feat: add security & resilience features (Phase 9)

Circuit breaker UI for upstream groups, proxy-level auth policies
(JWT, API key, basic, forward auth, mTLS) with reusable policies table,
WAF/request security config, and request/response header transforms.

Author: raffaelschneider

lib/sentinel_cp/services.ex

@@ -8,7 +8,7 @@ defmodule SentinelCp.Services do
 
   import Ecto.Query, warn: false
   alias SentinelCp.Repo
-  alias SentinelCp.Services.{Service, ProjectConfig, UpstreamGroup, UpstreamTarget, Certificate}
+  alias SentinelCp.Services.{Service, ProjectConfig, UpstreamGroup, UpstreamTarget, Certificate, AuthPolicy}
 
   ## Services
 
@@ -204,6 +204,54 @@ defmodule SentinelCp.Services do
     Repo.delete(target)
   end
 
+  ## Auth Policies
+
+  @doc """
+  Lists auth policies for a project, ordered by name.
+  """
+  def list_auth_policies(project_id) do
+    from(a in AuthPolicy,
+      where: a.project_id == ^project_id,
+      order_by: [asc: a.name]
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  Gets a single auth policy by ID.
+  """
+  def get_auth_policy(id), do: Repo.get(AuthPolicy, id)
+
+  @doc """
+  Gets a single auth policy by ID, raises if not found.
+  """
+  def get_auth_policy!(id), do: Repo.get!(AuthPolicy, id)
+
+  @doc """
+  Creates an auth policy.
+  """
+  def create_auth_policy(attrs) do
+    %AuthPolicy{}
+    |> AuthPolicy.create_changeset(attrs)
+    |> Repo.insert()
+  end
+
+  @doc """
+  Updates an auth policy.
+  """
+  def update_auth_policy(%AuthPolicy{} = policy, attrs) do
+    policy
+    |> AuthPolicy.update_changeset(attrs)
+    |> Repo.update()
+  end
+
+  @doc """
+  Deletes an auth policy.
+  """
+  def delete_auth_policy(%AuthPolicy{} = policy) do
+    Repo.delete(policy)
+  end
+
   ## Certificates
 
   @doc """

lib/sentinel_cp/services/auth_policy.ex

@@ -0,0 +1,75 @@
+defmodule SentinelCp.Services.AuthPolicy do
+  @moduledoc """
+  Auth policy schema for proxy-level authentication configuration.
+
+  Auth policies define how the proxy validates incoming requests (JWT, API key,
+  basic auth, forward auth, mTLS). Policies are reusable across services.
+  """
+  use Ecto.Schema
+  import Ecto.Changeset
+
+  @primary_key {:id, :binary_id, autogenerate: true}
+  @foreign_key_type :binary_id
+
+  @auth_types ~w(jwt api_key basic forward_auth mtls)
+
+  schema "auth_policies" do
+    field :name, :string
+    field :slug, :string
+    field :description, :string
+    field :auth_type, :string
+    field :config, :map, default: %{}
+    field :enabled, :boolean, default: true
+
+    belongs_to :project, SentinelCp.Projects.Project
+    has_many :services, SentinelCp.Services.Service
+
+    timestamps(type: :utc_datetime)
+  end
+
+  def create_changeset(policy, attrs) do
+    policy
+    |> cast(attrs, [:name, :description, :auth_type, :config, :enabled, :project_id])
+    |> validate_required([:name, :auth_type, :project_id])
+    |> validate_length(:name, min: 1, max: 100)
+    |> validate_inclusion(:auth_type, @auth_types)
+    |> generate_slug()
+    |> validate_slug()
+    |> unique_constraint([:project_id, :slug], error_key: :slug)
+    |> foreign_key_constraint(:project_id)
+  end
+
+  def update_changeset(policy, attrs) do
+    policy
+    |> cast(attrs, [:name, :description, :auth_type, :config, :enabled])
+    |> validate_required([:name, :auth_type])
+    |> validate_length(:name, min: 1, max: 100)
+    |> validate_inclusion(:auth_type, @auth_types)
+  end
+
+  defp generate_slug(changeset) do
+    case get_change(changeset, :name) do
+      nil ->
+        changeset
+
+      name ->
+        slug =
+          name
+          |> String.downcase()
+          |> String.replace(~r/[^a-z0-9]+/, "-")
+          |> String.replace(~r/^-+|-+$/, "")
+          |> String.slice(0, 50)
+
+        put_change(changeset, :slug, slug)
+    end
+  end
+
+  defp validate_slug(changeset) do
+    changeset
+    |> validate_required([:slug])
+    |> validate_format(:slug, ~r/^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/,
+      message: "must contain only lowercase letters, numbers, and hyphens"
+    )
+    |> validate_length(:slug, min: 1, max: 50)
+  end
+end

