✨ feat: Allow cache reading from replicas (#342)

* feat: Allow cache reading from replicas

* 🍱 fix logic

* ✨ add testing for redis with mock

* 🍱 fix permission

* 📝 test(e2e/redis): fix swapped IP→verdict comments

The mock returns "f" (not banned) for 1.2.3.4 and "t" (banned) for
1.2.3.5, and the run.sh assertions match that. Both doc comments
described the opposite mapping; correct them to match the code.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ✅ test(e2e/redis): exercise read-from-replica path

The redis scenario only set redisCacheHost, so it validated the writer
but never the round-robin reader path this feature adds. Split the mock
into two roles: the primary (--redis-addr) now answers every GET with a
miss, while the replica (--redis-read-addr) serves the hardcoded
verdicts. The scenario points redisCacheReadHosts at the replica (twice,
to drive round-robin), so the banned-IP-blocked assertion only passes if
the plugin actually reads decisions from the replica rather than the
primary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* 📝 docs: note replicas don't fall back to primary on outage

When RedisCacheReadHosts is set, reads are not retried against the
primary if the replicas are unreachable. Document that this, combined
with the default RedisCacheUnreachableBlock=true, means a replica outage
can block traffic while the primary is healthy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* 🐛 fix(cache): avoid nil-pointer panic on empty redis read

redisCache.get fell through to `switch err.Error()` when Get returned a
nil error with an empty value, panicking on the nil error. simpleredis
never returns that combination today (a miss yields RedisMiss), so it
was unreachable in practice — but the read path is safer treating an
empty, error-free read as a cache miss, which also guarantees err is
non-nil before err.Error() is called.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* 🍱 add test for rotation

* 🐛 readd redis/run.sh

* 🐛 fix redis/run.sh

* 🐛 fix test label; remove log

* 🍱 add tests for roundRobin

* 🐛 fix test

---------

Co-authored-by: maxlerebourg <maxlerebourg@gmail.com>
Co-authored-by: mhx <mathieu@hanotaux.fr>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/e2e/mock/mocklapi/main.go

@@ -2,7 +2,8 @@
 // suite. It answers only the few LAPI routes the plugin calls — live/none
 // decision lookups, the stream poll and the usage-metrics push — and lets the
 // test drive decisions through /admin instead of `cscli`. It also serves the
-// stub upstream that Traefik proxies allowed requests to.
+// stub upstream that Traefik proxies allowed requests to, and a hardcoded Redis
+// stand-in for exercising the redis cache path.
 //
 // It is NOT a Crowdsec/AppSec conformance harness — the real WAF engine (OWASP
 // CRS, virtual patching) is out of scope. The AppSec endpoint here emulates a
@@ -11,10 +12,12 @@
 package main
 
 import (
+	"bufio"
 	"encoding/json"
 	"flag"
 	"io"
 	"log"
+	"net"
 	"net/http"
 	"strings"
 	"sync"
@@ -46,6 +49,50 @@ func list(m map[string]Decision) []Decision {
 	return out
 }
 
+// --- Redis mock (inline-command wire format, as spoken by simpleredis) ---
+
+// serveRedis is a hardcoded stand-in. When verdicts is true it plays a replica
+// that holds decisions: every line is scanned for known IPs, 1.2.3.4 → "f"
+// (clean), 1.2.3.5 → "t" (banned); any other GET is a miss ($-1). When verdicts
+// is false it plays the primary and answers every GET with a miss, so a
+// scenario can prove reads are served from the replica and not the primary.
+// SET, DEL, AUTH, SELECT get +OK (they don't read the response anyway).
+func serveRedis(addr string, verdicts bool) {
+	ln, err := net.Listen("tcp", addr)
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer ln.Close()
+
+	for {
+		conn, err := ln.Accept()
+		if err != nil {
+			continue
+		}
+		go func(conn net.Conn) {
+			defer conn.Close()
+			rd := bufio.NewReader(conn)
+			for {
+				line, _, err := rd.ReadLine()
+				if err != nil {
+					return
+				}
+				s := string(line)
+				switch {
+				case verdicts && strings.Contains(s, "1.2.3.4"):
+					conn.Write([]byte("$1\r\nf\r\n"))
+				case verdicts && strings.Contains(s, "1.2.3.5"):
+					conn.Write([]byte("$1\r\nt\r\n"))
+				case strings.HasPrefix(strings.ToUpper(s), "GET "):
+					conn.Write([]byte("$-1\r\n"))
+				default:
+					conn.Write([]byte("+OK\r\n"))
+				}
+			}
+		}(conn)
+	}
+}
+
 func main() {
 	lapiAddr := flag.String("lapi-addr", "127.0.0.1:8090", "address for the LAPI mock")
 	// The stub upstream Traefik proxies allowed requests to — the binary-suite
@@ -53,6 +100,12 @@ func main() {
 	backendAddr := flag.String("backend-addr", "127.0.0.1:8091", "address for the stub upstream service")
 	// AppSec WAF stand-in (the real engine listens on :7422). Not a CRS engine.
 	appsecAddr := flag.String("appsec-addr", "127.0.0.1:8092", "address for the AppSec mock")
+	// Redis stand-ins on plain TCP ports, enough to exercise the plugin's redis
+	// cache path. The primary answers every GET with a miss; the replica serves
+	// the hardcoded verdicts, so a scenario pointing redisCacheReadHosts at the
+	// replica proves reads are offloaded to replicas.
+	redisAddr := flag.String("redis-addr", "127.0.0.1:8093", "address for the Redis primary mock (writes; GET always misses)")
+	redisReadAddr := flag.String("redis-read-addr", "127.0.0.1:8094", "address for the Redis replica mock (serves cached verdicts)")
 	// Optional TLS for the LAPI: when both are set the LAPI is served over HTTPS
 	// (cert signed by the scenario's throwaway CA) so the suite can exercise the
 	// bouncer's system-trust-store path. Backend and AppSec stay plaintext.
@@ -96,6 +149,9 @@ func main() {
 		})))
 	}()
 
+	go serveRedis(*redisAddr, false)
+	go serveRedis(*redisReadAddr, true)
+
 	mux := http.NewServeMux()
 
 	// Readiness probe for the test harness (empty body, 200).
@@ -154,9 +210,9 @@ func main() {
 	})
 
 	if *lapiTLSCert != "" && *lapiTLSKey != "" {
-		log.Printf("mocklapi: LAPI on %s (TLS), backend on %s, appsec on %s", *lapiAddr, *backendAddr, *appsecAddr)
+		log.Printf("mocklapi: LAPI on %s (TLS), backend on %s, appsec on %s, redis on %s (read %s)", *lapiAddr, *backendAddr, *appsecAddr, *redisAddr, *redisReadAddr)
 		log.Fatal(http.ListenAndServeTLS(*lapiAddr, *lapiTLSCert, *lapiTLSKey, mux))
 	}
-	log.Printf("mocklapi: LAPI on %s, backend on %s, appsec on %s", *lapiAddr, *backendAddr, *appsecAddr)
+	log.Printf("mocklapi: LAPI on %s, backend on %s, appsec on %s, redis on %s (read %s)", *lapiAddr, *backendAddr, *appsecAddr, *redisAddr, *redisReadAddr)
 	log.Fatal(http.ListenAndServe(*lapiAddr, mux))
 }