Crate waf_schema_enforcement 

Positive-security detection modules for Light WAF: they validate requests against the application’s real contract and score what falls outside it.

• GraphqlSchemaModule — GraphQL operations against the app’s SDL (apollo-compiler).
• GrpcSchemaModule — unary gRPC messages against the app’s FileDescriptorSet (prost-reflect).
• ApiSchemaModule — REST/JSON requests against the app’s OpenAPI 3.0/3.1 spec (oas3 + jsonschema, with no HTTP retriever: a WAF never fetches remote schemas).
• BotDetectionModule — client integrity: a modern-browser user agent with no sec-fetch-* headers.

Every module returns additive scores into the same cumulative anomaly score as the core modules, under reserved rule-id namespaces (rules), with configurable severities. The core’s structural caps run first, so validators only see bounded input; value-level injection stays in the core. A missing or invalid schema/descriptor/spec is a construction error (fail-closed on configuration, never on traffic). Build the modules inside a module_factory to pick up a changed schema on reload.

Re-exports

pub use api_schema::load_spec;

pub use api_schema::normalize_schema_3_0;

pub use api_schema::parse_spec;

pub use api_schema::ApiSchemaEnforcementConfig;

pub use api_schema::ApiSchemaModule;

pub use api_schema::CompiledSpec;

pub use api_schema::LoadedSpec;

pub use api_schema::RequestParts;

pub use api_schema::Resolution;

pub use api_schema::Router;

pub use api_schema::Violation;

pub use bot::BotDetectionConfig;

pub use bot::BotDetectionModule;

pub use grpc::GrpcSchemaEnforcementConfig;

pub use grpc::GrpcSchemaModule;

Modules

api_schema

API Security — OpenAPI positive-security (§4-B pt3). Validate each incoming REST/JSON request against the app’s REAL OpenAPI spec: a path/method/parameter/body shape the app’s own contract does not declare is a request a spec-compliant client never sends — a probing/abuse signal — so it contributes to the SAME cumulative anomaly score the core already uses (Decision::Scores, severity resolved by the pipeline). This is governance of the contract, NOT baseline detection: value-level injection (SQLi/XSS in a parameter value) stays in the OPEN §6 channel.

bot

Client-integrity / bot detection (§4-A). Native cross-header heuristics that a single regex cannot express — deliberately NOT the OPEN scanner module (which matches offensive-tool names in the User-Agent) nor curated content (CRS-curated §6).

grpc

gRPC schema-enforcement (§4-B part 2). Validates each unary gRPC request message (protobuf) against the app’s REAL compiled schema (a FileDescriptorSet .bin from protoc/buf): the :path (/pkg.Service/Method) selects the RPC’s input message type, and the message bytes are decoded against it. An unknown method or an un-decodable message is a query the real client never sends → it contributes to the SAME cumulative anomaly score (governance of the schema, not baseline detection — field content stays in the OPEN §6 channel, DoS caps in the OPEN grpc module which runs first).

rules

Central rule_id registry (G1 marker / G7 anti-double-count) — structural, not by convention.

Structs

GraphqlSchemaModule

GraphQL schema-enforcement module. Holds the app’s validated schema (immutable in-memory — no hot-reload in v1, see G5) and validates each operation the request carries.

SchemaEnforcementConfig

Configuration for the GraphQL schema-enforcement module. The core Config carries no enterprise fields, so the enterprise wiring builds this from [enterprise.schema_enforcement] (Step 5) and hands it to GraphqlSchemaModule::from_config.

Enums

OpValidity

How a GraphQL operation validates against the loaded schema.

Functions

load_schema

Load and validate a schema from a file (G5 reload-ready entry point): read → parse_schema. Called at construction so the boot can fail-closed on a missing/invalid schema; the future core module_factory will call the SAME function with keep-old-on-invalid (re-entrant, no side effects beyond the read).

parse_schema

Pure, re-entrant SDL parse+validate (G5 reload-readiness): SDL text → validated schema, no global state, no I/O. The testable core of schema loading.

validate_op

Validate one operation string against the schema, splitting parse-error from schema-invalid so the two carry distinct severities (G3).