[management, proxy] Add prompt-cache token and cost accounting to agent network usage (#6900)

Co-authored-by: braginini <bangvalo@gmail.com>

.github/workflows/agent-network-e2e.yml

@@ -5,6 +5,13 @@ on:
   schedule:
     - cron: "0 3 * * *"
   workflow_dispatch:
+    inputs:
+      bedrock_model:
+        description: >-
+          Bedrock inference-profile id to drive the matrix with, exactly as
+          AWS issues it. Leave empty for the Sonnet 4.6 default.
+        required: false
+        default: ""
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -62,6 +69,8 @@ jobs:
           CLOUDFLARE_TOKEN: ${{ secrets.E2E_CLOUDFLARE_TOKEN }}
           AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.E2E_AWS_BEARER_TOKEN_BEDROCK }}
           AWS_REGION: ${{ secrets.E2E_AWS_REGION }}
+          # Bedrock model override: dispatch input wins, then the repo variable, else the test default.
+          AWS_BEDROCK_MODEL: ${{ inputs.bedrock_model || vars.E2E_AWS_BEDROCK_MODEL }}
           # Vertex (Anthropic-on-Vertex): SA + project required; region defaults
           # to "global", model to a pinned claude snapshot.
           GOOGLE_VERTEX_SA_BASE64: ${{ secrets.E2E_GOOGLE_VERTEX_SA_BASE64 }}

e2e/agentnetwork/chat_test.go

@@ -9,12 +9,220 @@ import (
 	"testing"
 	"time"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
 
 	"github.com/netbirdio/netbird/e2e/harness"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
+// per1k is a model's published USD rates per 1k tokens. read is the prompt-cache read rate
+// (OpenAI: the cached-input discount rate); write is the cache-creation rate where one exists.
+type per1k struct{ in, out, read, write float64 }
+
+// publishedPer1k hardcodes the vendors' PUBLISHED rates for the models the live matrix can drive,
+// keyed by the normalized model id the proxy stamps. Deliberately independent of the proxy's
+// pricing table so a wrong embedded rate or a broken normalization fails the run.
+var publishedPer1k = map[string]per1k{
+	"gpt-4o-mini":                 {0.00015, 0.0006, 0.000075, 0},
+	"gpt-4o":                      {0.0025, 0.01, 0.00125, 0},
+	"claude-haiku-4-5":            {0.001, 0.005, 0.0001, 0.00125},
+	"claude-sonnet-4-5":           {0.003, 0.015, 0.0003, 0.00375},
+	"claude-sonnet-4-6":           {0.003, 0.015, 0.0003, 0.00375},
+	"kimi-k3":                     {0.003, 0.015, 0.0003, 0.003}, // no published write rate: bills at the input rate
+	"anthropic.claude-haiku-4-5":  {0.001, 0.005, 0.0001, 0.00125},
+	"anthropic.claude-sonnet-4-5": {0.003, 0.015, 0.0003, 0.00375},
+	"anthropic.claude-sonnet-4-6": {0.003, 0.015, 0.0003, 0.00375},
+}
+
+// rawCostVerificationSQL is the operator-facing double-check, run straight against the management
+// sqlite store: recompute each usage row's expected total and cache cost from its own persisted
+// token buckets and hardcoded published rates. OpenAI counts cached tokens as a subset of input;
+// Anthropic-shape providers count cache buckets additively.
+const rawCostVerificationSQL = `
+WITH rates(model, in_rate, out_rate, read_rate, write_rate) AS (
+  VALUES
+    ('gpt-4o-mini',                 0.00015, 0.0006, 0.000075, 0.0),
+    ('gpt-4o',                      0.0025,  0.01,   0.00125,  0.0),
+    ('claude-haiku-4-5',            0.001,   0.005,  0.0001,   0.00125),
+    ('claude-sonnet-4-5',           0.003,   0.015,  0.0003,   0.00375),
+    ('claude-sonnet-4-6',           0.003,   0.015,  0.0003,   0.00375),
+    ('kimi-k3',                     0.003,   0.015,  0.0003,   0.003),
+    ('anthropic.claude-haiku-4-5',  0.001,   0.005,  0.0001,   0.00125),
+    ('anthropic.claude-sonnet-4-5', 0.003,   0.015,  0.0003,   0.00375),
+    ('anthropic.claude-sonnet-4-6', 0.003,   0.015,  0.0003,   0.00375)
+)
+SELECT
+  u.provider,
+  u.model,
+  u.input_tokens,
+  u.output_tokens,
+  u.cached_input_tokens,
+  u.cache_creation_tokens,
+  u.input_cost_usd,
+  u.cached_input_cost_usd,
+  u.cache_creation_cost_usd,
+  u.output_cost_usd,
+  -- No cost_usd / cache_cost_usd columns are stored: both are derived from the
+  -- four per-bucket columns above, exactly as the API renders them.
+  (u.input_cost_usd + u.cached_input_cost_usd + u.cache_creation_cost_usd + u.output_cost_usd) AS cost_usd,
+  (u.cached_input_cost_usd + u.cache_creation_cost_usd) AS cache_cost_usd,
+  CASE WHEN u.provider = 'openai' THEN
+    (u.input_tokens - MIN(u.cached_input_tokens, u.input_tokens))*r.in_rate/1000.0
+  ELSE
+    u.input_tokens*r.in_rate/1000.0
+  END AS expected_input,
+  CASE WHEN u.provider = 'openai' THEN
+    MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+  ELSE
+    u.cached_input_tokens*r.read_rate/1000.0
+  END AS expected_cached_input,
+  CASE WHEN u.provider = 'openai' THEN
+    0.0
+  ELSE
+    u.cache_creation_tokens*r.write_rate/1000.0
+  END AS expected_cache_creation,
+  u.output_tokens*r.out_rate/1000.0 AS expected_output,
+  CASE WHEN u.provider = 'openai' THEN
+    (u.input_tokens - MIN(u.cached_input_tokens, u.input_tokens))*r.in_rate/1000.0
+      + MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+      + u.output_tokens*r.out_rate/1000.0
+  ELSE
+    u.input_tokens*r.in_rate/1000.0 + u.cached_input_tokens*r.read_rate/1000.0
+      + u.cache_creation_tokens*r.write_rate/1000.0 + u.output_tokens*r.out_rate/1000.0
+  END AS expected_total,
+  CASE WHEN u.provider = 'openai' THEN
+    MIN(u.cached_input_tokens, u.input_tokens)*r.read_rate/1000.0
+  ELSE
+    u.cached_input_tokens*r.read_rate/1000.0 + u.cache_creation_tokens*r.write_rate/1000.0
+  END AS expected_cache
+FROM agent_network_request_usage u
+JOIN rates r ON r.model = u.model
+ORDER BY u.timestamp`
+
+// verifyUsageRowsSQL re-checks every persisted usage row directly in the management sqlite store,
+// bypassing the API path — the same audit an operator can run on a production store.db.
+func verifyUsageRowsSQL(t *testing.T, srv *harness.Combined) {
+	t.Helper()
+
+	dbPath, err := srv.SnapshotStoreDB(t.TempDir())
+	require.NoError(t, err, "snapshot management sqlite store")
+
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
+	require.NoError(t, err, "open store snapshot")
+	sqlDB, err := db.DB()
+	require.NoError(t, err)
+	defer func() { _ = sqlDB.Close() }()
+
+	rows, err := db.Raw(rawCostVerificationSQL).Rows()
+	require.NoError(t, err, "run raw cost verification query")
+	defer func() { _ = rows.Close() }()
+
+	verified := 0
+	for rows.Next() {
+		var provider, model string
+		var inTok, outTok, readTok, writeTok int64
+		var inCost, cachedInCost, cacheCreateCost, outCost, cost, cacheCost float64
+		var wantInput, wantCachedInput, wantCacheCreation, wantOutput, wantTotal, wantCache float64
+		require.NoError(t, rows.Scan(&provider, &model, &inTok, &outTok, &readTok, &writeTok,
+			&inCost, &cachedInCost, &cacheCreateCost, &outCost, &cost, &cacheCost,
+			&wantInput, &wantCachedInput, &wantCacheCreation, &wantOutput, &wantTotal, &wantCache), "scan usage row")
+		t.Logf("[sql] %s/%s: in=%d out=%d cache_read=%d cache_write=%d stored in/cached/create/out=$%.6f/$%.6f/$%.6f/$%.6f total=$%.6f cache=$%.6f expected total=$%.6f cache=$%.6f",
+			provider, model, inTok, outTok, readTok, writeTok,
+			inCost, cachedInCost, cacheCreateCost, outCost, cost, cacheCost, wantTotal, wantCache)
+		assert.InDeltaf(t, wantInput, inCost, 1e-6, "stored input_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCachedInput, cachedInCost, 1e-6, "stored cached_input_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCacheCreation, cacheCreateCost, 1e-6, "stored cache_creation_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantOutput, outCost, 1e-6, "stored output_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantTotal, cost, 1e-6, "derived cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, wantCache, cacheCost, 1e-6, "derived cache_cost_usd for %s/%s must match the published-rate recompute", provider, model)
+		assert.InDeltaf(t, inCost+cachedInCost+cacheCreateCost+outCost, cost, 1e-9,
+			"stored buckets must sum to the derived cost_usd for %s/%s", provider, model)
+		verified++
+	}
+	require.NoError(t, rows.Err(), "iterate usage rows")
+	require.Positive(t, verified, "raw SQL check must cover at least one usage row")
+	t.Logf("[sql] verified %d usage rows in store.db against published rates", verified)
+
+	gwRows, err := db.Raw(`SELECT model,
+	  (input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd) AS cost_usd
+	  FROM agent_network_request_usage WHERE model LIKE '%/%'`).Rows()
+	require.NoError(t, err, "query gateway-prefixed usage rows")
+	defer func() { _ = gwRows.Close() }()
+	for gwRows.Next() {
+		var model string
+		var cost float64
+		require.NoError(t, gwRows.Scan(&model, &cost), "scan gateway usage row")
+		t.Logf("[sql] gateway %s: stored=$%.6f (must be 0 — deliberately unpriced)", model, cost)
+		assert.Zerof(t, cost, "gateway-prefixed model %q must store cost 0, never a guessed rate", model)
+	}
+	require.NoError(t, gwRows.Err(), "iterate gateway usage rows")
+}
+
+// validateAccessLogCost recomputes a live access-log row's expected total and cache cost from the
+// published per-1k rates and the row's persisted token buckets, and asserts both stored values.
+// Gateway-prefixed model ids the proxy deliberately does not price must store cost 0.
+func validateAccessLogCost(t *testing.T, pc providerCase, row api.AgentNetworkAccessLog) {
+	t.Helper()
+	model := catalogModel(pc)
+	provider := ""
+	if row.Provider != nil {
+		provider = *row.Provider
+	}
+	t.Logf("[cost] %s: provider=%s model=%s in=%d out=%d total=%d cache_read=%d cache_write=%d cost=$%.6f cache_cost=$%.6f",
+		pc.name, provider, model, row.InputTokens, row.OutputTokens, row.TotalTokens,
+		row.CachedInputTokens, row.CacheCreationTokens, row.CostUsd, row.CacheCostUsd)
+
+	rates, known := publishedPer1k[model]
+	if !known {
+		if strings.Contains(model, "/") {
+			assert.Zerof(t, row.CostUsd, "gateway-prefixed model %q is not priced so the cost meter must skip (cost 0)", model)
+			return
+		}
+		t.Logf("[cost] %s: no published rate on file for model %q (env-overridden?); skipping cost validation", pc.name, model)
+		return
+	}
+
+	// input_tokens may legitimately be 0: Moonshot/Kimi reports fully cached prompts under the cache
+	// buckets only. Output and total must always be present on a priced row.
+	require.Positive(t, row.OutputTokens, "priced row must carry output tokens")
+	require.Positive(t, row.TotalTokens, "priced row must carry total tokens")
+
+	var wantInput, wantCachedInput, wantCacheCreation float64
+	if provider == "openai" {
+		cached := min(row.CachedInputTokens, row.InputTokens) // cached is a subset of input
+		wantInput = float64(row.InputTokens-cached) / 1000 * rates.in
+		wantCachedInput = float64(cached) / 1000 * rates.read
+		// OpenAI has no cache-write bucket; wantCacheCreation stays 0.
+	} else {
+		// Anthropic / Bedrock shape: cache buckets are additive to input_tokens.
+		wantInput = float64(row.InputTokens) / 1000 * rates.in
+		wantCachedInput = float64(row.CachedInputTokens) / 1000 * rates.read
+		wantCacheCreation = float64(row.CacheCreationTokens) / 1000 * rates.write
+	}
+	wantOutput := float64(row.OutputTokens) / 1000 * rates.out
+	wantCache := wantCachedInput + wantCacheCreation
+	wantTotal := wantInput + wantCache + wantOutput
+
+	t.Logf("[cost] %s: expecting input=$%.6f cached_input=$%.6f cache_creation=$%.6f output=$%.6f total=$%.6f cache=$%.6f from published rates",
+		pc.name, wantInput, wantCachedInput, wantCacheCreation, wantOutput, wantTotal, wantCache)
+	assert.InDeltaf(t, wantInput, row.InputCostUsd, 1e-6, "stored input_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCachedInput, row.CachedInputCostUsd, 1e-6, "stored cached_input_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCacheCreation, row.CacheCreationCostUsd, 1e-6, "stored cache_creation_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantOutput, row.OutputCostUsd, 1e-6, "stored output_cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantTotal, row.CostUsd, 1e-6, "derived cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, wantCache, row.CacheCostUsd, 1e-6, "derived cache_cost_usd for %s (%s)", pc.name, model)
+
+	// The aggregates must be exactly the sum of the stored components, not an
+	// independently-computed figure that could drift from the breakdown.
+	assert.InDeltaf(t, row.InputCostUsd+row.CachedInputCostUsd+row.CacheCreationCostUsd+row.OutputCostUsd,
+		row.CostUsd, 1e-9, "stored buckets must sum to the derived cost_usd for %s (%s)", pc.name, model)
+	assert.InDeltaf(t, row.CachedInputCostUsd+row.CacheCreationCostUsd,
+		row.CacheCostUsd, 1e-9, "stored cache buckets must sum to the derived cache_cost_usd for %s (%s)", pc.name, model)
+}
+
 // providerCase is one entry in the live provider matrix. The same scenario runs
 // for every available provider; availability is keyed off env vars so the suite
 // covers whatever credentials are present (source ~/.llm-keys locally / set the
@@ -116,12 +324,12 @@ func availableProviders() []providerCase {
 		if region == "" {
 			region = "eu-central-1"
 		}
-		// A valid Bedrock inference-profile id (region prefix + date + version),
-		// overridable per account. `global.` profiles can be invoked from any
-		// region; set AWS_BEDROCK_MODEL to match the enabled profile for the token.
+		// A valid Bedrock inference-profile id, overridable per account (AWS_BEDROCK_MODEL, also the
+		// workflow's bedrock_model dispatch input). `global.` profiles work from any region. Defaults to
+		// Sonnet 4.6, whose id convention dropped the -YYYYMMDD-v1:0 suffix that Haiku 4.5 still carries.
 		model := os.Getenv("AWS_BEDROCK_MODEL")
 		if model == "" {
-			model = "global.anthropic.claude-haiku-4-5-20251001-v1:0"
+			model = "global.anthropic.claude-sonnet-4-6"
 		}
 		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: model, kind: harness.WireBedrock})
 	}
@@ -257,6 +465,10 @@ func TestProvidersMatrix(t *testing.T) {
 			// session id and confirm the marker propagated end-to-end.
 			sessionID := "e2e-session-" + pc.name
 
+			// A long-form prompt so completions carry realistic token counts for cost validation;
+			// max_tokens in the harness bodies (2048) lets the full answer through.
+			const matrixPrompt = "explain GitHub workflow in 1000 words"
+
 			// Retry briefly to absorb tunnel/DNS jitter on the first call.
 			var code int
 			var body string
@@ -267,11 +479,11 @@ func TestProvidersMatrix(t *testing.T) {
 				var cerr error
 				switch pc.kind {
 				case harness.WireVertex:
-					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, "Reply with exactly: pong", sessionID)
+					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, matrixPrompt, sessionID)
 				case harness.WireBedrock:
-					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, "Reply with exactly: pong", sessionID)
+					c, b, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, pc.model, matrixPrompt, sessionID)
 				default:
-					c, b, cerr = cl.ChatPrefixed(ctx, settings.Endpoint, proxyIP, pc.pathPrefix, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
+					c, b, cerr = cl.ChatPrefixed(ctx, settings.Endpoint, proxyIP, pc.pathPrefix, pc.kind, pc.model, matrixPrompt, sessionID)
 				}
 				if cerr == nil {
 					code, body = c, b
@@ -290,6 +502,7 @@ func TestProvidersMatrix(t *testing.T) {
 
 			// The session id sent as x-session-id must round-trip into the
 			// access-log row for this provider.
+			var row api.AgentNetworkAccessLog
 			require.Eventually(t, func() bool {
 				logs, lerr := srv.ListAccessLogs(ctx)
 				if lerr != nil {
@@ -297,11 +510,15 @@ func TestProvidersMatrix(t *testing.T) {
 				}
 				for _, r := range logs.Data {
 					if r.SessionId != nil && *r.SessionId == sessionID {
+						row = r
 						return true
 					}
 				}
 				return false
 			}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row for %s", sessionID, pc.name)
+
+			// Stored total and cache cost must match the published rates applied to the row's buckets.
+			validateAccessLogCost(t, pc, row)
 		})
 	}
 
@@ -322,4 +539,7 @@ func TestProvidersMatrix(t *testing.T) {
 		}
 		return false
 	}, 60*time.Second, 3*time.Second, "consumption must be recorded with positive token counts after live traffic")
+
+	// Final raw-SQL audit: bypass the API and re-verify every persisted usage row in the store.
+	verifyUsageRowsSQL(t, srv)
 }

e2e/harness/client.go

@@ -256,7 +256,7 @@ func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefi
 	case WireMessages:
 		path = "/v1/messages"
 		headers = []string{"anthropic-version: 2023-06-01"}
-		body = fmt.Sprintf(`{"model":%q,"max_tokens":64,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+		body = fmt.Sprintf(`{"model":%q,"max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, model, prompt)
 	default:
 		path = "/v1/chat/completions"
 		body = fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":%q}]}`, model, prompt)
@@ -271,7 +271,7 @@ func (cl *Client) ChatPrefixed(ctx context.Context, endpoint, proxyIP, pathPrefi
 // is sent as the universal x-session-id header the proxy records.
 func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region, model, prompt, sessionID string) (int, string, error) {
 	path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s:rawPredict", project, region, model)
-	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
+	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, prompt)
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
@@ -282,7 +282,7 @@ func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region
 // header the proxy records.
 func (cl *Client) Bedrock(ctx context.Context, endpoint, proxyIP, model, prompt, sessionID string) (int, string, error) {
 	path := "/model/" + model + "/invoke"
-	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
+	body := fmt.Sprintf(`{"anthropic_version":"bedrock-2023-05-31","max_tokens":2048,"messages":[{"role":"user","content":%q}]}`, prompt)
 	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
 }
 
@@ -341,7 +341,7 @@ func (cl *Client) Terminate(ctx context.Context) error {
 	return cl.container.Terminate(ctx)
 }
 
-// containerLogs reads up to 256 KiB of a container's logs for diagnostics.
+// containerLogs reads up to 4 MiB of a container's logs for diagnostics — enough for a whole provider-matrix run.
 func containerLogs(ctx context.Context, c testcontainers.Container) string {
 	if c == nil {
 		return ""
@@ -351,6 +351,6 @@ func containerLogs(ctx context.Context, c testcontainers.Container) string {
 		return fmt.Sprintf("<logs error: %v>", err)
 	}
 	defer r.Close()
-	b, _ := io.ReadAll(io.LimitReader(r, 256<<10))
+	b, _ := io.ReadAll(io.LimitReader(r, 4<<20))
 	return string(b)
 }

e2e/harness/combined.go

@@ -221,6 +221,29 @@ func (c *Combined) CreateProxyTokenCLI(ctx context.Context, name string) (string
 	return "", fmt.Errorf("token not found in CLI output: %s", string(out))
 }
 
+// SnapshotStoreDB copies the management sqlite store (with WAL/SHM sidecars) out of the bind-mounted
+// data dir into dstDir and returns the copy's path; reading a copy avoids locking against live writes.
+func (c *Combined) SnapshotStoreDB(dstDir string) (string, error) {
+	src := filepath.Join(c.workDir, "data", "store.db")
+	if _, err := os.Stat(src); err != nil {
+		return "", fmt.Errorf("management store not found at %s: %w", src, err)
+	}
+	dst := filepath.Join(dstDir, "store.db")
+	for _, suffix := range []string{"", "-wal", "-shm"} {
+		data, err := os.ReadFile(src + suffix)
+		if err != nil {
+			if os.IsNotExist(err) && suffix != "" {
+				continue // sidecar only exists in WAL mode
+			}
+			return "", fmt.Errorf("read %s: %w", src+suffix, err)
+		}
+		if err := os.WriteFile(dst+suffix, data, 0o600); err != nil {
+			return "", fmt.Errorf("write %s: %w", dst+suffix, err)
+		}
+	}
+	return dst, nil
+}
+
 // Logs returns the combined server container logs, for diagnostics.
 func (c *Combined) Logs(ctx context.Context) string {
 	return containerLogs(ctx, c.container)

infrastructure_files/getting-started.sh

@@ -228,8 +228,6 @@ read_enable_crowdsec() {
   echo "CrowdSec checks client IPs against a community threat intelligence database" > /dev/stderr
   echo "and blocks known malicious sources before they reach your services." > /dev/stderr
   echo "A local CrowdSec LAPI container will be added to your deployment." > /dev/stderr
-  echo "It also enables the AppSec (WAF) endpoint, so services can inspect HTTP" > /dev/stderr
-  echo "requests for exploits. Both stay off per service until you enable them." > /dev/stderr
   echo -n "Enable CrowdSec? [y/N]: " > /dev/stderr
   read -r CHOICE < /dev/tty
 
@@ -499,8 +497,7 @@ generate_configuration_files() {
         # TCP ServersTransport for PROXY protocol v2 to the proxy backend
         render_traefik_dynamic > traefik-dynamic.yaml
         if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-          mkdir -p crowdsec/acquis.d
-          render_crowdsec_appsec_acquis > crowdsec/acquis.d/appsec.yaml
+          mkdir -p crowdsec
         fi
       fi
       ;;
@@ -534,23 +531,6 @@ generate_configuration_files() {
   return 0
 }
 
