chore: formatting cleanup and plugin integration wiring

Apply formatter fixes across the codebase, add service_plugins
association, and wire plugin system into bundle compilation and
KDL generation.

Author: raffaelschneider

config/config.exs

@@ -92,8 +92,7 @@ config :sentinel_cp, :github_webhook,
   default_branch: "main"
 
 # ACME / Let's Encrypt configuration
-config :sentinel_cp, :acme,
-  directory_url: "https://acme-v02.api.letsencrypt.org/directory"
+config :sentinel_cp, :acme, directory_url: "https://acme-v02.api.letsencrypt.org/directory"
 
 # Import environment specific config. This must remain at the bottom
 # of this file so it overrides the configuration defined above.

config/test.exs

@@ -42,6 +42,11 @@ config :phoenix_live_view,
 config :phoenix,
   sort_verified_routes_query_params: true
 
+# Bundle storage (local filesystem in test)
+config :sentinel_cp, SentinelCp.Bundles.Storage,
+  backend: :local,
+  local_dir: Path.expand("../tmp/test_bundles", __DIR__)
+
 # Bundle signing disabled in test (individual tests can override)
 config :sentinel_cp, :bundle_signing, enabled: false
 

lib/mix/tasks/sentinel/config/apply.ex

@@ -35,7 +35,10 @@ defmodule Mix.Tasks.Sentinel.Config.Apply do
         apply_config(slug, file, opts)
 
       _ ->
-        Mix.shell().error("Usage: mix sentinel.config.apply <project_slug> <file> [--dry-run] [--yes]")
+        Mix.shell().error(
+          "Usage: mix sentinel.config.apply <project_slug> <file> [--dry-run] [--yes]"
+        )
+
         exit({:shutdown, 1})
     end
   end
@@ -123,15 +126,19 @@ defmodule Mix.Tasks.Sentinel.Config.Apply do
     cond do
       String.ends_with?(path, [".yml", ".yaml"]) ->
         case YamlElixir.read_from_string(content) do
-          {:ok, parsed} -> parsed
+          {:ok, parsed} ->
+            parsed
+
           {:error, reason} ->
             Mix.shell().error("Failed to parse YAML: #{inspect(reason)}")
             exit({:shutdown, 1})
         end
 
       String.ends_with?(path, ".json") ->
         case Jason.decode(content) do
-          {:ok, parsed} -> parsed
+          {:ok, parsed} ->
+            parsed
+
           {:error, reason} ->
             Mix.shell().error("Failed to parse JSON: #{inspect(reason)}")
             exit({:shutdown, 1})
@@ -145,7 +152,9 @@ defmodule Mix.Tasks.Sentinel.Config.Apply do
 
           {:error, _} ->
             case Jason.decode(content) do
-              {:ok, parsed} -> parsed
+              {:ok, parsed} ->
+                parsed
+
               {:error, _} ->
                 Mix.shell().error("Unable to parse file as YAML or JSON: #{path}")
                 exit({:shutdown, 1})

lib/mix/tasks/sentinel/config/diff.ex

@@ -87,15 +87,19 @@ defmodule Mix.Tasks.Sentinel.Config.Diff do
     cond do
       String.ends_with?(path, [".yml", ".yaml"]) ->
         case YamlElixir.read_from_string(content) do
-          {:ok, parsed} -> parsed
+          {:ok, parsed} ->
+            parsed
+
           {:error, reason} ->
             Mix.shell().error("Failed to parse YAML: #{inspect(reason)}")
             exit({:shutdown, 1})
         end
 
       String.ends_with?(path, ".json") ->
         case Jason.decode(content) do
-          {:ok, parsed} -> parsed
+          {:ok, parsed} ->
+            parsed
+
           {:error, reason} ->
             Mix.shell().error("Failed to parse JSON: #{inspect(reason)}")
             exit({:shutdown, 1})
@@ -108,7 +112,9 @@ defmodule Mix.Tasks.Sentinel.Config.Diff do
 
