feat: enhance WAF dashboard with timeline chart, event detail view, and sidebar nav

Add time-series stacked bar chart to WAF index page with auto-selected
bucket sizes based on time range. Create WAF event detail show page with
full event info, request headers, and metadata. Add sidebar navigation
link for WAF Events. Wire up clickable event rows for drill-down.
Update V2 roadmap to reflect all completed stretch goals.

Author: raffaelschneider

.claude/FEATURE_ROADMAP_V2.md

@@ -39,13 +39,13 @@
 > Make Sentinel CP capable of configuring all core proxy features through the UI.
 > Every competitor has these — they are table stakes.
 
-### 8.1 TLS / Certificate Management — DONE (ACME/CA stretch goals remain)
+### 8.1 TLS / Certificate Management — DONE
 - [x] Certificate CRUD (upload PEM/DER certs and private keys) — `certificate.ex` schema + `certificate_crypto.ex` AES-256-GCM encryption
 - [x] Certificate-to-service binding (assign certs to virtual hosts / services) — `Service.certificate_id` FK
 - [x] Certificate expiry tracking with dashboard warnings — `certificate_expiry_worker.ex` Oban worker, statuses: active/expiring_soon/expired/revoked
-- [ ] Auto-renewal integration (Let's Encrypt / ACME) — `acme_config` field exists, no ACME client
-- [ ] Internal CA for inter-node mTLS (inspired by nevisAdmin4 auto-PKI)
-- [ ] Trust store management (CA bundles for upstream verification)
+- [x] Auto-renewal integration (Let's Encrypt / ACME) — `acme/client.ex`, `acme/renewal.ex`, `acme/crypto.ex`, `certificate_renewal_worker.ex`
+- [x] Internal CA for inter-node mTLS (inspired by nevisAdmin4 auto-PKI) — `internal_ca.ex`, `internal_ca_live/`
+- [x] Trust store management (CA bundles for upstream verification) — `trust_store.ex`, `trust_stores_live/`
 - [x] KDL generation for TLS blocks — `kdl_generator.ex` `build_tls_certificates` + `build_tls_ref`
 
 ### 8.2 Upstream Groups / Load Balancing — DONE
@@ -91,11 +91,11 @@
 
 > Match enterprise expectations for proxy security and reliability features.
 
-### 9.1 Circuit Breakers — DONE (health view status is a stretch goal)
+### 9.1 Circuit Breakers — DONE
 - [x] Per-upstream circuit breaker configuration — `UpstreamGroup.circuit_breaker` map field
 - [x] Configurable thresholds (failure_threshold, success_threshold, timeout, half_open_max_requests)
 - [x] Half-open state with configurable probe interval
-- [ ] Circuit breaker status in node/service health views — no dedicated health view
+- [x] Circuit breaker status in node/service health views — `circuit_breaker_status.ex`, upstream group show page
 - [x] KDL generation for circuit breaker blocks — `build_nested_map_block` via upstream group
 
 ### 9.2 Proxy-Level Authentication — DONE
@@ -108,13 +108,13 @@
 - [x] Auth configuration UI + API — `auth_policies_live/`, `auth_policy_controller.ex`
 - [x] KDL generation for auth blocks — `build_auth_block`
 
-### 9.3 WAF / Request Security — DONE (anomaly detection / WAF dashboard are stretch goals)
+### 9.3 WAF / Request Security — DONE
 - [x] Request size limits (max body, max headers, max URI length) — `security.max_body_size`
 - [x] Content-type enforcement (whitelist allowed content types)
 - [x] Common attack pattern detection (SQLi, XSS, path traversal, RFI) — `security.block_sqli`, `security.block_xss`
 - [x] Custom WAF rules (regex-based block/allow) — via middleware system with custom type
-- [ ] Request rate anomaly detection
-- [ ] WAF event logging and dashboard
+- [x] Request rate anomaly detection — `waf_baseline.ex`, `waf_baseline_worker.ex`, `waf_anomaly.ex`, anomalies live view
+- [x] WAF event logging and dashboard — `waf_event.ex`, `waf_live/index.ex`, `waf_live/show.ex`, time-series chart
 - [x] Per-service WAF policy (enable/disable, sensitivity level) — `Service.security` map
 - [x] KDL generation for security blocks — `build_security_block`, `build_global_security`
 
