Struct ValidationPipeline 

pub struct ValidationPipeline<T: TokenGenerator = HmacTokenGenerator, E: ExplanationGenerator = TemplateExplanationGenerator> { /* private fields */ }

The validation pipeline that orchestrates all validation stages.

Implementations

impl ValidationPipeline<HmacTokenGenerator, TemplateExplanationGenerator>

pub fn new( config: CodeModeConfig, token_secret: impl Into<Vec<u8>>, ) -> Result<Self, TokenError>

Create a new validation pipeline with default generators.

Warning: This constructor does not configure a policy evaluator. Only basic config checks will be performed.

Errors

Returns TokenError::SecretTooShort if the token secret is shorter than HmacTokenGenerator::MIN_SECRET_LEN (16 bytes).

pub fn from_token_secret( config: CodeModeConfig, secret: &TokenSecret, ) -> Result<Self, TokenError>

Create a new validation pipeline from a TokenSecret.

Convenience constructor for production callers and derive macro generated code. Callers never need to call expose_secret() directly.

Security note: Internally this creates an intermediate Vec<u8> copy of the secret bytes that is not zeroized on drop. For maximum security, prefer TokenSecret::from_env which minimizes secret copies. This limitation will be addressed in a future version by adding a HmacTokenGenerator::from_secret_ref constructor.

Warning: This constructor does not configure a policy evaluator. Only basic config checks will be performed.

Errors

Returns TokenError::SecretTooShort if the token secret is shorter than HmacTokenGenerator::MIN_SECRET_LEN (16 bytes).

pub fn with_policy_evaluator( config: CodeModeConfig, token_secret: impl Into<Vec<u8>>, evaluator: Arc<dyn PolicyEvaluator>, ) -> Result<Self, TokenError>

Create a new validation pipeline with a policy evaluator.

Errors

Returns TokenError::SecretTooShort if the token secret is shorter than HmacTokenGenerator::MIN_SECRET_LEN (16 bytes).

pub fn from_token_secret_with_policy( config: CodeModeConfig, secret: &TokenSecret, evaluator: Arc<dyn PolicyEvaluator>, ) -> Result<Self, TokenError>

Create a pipeline from a TokenSecret with an Arc policy evaluator.

Used by derive macro generated code where the policy evaluator is stored as Arc<dyn PolicyEvaluator> on the parent struct.

Errors

Returns TokenError::SecretTooShort if the token secret is shorter than HmacTokenGenerator::MIN_SECRET_LEN (16 bytes).

impl<T: TokenGenerator, E: ExplanationGenerator> ValidationPipeline<T, E>

pub fn with_generators( config: CodeModeConfig, token_generator: T, explanation_generator: E, ) -> Self

Create a pipeline with custom generators.

pub fn set_policy_evaluator(&mut self, evaluator: Arc<dyn PolicyEvaluator>)

Set the policy evaluator for this pipeline.

pub fn has_policy_evaluator(&self) -> bool

Check if a policy evaluator is configured.

pub fn validate_graphql_query( &self, query: &str, context: &ValidationContext, ) -> Result<ValidationResult, ValidationError>

Validate a GraphQL query using basic config checks only.

pub async fn validate_graphql_query_async( &self, query: &str, context: &ValidationContext, ) -> Result<ValidationResult, ValidationError>

Validate a GraphQL query using a policy evaluator (async).

pub fn validate_javascript_code( &self, code: &str, context: &ValidationContext, ) -> Result<ValidationResult, ValidationError>

Validate JavaScript code for OpenAPI Code Mode (sync, no policy evaluation).

Runs config-level checks only. For policy evaluation (Cedar/AVP), use [validate_javascript_code_async] instead. Retained for backward compatibility with callers that don’t need policy enforcement.

pub async fn validate_javascript_code_async( &self, code: &str, context: &ValidationContext, ) -> Result<ValidationResult, ValidationError>

Validate JavaScript code with async policy evaluation.

Mirrors [validate_graphql_query_async] but for JavaScript/OpenAPI:

1. Parse JS via SWC + config-level checks (shared with sync version)
2. Policy evaluation via PolicyEvaluator::evaluate_script (async, fail-closed)
3. Security analysis + token generation

When no policy evaluator is configured, falls back to config-only checks.

pub fn validate_sql_query( &self, sql: &str, context: &ValidationContext, ) -> Result<ValidationResult, ValidationError>

Validate a SQL statement using basic config checks only (no policy evaluator).

For policy evaluation (Cedar/AVP), use [validate_sql_query_async] instead.

pub async fn validate_sql_query_async( &self, sql: &str, context: &ValidationContext, ) -> Result<ValidationResult, ValidationError>

Validate a SQL statement with async policy evaluation.

Mirrors [validate_graphql_query_async] and [validate_javascript_code_async]:

1. Parse SQL via sqlparser + config-level checks (shared with sync version)
2. Policy evaluation via PolicyEvaluator::evaluate_statement (async, fail-closed)
3. Security analysis + token generation

When no policy evaluator is configured, falls back to config-only checks.

pub fn should_auto_approve(&self, result: &ValidationResult) -> bool

Check if a validation result should be auto-approved.

pub fn config(&self) -> &CodeModeConfig

Get the config.

pub fn token_generator(&self) -> &T

Get the token generator.