-# The AppSec (WAF) listener only exists if an appsec acquisition datasource is
-# configured. One datasource is one listener carrying one merged rule set: the
-# protocol has no rule-set selector, so per-service rule variation would need
-# either a second datasource on another port or pre_eval hooks filtering on
-# req.Host.
-render_crowdsec_appsec_acquis() {
-  cat <<EOF
-source: appsec
-listen_addr: 0.0.0.0:7422
-appsec_configs:
-  - crowdsecurity/appsec-default
-labels:
-  type: appsec
-EOF
-  return 0
-}
-
 start_services_and_show_instructions() {
   # For built-in Traefik, start containers immediately
   # For NPM, start containers first (NPM needs services running to create proxy)
@@ -762,11 +742,7 @@ render_docker_compose_traefik_builtin() {
     restart: unless-stopped
     networks: [netbird]
     environment:
-      # appsec-generic-rules is required alongside appsec-virtual-patching:
-      # the appsec-default config references crowdsecurity/generic-* and
-      # crowdsecurity/experimental-*, which only that collection provides, and
-      # the engine exits at startup if they are missing.
-      COLLECTIONS: crowdsecurity/linux crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
+      COLLECTIONS: crowdsecurity/linux
     volumes:
       - ./crowdsec:/etc/crowdsec
       - crowdsec_db:/var/lib/crowdsec/data
@@ -1031,11 +1007,6 @@ EOF
     cat <<EOF
 NB_PROXY_CROWDSEC_API_URL=http://crowdsec:8080
 NB_PROXY_CROWDSEC_API_KEY=$CROWDSEC_BOUNCER_KEY
-# AppSec (WAF) request inspection. Separate endpoint from the LAPI above and
-# validated with the same bouncer key. Setting it makes the proxy advertise the
-# AppSec capability, which is what lets a service select appsec_mode; nothing is
-# inspected until a service opts in.
-NB_PROXY_CROWDSEC_APPSEC_URL=http://crowdsec:7422/
 EOF
   fi
 

management/internals/modules/agentnetwork/accesslog_ingest.go

@@ -18,21 +18,26 @@ import (
 // contract between the proxy and management; management flattens them into
 // queryable columns. Keep in sync with the proxy side.
 const (
-	metaKeyProvider           = "llm.provider"
-	metaKeyModel              = "llm.model"
-	metaKeyResolvedProviderID = "llm.resolved_provider_id"
-	metaKeySelectedPolicyID   = "llm.selected_policy_id"
-	metaKeyPolicyDecision     = "llm_policy.decision"
-	metaKeyPolicyReason       = "llm_policy.reason"
-	metaKeyInputTokens        = "llm.input_tokens"  //nolint:gosec // metadata key name, not a credential
-	metaKeyOutputTokens       = "llm.output_tokens" //nolint:gosec // metadata key name, not a credential
-	metaKeyTotalTokens        = "llm.total_tokens"  //nolint:gosec // metadata key name, not a credential
-	metaKeyCostUSDTotal       = "cost.usd_total"
-	metaKeyStream             = "llm.stream"
-	metaKeySessionID          = "llm.session_id"
-	metaKeyAuthorisingGroups  = "llm.authorising_groups"
-	metaKeyRequestPrompt      = "llm.request_prompt"
-	metaKeyResponseCompletion = "llm.response_completion"
+	metaKeyProvider            = "llm.provider"
+	metaKeyModel               = "llm.model"
+	metaKeyResolvedProviderID  = "llm.resolved_provider_id"
+	metaKeySelectedPolicyID    = "llm.selected_policy_id"
+	metaKeyPolicyDecision      = "llm_policy.decision"
+	metaKeyPolicyReason        = "llm_policy.reason"
+	metaKeyInputTokens         = "llm.input_tokens"          //nolint:gosec // metadata key name, not a credential
+	metaKeyOutputTokens        = "llm.output_tokens"         //nolint:gosec // metadata key name, not a credential
+	metaKeyTotalTokens         = "llm.total_tokens"          //nolint:gosec // metadata key name, not a credential
+	metaKeyCachedInputTokens   = "llm.cached_input_tokens"   //nolint:gosec // metadata key name, not a credential
+	metaKeyCacheCreationTokens = "llm.cache_creation_tokens" //nolint:gosec // metadata key name, not a credential
+	metaKeyCostUSDInput        = "cost.usd_input"
+	metaKeyCostUSDCachedInput  = "cost.usd_cached_input"
+	metaKeyCostUSDCacheCreate  = "cost.usd_cache_creation"
+	metaKeyCostUSDOutput       = "cost.usd_output"
+	metaKeyStream              = "llm.stream"
+	metaKeySessionID           = "llm.session_id"
+	metaKeyAuthorisingGroups   = "llm.authorising_groups"
+	metaKeyRequestPrompt       = "llm.request_prompt"
+	metaKeyResponseCompletion  = "llm.response_completion"
 )
 
 // IngestAccessLog flattens the metadata-bearing reverse-proxy access-log entry
@@ -108,20 +113,25 @@ func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLo
 		BytesUpload:   e.BytesUpload,
 		BytesDownload: e.BytesDownload,
 
-		Provider:           meta[metaKeyProvider],
-		Model:              meta[metaKeyModel],
-		SessionID:          meta[metaKeySessionID],
-		ResolvedProviderID: meta[metaKeyResolvedProviderID],
-		SelectedPolicyID:   meta[metaKeySelectedPolicyID],
-		Decision:           meta[metaKeyPolicyDecision],
-		DenyReason:         meta[metaKeyPolicyReason],
-		InputTokens:        parseMetaInt(meta, metaKeyInputTokens),
-		OutputTokens:       parseMetaInt(meta, metaKeyOutputTokens),
-		TotalTokens:        parseMetaInt(meta, metaKeyTotalTokens),
-		CostUSD:            parseMetaFloat(meta, metaKeyCostUSDTotal),
-		Stream:             parseMetaBool(meta, metaKeyStream),
-		RequestPrompt:      meta[metaKeyRequestPrompt],
-		ResponseCompletion: meta[metaKeyResponseCompletion],
+		Provider:             meta[metaKeyProvider],
+		Model:                meta[metaKeyModel],
+		SessionID:            meta[metaKeySessionID],
+		ResolvedProviderID:   meta[metaKeyResolvedProviderID],
+		SelectedPolicyID:     meta[metaKeySelectedPolicyID],
+		Decision:             meta[metaKeyPolicyDecision],
+		DenyReason:           meta[metaKeyPolicyReason],
+		InputTokens:          parseMetaInt(meta, metaKeyInputTokens),
+		OutputTokens:         parseMetaInt(meta, metaKeyOutputTokens),
+		TotalTokens:          parseMetaInt(meta, metaKeyTotalTokens),
+		CachedInputTokens:    parseMetaInt(meta, metaKeyCachedInputTokens),
+		CacheCreationTokens:  parseMetaInt(meta, metaKeyCacheCreationTokens),
+		InputCostUSD:         parseMetaFloat(meta, metaKeyCostUSDInput),
+		CachedInputCostUSD:   parseMetaFloat(meta, metaKeyCostUSDCachedInput),
+		CacheCreationCostUSD: parseMetaFloat(meta, metaKeyCostUSDCacheCreate),
+		OutputCostUSD:        parseMetaFloat(meta, metaKeyCostUSDOutput),
+		Stream:               parseMetaBool(meta, metaKeyStream),
+		RequestPrompt:        meta[metaKeyRequestPrompt],
+		ResponseCompletion:   meta[metaKeyResponseCompletion],
 	}
 
 	var groups []types.AgentNetworkAccessLogGroup
@@ -140,18 +150,23 @@ func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLo
 // log's ID so the two correlate.
 func usageFromFlattenedLog(e *types.AgentNetworkAccessLog, groups []types.AgentNetworkAccessLogGroup) (*types.AgentNetworkUsage, []types.AgentNetworkUsageGroup) {
 	usage := &types.AgentNetworkUsage{
-		ID:                 e.ID,
-		AccountID:          e.AccountID,
-		Timestamp:          e.Timestamp,
-		UserID:             e.UserID,
-		ResolvedProviderID: e.ResolvedProviderID,
-		Provider:           e.Provider,
-		Model:              e.Model,
-		SessionID:          e.SessionID,
-		InputTokens:        e.InputTokens,
-		OutputTokens:       e.OutputTokens,
-		TotalTokens:        e.TotalTokens,
-		CostUSD:            e.CostUSD,
+		ID:                   e.ID,
+		AccountID:            e.AccountID,
+		Timestamp:            e.Timestamp,
+		UserID:               e.UserID,
+		ResolvedProviderID:   e.ResolvedProviderID,
+		Provider:             e.Provider,
+		Model:                e.Model,
+		SessionID:            e.SessionID,
+		InputTokens:          e.InputTokens,
+		OutputTokens:         e.OutputTokens,
+		TotalTokens:          e.TotalTokens,
+		CachedInputTokens:    e.CachedInputTokens,
+		CacheCreationTokens:  e.CacheCreationTokens,
+		InputCostUSD:         e.InputCostUSD,
+		CachedInputCostUSD:   e.CachedInputCostUSD,
+		CacheCreationCostUSD: e.CacheCreationCostUSD,
+		OutputCostUSD:        e.OutputCostUSD,
 	}
 
 	usageGroups := make([]types.AgentNetworkUsageGroup, 0, len(groups))

management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go

@@ -28,17 +28,22 @@ func newIngestTestEntry() *accesslogs.AccessLogEntry {
 		UserId:       "user-1",
 		AgentNetwork: true,
 		Metadata: map[string]string{
-			metaKeyProvider:           "openai",
-			metaKeyModel:              "gpt-5.4",
-			metaKeyResolvedProviderID: "prov-1",
-			metaKeySessionID:          "sess-1",
-			metaKeyInputTokens:        "100",
-			metaKeyOutputTokens:       "50",
-			metaKeyTotalTokens:        "150",
-			metaKeyCostUSDTotal:       "0.0123",
-			metaKeyStream:             "true",
-			metaKeyRequestPrompt:      "hello",
-			metaKeyResponseCompletion: "world",
+			metaKeyProvider:            "openai",
+			metaKeyModel:               "gpt-5.4",
+			metaKeyResolvedProviderID:  "prov-1",
+			metaKeySessionID:           "sess-1",
+			metaKeyInputTokens:         "100",
+			metaKeyOutputTokens:        "50",
+			metaKeyTotalTokens:         "1174",
+			metaKeyCachedInputTokens:   "256",
+			metaKeyCacheCreationTokens: "768",
+			metaKeyCostUSDInput:        "0.0071",
+			metaKeyCostUSDCachedInput:  "0.0009",
+			metaKeyCostUSDCacheCreate:  "0.0020",
+			metaKeyCostUSDOutput:       "0.0023",
+			metaKeyStream:              "true",
+			metaKeyRequestPrompt:       "hello",
+			metaKeyResponseCompletion:  "world",
 			// repeated id must be de-duplicated before the group rows insert.
 			metaKeyAuthorisingGroups: "grp-eng,grp-eng,grp-ops",
 		},
@@ -65,7 +70,19 @@ func TestIngestAccessLog_RealStore_LogCollectionOff(t *testing.T) {
 	require.Len(t, usage, 1, "usage row must be written even with log collection off")
 	assert.Equal(t, int64(100), usage[0].InputTokens, "input tokens must round-trip from metadata")
 	assert.Equal(t, int64(50), usage[0].OutputTokens, "output tokens must round-trip from metadata")
-	assert.InDelta(t, 0.0123, usage[0].CostUSD, 1e-9, "cost must round-trip from metadata")
+	assert.Equal(t, int64(256), usage[0].CachedInputTokens, "cache-read tokens must round-trip from metadata")
+	assert.Equal(t, int64(768), usage[0].CacheCreationTokens, "cache-write tokens must round-trip from metadata")
+	// The per-bucket breakdown is the only cost state stored, and must survive
+	// the write/read cycle as real columns — usage rows are the only cost
+	// record for accounts with log collection off, so a dropped column here
+	// loses the split permanently.
+	assert.InDelta(t, 0.0071, usage[0].InputCostUSD, 1e-9, "input cost must round-trip from metadata")
+	assert.InDelta(t, 0.0009, usage[0].CachedInputCostUSD, 1e-9, "cache-read cost must round-trip from metadata")
+	assert.InDelta(t, 0.0020, usage[0].CacheCreationCostUSD, 1e-9, "cache-write cost must round-trip from metadata")
+	assert.InDelta(t, 0.0023, usage[0].OutputCostUSD, 1e-9, "output cost must round-trip from metadata")
+	// Aggregates are derived from the stored columns, never stored themselves.
+	assert.InDelta(t, 0.0123, usage[0].TotalCostUSD(), 1e-9, "total is derived from the stored buckets")
+	assert.InDelta(t, 0.0029, usage[0].CacheCostUSD(), 1e-9, "cache cost is derived from the two cache buckets")
 
 	logs, _, err := s.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
 	require.NoError(t, err)
@@ -96,6 +113,14 @@ func TestIngestAccessLog_RealStore_LogCollectionOn(t *testing.T) {
 	require.Equal(t, int64(1), total, "exactly one access-log row expected")
 	require.Len(t, logs, 1, "full access-log row must be written when log collection is on")
 	assert.Equal(t, "gpt-5.4", logs[0].Model, "model must flatten from metadata")
+	assert.Equal(t, int64(256), logs[0].CachedInputTokens, "cache-read tokens must flatten from metadata")
+	assert.Equal(t, int64(768), logs[0].CacheCreationTokens, "cache-write tokens must flatten from metadata")
+	assert.InDelta(t, 0.0029, logs[0].CacheCostUSD(), 1e-9, "cache cost is derived from the two cache buckets")
+	assert.InDelta(t, 0.0123, logs[0].TotalCostUSD(), 1e-9, "total is derived from the stored buckets")
+	assert.InDelta(t, 0.0071, logs[0].InputCostUSD, 1e-9, "input cost must flatten from metadata")
+	assert.InDelta(t, 0.0009, logs[0].CachedInputCostUSD, 1e-9, "cache-read cost must flatten from metadata")
+	assert.InDelta(t, 0.0020, logs[0].CacheCreationCostUSD, 1e-9, "cache-write cost must flatten from metadata")
+	assert.InDelta(t, 0.0023, logs[0].OutputCostUSD, 1e-9, "output cost must flatten from metadata")
 	assert.Equal(t, "hello", logs[0].RequestPrompt, "prompt must be retained when log collection is on")
 	assert.Equal(t, "world", logs[0].ResponseCompletion, "completion must be retained when log collection is on")
 	assert.True(t, logs[0].Stream, "stream flag must flatten from metadata")

management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go

@@ -38,7 +38,7 @@ func accessLogRow(id, sessionID string, ts time.Time, opts ...func(*types.AgentN
 		InputTokens:        100,
 		OutputTokens:       50,
 		TotalTokens:        150,
-		CostUSD:            0.01,
+		InputCostUSD:       0.01,
 	}
 	for _, o := range opts {
 		o(e)
@@ -74,7 +74,7 @@ func withTokens(in, out, total int64, cost float64) func(*types.AgentNetworkAcce
 		e.InputTokens = in
 		e.OutputTokens = out
 		e.TotalTokens = total
-		e.CostUSD = cost
+		e.InputCostUSD = cost
 	}
 }
 
@@ -155,7 +155,7 @@ func TestAccessLogSessions_FoldAndAggregate(t *testing.T) {
 	assert.Equal(t, int64(310), a.InputTokens, "input tokens summed")
 	assert.Equal(t, int64(135), a.OutputTokens, "output tokens summed")
 	assert.Equal(t, int64(445), a.TotalTokens, "total tokens summed")
-	assert.InDelta(t, 0.031, a.CostUSD, 1e-9, "cost summed")
+	assert.InDelta(t, 0.031, a.TotalCostUSD(), 1e-9, "cost summed")
 	assert.Equal(t, "deny", a.Decision, "any deny makes the session a deny")
 	assert.ElementsMatch(t, []string{"openai", "anthropic"}, a.Providers, "distinct providers")
 	assert.ElementsMatch(t, []string{"gpt-5.4", "claude-haiku-4-5"}, a.Models, "distinct models")

management/internals/modules/agentnetwork/types/accesslog.go

@@ -41,8 +41,24 @@ type AgentNetworkAccessLog struct {
 	InputTokens        int64
 	OutputTokens       int64
 	TotalTokens        int64
-	CostUSD            float64
-	Stream             bool
+	// Prompt-cache buckets: read + write token counts.
+	CachedInputTokens   int64
+	CacheCreationTokens int64
+	// Per-bucket cost breakdown — one column per token bucket the provider
+	// bills separately. These four are the only cost state stored: the total
+	// and the cache portion are derived on read (TotalCostUSD / CacheCostUSD)
+	// rather than stored alongside, so a stored aggregate can never drift out
+	// of step with the components it summarises.
+	//
+	// default:0 matters on upgrade: these columns are ALTER TABLE ADD COLUMN
+	// on an existing table, and without it every historical row holds NULL —
+	// which a raw SUM()/scan into float64 can't read. The default backfills
+	// them as 0, so pre-upgrade rows report an unknown split, not an error.
+	InputCostUSD         float64 `gorm:"not null;default:0"`
+	CachedInputCostUSD   float64 `gorm:"not null;default:0"`
+	CacheCreationCostUSD float64 `gorm:"not null;default:0"`
+	OutputCostUSD        float64 `gorm:"not null;default:0"`
+	Stream               bool
 
 	// Prompt capture. Only populated when prompt collection is enabled
 	// (account master switch AND policy guardrail). Heavy free text.
@@ -60,19 +76,44 @@ type AgentNetworkAccessLog struct {
 // the reverse-proxy AccessLogEntry table.
 func (AgentNetworkAccessLog) TableName() string { return "agent_network_access_log" }
 
+// CostUSDSQLExpr is the SQL sum of the per-bucket cost columns — the total cost
+// of a row. Used wherever a query has to sort or aggregate on total cost now
+// that no cost_usd column is stored. Plain arithmetic over NOT NULL columns, so
+// it stays portable across SQLite and Postgres.
+const CostUSDSQLExpr = "(input_cost_usd + cached_input_cost_usd + cache_creation_cost_usd + output_cost_usd)"
+
+// TotalCostUSD is the request's total cost: the sum of the four per-bucket
+// costs. Derived rather than stored so it cannot disagree with the breakdown.
+func (a *AgentNetworkAccessLog) TotalCostUSD() float64 {
+	return a.InputCostUSD + a.CachedInputCostUSD + a.CacheCreationCostUSD + a.OutputCostUSD
+}
+
+// CacheCostUSD is the portion of the total billed for prompt-cache buckets:
+// cache reads plus cache writes.
+func (a *AgentNetworkAccessLog) CacheCostUSD() float64 {
+	return a.CachedInputCostUSD + a.CacheCreationCostUSD
+}
+
 // ToAPIResponse renders the flattened entry as the API representation.
 func (a *AgentNetworkAccessLog) ToAPIResponse() api.AgentNetworkAccessLog {
 	out := api.AgentNetworkAccessLog{
-		Id:           a.ID,
-		ServiceId:    a.ServiceID,
-		Timestamp:    a.Timestamp,
-		StatusCode:   a.StatusCode,
-		DurationMs:   int(a.Duration.Milliseconds()),
-		InputTokens:  a.InputTokens,
-		OutputTokens: a.OutputTokens,
-		TotalTokens:  a.TotalTokens,
-		CostUsd:      a.CostUSD,
-		Stream:       &a.Stream,
+		Id:                   a.ID,
+		ServiceId:            a.ServiceID,
+		Timestamp:            a.Timestamp,
+		StatusCode:           a.StatusCode,
+		DurationMs:           int(a.Duration.Milliseconds()),
+		InputTokens:          a.InputTokens,
+		OutputTokens:         a.OutputTokens,
+		TotalTokens:          a.TotalTokens,
+		CachedInputTokens:    a.CachedInputTokens,
+		CacheCreationTokens:  a.CacheCreationTokens,
+		InputCostUsd:         a.InputCostUSD,
+		CachedInputCostUsd:   a.CachedInputCostUSD,
+		CacheCreationCostUsd: a.CacheCreationCostUSD,
+		OutputCostUsd:        a.OutputCostUSD,
+		CostUsd:              a.TotalCostUSD(),
+		CacheCostUsd:         a.CacheCostUSD(),
+		Stream:               &a.Stream,
 	}
 
 	out.UserId = strPtr(a.UserID)
@@ -112,20 +153,36 @@ func strPtr(s string) *string {
 // summary plus its ordered entries. Assembled in Go from a page of entries — it
 // is not a stored table.
 type AgentNetworkAccessLogSession struct {
-	SessionID    string // empty for a session-less (singleton) request
-	UserID       string
-	GroupIDs     []string // union of the entries' authorising groups
-	StartedAt    time.Time
-	EndedAt      time.Time
-	RequestCount int
-	InputTokens  int64
-	OutputTokens int64
-	TotalTokens  int64
-	CostUSD      float64
-	Providers    []string // distinct vendors seen in the session
-	Models       []string // distinct models seen in the session
-	Decision     string   // "deny" if any entry was denied, else "allow"
-	Entries      []*AgentNetworkAccessLog
+	SessionID            string // empty for a session-less (singleton) request
+	UserID               string
+	GroupIDs             []string // union of the entries' authorising groups
+	StartedAt            time.Time
+	EndedAt              time.Time
+	RequestCount         int
+	InputTokens          int64
+	OutputTokens         int64
+	TotalTokens          int64
+	CachedInputTokens    int64
+	CacheCreationTokens  int64
+	InputCostUSD         float64
+	CachedInputCostUSD   float64
+	CacheCreationCostUSD float64
+	OutputCostUSD        float64
+	Providers            []string // distinct vendors seen in the session
+	Models               []string // distinct models seen in the session
+	Decision             string   // "deny" if any entry was denied, else "allow"
+	Entries              []*AgentNetworkAccessLog
+}
+
+// TotalCostUSD is the session's total cost: the sum of the four per-bucket
+// costs accumulated across its entries.
+func (sess *AgentNetworkAccessLogSession) TotalCostUSD() float64 {
+	return sess.InputCostUSD + sess.CachedInputCostUSD + sess.CacheCreationCostUSD + sess.OutputCostUSD
+}
+
+// CacheCostUSD is the session's prompt-cache spend: cache reads plus writes.
+func (sess *AgentNetworkAccessLogSession) CacheCostUSD() float64 {
+	return sess.CachedInputCostUSD + sess.CacheCreationCostUSD
 }
 
