v0.6.0-beta — custom WAF rules + body scanning

Phase 5.1 of the request WAF.

Added

• Custom WAF rules — a tigershield_rule store + a /tigershield/admin/rules editor (DataTables grid + create/edit modal). Match one request surface (path / query / path+query / User-Agent / method / body) by a literal substring or a regex, with the rule's own action (log / captcha / block — not tier-capped like the shipped soft heuristics). Rules run after the shipped ruleset (first match wins).
• No DB on the hot path — the DB is the source of truth; every write recompiles the active rules to storage/cache/tigershield/waf-custom.json, which the gate reads (one-shot lazy rebuild on a miss) — the same discipline as the CrowdSec blocklist. Tigershield_Service_Rules (datatable / save / toggle / delete) recompiles on every mutation; regex rules are validated on save.
• POST-body scanning (opt-in) — the content categories (traversal / RCE / SQLi / XSS) and any body-targeted custom rule also match form-field values. Off by default (waf.body.enabled); a rich-content skip list (waf.body.skip) plus always-skipped password / CSRF / captcha fields hold down false positives.

Changed

• Tigershield_Service_Waf::inspect() resolves the action itself (returns {label, action}); the gate uses it directly.

Verified

• 17-assertion harness on tiger-dev: custom literal/regex matches + actions, disabled-rule skip, body scanning + skip-list + always-skip fields, shipped body categories, shipped-rule regression, and a benign battery — 0 false positives.

Free · BSD-3-Clause.