@@ -178,9 +178,9 @@
 - [x] Link spec to service for documentation — `Service.openapi_spec_id` FK + `Service.openapi_path`
 - [x] Preview generated services before applying — dedicated preview endpoint
 
-### 11.2 Service Discovery Integration — DONE (DNS/SRV; Consul/K8s are stretch goals)
-- [ ] Consul service discovery (watch for backend changes, auto-update upstream groups)
-- [ ] Kubernetes service discovery (watch Services/Endpoints)
+### 11.2 Service Discovery Integration — DONE
+- [x] Consul service discovery (watch for backend changes, auto-update upstream groups) — `consul_resolver.ex`
+- [x] Kubernetes service discovery (watch Services/Endpoints) — `k8s_resolver.ex`
 - [x] DNS-based discovery (SRV records) — `discovery_source.ex`, `dns_resolver.ex`, `dns_resolver/inet.ex`
 - [x] Manual refresh + auto-sync toggle — `discovery_sync_worker.ex` background worker
 - [x] Discovery source status in UI — `last_synced_at`, `last_sync_status`, `last_sync_error`, `last_sync_targets_count`
@@ -208,31 +208,31 @@
 - [x] Customizable portal branding — `portal_title`, `portal_custom_css`, `portal_logo_url`
 - [x] Usage analytics per API consumer
 
-### 11.6 Secrets Management — DONE (Vault integration is a stretch goal)
+### 11.6 Secrets Management — DONE
 - [x] Secrets store (encrypted at rest, scoped to project or environment) — `secrets/secret.ex`, `secret_crypto.ex` AES-GCM
 - [x] Secret references in service config (e.g., `${secrets.NAME}`) — `secrets.ex` reference pattern
 - [x] Secret injection into KDL at compile time (never stored in bundles in plaintext) — `kdl_generator.ex` `maybe_resolve_secrets`
-- [ ] Vault integration (HashiCorp Vault as external secrets backend)
+- [x] Vault integration (HashiCorp Vault as external secrets backend) — `vault_client.ex`, `vault_config.ex`
 - [x] Secret rotation workflows — `secrets.ex` `rotate_secret`, `last_rotated_at` tracking
 - [x] Audit logging for secret access — audit logs on create/update/rotate
 
 ---
 
-## Remaining Stretch Goals
-
-Items that are not yet implemented but would add value:
-
-| Feature | Phase | Effort | Impact |
-|---------|-------|--------|--------|
-| ACME / Let's Encrypt auto-renewal | 8.1 | Medium | High — eliminates manual cert rotation |
-| Internal CA for mTLS | 8.1 | Large | Medium — enterprise mTLS use cases |
-| Trust store management | 8.1 | Small | Medium — upstream TLS verification |
-| Circuit breaker health view status | 9.1 | Small | Low — observability improvement |
-| WAF anomaly detection | 9.3 | Large | Medium — advanced threat detection |
-| WAF event logging dashboard | 9.3 | Medium | Medium — security visibility |
-| Consul service discovery | 11.2 | Medium | Medium — HashiCorp ecosystem |
-| Kubernetes service discovery | 11.2 | Medium | High — K8s is dominant deployment target |
-| Vault integration for secrets | 11.6 | Medium | Medium — enterprise secrets management |
+## Completed Stretch Goals
+
+All originally-identified stretch goals have been implemented:
+
+| Feature | Phase | Status |
+|---------|-------|--------|
+| ACME / Let's Encrypt auto-renewal | 8.1 | Done — `acme/client.ex`, `acme/renewal.ex`, `certificate_renewal_worker.ex` |
+| Internal CA for mTLS | 8.1 | Done — `internal_ca.ex`, `internal_ca_live/` |
+| Trust store management | 8.1 | Done — `trust_store.ex`, `trust_stores_live/` |
+| Circuit breaker health view status | 9.1 | Done — `circuit_breaker_status.ex`, upstream group show page |
+| WAF anomaly detection | 9.3 | Done — `waf_baseline.ex`, `waf_baseline_worker.ex`, `waf_anomaly.ex` |
+| WAF event logging dashboard | 9.3 | Done — `waf_event.ex`, `waf_live/index.ex`, `waf_live/show.ex` |
+| Consul service discovery | 11.2 | Done — `consul_resolver.ex` |
+| Kubernetes service discovery | 11.2 | Done — `k8s_resolver.ex` |
+| Vault integration for secrets | 11.6 | Done — `vault_client.ex`, `vault_config.ex` |
 