 // sessionKey is the grouping key for an entry: its session id, or — when the
@@ -205,7 +262,12 @@ func (sess *AgentNetworkAccessLogSession) foldEntry(sk *sessionSeen, e *AgentNet
 	sess.InputTokens += e.InputTokens
 	sess.OutputTokens += e.OutputTokens
 	sess.TotalTokens += e.TotalTokens
-	sess.CostUSD += e.CostUSD
+	sess.CachedInputTokens += e.CachedInputTokens
+	sess.CacheCreationTokens += e.CacheCreationTokens
+	sess.InputCostUSD += e.InputCostUSD
+	sess.CachedInputCostUSD += e.CachedInputCostUSD
+	sess.CacheCreationCostUSD += e.CacheCreationCostUSD
+	sess.OutputCostUSD += e.OutputCostUSD
 	if e.Timestamp.Before(sess.StartedAt) {
 		sess.StartedAt = e.Timestamp
 	}
@@ -248,15 +310,22 @@ func (sess *AgentNetworkAccessLogSession) ToAPIResponse() api.AgentNetworkAccess
 	}
 
 	out := api.AgentNetworkAccessLogSession{
-		StartedAt:    sess.StartedAt,
-		EndedAt:      sess.EndedAt,
-		RequestCount: sess.RequestCount,
-		InputTokens:  sess.InputTokens,
-		OutputTokens: sess.OutputTokens,
-		TotalTokens:  sess.TotalTokens,
-		CostUsd:      sess.CostUSD,
-		Decision:     sess.Decision,
-		Entries:      entries,
+		StartedAt:            sess.StartedAt,
+		EndedAt:              sess.EndedAt,
+		RequestCount:         sess.RequestCount,
+		InputTokens:          sess.InputTokens,
+		OutputTokens:         sess.OutputTokens,
+		TotalTokens:          sess.TotalTokens,
+		CachedInputTokens:    sess.CachedInputTokens,
+		CacheCreationTokens:  sess.CacheCreationTokens,
+		InputCostUsd:         sess.InputCostUSD,
+		CachedInputCostUsd:   sess.CachedInputCostUSD,
+		CacheCreationCostUsd: sess.CacheCreationCostUSD,
+		OutputCostUsd:        sess.OutputCostUSD,
+		CostUsd:              sess.TotalCostUSD(),
+		CacheCostUsd:         sess.CacheCostUSD(),
+		Decision:             sess.Decision,
+		Entries:              entries,
 	}
 	out.SessionId = strPtr(sess.SessionID)
 	out.UserId = strPtr(sess.UserID)

management/internals/modules/agentnetwork/types/accesslogfilter.go

@@ -54,7 +54,7 @@ var accessLogSortFields = map[string]string{
 	"provider":     "provider",
 	"status_code":  "status_code",
 	"duration":     "duration",
-	"cost_usd":     "cost_usd",
+	"cost_usd":     CostUSDSQLExpr,
 	"total_tokens": "total_tokens",
 	"user_id":      "user_id",
 	"decision":     "decision",
@@ -70,7 +70,7 @@ var accessLogSortFields = map[string]string{
 var sessionSortExprs = map[string]string{ //nolint:gosec // G101 false positive: "total_tokens" sort key, not a credential
 	"timestamp":     "MAX(timestamp)",
 	"started_at":    "MIN(timestamp)",
-	"cost_usd":      "SUM(cost_usd)",
+	"cost_usd":      "SUM" + CostUSDSQLExpr,
 	"total_tokens":  "SUM(total_tokens)",
 	"duration":      "SUM(duration)",
 	"request_count": "COUNT(*)",

management/internals/modules/agentnetwork/types/cost_test.go

@@ -0,0 +1,124 @@
+package types
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// costRow builds an access-log entry carrying only a cost breakdown — the rest
+// of the row is irrelevant to the summation identities under test.
+func costRow(id, session string, ts time.Time, in, cachedIn, cacheCreate, out float64) *AgentNetworkAccessLog {
+	return &AgentNetworkAccessLog{
+		ID:                   id,
+		SessionID:            session,
+		Timestamp:            ts,
+		InputCostUSD:         in,
+		CachedInputCostUSD:   cachedIn,
+		CacheCreationCostUSD: cacheCreate,
+		OutputCostUSD:        out,
+	}
+}
+
+// TestAPIResponse_CostComponentsSumToAggregates is the contract a client adding
+// up an API response depends on: within a single rendered object, the four
+// per-bucket fields sum to cost_usd, and the two cache fields sum to
+// cache_cost_usd. Uses rates that are not exactly representable in binary
+// floating point, so the identity is checked against real arithmetic rather
+// than round numbers.
+func TestAPIResponse_CostComponentsSumToAggregates(t *testing.T) {
+	row := costRow("r1", "s1", time.Now(), 0.000768, 0.0002304, 0.00192, 0.003)
+
+	api := row.ToAPIResponse()
+	assert.InDelta(t, api.InputCostUsd+api.CachedInputCostUsd+api.CacheCreationCostUsd+api.OutputCostUsd,
+		api.CostUsd, 1e-12, "rendered buckets must sum to the rendered cost_usd")
+	assert.InDelta(t, api.CachedInputCostUsd+api.CacheCreationCostUsd, api.CacheCostUsd, 1e-12,
+		"rendered cache buckets must sum to the rendered cache_cost_usd")
+	assert.InDelta(t, 0.0059184, api.CostUsd, 1e-12, "total is the exact sum, not a separately rounded figure")
+	assert.InDelta(t, 0.0021504, api.CacheCostUsd, 1e-12, "cache cost is the exact sum of the two cache buckets")
+}
+
+// TestSessionSummary_SumsMatchSummedEntries proves a session summary equals the
+// sum of the entries it renders: a client that adds up the entries itself must
+// land on the same number the summary reports, per bucket and in total.
+func TestSessionSummary_SumsMatchSummedEntries(t *testing.T) {
+	base := time.Date(2026, 5, 5, 10, 0, 0, 0, time.UTC)
+	entries := []*AgentNetworkAccessLog{
+		costRow("r1", "s1", base, 0.000768, 0.0002304, 0.00192, 0.003),
+		costRow("r2", "s1", base.Add(time.Minute), 0.000625, 0.0009375, 0, 0.005),
+		costRow("r3", "s1", base.Add(2*time.Minute), 0.0000016, 0, 0, 0.0000032),
+	}
+
+	sessions := FoldAccessLogSessions([]string{"s1"}, entries)
+	require.Len(t, sessions, 1)
+	sess := sessions[0].ToAPIResponse()
+
+	var wantInput, wantCachedInput, wantCacheCreation, wantOutput float64
+	for _, e := range entries {
+		wantInput += e.InputCostUSD
+		wantCachedInput += e.CachedInputCostUSD
+		wantCacheCreation += e.CacheCreationCostUSD
+		wantOutput += e.OutputCostUSD
+	}
+
+	assert.InDelta(t, wantInput, sess.InputCostUsd, 1e-12, "session input cost is the sum of its entries")
+	assert.InDelta(t, wantCachedInput, sess.CachedInputCostUsd, 1e-12, "session cache-read cost is the sum of its entries")
+	assert.InDelta(t, wantCacheCreation, sess.CacheCreationCostUsd, 1e-12, "session cache-write cost is the sum of its entries")
+	assert.InDelta(t, wantOutput, sess.OutputCostUsd, 1e-12, "session output cost is the sum of its entries")
+	assert.InDelta(t, wantInput+wantCachedInput+wantCacheCreation+wantOutput, sess.CostUsd, 1e-12,
+		"session total equals the summed entry buckets")
+
+	// Summing the rendered entries must give the same answer as reading the
+	// summary — the property a UI relies on when it totals a table itself.
+	var fromEntries float64
+	for _, e := range sess.Entries {
+		fromEntries += e.CostUsd
+	}
+	assert.InDelta(t, sess.CostUsd, fromEntries, 1e-12, "summary total must match the summed rendered entries")
+
+	// The sub-microdollar row must still contribute; it would vanish under
+	// 6-decimal quantisation.
+	assert.Greater(t, sess.InputCostUsd, 0.001393, "small-cost rows must not be quantised away")
+}
+
+// TestUsageBuckets_SumsMatchSummedRows proves the same identity one level up:
+// a usage bucket equals the sum of the ledger rows folded into it, and the
+// buckets together equal the whole range.
+func TestUsageBuckets_SumsMatchSummedRows(t *testing.T) {
+	day1 := time.Date(2026, 5, 5, 9, 0, 0, 0, time.UTC)
+	day2 := time.Date(2026, 5, 6, 9, 0, 0, 0, time.UTC)
+	rows := []*AgentNetworkUsage{
+		{ID: "u1", Timestamp: day1, InputCostUSD: 0.000768, CachedInputCostUSD: 0.0002304, CacheCreationCostUSD: 0.00192, OutputCostUSD: 0.003},
+		{ID: "u2", Timestamp: day1.Add(time.Hour), InputCostUSD: 0.000625, CachedInputCostUSD: 0.0009375, OutputCostUSD: 0.005},
+		{ID: "u3", Timestamp: day2, InputCostUSD: 0.0000016, OutputCostUSD: 0.0000032},
+	}
+
+	buckets := AggregateUsageByGranularity(rows, UsageGranularityDay)
+	require.Len(t, buckets, 2, "two distinct days expected")
+
+	var total, cache float64
+	for _, b := range buckets {
+		api := b.ToAPIResponse()
+		assert.InDelta(t, api.InputCostUsd+api.CachedInputCostUsd+api.CacheCreationCostUsd+api.OutputCostUsd,
+			api.CostUsd, 1e-12, "each bucket's components must sum to its cost_usd")
+		total += api.CostUsd
+		cache += api.CacheCostUsd
+	}
+
+	var wantTotal, wantCache float64
+	for _, r := range rows {
+		wantTotal += r.TotalCostUSD()
+		wantCache += r.CacheCostUSD()
+	}
+	assert.InDelta(t, wantTotal, total, 1e-12, "buckets must sum to the total across all ledger rows")
+	assert.InDelta(t, wantCache, cache, 1e-12, "buckets must sum to the cache spend across all ledger rows")
+
+	// A month bucket over the same rows must total identically — regrouping
+	// changes the partition, never the sum.
+	monthly := AggregateUsageByGranularity(rows, UsageGranularityMonth)
+	require.Len(t, monthly, 1)
+	assert.InDelta(t, wantTotal, monthly[0].ToAPIResponse().CostUsd, 1e-12,
+		"re-bucketing at a different granularity must preserve the total")
+}

management/internals/modules/agentnetwork/types/usage.go

@@ -25,8 +25,19 @@ type AgentNetworkUsage struct {
 	InputTokens        int64
 	OutputTokens       int64
 	TotalTokens        int64
-	CostUSD            float64
-	CreatedAt          time.Time
+	// Prompt-cache buckets: read + write token counts.
+	CachedInputTokens   int64
+	CacheCreationTokens int64
+	// Per-bucket cost breakdown, mirroring AgentNetworkAccessLog — the only
+	// cost state stored; total and cache portion are derived on read. Kept on
+	// the usage ledger too so spend can be attributed per bucket even for
+	// accounts with log collection turned off. See AgentNetworkAccessLog for
+	// why the columns carry a zero default.
+	InputCostUSD         float64 `gorm:"not null;default:0"`
+	CachedInputCostUSD   float64 `gorm:"not null;default:0"`
+	CacheCreationCostUSD float64 `gorm:"not null;default:0"`
+	OutputCostUSD        float64 `gorm:"not null;default:0"`
+	CreatedAt            time.Time
 }
 
 // TableName keeps usage records in their own stripped table. Named
@@ -34,6 +45,17 @@ type AgentNetworkUsage struct {
 // agent_network_usage table in a shared database.
 func (AgentNetworkUsage) TableName() string { return "agent_network_request_usage" }
 
+// TotalCostUSD is the request's total cost: the sum of the four per-bucket
+// costs. Derived rather than stored so it cannot disagree with the breakdown.
+func (u *AgentNetworkUsage) TotalCostUSD() float64 {
+	return u.InputCostUSD + u.CachedInputCostUSD + u.CacheCreationCostUSD + u.OutputCostUSD
+}
+
+// CacheCostUSD is the portion of the total billed for prompt-cache buckets.
+func (u *AgentNetworkUsage) CacheCostUSD() float64 {
+	return u.CachedInputCostUSD + u.CacheCreationCostUSD
+}
+
 // AgentNetworkUsageGroup is the normalised many-to-many row linking a usage
 // record to one authorising group, mirroring AgentNetworkAccessLogGroup so the
 // usage overview can filter by group with a `group_id IN (...)` join.

management/internals/modules/agentnetwork/types/usageoverview.go

@@ -33,21 +33,45 @@ func ParseUsageGranularity(s string) UsageGranularity {
 // AgentNetworkUsageBucket is one aggregated usage time bucket. PeriodStart is
 // the UTC start of the bucket as YYYY-MM-DD.
 type AgentNetworkUsageBucket struct {
-	PeriodStart  string
-	InputTokens  int64
-	OutputTokens int64
-	TotalTokens  int64
-	CostUSD      float64
+	PeriodStart          string
+	InputTokens          int64
+	OutputTokens         int64
+	TotalTokens          int64
+	CachedInputTokens    int64
+	CacheCreationTokens  int64
+	InputCostUSD         float64
+	CachedInputCostUSD   float64
+	CacheCreationCostUSD float64
+	OutputCostUSD        float64
+}
+
+// TotalCostUSD is the bucket's total spend: the sum of the four per-bucket
+// costs. Derived rather than accumulated separately so it cannot disagree with
+// the components.
+func (b *AgentNetworkUsageBucket) TotalCostUSD() float64 {
+	return b.InputCostUSD + b.CachedInputCostUSD + b.CacheCreationCostUSD + b.OutputCostUSD
+}
+
+// CacheCostUSD is the bucket's prompt-cache spend: cache reads plus writes.
+func (b *AgentNetworkUsageBucket) CacheCostUSD() float64 {
+	return b.CachedInputCostUSD + b.CacheCreationCostUSD
 }
 
 // ToAPIResponse renders the bucket as the API representation.
 func (b *AgentNetworkUsageBucket) ToAPIResponse() api.AgentNetworkUsageBucket {
 	return api.AgentNetworkUsageBucket{
-		PeriodStart:  b.PeriodStart,
-		InputTokens:  b.InputTokens,
-		OutputTokens: b.OutputTokens,
-		TotalTokens:  b.TotalTokens,
-		CostUsd:      b.CostUSD,
+		PeriodStart:          b.PeriodStart,
+		InputTokens:          b.InputTokens,
+		OutputTokens:         b.OutputTokens,
+		TotalTokens:          b.TotalTokens,
+		CachedInputTokens:    b.CachedInputTokens,
+		CacheCreationTokens:  b.CacheCreationTokens,
+		InputCostUsd:         b.InputCostUSD,
+		CachedInputCostUsd:   b.CachedInputCostUSD,
+		CacheCreationCostUsd: b.CacheCreationCostUSD,
+		OutputCostUsd:        b.OutputCostUSD,
+		CostUsd:              b.TotalCostUSD(),
+		CacheCostUsd:         b.CacheCostUSD(),
 	}
 }
 
@@ -84,7 +108,12 @@ func AggregateUsageByGranularity(rows []*AgentNetworkUsage, g UsageGranularity)
 		b.InputTokens += r.InputTokens
 		b.OutputTokens += r.OutputTokens
 		b.TotalTokens += r.TotalTokens
-		b.CostUSD += r.CostUSD
+		b.CachedInputTokens += r.CachedInputTokens
+		b.CacheCreationTokens += r.CacheCreationTokens
+		b.InputCostUSD += r.InputCostUSD
+		b.CachedInputCostUSD += r.CachedInputCostUSD
+		b.CacheCreationCostUSD += r.CacheCreationCostUSD
+		b.OutputCostUSD += r.OutputCostUSD
 	}
 
 	out := make([]*AgentNetworkUsageBucket, 0, len(byPeriod))

management/internals/modules/reverseproxy/domain/domain.go

@@ -23,9 +23,6 @@ type Domain struct {
 	// SupportsCrowdSec is populated at query time from proxy cluster capabilities.
 	// Not persisted.
 	SupportsCrowdSec *bool `gorm:"-"`
-	// SupportsAppSec is populated at query time from proxy cluster capabilities.
-	// Not persisted.
-	SupportsAppSec *bool `gorm:"-"`
 	// SupportsPrivate is populated at query time from proxy cluster capabilities. Not persisted.
 	SupportsPrivate *bool `gorm:"-"`
 }

management/internals/modules/reverseproxy/domain/manager/api.go

@@ -49,7 +49,6 @@ func domainToApi(d *domain.Domain) api.ReverseProxyDomain {
 		SupportsCustomPorts: d.SupportsCustomPorts,
 		RequireSubdomain:    d.RequireSubdomain,
 		SupportsCrowdsec:    d.SupportsCrowdSec,
-		SupportsAppsec:      d.SupportsAppSec,
 		SupportsPrivate:     d.SupportsPrivate,
 	}
 	if d.TargetCluster != "" {

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -35,7 +35,6 @@ type proxyManager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -95,7 +94,6 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		d.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, cluster)
 		d.RequireSubdomain = m.proxyManager.ClusterRequireSubdomain(ctx, cluster)
 		d.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, cluster)
-		d.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, cluster)
 		d.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, cluster)
 		ret = append(ret, d)
 	}
@@ -113,7 +111,6 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		if d.TargetCluster != "" {
 			cd.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, d.TargetCluster)
 			cd.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, d.TargetCluster)
-			cd.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, d.TargetCluster)
 			cd.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, d.TargetCluster)
 		}
 		// Custom domains never require a subdomain by default since

management/internals/modules/reverseproxy/domain/manager/manager_test.go

@@ -40,10 +40,6 @@ func (m *mockProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
-func (m *mockProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
-	return nil
-}
-
 func (m *mockProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager.go

@@ -19,7 +19,6 @@ type Manager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStale(ctx context.Context, inactivityDuration time.Duration) error
 	GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error)

management/internals/modules/reverseproxy/proxy/manager/manager.go

@@ -21,7 +21,6 @@ type store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
@@ -139,13 +138,6 @@ func (m Manager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string
 	return m.store.GetClusterSupportsCrowdSec(ctx, clusterAddr)
 }
 
-// ClusterSupportsAppSec returns whether all active proxies in the cluster have
-// a CrowdSec AppSec endpoint configured (unanimous). Returns nil when no proxy
-// has reported capabilities.
-func (m Manager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
-	return m.store.GetClusterSupportsAppSec(ctx, clusterAddr)
-}
-
 // ClusterSupportsPrivate reports whether any active proxy claims the private capability (nil = unreported).
 func (m Manager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	return m.store.GetClusterSupportsPrivate(ctx, clusterAddr)

management/internals/modules/reverseproxy/proxy/manager/manager_test.go

@@ -99,9 +99,6 @@ func (m *mockStore) GetClusterRequireSubdomain(_ context.Context, _ string) *boo
 func (m *mockStore) GetClusterSupportsCrowdSec(_ context.Context, _ string) *bool {
 	return nil
 }
-func (m *mockStore) GetClusterSupportsAppSec(_ context.Context, _ string) *bool {
-	return nil
-}
 func (m *mockStore) GetClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager_mock.go

@@ -50,6 +50,20 @@ func (mr *MockManagerMockRecorder) CleanupStale(ctx, inactivityDuration interfac
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupStale", reflect.TypeOf((*MockManager)(nil).CleanupStale), ctx, inactivityDuration)
 }
 
+// ClusterSupportsCustomPorts mocks base method.
+func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
+func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
+}
+
 // ClusterRequireSubdomain mocks base method.
 func (m *MockManager) ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -64,20 +78,6 @@ func (mr *MockManagerMockRecorder) ClusterRequireSubdomain(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterRequireSubdomain", reflect.TypeOf((*MockManager)(nil).ClusterRequireSubdomain), ctx, clusterAddr)
 }
 
-// ClusterSupportsAppSec mocks base method.
-func (m *MockManager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsAppSec", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// ClusterSupportsAppSec indicates an expected call of ClusterSupportsAppSec.
-func (mr *MockManagerMockRecorder) ClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsAppSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsAppSec), ctx, clusterAddr)
-}
-
 // ClusterSupportsCrowdSec mocks base method.
 func (m *MockManager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -92,20 +92,6 @@ func (mr *MockManagerMockRecorder) ClusterSupportsCrowdSec(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCrowdSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCrowdSec), ctx, clusterAddr)
 }
 
-// ClusterSupportsCustomPorts mocks base method.
-func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
-func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
-}
-
 // ClusterSupportsPrivate mocks base method.
 func (m *MockManager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -135,35 +121,6 @@ func (mr *MockManagerMockRecorder) Connect(ctx, proxyID, sessionID, clusterAddre
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Connect", reflect.TypeOf((*MockManager)(nil).Connect), ctx, proxyID, sessionID, clusterAddress, ipAddress, accountID, capabilities)
 }
 
-// CountAccountProxies mocks base method.
-func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// CountAccountProxies indicates an expected call of CountAccountProxies.
-func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
-}
-
-// DeleteAccountCluster mocks base method.
-func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
-func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
-}
-
 // Disconnect mocks base method.
 func (m *MockManager) Disconnect(ctx context.Context, proxyID, sessionID string) error {
 	m.ctrl.T.Helper()
@@ -178,21 +135,6 @@ func (mr *MockManagerMockRecorder) Disconnect(ctx, proxyID, sessionID interface{
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Disconnect", reflect.TypeOf((*MockManager)(nil).Disconnect), ctx, proxyID, sessionID)
 }
 
-// GetAccountProxy mocks base method.
-func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
-	ret0, _ := ret[0].(*Proxy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountProxy indicates an expected call of GetAccountProxy.
-func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
-}
-
 // GetActiveClusterAddresses mocks base method.
 func (m *MockManager) GetActiveClusterAddresses(ctx context.Context) ([]string, error) {
 	m.ctrl.T.Helper()
@@ -208,7 +150,6 @@ func (mr *MockManagerMockRecorder) GetActiveClusterAddresses(ctx interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddresses", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddresses), ctx)
 }
 
-// GetActiveClusterAddressesForAccount mocks base method.
 func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, accountID string) ([]string, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetActiveClusterAddressesForAccount", ctx, accountID)
@@ -217,7 +158,6 @@ func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, a
 	return ret0, ret1
 }
 
-// GetActiveClusterAddressesForAccount indicates an expected call of GetActiveClusterAddressesForAccount.
 func (mr *MockManagerMockRecorder) GetActiveClusterAddressesForAccount(ctx, accountID interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddressesForAccount", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddressesForAccount), ctx, accountID)
@@ -237,6 +177,36 @@ func (mr *MockManagerMockRecorder) Heartbeat(ctx, p interface{}) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Heartbeat", reflect.TypeOf((*MockManager)(nil).Heartbeat), ctx, p)
 }
 
+// GetAccountProxy mocks base method.
+func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
+	ret0, _ := ret[0].(*Proxy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountProxy indicates an expected call of GetAccountProxy.
+func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
+}
+
+// CountAccountProxies mocks base method.
+func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountAccountProxies indicates an expected call of CountAccountProxies.
+func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
+}
+
 // IsClusterAddressAvailable mocks base method.
 func (m *MockManager) IsClusterAddressAvailable(ctx context.Context, clusterAddress, accountID string) (bool, error) {
 	m.ctrl.T.Helper()
@@ -252,6 +222,20 @@ func (mr *MockManagerMockRecorder) IsClusterAddressAvailable(ctx, clusterAddress
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsClusterAddressAvailable", reflect.TypeOf((*MockManager)(nil).IsClusterAddressAvailable), ctx, clusterAddress, accountID)
 }
 
+// DeleteAccountCluster mocks base method.
+func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
+func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
+}
+
 // MockController is a mock of Controller interface.
 type MockController struct {
 	ctrl     *gomock.Controller

management/internals/modules/reverseproxy/proxy/proxy.go

@@ -20,9 +20,6 @@ type Capabilities struct {
 	RequireSubdomain *bool
 	// SupportsCrowdsec indicates whether this proxy has CrowdSec configured.
 	SupportsCrowdsec *bool
-	// SupportsAppsec indicates whether this proxy has a CrowdSec AppSec (WAF)
-	// endpoint configured.
-	SupportsAppsec *bool
 	// Private indicates whether this proxy supports inbound access via Wireguard
 	// tunnel and netbird-only authentication policies
 	Private *bool
@@ -77,6 +74,5 @@ type Cluster struct {
 	SupportsCustomPorts *bool
 	RequireSubdomain    *bool
 	SupportsCrowdSec    *bool
-	SupportsAppSec      *bool
 	Private             *bool
 }

management/internals/modules/reverseproxy/service/manager/api.go

@@ -204,7 +204,6 @@ func (h *handler) getClusters(w http.ResponseWriter, r *http.Request) {
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdSec,
-			SupportsAppsec:      c.SupportsAppSec,
 			Private:             c.Private,
 		})
 	}

management/internals/modules/reverseproxy/service/manager/manager.go

@@ -82,7 +82,6 @@ type CapabilityProvider interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -138,7 +137,6 @@ func (m *Manager) GetClusters(ctx context.Context, accountID, userID string) ([]
 		clusters[i].SupportsCustomPorts = m.capabilities.ClusterSupportsCustomPorts(ctx, clusters[i].Address)
 		clusters[i].RequireSubdomain = m.capabilities.ClusterRequireSubdomain(ctx, clusters[i].Address)
 		clusters[i].SupportsCrowdSec = m.capabilities.ClusterSupportsCrowdSec(ctx, clusters[i].Address)
-		clusters[i].SupportsAppSec = m.capabilities.ClusterSupportsAppSec(ctx, clusters[i].Address)
 		clusters[i].Private = m.capabilities.ClusterSupportsPrivate(ctx, clusters[i].Address)
 	}
 

management/internals/modules/reverseproxy/service/service.go

@@ -165,13 +165,6 @@ type AccessRestrictions struct {
 	AllowedCountries []string `json:"allowed_countries,omitempty" gorm:"serializer:json"`
 	BlockedCountries []string `json:"blocked_countries,omitempty" gorm:"serializer:json"`
 	CrowdSecMode     string   `json:"crowdsec_mode,omitempty" gorm:"serializer:json"`
-	// AllowMatch controls how the allowlists combine: "" or "all" require
-	// matching every allowlist (AND), "any" requires matching at least one (OR).
-	// Empty is treated as "all" for backward compatibility with existing records.
-	AllowMatch string `json:"allow_match,omitempty" gorm:"serializer:json"`
-	// AppSecMode is the CrowdSec AppSec (WAF) request inspection mode: "",
-	// "off", "enforce", or "observe". HTTP services only.
-	AppSecMode string `json:"appsec_mode,omitempty" gorm:"serializer:json"`
 }
 
 // Copy returns a deep copy of the AccessRestrictions.
@@ -182,8 +175,6 @@ func (r AccessRestrictions) Copy() AccessRestrictions {
 		AllowedCountries: slices.Clone(r.AllowedCountries),
 		BlockedCountries: slices.Clone(r.BlockedCountries),
 		CrowdSecMode:     r.CrowdSecMode,
-		AllowMatch:       r.AllowMatch,
-		AppSecMode:       r.AppSecMode,
 	}
 }
 