           {:error, _} ->
             case Jason.decode(content) do
-              {:ok, parsed} -> parsed
+              {:ok, parsed} ->
+                parsed
+
               {:error, _} ->
                 Mix.shell().error("Unable to parse file as YAML or JSON: #{path}")
                 exit({:shutdown, 1})

lib/mix/tasks/sentinel/config/export.ex

@@ -35,7 +35,10 @@ defmodule Mix.Tasks.Sentinel.Config.Export do
         export(slug, opts)
 
       _ ->
-        Mix.shell().error("Usage: mix sentinel.config.export <project_slug> [--format yaml|json] [--output file]")
+        Mix.shell().error(
+          "Usage: mix sentinel.config.export <project_slug> [--format yaml|json] [--output file]"
+        )
+
         exit({:shutdown, 1})
     end
   end

lib/sentinel_cp/analytics/waf_anomaly_detector.ex

@@ -25,7 +25,8 @@ defmodule SentinelCp.Analytics.WafAnomalyDetector do
     anomalies =
       Enum.flat_map(observations, fn {metric_type, observed} ->
         case Map.get(baselines, metric_type) do
-          %{mean: mean, stddev: stddev} when is_number(mean) and is_number(stddev) and stddev > 0 ->
+          %{mean: mean, stddev: stddev}
+          when is_number(mean) and is_number(stddev) and stddev > 0 ->
             detect_spike(metric_type, observed, mean, stddev, sigma_threshold)
 
           _ ->
@@ -39,7 +40,13 @@ defmodule SentinelCp.Analytics.WafAnomalyDetector do
   @doc """
   Detects spike anomalies where the observed value exceeds mean + threshold * stddev.
   """
-  def detect_spike(metric_type, observed, mean, stddev, sigma_threshold \\ @default_sigma_threshold) do
+  def detect_spike(
+        metric_type,
+        observed,
+        mean,
+        stddev,
+        sigma_threshold \\ @default_sigma_threshold
+      ) do
     deviation = (observed - mean) / stddev
 
     if deviation > sigma_threshold do
@@ -49,7 +56,8 @@ defmodule SentinelCp.Analytics.WafAnomalyDetector do
         %{
           anomaly_type: "spike",
           severity: severity,
-          description: "#{metric_type} spike: #{Float.round(observed * 1.0, 1)} observed vs #{Float.round(mean, 1)} expected (#{Float.round(deviation, 1)} sigma)",
+          description:
+            "#{metric_type} spike: #{Float.round(observed * 1.0, 1)} observed vs #{Float.round(mean, 1)} expected (#{Float.round(deviation, 1)} sigma)",
           observed_value: observed * 1.0,
           expected_mean: mean,
           expected_stddev: stddev,
@@ -85,7 +93,12 @@ defmodule SentinelCp.Analytics.WafAnomalyDetector do
   @doc """
   Detects IP burst anomalies (unusual number of unique attacking IPs).
   """
-  def detect_ip_burst(unique_ips, baseline_mean, baseline_stddev, sigma_threshold \\ @default_sigma_threshold) do
+  def detect_ip_burst(
+        unique_ips,
+        baseline_mean,
+        baseline_stddev,
+        sigma_threshold \\ @default_sigma_threshold
+      ) do
     if baseline_stddev > 0 do
       detect_spike("unique_ips", unique_ips, baseline_mean, baseline_stddev, sigma_threshold)
       |> Enum.map(&Map.put(&1, :anomaly_type, "ip_burst"))
@@ -97,7 +110,12 @@ defmodule SentinelCp.Analytics.WafAnomalyDetector do
   @doc """
   Detects rate change anomalies (sudden increase in block rate).
   """
-  def detect_rate_change(current_rate, baseline_mean, baseline_stddev, sigma_threshold \\ @default_sigma_threshold) do
+  def detect_rate_change(
+        current_rate,
+        baseline_mean,
+        baseline_stddev,
+        sigma_threshold \\ @default_sigma_threshold
+      ) do
     if baseline_stddev > 0 do
       detect_spike("block_rate", current_rate, baseline_mean, baseline_stddev, sigma_threshold)
       |> Enum.map(&Map.put(&1, :anomaly_type, "rate_change"))

