Configuration

config = ScanConfig(
    # T1: Malware / Virus (requires AV setup)
    enable_antivirus=False,

    # T2: Active Content (macros, JS, LLM tool-call injection)
    enable_active_content_checks=True,

    # T3: Obfuscation (hidden content, CMap analysis)
    enable_obfuscation_checks=True,

    # T4: Prompt Injection (5-layer pipeline, 22 languages)
    enable_prompt_injection=True,

    # T5: Ranking Manipulation (TF-IDF drift, Jaccard anomaly)
    enable_ranking_abuse=True,

    # T6: Resource Exhaustion (DoS — zip bombs, timeouts)
    enable_dos_checks=True,

    # T7: Embedded Payloads (binaries, steganography)
    enable_embedded_content_checks=True,

    # T1, T7: Recursive archive scanning (ZIP/tar members scanned recursively)
    enable_archive_scan=True,

    # T8: Metadata Injection (EXIF/XMP exploitation)
    enable_metadata_checks=True,

    # T9: ATS Manipulation (white text, off-page positioning, keyword stuffing)
    enable_ats_manipulation_checks=True,

    # T10: Indirect / Multi-Hop Prompt Injection (on by default — pure regex, negligible latency)
    enable_indirect_injection=True,

    # T11: RAG / Knowledge-Base Poisoning (on by default — Sub-A always active)
    enable_rag_poisoning=True,

    # T12: Social Engineering / Phishing (on by default — pure regex, negligible latency)
    enable_social_engineering=True,
)

config = ScanConfig(
    # Layer 1 — Aho-Corasick O(n) phrase matching (multilingual set, 22 languages)
    enable_advanced_ahocorasick=True,

    # Layer 3 — Sliding-window local DeBERTa classifier (CPU/GPU)
    enable_advanced_bert=True,
    bert_model_path="ProtectAI/deberta-v3-base-prompt-injection-v2",
    bert_confidence_threshold=0.75,   # lower = more sensitive (default was 0.85)
    bert_max_chunks=20,               # max sliding windows per document

    # Layer 4 — Semantic nearest-neighbour (cosine similarity, sentence-transformers)
    enable_semantic_nn=True,
    nn_model_name="all-MiniLM-L6-v2",
    nn_sim_threshold=0.72,            # recall-tuned default

    # Custom phrases layered on top of the built-in list (YAML file)
    custom_ahocorasick_yaml_path="path/to/custom_phrases.yaml",
)

config = ScanConfig(
    enable_yara=True,

    # Include the 53 built-in malware family rules (Emotet, TrickBot, Dridex,
    # PDF heap-spray exploits, RTF Equation Editor RCE, polyglot files, etc.)
    enable_builtin_yara_rules=True,

    # Optionally layer in your own rules on top of the built-in set
    yara_rules_path="path/to/custom.yar",
)

config = ScanConfig(
    enable_ocr_injection_scan=True,   # Off by default (adds ~50–200 ms per image)
)

config = ScanConfig(
    enable_indirect_injection=True,   # On by default (pure regex, < 1 ms)
)

config = ScanConfig(
    enable_rag_poisoning=True,        # On by default (Sub-A always active)
    enable_semantic_nn=True,          # Activates Sub-B context flooding check
    enable_advanced_bert=True,        # Activates Sub-C false authority citation
)

config = ScanConfig(
    enable_social_engineering=True,   # On by default (pure regex, < 1 ms)
)

config = ScanConfig(
    enable_steganography_checks=True,
)

from doc_firewall import PolicyEngine, Scanner, ScanConfig

engine = PolicyEngine("/etc/docfw/policy.yaml")
scanner = Scanner(config=ScanConfig(), policy_engine=engine)
report  = scanner.scan("resume.pdf", policy_name="hr-intake")

config = ScanConfig(
    policy_path="/etc/docfw/policy.yaml",
    policy_name="hr-intake",   # default policy when glob matching finds nothing
)
scanner = Scanner(config=config)

config = ScanConfig(
    verify_model_integrity=True,
    model_integrity_manifest_path="/etc/docfw/model_manifest.json",
)

from doc_firewall.security import ModelIntegrityChecker
ModelIntegrityChecker.generate_manifest(
    ["/mnt/models/deberta-v3-base-prompt-injection-v2"],
    output_path="/etc/docfw/model_manifest.json",
)

config = ScanConfig(
    # Path to the append-only JSONL audit log with SHA-256 hash chain
    audit_log_path="/var/log/docfw/audit.jsonl",
)

config = ScanConfig(
    # Path to the JSON key store (SHA-256-hashed API keys)
    api_keys_path="/etc/docfw/api_keys.json",

    # Per-key token-bucket rate limit (requests per minute)
    api_rate_limit_rpm=60,
)

config = ScanConfig(
    ats_keywords=["nursing", "medical", "registered", "certified", "healthcare"],
)

from doc_firewall import Scanner, ScanConfig

report = Scanner(ScanConfig()).scan("suspect.pdf")
for f in report.findings:
    if f.cve:
        print(f"CVE: {f.cve}")               # e.g. "CVE-2017-11882"
    if f.mitre_technique:
        print(f"MITRE: {f.mitre_technique}")  # e.g. "T1059.007"
    if f.attack_objective:
        print(f"Goal: {f.attack_objective}")  # plain English

# Default: True. Allows standard watermarks ("Draft", "Internal Use Only")
config = ScanConfig(allow_hidden_watermarks=True)