guard-core 2.2.2__tar.gz → 3.0.0__tar.gz

{guard_core-2.2.2/guard_core.egg-info → guard_core-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: guard-core
-Version: 2.2.2
+Version: 3.0.0
 Summary: Framework-agnostic security engine for the Guard ecosystem.
 Author-email: Renzo Franceschini <rennf93@users.noreply.github.com>
 License: MIT
@@ -308,6 +308,23 @@ See the [SecurityConfig Reference](https://rennf93.github.io/guard-core/latest/c
 
 ___
 
+Migration: fail_secure default flipped
+--------------------------------------
+
+`SecurityConfig.fail_secure` now defaults to `True`. When a security check raises an unexpected exception, the request is blocked with HTTP 500 instead of falling through.
+
+**Why**: the old fail-open default silently masked check bugs. The new default surfaces them so they can be fixed instead of leaking past the security layer.
+
+**Migration**: to restore the previous fail-open behavior, opt in explicitly:
+
+```python
+config = SecurityConfig(fail_secure=False)
+```
+
+Recommended path: keep the new default and fix any check exceptions that surface. The old default could mask genuine bugs.
+
+___
+
 Detection Engine
 ----------------
 

{guard_core-2.2.2 → guard_core-3.0.0}/README.md

@@ -250,6 +250,23 @@ See the [SecurityConfig Reference](https://rennf93.github.io/guard-core/latest/c
 
 ___
 
+Migration: fail_secure default flipped
+--------------------------------------
+
+`SecurityConfig.fail_secure` now defaults to `True`. When a security check raises an unexpected exception, the request is blocked with HTTP 500 instead of falling through.
+
+**Why**: the old fail-open default silently masked check bugs. The new default surfaces them so they can be fixed instead of leaking past the security layer.
+
+**Migration**: to restore the previous fail-open behavior, opt in explicitly:
+
+```python
+config = SecurityConfig(fail_secure=False)
+```
+
+Recommended path: keep the new default and fix any check exceptions that surface. The old default could mask genuine bugs.
+
+___
+
 Detection Engine
 ----------------
 

{guard_core-2.2.2 → guard_core-3.0.0}/guard_core/handlers/cloud_handler.py

@@ -94,7 +94,92 @@ async def fetch_azure_ip_ranges() -> set[ipaddress.IPv4Network | ipaddress.IPv6N
         return set()
 
 
-_ALL_PROVIDERS = set({"AWS", "GCP", "Azure"})
+async def fetch_digitalocean_ip_ranges() -> set[
+    ipaddress.IPv4Network | ipaddress.IPv6Network
+]:
+    try:
+        async with aiohttp.ClientSession() as session:
+            response = await session.get(
+                "https://www.digitalocean.com/geo/google.csv",
+                timeout=aiohttp.ClientTimeout(total=10),
+            )
+            response.raise_for_status()
+            body = await response.text()
+
+        networks: set[ipaddress.IPv4Network | ipaddress.IPv6Network] = set()
+        for raw_line in body.splitlines():
+            line = raw_line.strip()
+            if not line or line.startswith("#"):
+                continue
+            prefix = line.split(",", 1)[0].strip()
+            if not prefix:
+                continue
+            try:
+                networks.add(ipaddress.ip_network(prefix))
+            except ValueError:
+                continue
+        return networks
+    except Exception as e:
+        logging.error(f"Failed to fetch DigitalOcean IP ranges: {str(e)}")
+        return set()
+
+
+async def fetch_linode_ip_ranges() -> set[
+    ipaddress.IPv4Network | ipaddress.IPv6Network
+]:
+    try:
+        async with aiohttp.ClientSession() as session:
+            response = await session.get(
+                "https://geoip.linode.com/",
+                timeout=aiohttp.ClientTimeout(total=10),
+            )
+            response.raise_for_status()
+            body = await response.text()
+
+        networks: set[ipaddress.IPv4Network | ipaddress.IPv6Network] = set()
+        for raw_line in body.splitlines():
+            line = raw_line.strip()
+            if not line or line.startswith("#"):
+                continue
+            prefix = line.split(",", 1)[0].strip()
+            if not prefix:
+                continue
+            try:
+                networks.add(ipaddress.ip_network(prefix))
+            except ValueError:
+                continue
+        return networks
+    except Exception as e:
+        logging.error(f"Failed to fetch Linode IP ranges: {str(e)}")
+        return set()
+
+
+async def fetch_vultr_ip_ranges() -> set[ipaddress.IPv4Network | ipaddress.IPv6Network]:
+    try:
+        async with aiohttp.ClientSession() as session:
+            response = await session.get(
+                "https://geofeed.constant.com/?json",
+                timeout=aiohttp.ClientTimeout(total=10),
+            )
+            response.raise_for_status()
+            data = await response.json(content_type=None)
+
+        networks: set[ipaddress.IPv4Network | ipaddress.IPv6Network] = set()
+        for entry in data.get("subnets", []):
+            prefix = entry.get("ip_prefix")
+            if not prefix:
+                continue
+            try:
+                networks.add(ipaddress.ip_network(prefix))
+            except ValueError:
+                continue
+        return networks
+    except Exception as e:
+        logging.error(f"Failed to fetch Vultr IP ranges: {str(e)}")
+        return set()
+
+
+_ALL_PROVIDERS = set({"AWS", "GCP", "Azure", "DigitalOcean", "Linode", "Vultr"})
 