lib/sentinel_cp/services/kdl_generator.ex

@@ -6,7 +6,7 @@ defmodule SentinelCp.Services.KdlGenerator do
   """
 
   alias SentinelCp.Services
-  alias SentinelCp.Services.{Service, ProjectConfig, UpstreamGroup, Certificate}
+  alias SentinelCp.Services.{Service, ProjectConfig, UpstreamGroup, Certificate, AuthPolicy}
 
   @doc """
   Generates KDL configuration for a project from its services and config.
@@ -22,7 +22,8 @@ defmodule SentinelCp.Services.KdlGenerator do
       {:ok, config} = Services.get_or_create_project_config(project_id)
       upstream_groups = Services.list_upstream_groups(project_id)
       certificates = Services.list_certificates(project_id)
-      kdl = build_kdl(services, config, upstream_groups, certificates)
+      auth_policies = Services.list_auth_policies(project_id)
+      kdl = build_kdl(services, config, upstream_groups, certificates, auth_policies)
       {:ok, kdl}
     end
   end
@@ -31,7 +32,7 @@ defmodule SentinelCp.Services.KdlGenerator do
   Generates KDL from provided services, config, and upstream groups (no DB access).
   Useful for testing.
   """
-  def build_kdl(services, %ProjectConfig{} = config, upstream_groups \\ [], certificates \\ []) do
+  def build_kdl(services, %ProjectConfig{} = config, upstream_groups \\ [], certificates \\ [], auth_policies \\ []) do
     # Build lookup maps
     group_map =
       upstream_groups
@@ -41,6 +42,10 @@ defmodule SentinelCp.Services.KdlGenerator do
       certificates
       |> Enum.into(%{}, fn c -> {c.id, c} end)
 
+    auth_policy_map =
+      auth_policies
+      |> Enum.into(%{}, fn a -> {a.id, a} end)
+
     # Determine which certificates are used by services
     used_cert_ids =
       services
@@ -58,7 +63,7 @@ defmodule SentinelCp.Services.KdlGenerator do
       "",
       build_tls_certificates(used_certs),
       build_upstream_groups(upstream_groups),
-      build_routes(services, group_map, cert_map),
+      build_routes(services, group_map, cert_map, auth_policy_map),
       build_rate_limits(services)
     ]
 
@@ -85,6 +90,7 @@ defmodule SentinelCp.Services.KdlGenerator do
 
     lines = lines ++ build_global_compression(config)
     lines = lines ++ build_global_access_control(config)
+    lines = lines ++ build_global_security(config)
 
     lines ++ ["}"]
   end
@@ -97,6 +103,10 @@ defmodule SentinelCp.Services.KdlGenerator do
     build_nested_map_block(config.global_access_control, "access_control", "    ")
   end
 
+  defp build_global_security(%ProjectConfig{} = config) do
+    build_nested_map_block(config.default_security, "security", "    ")
+  end
+
   defp build_upstream_groups([]), do: []
 
   defp build_upstream_groups(groups) do
@@ -136,16 +146,16 @@ defmodule SentinelCp.Services.KdlGenerator do
     lines ++ ["    }"]
   end
 
-  defp build_routes(services, group_map, cert_map) do
+  defp build_routes(services, group_map, cert_map, auth_policy_map) do
     route_blocks =
       services
-      |> Enum.map(&build_route(&1, group_map, cert_map))
+      |> Enum.map(&build_route(&1, group_map, cert_map, auth_policy_map))
       |> Enum.intersperse([""])
 