 ---
 

lib/sentinel_cp/analytics.ex

@@ -200,6 +200,11 @@ defmodule SentinelCp.Analytics do
 
   ## WAF Events
 
+  @doc """
+  Gets a single WAF event by ID.
+  """
+  def get_waf_event(id), do: Repo.get(WafEvent, id)
+
   @doc """
   Bulk inserts WAF event records from a node push.
   """
@@ -243,9 +248,7 @@ defmodule SentinelCp.Analytics do
 
     if blocked_count > 0 do
       for pid <- project_ids do
-        SentinelCp.Events.emit("security.waf_blocked", %{count: blocked_count},
-          project_id: pid
-        )
+        SentinelCp.Events.emit("security.waf_blocked", %{count: blocked_count}, project_id: pid)
       end
     end
 
@@ -364,11 +367,20 @@ defmodule SentinelCp.Analytics do
         e.rule_type
       ],
       select: %{
-        bucket: fragment("datetime((strftime('%s', ?) / ? * ?), 'unixepoch')", e.timestamp, ^bucket_seconds, ^bucket_seconds),
+        bucket:
+          fragment(
+            "datetime((strftime('%s', ?) / ? * ?), 'unixepoch')",
+            e.timestamp,
+            ^bucket_seconds,
+            ^bucket_seconds
+          ),
         rule_type: e.rule_type,
         count: count(e.id)
       },
-      order_by: [asc: fragment("(strftime('%s', ?) / ? * ?)", e.timestamp, ^bucket_seconds, ^bucket_seconds)]
+      order_by: [
+        asc:
+          fragment("(strftime('%s', ?) / ? * ?)", e.timestamp, ^bucket_seconds, ^bucket_seconds)
+      ]
     )
     |> Repo.all()
   end
@@ -553,9 +565,21 @@ defmodule SentinelCp.Analytics do
 
   defp normalize_aggregation(result) when is_map(result) do
     Map.new(result, fn
-      {k, nil} when k in [:total_requests, :total_errors, :total_bandwidth_in, :total_bandwidth_out,
-                           :total_2xx, :total_3xx, :total_4xx, :total_5xx,
-                           :status_2xx, :status_3xx, :status_4xx, :status_5xx] ->
+      {k, nil}
+      when k in [
+             :total_requests,
+             :total_errors,
+             :total_bandwidth_in,
+             :total_bandwidth_out,
+             :total_2xx,
+             :total_3xx,
+             :total_4xx,
+             :total_5xx,
+             :status_2xx,
+             :status_3xx,
+             :status_4xx,
+             :status_5xx
+           ] ->
         {k, 0}
 
       {k, %Decimal{} = v} ->

lib/sentinel_cp_web/components/layouts.ex

@@ -169,6 +169,13 @@ defmodule SentinelCpWeb.Layouts do
           current={@path}
           match="/topology"
         />
+        <.sidebar_link
+          path={~p"/orgs/#{@org_slug}/projects/#{@project_slug}/waf"}
+          icon="hero-shield-check"
+          label="WAF Events"
+          current={@path}
+          match="/waf"
+        />
 
         <div class="sidebar-section-title mt-4">Settings</div>
         <.sidebar_link