A source of facts about a request.

A signal reads the request (and, for behavioural signals, Limen's shared state) and stores one or more named values in the Limen.Context. Policies refer to those values by name with signal/1; the core knows nothing about what they mean.

Every value a signal stores is copied into the Limen.Decision, together with any evidence the signal attached with Limen.Context.put_signal/4, so a decision can always be explained from its inputs.

Identity

The client address, its prefix and the JA4 fingerprint are resolved for every request, before any other signal, because the pass cookie fast path is bound to them. See Limen.Signal.ClientIP and Limen.Signal.JA4.

Built-in signals

Writing a signal

defmodule MyApp.Signal.Tor do
  @behaviour Limen.Signal

  @impl true
  def provides, do: [:tor_exit]

  @impl true
  def collect(ctx) do
    exit? = Limen.Lists.member?(:tor_exits, ctx.client_ip)
    Limen.Context.put_signal(ctx, :tor_exit, exit?)
  end
end

collect/1 runs on the request path: it must not call processes or send messages, and should cost at most a few microseconds.