     ["routes {"] ++ List.flatten(route_blocks) ++ ["}"]
   end
 
-  defp build_route(%Service{} = service, group_map, cert_map) do
+  defp build_route(%Service{} = service, group_map, cert_map, auth_policy_map) do
     lines = ["    route #{inspect(service.route_path)} {"]
 
     lines =
@@ -182,6 +192,10 @@ defmodule SentinelCp.Services.KdlGenerator do
     lines = lines ++ build_compression_block(service.compression)
     lines = lines ++ build_path_rewrite_block(service.path_rewrite)
     lines = lines ++ build_tls_ref(service.certificate_id, cert_map)
+    lines = lines ++ build_auth_block(service.auth_policy_id, auth_policy_map)
+    lines = lines ++ build_security_block(service.security)
+    lines = lines ++ build_request_transform_block(service.request_transform)
+    lines = lines ++ build_response_transform_block(service.response_transform)
 
     lines ++ ["    }"]
   end
@@ -293,6 +307,45 @@ defmodule SentinelCp.Services.KdlGenerator do
     end
   end
 
+  defp build_security_block(sec) when sec == %{} or sec == nil, do: []
+
+  defp build_security_block(sec) do
+    build_nested_map_block(sec, "security", "        ")
+  end
+
+  defp build_request_transform_block(rt) when rt == %{} or rt == nil, do: []
+
+  defp build_request_transform_block(rt) do
+    build_nested_map_block(rt, "request_transform", "        ")
+  end
+
+  defp build_response_transform_block(rt) when rt == %{} or rt == nil, do: []
+
+  defp build_response_transform_block(rt) do
+    build_nested_map_block(rt, "response_transform", "        ")
+  end
+
+  defp build_auth_block(nil, _auth_policy_map), do: []
+
+  defp build_auth_block(auth_policy_id, auth_policy_map) do
+    case Map.get(auth_policy_map, auth_policy_id) do
+      nil ->
+        []
+
+      %AuthPolicy{} = policy ->
+        lines = ["        auth {"]
+        lines = lines ++ ["            type #{inspect(policy.auth_type)}"]
+
+        config_lines =
+          (policy.config || %{})
+          |> Enum.sort_by(fn {k, _} -> k end)
+          |> Enum.map(fn {key, value} -> "            #{key} #{format_value(value)}" end)
+
+        lines = lines ++ config_lines
+        lines ++ ["        }"]
+    end
+  end
+
   defp build_rate_limits(services) do
     rate_limited =
       services

lib/sentinel_cp/services/project_config.ex

@@ -19,6 +19,7 @@ defmodule SentinelCp.Services.ProjectConfig do
     field :default_cors, :map, default: %{}
     field :default_compression, :map, default: %{}
     field :global_access_control, :map, default: %{}
+    field :default_security, :map, default: %{}
 
     belongs_to :project, SentinelCp.Projects.Project
 
@@ -34,6 +35,7 @@ defmodule SentinelCp.Services.ProjectConfig do
       :default_cors,
       :default_compression,
       :global_access_control,
+      :default_security,
       :project_id
     ])
     |> validate_required([:project_id])

lib/sentinel_cp/services/service.ex

@@ -30,11 +30,15 @@ defmodule SentinelCp.Services.Service do
     field :access_control, :map, default: %{}
     field :compression, :map, default: %{}
     field :path_rewrite, :map, default: %{}
+    field :security, :map, default: %{}
+    field :request_transform, :map, default: %{}
+    field :response_transform, :map, default: %{}
     field :redirect_url, :string
 
     belongs_to :project, SentinelCp.Projects.Project
     belongs_to :upstream_group, SentinelCp.Services.UpstreamGroup
     belongs_to :certificate, SentinelCp.Services.Certificate
+    belongs_to :auth_policy, SentinelCp.Services.AuthPolicy
 
     timestamps(type: :utc_datetime)
   end
@@ -60,9 +64,13 @@ defmodule SentinelCp.Services.Service do
       :access_control,
       :compression,
       :path_rewrite,
+      :security,
+      :request_transform,
+      :response_transform,
       :redirect_url,
       :upstream_group_id,
       :certificate_id,
+      :auth_policy_id,
       :project_id
     ])
     |> validate_required([:name, :route_path, :project_id])
@@ -96,9 +104,13 @@ defmodule SentinelCp.Services.Service do
       :access_control,
       :compression,
       :path_rewrite,
+      :security,
+      :request_transform,
+      :response_transform,
       :redirect_url,
       :upstream_group_id,
-      :certificate_id
+      :certificate_id,
+      :auth_policy_id
     ])
     |> validate_required([:name, :route_path])
     |> validate_length(:name, min: 1, max: 100)