application-security

Forge security umbrella — composes infrastructure-hardening (response headers) + infrastructure-waf (request) + body limit into one correctly-ordered stack.

Tier	application
Role	unclassified (baselined)
Path	`crates/application/security`
Edition	2024
Targets	application_security
Public items	15 across 0 modules
Tests	3

What it is for

application-security — the security umbrella for forge apps.

Composes the two security halves + a request-body ceiling into one correctly-ordered Tower stack and applies it to an axum::Router:

request-side: infrastructure-waf (signatures, rate-limit, honeypots)
response-side: infrastructure-hardening (security headers)
ceiling: request body-size limit

# Ordering (the reason this crate exists)

Response headers must be outermost so they apply to every response — including a WAF 403 block — and the body-limit sits just inside them, ahead of the WAF. axum Router::layer is last-added-outermost (the opposite of tower::ServiceBuilder), so SecurityStack::apply adds the WAF first (innermost) and the header layer last (outermost). App authors never hand-order these.

let router = SecurityStack::recommended()?.apply(router);

Resource ceilings beyond body-size (request timeout, global concurrency) are intentionally deferred: a correct global concurrency cap on axum needs GlobalConcurrencyLimitLayer (per-clone semaphores don't cap globally), and a timeout layer must return a 408 response rather than a non-Infallible error to satisfy axum's Router::layer bounds. Tracked for a follow-up.

B-009 Gate-0.5 finding: neither wrapped library crate ships a migrations/ directory — infrastructure-hardening (crates/infrastructure/hardening) is response-header middleware and infrastructure-waf (crates/infrastructure/waf) is request-side signature/rate-limit middleware; both are stateless Tower layers with no schema of their own. migrations() staying empty is correct, not an oversight. Nothing to vendor. permission_codes() was already declared before this pass.

Capabilities

`crate root`

application-security — the security umbrella for forge apps.

Item
`pub const DEFAULT_BODY_LIMIT: usize`

`SecurityModule`

application-security — the security umbrella for forge apps.

Item
`pub struct SecurityModule`
`SecurityModule :: fn new() -> Self`
`SecurityModule :: fn name(& self) -> & 'static str`
`SecurityModule :: fn version(& self) -> & 'static str`
`SecurityModule :: fn migrations(& self) -> Vec <MigrationSet>`
`SecurityModule :: async fn migrate_pending(& self, _pool : & PgPool) -> Result <u32, MigrationError>`
`SecurityModule :: fn permission_codes(& self) -> Vec <String>`

`SecurityStack`

application-security — the security umbrella for forge apps.

Item
`pub struct SecurityStack`
`SecurityStack :: fn recommended() -> Result <Self, SecurityStackError>`
`SecurityStack :: fn with_waf_config(waf_config : infrastructure_waf::WafConfig,) -> Result <Self, SecurityStackError>`
`SecurityStack :: fn body_limit(mut self, bytes : usize) -> Self`
`SecurityStack :: fn apply(self, router : axum::Router) -> axum::Router`

`SecurityStackError`

application-security — the security umbrella for forge apps.

Item
`pub struct SecurityStackError`
`SecurityStackError :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

Item	What it is
`pub const DEFAULT_BODY_LIMIT: usize`	Default request body-size ceiling (2 MiB).
`pub struct SecurityStackError`	Error building the security stack (e.g
`SecurityStackError :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`	—
`pub struct SecurityStack`	The composed forge security stack: WAF + body-limit + response headers.
`SecurityStack :: fn recommended() -> Result <Self, SecurityStackError>`	Build the recommended stack: default WAF + secure-default response headers + a 2 MiB request-body ceiling
`SecurityStack :: fn with_waf_config(waf_config : infrastructure_waf::WafConfig,) -> Result <Self, SecurityStackError>`	Build the stack with a caller-supplied `infrastructure_waf::WafConfig` (e.g
`SecurityStack :: fn body_limit(mut self, bytes : usize) -> Self`	Override the request body-size ceiling (bytes).
`SecurityStack :: fn apply(self, router : axum::Router) -> axum::Router`	Apply the stack to a router
`pub struct SecurityModule`	Forge module identity for `application-security`.
`SecurityModule :: fn new() -> Self`	Create the module.
`SecurityModule :: fn name(& self) -> & 'static str`	—
`SecurityModule :: fn version(& self) -> & 'static str`	—
`SecurityModule :: fn migrations(& self) -> Vec <MigrationSet>`	—
`SecurityModule :: async fn migrate_pending(& self, _pool : & PgPool) -> Result <u32, MigrationError>`	—
`SecurityModule :: fn permission_codes(& self) -> Vec <String>`	—

