() {
155        let config = SecurityConfig::secure();
156        assert!(config.encryption_enabled);
157        assert!(config.access_control_enabled);
158        assert!(config.audit_logging_enabled);
159        assert!(config.lineage_tracking_enabled);
160        assert!(config.multitenancy_enabled);
161    }
162
163    #[test]
164    fn test_minimal_config() {
165        let config = SecurityConfig::minimal();
166        assert!(config.encryption_enabled);
167        assert!(!config.access_control_enabled);
168        assert!(!config.audit_logging_enabled);
169    }
170}
oxigdal_security/lib.rs

oxigdal_security/
lib.rs
