feat(security): recovery alerts, gate-block sharing, rolling-window burst and admin breakdown for CrowdSec

src/lib/crowdsec-report.test.ts

@@ -323,6 +323,43 @@ describe("crowdsec-report", () => {
 		expect(state.sendAlert).not.toHaveBeenCalled();
 	});
 
+	it("raises an info alert the first time the channel heals after failures", async () => {
+		fetchMock.mockImplementation((url: string) => {
+			const path = String(url).replace(CAPI, "");
+			if (path === "/watchers/login") {
+				return Promise.resolve(
+					jsonResponse({
+						token: "jwt-xyz",
+						expire: new Date(Date.now() + 3_600_000).toISOString(),
+					}),
+				);
+			}
+			if (path === "/signals") {
+				return Promise.resolve(jsonResponse({ message: "boom" }, 500));
+			}
+			return Promise.resolve(jsonResponse({}));
+		});
+
+		await reportCrowdsecSignal(signalInput("198.51.100.40"));
+		await tick();
+		expect(state.sendAlert).toHaveBeenCalledTimes(1);
+		expect((await getLastCrowdsecReport())?.ok).toBe(false);
+
+		// Channel heals: the first success after a failure is worth a notice.
+		routeCapi();
+		await reportCrowdsecSignal(signalInput("198.51.100.41"));
+		await tick();
+		const last: CrowdsecReportStatus | null = await getLastCrowdsecReport();
+		expect(last?.ok).toBe(true);
+
+		expect(state.sendAlert).toHaveBeenCalledTimes(2);
+		const alerts = state.sendAlert.mock.calls.map(([input]) => input);
+		expect(alerts[0].severity).toBe("warning");
+		expect(alerts[1].severity).toBe("info");
+		expect(alerts[1].message).toContain("recovered");
+		expect(alerts[1].context).toMatchObject({ ip: "198.51.100.41" });
+	});
+
 	it("verifies the watcher channel end to end", async () => {
 		routeCapi();
 		const status = await verifyCrowdsecReporting();

src/lib/crowdsec-report.ts

@@ -348,7 +348,9 @@ async function pushSignal(input: {
 			body: [
 				{
 					machine_id: input.credentials.machineId,
-					message: "atomcms-next anti-DDoS gate blocked a community-flagged IP",
+					message: input.verdict.reputation
+						? "atomcms-next anti-DDoS gate blocked a community-flagged IP"
+						: "atomcms-next anti-DDoS gate blocked a repeat rate-limit offender",
 					scenario: SCENARIO,
 					scenario_version: SCENARIO_VERSION,
 					scenario_hash: scenarioHash(),
@@ -390,9 +392,21 @@ async function pushSignal(input: {
 				`signal push rejected (HTTP ${response.status}): ${await errorDetail(response)}`,
 			);
 		}
+		// Was the channel down before this? A first success after failures
+		// deserves a recovery notice (separate cooldown key from the failure).
+		const before = await getLastCrowdsecReport();
 		const status: CrowdsecReportStatus = { ok: true, at: Date.now() };
 		await setLastCrowdsecReport(status);
 		void bumpCrowdsecStat("reports");
+		if (before && !before.ok) {
+			void raiseCrowdsecAlert("report-recovered", {
+				type: "ddos",
+				severity: "info",
+				message:
+					"CrowdSec signal push recovered — detections are reaching the community again.",
+				context: { ip: input.ip },
+			});
+		}
 		logger.info("[crowdsec-report] Detection shared with the community", {
 			ip: input.ip,
 			category: input.category,

src/lib/ddos-guard-crowdsec.test.ts

@@ -6,7 +6,16 @@ import { enforceDdosRateLimit } from "@/lib/ddos-guard";
 
