feat(security): WAF-equivalent input validation + GraphQL depth/complexity limit — PR3 (#2270)

[jung-thomas]

What & why

PR3 of the origin-abuse-protection series (after #2263 shared rate limiter, #2264 edge-cache Fast-Purge). Closes #2270.

Adds a WAF-equivalent input-validation layer on the anon / agentic write surface, plus depth + complexity limiting (and prod-only introspection block) on the public GraphQL endpoint. Consistent with the series: DB-flag gated, DB-driven config, env-free, fail-open, default OFF.

Layers

• Anon POST bodies — srv/lib/input-validation/register.js mounts a two-mode express middleware in cds.on('bootstrap'), right after the rate limiter (floods shed first):
  • size mode — Content-Length body-size cap only. Stream-safe, so it can't loosen a stricter inline limit (e.g. /api/ui-event's 64kb) or interfere with OData parsing. Applied broadly (/content, /build, /graph, /feedback, /homepage, /api, /graphql/public).
  • full mode — size cap + bounded express.json pre-parse + JSON depth/keys/array-length shape check. Scoped to the anon + CSRF-off agentic JSON-RPC surface (/mcp*, /a2a, /chat/stream). Pre-parse is reused downstream (CAP bodyParser4 early-returns on object body; graphql-http reads req.body) → no double-consume.
  • Responses: 413 payload_too_large / 400 invalid_json / 400 invalid_body_shape. srv/lib/input-validation/json-shape.js is a pure, iterative (explicit-stack, never recursive) walker.
• GraphQL /graphql/public — srv/lib/graphql-guard.js provides a hand-rolled graphql-js costLimitRule(maxDepth, maxComplexity) (fragment-resolving, cycle-guarded) and a per-request buildPublicValidationRules fn wired via validationRules in graphql-config.js. Appends the cost rule and, in PROD only, NoSchemaIntrospectionCustomRule. No new dependency (keeps srv-qa boot + "no new BTP entitlements" intact).
• MCP — mcp-channels-search.js, mcp-events-search.js, mcp-kg-tools.js now normalize caller-controlled limit/depth via the canonical clampLimit() shared validator.

Config & flag

• Flag INPUT_VALIDATION_ENABLED (kind:'db', ImsConfig flag.inputvalidation, default false, dev-only) registered in feature-flags/registry.js — surfaces in the Feature Flags UI and auto-registers with db-flags for isFlagEnabled().
• Thresholds in srv/lib/runtime-config/input-validation-settings.js (ImsConfig-backed, ~5s cache, globalThis-pinned, never-throws, no env fallback — blue-green safe). Defaults: 1 MiB body, depth 32, 10k keys, 50k array, gql depth 12 / complexity 1000.
• Fail-open everywhere: flag-off / config-error / walker-fault all resolve to next() (or specifiedRules for GraphQL).

Existing SELECT-only validator untouched

srv/lib/analytics-sql-validator.cjs stays as its own layer — this PR does not replace it.

Tests & verification

• test/unit/input-validation.test.js (new, 25 tests): json-shape depth/keys/array + primitives + deep-payload stack-safety; config defaulting; middleware flag-gating / 413 / 400-shape / size-vs-full / exclude / fail-open; costLimitRule depth + complexity + fragment rejection; buildPublicValidationRules flag-off/on / prod-introspection / fail-open.
• Updated test/unit/mcp-{channels,events}-search.test.js limit=0 assertions to the canonical clampLimit semantics (explicit 0 → floor 1; only omitted → default). These two were the only real test failures introduced; the rest of the unit suite is unchanged (remaining failing files are the pre-existing island/imgly vite transform issues).
• Registry drift test (feature-flags-registry.test.js) passes.
• srv-qa cp-list: unaffected — reverse-dependency audit confirms none of the new modules are reachable from content-store.js; their only importers (server.js, graphql-config.js) are not in srv-qa's curated tree.

Rollout

Default OFF. Enable in DEV via ImsConfig flag.inputvalidation, observe, then PROD.