feat: add middleware / plugin system (Phase 11.3)

Add composable, reusable middleware entities that can be attached to
services in an ordered chain. Middleware coexists with existing inline
fields — inline blocks render first, middleware chain blocks append
after in position order.

- Middleware schema (12 types: rate_limit, cache, cors, compression,
  headers, access_control, security, path_rewrite, request_transform,
  response_transform, auth, custom) with project-scoped slugs
- ServiceMiddleware join table with position ordering, per-service
  config_override, and enable toggle
- KDL generator produces middleware chain blocks with merged config
  (auth type generates structured auth blocks, custom type uses
  configurable kdl_block_name)
- Middleware library LiveView pages (index, new, show, edit)
- Service show page middleware chain section (attach/detach)
- REST API for middleware CRUD and service chain management
- 32 new tests (713 total, 0 failures)

Author: raffaelschneider

lib/sentinel_cp/services.ex

@@ -8,7 +8,7 @@ defmodule SentinelCp.Services do
 
   import Ecto.Query, warn: false
   alias SentinelCp.Repo
-  alias SentinelCp.Services.{Service, ServiceTemplate, ProjectConfig, UpstreamGroup, UpstreamTarget, Certificate, AuthPolicy, OpenApiSpec, DiscoverySource, DiscoverySync}
+  alias SentinelCp.Services.{Service, ServiceTemplate, ProjectConfig, UpstreamGroup, UpstreamTarget, Certificate, AuthPolicy, OpenApiSpec, DiscoverySource, DiscoverySync, Middleware, ServiceMiddleware}
 
   ## Services
 
@@ -613,6 +613,141 @@ defmodule SentinelCp.Services do
     end
   end
 
+  ## Middlewares
+
+  @doc """
+  Lists middlewares for a project, ordered by name.
+  """
+  def list_middlewares(project_id) do
+    from(m in Middleware,
+      where: m.project_id == ^project_id,
+      order_by: [asc: m.name]
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  Lists middlewares for a project filtered by type.
+  """
+  def list_middlewares_by_type(project_id, type) do
+    from(m in Middleware,
+      where: m.project_id == ^project_id and m.middleware_type == ^type,
+      order_by: [asc: m.name]
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  Gets a single middleware by ID.
+  """
+  def get_middleware(id), do: Repo.get(Middleware, id)
+
+  @doc """
+  Gets a single middleware by ID, raises if not found.
+  """
+  def get_middleware!(id), do: Repo.get!(Middleware, id)
+
+  @doc """
+  Creates a middleware.
+  """
+  def create_middleware(attrs) do
+    %Middleware{}
+    |> Middleware.create_changeset(attrs)
+    |> Repo.insert()
+  end
+
+  @doc """
+  Updates a middleware.
+  """
+  def update_middleware(%Middleware{} = middleware, attrs) do
+    middleware
+    |> Middleware.update_changeset(attrs)
+    |> Repo.update()
+  end
+
+  @doc """
+  Deletes a middleware. Cascades to service_middlewares.
+  """
+  def delete_middleware(%Middleware{} = middleware) do
+    Repo.delete(middleware)
+  end
+
+  ## Service Middleware Chain
+
+  @doc """
+  Lists service middlewares for a service, ordered by position, preloading middleware.
+  """
+  def list_service_middlewares(service_id) do
+    from(sm in ServiceMiddleware,
+      where: sm.service_id == ^service_id,
+      order_by: [asc: sm.position],
+      preload: [:middleware]
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  Attaches a middleware to a service.
+  """
+  def attach_middleware(attrs) do
+    %ServiceMiddleware{}
+    |> ServiceMiddleware.changeset(attrs)
+    |> Repo.insert()
+  end
+
+  @doc """
+  Detaches a middleware from a service.
+  """
+  def detach_middleware(%ServiceMiddleware{} = sm) do
+    Repo.delete(sm)
+  end
+
+  @doc """
+  Gets a service middleware by ID.
+  """
+  def get_service_middleware(id) do
+    ServiceMiddleware
+    |> Repo.get(id)
+    |> Repo.preload(:middleware)
+  end
+
+  @doc """
+  Gets a service middleware by service_id and middleware_id.
+  """
+  def get_service_middleware_by(service_id, middleware_id) do
+    from(sm in ServiceMiddleware,
+      where: sm.service_id == ^service_id and sm.middleware_id == ^middleware_id
+    )
+    |> Repo.one()
+  end
+
+  @doc """
+  Updates a service middleware (position, enabled, config_override).
+  """
+  def update_service_middleware(%ServiceMiddleware{} = sm, attrs) do
+    sm
+    |> ServiceMiddleware.changeset(attrs)
+    |> Repo.update()
+  end
+
+  @doc """
+  Batch updates service middleware positions.
+
+  Accepts a list of `{service_middleware_id, position}` tuples.
+  """
+  def reorder_service_middlewares(service_id, id_position_pairs) do
+    Repo.transaction(fn ->
+      for {id, position} <- id_position_pairs do
+        from(sm in ServiceMiddleware,
+          where: sm.id == ^id and sm.service_id == ^service_id
+        )
+        |> Repo.update_all(set: [position: position])
+      end
+
+      :ok
+    end)
+  end
+
   defp dns_resolver do
     Application.get_env(:sentinel_cp, :dns_resolver, SentinelCp.Services.DnsResolver.Inet)
   end

