Feat: Rule suppression

[mclueppers]

No description provided.

[Copilot]

Pull request overview

Adds a rule-suppression feature end-to-end (OpenResty runtime + Redis sync + Admin API + Admin UI), letting operators mark specific detection flags as “not counting” for a given scope without disabling an entire endpoint/vhost.

Changes:

• Implements suppression storage/sync (Redis hash → shared dict) and applies suppressions during defense-node execution.
• Adds admin API endpoints + RBAC permissions for managing suppressions, with UI pages and Shadow Mode shortcuts.
• Adds CI guard to detect drift between image nginx.conf and Helm chart’s embedded copy (env + lua_shared_dict).

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
scripts/check-helm-drift.py	New CI script to compare env/shared-dict declarations between image and Helm chart config.
openresty/spec/suppressions_spec.lua	Unit specs covering matching, scoping, and application semantics.
openresty/lua/suppressions.lua	Suppression matching/scoping logic and application to defense-node results.
openresty/lua/redis_sync.lua	Synces suppression data from Redis into a dedicated shared dict cache.
openresty/lua/rbac.lua	Adds suppressions permissions and routes to the RBAC map.
openresty/lua/defense_profile_executor.lua	Hooks suppression application into the defense-node execution path.
openresty/lua/api_handlers/suppressions.lua	New API handler for listing/creating/deleting suppressions.
openresty/lua/admin_api.lua	Registers suppressions handler and routes DELETE /suppressions/{id}.
openresty/conf/nginx.conf	Adds lua_shared_dict suppression_cache to the image config.
helm/forms-waf/templates/openresty-configmap.yaml	Syncs env + shared dict declarations in the chart’s nginx.conf copy.
docs/openapi.yaml	Documents suppression schema and /suppressions endpoints.
docs/API_HANDLERS.md	Adds handler documentation and RBAC resource/action list for suppressions.
admin-ui/src/pages/shadow/ShadowMode.tsx	Adds “Suppress” shortcut from Shadow Mode counts.
admin-ui/src/pages/security/Suppressions.tsx	New UI for creating/listing/removing suppressions.
admin-ui/src/components/layout/Sidebar.tsx	Adds Suppressions entry under Security navigation.
admin-ui/src/App.tsx	Adds route for /security/suppressions.
admin-ui/src/api/generated.ts	Generated OpenAPI bindings updated with suppressions types/paths.
admin-ui/src/api/client.ts	Adds suppressionsApi client and related TS types.
.github/workflows/quality.yml	Runs the new Helm/nginx.conf drift check in CI.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.

Suppressed comments (5)

openresty/lua/api_handlers/suppressions.lua:121

• POST /suppressions only checks that scope_id is non-empty for vhost/endpoint scopes; a typo yields a suppression that never applies, which is hard to diagnose (and contradicts RBAC’s comment that scope is enforced on creation). Consider validating that the referenced vhost/endpoint config exists before accepting the suppression.

    local red, conn_err = utils.get_redis()
    if not red then
        return utils.error_response("Redis connection failed: " .. (conn_err or "unknown"))
    end

    local existing = read_all(red)

openresty/lua/api_handlers/suppressions.lua:45

• read_all() accepts any JSON value from Redis; if a stored suppression value decodes to a non-table, later code assumes fields like .id/.created_at exist and may error. Only include decoded entries that are JSON objects (Lua tables).

This issue also appears on line 116 of the same file.

        for i = 1, #raw, 2 do
            local decoded = cjson.decode(raw[i + 1])
            if decoded then
                decoded.id = decoded.id or raw[i]
                out[#out + 1] = decoded
            end
        end

openresty/lua/suppressions.lua:109

• active_patterns() assumes every entry from get_all() is a table; if the cache contains any non-table values (e.g. corrupted Redis data making it into the list), indexing entry.flag will raise and can break request handling. Add a type guard before reading fields.

    for _, entry in ipairs(_M.get_all()) do
        if entry.flag and applies_to_scope(entry, vhost_id, endpoint_id) then
            patterns[#patterns + 1] = entry.flag
        end

openresty/lua/redis_sync.lua:312

• sync_suppressions() appends any JSON value returned by cjson.decode(); if a hash field contains non-object JSON (string/number/bool), the suppressions list will contain non-tables and later code (suppressions.active_patterns) will error when it indexes entry.flag. Filter decoded values to tables only.

        for i = 1, #entries, 2 do
            local decoded = cjson.decode(entries[i + 1])
            if decoded then
                decoded.id = decoded.id or entries[i]
                list[#list + 1] = decoded
            end
        end

admin-ui/src/pages/security/Suppressions.tsx:52

• scopeType is initialised by casting the query param to SuppressionScope; if someone lands on /security/suppressions?scope_type=foo (or a stale link), the state becomes an invalid value that won’t match the Select options and can break form logic. Guard the query param against the allowed literals before using it.

  const [scopeType, setScopeType] = useState<SuppressionScope>(
    (searchParams.get('scope_type') as SuppressionScope | null) ?? 'vhost'
  )
  const [scopeId, setScopeId] = useState(searchParams.get('scope_id') ?? '')