 
 class CloudManager:
@@ -113,6 +198,9 @@ class CloudManager:
                 "AWS": set(),
                 "GCP": set(),
                 "Azure": set(),
+                "DigitalOcean": set(),
+                "Linode": set(),
+                "Vultr": set(),
             }
             cls._instance.last_updated = {provider: None for provider in _ALL_PROVIDERS}
             cls._instance.redis_handler = None
@@ -146,6 +234,9 @@ class CloudManager:
                     "AWS": fetch_aws_ip_ranges,
                     "GCP": fetch_gcp_ip_ranges,
                     "Azure": fetch_azure_ip_ranges,
+                    "DigitalOcean": fetch_digitalocean_ip_ranges,
+                    "Linode": fetch_linode_ip_ranges,
+                    "Vultr": fetch_vultr_ip_ranges,
                 }[provider]()
                 if ranges:
                     old_ranges = self.ip_ranges.get(provider, set())
@@ -195,6 +286,9 @@ class CloudManager:
                     "AWS": fetch_aws_ip_ranges,
                     "GCP": fetch_gcp_ip_ranges,
                     "Azure": fetch_azure_ip_ranges,
+                    "DigitalOcean": fetch_digitalocean_ip_ranges,
+                    "Linode": fetch_linode_ip_ranges,
+                    "Vultr": fetch_vultr_ip_ranges,
                 }[provider]
 
                 ranges = await fetch_func()
@@ -233,6 +327,9 @@ class CloudManager:
                     "AWS": fetch_aws_ip_ranges,
                     "GCP": fetch_gcp_ip_ranges,
                     "Azure": fetch_azure_ip_ranges,
+                    "DigitalOcean": fetch_digitalocean_ip_ranges,
+                    "Linode": fetch_linode_ip_ranges,
+                    "Vultr": fetch_vultr_ip_ranges,
                 }[provider]
                 ranges = await fetch_func()
                 if ranges:

{guard_core-2.2.2 → guard_core-3.0.0}/guard_core/models.py

@@ -272,10 +272,12 @@ class SecurityConfig(BaseModel):
     )
 
     fail_secure: bool = Field(
-        default=False,
+        default=True,
         description=(
             "Block the request when any security check raises an unexpected exception. "
-            "False (default) logs the error and falls through (fail-open)."
+            "True (default) returns HTTP 500 so check bugs surface; "
+            "False logs and falls through (fail-open) - "
+            "opt-in only for staging diagnostics."
         ),
     )
 
@@ -332,6 +334,26 @@ class SecurityConfig(BaseModel):
         default=3, description="Number of retry attempts for failed requests"
     )
 
