Init AppSec before the run context, keep credentials out of its logged URL, and parse its concurrency cap at int size

proxy/internal/appsec/client_test.go

@@ -37,7 +37,13 @@ func (e *engine) start(t *testing.T) *httptest.Server {
 	t.Helper()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		body, err := io.ReadAll(r.Body)
-		require.NoError(t, err)
+		if err != nil {
+			// FailNow is only valid on the test goroutine, and this is the
+			// server's; report and answer 500 so Inspect sees the failure.
+			t.Errorf("read mirrored body: %v", err)
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
 		e.requests++
 		e.gotMethod = r.Method
 		e.gotHeader = r.Header.Clone()

proxy/internal/restrict/restrict.go

@@ -253,16 +253,6 @@ func (v Verdict) IsCrowdSec() bool {
 	}
 }
 
-// IsAppSec returns true when the verdict originates from an AppSec inspection.
-func (v Verdict) IsAppSec() bool {
-	switch v {
-	case DenyAppSecBan, DenyAppSecCaptcha, DenyAppSecUnavailable:
-		return true
-	default:
-		return false
-	}
-}
-
 // IsObserveOnly returns true when v is a CrowdSec verdict and the filter is in
 // observe mode. Callers should log the verdict but not block the request.
 func (f *Filter) IsObserveOnly(v Verdict) bool {