lib/sentinel_cp/services/kdl_generator.ex

@@ -23,7 +23,15 @@ defmodule SentinelCp.Services.KdlGenerator do
       upstream_groups = Services.list_upstream_groups(project_id)
       certificates = Services.list_certificates(project_id)
       auth_policies = Services.list_auth_policies(project_id)
-      kdl = build_kdl(services, config, upstream_groups, certificates, auth_policies)
+
+      # Build middleware chain map: service_id -> [service_middlewares]
+      middleware_chains =
+        services
+        |> Enum.into(%{}, fn s ->
+          {s.id, Services.list_service_middlewares(s.id)}
+        end)
+
+      kdl = build_kdl(services, config, upstream_groups, certificates, auth_policies, middleware_chains)
       {:ok, kdl}
     end
   end
@@ -32,7 +40,7 @@ defmodule SentinelCp.Services.KdlGenerator do
   Generates KDL from provided services, config, and upstream groups (no DB access).
   Useful for testing.
   """
-  def build_kdl(services, %ProjectConfig{} = config, upstream_groups \\ [], certificates \\ [], auth_policies \\ []) do
+  def build_kdl(services, %ProjectConfig{} = config, upstream_groups \\ [], certificates \\ [], auth_policies \\ [], middleware_chains \\ %{}) do
     # Build lookup maps
     group_map =
       upstream_groups
@@ -63,7 +71,7 @@ defmodule SentinelCp.Services.KdlGenerator do
       "",
       build_tls_certificates(used_certs),
       build_upstream_groups(upstream_groups),
-      build_routes(services, group_map, cert_map, auth_policy_map),
+      build_routes(services, group_map, cert_map, auth_policy_map, middleware_chains),
       build_rate_limits(services)
     ]
 
@@ -146,16 +154,19 @@ defmodule SentinelCp.Services.KdlGenerator do
     lines ++ ["    }"]
   end
 
-  defp build_routes(services, group_map, cert_map, auth_policy_map) do
+  defp build_routes(services, group_map, cert_map, auth_policy_map, middleware_chains) do
     route_blocks =
       services
-      |> Enum.map(&build_route(&1, group_map, cert_map, auth_policy_map))
+      |> Enum.map(fn service ->
+        chain = Map.get(middleware_chains, service.id, [])
+        build_route(service, group_map, cert_map, auth_policy_map, chain)
+      end)
       |> Enum.intersperse([""])
 
     ["routes {"] ++ List.flatten(route_blocks) ++ ["}"]
   end
 
-  defp build_route(%Service{} = service, group_map, cert_map, auth_policy_map) do
+  defp build_route(%Service{} = service, group_map, cert_map, auth_policy_map, middleware_chain) do
     lines = ["    route #{inspect(service.route_path)} {"]
 
     lines =
@@ -198,6 +209,9 @@ defmodule SentinelCp.Services.KdlGenerator do
     lines = lines ++ build_response_transform_block(service.response_transform)
     lines = lines ++ build_traffic_split_block(service.traffic_split, group_map)
 
+    # Append middleware chain blocks (after inline fields)
+    lines = lines ++ build_middleware_chain(middleware_chain)
+
     lines ++ ["    }"]
   end
 
@@ -401,6 +415,58 @@ defmodule SentinelCp.Services.KdlGenerator do
     end
   end
 