@@ -817,25 +808,13 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
 		}
 		res.CrowdSecMode = string(*r.CrowdsecMode)
 	}
-	if r.AllowMatch != nil {
-		if !r.AllowMatch.Valid() {
-			return AccessRestrictions{}, fmt.Errorf("invalid allow_match %q", *r.AllowMatch)
-		}
-		res.AllowMatch = string(*r.AllowMatch)
-	}
-	if r.AppsecMode != nil {
-		if !r.AppsecMode.Valid() {
-			return AccessRestrictions{}, fmt.Errorf("invalid appsec_mode %q", *r.AppsecMode)
-		}
-		res.AppSecMode = string(*r.AppsecMode)
-	}
 	return res, nil
 }
 
 func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
 		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" && r.AllowMatch == "" && r.AppSecMode == "" {
+		r.CrowdSecMode == "" {
 		return nil
 	}
 	res := &api.AccessRestrictions{}
@@ -855,21 +834,13 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 		mode := api.AccessRestrictionsCrowdsecMode(r.CrowdSecMode)
 		res.CrowdsecMode = &mode
 	}
-	if r.AllowMatch != "" {
-		match := api.AccessRestrictionsAllowMatch(r.AllowMatch)
-		res.AllowMatch = &match
-	}
-	if r.AppSecMode != "" {
-		mode := api.AccessRestrictionsAppsecMode(r.AppSecMode)
-		res.AppsecMode = &mode
-	}
 	return res
 }
 
 func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
 		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" && r.AllowMatch == "" && r.AppSecMode == "" {
+		r.CrowdSecMode == "" {
 		return nil
 	}
 	return &proto.AccessRestrictions{
@@ -878,8 +849,6 @@ func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 		AllowedCountries: r.AllowedCountries,
 		BlockedCountries: r.BlockedCountries,
 		CrowdsecMode:     r.CrowdSecMode,
-		AllowMatch:       r.AllowMatch,
-		AppsecMode:       r.AppSecMode,
 	}
 }
 
@@ -905,11 +874,6 @@ func (s *Service) Validate() error {
 	if err := validateAccessRestrictions(&s.Restrictions); err != nil {
 		return err
 	}
-	// AppSec inspects HTTP requests, so it cannot apply to the L4 modes, which
-	// forward opaque byte streams.
-	if appSecEnabled(s.Restrictions.AppSecMode) && s.Mode != ModeHTTP {
-		return fmt.Errorf("appsec_mode is only supported for HTTP services, got mode %q", s.Mode)
-	}
 	if err := s.validatePrivateRequirements(); err != nil {
 		return err
 	}
@@ -1278,39 +1242,10 @@ func validateCrowdSecMode(mode string) error {
 	}
 }
 
-func validateAllowMatch(mode string) error {
-	switch mode {
-	case "", "all", "any":
-		return nil
-	default:
-		return fmt.Errorf("allow_match %q is invalid", mode)
-	}
-}
-
-func validateAppSecMode(mode string) error {
-	switch mode {
-	case "", "off", "enforce", "observe":
-		return nil
-	default:
-		return fmt.Errorf("appsec_mode %q is invalid", mode)
-	}
-}
-
-// appSecEnabled reports whether the mode asks for request inspection.
-func appSecEnabled(mode string) bool {
-	return mode == "enforce" || mode == "observe"
-}
-
 func validateAccessRestrictions(r *AccessRestrictions) error {
 	if err := validateCrowdSecMode(r.CrowdSecMode); err != nil {
 		return err
 	}
-	if err := validateAllowMatch(r.AllowMatch); err != nil {
-		return err
-	}
-	if err := validateAppSecMode(r.AppSecMode); err != nil {
-		return err
-	}
 
 	if len(r.AllowedCIDRs) > maxCIDREntries {
 		return fmt.Errorf("allowed_cidrs: exceeds maximum of %d entries", maxCIDREntries)

management/internals/modules/reverseproxy/service/service_test.go

@@ -26,17 +26,6 @@ func validProxy() *Service {
 	}
 }
 
-// validL4Proxy returns a service that passes validation in one of the L4 modes.
-func validL4Proxy(mode string) *Service {
-	rp := validProxy()
-	rp.Mode = mode
-	rp.ListenPort = 9000
-	rp.Targets = []*Target{
-		{TargetId: "peer-1", TargetType: TargetTypePeer, Host: "10.0.0.1", Port: 5432, Protocol: mode, Enabled: true},
-	}
-	return rp
-}
-
 func TestValidate_Valid(t *testing.T) {
 	require.NoError(t, validProxy().Validate())
 }
@@ -1313,130 +1302,6 @@ func TestValidate_Private_AcceptsClusterTargetWithAccessGroups(t *testing.T) {
 	require.NoError(t, rp.Validate())
 }
 
-func TestRestrictions_AllowMatch_RoundTrip(t *testing.T) {
-	anyMatch := api.AccessRestrictionsAllowMatchAny
-	apiIn := &api.AccessRestrictions{
-		AllowedCidrs:     &[]string{"203.0.113.0/24"},
-		AllowedCountries: &[]string{"US"},
-		AllowMatch:       &anyMatch,
-	}
-
-	model, err := restrictionsFromAPI(apiIn)
-	require.NoError(t, err)
-	assert.Equal(t, "any", model.AllowMatch)
-
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut.AllowMatch)
-	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
-
-	protoOut := restrictionsToProto(model)
-	require.NotNil(t, protoOut)
-	assert.Equal(t, "any", protoOut.AllowMatch)
-}
-
-func TestRestrictions_AllowMatch_EmptyDefaultsToAll(t *testing.T) {
-	// A stored record with no allow_match (existing services) stays empty and
-	// must not surface a value on the API, preserving AND behavior downstream.
-	model, err := restrictionsFromAPI(&api.AccessRestrictions{
-		AllowedCidrs: &[]string{"203.0.113.0/24"},
-	})
-	require.NoError(t, err)
-	assert.Empty(t, model.AllowMatch, "unset allow_match stays empty")
-
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut)
-	assert.Nil(t, apiOut.AllowMatch, "empty allow_match is omitted from the API response")
-}
-
-func TestRestrictions_AllowMatchOnly_Preserved(t *testing.T) {
-	// allow_match set without any list must not be dropped by the emptiness
-	// guards, so it round-trips through both the API and proto conversions.
-	model := AccessRestrictions{AllowMatch: "any"}
-
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut, "allow-match-only restriction must not be omitted from the API response")
-	require.NotNil(t, apiOut.AllowMatch)
-	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
-
-	protoOut := restrictionsToProto(model)
-	require.NotNil(t, protoOut, "allow-match-only restriction must not be omitted from the proto output")
-	assert.Equal(t, "any", protoOut.AllowMatch)
-}
-
-func TestValidate_RejectsInvalidAllowMatch(t *testing.T) {
-	rp := validProxy()
-	rp.Restrictions = AccessRestrictions{
-		AllowedCIDRs: []string{"203.0.113.0/24"},
-		AllowMatch:   "sometimes",
-	}
-	assert.ErrorContains(t, rp.Validate(), "allow_match")
-}
-
-func TestRestrictions_AppSecMode_RoundTrip(t *testing.T) {
-	mode := api.AccessRestrictionsAppsecModeEnforce
-	apiIn := &api.AccessRestrictions{AppsecMode: &mode}
-
-	model, err := restrictionsFromAPI(apiIn)
-	require.NoError(t, err)
-	assert.Equal(t, "enforce", model.AppSecMode)
-
-	// appsec_mode alone must keep the restrictions object alive on both the API
-	// and proto legs: it is meaningful without any CIDR or country entry.
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut, "appsec_mode alone must not collapse the restrictions to nil")
-	require.NotNil(t, apiOut.AppsecMode)
-	assert.Equal(t, api.AccessRestrictionsAppsecModeEnforce, *apiOut.AppsecMode)
-
-	protoOut := restrictionsToProto(model)
-	require.NotNil(t, protoOut, "appsec_mode alone must reach the proxy")
-	assert.Equal(t, "enforce", protoOut.AppsecMode)
-}
-
-func TestRestrictions_AppSecMode_EmptyIsOmitted(t *testing.T) {
-	model, err := restrictionsFromAPI(&api.AccessRestrictions{
-		AllowedCidrs: &[]string{"203.0.113.0/24"},
-	})
-	require.NoError(t, err)
-	assert.Empty(t, model.AppSecMode)
-
-	apiOut := restrictionsToAPI(model)
-	require.NotNil(t, apiOut)
-	assert.Nil(t, apiOut.AppsecMode, "empty appsec_mode is omitted from the API response")
-}
-
-func TestRestrictions_AppSecMode_CopyIsDeep(t *testing.T) {
-	original := AccessRestrictions{AppSecMode: "observe", CrowdSecMode: "enforce"}
-	assert.Equal(t, original, original.Copy(), "Copy must carry every mode field")
-}
-
-func TestValidate_RejectsInvalidAppSecMode(t *testing.T) {
-	rp := validProxy()
-	rp.Restrictions = AccessRestrictions{AppSecMode: "sometimes"}
-	assert.ErrorContains(t, rp.Validate(), "appsec_mode")
-}
-
-func TestValidate_RejectsAppSecOnL4Modes(t *testing.T) {
-	// AppSec inspects HTTP requests, so the L4 modes cannot honor it. Accepting
-	// the field there would report protection that never runs.
-	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
-		t.Run(mode, func(t *testing.T) {
-			rp := validL4Proxy(mode)
-			rp.Restrictions = AccessRestrictions{AppSecMode: "enforce"}
-			assert.ErrorContains(t, rp.Validate(), "appsec_mode is only supported for HTTP services")
-		})
-	}
-}
-
-func TestValidate_AllowsAppSecOffOnL4Modes(t *testing.T) {
-	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
-		t.Run(mode, func(t *testing.T) {
-			rp := validL4Proxy(mode)
-			rp.Restrictions = AccessRestrictions{AppSecMode: "off"}
-			require.NoError(t, rp.Validate(), "an explicit off must not be rejected on L4 services")
-		})
-	}
-}
-
 func TestValidate_Private_RejectsNonHTTPMode(t *testing.T) {
 	rp := validProxy()
 	rp.Private = true

management/internals/shared/grpc/proxy.go

@@ -29,7 +29,6 @@ import (
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -37,6 +36,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"
@@ -505,7 +505,6 @@ func (s *ProxyServiceServer) registerProxyConnection(ctx context.Context, params
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdsec,
-			SupportsAppsec:      c.SupportsAppsec,
 			Private:             c.Private,
 		}
 	}

management/server/migration/migration.go

@@ -683,3 +683,81 @@ func BackfillPublicIDs[T any](ctx context.Context, db *gorm.DB) error {
 	log.WithContext(ctx).Infof("Backfill of empty public_id in table %s completed", tableName)
 	return nil
 }
+
+// FoldCostAggregatesIntoBuckets migrates a per-request cost table from the old
+// "stored aggregate" shape (cost_usd + cache_cost_usd columns) to the per-bucket
+// breakdown, where the total and cache portion are derived on read instead.
+//
+// The fold preserves both aggregates exactly for historical rows: the cache
+// total moves into cached_input_cost_usd and the remainder into
+// input_cost_usd, so a row's derived total and cache cost still match what it
+// reported before the upgrade. The finer split is genuinely unknown for those
+// rows — the old schema never recorded a read/write or input/output division —
+// so it is lumped rather than guessed; only rows written after the upgrade
+// carry a true four-way split.
+//
+// Dropping the columns before folding would zero every historical row's cost,
+// so the update runs first and the drop only happens once it succeeds. A table
+// with no cost_usd column has already been migrated (or was created fresh) and
+// is skipped.
+func FoldCostAggregatesIntoBuckets[T any](ctx context.Context, db *gorm.DB) error {
+	var model T
+
+	if !db.Migrator().HasTable(&model) {
+		log.WithContext(ctx).Debugf("table for %T does not exist, no cost-bucket migration needed", model)
+		return nil
+	}
+	if !db.Migrator().HasColumn(&model, "cost_usd") {
+		log.WithContext(ctx).Debugf("table for %T has no cost_usd column, cost buckets already migrated", model)
+		return nil
+	}
+
+	stmt := &gorm.Statement{DB: db}
+	if err := stmt.Parse(&model); err != nil {
+		return fmt.Errorf("parse model schema: %w", err)
+	}
+	tableName := stmt.Schema.Table
+
+	// COALESCE guards rows whose new columns were added as NULL by an earlier
+	// AutoMigrate run that predates the NOT NULL default.
+	hasCacheColumn := db.Migrator().HasColumn(&model, "cache_cost_usd")
+	cacheExpr := "0"
+	if hasCacheColumn {
+		cacheExpr = "COALESCE(cache_cost_usd, 0)"
+	}
+
+	if err := db.Transaction(func(tx *gorm.DB) error {
+		// Only touch rows that carry a legacy total and no breakdown yet, so
+		// the migration is idempotent and never overwrites a true split.
+		update := fmt.Sprintf(`UPDATE %s
+			SET input_cost_usd = COALESCE(cost_usd, 0) - %s,
+			    cached_input_cost_usd = %s,
+			    cache_creation_cost_usd = 0,
+			    output_cost_usd = 0
+			WHERE COALESCE(cost_usd, 0) <> 0
+			  AND COALESCE(input_cost_usd, 0) = 0
+			  AND COALESCE(cached_input_cost_usd, 0) = 0
+			  AND COALESCE(cache_creation_cost_usd, 0) = 0
+			  AND COALESCE(output_cost_usd, 0) = 0`, tableName, cacheExpr, cacheExpr)
+		res := tx.Exec(update)
+		if res.Error != nil {
+			return fmt.Errorf("fold legacy cost aggregates in %s: %w", tableName, res.Error)
+		}
+		log.WithContext(ctx).Infof("folded legacy cost aggregates into per-bucket columns for %d rows in table %s", res.RowsAffected, tableName)
+
+		if err := tx.Migrator().DropColumn(&model, "cost_usd"); err != nil {
+			return fmt.Errorf("drop cost_usd from %s: %w", tableName, err)
+		}
+		if hasCacheColumn {
+			if err := tx.Migrator().DropColumn(&model, "cache_cost_usd"); err != nil {
+				return fmt.Errorf("drop cache_cost_usd from %s: %w", tableName, err)
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	log.WithContext(ctx).Infof("migration of stored cost aggregates to per-bucket columns in table %s completed", tableName)
+	return nil
+}

management/server/migration/migration_test.go

@@ -16,6 +16,7 @@ import (
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
 
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/server/migration"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/testutil"
@@ -639,3 +640,99 @@ func TestCleanupOrphanedResources_SkipsWhenForeignKeyExists(t *testing.T) {
 	db.Model(&testChildWithFK{}).Count(&count)
 	assert.Equal(t, int64(2), count, "Both rows should survive — migration must skip when FK constraint exists")
 }
+
+// legacyCostRow is the pre-breakdown shape of the usage table: cost was stored
+// as a total plus a cache portion, with no per-bucket columns. Used to build a
+// realistic pre-upgrade table for the fold migration to run against.
+type legacyCostRow struct {
+	ID           string `gorm:"primaryKey"`
+	AccountID    string
+	Model        string
+	CostUSD      float64
+	CacheCostUSD float64
+}
+
+func (legacyCostRow) TableName() string { return "agent_network_request_usage" }
+
+// TestFoldCostAggregatesIntoBuckets_PreservesHistoricalCost covers the upgrade
+// path: a table written under the old schema must come out with its per-row
+// total and cache cost unchanged, because dropping cost_usd without folding it
+// forward would silently zero every historical row's spend.
+func TestFoldCostAggregatesIntoBuckets_PreservesHistoricalCost(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	// setupDatabase hands back a process-shared database, so start from a clean
+	// table rather than inheriting rows from another test.
+	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.AgentNetworkUsage{}))
+
+	require.NoError(t, db.AutoMigrate(&legacyCostRow{}), "legacy table must be created")
+	require.NoError(t, db.Create(&legacyCostRow{
+		ID: "u1", AccountID: "acct-1", Model: "claude-sonnet-4-6", CostUSD: 0.0123, CacheCostUSD: 0.0029,
+	}).Error)
+	require.NoError(t, db.Create(&legacyCostRow{
+		ID: "u2", AccountID: "acct-1", Model: "gpt-4o", CostUSD: 0.5, CacheCostUSD: 0,
+	}).Error)
+	// A zero-cost row (denied / unpriced request) must stay zero, not be touched.
+	require.NoError(t, db.Create(&legacyCostRow{ID: "u3", AccountID: "acct-1", Model: "gw/unpriced"}).Error)
+
+	// AutoMigrate adds the per-bucket columns alongside the legacy ones, exactly
+	// as a real upgrade does before the post-auto migrations run.
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.AgentNetworkUsage{}), "new columns must be added")
+
+	require.NoError(t, migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db))
+
+	assert.False(t, db.Migrator().HasColumn(&agentNetworkTypes.AgentNetworkUsage{}, "cost_usd"),
+		"legacy cost_usd column must be dropped once folded")
+	assert.False(t, db.Migrator().HasColumn(&agentNetworkTypes.AgentNetworkUsage{}, "cache_cost_usd"),
+		"legacy cache_cost_usd column must be dropped once folded")
+
+	var rows []*agentNetworkTypes.AgentNetworkUsage
+	require.NoError(t, db.Order("id").Find(&rows).Error)
+	require.Len(t, rows, 3)
+
+	// u1: total and cache portion both preserved; the read/write and
+	// input/output splits are unknowable for a legacy row, so the cache total
+	// lands on cached_input and the remainder on input.
+	assert.InDelta(t, 0.0123, rows[0].TotalCostUSD(), 1e-9, "historical total must survive the fold")
+	assert.InDelta(t, 0.0029, rows[0].CacheCostUSD(), 1e-9, "historical cache cost must survive the fold")
+	assert.InDelta(t, 0.0094, rows[0].InputCostUSD, 1e-9, "non-cache remainder lands on input")
+	assert.InDelta(t, 0.0029, rows[0].CachedInputCostUSD, 1e-9, "legacy cache total lands on cached input")
+	assert.Zero(t, rows[0].CacheCreationCostUSD, "legacy rows carry no read/write split to recover")
+	assert.Zero(t, rows[0].OutputCostUSD, "legacy rows carry no input/output split to recover")
+
+	// u2: no cache spend — the whole total is the non-cache remainder.
+	assert.InDelta(t, 0.5, rows[1].TotalCostUSD(), 1e-9, "cache-free historical total must survive")
+	assert.Zero(t, rows[1].CacheCostUSD(), "a cache-free row must stay cache-free")
+
+	// u3: zero stays zero rather than being rewritten.
+	assert.Zero(t, rows[2].TotalCostUSD(), "an unpriced row must remain unpriced")
+}
+
+// TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated proves the migration is
+// safe to re-run: with no legacy column present it is a no-op that leaves a
+// true four-way split untouched.
+func TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated(t *testing.T) {
+	ctx := context.Background()
+	db := setupDatabase(t)
+	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.AgentNetworkUsage{}))
+
+	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.AgentNetworkUsage{}))
+	// Timestamp must be set explicitly: a zero time.Time serialises as
+	// '0000-00-00 00:00:00', which MySQL rejects under strict mode.
+	require.NoError(t, db.Create(&agentNetworkTypes.AgentNetworkUsage{
+		ID: "u1", AccountID: "acct-1", Model: "claude-sonnet-4-6",
+		Timestamp:    time.Date(2026, 5, 5, 9, 0, 0, 0, time.UTC),
+		InputCostUSD: 0.001, CachedInputCostUSD: 0.002, CacheCreationCostUSD: 0.003, OutputCostUSD: 0.004,
+	}).Error)
+
+	require.NoError(t, migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db),
+		"running against an already-migrated table must be a no-op, not an error")
+
+	var row agentNetworkTypes.AgentNetworkUsage
+	require.NoError(t, db.First(&row, "id = ?", "u1").Error)
+	assert.InDelta(t, 0.001, row.InputCostUSD, 1e-9, "a true split must not be rewritten")
+	assert.InDelta(t, 0.002, row.CachedInputCostUSD, 1e-9)
+	assert.InDelta(t, 0.003, row.CacheCreationCostUSD, 1e-9)
+	assert.InDelta(t, 0.004, row.OutputCostUSD, 1e-9)
+	assert.InDelta(t, 0.01, row.TotalCostUSD(), 1e-9, "derived total sums the four buckets")
+}

management/server/store/sql_store.go

@@ -2259,7 +2259,7 @@ func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*p
 }
 
 func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
-	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth, restrictions,
+	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth,
 		meta_created_at, meta_certificate_issued_at, meta_status, proxy_cluster,
 		pass_host_header, rewrite_redirects, session_private_key, session_public_key,
 		mode, listen_port, port_auto_assigned, source, source_peer, terminated,
@@ -2278,7 +2278,6 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 	services, err := pgx.CollectRows(serviceRows, func(row pgx.CollectableRow) (*rpservice.Service, error) {
 		var s rpservice.Service
 		var auth []byte
-		var restrictions []byte
 		var accessGroups []byte
 		var createdAt, certIssuedAt sql.NullTime
 		var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
@@ -2292,7 +2291,6 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 			&s.Domain,
 			&s.Enabled,
 			&auth,
-			&restrictions,
 			&createdAt,
 			&certIssuedAt,
 			&status,
@@ -2320,12 +2318,6 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 			}
 		}
 
-		if len(restrictions) > 0 {
-			if err := json.Unmarshal(restrictions, &s.Restrictions); err != nil {
-				return nil, fmt.Errorf("unmarshal restrictions: %w", err)
-			}
-		}
-
 		if len(accessGroups) > 0 {
 			if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
 				return nil, fmt.Errorf("unmarshal access_groups: %w", err)
@@ -6365,7 +6357,6 @@ var validCapabilityColumns = map[string]struct{}{
 	"supports_custom_ports": {},
 	"require_subdomain":     {},
 	"supports_crowdsec":     {},
-	"supports_appsec":       {},
 	"private":               {},
 }
 
@@ -6396,14 +6387,6 @@ func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr s
 	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
 }
 
-// GetClusterSupportsAppSec returns whether all active proxies in the cluster
-// have a CrowdSec AppSec endpoint configured. Returns nil when no proxy
-// reported the capability. Unanimous for the same reason as CrowdSec: a single
-// proxy without AppSec would let requests through uninspected.
-func (s *SqlStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
-	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_appsec")
-}
-
 // getClusterUnanimousCapability returns an aggregated boolean capability
 // requiring all active proxies in the cluster to report true.
 func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {

management/server/store/sql_store_agentnetwork.go

@@ -71,7 +71,7 @@ func (s *SqlStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetr
 	usageRow := db.Model(&agentNetworkTypes.AgentNetworkUsage{}).
 		Select("COALESCE(SUM(input_tokens), 0) AS input_tokens, " +
 			"COALESCE(SUM(output_tokens), 0) AS output_tokens, " +
-			"COALESCE(SUM(cost_usd), 0) AS cost_usd").Row()
+			"COALESCE(SUM" + agentNetworkTypes.CostUSDSQLExpr + ", 0) AS cost_usd").Row()
 	if err := usageRow.Scan(&m.InputTokens, &m.OutputTokens, &m.CostUSD); err != nil {
 		return AgentNetworkMetrics{}, fmt.Errorf("scan agent network usage metrics: %w", err)
 	}

management/server/store/sql_store_agentnetwork_accesslog_test.go

@@ -37,7 +37,7 @@ func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
 		InputTokens:        1200,
 		OutputTokens:       640,
 		TotalTokens:        1840,
-		CostUSD:            0.0231,
+		InputCostUSD:       0.0231,
 	}
 	usageGroups := []agentNetworkTypes.AgentNetworkUsageGroup{
 		{UsageID: usage.ID, GroupID: "grp-eng", AccountID: accountID},
@@ -71,7 +71,7 @@ func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
 		InputTokens:  1200,
 		OutputTokens: 640,
 		TotalTokens:  1840,
-		CostUSD:      0.0231,
+		InputCostUSD: 0.0231,
 	}
 	entryGroups := []agentNetworkTypes.AgentNetworkAccessLogGroup{
 		{LogID: entry.ID, GroupID: "grp-eng", AccountID: accountID},
@@ -127,7 +127,7 @@ func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
 	mk := func(id string, ts time.Time, model string, in, out int64, cost float64) *agentNetworkTypes.AgentNetworkUsage {
 		return &agentNetworkTypes.AgentNetworkUsage{
 			ID: id, AccountID: accountID, Timestamp: ts, Model: model,
-			InputTokens: in, OutputTokens: out, TotalTokens: in + out, CostUSD: cost,
+			InputTokens: in, OutputTokens: out, TotalTokens: in + out, InputCostUSD: cost,
 		}
 	}
 	require.NoError(t, s.CreateAgentNetworkUsage(ctx, mk("u1", day1, "gpt-4o", 100, 50, 0.10), nil))
@@ -143,7 +143,7 @@ func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
 	assert.Equal(t, "2026-05-05", buckets[0].PeriodStart, "oldest-first ordering")
 	assert.Equal(t, int64(300), buckets[0].InputTokens, "same-day input tokens summed")
 	assert.Equal(t, int64(130), buckets[0].OutputTokens)
-	assert.InDelta(t, 0.30, buckets[0].CostUSD, 1e-9, "same-day cost summed")
+	assert.InDelta(t, 0.30, buckets[0].TotalCostUSD(), 1e-9, "same-day cost summed")
 	assert.Equal(t, "2026-05-06", buckets[1].PeriodStart)
 	assert.Equal(t, int64(15), buckets[1].TotalTokens)
 
