Add CrowdSec AppSec request inspection to the reverse proxy

management/server/store/sql_store.go

@@ -6491,6 +6491,7 @@ var validCapabilityColumns = map[string]struct{}{
 	"supports_custom_ports": {},
 	"require_subdomain":     {},
 	"supports_crowdsec":     {},
+	"supports_appsec":       {},
 	"private":               {},
 }
 
@@ -6521,6 +6522,14 @@ func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr s
 	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
 }
 
+// GetClusterSupportsAppSec returns whether all active proxies in the cluster
+// have a CrowdSec AppSec endpoint configured. Returns nil when no proxy
+// reported the capability. Unanimous for the same reason as CrowdSec: a single
+// proxy without AppSec would let requests through uninspected.
+func (s *SqlStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_appsec")
+}
+
 // getClusterUnanimousCapability returns an aggregated boolean capability
 // requiring all active proxies in the cluster to report true.
 func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {

management/server/store/sql_store_proxy_capability_test.go

@@ -0,0 +1,119 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+)
+
+// Capabilities travel proxy → gRPC → embedded gorm columns → aggregation → API.
+// A field dropped at any of those hops reads as "capability absent", which is
+// indistinguishable from a proxy that never reported it: the dashboard simply
+// hides the feature and nothing fails. These assertions cover the persistence
+// and aggregation hops.
+func TestSqlStore_ClusterCapabilityAggregation(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	yes, no := true, false
+
+	tests := []struct {
+		name          string
+		reported      []*bool // one entry per connected proxy in the cluster
+		wantAppSec    *bool
+		wantAssertion string
+	}{
+		{
+			name:          "unreported stays unknown",
+			reported:      []*bool{nil},
+			wantAppSec:    nil,
+			wantAssertion: "an unreported capability must not read as false",
+		},
+		{
+			name:          "single proxy reporting true",
+			reported:      []*bool{&yes},
+			wantAppSec:    &yes,
+			wantAssertion: "a reported capability must survive persistence",
+		},
+		{
+			name:          "one proxy without it disables the cluster",
+			reported:      []*bool{&yes, &no},
+			wantAppSec:    &no,
+			wantAssertion: "capability must be unanimous, so a rolling upgrade cannot leave traffic uninspected",
+		},
+		{
+			name:          "one proxy yet to report disables the cluster",
+			reported:      []*bool{&yes, nil},
+			wantAppSec:    &no,
+			wantAssertion: "a proxy that has not reported must not count as capable",
+		},
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		for i, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				cluster := fmt.Sprintf("cluster-%d.proxy.example", i)
+				for j, reported := range tt.reported {
+					require.NoError(t, store.SaveProxy(ctx, &proxy.Proxy{
+						ID:             fmt.Sprintf("proxy-%d-%d", i, j),
+						ClusterAddress: cluster,
+						Status:         proxy.StatusConnected,
+						LastSeen:       time.Now(),
+						Capabilities:   proxy.Capabilities{SupportsAppsec: reported},
+					}))
+				}
+
+				got := store.GetClusterSupportsAppSec(ctx, cluster)
+				if tt.wantAppSec == nil {
+					assert.Nil(t, got, tt.wantAssertion)
+					return
+				}
+				require.NotNil(t, got, tt.wantAssertion)
+				assert.Equal(t, *tt.wantAppSec, *got, tt.wantAssertion)
+			})
+		}
+	})
+}
+
+// AppSec and IP reputation are separate endpoints, so a cluster can have either
+// without the other. Gating one on the other would silently disable a feature
+// the operator configured.
+func TestSqlStore_ClusterCapabilitiesAreIndependent(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		const cluster = "independent.proxy.example"
+		yes, no := true, false
+
+		require.NoError(t, store.SaveProxy(ctx, &proxy.Proxy{
+			ID:             "proxy-independent",
+			ClusterAddress: cluster,
+			Status:         proxy.StatusConnected,
+			LastSeen:       time.Now(),
+			Capabilities: proxy.Capabilities{
+				SupportsAppsec:   &yes,
+				SupportsCrowdsec: &no,
+			},
+		}))
+
+		appsec := store.GetClusterSupportsAppSec(ctx, cluster)
+		crowdsec := store.GetClusterSupportsCrowdSec(ctx, cluster)
+		require.NotNil(t, appsec)
+		require.NotNil(t, crowdsec)
+		assert.True(t, *appsec, "AppSec must not be gated on CrowdSec")
+		assert.False(t, *crowdsec, "CrowdSec must not be implied by AppSec")
+	})
+}

management/server/store/sql_store_service_test.go

@@ -155,6 +155,8 @@ func TestSqlStore_GetAccount_ServiceRestrictionsRoundtrip(t *testing.T) {
 				AllowedCIDRs:     []string{"203.0.113.0/24"},
 				AllowedCountries: []string{"US"},
 				AllowMatch:       "any",
+				CrowdSecMode:     "observe",
+				AppSecMode:       "enforce",
 			},
 		}
 		require.NoError(t, store.CreateService(ctx, svc))
@@ -164,11 +166,13 @@ func TestSqlStore_GetAccount_ServiceRestrictionsRoundtrip(t *testing.T) {
 		require.Len(t, loaded.Services, 1)
 
 		// Restrictions are stored as a JSON blob; confirm the whole struct,
-		// including allow_match, survives the read path (Postgres pgx path
-		// included via runTestForAllEngines).
+		// including allow_match and the CrowdSec modes, survives the read path
+		// (Postgres pgx path included via runTestForAllEngines).
 		got := loaded.Services[0].Restrictions
 		assert.Equal(t, []string{"203.0.113.0/24"}, got.AllowedCIDRs)
 		assert.Equal(t, []string{"US"}, got.AllowedCountries)
 		assert.Equal(t, "any", got.AllowMatch)
+		assert.Equal(t, "observe", got.CrowdSecMode)
+		assert.Equal(t, "enforce", got.AppSecMode)
 	})
 }

management/server/store/store.go

@@ -329,6 +329,7 @@ type Store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error)

management/server/store/store_mock.go

@@ -1878,6 +1878,20 @@ func (mr *MockStoreMockRecorder) GetClusterRequireSubdomain(ctx, clusterAddr int
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterRequireSubdomain", reflect.TypeOf((*MockStore)(nil).GetClusterRequireSubdomain), ctx, clusterAddr)
 }
 
+// GetClusterSupportsAppSec mocks base method.
+func (m *MockStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClusterSupportsAppSec", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// GetClusterSupportsAppSec indicates an expected call of GetClusterSupportsAppSec.
+func (mr *MockStoreMockRecorder) GetClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsAppSec", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsAppSec), ctx, clusterAddr)
+}
+
 // GetClusterSupportsCrowdSec mocks base method.
 func (m *MockStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()