check method

  1. @override
Future<SecurityResult> check(
  1. RequestContext context
)
override

Inspects context and returns a SecurityResult.

Implementations should be side-effect-light with respect to context.body (avoid destructive mutation) but may freely read/write context.metadata to communicate with later layers.

Implementation

@override
Future<SecurityResult> check(RequestContext context) async {
  final body = context.body;

  if (Validators.isEmptyPayload(body)) {
    return SecurityResult.block(
      message: 'Request payload is empty',
      flags: const ['empty_payload'],
      riskScore: 0.9,
    );
  }

  if (!Validators.isStructurallyValidMap(body)) {
    return SecurityResult.block(
      message: 'Request payload is malformed (expected a JSON object)',
      flags: const ['malformed_payload'],
      riskScore: 0.9,
    );
  }

  final sanitized = Helpers.sanitize(body);
  context.setMeta('sanitizedBody', sanitized);

  return SecurityResult.allow(message: 'Payload structurally valid');
}