@@ -174,7 +174,7 @@ func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
 			ID: id, AccountID: accountID, ServiceID: "svc", Timestamp: ts,
 			UserID: user, StatusCode: 200, Provider: provider, Model: model,
 			SessionID: session, Decision: decision,
-			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, CostUSD: cost,
+			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, InputCostUSD: cost,
 		}
 	}
 
@@ -207,7 +207,7 @@ func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
 	s1 := sessions[2]
 	assert.Equal(t, 2, s1.RequestCount, "s1 has two requests")
 	assert.Equal(t, int64(300), s1.TotalTokens, "tokens summed across the session")
-	assert.InDelta(t, 0.30, s1.CostUSD, 1e-9, "cost summed across the session")
+	assert.InDelta(t, 0.30, s1.TotalCostUSD(), 1e-9, "cost summed across the session")
 	assert.Equal(t, "alice", s1.UserID)
 	assert.Equal(t, "allow", s1.Decision)
 	// SQLite hands times back in time.Local; normalise to UTC so the instant is

management/server/store/sql_store_service_test.go

@@ -44,46 +44,3 @@ func TestSqlStore_GetAccount_PrivateServiceRoundtrip(t *testing.T) {
 		assert.Equal(t, []string{"grp-admins", "grp-ops"}, got.AccessGroups)
 	})
 }
-
-func TestSqlStore_GetAccount_ServiceRestrictionsRoundtrip(t *testing.T) {
-	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		ctx := context.Background()
-		account := newAccountWithId(ctx, "account_svc_restrictions", "testuser", "")
-		require.NoError(t, store.SaveAccount(ctx, account))
-
-		svc := &rpservice.Service{
-			ID:        "svc-restrictions",
-			AccountID: account.Id,
-			Name:      "restricted-svc",
-			Domain:    "restricted.example",
-			Enabled:   true,
-			Mode:      rpservice.ModeHTTP,
-			Restrictions: rpservice.AccessRestrictions{
-				AllowedCIDRs:     []string{"203.0.113.0/24"},
-				AllowedCountries: []string{"US"},
-				AllowMatch:       "any",
-				CrowdSecMode:     "observe",
-				AppSecMode:       "enforce",
-			},
-		}
-		require.NoError(t, store.CreateService(ctx, svc))
-
-		loaded, err := store.GetAccount(ctx, account.Id)
-		require.NoError(t, err)
-		require.Len(t, loaded.Services, 1)
-
-		// Restrictions are stored as a JSON blob; confirm the whole struct,
-		// including allow_match and the crowdsec/appsec modes, survives the
-		// read path (Postgres pgx path included via runTestForAllEngines).
-		got := loaded.Services[0].Restrictions
-		assert.Equal(t, []string{"203.0.113.0/24"}, got.AllowedCIDRs)
-		assert.Equal(t, []string{"US"}, got.AllowedCountries)
-		assert.Equal(t, "any", got.AllowMatch)
-		assert.Equal(t, "observe", got.CrowdSecMode)
-		assert.Equal(t, "enforce", got.AppSecMode)
-	})
-}

management/server/store/store.go

@@ -321,7 +321,6 @@ type Store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
-	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error)
@@ -651,6 +650,14 @@ func getMigrationsPostAuto(ctx context.Context) []migrationFunc {
 		func(db *gorm.DB) error {
 			return migration.DropIndex[proxy.Proxy](ctx, db, "idx_proxy_account_id_unique")
 		},
+		// Post-auto so the per-bucket cost columns already exist when the legacy
+		// aggregates are folded into them and dropped.
+		func(db *gorm.DB) error {
+			return migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkAccessLog](ctx, db)
+		},
+		func(db *gorm.DB) error {
+			return migration.FoldCostAggregatesIntoBuckets[agentNetworkTypes.AgentNetworkUsage](ctx, db)
+		},
 	}
 }
 

management/server/store/store_mock.go

@@ -1835,20 +1835,6 @@ func (mr *MockStoreMockRecorder) GetClusterRequireSubdomain(ctx, clusterAddr int
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterRequireSubdomain", reflect.TypeOf((*MockStore)(nil).GetClusterRequireSubdomain), ctx, clusterAddr)
 }
 
-// GetClusterSupportsAppSec mocks base method.
-func (m *MockStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetClusterSupportsAppSec", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// GetClusterSupportsAppSec indicates an expected call of GetClusterSupportsAppSec.
-func (mr *MockStoreMockRecorder) GetClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsAppSec", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsAppSec), ctx, clusterAddr)
-}
-
 // GetClusterSupportsCrowdSec mocks base method.
 func (m *MockStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()

proxy/cmd/proxy/cmd/root.go

@@ -79,9 +79,6 @@ var (
 	geoDataDir            string
 	crowdsecAPIURL        string
 	crowdsecAPIKey        string
-	appsecURL             string
-	appsecTimeout         time.Duration
-	appsecMaxBodyBytes    int64
 )
 
 var rootCmd = &cobra.Command{
@@ -128,9 +125,6 @@ func init() {
 	rootCmd.Flags().StringVar(&geoDataDir, "geo-data-dir", envStringOrDefault("NB_PROXY_GEO_DATA_DIR", "/var/lib/netbird/geolocation"), "Directory for the GeoLite2 MMDB file (auto-downloaded if missing)")
 	rootCmd.Flags().StringVar(&crowdsecAPIURL, "crowdsec-api-url", envStringOrDefault("NB_PROXY_CROWDSEC_API_URL", ""), "CrowdSec LAPI URL for IP reputation checks")
 	rootCmd.Flags().StringVar(&crowdsecAPIKey, "crowdsec-api-key", envStringOrDefault("NB_PROXY_CROWDSEC_API_KEY", ""), "CrowdSec bouncer API key")
-	rootCmd.Flags().StringVar(&appsecURL, "crowdsec-appsec-url", envStringOrDefault("NB_PROXY_CROWDSEC_APPSEC_URL", ""), "CrowdSec AppSec (WAF) endpoint for HTTP request inspection, e.g. http://127.0.0.1:7422/ (reuses the bouncer API key)")
-	rootCmd.Flags().DurationVar(&appsecTimeout, "crowdsec-appsec-timeout", envDurationOrDefault("NB_PROXY_CROWDSEC_APPSEC_TIMEOUT", 0), "Timeout for a single AppSec inspection call (0 = 200ms)")
-	rootCmd.Flags().Int64Var(&appsecMaxBodyBytes, "crowdsec-appsec-max-body-bytes", envInt64OrDefault("NB_PROXY_CROWDSEC_APPSEC_MAX_BODY_BYTES", 0), "Cap on the request body mirrored to AppSec (0 = 64KiB, negative = headers and URI only)")
 }
 
 // Execute runs the root command.
@@ -260,10 +254,6 @@ func runServer(cmd *cobra.Command, args []string) error {
 		GeoDataDir:               geoDataDir,
 		CrowdSecAPIURL:           crowdsecAPIURL,
 		CrowdSecAPIKey:           crowdsecAPIKey,
-		CrowdSecAppSecURL:        appsecURL,
-		CrowdSecAppSecTimeout:    appsecTimeout,
-
-		CrowdSecAppSecMaxBodyBytes: appsecMaxBodyBytes,
 	})
 
 	return srv.ListenAndServe(ctx, addr)
@@ -303,19 +293,6 @@ func envUint16OrDefault(key string, def uint16) uint16 {
 	return uint16(parsed)
 }
 
-func envInt64OrDefault(key string, def int64) int64 {
-	v, exists := os.LookupEnv(key)
-	if !exists {
-		return def
-	}
-	parsed, err := strconv.ParseInt(v, 10, 64)
-	if err != nil {
-		log.Warnf("parse %s=%q: %v, using default %d", key, v, err, def)
-		return def
-	}
-	return parsed
-}
-
 func envDurationOrDefault(key string, def time.Duration) time.Duration {
 	v, exists := os.LookupEnv(key)
 	if !exists {

proxy/internal/accesslog/logger.go

@@ -221,14 +221,21 @@ func (l *Logger) allowDenyLog(serviceID types.ServiceID, reason string) bool {
 // proxy/internal/middleware/keys.go — only the dimensions management needs to
 // record a usage row (provider / model / tokens / cost / groups).
 var usageMetadataKeys = map[string]struct{}{
-	"llm.provider":             {},
-	"llm.model":                {},
-	"llm.resolved_provider_id": {},
-	"llm.input_tokens":         {},
-	"llm.output_tokens":        {},
-	"llm.total_tokens":         {},
-	"cost.usd_total":           {},
-	"llm.authorising_groups":   {},
+	"llm.provider":              {},
+	"llm.model":                 {},
+	"llm.resolved_provider_id":  {},
+	"llm.input_tokens":          {},
+	"llm.output_tokens":         {},
+	"llm.total_tokens":          {},
+	"llm.cached_input_tokens":   {},
+	"llm.cache_creation_tokens": {},
+	"cost.usd_input":            {},
+	"cost.usd_cached_input":     {},
+	"cost.usd_cache_creation":   {},
+	"cost.usd_output":           {},
+	"cost.usd_total":            {},
+	"cost.usd_cache":            {},
+	"llm.authorising_groups":    {},
 }
 
 // stripAgentNetworkEntryForUsage returns the entry reduced to what's needed to

proxy/internal/appsec/body.go

@@ -1,83 +0,0 @@
-package appsec
-
-import (
-	"bytes"
-	"errors"
-	"io"
-	"mime"
-	"net/http"
-	"net/url"
-	"slices"
-	"strconv"
-)
-
-// bufferBody reads up to limit+1 bytes from r.Body and always restores r.Body so
-// the request stays forwardable. oversize reports that the body exceeded limit, in
-// which case the returned prefix must not be used for inspection: the bytes are
-// only read so they can be replayed to the backend.
-func bufferBody(r *http.Request, limit int64) (body []byte, oversize bool, err error) {
-	original := r.Body
-	buf, readErr := io.ReadAll(io.LimitReader(original, limit+1))
-	if readErr != nil && !errors.Is(readErr, io.EOF) {
-		// Restore what was read so a downstream retry sees a consistent stream,
-		// then surface the failure.
-		r.Body = replay(buf, original)
-		return nil, false, readErr
-	}
-
-	if int64(len(buf)) > limit {
-		r.Body = replay(buf, original)
-		return nil, true, nil
-	}
-
-	// The whole body is buffered, so the original is drained and can be closed.
-	// A close error on a drained read-only body does not invalidate the bytes.
-	_ = original.Close()
-	r.Body = io.NopCloser(bytes.NewReader(buf))
-	if r.ContentLength <= 0 {
-		// A chunked request now has a known length. Keep ContentLength and the
-		// header in agreement so the upstream request is framed consistently.
-		r.ContentLength = int64(len(buf))
-		r.Header.Set("Content-Length", strconv.Itoa(len(buf)))
-		r.Header.Del("Transfer-Encoding")
-		r.TransferEncoding = nil
-	}
-	return buf, false, nil
-}
-
-// replay returns a ReadCloser that yields the already-read prefix followed by
-// the remainder of the original stream, and closes the original.
-func replay(prefix []byte, rest io.ReadCloser) io.ReadCloser {
-	return struct {
-		io.Reader
-		io.Closer
-	}{
-		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
-		Closer: rest,
-	}
-}
-
-// formHasField reports whether body is a URL-encoded form carrying any of the
-// named fields. Used to keep credential submissions out of the mirrored
-// request: the proxy's own password / PIN login form posts to the service path,
-// so without this the plaintext credential would reach the Security Engine.
-func formHasField(contentType string, body []byte, fields []string) bool {
-	if len(fields) == 0 || len(body) == 0 {
-		return false
-	}
-	media, _, err := mime.ParseMediaType(contentType)
-	if err != nil || media != "application/x-www-form-urlencoded" {
-		return false
-	}
-	values, err := url.ParseQuery(string(body))
-	if err != nil {
-		// An unparsable form cannot be cleared as credential-free.
-		return true
-	}
-	for field := range values {
-		if slices.Contains(fields, field) {
-			return true
-		}
-	}
-	return false
-}

proxy/internal/appsec/client.go

@@ -1,339 +0,0 @@
-// Package appsec implements the CrowdSec AppSec (WAF) side of the remediation
-// component protocol: each inspected HTTP request is mirrored to the Security
-// Engine's AppSec endpoint, which replies with an allow / ban / captcha verdict
-// for that request.
-//
-// This is a separate endpoint from the LAPI decision stream used by the
-// crowdsec package: LAPI answers "is this IP known bad", AppSec answers "is
-// this request an attack". The two are configured and enabled independently.
-package appsec
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"strings"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/proxy/internal/restrict"
-)
-
-// Header names the AppSec component reads off the mirrored request. IP, URI and
-// Verb are mandatory: the engine answers 500 when any of them is missing.
-const (
-	headerAPIKey        = "X-Crowdsec-Appsec-Api-Key" //nolint:gosec // G101: a header name, not a credential
-	headerIP            = "X-Crowdsec-Appsec-Ip"
-	headerURI           = "X-Crowdsec-Appsec-Uri"
-	headerVerb          = "X-Crowdsec-Appsec-Verb"
-	headerHost          = "X-Crowdsec-Appsec-Host"
-	headerUserAgent     = "X-Crowdsec-Appsec-User-Agent"
-	headerHTTPVersion   = "X-Crowdsec-Appsec-Http-Version"
-	headerTransactionID = "X-Crowdsec-Appsec-Transaction-Id"
-)
-
-// headerPrefix covers every protocol header. Any client-supplied header in this
-// namespace is dropped before forwarding so a caller cannot influence the
-// engine's view of its own address, or replay an API key.
-const headerPrefix = "X-Crowdsec-Appsec-"
-
-// Remediation actions the engine can return.
-const (
-	actionAllow   = "allow"
-	actionBan     = "ban"
-	actionCaptcha = "captcha"
-)
-
-const (
-	// DefaultTimeout matches the 200ms budget CrowdSec's remediation component
-	// spec sets for the blocking AppSec call.
-	DefaultTimeout = 200 * time.Millisecond
-	// DefaultMaxBodyBytes caps the request body mirrored to the engine.
-	// Requests with a larger body are inspected on headers and URI only.
-	DefaultMaxBodyBytes int64 = 64 << 10
-)
-
-// ErrUnavailable reports that the engine could not produce a verdict: the call
-// failed, timed out, or the engine rejected it (401 bad key, 500 malformed).
-// Distinguished from a block verdict so the caller can apply the per-service
-// mode: enforce fails closed, observe allows.
-var ErrUnavailable = errors.New("appsec engine unavailable")
-
-// Config configures a Client.
-type Config struct {
-	// URL is the AppSec endpoint, e.g. http://127.0.0.1:7422/.
-	URL string
-	// APIKey is the CrowdSec bouncer API key. The AppSec component validates it
-	// against LAPI, so the same key used for the decision stream works here.
-	APIKey string
-	// Timeout bounds a single inspection call. Zero means DefaultTimeout.
-	Timeout time.Duration
-	// MaxBodyBytes caps the mirrored request body. Zero means
-	// DefaultMaxBodyBytes; negative disables body forwarding entirely.
-	MaxBodyBytes int64
-	Logger       *log.Entry
-}
-
-// Client mirrors HTTP requests to a CrowdSec AppSec endpoint. It holds no
-// per-service state and is safe for concurrent use.
-type Client struct {
-	url          string
-	apiKey       string
-	maxBodyBytes int64
-	http         *http.Client
-	logger       *log.Entry
-}
-
-// New validates the config and returns a Client. The endpoint is not contacted
-// here: the engine may come up after the proxy.
-func New(cfg Config) (*Client, error) {
-	if cfg.URL == "" {
-		return nil, errors.New("appsec url is empty")
-	}
-	if cfg.APIKey == "" {
-		return nil, errors.New("appsec api key is empty")
-	}
-	parsed, err := url.Parse(cfg.URL)
-	if err != nil {
-		return nil, fmt.Errorf("parse appsec url: %w", err)
-	}
-	if parsed.Scheme != "http" && parsed.Scheme != "https" {
-		return nil, fmt.Errorf("appsec url scheme %q is not http(s)", parsed.Scheme)
-	}
-	if parsed.Host == "" {
-		return nil, errors.New("appsec url has no host")
-	}
-
-	timeout := cfg.Timeout
-	if timeout <= 0 {
-		timeout = DefaultTimeout
-	}
-	maxBody := cfg.MaxBodyBytes
-	if maxBody == 0 {
-		maxBody = DefaultMaxBodyBytes
-	}
-	logger := cfg.Logger
-	if logger == nil {
-		logger = log.NewEntry(log.StandardLogger())
-	}
-
-	return &Client{
-		url:          cfg.URL,
-		apiKey:       cfg.APIKey,
-		maxBodyBytes: maxBody,
-		logger:       logger,
-		http: &http.Client{
-			Timeout: timeout,
-			Transport: &http.Transport{
-				MaxIdleConns:        100,
-				MaxIdleConnsPerHost: 32,
-				IdleConnTimeout:     90 * time.Second,
-			},
-		},
-	}, nil
-}
-
-// Request is one inspection request.
-type Request struct {
-	// HTTP is the in-flight client request. Inspect buffers and restores its
-	// body, so the request stays forwardable afterwards.
-	HTTP *http.Request
-	// ClientIP is the resolved client address (after trusted-proxy handling).
-	ClientIP netip.Addr
-	// TransactionID correlates the engine's alert with the proxy's access log
-	// entry. Empty lets the engine generate its own UUID.
-	TransactionID string
-	// OmitBodyFields suppresses body forwarding when the body is a form
-	// containing any of these field names. Used to keep credentials submitted
-	// to the proxy's own login form out of the engine.
-	OmitBodyFields []string
-}
-
-// Inspect mirrors r to the AppSec engine and returns its verdict. A nil error
-// with restrict.Allow means the request passed. On failure it returns
-// DenyAppSecUnavailable wrapped with ErrUnavailable; the caller decides whether
-// that blocks, based on the per-service mode.
-func (c *Client) Inspect(ctx context.Context, req Request) (restrict.Verdict, error) {
-	if c == nil {
-		return restrict.DenyAppSecUnavailable, ErrUnavailable
-	}
-	if req.HTTP == nil {
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: nil request", ErrUnavailable)
-	}
-
-	body, err := c.readBody(req)
-	if err != nil {
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: read body: %w", ErrUnavailable, err)
-	}
-
-	outbound, err := c.buildRequest(ctx, req, body)
-	if err != nil {
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: %w", ErrUnavailable, err)
-	}
-
-	resp, err := c.http.Do(outbound)
-	if err != nil {
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: %w", ErrUnavailable, err)
-	}
-	defer func() {
-		if err := resp.Body.Close(); err != nil {
-			c.logger.Tracef("close appsec response body: %v", err)
-		}
-	}()
-
-	return c.verdict(resp)
-}
-
-// readBody buffers the body so it can be mirrored, always restoring it on the
-// original request. Returns nil when there is no body to forward: no body at
-// all, an upgrade request, a body over the cap, or a credential form.
-func (c *Client) readBody(req Request) ([]byte, error) {
-	r := req.HTTP
-	if c.maxBodyBytes < 0 || r.Body == nil || r.Body == http.NoBody {
-		return nil, nil
-	}
-	// Upgrade requests (websockets) have no meaningful request body and their
-	// stream must not be consumed here.
-	if r.Header.Get("Upgrade") != "" || strings.EqualFold(r.Header.Get("Connection"), "upgrade") {
-		return nil, nil
-	}
-	// A Content-Length over the cap is known to be too large before reading.
-	if r.ContentLength > c.maxBodyBytes {
-		return nil, nil
-	}
-
-	body, oversize, err := bufferBody(r, c.maxBodyBytes)
-	if err != nil {
-		return nil, err
-	}
-	// An oversize body was only partially read: a truncated prefix changes the
-	// engine's verdict in both directions, so inspect headers and URI only.
-	if oversize {
-		return nil, nil
-	}
-	if formHasField(r.Header.Get("Content-Type"), body, req.OmitBodyFields) {
-		return nil, nil
-	}
-	return body, nil
-}
-
-// buildRequest assembles the mirrored request. Per the protocol it is a GET
-// when there is no body and a POST otherwise; bytes.Reader gives the outbound
-// request an accurate Content-Length, which the engine relies on to read the
-// body at all.
-func (c *Client) buildRequest(ctx context.Context, req Request, body []byte) (*http.Request, error) {
-	method := http.MethodGet
-	var payload io.Reader
-	if len(body) > 0 {
-		method = http.MethodPost
-		payload = bytes.NewReader(body)
-	}
-
-	outbound, err := http.NewRequestWithContext(ctx, method, c.url, payload)
-	if err != nil {
-		return nil, fmt.Errorf("build appsec request: %w", err)
-	}
-
-	r := req.HTTP
-	copyInspectableHeaders(outbound.Header, r.Header)
-
-	outbound.Header.Set(headerAPIKey, c.apiKey)
-	outbound.Header.Set(headerIP, req.ClientIP.Unmap().String())
-	outbound.Header.Set(headerURI, r.URL.RequestURI())
-	outbound.Header.Set(headerVerb, r.Method)
-	outbound.Header.Set(headerHost, r.Host)
-	if ua := r.UserAgent(); ua != "" {
-		outbound.Header.Set(headerUserAgent, ua)
-	}
-	outbound.Header.Set(headerHTTPVersion, httpVersion(r))
-	if req.TransactionID != "" {
-		outbound.Header.Set(headerTransactionID, req.TransactionID)
-	}
-	return outbound, nil
-}
-
-// verdict maps the engine's response to a restrict.Verdict. 200 is a pass and
-// 401/500 are engine-side failures; every other status carries a remediation in
-// the body. The blocked status code is operator-configurable
-// (blocked_http_code), so the action field decides, not the status.
-func (c *Client) verdict(resp *http.Response) (restrict.Verdict, error) {
-	switch resp.StatusCode {
-	case http.StatusOK:
-		return restrict.Allow, nil
-	case http.StatusUnauthorized:
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: rejected api key", ErrUnavailable)
-	case http.StatusInternalServerError:
-		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: engine error", ErrUnavailable)
-	}
-
-	var decoded struct {
-		Action string `json:"action"`
-	}
-	if err := json.NewDecoder(io.LimitReader(resp.Body, 4<<10)).Decode(&decoded); err != nil {
-		// A non-2xx status with an unreadable body is still a block: the engine
-		// answered, we just cannot tell which remediation it chose.
-		c.logger.Debugf("failed to decode appsec response (status %d): %v", resp.StatusCode, err)
-		return restrict.DenyAppSecBan, nil
-	}
-
-	switch decoded.Action {
-	case actionAllow:
-		return restrict.Allow, nil
-	case actionCaptcha:
-		return restrict.DenyAppSecCaptcha, nil
-	case actionBan:
-		return restrict.DenyAppSecBan, nil
-	default:
-		// Unknown remediation: the engine flagged the request, so deny.
-		c.logger.Debugf("unknown appsec action %q (status %d), treating as ban", decoded.Action, resp.StatusCode)
-		return restrict.DenyAppSecBan, nil
-	}
-}
-
-// copyInspectableHeaders copies the client's headers, which are what the WAF
-// rules actually match on, dropping hop-by-hop headers that describe the
-// proxy-to-engine connection rather than the client request, and any header in
-// the AppSec protocol namespace.
-func copyInspectableHeaders(dst, src http.Header) {
-	for name, values := range src {
-		if hopByHopHeaders[http.CanonicalHeaderKey(name)] {
-			continue
-		}
-		if strings.HasPrefix(http.CanonicalHeaderKey(name), headerPrefix) {
-			continue
-		}
-		dst[http.CanonicalHeaderKey(name)] = append([]string(nil), values...)
-	}
-	// Content-Length describes the mirrored payload, not the client's: net/http
-	// sets it from the body we actually attach. Content-Type is kept either way
-	// so rules matching on it still fire when the body was not forwarded.
-	dst.Del("Content-Length")
-}
-
-var hopByHopHeaders = map[string]bool{
-	"Connection":          true,
-	"Keep-Alive":          true,
-	"Proxy-Authenticate":  true,
-	"Proxy-Authorization": true,
-	"Proxy-Connection":    true,
-	"Te":                  true,
-	"Trailer":             true,
-	"Transfer-Encoding":   true,
-	"Upgrade":             true,
-}
-
-// httpVersion renders the two-digit form the engine parses ("11", "20").
-func httpVersion(r *http.Request) string {
-	major, minor := r.ProtoMajor, r.ProtoMinor
-	if major < 0 || major > 9 || minor < 0 || minor > 9 {
-		return ""
-	}
-	return fmt.Sprintf("%d%d", major, minor)
-}

