Module security 

Security module for shell-tunnel.

Two of the three things here are defences this server applies; the third is a primitive it offers and does not use. They were listed together as “provided for the API layer”, which reads as three active defences and is not what happens.

Applied by the server, on every request

• API key authentication — bearer tokens, scoped by capability (auth, capability).
• Rate limiting — per-address sliding window (rate_limit).

Offered, and not applied

• Command validation (validation) — CommandValidator, looks_like_injection and the rest are not called from any execute path. A command sent to /execute reaches the shell without passing through them, and nothing here is a barrier between a caller and the machine; the barriers are the two above, plus crate::fs::FsRoot on the filesystem routes.

  Whether to wire it is an open product question rather than an oversight: a substring blocklist on by default is a trade a run-anything tool has to choose deliberately. Until it is chosen, this stays a primitive a consumer may apply to its own input before calling — which is a real use, and the reason it is still exported.

Example

use shell_tunnel::security::{ApiKeyStore, RateLimiter, CommandValidator};

// Applied by the server: authentication …
let auth = ApiKeyStore::default();
auth.add_key("my-secret-key");

// … and rate limiting (100 req/min).
let limiter = RateLimiter::default();

// Offered, not applied: a consumer may run this over its own input before
// calling the API. The server does not.
let validator = CommandValidator::default();
assert!(validator.validate_command("echo hello").is_ok());

Re-exports

pub use auth::auth_middleware;

pub use auth::generate_api_key;

pub use auth::ApiKeyStore;

pub use auth::AuthConfig;

pub use auth::TokenRecord;

pub use capability::preset;

pub use capability::CapabilitySet;

pub use capability::KNOWN_CAPABILITIES;

pub use capability::WILDCARD;

pub use rate_limit::rate_limit_middleware;

pub use rate_limit::RateLimitCharge;

pub use rate_limit::RateLimitConfig;

pub use rate_limit::RateLimitDecision;

pub use rate_limit::RateLimitStats;

pub use rate_limit::RateLimiter;

pub use validation::looks_like_injection;

pub use validation::sanitize_for_display;

pub use validation::CommandValidator;

pub use validation::ValidationConfig;

pub use validation::ValidationError;

Modules

auth

API Key authentication.

capability

Capability set — the frozen access-control mechanism (Phase A wire contract v1).

rate_limit

Rate limiting implementation.

validation

Input validation and command sanitization.