feat: rule engine + tripwires + wd_clearance forwarding (#2 #3 #5) - #20
Merged
Conversation
Ports @webdecoy/node's rule engine to PHP and adds the deception layer the
plugin was missing despite the product name.
- WebDecoy\Rules\{RuleEngine,TripwireRule,RuleContext,RuleResult,
ViolationEvent,...}: pure, framework-agnostic SDK classes mirroring node's
rules engine. First non-dry-run DENY/THROTTLE wins; every non-ALLOW result
records a violation; dry-run logs without blocking.
- TripwireRule: deterministic, zero-FP blocking of honeypot paths. Ships
node's 18 DEFAULT_TRIPWIRE_PATHS verbatim; supports custom exact paths,
prefixes, and (fail-open) regex patterns.
- Clearance forwarding (#136 WP half): the wd_clearance cookie is attached
ONLY to tripwire violations, so the deception signal — not heuristics —
drives the durable device-fingerprint deny-list.
- WebDecoy_Violation_Reporter: per-request buffer flushed once on shutdown
via a non-blocking POST to /api/v1/sdk/violations/batch. Cloud-gated
(needs an API key); local-only installs still enforce, just don't report.
- Wired into early_check() before heuristic scoring (matches node's
protect() flow). New Settings -> Tripwires tab. Violations always logged
locally (visible in Detections, incl. dry-run).
- tests/: dependency-free PHP runner porting node's rule-engine and
tripwire test vectors (17 assertions, green).
Closes #2, #3, #5. Part of #16.
Co-authored-by: Claude <noreply@anthropic.com>
The built-in scanner-bait paths carry no false-positive risk for real visitors, so protection is active out of the box (no users yet — no migration concern).
15 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First P0 bundle of the v2.2 parity milestone. Brings the plugin's deterministic deception layer to parity with
@webdecoy/nodeand wires the WordPress half of the clearance enforcement loop. (Supersedes #18, which auto-closed when its stacked base branch was deleted after #17 merged.)What's here
WebDecoy\Rules\RuleEngine, a faithful PHP port of node'srule-engine.ts. Rules evaluate in order; first non-dry-runDENY/THROTTLEwins; every non-ALLOWresult records aViolationEvent; dry-run logs without blocking. Runs inearly_check()before heuristic scoring.WebDecoy\Rules\TripwireRule, deterministic zero-false-positive blocking of honeypot paths. Ships node's 18DEFAULT_TRIPWIRE_PATHSverbatim; custom exact paths, prefixes, and fail-open regex patterns. On by default (built-in bait paths carry no false-positive risk). New Settings → Tripwires tab.wd_clearancecookie only to tripwire violations, so the unspoofable deception signal drives the backend's durable device-fingerprint deny-list (WP half of WebDecoy/app#136).WebDecoy_Violation_Reporterbuffers per request, flushes once onshutdownwith a non-blocking POST to/api/v1/sdk/violations/batch. Cloud-gated; local-only installs still enforce.Tests
tests/is a dependency-free PHP runner porting node'srule-engine.test.tsandtripwire-rule.test.tsvectors — 17 assertions, all green (php tests/run.php). Build stripstests/.Closes #2, closes #3, closes #5. Part of #16.