proxy/internal/appsec/client_test.go

@@ -1,416 +0,0 @@
-package appsec
-
-import (
-	"context"
-	"errors"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"net/netip"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/restrict"
-)
-
-// engine records what the AppSec component received and replies with a
-// canned status and body.
-type engine struct {
-	status int
-	body   string
-
-	gotMethod string
-	gotHeader http.Header
-	gotBody   []byte
-	gotLength int64
-	requests  int
-}
-
-func (e *engine) start(t *testing.T) *httptest.Server {
-	t.Helper()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		require.NoError(t, err)
-		e.requests++
-		e.gotMethod = r.Method
-		e.gotHeader = r.Header.Clone()
-		e.gotBody = body
-		e.gotLength = r.ContentLength
-
-		status := e.status
-		if status == 0 {
-			status = http.StatusOK
-		}
-		w.WriteHeader(status)
-		if e.body != "" {
-			_, _ = w.Write([]byte(e.body))
-		}
-	}))
-	t.Cleanup(srv.Close)
-	return srv
-}
-
-func newClient(t *testing.T, url string, cfg ...func(*Config)) *Client {
-	t.Helper()
-	c := Config{URL: url, APIKey: "test-key"}
-	for _, fn := range cfg {
-		fn(&c)
-	}
-	client, err := New(c)
-	require.NoError(t, err)
-	return client
-}
-
-func inbound(method, target string, body string) *http.Request {
-	var r *http.Request
-	if body == "" {
-		r = httptest.NewRequest(method, target, nil)
-	} else {
-		r = httptest.NewRequest(method, target, strings.NewReader(body))
-	}
-	r.Host = "svc.example.com"
-	r.Header.Set("User-Agent", "curl/8.0")
-	return r
-}
-
-func TestNew_RejectsBadConfig(t *testing.T) {
-	tests := []struct {
-		name string
-		cfg  Config
-	}{
-		{"empty url", Config{APIKey: "k"}},
-		{"empty key", Config{URL: "http://127.0.0.1:7422/"}},
-		{"non http scheme", Config{URL: "tcp://127.0.0.1:7422", APIKey: "k"}},
-		{"no host", Config{URL: "http:///path", APIKey: "k"}},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			_, err := New(tt.cfg)
-			require.Error(t, err)
-		})
-	}
-}
-
-func TestInspect_AllowSendsProtocolHeaders(t *testing.T) {
-	eng := &engine{status: http.StatusOK, body: `{"action":"allow","http_status":200}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL)
-
-	r := inbound(http.MethodGet, "http://svc.example.com/admin?q=1", "")
-	r.Header.Set("Cookie", "session=abc")
-
-	verdict, err := client.Inspect(context.Background(), Request{
-		HTTP:          r,
-		ClientIP:      netip.MustParseAddr("203.0.113.7"),
-		TransactionID: "req-42",
-	})
-	require.NoError(t, err)
-	assert.Equal(t, restrict.Allow, verdict, "allow action must pass the request")
-
-	assert.Equal(t, http.MethodGet, eng.gotMethod, "a bodyless request is forwarded as GET")
-	assert.Equal(t, "203.0.113.7", eng.gotHeader.Get(headerIP))
-	assert.Equal(t, "/admin?q=1", eng.gotHeader.Get(headerURI), "URI header must carry path and query")
-	assert.Equal(t, http.MethodGet, eng.gotHeader.Get(headerVerb))
-	assert.Equal(t, "svc.example.com", eng.gotHeader.Get(headerHost))
-	assert.Equal(t, "curl/8.0", eng.gotHeader.Get(headerUserAgent))
-	assert.Equal(t, "11", eng.gotHeader.Get(headerHTTPVersion))
-	assert.Equal(t, "req-42", eng.gotHeader.Get(headerTransactionID))
-	assert.Equal(t, "test-key", eng.gotHeader.Get(headerAPIKey))
-	// Client headers are what the WAF rules match on.
-	assert.Equal(t, "session=abc", eng.gotHeader.Get("Cookie"))
-}
-
-func TestInspect_MapsActionsToVerdicts(t *testing.T) {
-	tests := []struct {
-		name    string
-		status  int
-		body    string
-		want    restrict.Verdict
-		wantErr bool
-	}{
-		{"allow", http.StatusOK, `{"action":"allow"}`, restrict.Allow, false},
-		{"ban", http.StatusForbidden, `{"action":"ban","http_status":403}`, restrict.DenyAppSecBan, false},
-		{"captcha", http.StatusForbidden, `{"action":"captcha","http_status":403}`, restrict.DenyAppSecCaptcha, false},
-		// blocked_http_code is operator-configurable, so the action decides.
-		{"custom block status", http.StatusTeapot, `{"action":"ban"}`, restrict.DenyAppSecBan, false},
-		{"allow on custom status", http.StatusTeapot, `{"action":"allow"}`, restrict.Allow, false},
-		{"unknown action denies", http.StatusForbidden, `{"action":"something-new"}`, restrict.DenyAppSecBan, false},
-		{"unreadable body denies", http.StatusForbidden, `not json`, restrict.DenyAppSecBan, false},
-		{"bad api key is unavailable", http.StatusUnauthorized, "", restrict.DenyAppSecUnavailable, true},
-		{"engine error is unavailable", http.StatusInternalServerError, "", restrict.DenyAppSecUnavailable, true},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			eng := &engine{status: tt.status, body: tt.body}
-			srv := eng.start(t)
-			client := newClient(t, srv.URL)
-
-			verdict, err := client.Inspect(context.Background(), Request{
-				HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
-				ClientIP: netip.MustParseAddr("203.0.113.7"),
-			})
-			if tt.wantErr {
-				require.Error(t, err)
-				assert.True(t, errors.Is(err, ErrUnavailable), "engine-side failures must be ErrUnavailable so the caller can apply the mode")
-			} else {
-				require.NoError(t, err)
-			}
-			assert.Equal(t, tt.want, verdict)
-		})
-	}
-}
-
-func TestInspect_ForwardsBodyAndRestoresIt(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL)
-
-	const payload = `{"user":"' OR 1=1--"}`
-	r := inbound(http.MethodPost, "http://svc.example.com/login", payload)
-	r.Header.Set("Content-Type", "application/json")
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:     r,
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.NoError(t, err)
-
-	assert.Equal(t, http.MethodPost, eng.gotMethod, "a request with a body is forwarded as POST")
-	assert.Equal(t, payload, string(eng.gotBody))
-	assert.Equal(t, int64(len(payload)), eng.gotLength,
-		"the engine reads exactly Content-Length bytes, so it must be accurate")
-
-	// The backend still needs the body.
-	restored, err := io.ReadAll(r.Body)
-	require.NoError(t, err)
-	assert.Equal(t, payload, string(restored), "body must be restored for the upstream request")
-}
-
-func TestInspect_OversizeBodyFallsBackToHeaders(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL, func(c *Config) { c.MaxBodyBytes = 16 })
-
-	payload := strings.Repeat("A", 64)
-	r := inbound(http.MethodPost, "http://svc.example.com/upload", payload)
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:     r,
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.NoError(t, err)
-
-	assert.Equal(t, http.MethodGet, eng.gotMethod, "an oversize body is not forwarded")
-	assert.Empty(t, eng.gotBody, "a truncated prefix must never be sent: it changes the verdict")
-
-	restored, err := io.ReadAll(r.Body)
-	require.NoError(t, err)
-	assert.Equal(t, payload, string(restored), "the full body must still reach the upstream")
-}
-
-func TestInspect_ChunkedOversizeBodyIsReplayed(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL, func(c *Config) { c.MaxBodyBytes = 8 })
-
-	payload := strings.Repeat("B", 40)
-	r := inbound(http.MethodPost, "http://svc.example.com/upload", payload)
-	// Unknown length: the cap can only be detected while reading.
-	r.ContentLength = -1
-	r.Header.Del("Content-Length")
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:     r,
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.NoError(t, err)
-
-	assert.Empty(t, eng.gotBody)
-	restored, err := io.ReadAll(r.Body)
-	require.NoError(t, err)
-	assert.Equal(t, payload, string(restored), "bytes read to detect the cap must be replayed")
-}
-
-func TestInspect_SkipsCredentialForm(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL)
-
-	r := inbound(http.MethodPost, "http://svc.example.com/", "password=hunter2&next=%2Fhome")
-	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:           r,
-		ClientIP:       netip.MustParseAddr("203.0.113.7"),
-		OmitBodyFields: []string{"password", "pin"},
-	})
-	require.NoError(t, err)
-
-	assert.Empty(t, eng.gotBody, "a login form body must not reach the engine")
-	assert.NotContains(t, string(eng.gotBody), "hunter2")
-	// The request is still inspected on headers and URI.
-	assert.Equal(t, 1, eng.requests)
-
-	restored, err := io.ReadAll(r.Body)
-	require.NoError(t, err)
-	assert.Equal(t, "password=hunter2&next=%2Fhome", string(restored),
-		"the login handler still needs to read the form")
-}
-
-func TestInspect_ForwardsNonCredentialForm(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL)
-
-	r := inbound(http.MethodPost, "http://svc.example.com/search", "q=%3Cscript%3E")
-	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:           r,
-		ClientIP:       netip.MustParseAddr("203.0.113.7"),
-		OmitBodyFields: []string{"password", "pin"},
-	})
-	require.NoError(t, err)
-	assert.Equal(t, "q=%3Cscript%3E", string(eng.gotBody), "ordinary form bodies must be inspected")
-}
-
-func TestInspect_StripsSpoofedProtocolHeaders(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL)
-
-	r := inbound(http.MethodGet, "http://svc.example.com/", "")
-	// A caller trying to make the engine see a different source address, and to
-	// smuggle in its own key.
-	r.Header.Set(headerIP, "10.0.0.1")
-	r.Header.Set(headerAPIKey, "attacker-key")
-	r.Header.Set(headerURI, "/harmless")
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:     r,
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.NoError(t, err)
-
-	assert.Equal(t, "203.0.113.7", eng.gotHeader.Get(headerIP), "the proxy's resolved IP must win")
-	assert.Equal(t, "test-key", eng.gotHeader.Get(headerAPIKey))
-	assert.Equal(t, "/", eng.gotHeader.Get(headerURI))
-	assert.Len(t, eng.gotHeader.Values(headerIP), 1, "no duplicate protocol headers")
-}
-
-func TestInspect_DropsHopByHopHeaders(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL)
-
-	r := inbound(http.MethodGet, "http://svc.example.com/", "")
-	r.Header.Set("Proxy-Authorization", "Basic zzz")
-	r.Header.Set("Keep-Alive", "timeout=5")
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:     r,
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.NoError(t, err)
-
-	assert.Empty(t, eng.gotHeader.Get("Proxy-Authorization"))
-	assert.Empty(t, eng.gotHeader.Get("Keep-Alive"))
-}
-
-func TestInspect_UpgradeRequestKeepsStreamIntact(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL)
-
-	r := inbound(http.MethodGet, "http://svc.example.com/ws", "")
-	r.Header.Set("Upgrade", "websocket")
-	r.Header.Set("Connection", "upgrade")
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:     r,
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.NoError(t, err)
-	assert.Equal(t, http.MethodGet, eng.gotMethod)
-	assert.Empty(t, eng.gotBody)
-	assert.Equal(t, 1, eng.requests, "upgrade requests are still inspected on headers")
-}
-
-func TestInspect_TimeoutIsUnavailable(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		time.Sleep(200 * time.Millisecond)
-		w.WriteHeader(http.StatusOK)
-	}))
-	t.Cleanup(srv.Close)
-
-	client := newClient(t, srv.URL, func(c *Config) { c.Timeout = 10 * time.Millisecond })
-
-	verdict, err := client.Inspect(context.Background(), Request{
-		HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.Error(t, err)
-	assert.True(t, errors.Is(err, ErrUnavailable))
-	assert.Equal(t, restrict.DenyAppSecUnavailable, verdict)
-}
-
-func TestInspect_UnreachableEngineIsUnavailable(t *testing.T) {
-	// Port 1 on loopback refuses connections.
-	client := newClient(t, "http://127.0.0.1:1/")
-
-	verdict, err := client.Inspect(context.Background(), Request{
-		HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.Error(t, err)
-	assert.True(t, errors.Is(err, ErrUnavailable))
-	assert.Equal(t, restrict.DenyAppSecUnavailable, verdict)
-}
-
-func TestInspect_NilClientFailsClosed(t *testing.T) {
-	var client *Client
-	verdict, err := client.Inspect(context.Background(), Request{
-		HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.Error(t, err)
-	assert.Equal(t, restrict.DenyAppSecUnavailable, verdict)
-}
-
-func TestInspect_NegativeCapDisablesBodyForwarding(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL, func(c *Config) { c.MaxBodyBytes = -1 })
-
-	const payload = `{"a":1}`
-	r := inbound(http.MethodPost, "http://svc.example.com/", payload)
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:     r,
-		ClientIP: netip.MustParseAddr("203.0.113.7"),
-	})
-	require.NoError(t, err)
-	assert.Empty(t, eng.gotBody)
-
-	restored, err := io.ReadAll(r.Body)
-	require.NoError(t, err)
-	assert.Equal(t, payload, string(restored), "an untouched body must still be forwardable")
-}
-
-func TestInspect_MapsV4MappedClientIP(t *testing.T) {
-	eng := &engine{body: `{"action":"allow"}`}
-	srv := eng.start(t)
-	client := newClient(t, srv.URL)
-
-	_, err := client.Inspect(context.Background(), Request{
-		HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
-		ClientIP: netip.MustParseAddr("::ffff:203.0.113.7"),
-	})
-	require.NoError(t, err)
-	assert.Equal(t, "203.0.113.7", eng.gotHeader.Get(headerIP),
-		"v4-mapped addresses must be unmapped so engine allowlists and rules match")
-}

proxy/internal/auth/appsec_test.go

@@ -1,179 +0,0 @@
-package auth
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/proxy/internal/appsec"
-	"github.com/netbirdio/netbird/proxy/internal/proxy"
-	"github.com/netbirdio/netbird/proxy/internal/restrict"
-	"github.com/netbirdio/netbird/proxy/internal/types"
-)
-
-// appsecEngine is a stub AppSec component returning a fixed remediation.
-func appsecEngine(t *testing.T, status int, body string) *httptest.Server {
-	t.Helper()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		_, _ = strings.NewReader("").Read(nil)
-		defer func() { _ = r.Body.Close() }()
-		w.WriteHeader(status)
-		if body != "" {
-			_, _ = w.Write([]byte(body))
-		}
-	}))
-	t.Cleanup(srv.Close)
-	return srv
-}
-
-// serveWithAppSec runs a request through the middleware for a domain configured
-// with the given AppSec mode, returning the response and the captured metadata.
-func serveWithAppSec(t *testing.T, mode restrict.AppSecMode, client *appsec.Client, r *http.Request) (*httptest.ResponseRecorder, map[string]string, bool) {
-	t.Helper()
-
-	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	mw.SetAppSec(client)
-	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
-		AccountID:  types.AccountID("acct-1"),
-		ServiceID:  types.ServiceID("svc-1"),
-		AppSecMode: mode,
-	}))
-
-	reached := false
-	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		reached = true
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	cd := proxy.NewCapturedData("req-1")
-	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, r)
-
-	return rec, cd.GetMetadata(), reached
-}
-
-func appsecRequest() *http.Request {
-	r := httptest.NewRequest(http.MethodGet, "http://svc.example.com/?x=/etc/passwd", nil)
-	r.Host = "svc.example.com"
-	r.RemoteAddr = "203.0.113.7:44444"
-	return r
-}
-
-func TestCheckAppSec_EnforceBlocksBannedRequest(t *testing.T) {
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
-
-	assert.Equal(t, http.StatusForbidden, rec.Code)
-	assert.False(t, reached, "a banned request must not reach the backend")
-	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
-	assert.NotContains(t, meta, "appsec_mode", "enforce is the default, only observe is annotated")
-}
-
-func TestCheckAppSec_ObserveAllowsAndRecordsVerdict(t *testing.T) {
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, client, appsecRequest())
-
-	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.True(t, reached, "observe mode must not block")
-	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
-	assert.Equal(t, "observe", meta["appsec_mode"])
-}
-
-func TestCheckAppSec_AllowedRequestPasses(t *testing.T) {
-	srv := appsecEngine(t, http.StatusOK, `{"action":"allow","http_status":200}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
-
-	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.True(t, reached)
-	assert.NotContains(t, meta, "appsec_verdict", "a clean request records no verdict")
-}
-
-func TestCheckAppSec_OffSkipsInspection(t *testing.T) {
-	// An engine that would ban everything; the mode must keep us away from it.
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecOff, client, appsecRequest())
-
-	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.True(t, reached)
-	assert.Empty(t, meta)
-}
-
-func TestCheckAppSec_EnforceFailsClosedWithoutClient(t *testing.T) {
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, nil, appsecRequest())
-
-	assert.Equal(t, http.StatusForbidden, rec.Code,
-		"enforce with no configured endpoint must deny rather than pass traffic uninspected")
-	assert.False(t, reached)
-	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
-}
-
-func TestCheckAppSec_ObserveAllowsWithoutClient(t *testing.T) {
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, nil, appsecRequest())
-
-	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.True(t, reached)
-	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
-	assert.Equal(t, "observe", meta["appsec_mode"])
-}
-
-func TestCheckAppSec_EnforceFailsClosedWhenEngineUnreachable(t *testing.T) {
-	client, err := appsec.New(appsec.Config{URL: "http://127.0.0.1:1/", APIKey: "k"})
-	require.NoError(t, err)
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
-
-	assert.Equal(t, http.StatusForbidden, rec.Code)
-	assert.False(t, reached)
-	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
-}
-
-func TestCheckAppSec_InspectsOverlayTraffic(t *testing.T) {
-	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	// Requests arriving over the WireGuard overlay skip the geo and IP-reputation
-	// checks, but request content is just as inspectable.
-	r := appsecRequest()
-	r = r.WithContext(types.WithOverlayOrigin(r.Context()))
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
-
-	assert.Equal(t, http.StatusForbidden, rec.Code, "overlay traffic must still be inspected")
-	assert.False(t, reached)
-	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
-}
-
-func TestCheckAppSec_UnresolvableClientIPFailsClosed(t *testing.T) {
-	srv := appsecEngine(t, http.StatusOK, `{"action":"allow"}`)
-	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
-	require.NoError(t, err)
-
-	r := appsecRequest()
-	r.RemoteAddr = "not-an-address"
-
-	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
-
-	assert.Equal(t, http.StatusForbidden, rec.Code,
-		"the engine requires a client address; a request we cannot attribute must not pass")
-	assert.False(t, reached)
-	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
-}

proxy/internal/auth/middleware.go

@@ -18,7 +18,6 @@ import (
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/proxy/auth"
-	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/proxy"
 	"github.com/netbirdio/netbird/proxy/internal/restrict"
 	"github.com/netbirdio/netbird/proxy/internal/types"
@@ -60,8 +59,6 @@ type DomainConfig struct {
 	IPRestrictions    *restrict.Filter
 	// Private routes the domain through ValidateTunnelPeer; failure → 403.
 	Private bool
-	// AppSecMode enables CrowdSec AppSec request inspection for this domain.
-	AppSecMode restrict.AppSecMode
 }
 
 type validationResult struct {
@@ -85,9 +82,6 @@ type Middleware struct {
 	sessionValidator SessionValidator
 	geo              restrict.GeoResolver
 	tunnelCache      *tunnelValidationCache
-	// appsec is the shared CrowdSec AppSec client, nil when the proxy has no
-	// AppSec endpoint configured. Set once during startup, before serving.
-	appsec *appsec.Client
 }
 
 // NewMiddleware creates a new authentication middleware. The sessionValidator is
@@ -105,12 +99,6 @@ func NewMiddleware(logger *log.Logger, sessionValidator SessionValidator, geo re
 	}
 }
 
-// SetAppSec installs the shared CrowdSec AppSec client. Must be called during
-// startup, before the middleware serves any request.
-func (mw *Middleware) SetAppSec(client *appsec.Client) {
-	mw.appsec = client
-}
-
 // Protect wraps next with per-domain authentication and IP restriction checks.
 // Requests whose Host is not registered pass through unchanged.
 func (mw *Middleware) Protect(next http.Handler) http.Handler {
@@ -135,10 +123,6 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 			return
 		}
 
-		if !mw.checkAppSec(w, r, config) {
-			return
-		}
-
 		// Private services bypass operator schemes and gate on tunnel peer.
 		if config.Private {
 			if mw.forwardWithTunnelPeer(w, r, host, config, next) {
@@ -278,93 +262,6 @@ func (mw *Middleware) checkIPRestrictions(w http.ResponseWriter, r *http.Request
 	return false
 }
 
-// checkAppSec mirrors the request to the CrowdSec AppSec engine when the domain
-// enables inspection. Returns false when the request was blocked and a response
-// has been written.
-//
-// Unlike the geo and IP-reputation checks, this runs for overlay traffic too:
-// AppSec inspects request content, which is just as meaningful when the caller
-// reached the proxy through the WireGuard tunnel.
-func (mw *Middleware) checkAppSec(w http.ResponseWriter, r *http.Request, config DomainConfig) bool {
-	if !config.AppSecMode.Enabled() {
-		return true
-	}
-
-	verdict := mw.inspectAppSec(r, config)
-	if verdict == restrict.Allow {
-		return true
-	}
-
-	observe := config.AppSecMode == restrict.AppSecObserve
-	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
-		cd.SetMetadata("appsec_verdict", verdict.String())
-		if observe {
-			cd.SetMetadata("appsec_mode", "observe")
-		}
-	}
-
-	if observe {
-		mw.logger.Debugf("AppSec observe: would block %s for %s (%s)", r.RemoteAddr, r.Host, verdict)
-		return true
-	}
-
-	mw.markDenied(r, verdict.String())
-	mw.logger.Debugf("AppSec: %s for %s %s", verdict, r.Host, r.RemoteAddr)
-	http.Error(w, "Forbidden", http.StatusForbidden)
-	return false
-}
-
-// inspectAppSec runs the AppSec call and returns its verdict. Failures come
-// back as DenyAppSecUnavailable regardless of mode so observe mode still
-// records that inspection did not happen; the caller decides what blocks.
-func (mw *Middleware) inspectAppSec(r *http.Request, config DomainConfig) restrict.Verdict {
-	// Mode requested but the proxy has no AppSec endpoint configured. Management
-	// gates this on the cluster capability; a stale mapping can still arrive.
-	if mw.appsec == nil {
-		mw.logger.Debugf("AppSec mode %q requested for %s but no AppSec endpoint is configured", config.AppSecMode, r.Host)
-		return restrict.DenyAppSecUnavailable
-	}
-
-	clientIP := mw.resolveClientIP(r)
-	if !clientIP.IsValid() {
-		// The engine requires a client address, and a request whose source we
-		// cannot establish is exactly the kind we must not wave through.
-		mw.logger.Debugf("AppSec: cannot resolve client address for %q", r.RemoteAddr)
-		return restrict.DenyAppSecUnavailable
-	}
-
-	req := appsec.Request{
-		HTTP:           r,
-		ClientIP:       clientIP,
-		OmitBodyFields: credentialFormFields(config.Schemes),
-	}
-	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
-		req.TransactionID = cd.GetRequestID()
-	}
-
-	verdict, err := mw.appsec.Inspect(r.Context(), req)
-	if err != nil {
-		mw.logger.Debugf("AppSec inspection failed for %s: %v", r.Host, err)
-	}
-	return verdict
-}
-
-// credentialFormFields lists the login form fields whose presence suppresses
-// body forwarding, so a password or PIN submitted to the proxy's own login form
-// never reaches the Security Engine.
-func credentialFormFields(schemes []Scheme) []string {
-	var fields []string
-	for _, s := range schemes {
-		switch s.Type() {
-		case auth.MethodPassword:
-			fields = append(fields, passwordFormId)
-		case auth.MethodPIN:
-			fields = append(fields, pinFormId)
-		}
-	}
-	return fields
-}
-
 // resolveClientIP extracts the real client IP from CapturedData, falling back to r.RemoteAddr.
 func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
@@ -384,18 +281,12 @@ func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	return addr.Unmap()
 }
 
