fix: security hardening, reliability improvements, and notification UI polish

- Add plugin ownership checks to prevent cross-project deletion (index + version)
- Remove internal storage_key from plugin version API response
- Check channel.enabled at delivery time, skip disabled channels
- Add HTTP timeouts (receive: 15s, pool: 5s) to all notification adapters
- Extract shared helpers module for 11 notification LiveViews (~370 lines removed)
- Add missing channel links in rules list, rule show, and delivery list
- Disable rule creation submit when no channels exist with link to create one
- Expand resource_badge to cover 13 additional resource types
- Add data-confirm to WAF anomaly resolve/false-positive and portal key revoke
- Add Analytics sidebar link

Author: raffaelschneider

lib/sentinel_cp/events/adapters/pagerduty.ex

@@ -27,7 +27,12 @@ defmodule SentinelCp.Events.Adapters.PagerDuty do
   def deliver(routing_key, payload) do
     body = Jason.encode!(payload)
 
-    case Req.post(@events_url, body: body, headers: [{"content-type", "application/json"}]) do
+    case Req.post(@events_url,
+           body: body,
+           headers: [{"content-type", "application/json"}],
+           receive_timeout: 15_000,
+           pool_timeout: 5_000
+         ) do
       {:ok, %{status: 202}} -> {:ok, 202}
       {:ok, %{status: status, body: body}} -> {:error, {:http_error, status, body}}
       {:error, reason} -> {:error, reason}

lib/sentinel_cp/events/adapters/slack.ex

@@ -35,7 +35,12 @@ defmodule SentinelCp.Events.Adapters.Slack do
   def deliver(webhook_url, payload) do
     body = Jason.encode!(payload)
 
-    case Req.post(webhook_url, body: body, headers: [{"content-type", "application/json"}]) do
+    case Req.post(webhook_url,
+           body: body,
+           headers: [{"content-type", "application/json"}],
+           receive_timeout: 15_000,
+           pool_timeout: 5_000
+         ) do
       {:ok, %{status: status}} when status in 200..299 ->
         {:ok, status}
 

lib/sentinel_cp/events/adapters/teams.ex

@@ -38,7 +38,12 @@ defmodule SentinelCp.Events.Adapters.Teams do
   def deliver(webhook_url, payload) do
     body = Jason.encode!(payload)
 
-    case Req.post(webhook_url, body: body, headers: [{"content-type", "application/json"}]) do
+    case Req.post(webhook_url,
+           body: body,
+           headers: [{"content-type", "application/json"}],
+           receive_timeout: 15_000,
+           pool_timeout: 5_000
+         ) do
       {:ok, %{status: status}} when status in 200..299 -> {:ok, status}
       {:ok, %{status: status, body: body}} -> {:error, {:http_error, status, body}}
       {:error, reason} -> {:error, reason}

lib/sentinel_cp/events/adapters/webhook.ex

@@ -17,7 +17,12 @@ defmodule SentinelCp.Events.Adapters.Webhook do
     body = Jason.encode!(payload)
     headers = build_headers(body, signing_secret)
 
-    case Req.post(url, body: body, headers: headers) do
+    case Req.post(url,
+           body: body,
+           headers: headers,
+           receive_timeout: 15_000,
+           pool_timeout: 5_000
+         ) do
       {:ok, %{status: status}} when status in 200..299 -> {:ok, status}
       {:ok, %{status: status, body: body}} -> {:error, {:http_error, status, body}}
       {:error, reason} -> {:error, reason}

lib/sentinel_cp/events/delivery_worker.ex

@@ -30,11 +30,22 @@ defmodule SentinelCp.Events.DeliveryWorker do
       event = Events.get_event(attempt.event_id)
       channel = attempt.channel
 