lib/sentinel_cp/analytics/waf_anomaly_worker.ex

@@ -38,7 +38,9 @@ defmodule SentinelCp.Analytics.WafAnomalyWorker do
       end)
 
     if total_anomalies > 0 do
-      Logger.info("WafAnomalyWorker: detected #{total_anomalies} anomalies across #{length(project_ids)} projects")
+      Logger.info(
+        "WafAnomalyWorker: detected #{total_anomalies} anomalies across #{length(project_ids)} projects"
+      )
     end
 
     schedule_next()
@@ -80,12 +82,17 @@ defmodule SentinelCp.Analytics.WafAnomalyWorker do
 
           case Analytics.create_waf_anomaly(attrs) do
             {:ok, anomaly} ->
-              SentinelCp.Events.emit("security.waf_anomaly", %{
-                anomaly_id: anomaly.id,
-                anomaly_type: anomaly.anomaly_type,
-                severity: anomaly.severity,
-                description: anomaly.description
-              }, project_id: project_id)
+              SentinelCp.Events.emit(
+                "security.waf_anomaly",
+                %{
+                  anomaly_id: anomaly.id,
+                  anomaly_type: anomaly.anomaly_type,
+                  severity: anomaly.severity,
+                  description: anomaly.description
+                },
+                project_id: project_id
+              )
+
               true
 
             {:error, _} ->

lib/sentinel_cp/audit/audit_checkpoint.ex

@@ -31,7 +31,13 @@ defmodule SentinelCp.Audit.AuditCheckpoint do
       :entries_count,
       :project_id
     ])
-    |> validate_required([:sequence_number, :last_entry_hash, :digest, :signature, :entries_count])
+    |> validate_required([
+      :sequence_number,
+      :last_entry_hash,
+      :digest,
+      :signature,
+      :entries_count
+    ])
     |> validate_number(:sequence_number, greater_than: 0)
     |> validate_number(:entries_count, greater_than_or_equal_to: 0)
   end

lib/sentinel_cp/audit/compliance_export.ex

@@ -137,6 +137,7 @@ defmodule SentinelCp.Audit.ComplianceExport do
   end
 
   defp encode_metadata(nil), do: ""
+
   defp encode_metadata(metadata) when is_map(metadata) do
     metadata
     |> Enum.map(fn {k, v} -> "#{k}=#{inspect(v)}" end)

lib/sentinel_cp/bundles/compile_worker.ex

@@ -11,7 +11,7 @@ defmodule SentinelCp.Bundles.CompileWorker do
 
   alias SentinelCp.Bundles
   alias SentinelCp.Bundles.{Compiler, Risk, Signing, Storage}
-  alias SentinelCp.{Audit, Services}
+  alias SentinelCp.{Audit, Plugins, Services}
 
   @impl Oban.Worker
   def perform(%Oban.Job{args: %{"bundle_id" => bundle_id}}) do
@@ -110,15 +110,20 @@ defmodule SentinelCp.Bundles.CompileWorker do
   end
 
   defp build_extra_files(project_id) do
-    case Services.get_internal_ca(project_id) do
-      nil ->
-        []
-
-      ca ->
-        [
-          {"internal-ca/ca.pem", ca.ca_cert_pem},
-          {"internal-ca/crl.pem", ca.crl_pem || ""}
-        ]
-    end
+    ca_files =
+      case Services.get_internal_ca(project_id) do
+        nil ->
+          []
+
+        ca ->
+          [
+            {"internal-ca/ca.pem", ca.ca_cert_pem},
+            {"internal-ca/crl.pem", ca.crl_pem || ""}
+          ]
+      end
+
+    plugin_files = Plugins.collect_plugin_files(project_id)
+
+    ca_files ++ plugin_files
   end
 end