-// markDenied records the deny reason on the captured data so the access log
-// attributes the response to the proxy rather than the backend.
-func (mw *Middleware) markDenied(r *http.Request, reason string) {
+// blockIPRestriction sets captured data fields for an IP-restriction block event.
+func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
 		cd.SetOrigin(proxy.OriginAuth)
 		cd.SetAuthMethod(reason)
 	}
-}
-
-// blockIPRestriction sets captured data fields for an IP-restriction block event.
-func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
-	mw.markDenied(r, reason)
 	mw.logger.Debugf("IP restriction: %s for %s", reason, r.RemoteAddr)
 }
 
@@ -751,49 +642,40 @@ func wasCredentialSubmitted(r *http.Request, method auth.Method) bool {
 	return false
 }
 
-// DomainSettings is the per-domain configuration AddDomain applies.
-type DomainSettings struct {
-	Schemes []Scheme
-	// SessionPublicKey is the base64-encoded ed25519 key used to verify session
-	// cookies. Required when Schemes is non-empty.
-	SessionPublicKey  string
-	SessionExpiration time.Duration
-	AccountID         types.AccountID
-	ServiceID         types.ServiceID
-	IPRestrictions    *restrict.Filter
-	// Private forces ValidateTunnelPeer enforcement (403 on failure) regardless
-	// of the schemes list.
-	Private    bool
-	AppSecMode restrict.AppSecMode
-}
-
-// AddDomain registers authentication schemes for the given domain. With schemes
-// a valid session public key is required.
-func (mw *Middleware) AddDomain(domain string, settings DomainSettings) error {
-	config := DomainConfig{
-		AccountID:      settings.AccountID,
-		ServiceID:      settings.ServiceID,
-		IPRestrictions: settings.IPRestrictions,
-		Private:        settings.Private,
-		AppSecMode:     settings.AppSecMode,
+// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
+// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
+func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool) error {
+	if len(schemes) == 0 {
+		mw.domainsMux.Lock()
+		defer mw.domainsMux.Unlock()
+		mw.domains[domain] = DomainConfig{
+			AccountID:      accountID,
+			ServiceID:      serviceID,
+			IPRestrictions: ipRestrictions,
+			Private:        private,
+		}
+		return nil
 	}
 
-	if len(settings.Schemes) > 0 {
-		pubKeyBytes, err := base64.StdEncoding.DecodeString(settings.SessionPublicKey)
-		if err != nil {
-			return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
-		}
-		if len(pubKeyBytes) != ed25519.PublicKeySize {
-			return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
-		}
-		config.Schemes = settings.Schemes
-		config.SessionPublicKey = pubKeyBytes
-		config.SessionExpiration = settings.SessionExpiration
+	pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
+	if err != nil {
+		return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
+	}
+	if len(pubKeyBytes) != ed25519.PublicKeySize {
+		return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
 	}
 
 	mw.domainsMux.Lock()
 	defer mw.domainsMux.Unlock()
-	mw.domains[domain] = config
+	mw.domains[domain] = DomainConfig{
+		Schemes:           schemes,
+		SessionPublicKey:  pubKeyBytes,
+		SessionExpiration: expiration,
+		AccountID:         accountID,
+		ServiceID:         serviceID,
+		IPRestrictions:    ipRestrictions,
+		Private:           private,
+	}
 	return nil
 }
 

proxy/internal/auth/middleware_test.go

@@ -64,7 +64,7 @@ func TestAddDomain_ValidKey(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false)
 	require.NoError(t, err)
 
 	mw.domainsMux.RLock()
@@ -81,7 +81,7 @@ func TestAddDomain_EmptyKey(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "", time.Hour, "", "", nil, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -95,7 +95,7 @@ func TestAddDomain_InvalidBase64(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "not-valid-base64!!!", SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "not-valid-base64!!!", time.Hour, "", "", nil, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "decode session public key")
 
@@ -110,7 +110,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 
 	shortKey := base64.StdEncoding.EncodeToString([]byte("tooshort"))
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: shortKey, SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, shortKey, time.Hour, "", "", nil, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -123,7 +123,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 func TestAddDomain_NoSchemes_NoKeyRequired(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false)
 	require.NoError(t, err, "domains with no auth schemes should not require a key")
 
 	mw.domainsMux.RLock()
@@ -139,8 +139,8 @@ func TestAddDomain_OverwritesPreviousConfig(t *testing.T) {
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp2.PublicKey, SessionExpiration: 2 * time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp2.PublicKey, 2*time.Hour, "", "", nil, false))
 
 	mw.domainsMux.RLock()
 	config := mw.domains["example.com"]
@@ -156,7 +156,7 @@ func TestRemoveDomain(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	mw.RemoveDomain("example.com")
 
@@ -180,7 +180,7 @@ func TestProtect_UnknownDomainPassesThrough(t *testing.T) {
 
 func TestProtect_DomainWithNoSchemesPassesThrough(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -197,7 +197,7 @@ func TestProtect_UnauthenticatedRequestIsBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -218,7 +218,7 @@ func TestProtect_HostWithPortIsMatched(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -239,7 +239,7 @@ func TestProtect_ValidSessionCookiePassesThrough(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
 	require.NoError(t, err)
@@ -272,7 +272,7 @@ func TestProtect_SessionCookieGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	groups := []string{"engineering", "sre"}
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, groups, nil, time.Hour)
@@ -337,7 +337,7 @@ func TestProtect_PrivateService_TunnelPeerGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	// Private service: no operator schemes — auth gates solely on the tunnel peer.
-	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
+	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14")) // CGNAT tunnel source
@@ -377,7 +377,7 @@ func TestProtect_PrivateService_TunnelPeerDenied(t *testing.T) {
 	}}
 	mw := NewMiddleware(log.StandardLogger(), validator, nil)
 	kp := generateTestKeyPair(t)
-	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
+	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14"))
@@ -405,7 +405,7 @@ func TestProtect_ExpiredSessionCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	// Sign a token that expired 1 second ago.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, -time.Second)
@@ -431,7 +431,7 @@ func TestProtect_WrongDomainCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	// Token signed for a different domain audience.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "other.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -458,7 +458,7 @@ func TestProtect_WrongKeyCookieIsRejected(t *testing.T) {
 	kp2 := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
 
 	// Token signed with a different private key.
 	token, err := sessionkey.SignToken(kp2.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -495,7 +495,7 @@ func TestProtect_SchemeAuthRedirectsWithCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -548,7 +548,7 @@ func TestProtect_FailedAuthDoesNotSetCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -584,7 +584,7 @@ func TestProtect_MultipleSchemes(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{pinScheme, passwordScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{pinScheme, passwordScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -614,7 +614,7 @@ func TestProtect_InvalidTokenFromSchemeReturns400(t *testing.T) {
 			return "invalid-jwt-token", "", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -638,7 +638,7 @@ func TestAddDomain_RandomBytes32NotEd25519(t *testing.T) {
 	key := base64.StdEncoding.EncodeToString(randomBytes)
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	err = mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: key, SessionExpiration: time.Hour})
+	err = mw.AddDomain("example.com", []Scheme{scheme}, key, time.Hour, "", "", nil, false)
 	require.NoError(t, err, "any 32-byte key should be accepted at registration time")
 }
 
@@ -647,10 +647,10 @@ func TestAddDomain_InvalidKeyDoesNotCorruptExistingConfig(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	// Attempt to overwrite with an invalid key.
-	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "bad", SessionExpiration: time.Hour})
+	err := mw.AddDomain("example.com", []Scheme{scheme}, "bad", time.Hour, "", "", nil, false)
 	require.Error(t, err)
 
 	// The original valid config should still be intact.
@@ -674,7 +674,7 @@ func TestProtect_FailedPinAuthCapturesAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -701,7 +701,7 @@ func TestProtect_FailedPasswordAuthCapturesAuthMethod(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -728,7 +728,7 @@ func TestProtect_NoCredentialsDoesNotCaptureAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -815,7 +815,8 @@ func TestWasCredentialSubmitted(t *testing.T) {
 func TestCheckIPRestrictions_UnparseableAddress(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -850,7 +851,8 @@ func TestCheckIPRestrictions_UsesCapturedDataClientIP(t *testing.T) {
 	// trusted proxies), checkIPRestrictions should use that IP, not RemoteAddr.
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -890,7 +892,8 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 	// Geo is nil, country restrictions are configured: must deny (fail-close).
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -913,10 +916,11 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{
-		AllowedCIDRs:     []string{"100.64.0.0/10"},
-		AllowedCountries: []string{"US"},
-	})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{
+			AllowedCIDRs:     []string{"100.64.0.0/10"},
+			AllowedCountries: []string{"US"},
+		}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -949,7 +953,8 @@ func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginRespectsCIDR(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}})})
+	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
+		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}}), false)
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -977,7 +982,7 @@ func TestProtect_OIDCOnlyRedirectsDirectly(t *testing.T) {
 			return "", oidcURL, nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1006,7 +1011,7 @@ func TestProtect_OIDCWithOtherMethodShowsLoginPage(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{oidcScheme, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidcScheme, pinScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1050,7 +1055,7 @@ func TestProtect_HeaderAuth_ForwardsOnSuccess(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	var backendCalled bool
 	capturedData := proxy.NewCapturedData("")
@@ -1093,7 +1098,7 @@ func TestProtect_HeaderAuth_MissingHeaderFallsThrough(t *testing.T) {
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
 	// Also add a PIN scheme so we can verify fallthrough behavior.
 	pinScheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr, pinScheme}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1113,7 +1118,7 @@ func TestProtect_HeaderAuth_WrongValueReturns401(t *testing.T) {
 		return &proto.AuthenticateResponse{Success: false}, nil
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -1136,7 +1141,7 @@ func TestProtect_HeaderAuth_InfraErrorReturns502(t *testing.T) {
 		return nil, errors.New("gRPC unavailable")
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1153,7 +1158,7 @@ func TestProtect_HeaderAuth_SubsequentRequestUsesSessionCookie(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -1213,7 +1218,7 @@ func TestProtect_HeaderAuth_MultipleValuesSameHeader(t *testing.T) {
 
 	// Single Header scheme (as if one entry existed), but the mock checks both values.
 	hdr := NewHeader(mock, "svc1", "acc1", "Authorization")
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
 
 	var backendCalled bool
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -1271,7 +1276,7 @@ func TestProtect_OIDCOnPlainHTTP_BlockedWith400(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1295,7 +1300,7 @@ func TestProtect_OIDCOverTLS_NotBlocked(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1315,7 +1320,7 @@ func TestProtect_NonOIDCSchemes_PlainHTTP_NotBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1345,7 +1350,7 @@ func TestProtect_TunnelPeerFastPath_RequiresInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1380,7 +1385,7 @@ func TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
 
 	handler := mw.Protect(newPassthroughHandler())
 

proxy/internal/auth/tunnel_lookup_test.go

@@ -44,7 +44,7 @@ func (s *stubSessionValidator) ValidateTunnelPeer(_ context.Context, in *proto.V
 func newTunnelMiddleware(t *testing.T, validator SessionValidator) *Middleware {
 	t.Helper()
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("svc.example", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1"}))
+	require.NoError(t, mw.AddDomain("svc.example", nil, "", 0, "acct-1", "svc-1", nil, false))
 	return mw
 }
 
@@ -235,8 +235,8 @@ func TestForwardWithTunnelPeer_RoutesAccountIDIntoCacheKey(t *testing.T) {
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
 
-	require.NoError(t, mw.AddDomain("svc-a.example", DomainSettings{AccountID: "acct-a", ServiceID: "svc-a"}))
-	require.NoError(t, mw.AddDomain("svc-b.example", DomainSettings{AccountID: "acct-b", ServiceID: "svc-b"}))
+	require.NoError(t, mw.AddDomain("svc-a.example", nil, "", 0, "acct-a", "svc-a", nil, false))
+	require.NoError(t, mw.AddDomain("svc-b.example", nil, "", 0, "acct-b", "svc-b", nil, false))
 
 	// The fast-path requires the inbound-listener marker on the context.
 	// The peerstore lookup itself is account-agnostic at this level
@@ -299,7 +299,7 @@ func TestForwardWithTunnelPeer_LocalLookupShortCircuitDoesNotPopulateCache(t *te
 
 func TestPrivateService_FailsClosedOnTunnelPeerFailure(t *testing.T) {
 	mw := NewMiddleware(log.New(), nil, nil)
-	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
+	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -328,7 +328,7 @@ func TestPrivateService_ForwardsOnTunnelPeerSuccess(t *testing.T) {
 		},
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
+	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {

proxy/internal/llm/bedrock.go

@@ -56,10 +56,12 @@ type bedrockResponse struct {
 		OutputTokens             int64 `json:"output_tokens"`
 		CacheReadInputTokens     int64 `json:"cache_read_input_tokens"`
 		CacheCreationInputTokens int64 `json:"cache_creation_input_tokens"`
-		// Converse — camelCase.
-		InputTokensCamel  int64 `json:"inputTokens"`
-		OutputTokensCamel int64 `json:"outputTokens"`
-		TotalTokensCamel  int64 `json:"totalTokens"`
+		// Converse — camelCase; cache buckets are additive to inputTokens (AWS names the write bucket cacheWriteInputTokens).
+		InputTokensCamel      int64 `json:"inputTokens"`
+		OutputTokensCamel     int64 `json:"outputTokens"`
+		TotalTokensCamel      int64 `json:"totalTokens"`
+		CacheReadTokensCamel  int64 `json:"cacheReadInputTokens"`
+		CacheWriteTokensCamel int64 `json:"cacheWriteInputTokens"`
 	} `json:"usage"`
 }
 
@@ -83,16 +85,18 @@ func (BedrockParser) ParseResponse(status int, contentType string, body []byte)
 	}
 	inTok := firstNonZero(resp.Usage.InputTokens, resp.Usage.InputTokensCamel)
 	outTok := firstNonZero(resp.Usage.OutputTokens, resp.Usage.OutputTokensCamel)
+	cacheRead := firstNonZero(resp.Usage.CacheReadInputTokens, resp.Usage.CacheReadTokensCamel)
+	cacheWrite := firstNonZero(resp.Usage.CacheCreationInputTokens, resp.Usage.CacheWriteTokensCamel)
 	total := resp.Usage.TotalTokensCamel
 	if total == 0 {
-		total = inTok + outTok + resp.Usage.CacheReadInputTokens + resp.Usage.CacheCreationInputTokens
+		total = inTok + outTok + cacheRead + cacheWrite
 	}
 	return Usage{
 		InputTokens:         inTok,
 		OutputTokens:        outTok,
 		TotalTokens:         total,
-		CachedInputTokens:   resp.Usage.CacheReadInputTokens,
-		CacheCreationTokens: resp.Usage.CacheCreationInputTokens,
+		CachedInputTokens:   cacheRead,
+		CacheCreationTokens: cacheWrite,
 	}, nil
 }
 

proxy/internal/llm/bedrock_test.go

@@ -26,6 +26,18 @@ func TestBedrockParser_ParseResponse_Converse(t *testing.T) {
 	require.Equal(t, int64(14), u.TotalTokens, "converse uses provider total")
 }
 
+// Converse camelCase cache fields must land in the billed Usage buckets, same as the InvokeModel snake_case fields.
+func TestBedrockParser_ParseResponse_ConverseCacheBuckets(t *testing.T) {
+	body := []byte(`{"usage":{"inputTokens":11,"outputTokens":3,"cacheReadInputTokens":7,"cacheWriteInputTokens":9}}`)
+	u, err := BedrockParser{}.ParseResponse(200, "application/json", body)
+	require.NoError(t, err)
+	require.Equal(t, int64(11), u.InputTokens, "converse input tokens")
+	require.Equal(t, int64(3), u.OutputTokens, "converse output tokens")
+	require.Equal(t, int64(7), u.CachedInputTokens, "converse cache-read tokens")
+	require.Equal(t, int64(9), u.CacheCreationTokens, "converse cache-write tokens")
+	require.Equal(t, int64(11+3+7+9), u.TotalTokens, "total backfill is additive when the provider omits totalTokens")
+}
+
 func TestBedrockParser_ParseResponse_StreamingUnsupported(t *testing.T) {
 	_, err := BedrockParser{}.ParseResponse(200, "application/vnd.amazon.eventstream", []byte("binary"))
 	require.ErrorIs(t, err, ErrStreamingUnsupported, "event-stream must route to the streaming accumulator")

proxy/internal/llm/pricing/pricing.go

@@ -128,6 +128,46 @@ type Table struct {
 //   - Other providers: cached and cacheCreation are ignored; cost is
 //     inTokens*InputPer1K + outTokens*OutputPer1K.
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool) {
+	c, ok := t.Costs(provider, model, inTokens, outTokens, cachedInput, cacheCreation)
+	return c.TotalUSD, ok
+}
+
+// Costs is a per-request cost split. The four per-bucket fields are the base
+// of the breakdown — one per token bucket the provider bills separately — and
+// the two aggregates are derived from them:
+//
+//	TotalUSD = InputUSD + CachedInputUSD + CacheCreationUSD + OutputUSD
+//	CacheUSD = CachedInputUSD + CacheCreationUSD
+//
+// InputUSD is always the cost of the *non-cached* input bucket, for both
+// provider shapes: on OpenAI the cached subset is carved out of inTokens and
+// billed as CachedInputUSD, so the two never double-count. Buckets a provider
+// doesn't bill are zero, which keeps the identities above true everywhere.
+type Costs struct {
+	InputUSD         float64
+	CachedInputUSD   float64
+	CacheCreationUSD float64
+	OutputUSD        float64
+	TotalUSD         float64
+	CacheUSD         float64
+}
+
+// newCosts assembles a split from its per-bucket parts, deriving the two
+// aggregates so TotalUSD and CacheUSD can never drift from the breakdown.
+func newCosts(input, cachedInput, cacheCreation, output float64) Costs {
+	return Costs{
+		InputUSD:         input,
+		CachedInputUSD:   cachedInput,
+		CacheCreationUSD: cacheCreation,
+		OutputUSD:        output,
+		TotalUSD:         input + cachedInput + cacheCreation + output,
+		CacheUSD:         cachedInput + cacheCreation,
+	}
+}
+
+// Costs returns the estimated USD cost split for the given token counts, with
+// the same semantics as Cost.
+func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool) {
 	// Clamp negatives to zero before any pricing math so a malformed
 	// upstream count can never produce a negative cost.
 	if inTokens < 0 {
@@ -143,15 +183,15 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 		cacheCreation = 0
 	}
 	if t == nil {
-		return 0, false
+		return Costs{}, false
 	}
 	byModel, ok := t.entries[provider]
 	if !ok {
-		return 0, false
+		return Costs{}, false
 	}
 	entry, ok := byModel[model]
 	if !ok {
-		return 0, false
+		return Costs{}, false
 	}
 	output := (float64(outTokens) / 1000.0) * entry.OutputPer1K
 	switch provider {
@@ -168,7 +208,7 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 		}
 		nonCached := float64(inTokens-clamped) / 1000.0 * entry.InputPer1K
 		cached := float64(clamped) / 1000.0 * cachedRate
-		return nonCached + cached + output, true
+		return newCosts(nonCached, cached, 0, output), true
 	case "anthropic", "bedrock":
 		// Bedrock-Anthropic returns the same additive cache buckets as
 		// first-party Anthropic; non-Anthropic Bedrock models simply report
@@ -184,10 +224,10 @@ func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, c
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
 		read := float64(cachedInput) / 1000.0 * readRate
 		create := float64(cacheCreation) / 1000.0 * createRate
-		return input + read + create + output, true
+		return newCosts(input, read, create, output), true
 	default:
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
-		return input + output, true
+		return newCosts(input, 0, 0, output), true
 	}
 }
 

