Struct IpcSecurityPipeline 

pub struct IpcSecurityPipeline { /* private fields */ }

Assembled IPC security pipeline holding all control point instances.

Implementations

impl IpcSecurityPipeline

pub fn new(config: IpcSecurityConfig, audit_config: AuditConfig) -> Self

Creates a new pipeline from configuration.

Arguments

• config: IPC security configuration.
• audit_config: Root audit persistence configuration.

Returns

Returns an initialized IpcSecurityPipeline with all control points ready.

pub fn check( &mut self, method: &str, raw_body_len: usize, peer_identity: &PeerIdentity, connection_id: &str, ) -> CheckOutcome

Runs pre-dispatch security checks, excluding C4 (replay) and C8 (idempotency) which are handled separately to resolve ordering.

Execution order (per contract, with corrected C4/C8 ordering): C6 → C5 → C2 → C3

C4 (replay protection) and C8 (idempotency) are ordered by the caller: C8 is checked first; if the response is already cached, it is returned without recording in C4. Otherwise C4 records the request_id and dispatch proceeds — see check_replay_and_record.

C1 (socket owner) runs at bind time. C9 (allowlist) runs at extension points. C7 (audit) runs post-dispatch.

Arguments

• method: IPC method name.
• raw_body_len: Byte length of the raw request body (for C5).
• peer_identity: Extracted peer identity snapshot (for C2/C3).
• connection_id: Opaque connection identifier (for per-connection C6).

Returns

Returns CheckOutcome::Passed when all checks pass, or CheckOutcome::Denied(error) with the denial error.

pub fn check_replay_and_record( &mut self, request_id: &str, ) -> Result<(), DashboardError>

Checks C4 replay protection and records the request_id.

Must be called after C8 idempotency check: if the response is already cached, the caller returns early without recording in C4. This prevents C4 from rejecting a legitimate retry that hits the idempotency cache.

Arguments

• request_id: Request identifier to check and record.

Returns

Returns Ok(()) for a first submission, or Err(DashboardError) with code replay_detected for a replay.

pub fn check_idempotency(&self, request_id: &str) -> Option<String>

Checks the idempotency cache for a cached response (C8).

Called after check() passes but before dispatch.

Arguments

• request_id: Request identifier.

Returns

Returns Some(cached_result_json) if a cached result exists, or None if no cache hit.

pub fn cache_result(&mut self, request_id: &str, response_json: &str)

Caches a dispatch result for idempotency (C8).

Arguments

• request_id: Request identifier.
• response_json: Serialized response to cache.

pub fn request_size_limit_bytes(&self) -> Option<usize>

Returns the C5 request size limit in bytes, or None if disabled.

pub fn high_risk_methods(&self) -> &[String]

Returns the configured high-risk command method list.

This is the list from AuthorizationConfig.high_risk_commands. When empty (the config is not populated), the caller should fall back to a hardcoded default set.

pub fn check_ext_command_allowlist( &self, path: &str, ) -> Result<(), DashboardError>

Checks whether an external command path is allowed by C9 allowlist.

This is called at extension points where external executables may be invoked under supervisor control. The allowlist rejects paths that are not explicitly configured.

Arguments

• path: Absolute executable path to check.

Returns

Returns Ok(()) when the path is allowed, or Err(DashboardError) with allowlist_empty or allowlist_denied.

pub fn audit_backend(&self) -> &AuditBackend

Returns a reference to the audit backend for health checks.

pub fn write_audit( &mut self, method: &str, peer_identity: &PeerIdentity, allowed: bool, denial_error: Option<&DashboardError>, denial_control_point: &str, is_high_risk: bool, ) -> Result<(), DashboardError>

Writes an audit record after dispatch (C7).

Returns Ok(()) on success or Err(DashboardError) when the audit backend is unwritable. The caller should fail closed for high-risk commands.

When is_high_risk is true and the configured failure strategy is fail_closed, any backend write error is propagated so the caller can reject the command. When defer_bounded, errors are logged but not propagated.

Arguments

• method: IPC method name.
• peer_identity: Peer identity snapshot.
• allowed: Whether the request was allowed.
• denial_error: The denial error if denied.
• denial_control_point: Which control point denied (C1-C9 or “dispatch”).
• is_high_risk: Whether this is a high-risk command (e.g. restart, shutdown).

Returns

Returns Ok(()) when the audit record was written, or Err(DashboardError) when the backend is unwritable and the failure strategy requires fail-closed.