feat: Configurable detection thresholds

[nfebe]

No description provided.

[sourceant]

Code Review Summary

✨ This pull request significantly enhances the security module by introducing an internal API token for secure communication between Nginx and the agent, and by adding more granular security detection thresholds. These changes improve both the security posture and the configurability of the agent's defense mechanisms.

🚀 Key Improvements

• Introduction of InternalAPIToken in SecurityConfig for authenticated internal Nginx-Agent communication for blocked IP lists.
• Nginx Lua scripts (templates/infra/nginx/lua/security.lua) now correctly use the InternalAPIToken when fetching blocked IPs from the agent's internal API.
• Added extensive detection thresholds (DetectionWindow, NotFoundThreshold, AuthFailureThreshold, UniquePathsThreshold, RepeatedHitsThreshold) to the security configuration, allowing for more fine-tuned anomaly detection.
• The updateSecuritySettings API endpoint in internal/api/security_handlers.go has been extended to support runtime configuration of these new security thresholds.

💡 Minor Suggestions

• Consider using pointer types (e.g., *int, *string) for all optional fields in the updateSecuritySettings request struct to ensure consistent handling of partial updates and distinguish between zero values and omitted fields.

[sourceant]

Review complete. No specific code suggestions were generated. See the overview comment for a summary.

[sourceant]

Review complete. See the overview comment for a summary.

[sourceant]

Consistent with previous duration parsing suggestions, explicitly handle errors for DetectionWindow to provide clear feedback to the API consumer.

Suggested change

	if req.DetectionWindow != "" {
	if d, err := time.ParseDuration(req.DetectionWindow); err == nil {
	s.config.Security.DetectionWindow = d
	updatedFields = append(updatedFields, "detection_window")
	}
	if req.DetectionWindow != "" {
	d, err := time.ParseDuration(req.DetectionWindow)
	if err != nil {
	c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid detection_window duration format"})
	return
	}
	s.config.Security.DetectionWindow = d
	updatedFields = append(updatedFields, "detection_window")
	}

[sourceant]

Review complete. See the overview comment for a summary.

[sourceant]

The SetDetectorThresholds call here correctly initializes the security manager on startup. However, the exact same call is also made in updateSecuritySettings. While not strictly an error, it's slightly redundant. Consider if the initial setup should just apply default values (or values from the config file at startup) and the API handler should be the sole source of runtime updates. If the manager is re-initialized or config reloaded without an API call, this is necessary. Current approach is defensive.

Suggested change

	securityManager.SetDetectorThresholds(
	cfg.Security.RateThreshold,
	cfg.Security.NotFoundThreshold,
	cfg.Security.AuthFailureThreshold,
	cfg.Security.UniquePathsThreshold,
	cfg.Security.RepeatedHitsThreshold,
	cfg.Security.DetectionWindow,
	)
	// Thresholds are applied dynamically via updateSecuritySettings, ensuring consistency.
	// Initial values are sourced directly from config.Security.