+    agent_project_encryption_key: str | None = Field(
+        default=None,
+        description=(
+            "Per-project AES-256-GCM key used to encrypt the telemetry payload "
+            "between the agent and the SaaS. When set, the agent posts to "
+            "/api/v1/events/encrypted instead of /api/v1/events. Required for "
+            "API keys that have encryption enforced server-side."
+        ),
+    )
+
+    agent_guard_version: str | None = Field(
+        default=None,
+        description=(
+            "Framework wrapper version (e.g. fastapi-guard's __version__) "
+            "propagated to the agent so the SaaS can attribute telemetry to "
+            "the wrapper version, not just the agent version. Set this to "
+            "your framework integration's __version__ at construction time."
+        ),
+    )
+
     enable_dynamic_rules: bool = Field(
         default=False, description="Enable dynamic rule updates from SaaS platform"
     )
@@ -656,6 +678,8 @@ class SecurityConfig(BaseModel):
                 enable_metrics=self.agent_enable_metrics,
                 timeout=self.agent_timeout,
                 retry_attempts=self.agent_retry_attempts,
+                project_encryption_key=self.agent_project_encryption_key,
+                guard_version=self.agent_guard_version,
             )
         except ImportError:
             return None

{guard_core-2.2.2 → guard_core-3.0.0}/guard_core/sync/handlers/cloud_handler.py

@@ -92,7 +92,90 @@ def fetch_azure_ip_ranges() -> set[ipaddress.IPv4Network | ipaddress.IPv6Network
         return set()
 
 
-_ALL_PROVIDERS = set({"AWS", "GCP", "Azure"})
+def fetch_digitalocean_ip_ranges() -> set[
+    ipaddress.IPv4Network | ipaddress.IPv6Network
+]:
+    try:
+        with requests.Session() as session:
+            response = session.get(
+                "https://www.digitalocean.com/geo/google.csv",
+                timeout=10,
+            )
+            response.raise_for_status()
+            body = response.text
+
+        networks: set[ipaddress.IPv4Network | ipaddress.IPv6Network] = set()
+        for raw_line in body.splitlines():
+            line = raw_line.strip()
+            if not line or line.startswith("#"):
+                continue
+            prefix = line.split(",", 1)[0].strip()
+            if not prefix:
+                continue
+            try:
+                networks.add(ipaddress.ip_network(prefix))
+            except ValueError:
+                continue
+        return networks
+    except Exception as e:
+        logging.error(f"Failed to fetch DigitalOcean IP ranges: {str(e)}")
+        return set()
+
+
+def fetch_linode_ip_ranges() -> set[ipaddress.IPv4Network | ipaddress.IPv6Network]:
+    try:
+        with requests.Session() as session:
+            response = session.get(
+                "https://geoip.linode.com/",
+                timeout=10,
+            )
+            response.raise_for_status()
+            body = response.text
+
+        networks: set[ipaddress.IPv4Network | ipaddress.IPv6Network] = set()
+        for raw_line in body.splitlines():
+            line = raw_line.strip()
+            if not line or line.startswith("#"):
+                continue
+            prefix = line.split(",", 1)[0].strip()
+            if not prefix:
+                continue
+            try:
+                networks.add(ipaddress.ip_network(prefix))
+            except ValueError:
+                continue
+        return networks
+    except Exception as e:
+        logging.error(f"Failed to fetch Linode IP ranges: {str(e)}")
+        return set()
+
+
+def fetch_vultr_ip_ranges() -> set[ipaddress.IPv4Network | ipaddress.IPv6Network]:
+    try:
+        with requests.Session() as session:
+            response = session.get(
+                "https://geofeed.constant.com/?json",
+                timeout=10,
+            )
+            response.raise_for_status()
+            data = response.json()
+
+        networks: set[ipaddress.IPv4Network | ipaddress.IPv6Network] = set()
+        for entry in data.get("subnets", []):
+            prefix = entry.get("ip_prefix")
+            if not prefix:
+                continue
+            try:
+                networks.add(ipaddress.ip_network(prefix))
+            except ValueError:
+                continue
+        return networks
+    except Exception as e:
+        logging.error(f"Failed to fetch Vultr IP ranges: {str(e)}")
+        return set()
+
+
+_ALL_PROVIDERS = set({"AWS", "GCP", "Azure", "DigitalOcean", "Linode", "Vultr"})
 