-      if event && channel do
-        execute_delivery(attempt, event, channel)
-      else
-        Logger.warning("Delivery attempt #{attempt_id}: missing event or channel")
-        :ok
+      cond do
+        is_nil(event) || is_nil(channel) ->
+          Logger.warning("Delivery attempt #{attempt_id}: missing event or channel")
+          :ok
+
+        not channel.enabled ->
+          Logger.info("Delivery attempt #{attempt_id}: channel disabled, skipping")
+
+          attempt
+          |> Ecto.Changeset.change(%{status: "skipped"})
+          |> Repo.update!()
+
+          :ok
+
+        true ->
+          execute_delivery(attempt, event, channel)
       end
     else
       :ok

lib/sentinel_cp_web/components/core_components.ex

@@ -463,6 +463,19 @@ defmodule SentinelCpWeb.CoreComponents do
         "rollout" -> {"RO", "badge-warning"}
         "project" -> {"PJ", "badge-primary"}
         "org" -> {"OR", "badge-secondary"}
+        "service" -> {"SV", "badge-info"}
+        "certificate" -> {"CT", "badge-success"}
+        "middleware" -> {"MW", "badge-warning"}
+        "plugin" -> {"PL", "badge-primary"}
+        "plugin_version" -> {"PV", "badge-primary"}
+        "environment" -> {"EN", "badge-info"}
+        "upstream" -> {"UP", "badge-secondary"}
+        "policy" -> {"PO", "badge-warning"}
+        "notification_channel" -> {"NC", "badge-info"}
+        "notification_rule" -> {"NR", "badge-secondary"}
+        "waf" -> {"WF", "badge-error"}
+        "api_key" -> {"AK", "badge-warning"}
+        "user" -> {"US", "badge-info"}
         _ -> {"??", "badge-ghost"}
       end
 

lib/sentinel_cp_web/components/layouts.ex

@@ -176,6 +176,13 @@ defmodule SentinelCpWeb.Layouts do
           current={@path}
           match="/waf"
         />
+        <.sidebar_link
+          path={~p"/orgs/#{@org_slug}/projects/#{@project_slug}/analytics"}
+          icon="hero-chart-bar"
+          label="Analytics"
+          current={@path}
+          match="/analytics"
+        />
 
         <div class="sidebar-section-title mt-4">Settings</div>
         <.sidebar_link

lib/sentinel_cp_web/controllers/api/plugin_controller.ex

@@ -391,7 +391,6 @@ defmodule SentinelCpWeb.Api.PluginController do
     %{
       id: version.id,
       version: version.version,
-      storage_key: version.storage_key,
       checksum: version.checksum,
       file_size: version.file_size,
       changelog: version.changelog,

lib/sentinel_cp_web/live/notifications_live/channel_edit.ex

@@ -1,7 +1,9 @@
 defmodule SentinelCpWeb.NotificationsLive.ChannelEdit do
   use SentinelCpWeb, :live_view
 
-  alias SentinelCp.{Audit, Events, Orgs, Projects}
+  import SentinelCpWeb.NotificationsLive.Helpers
+
+  alias SentinelCp.{Audit, Events, Projects}
 
   @impl true
   def mount(%{"project_slug" => slug, "id" => id} = params, _session, socket) do
@@ -50,7 +52,7 @@ defmodule SentinelCpWeb.NotificationsLive.ChannelEdit do
         {:noreply,
          socket
          |> put_flash(:info, "Channel updated.")
-         |> push_navigate(to: show_path(socket.assigns.org, project, updated))}
+         |> push_navigate(to: channel_show_path(socket.assigns.org, project, updated))}
 
       {:error, %Ecto.Changeset{} = changeset} ->
         errors =
@@ -171,7 +173,7 @@ defmodule SentinelCpWeb.NotificationsLive.ChannelEdit do
 
