Emit deny action inline when includeEngineConfig=false

[cognitivegears]

Problem

OAShield's generated rules use the block action, whose disruptive behavior is inherited from the SecDefaultAction emitted in mainconfig.conf. With includeEngineConfig=false (the documented way to layer the rules onto an engine that already configures itself), that SecDefaultAction is omitted — so block inherits the host engine's phase-2 default.

The OWASP Core Rule Set defaults phase 2 to pass (it uses anomaly scoring with an explicit deny only in rule 949110). So when OAShield rules are layered onto a Coraza/ModSecurity + CRS deployment with includeEngineConfig=false, every OAShield rule silently no-ops: it logs but never denies. A request that violates the API contract (undeclared parameter, shadow endpoint, bad type) is logged and then forwarded to the app.

Repro: generate with includeEngineConfig=false, load the rules into a stock Coraza+CRS reverse proxy, POST a body with an undeclared property → CRS forwards it, and OAShield logs Unknown parameter detected but returns 200 instead of 403.

Fix

Introduce a ruleDisruptiveAction template variable:

• includeEngineConfig=true (default) → block (unchanged; rules inherit the emitted SecDefaultAction).
• includeEngineConfig=false → the disruptive action inline (deny,status:N / drop / pass / redirect, driven by the existing denyAction/denyStatus/denyRedirectUrl), so the rules block regardless of the host's default action — or, with denyAction=pass, run detection-only.

This is the natural meaning of the two options together: if you're not emitting the engine config, the rules can't rely on it, so they carry the action themselves.

Compatibility

Default output is unchanged — GoldenFileTest (all sample specs × both flavors) passes with no golden churn, because ruleDisruptiveAction is still block whenever the engine config is emitted.

Tests

DenyConfigTest gains three cases (all green, mvn test -Dtest=DenyConfigTest,GoldenFileTest → 24 run, 0 failures):

• includeEngineConfig=false → operation rules and the catch-all default-deny carry inline deny,status:403, no bare block.
• includeEngineConfig=false + denyAction=pass → inline pass (detection-only).
• default → bare block preserved.

Docs

docs/configuration.md updated to describe the inline-action behavior under includeEngineConfig=false.

🤖 Generated with Claude Code