Re-exports. Exported here, defined elsewhere.

Export	Defined in
`infrastructure_hardening`	`infrastructure_hardening`
`infrastructure_waf`	`infrastructure_waf`

Boundary

Reaches into infrastructure.

Shares tier application with 120 other crates: application-agreements, application-ai, application-analytics, application-approvals, application-assessments, application-audit-log, application-auth, application-billing, … (120 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier (ontology)	`application`
Architectural role (taxonomy)	`unclassified (baselined)`
Location	`crates/application/security`
Vocabulary in force (lexicon)	`current`

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_application["application"] --> n_infrastructure["infrastructure"]

Dependencies

Runtime, in this workspace.

Crate	Tier	Optional	Only on
`application-core`	application	no	always
`infrastructure-hardening`	infrastructure	no	always
`infrastructure-waf`	infrastructure	no	always

Runtime, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`async-trait`	`^0.1`	—	no	always
`axum`	`^0.7`	`multipart`	no	always
`sqlx`	`^0.8`	`runtime-tokio`, `postgres`, `chrono`, `uuid`, `json`	no	always

Development, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`http`	`^1.1`	—	no	always
`tokio`	`^1`	`full`	no	always
`tower`	`^0.5`	`util`	no	always

Build. None.

Depended on by. Nothing in this workspace.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  SELF["application-security"]
  SELF -->|runtime| n_application_core["application-core"]
  SELF -->|runtime| n_infrastructure_hardening["infrastructure-hardening"]
  SELF -->|runtime| n_infrastructure_waf["infrastructure-waf"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Kind	Name	Source
lib	`application_security`	`src/lib.rs`

Error model

Error type	Named by
`SecurityStackError`	declared, no public signature returns it

Operational characteristics

Property	Evidence
async public surface	yes
async runtime	none detected
database access	yes
network I/O	yes
unsafe code	none detected
environment variables	yes

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

Variable	Read in
`CARGO_PKG_VERSION`	`src/lib.rs`

No workspace crate depends on this one.

Verification

Kind	Count
Unit tests	3
Integration tests	0
Examples	0
Doctests	0

Evidence by module. How often each public module is named by something executable.

Module	Tests	Examples	Consumers
`crate root`	4	0	0

What the tests establish, by name:

applied_stack_adds_headers_to_responses — src/lib.rs
recommended_stack_builds — src/lib.rs
with_waf_config_preserves_custom_config — src/lib.rs

Documentation coverage

Measure	Documented	Total
Public items with rustdoc	9	15
Public modules with a `//!` block	0	0

pie showData
    title Public items with rustdoc
    "Documented" : 9
    "No rustdoc detected" : 6

Metrics

Metric	Value
Rust source files	1
Source lines	187
Code lines	110
Public API items	15
Public modules	0
Tests	3
Examples	0
Cargo features	0
Direct runtime dependencies	6
Workspace reverse dependencies	0

pie showData
    title Public API by kind
    "constant" : 1
    "method" : 11
    "struct" : 3

pie showData
    title Rust source composition
    "Code" : 110
    "Blank or comment" : 77

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.

What it is for

Capabilities

crate root

SecurityModule

SecurityStack

SecurityStackError

How to use it

Module structure

Public surface

Boundary

Where it sits

Dependencies

Feature flags

Targets

Error model

Operational characteristics

Configuration

Related capabilities

Verification

Documentation coverage

Metrics

Generation

`crate root`

`SecurityModule`

`SecurityStack`

`SecurityStackError`