+  defp build_middleware_chain([]), do: []
+
+  defp build_middleware_chain(service_middlewares) do
+    service_middlewares
+    |> Enum.filter(fn sm -> sm.enabled end)
+    |> Enum.sort_by(fn sm -> sm.position end)
+    |> Enum.flat_map(&build_middleware_block/1)
+  end
+
+  defp build_middleware_block(service_middleware) do
+    middleware = service_middleware.middleware
+
+    # Skip disabled middleware definitions
+    unless middleware.enabled do
+      []
+    else
+      merged_config = Map.merge(middleware.config || %{}, service_middleware.config_override || %{})
+
+      case middleware.middleware_type do
+        "auth" ->
+          build_middleware_auth_block(merged_config)
+
+        "custom" ->
+          block_name = Map.get(merged_config, "kdl_block_name", "custom")
+          config = Map.drop(merged_config, ["kdl_block_name"])
+          build_nested_map_block(config, block_name, "        ")
+
+        type ->
+          build_nested_map_block(merged_config, type, "        ")
+      end
+    end
+  end
+
+  defp build_middleware_auth_block(config) do
+    auth_type = Map.get(config, "type", Map.get(config, "auth_type"))
+    rest = Map.drop(config, ["type", "auth_type"])
+
+    if auth_type do
+      lines = ["        auth {"]
+      lines = lines ++ ["            type #{inspect(auth_type)}"]
+
+      config_lines =
+        rest
+        |> Enum.sort_by(fn {k, _} -> k end)
+        |> Enum.map(fn {key, value} -> "            #{key} #{format_value(value)}" end)
+
+      lines ++ config_lines ++ ["        }"]
+    else
+      build_nested_map_block(config, "auth", "        ")
+    end
+  end
+
   defp build_rate_limits(services) do
     rate_limited =
       services

lib/sentinel_cp/services/middleware.ex

@@ -0,0 +1,77 @@
+defmodule SentinelCp.Services.Middleware do
+  @moduledoc """
+  Middleware schema for reusable proxy middleware definitions.
+
+  Middleware entities are project-scoped building blocks (rate limiting, CORS,
+  compression, etc.) that can be attached to services in an ordered chain via
+  ServiceMiddleware join records.
+  """
+  use Ecto.Schema
+  import Ecto.Changeset
+
+  @primary_key {:id, :binary_id, autogenerate: true}
+  @foreign_key_type :binary_id
+
+  @middleware_types ~w(rate_limit cache cors compression headers access_control security path_rewrite request_transform response_transform auth custom)
+
+  schema "middlewares" do
+    field :name, :string
+    field :slug, :string
+    field :description, :string
+    field :middleware_type, :string
+    field :config, :map, default: %{}
+    field :enabled, :boolean, default: true
+
+    belongs_to :project, SentinelCp.Projects.Project
+    has_many :service_middlewares, SentinelCp.Services.ServiceMiddleware
+
+    timestamps(type: :utc_datetime)
+  end
+
+  def middleware_types, do: @middleware_types
+
+  def create_changeset(middleware, attrs) do
+    middleware
+    |> cast(attrs, [:name, :description, :middleware_type, :config, :enabled, :project_id])
+    |> validate_required([:name, :middleware_type, :project_id])
+    |> validate_length(:name, min: 1, max: 100)
+    |> validate_inclusion(:middleware_type, @middleware_types)
+    |> generate_slug()
+    |> validate_slug()
+    |> unique_constraint([:project_id, :slug], error_key: :slug)
+    |> foreign_key_constraint(:project_id)
+  end
+
+  def update_changeset(middleware, attrs) do
+    middleware
+    |> cast(attrs, [:name, :description, :config, :enabled])
+    |> validate_required([:name])
+    |> validate_length(:name, min: 1, max: 100)
+  end
+
+  defp generate_slug(changeset) do
+    case get_change(changeset, :name) do
+      nil ->
+        changeset
+
+      name ->
+        slug =
+          name
+          |> String.downcase()
+          |> String.replace(~r/[^a-z0-9]+/, "-")
+          |> String.replace(~r/^-+|-+$/, "")
+          |> String.slice(0, 50)
+
+        put_change(changeset, :slug, slug)
+    end
+  end
+
+  defp validate_slug(changeset) do
+    changeset
+    |> validate_required([:slug])
+    |> validate_format(:slug, ~r/^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/,
+      message: "must contain only lowercase letters, numbers, and hyphens"
+    )
+    |> validate_length(:slug, min: 1, max: 50)
+  end
+end

lib/sentinel_cp/services/service.ex

@@ -42,6 +42,8 @@ defmodule SentinelCp.Services.Service do
     belongs_to :auth_policy, SentinelCp.Services.AuthPolicy
     belongs_to :openapi_spec, SentinelCp.Services.OpenApiSpec
 
+    has_many :service_middlewares, SentinelCp.Services.ServiceMiddleware
+
     field :openapi_path, :string
 
     timestamps(type: :utc_datetime)