check method

  1. @override
Future<SecurityResult> check(
  1. RequestContext context
)
override

Inspects context and returns a SecurityResult.

Implementations should be side-effect-light with respect to context.body (avoid destructive mutation) but may freely read/write context.metadata to communicate with later layers.

Implementation

@override
Future<SecurityResult> check(RequestContext context) async {
  final body = context.getMeta<dynamic>('sanitizedBody') ?? context.body;
  final amount = Validators.extractAmount(body);

  // Non-transactional requests (no amount field) simply pass through
  // the sandbox untouched.
  if (amount == null) {
    return SecurityResult.allow(message: 'No transaction to simulate');
  }

  if (amount <= 0) {
    return SecurityResult.block(
      message: 'Transaction amount must be positive',
      flags: const ['invalid_amount'],
      riskScore: 0.7,
    );
  }

  if (amount > maxTransactionAmount) {
    return SecurityResult.block(
      message: 'Transaction exceeds maximum allowed amount',
      flags: const ['amount_over_limit'],
      riskScore: 0.9,
    );
  }

  final userId = context.userId;
  final balance = userId != null ? mockBalances[userId] : null;

  if (balance != null && amount > balance) {
    return SecurityResult.block(
      message: 'Simulated dry-run failed: amount exceeds mock balance',
      flags: const ['insufficient_mock_balance'],
      riskScore: 0.8,
    );
  }

  context.setMeta('sandboxAmount', amount);
  return SecurityResult.allow(message: 'Dry-run simulation passed');
}