           <div class="flex gap-2 pt-4">
             <button type="submit" class="btn btn-primary btn-sm">Save Changes</button>
-            <.link navigate={show_path(@org, @project, @channel)} class="btn btn-ghost btn-sm">
+            <.link navigate={channel_show_path(@org, @project, @channel)} class="btn btn-ghost btn-sm">
               Cancel
             </.link>
           </div>
@@ -180,28 +182,4 @@ defmodule SentinelCpWeb.NotificationsLive.ChannelEdit do
     </div>
     """
   end
-
-  defp resolve_org(%{"org_slug" => slug}), do: Orgs.get_org_by_slug(slug)
-  defp resolve_org(_), do: nil
-
-  defp build_config("slack", params), do: %{"webhook_url" => params["webhook_url"] || ""}
-  defp build_config("pagerduty", params), do: %{"routing_key" => params["routing_key"] || ""}
-
-  defp build_config("email", params) do
-    config = %{"to" => params["to"] || ""}
-
-    if params["from"] && params["from"] != "",
-      do: Map.put(config, "from", params["from"]),
-      else: config
-  end
-
-  defp build_config("teams", params), do: %{"webhook_url" => params["webhook_url"] || ""}
-  defp build_config("webhook", params), do: %{"url" => params["url"] || ""}
-  defp build_config(_, _), do: %{}
-
-  defp show_path(%{slug: org_slug}, project, channel),
-    do: ~p"/orgs/#{org_slug}/projects/#{project.slug}/notifications/channels/#{channel.id}"
-
-  defp show_path(nil, project, channel),
-    do: ~p"/projects/#{project.slug}/notifications/channels/#{channel.id}"
 end

lib/sentinel_cp_web/live/notifications_live/channel_new.ex

@@ -1,7 +1,9 @@
 defmodule SentinelCpWeb.NotificationsLive.ChannelNew do
   use SentinelCpWeb, :live_view
 
-  alias SentinelCp.{Audit, Events, Orgs, Projects}
+  import SentinelCpWeb.NotificationsLive.Helpers
+
+  alias SentinelCp.{Audit, Events, Projects}
   alias SentinelCp.Events.Channel
 
   @impl true
@@ -56,7 +58,7 @@ defmodule SentinelCpWeb.NotificationsLive.ChannelNew do
         {:noreply,
          socket
          |> put_flash(:info, "Channel created.")
-         |> push_navigate(to: show_path(socket.assigns.org, project, channel))}
+         |> push_navigate(to: channel_show_path(socket.assigns.org, project, channel))}
 
       {:error, %Ecto.Changeset{} = changeset} ->
         errors =
@@ -194,34 +196,4 @@ defmodule SentinelCpWeb.NotificationsLive.ChannelNew do
     </div>
     """
   end
-
-  defp resolve_org(%{"org_slug" => slug}), do: Orgs.get_org_by_slug(slug)
-  defp resolve_org(_), do: nil
-
-  defp build_config("slack", params), do: %{"webhook_url" => params["webhook_url"] || ""}
-  defp build_config("pagerduty", params), do: %{"routing_key" => params["routing_key"] || ""}
-
-  defp build_config("email", params) do
-    config = %{"to" => params["to"] || ""}
-
-    if params["from"] && params["from"] != "",
-      do: Map.put(config, "from", params["from"]),
-      else: config
-  end
-
-  defp build_config("teams", params), do: %{"webhook_url" => params["webhook_url"] || ""}
-  defp build_config("webhook", params), do: %{"url" => params["url"] || ""}
-  defp build_config(_, _), do: %{}
-
-  defp channels_path(%{slug: org_slug}, project),
-    do: ~p"/orgs/#{org_slug}/projects/#{project.slug}/notifications/channels"
-
-  defp channels_path(nil, project),
-    do: ~p"/projects/#{project.slug}/notifications/channels"
-
-  defp show_path(%{slug: org_slug}, project, channel),
-    do: ~p"/orgs/#{org_slug}/projects/#{project.slug}/notifications/channels/#{channel.id}"
-
-  defp show_path(nil, project, channel),
-    do: ~p"/projects/#{project.slug}/notifications/channels/#{channel.id}"
 end