0.86.0: redaction exceptions, hit counts, scan cache

Cargo.toml

@@ -61,7 +61,7 @@ categories = ["network-programming", "web-programming::http-server"]
 
 # 二进制走 CalVer，crate 走 SemVer —— 两者是两回事，卖给不同的人。
 # 这里是 crate 的版本。
-version = "0.85.0"
+version = "0.86.0"
 
 [workspace.dependencies]
 # ── 内部 crate ───────────────────────────────────────────

crates/tw-api/msg-codes.txt

@@ -101,6 +101,9 @@ config.plugin.duplicate
 config.plugin.file
 config.plugin.sha256
 config.provider_concurrency_range
+config.redact_exception_duplicate
+config.redact_exception_hash_bad
+config.redact_exceptions_too_many
 config.rejected
 config.rejected_at
 config.remote_port_is_gateway
@@ -568,6 +571,11 @@ security.bad_content_pattern
 security.bad_label
 security.bad_pattern
 security.content_action_bad
+security.exception_forgotten
+security.exception_not_exceptable
+security.exception_saved_secret
+security.exception_value_empty
+security.exceptions_full
 security.pattern_empty
 security.redact_action_unknown
 security.redact_match_bad
@@ -577,6 +585,7 @@ security.rule_scope_codepoints
 security.rule_scope_empty
 security.unknown_action
 security.unknown_custom_rule
+security.unknown_event
 security.unknown_guard
 security.unknown_rule
 sync.already_on

crates/tw-api/src/ep.rs

@@ -198,6 +198,8 @@ endpoints! {
     // ─────────────────────────────────────────────── 安全
     Security: GET "/security", () => api::SecurityDetail;
     SecurityEvents: GET "/security/events", api::SecurityEventsQuery => api::SecurityEventsPage;
+    /// 一项防护从某个时刻起每条规则命中了几次（记录的 `count` 加起来），按规则排
+    SecurityRuleCounts: GET "/security/counts", api::SecurityRuleHitsQuery => Vec<api::SecurityRuleHits>;
     SetSecurityMode: PUT "/security/{guard}/mode" [guard], api::ModeSave => api::ConfigWritten;
     ToggleBuiltinRule: PUT "/security/{guard}/builtin/{id}" [guard, id], api::RuleToggle => api::ConfigWritten;
     SetBuiltinRuleAction: PUT "/security/{guard}/builtin/{id}/action" [guard, id], api::ActionSave => api::ConfigWritten;
@@ -207,6 +209,12 @@ endpoints! {
     UpdateCustomRule: PUT "/security/{guard}/custom/{name}" [guard, name], api::CustomRuleSave => api::ConfigWritten;
     DeleteCustomRule: DELETE "/security/{guard}/custom/{name}" [guard, name], api::BaseVersion => api::ConfigWritten;
     TestSecurity: POST "/security/{guard}/test" [guard], api::SecurityTestRequest => api::SecurityTestResult;
+    /// 出站脱敏的例外值：列出、手动加入（交原值，core 当场算哈希）、把安全日志的一条列为例外
+    /// （按那一行的号）、移出（按哈希）。加入时已经在表里的不再写一次
+    RedactExceptions: GET "/security/exceptions", () => api::RedactExceptions;
+    AddRedactException: POST "/security/exceptions", api::ExceptionAdd => api::ExceptionAdded;
+    ExceptSecurityEvent: POST "/security/events/{id}/exception" [id], api::BaseVersion => api::ExceptionAdded;
+    RemoveRedactException: DELETE "/security/exceptions/{sha256}" [sha256], api::BaseVersion => api::ConfigWritten;
 
     // ─────────────────────────────────────────────── 脚本插件
     //