feat(api-sheriff): implement request pipeline data plane

api-sheriff/pom.xml

@@ -29,6 +29,13 @@
             <groupId>de.cuioss</groupId>
             <artifactId>cui-java-tools</artifactId>
         </dependency>
+        <!-- cui-http: inbound security filtering (de.cuioss.http.security) and the
+             forwarded-header resolver (de.cuioss.http.forwarded); version 2.1.0 managed
+             by cui-java-bom's ${version.cui.http} -->
+        <dependency>
+            <groupId>de.cuioss</groupId>
+            <artifactId>cui-http</artifactId>
+        </dependency>
 
         <!-- Configuration management: YAML parsing + boot-time JSON Schema validation -->
         <dependency>
@@ -49,6 +56,12 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-arc</artifactId>
         </dependency>
+        <!-- quarkus-resteasy: RETAINED after the Plan-04 data-plane cutover (the JAX-RS
+             GatewayResource placeholder was removed; the public edge is now the Vert.x
+             GatewayEdgeRoute). It stays because GatewayExceptionMapper is a JAX-RS @Provider
+             (jakarta.ws.rs.ext.ExceptionMapper) rendering the RFC 9457 problem+json contract, and
+             token-sheriff-client-quarkus registers its own JAX-RS RFC 9457 mapper — both require a
+             JAX-RS runtime. Dropping it would also need explicit approval per the dependency rule. -->
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-resteasy</artifactId>
@@ -69,6 +82,12 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-micrometer-registry-prometheus</artifactId>
         </dependency>
+        <!-- SmallRye Fault Tolerance: programmatic Guard/TypedGuard + CircuitBreakerMaintenance
+             for the per-route resilience guard held on RouteRuntime (Quarkus-BOM-managed) -->
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-smallrye-fault-tolerance</artifactId>
+        </dependency>
 
         <!-- Token Sheriff: client engine + Quarkus extensions (versions managed by token-sheriff-bom) -->
         <dependency>
@@ -126,6 +145,71 @@
             <artifactId>cui-test-juli-logger</artifactId>
             <scope>test</scope>
         </dependency>
+        <!-- cui-http attack databases (generators classifier) driving the adversarial
+             pipeline tests; classifier variant is not BOM-managed, so the inherited
+             ${version.cui.http} pins it to the same 2.1.0 as the main artifact -->
+        <dependency>
+            <groupId>de.cuioss</groupId>
+            <artifactId>cui-http</artifactId>
+            <version>${version.cui.http}</version>
+            <classifier>generators</classifier>
+            <scope>test</scope>
+        </dependency>
+        <!-- token-sheriff-validation generators (JWKS / key material for the offline bearer-token
+             unit tests); the classifier variant is not BOM-managed, so pin it to the stack version
+             explicitly, mirroring the cui-http generators dependency above -->
+        <dependency>
+            <groupId>de.cuioss.sheriff.token</groupId>
+            <artifactId>token-sheriff-validation</artifactId>
+            <version>${version.token-sheriff}</version>
+            <classifier>generators</classifier>
+            <scope>test</scope>
+        </dependency>
+        <!-- JJWT runtime for the token-sheriff-validation generators test-jar. TestTokenHolder
+             (de.cuioss.sheriff.token.validation.test) uses Jwts.SIG (jjwt-api 0.12+) and needs
+             jjwt-impl + jjwt-jackson on the TEST runtime classpath to sign/parse. token-sheriff-validation
+             declares all three jjwt artifacts at test scope, so they do NOT transitively reach this
+             consumer — a cold Maven resolution (CI, fresh env) therefore omits them and TestTokenHolder's
+             static initializer fails with NoClassDefFoundError io/jsonwebtoken/Jwts$SIG. Declared here
+             at test scope with the version inherited from token-sheriff-bom (${version.jjwt} = 0.13.0),
+             so the jjwt line always matches the token-sheriff stack. -->
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-api</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-impl</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-jackson</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <!-- SmallRye Fault Tolerance STANDALONE SPI for the DispatchStageTest retry-gating unit tests.
+             Those tests build a Guard programmatically via io.smallrye.faulttolerance.api.Guard.create()
+             outside any CDI/Quarkus runtime; SpiAccess then ServiceLoader-resolves an
+             io.smallrye.faulttolerance.api.Spi implementation. The compile-scope quarkus-smallrye-fault-tolerance
+             pulls the CDI implementation (io.smallrye:smallrye-fault-tolerance), which registers its Spi via CDI
+             beans, NOT via META-INF/services — so a plain JUnit run finds no Spi and Guard.create() fails with
+             "Could not find implementation of io.smallrye.faulttolerance.api.Spi" (ExceptionInInitializerError /
+             NoClassDefFoundError). smallrye-fault-tolerance-standalone supplies the non-CDI Spi these tests need.
+             Test-scope only (production uses the CDI-wired Guard); version inherited from the Quarkus BOM,
+             matching the 6.11.1 smallrye-fault-tolerance line already on the classpath. -->
+        <dependency>
+            <groupId>io.smallrye</groupId>
+            <artifactId>smallrye-fault-tolerance-standalone</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <!-- ArchUnit: ADR-0005 framework-agnostic package-boundary gate (FrameworkAgnosticArchTest) -->
+        <dependency>
+            <groupId>com.tngtech.archunit</groupId>
+            <artifactId>archunit</artifactId>
+            <version>1.4.2</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

