sh_layer0/
lib.rs

1//! # Continuum Layer 0: Security Gateway
2//!
3//! 所有外部输入的安全网关层。
4//!
5//! ## 模块
6//! - `input_validator`: 输入验证
7//! - `pii_scrubber`: PII 数据清洗
8//! - `access_controller`: 访问控制
9//! - `rate_limiter`: 速率限制
10//! - `secrets_manager`: 密钥管理
11//! - `encryption_engine`: 加密引擎
12//! - `threat_detector`: 威胁检测
13
14pub mod access_controller;
15pub mod encryption_engine;
16pub mod input_validator;
17pub mod pii_scrubber;
18pub mod rate_limiter;
19pub mod secrets_manager;
20pub mod threat_detector;
21
22pub use access_controller::{AccessController, Permission, Role};
23pub use encryption_engine::{
24    derive_key_from_password, generate_salt, EncryptedData, EncryptionAlgorithm, EncryptionConfig,
25    EncryptionEngine, EncryptionError, EncryptionKey,
26};
27pub use input_validator::{InputValidator, ValidationResult};
28pub use pii_scrubber::{PiiScrubber, ScrubResult};
29pub use rate_limiter::{RateLimitConfig, RateLimiter};
30pub use secrets_manager::{
31    AuditAction, AuditLogEntry, SecretMetadataInfo, SecretsManager, SecretsManagerConfig,
32};
33pub use threat_detector::{
34    DetectionRule, ResponseAction, ResponseRule, Threat, ThreatDetector, ThreatDetectorConfig,
35    ThreatError, ThreatLevel, ThreatStats, ThreatType,
36};
37
38/// 安全网关 - 所有外部输入的入口
39pub struct SecurityGateway {
40    input_validator: InputValidator,
41    pii_scrubber: PiiScrubber,
42    access_controller: AccessController,
43    rate_limiter: RateLimiter,
44}
45
46impl SecurityGateway {
47    pub fn new() -> Self {
48        Self {
49            input_validator: InputValidator::new(),
50            pii_scrubber: PiiScrubber::new(),
51            access_controller: AccessController::new(),
52            rate_limiter: RateLimiter::new(),
53        }
54    }
55
56    /// 验证并清理输入
57    pub async fn validate_input(&self, input: &str) -> anyhow::Result<String> {
58        // 1. 验证输入格式
59        self.input_validator.validate(input)?;
60
61        // 2. 清理 PII 数据
62        let result = self.pii_scrubber.scrub(input);
63
64        Ok(result.scrubbed)
65    }
66
67    /// 检查访问权限
68    pub fn check_access(&self, user_id: &str, resource: &str, action: &str) -> bool {
69        self.access_controller.check(user_id, resource, action)
70    }
71
72    /// 检查速率限制
73    pub async fn check_rate(&self, key: &str) -> anyhow::Result<bool> {
74        self.rate_limiter.check(key).await
75    }
76}
77
78impl Default for SecurityGateway {
79    fn default() -> Self {
80        Self::new()
81    }
82}
sh_layer0/lib.rs

sh_layer0/
lib.rs
