feat(security): recovery alerts, gate-block sharing, rolling-window burst and admin breakdown for CrowdSec

src/lib/crowdsec-report.ts

@@ -348,7 +348,9 @@ async function pushSignal(input: {
 			body: [
 				{
 					machine_id: input.credentials.machineId,
-					message: "atomcms-next anti-DDoS gate blocked a community-flagged IP",
+					message: input.verdict.reputation
+						? "atomcms-next anti-DDoS gate blocked a community-flagged IP"
+						: "atomcms-next anti-DDoS gate blocked a repeat rate-limit offender",
 					scenario: SCENARIO,
 					scenario_version: SCENARIO_VERSION,
 					scenario_hash: scenarioHash(),
@@ -390,9 +392,21 @@ async function pushSignal(input: {
 				`signal push rejected (HTTP ${response.status}): ${await errorDetail(response)}`,
 			);
 		}
+		// Was the channel down before this? A first success after failures
+		// deserves a recovery notice (separate cooldown key from the failure).
+		const before = await getLastCrowdsecReport();
 		const status: CrowdsecReportStatus = { ok: true, at: Date.now() };
 		await setLastCrowdsecReport(status);
 		void bumpCrowdsecStat("reports");
+		if (before && !before.ok) {
+			void raiseCrowdsecAlert("report-recovered", {
+				type: "ddos",
+				severity: "info",
+				message:
+					"CrowdSec signal push recovered — detections are reaching the community again.",
+				context: { ip: input.ip },
+			});
+		}
 		logger.info("[crowdsec-report] Detection shared with the community", {
 			ip: input.ip,
 			category: input.category,