 // The gate's block escalation (and thus the CrowdSec hook) only runs when
 // Redis is reachable, so the integration test drives a small in-memory fake.
-const state = vi.hoisted(() => ({ map: new Map<string, string>() }));
+const state = vi.hoisted(() => ({
+	map: new Map<string, string>(),
+	z: new Map<string, Array<[number, string]>>(),
+	sendAlert: vi.fn(),
+}));
+
+vi.mock("@/lib/services/alert", () => ({
+	sendAlert: state.sendAlert,
+	ddosDetected: vi.fn(),
+}));
 
 vi.mock("@/lib/redis", () => ({
 	redis: {
@@ -31,8 +40,24 @@ vi.mock("@/lib/redis", () => ({
 			state.map.set(key, String(next));
 			return next;
 		},
+		expire: async () => 1,
 		pexpire: async () => 1,
 		pttl: async () => 60_000,
+		zadd: async (key: string, score: number, member: string) => {
+			const list = state.z.get(key) ?? [];
+			list.push([score, member]);
+			list.sort((a, b) => a[0] - b[0]);
+			state.z.set(key, list);
+			return 1;
+		},
+		zremrangebyscore: async (key: string, min: number, max: number) => {
+			const list = (state.z.get(key) ?? []).filter(
+				([score]) => score < min || score > max,
+			);
+			state.z.set(key, list);
+			return 1;
+		},
+		zcard: async (key: string) => (state.z.get(key) ?? []).length,
 		sadd: async (key: string, member: string) => {
 			const members = new Set(
 				(state.map.get(key) ?? "").split("\u0001").filter(Boolean),
@@ -95,6 +120,8 @@ describe("anti-DDoS automatic CrowdSec blocks", () => {
 		vi.unstubAllGlobals();
 		vi.unstubAllEnvs();
 		state.map.clear();
+		state.z.clear();
+		state.sendAlert.mockReset();
 		resetCrowdsecCache();
 		invalidateAntiddosConfig();
 		fetchMock = vi.fn();

src/lib/ddos-guard.ts

@@ -8,6 +8,11 @@ import { resolveClientIp } from "@/lib/client-ip";
 import { isCloudflareProxied } from "@/lib/cloudflare";
 import { maybeAutoBlockCloudflare } from "@/lib/cloudflare-api";
 import { maybeAutoBlockCrowdsec } from "@/lib/crowdsec-api";
+import { reportCrowdsecSignal } from "@/lib/crowdsec-report";
+import {
+	bumpCrowdsecBreakdownStat,
+	bumpCrowdsecStat,
+} from "@/lib/crowdsec-stats";
 import { classifyDdos, isSuspiciousPath } from "@/lib/ddos";
 import { rateLimit } from "@/lib/rate-limit";
 import { redis } from "@/lib/redis";
@@ -113,6 +118,36 @@ export async function enforceDdosRateLimit(
 			const ttl = blockTtlForViolations(violations, config.blockTiers);
 			if (violations >= config.maxViolations) {
 				await redis.set(blockKey, "1", "EX", ttl);
+				// Share the block in the daily activity histogram + breakdown.
+				void bumpCrowdsecStat("blocks");
+				void bumpCrowdsecBreakdownStat("category", category);
+				// Opt-in: also push our OWN detection (not just CrowdSec-
+				// reputation blocks) into the community blocklist via the same
+				// CAPI channel. Fire-and-forget; deduped per IP internally.
+				void reportCrowdsecSignal({
+					ip,
+					category,
+					ttlSeconds: ttl,
+					verdict: {
+						ip,
+						reputation: null,
+						score: 0,
+						aggressiveness: 0,
+						confidence: null,
+						behaviors: [`gate:${category}`],
+						falsePositive: false,
+						checkedAt: Date.now(),
+					},
+					meta: {
+						source: "gate",
+						category,
+						reputation: null,
+						score: 0,
+						behaviors: [`gate:${category}`],
+						ttlSeconds: ttl,
+						blockedAt: Date.now(),
+					},
+				});
 				// Mirror the host-level block to the Cloudflare edge (IP Access
 				// Rules) so a repeat offender is shed before it reaches the
 				// origin. Only when this request demonstrably transited