api-sheriff/src/main/java/de/cuioss/sheriff/api/ApiSheriffLogMessages.java

@@ -0,0 +1,89 @@
+/*
+ * Copyright © 2022 CUI-OpenSource-Software (info@cuioss.de)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package de.cuioss.sheriff.api;
+
+import de.cuioss.tools.logging.LogRecord;
+import de.cuioss.tools.logging.LogRecordModel;
+
+import lombok.experimental.UtilityClass;
+
+/**
+ * DSL-style {@link LogRecord} catalogue for the API Sheriff gateway request-pipeline edge.
+ * <p>
+ * Structured {@code INFO} (1-99) and {@code WARN} (100-199) messages carry the
+ * {@code ApiSheriff} prefix and a stable numeric identifier, so they are greppable and
+ * assertable. This catalogue's identifier ranges are disjoint from
+ * {@link de.cuioss.sheriff.api.config.ConfigLogMessages}'s (the boot-time configuration
+ * subsystem catalogue), which shares the same {@code ApiSheriff} prefix: {@code 1-2} /
+ * {@code 100} / {@code 103-104} here vs {@code 2-3} / {@code 101-102} / {@code 200-201}
+ * there — never renumber one catalogue without checking the other for a collision.
+ * Security-relevant {@code WARN}s record only the failure <em>type</em> and route id —
+ * never the raw offending payload. {@code DEBUG} / {@code TRACE} diagnostics use the logger
+ * directly and are not catalogued here.
+ *
+ * @author API Sheriff Team
+ * @since 1.0
+ */
+@UtilityClass
+public final class ApiSheriffLogMessages {
+
+    private static final String PREFIX = "ApiSheriff";
+
+    /**
+     * Info-level messages (INFO range 1-99).
+     */
+    @UtilityClass
+    public static final class INFO {
+
+        /** The route table was compiled into the immutable per-route runtime at boot. */
+        public static final LogRecord ROUTE_TABLE_COMPILED = LogRecordModel.builder()
+                .prefix(PREFIX)
+                .identifier(1)
+                .template("Route table compiled: %s route runtime(s) assembled")
+                .build();
+    }
+
+    /**
+     * Warn-level messages (WARN range 100-199).
+     */
+    @UtilityClass
+    public static final class WARN {
+
+        /**
+         * A cui-http security filter rejected a request. Records the route id and the
+         * failure type only — the raw offending payload is never logged.
+         */
+        public static final LogRecord SECURITY_FILTER_VIOLATION = LogRecordModel.builder()
+                .prefix(PREFIX)
+                .identifier(100)
+                .template("Security filter rejected a request on route '%s': failure type %s")
+                .build();
+
+        /** The circuit breaker opened for an upstream after consecutive failures. */
+        public static final LogRecord CIRCUIT_BREAKER_OPEN = LogRecordModel.builder()
+                .prefix(PREFIX)
+                .identifier(103)
+                .template("Circuit breaker opened for upstream '%s'")
+                .build();
+
+        /** The circuit breaker closed again for an upstream after recovery. */
+        public static final LogRecord CIRCUIT_BREAKER_CLOSED = LogRecordModel.builder()
+                .prefix(PREFIX)
+                .identifier(104)
+                .template("Circuit breaker closed for upstream '%s'")
+                .build();
+    }
+}