Remove the CrowdSec decision feed (closes #315)

sneak ruled to remove it. Gone: the heuristic crowdsec, the ban cause crowdsec and its earlier_bans count, the tag crowdsec, the settings SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY, the decision list fetch and parse in internal/reputation, their tests, and every mention in the README, SPEC.md and docs/. EVALUATION.md keeps its comparison of tools. The ban ledger's internal ban function loses its expires parameter, which only CrowdSec bans used. Model: opus-5-5
2026-11-13 19:08:21 +00:00
1 parent 50c50bfcae
commit 478c3affad
@@ -847,92 +847,6 @@ func TestBlocklistTriesAndCopiesKeptInListsJSONAcrossRestarts(t *testing.T) {
 	}
 }

-func TestCrowdSecDecisionListKeptInListsJSONAcrossARestart(t *testing.T) {
-	t.Parallel()
-
-	const bouncerKey = "crowdsec-key-0123456789abcdef"
-
-	// A stand-in for the engine's local API, which bans 203.0.113.0/24 for
-	// four hours, and answers only a request with its key, while it is up.
-	down := new(atomic.Bool)
-	engine := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			switch {
-			case r.URL.Path != "/v1/decisions" || r.Header.Get("X-Api-Key") != bouncerKey:
-				w.WriteHeader(http.StatusForbidden)
-			case down.Load():
-				w.WriteHeader(http.StatusServiceUnavailable)
-			default:
-				_, _ = io.WriteString(
-					w,
-					`[{"duration": "4h0m0s", "origin": "crowdsec", `+
-						`"scenario": "crowdsecurity/http-probing", "scope": "Range", `+
-						`"type": "ban", "value": "203.0.113.0/24"}]`,
-				)
-			}
-		}))
-	t.Cleanup(engine.Close)
-
-	dir, cache := t.TempDir(), t.TempDir()
-	env := map[string]string{
-		listenAddr:                  localhost + ":0",
-		stateDir:                    dir,
-		cacheDir:                    cache,
-		ruleFilesDir:                t.TempDir(),
-		"SWW_WAF_CROWDSEC_LAPI_URL": engine.URL,
-		"SWW_WAF_CROWDSEC_LAPI_KEY": bouncerKey,
-	}
-
-	// Once the list is fetched, the client's request bans it.
-	first := runUntilStopped(t, env, func(url string) {
-		for statusFrom(t, url, placed) != http.StatusForbidden {
-			time.Sleep(pollInterval)
-		}
-	})
-
-	ban := onlyBan(t, dir)
-	if ban["netblock"] != placed+"/32" || ban["cause"] != "crowdsec" ||
-		ban["reason"] != "CrowdSec's decision for crowdsecurity/http-probing" {
-		t.Errorf(
-			"bans.json holds %v, want the ban for crowdsec on %s",
-			ban,
-			placed,
-		)
-	}
-
-	// Restarted with the engine down, the copy kept in lists.json bans
-	// another client in the netblock from its first request.
-	down.Store(true)
-
-	second := runUntilStopped(t, env, func(url string) {
-		wantStatus(t, url, "203.0.113.10", http.StatusForbidden)
-	})
-
-	// The key is in neither run's output, nor in a state or cache file.
-	files := []string{
-		filepath.Join(dir, "bans.json"), filepath.Join(dir, "clients.json"),
-		filepath.Join(cache, "lists.json"),
-	}
-	shown := make([]string, 0, len(files)+2)
-	shown = append(shown, first.text(), second.text())
-
-	for _, path := range files {
-		data, err := os.ReadFile(path) //nolint:gosec // the test's
-		if err != nil {
-			t.Fatalf("read %s: %v", path, err)
-		}
-
-		shown = append(shown, string(data))
-	}
-
-	if all := strings.Join(shown, "\n"); strings.Contains(all, bouncerKey) {
-		t.Errorf(
-			"the key is shown in the output or the state and cache files:\n%s",
-			all,
-		)
-	}
-}
-
 // wantDeniedByList checks that the request log line is of a request the
 // blocklist at listURL refused.
 func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {