Crate ranvier_guard 

ranvier-guard — HTTP Security/Policy Guard Nodes

Guard nodes are typed Transition nodes that enforce security and policy constraints as visible, traceable pipeline steps — replacing hidden Tower middleware layers.

Each Guard reads context from the Bus (e.g., request headers, client IP) and either passes the input through unchanged or returns a Fault.

Available Guards

Guard	Purpose	Bus Read	Bus Write
CorsGuard	Origin validation + CORS headers	RequestOrigin	CorsHeaders
RateLimitGuard	Per-client token-bucket rate limiting	ClientIdentity	—
SecurityHeadersGuard	Standard security response headers	—	SecurityHeaders
IpFilterGuard	Allow/deny-list IP filtering	ClientIp	—
AccessLogGuard	Structured access logging	AccessLogRequest	AccessLogEntry

Example

use ranvier_guard::*;

Axon::simple::<String>("api")
    .then(AccessLogGuard::new())
    .then(CorsGuard::new(CorsConfig::default()))
    .then(SecurityHeadersGuard::new(SecurityPolicy::default()))
    .then(business_logic)

Modules

prelude

Structs

AcceptEncoding

Bus-injectable type representing the client’s Accept-Encoding header.

AccessLogEntry

Access log entry written to the Bus by AccessLogGuard.

AccessLogGuard

HTTP access log guard — logs request metadata and writes an AccessLogEntry to the Bus.

AccessLogRequest

Request metadata injected into the Bus before AccessLogGuard runs.

AuthGuard

Authentication guard — validates credentials and injects IamIdentity into the Bus.

AuthorizationHeader

Bus-injectable type representing the raw Authorization header value.

ClientIdentity

Bus-injectable type representing the client identity for rate limiting.

ClientIp

Bus-injectable type representing the client IP address.

CompressionConfig

Compression configuration written to the Bus after encoding negotiation.

CompressionGuard

Compression guard — negotiates response encoding from Accept-Encoding.

ContentLength

Bus-injectable type representing the request’s Content-Length header value.

ContentTypeGuard

Content-Type validation guard — rejects requests with unsupported media types.

CorsConfig

CORS guard configuration.

CorsGuard

CORS guard Transition — validates the request origin against allowed origins.

CorsHeaders

CORS headers to be applied to the response.

IdempotencyCache

Shared TTL-based in-memory cache for idempotency key tracking.

IdempotencyCachedResponse

Cached response from a previous idempotent request.

IdempotencyGuard

Idempotency guard — prevents duplicate request processing via an in-memory TTL cache.

IdempotencyKey

Bus-injectable type representing the Idempotency-Key header value.

IpFilterGuard

IP filter guard — allows or denies requests based on client IP.

RateLimitError

Rate limit error with retry-after information.

RateLimitGuard

Rate limit guard — enforces per-client request rate limits.

RequestContentType

Bus-injectable type representing the request’s Content-Type header value.

RequestId

Bus type representing a unique request identifier.

RequestIdGuard

Request ID guard — ensures every request has a unique identifier.

RequestOrigin

Bus-injectable type representing the request origin header.

RequestSizeLimitGuard

Request body size limit guard — rejects requests exceeding the configured maximum Content-Length.

SecurityHeaders

Security headers stored in the Bus for the HTTP layer to apply.

SecurityHeadersGuard

Security headers guard — injects standard security headers into the Bus.

SecurityPolicy

Security policy configuration for HTTP response headers.

TimeoutDeadline

Deadline for the current request pipeline.

TimeoutGuard

Pipeline timeout guard — sets a TimeoutDeadline in the Bus.

TrustedProxies

A set of trusted proxy IPs for safe X-Forwarded-For extraction.

Enums

AuthStrategy

Authentication strategy for AuthGuard.

CompressionEncoding

Supported compression encodings.

IpFilterMode

IP filter mode.