 
 class CloudManager:
@@ -111,6 +194,9 @@ class CloudManager:
                 "AWS": set(),
                 "GCP": set(),
                 "Azure": set(),
+                "DigitalOcean": set(),
+                "Linode": set(),
+                "Vultr": set(),
             }
             cls._instance.last_updated = {provider: None for provider in _ALL_PROVIDERS}
             cls._instance.redis_handler = None
@@ -144,6 +230,9 @@ class CloudManager:
                     "AWS": fetch_aws_ip_ranges,
                     "GCP": fetch_gcp_ip_ranges,
                     "Azure": fetch_azure_ip_ranges,
+                    "DigitalOcean": fetch_digitalocean_ip_ranges,
+                    "Linode": fetch_linode_ip_ranges,
+                    "Vultr": fetch_vultr_ip_ranges,
                 }[provider]()
                 if ranges:
                     old_ranges = self.ip_ranges.get(provider, set())
@@ -193,6 +282,9 @@ class CloudManager:
                     "AWS": fetch_aws_ip_ranges,
                     "GCP": fetch_gcp_ip_ranges,
                     "Azure": fetch_azure_ip_ranges,
+                    "DigitalOcean": fetch_digitalocean_ip_ranges,
+                    "Linode": fetch_linode_ip_ranges,
+                    "Vultr": fetch_vultr_ip_ranges,
                 }[provider]
 
                 ranges = fetch_func()
@@ -231,6 +323,9 @@ class CloudManager:
                     "AWS": fetch_aws_ip_ranges,
                     "GCP": fetch_gcp_ip_ranges,
                     "Azure": fetch_azure_ip_ranges,
+                    "DigitalOcean": fetch_digitalocean_ip_ranges,
+                    "Linode": fetch_linode_ip_ranges,
+                    "Vultr": fetch_vultr_ip_ranges,
                 }[provider]
                 ranges = fetch_func()
                 if ranges:

{guard_core-2.2.2 → guard_core-3.0.0/guard_core.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: guard-core
-Version: 2.2.2
+Version: 3.0.0
 Summary: Framework-agnostic security engine for the Guard ecosystem.
 Author-email: Renzo Franceschini <rennf93@users.noreply.github.com>
 License: MIT
@@ -308,6 +308,23 @@ See the [SecurityConfig Reference](https://rennf93.github.io/guard-core/latest/c
 
 ___
 
+Migration: fail_secure default flipped
+--------------------------------------
+
+`SecurityConfig.fail_secure` now defaults to `True`. When a security check raises an unexpected exception, the request is blocked with HTTP 500 instead of falling through.
+
+**Why**: the old fail-open default silently masked check bugs. The new default surfaces them so they can be fixed instead of leaking past the security layer.
+
+**Migration**: to restore the previous fail-open behavior, opt in explicitly:
+
+```python
+config = SecurityConfig(fail_secure=False)
+```
+
+Recommended path: keep the new default and fix any check exceptions that surface. The old default could mask genuine bugs.
+
+___
+
 Detection Engine
 ----------------
 

{guard_core-2.2.2 → guard_core-3.0.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "guard-core"
-version = "2.2.2"
+version = "3.0.0"
 description = "Framework-agnostic security engine for the Guard ecosystem."
 authors = [
     {name = "Renzo Franceschini", email = "rennf93@users.noreply.github.com"}

{guard_core-2.2.2 → guard_core-3.0.0}/tests/test_pipeline_fail_secure.py

@@ -6,15 +6,15 @@ from guard_core.core.checks.pipeline import SecurityCheckPipeline
 from guard_core.models import SecurityConfig
 
 
-def test_fail_secure_field_exists_with_safe_default() -> None:
+def test_default_security_config_is_fail_secure() -> None:
     config = SecurityConfig()
     assert hasattr(config, "fail_secure")
-    assert config.fail_secure is False
+    assert config.fail_secure is True
 
 
-def test_fail_secure_can_be_enabled() -> None:
-    config = SecurityConfig(fail_secure=True)
-    assert config.fail_secure is True
+def test_fail_secure_can_be_disabled() -> None:
+    config = SecurityConfig(fail_secure=False)
+    assert config.fail_secure is False
 
 
 @pytest.mark.asyncio