proxy/internal/middleware/builtin/cost_calculation_matrix_test.go

@@ -0,0 +1,329 @@
+package builtin_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"strconv"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/cost_meter"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_request_parser"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_response_parser"
+)
+
+// Drives the real pipeline (llm_request_parser → llm_response_parser → cost_meter) on the embedded default pricing
+// table and asserts exact USD amounts hardcoded from the vendors' published prices, including the cache split.
+func TestCostCalculation_ProviderMatrix(t *testing.T) {
+	// Empty data dir → embedded defaults, like a proxy with no pricing override.
+	builtin.Configure(context.Background(), t.TempDir(), nil, nil, nil)
+
+	reqMW, err := llm_request_parser.Factory{}.New(nil)
+	require.NoError(t, err, "build llm_request_parser")
+	respMW, err := llm_response_parser.Factory{}.New(nil)
+	require.NoError(t, err, "build llm_response_parser")
+	costMW, err := cost_meter.Factory{}.New(nil)
+	require.NoError(t, err, "build cost_meter")
+	t.Cleanup(func() { _ = costMW.Close() })
+
+	const jsonCT = "application/json"
+	const sseCT = "text/event-stream"
+	const awsCT = "application/vnd.amazon.eventstream"
+
+	cases := []struct {
+		name     string
+		url      string
+		reqBody  []byte
+		respCT   string
+		respBody []byte
+
+		wantProvider  string
+		wantModel     string
+		wantCost      float64 // exact expected USD; ignored when wantSkip is set
+		wantCacheCost float64 // expected cost.usd_cache portion of wantCost
+		wantSkip      string  // expected cost.skipped reason, "" when priced
+	}{
+		{
+			// gpt-4o-mini $0.15/$0.60 per MTok: 1000×0.15/1M + 500×0.60/1M.
+			name:         "openai chat completions",
+			url:          "https://api.openai.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"choices":[{"message":{"content":"pong"}}],"usage":{"prompt_tokens":1000,"completion_tokens":500,"total_tokens":1500}}`),
+			wantProvider: "openai",
+			wantModel:    "gpt-4o-mini",
+			wantCost:     0.00045,
+		},
+		{
+			// OpenAI cached tokens are a SUBSET of prompt_tokens at a discount; gpt-4o $2.50/$10 per MTok, cached $1.25/M:
+			// 250×2.5/1M + 750×1.25/1M + 500×10/1M.
+			name:          "openai cached subset discount",
+			url:           "https://api.openai.com/v1/chat/completions",
+			reqBody:       []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":500,"prompt_tokens_details":{"cached_tokens":750}}}`),
+			wantProvider:  "openai",
+			wantModel:     "gpt-4o",
+			wantCost:      0.0065625,
+			wantCacheCost: 0.0009375,
+		},
+		{
+			// OpenAI streaming: usage rides the final SSE frame.
+			name:         "openai chat SSE stream",
+			url:          "https://api.openai.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"gpt-4o-mini","stream":true,"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       sseCT,
+			respBody:     sseBody(`{"choices":[{"delta":{"content":"po"}}]}`, `{"choices":[{"delta":{"content":"ng"}}]}`, `{"choices":[],"usage":{"prompt_tokens":1000,"completion_tokens":500}}`, "[DONE]"),
+			wantProvider: "openai",
+			wantModel:    "gpt-4o-mini",
+			wantCost:     0.00045,
+		},
+		{
+			// Mistral speaks the OpenAI shape: mistral-large-latest $0.50/$1.50 per MTok.
+			name:         "mistral via openai shape",
+			url:          "https://api.mistral.ai/v1/chat/completions",
+			reqBody:      []byte(`{"model":"mistral-large-latest","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":1000}}`),
+			wantProvider: "openai",
+			wantModel:    "mistral-large-latest",
+			wantCost:     0.002,
+		},
+		{
+			// The field report, minus caching: Bedrock Sonnet 4.6 $3/$15 per MTok, 3×3/1M + 1514×15/1M = $0.022719.
+			// Also covers inference-profile normalization of the region-prefixed versioned id in the URL.
+			name:         "bedrock invoke — reported scenario, no cache",
+			url:          "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke",
+			reqBody:      []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"content":[{"type":"text","text":"pong"}],"usage":{"input_tokens":3,"output_tokens":1514}}`),
+			wantProvider: "bedrock",
+			wantModel:    "anthropic.claude-sonnet-4-6",
+			wantCost:     0.022719,
+		},
+		{
+			// The field report as observed: the FIRST call of a session also wrote a 30,528-token prompt cache at
+			// 1.25× input ($3.75/M): 0.022719 + 30528×3.75/1M = $0.137199 — the reported $0.1372.
+			name:          "bedrock invoke — reported scenario with cache write",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"usage":{"input_tokens":3,"output_tokens":1514,"cache_creation_input_tokens":30528,"cache_read_input_tokens":0}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-sonnet-4-6",
+			wantCost:      0.137199,
+			wantCacheCost: 0.11448,
+		},
+		{
+			// Same numbers over the InvokeModel event-stream: message_start carries input + cache, message_delta the output.
+			name:          "bedrock invoke stream with cache write",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/global.anthropic.claude-sonnet-4-6-20260115-v1:0/invoke-with-response-stream",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        awsCT,
+			respBody:      bedrockInvokeStream(t, `{"type":"message_start","message":{"usage":{"input_tokens":3,"output_tokens":1,"cache_creation_input_tokens":30528}}}`, `{"type":"content_block_delta","delta":{"type":"text_delta","text":"pong"}}`, `{"type":"message_delta","usage":{"output_tokens":1514}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-sonnet-4-6",
+			wantCost:      0.137199,
+			wantCacheCost: 0.11448,
+		},
+		{
+			// Converse camelCase usage incl. cache buckets. Haiku 4.5 $1/$5 per MTok, read $0.10/M, write $1.25/M:
+			// 50×1/1M + 100×5/1M + 2000×0.1/1M + 1000×1.25/1M = $0.002.
+			name:          "bedrock converse with cache buckets",
+			url:           "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/converse",
+			reqBody:       []byte(`{"messages":[{"role":"user","content":[{"text":"hi"}]}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"output":{"message":{"content":[{"text":"pong"}]}},"usage":{"inputTokens":50,"outputTokens":100,"totalTokens":3150,"cacheReadInputTokens":2000,"cacheWriteInputTokens":1000}}`),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-haiku-4-5",
+			wantCost:      0.002,
+			wantCacheCost: 0.00145,
+		},
+		{
+			// Same numbers over converse-stream: usage rides the trailing metadata frame.
+			name:    "bedrock converse stream with cache buckets",
+			url:     "https://bedrock-runtime.eu-central-1.amazonaws.com/model/eu.anthropic.claude-haiku-4-5-20251001-v1:0/converse-stream",
+			reqBody: []byte(`{"messages":[{"role":"user","content":[{"text":"hi"}]}]}`),
+			respCT:  awsCT,
+			respBody: bedrockConverseStream(t,
+				`{"delta":{"text":"pong"}}`,
+				`{"usage":{"inputTokens":50,"outputTokens":100,"totalTokens":3150,"cacheReadInputTokens":2000,"cacheWriteInputTokens":1000}}`,
+			),
+			wantProvider:  "bedrock",
+			wantModel:     "anthropic.claude-haiku-4-5",
+			wantCost:      0.002,
+			wantCacheCost: 0.00145,
+		},
+		{
+			// First-party Anthropic, additive cache buckets. Sonnet 4.6:
+			// 256×3/1M + 200×15/1M + 768×0.3/1M + 512×3.75/1M.
+			name:          "anthropic messages with cache buckets",
+			url:           "https://api.anthropic.com/v1/messages",
+			reqBody:       []byte(`{"model":"claude-sonnet-4-6","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:        jsonCT,
+			respBody:      []byte(`{"content":[{"type":"text","text":"pong"}],"usage":{"input_tokens":256,"output_tokens":200,"cache_read_input_tokens":768,"cache_creation_input_tokens":512}}`),
+			wantProvider:  "anthropic",
+			wantModel:     "claude-sonnet-4-6",
+			wantCost:      0.0059184,
+			wantCacheCost: 0.0021504,
+		},
+		{
+			// Anthropic SSE: input from message_start, output from message_delta. Haiku 4.5: 1000×1/1M + 2000×5/1M.
+			name:         "anthropic SSE stream",
+			url:          "https://api.anthropic.com/v1/messages",
+			reqBody:      []byte(`{"model":"claude-haiku-4-5","stream":true,"messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       sseCT,
+			respBody:     sseBody(`{"type":"message_start","message":{"usage":{"input_tokens":1000,"output_tokens":2}}}`, `{"type":"content_block_delta","delta":{"type":"text_delta","text":"pong"}}`, `{"type":"message_delta","usage":{"output_tokens":2000}}`, `{"type":"message_stop"}`),
+			wantProvider: "anthropic",
+			wantModel:    "claude-haiku-4-5",
+			wantCost:     0.011,
+		},
+		{
+			// Kimi's Anthropic-compatible endpoint: kimi-k3 $3/$15 per MTok under the anthropic table.
+			name:         "kimi anthropic shape",
+			url:          "https://api.moonshot.ai/anthropic/v1/messages",
+			reqBody:      []byte(`{"model":"kimi-k3","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"input_tokens":1000,"output_tokens":1000}}`),
+			wantProvider: "anthropic",
+			wantModel:    "kimi-k3",
+			wantCost:     0.018,
+		},
+		{
+			// Vertex path-routed model with "@version" stripped; Anthropic-on-Vertex priced under the anthropic table.
+			name:         "vertex anthropic path-routed",
+			url:          "https://aiplatform.googleapis.com/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-4-6@20260115:rawPredict",
+			reqBody:      []byte(`{"anthropic_version":"vertex-2023-10-16","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"input_tokens":200,"output_tokens":100}}`),
+			wantProvider: "anthropic",
+			wantModel:    "claude-sonnet-4-6",
+			wantCost:     0.0021,
+		},
+		{
+			// Gateway-prefixed model ids are not in the pricing table: the meter must SKIP, never guess a rate.
+			name:         "gateway-prefixed model skips pricing",
+			url:          "https://gateway.example.com/v1/chat/completions",
+			reqBody:      []byte(`{"model":"openai/gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`),
+			respCT:       jsonCT,
+			respBody:     []byte(`{"usage":{"prompt_tokens":1000,"completion_tokens":500}}`),
+			wantProvider: "openai",
+			wantModel:    "openai/gpt-4o-mini",
+			wantSkip:     "unknown_model",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			in := &middleware.Input{
+				Method:  "POST",
+				URL:     tc.url,
+				Headers: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+				Body:    tc.reqBody,
+			}
+
+			reqOut, err := reqMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "request parser")
+			in.Metadata = append(in.Metadata, reqOut.Metadata...)
+
+			require.Equal(t, tc.wantProvider, metaKV(in.Metadata, middleware.KeyLLMProvider), "detected provider")
+			require.Equal(t, tc.wantModel, metaKV(in.Metadata, middleware.KeyLLMModel), "detected (normalized) model")
+
+			in.Status = 200
+			in.RespHeaders = []middleware.KV{{Key: "Content-Type", Value: tc.respCT}}
+			in.RespBody = tc.respBody
+
+			respOut, err := respMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "response parser")
+			in.Metadata = append(in.Metadata, respOut.Metadata...)
+
+			costOut, err := costMW.Invoke(context.Background(), in)
+			require.NoError(t, err, "cost meter")
+
+			if tc.wantSkip != "" {
+				assert.Equal(t, tc.wantSkip, metaKV(costOut.Metadata, middleware.KeyCostSkipped), "expected cost skip reason")
+				assert.Empty(t, metaKV(costOut.Metadata, middleware.KeyCostUSDTotal), "no cost may be emitted on skip")
+				return
+			}
+
+			raw := metaKV(costOut.Metadata, middleware.KeyCostUSDTotal)
+			require.NotEmpty(t, raw, "cost.usd_total must be emitted; skip=%q", metaKV(costOut.Metadata, middleware.KeyCostSkipped))
+			got, err := strconv.ParseFloat(raw, 64)
+			require.NoError(t, err, "cost must be a float")
+			// cost.usd_total is rendered with %.6f: allow half of the last printed digit on top of float error.
+			assert.InDelta(t, tc.wantCost, got, 5.1e-7, "USD cost for %s", tc.name)
+
+			rawCache := metaKV(costOut.Metadata, middleware.KeyCostUSDCache)
+			require.NotEmpty(t, rawCache, "cost.usd_cache must be emitted next to cost.usd_total")
+			gotCache, err := strconv.ParseFloat(rawCache, 64)
+			require.NoError(t, err, "cache cost must be a float")
+			assert.InDelta(t, tc.wantCacheCost, gotCache, 5.1e-7, "cache USD cost for %s", tc.name)
+		})
+	}
+}
+
+// metaKV returns the value for key in kvs, or "" when absent.
+func metaKV(kvs []middleware.KV, key string) string {
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value
+		}
+	}
+	return ""
+}
+
+// sseBody renders data frames as a text/event-stream body.
+func sseBody(frames ...string) []byte {
+	var b bytes.Buffer
+	for _, f := range frames {
+		b.WriteString("data: ")
+		b.WriteString(f)
+		b.WriteString("\n\n")
+	}
+	return b.Bytes()
+}
+
+// awsFrame encodes one AWS event-stream frame with the given :event-type.
+func awsFrame(t *testing.T, eventType string, payload []byte) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	enc := eventstream.NewEncoder()
+	require.NoError(t, enc.Encode(&buf, eventstream.Message{
+		Headers: eventstream.Headers{{Name: ":event-type", Value: eventstream.StringValue(eventType)}},
+		Payload: payload,
+	}), "encode event-stream frame")
+	return buf.Bytes()
+}
+
+// bedrockInvokeStream builds an invoke-with-response-stream body: each "chunk" frame wraps a base64 Anthropic event.
+func bedrockInvokeStream(t *testing.T, events ...string) []byte {
+	t.Helper()
+	var body bytes.Buffer
+	for _, ev := range events {
+		wrap, err := json.Marshal(map[string]string{"bytes": base64.StdEncoding.EncodeToString([]byte(ev))})
+		require.NoError(t, err)
+		body.Write(awsFrame(t, "chunk", wrap))
+	}
+	return body.Bytes()
+}
+
+// bedrockConverseStream builds a converse-stream body: contentBlockDelta frames plus a trailing metadata usage frame.
+func bedrockConverseStream(t *testing.T, deltas ...string) []byte {
+	t.Helper()
+	var body bytes.Buffer
+	for i, ev := range deltas {
+		eventType := "contentBlockDelta"
+		if i == len(deltas)-1 {
+			eventType = "metadata"
+		}
+		body.Write(awsFrame(t, eventType, []byte(ev)))
+	}
+	return body.Bytes()
+}

proxy/internal/middleware/builtin/cost_meter/middleware.go

@@ -32,7 +32,12 @@ const (
 )
 
 var metadataKeys = []string{
+	middleware.KeyCostUSDInput,
+	middleware.KeyCostUSDCachedInput,
+	middleware.KeyCostUSDCacheCreation,
+	middleware.KeyCostUSDOutput,
 	middleware.KeyCostUSDTotal,
+	middleware.KeyCostUSDCache,
 	middleware.KeyCostSkipped,
 }
 
@@ -140,18 +145,38 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 	}
 
 	table := m.loader.Get()
-	cost, ok := table.Cost(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
+	costs, ok := table.Costs(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
 	if !ok {
 		out.Metadata = skip(skipUnknownModel)
 		return out, nil
 	}
 
+	// Per-bucket costs first: they're the base of the breakdown, and the two
+	// aggregates that follow are derived from exactly these four values.
 	out.Metadata = []middleware.KV{
-		{Key: middleware.KeyCostUSDTotal, Value: fmt.Sprintf("%.6f", cost)},
+		{Key: middleware.KeyCostUSDInput, Value: usd(costs.InputUSD)},
+		{Key: middleware.KeyCostUSDCachedInput, Value: usd(costs.CachedInputUSD)},
+		{Key: middleware.KeyCostUSDCacheCreation, Value: usd(costs.CacheCreationUSD)},
+		{Key: middleware.KeyCostUSDOutput, Value: usd(costs.OutputUSD)},
+		{Key: middleware.KeyCostUSDTotal, Value: usd(costs.TotalUSD)},
+		{Key: middleware.KeyCostUSDCache, Value: usd(costs.CacheUSD)},
 	}
 	return out, nil
 }
 
+// usd renders a cost as the fixed-precision string every cost.usd_* key
+// carries, so the per-bucket values and the aggregates round identically.
+//
+// 9 decimals, not 6: these values are summed downstream — per request, per
+// session, and per usage bucket — so the rounding step is applied once per
+// bucket per row and then accumulated. At 6 decimals a single row loses up to
+// 2e-6 across its four buckets (enough to break a 1e-6 reconciliation against
+// published rates), and a bucket smaller than half a microdollar quantises to
+// zero outright: 16 cache-read tokens on a cheap model is 1.6e-9, so summing
+// 10k such rows reports 0.02 instead of 0.016. Nano-dollar precision keeps the
+// per-row error ~1000x below the smallest realistic bucket.
+func usd(v float64) string { return fmt.Sprintf("%.9f", v) }
+
 // skip returns a single-entry metadata slice carrying the given skip
 // reason under KeyCostSkipped.
 func skip(reason string) []middleware.KV {

proxy/internal/middleware/builtin/cost_meter/middleware_test.go

@@ -67,7 +67,15 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 	assert.NoError(t, mw.Close(), "Close on stateless middleware is a no-op")
 
 	keys := mw.MetadataKeys()
-	expected := []string{middleware.KeyCostUSDTotal, middleware.KeyCostSkipped}
+	expected := []string{
+		middleware.KeyCostUSDInput,
+		middleware.KeyCostUSDCachedInput,
+		middleware.KeyCostUSDCacheCreation,
+		middleware.KeyCostUSDOutput,
+		middleware.KeyCostUSDTotal,
+		middleware.KeyCostUSDCache,
+		middleware.KeyCostSkipped,
+	}
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }
 
@@ -105,7 +113,7 @@ func TestFactory_DefaultPricingPathLoadsFixture(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted for known model")
-	assert.Equal(t, "0.000750", value, "0.00015 + 0.0006 per 1k tokens, 6-decimal format")
+	assert.Equal(t, "0.000750000", value, "0.00015 + 0.0006 per 1k tokens, 9-decimal format")
 }
 
 func TestFactory_PricingPathOverride(t *testing.T) {
@@ -129,7 +137,7 @@ func TestFactory_PricingPathOverride(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted with custom pricing path")
-	assert.Equal(t, "0.015000", value, "2*0.0025 + 1*0.01 = 0.015 with 6-decimal format")
+	assert.Equal(t, "0.015000000", value, "2*0.0025 + 1*0.01 = 0.015 with 9-decimal format")
 }
 
 func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
@@ -148,7 +156,7 @@ func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
 
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cost.usd_total must be emitted")
-	assert.Equal(t, "0.018000", value, "0.003 + 0.015 = 0.018 with 6-decimal format")
+	assert.Equal(t, "0.018000000", value, "0.003 + 0.015 = 0.018 with 9-decimal format")
 	_, skipped := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
 	assert.False(t, skipped, "cost.skipped must not be set when cost is computed")
 }
@@ -357,8 +365,25 @@ func TestInvoke_OpenAICachedSubsetDiscount(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "cached subset path must produce a cost — never a skip")
 	// 250 non-cached at 0.0025/1k + 750 cached at 0.00125/1k + 500 output at 0.01/1k.
-	assert.Equal(t, "0.006563", value,
+	assert.Equal(t, "0.006562500", value,
 		"cached subset must be billed at the discount rate, non-cached at the full rate; never double-billed")
+
+	cache, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDCache)
+	require.True(t, ok, "cost.usd_cache must be emitted alongside cost.usd_total")
+	// 750 cached at 0.00125/1k = 0.0009375.
+	assert.Equal(t, "0.000937500", cache, "cache cost is the discounted cost of the cached subset")
+
+	// Per-bucket breakdown. On OpenAI the cached subset is carved out of the
+	// input bucket, so input covers only the 250 non-cached tokens — the two
+	// must never double-count the same 750 tokens.
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDInput, "0.000625000",
+		"input bucket bills only the non-cached remainder")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCachedInput, "0.000937500",
+		"cached-input bucket bills the discounted subset")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCacheCreation, "0.000000000",
+		"OpenAI has no cache-write bucket")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDOutput, "0.005000000",
+		"output bucket bills 500 tokens at 0.01/1k")
 }
 
 // TestInvoke_AnthropicCacheBucketsAdditive proves the Anthropic
@@ -384,9 +409,33 @@ func TestInvoke_AnthropicCacheBucketsAdditive(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 256 input * 0.003 + 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 + 200 output * 0.015
-	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184 → "0.005918" with 6-decimal format.
-	assert.Equal(t, "0.005918", value,
+	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184.
+	assert.Equal(t, "0.005918400", value,
 		"each Anthropic input bucket must bill at its own rate — cache_read cheap, cache_creation expensive, regular input mid")
+
+	cache, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDCache)
+	require.True(t, ok, "cost.usd_cache must be emitted alongside cost.usd_total")
+	// 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 = 0.0021504.
+	assert.Equal(t, "0.002150400", cache, "cache cost sums the read and creation buckets")
+
+	// Per-bucket breakdown: four separately-billed buckets, each at its own rate.
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDInput, "0.000768000",
+		"input bucket bills 256 tokens at 0.003/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCachedInput, "0.000230400",
+		"cache-read bucket bills 768 tokens at the cheap 0.0003/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDCacheCreation, "0.001920000",
+		"cache-write bucket bills 512 tokens at the expensive 0.00375/1k")
+	assertBucket(t, out.Metadata, middleware.KeyCostUSDOutput, "0.003000000",
+		"output bucket bills 200 tokens at 0.015/1k")
+}
+
+// assertBucket asserts one per-bucket cost key carries the expected
+// 6-decimal value.
+func assertBucket(t *testing.T, md []middleware.KV, key, want, msg string) {
+	t.Helper()
+	got, ok := metaValue(t, md, key)
+	require.Truef(t, ok, "%s must be emitted", key)
+	assert.Equal(t, want, got, msg)
 }
 
 // TestInvoke_CachedTokensAbsentFallsBackToBaseFormula covers the
@@ -411,7 +460,7 @@ func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 1000 input * 0.0025 + 500 output * 0.01 = 0.0025 + 0.005 = 0.0075
-	assert.Equal(t, "0.007500", value, "no cached metadata = same cost as before the feature landed")
+	assert.Equal(t, "0.007500000", value, "no cached metadata = same cost as before the feature landed")
 }
 
 // TestInvoke_UnparseableCachedTokensSkippedSilently proves the
@@ -435,7 +484,7 @@ func TestInvoke_UnparseableCachedTokensSkippedSilently(t *testing.T) {
 	require.NoError(t, err)
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok, "garbage cache metadata must NOT switch the response from a cost to a skip — fall back to 0 cached")
-	assert.Equal(t, "0.007500", value, "same as the no-cached-metadata path")
+	assert.Equal(t, "0.007500000", value, "same as the no-cached-metadata path")
 }
 
 // TestMiddleware_CloseCancelsReloader proves Close stops the per-instance

proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go

@@ -69,15 +69,18 @@ func applyBedrockInvokeChunk(payload []byte, usage *llm.Usage, completion *strin
 }
 
 // converseStreamEvent captures the Converse stream frames carrying completion
-// text (contentBlockDelta) and the final token usage (metadata).
+// text (contentBlockDelta) and the final token usage (metadata). Cache buckets
+// are additive to inputTokens (AWS write bucket: cacheWriteInputTokens).
 type converseStreamEvent struct {
 	Delta *struct {
 		Text string `json:"text"`
 	} `json:"delta"`
 	Usage *struct {
-		InputTokens  int64 `json:"inputTokens"`
-		OutputTokens int64 `json:"outputTokens"`
-		TotalTokens  int64 `json:"totalTokens"`
+		InputTokens      int64 `json:"inputTokens"`
+		OutputTokens     int64 `json:"outputTokens"`
+		TotalTokens      int64 `json:"totalTokens"`
+		CacheReadTokens  int64 `json:"cacheReadInputTokens"`
+		CacheWriteTokens int64 `json:"cacheWriteInputTokens"`
 	} `json:"usage"`
 }
 
@@ -105,6 +108,12 @@ func applyConverseStreamEvent(eventType string, payload []byte, usage *llm.Usage
 			if ev.Usage.TotalTokens > 0 {
 				usage.TotalTokens = ev.Usage.TotalTokens
 			}
+			if ev.Usage.CacheReadTokens > 0 {
+				usage.CachedInputTokens = ev.Usage.CacheReadTokens
+			}
+			if ev.Usage.CacheWriteTokens > 0 {
+				usage.CacheCreationTokens = ev.Usage.CacheWriteTokens
+			}
 		}
 	}
 }

proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go

@@ -66,6 +66,24 @@ func TestAccumulateBedrockStream_Converse(t *testing.T) {
 	require.Equal(t, "pong", completion, "converse text deltas concatenated")
 }
 
+// The converse-stream metadata frame's camelCase cache fields must reach the billed cache buckets.
+func TestAccumulateBedrockStream_ConverseCacheBuckets(t *testing.T) {
+	var body bytes.Buffer
+	body.Write(bedrockFrame(t, "contentBlockDelta", mustJSON(t, map[string]any{"delta": map[string]any{"text": "pong"}})))
+	body.Write(bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{
+		"inputTokens": 11, "outputTokens": 3, "totalTokens": 30,
+		"cacheReadInputTokens": 7, "cacheWriteInputTokens": 9,
+	}})))
+
+	usage, completion := accumulateBedrockStream(body.Bytes())
+	require.Equal(t, int64(11), usage.InputTokens, "input tokens from metadata frame")
+	require.Equal(t, int64(3), usage.OutputTokens, "output tokens from metadata frame")
+	require.Equal(t, int64(7), usage.CachedInputTokens, "cache-read tokens from metadata frame")
+	require.Equal(t, int64(9), usage.CacheCreationTokens, "cache-write tokens from metadata frame")
+	require.Equal(t, int64(30), usage.TotalTokens, "provider-reported total wins")
+	require.Equal(t, "pong", completion)
+}
+
 func TestAccumulateBedrockStream_Truncated(t *testing.T) {
 	// A body cut mid-frame must not panic; partial usage is returned.
 	full := bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{"inputTokens": 11, "outputTokens": 3}}))

proxy/internal/middleware/keys.go

@@ -75,8 +75,19 @@ const (
 	KeyLLMAttributionGroupID = "llm.attribution_group_id"
 	KeyLLMAttributionWindowS = "llm.attribution_window_seconds"
 
-	// Cost metering (emitted by cost_meter).
-	KeyCostUSDTotal = "cost.usd_total"
+	// Cost metering (emitted by cost_meter). The four per-bucket keys are the
+	// base of the breakdown — one per token bucket the provider bills
+	// separately — and the two aggregates below are derived from them:
+	// usd_total is their sum, usd_cache is cached_input + cache_creation.
+	KeyCostUSDInput = "cost.usd_input"
+	// KeyCostUSDCachedInput is the cost of the cache-read bucket (Anthropic cache_read; OpenAI's discounted cached subset of input).
+	KeyCostUSDCachedInput = "cost.usd_cached_input"
+	// KeyCostUSDCacheCreation is the cost of the cache-write bucket. Zero for providers without one.
+	KeyCostUSDCacheCreation = "cost.usd_cache_creation"
+	KeyCostUSDOutput        = "cost.usd_output"
+	KeyCostUSDTotal         = "cost.usd_total"
+	// KeyCostUSDCache is the portion of cost.usd_total billed for prompt-cache buckets (cache read/creation, or OpenAI's cached input subset).
+	KeyCostUSDCache = "cost.usd_cache"
 	KeyCostSkipped  = "cost.skipped"
 
 	// Framework-emitted error markers. Use the mw.<id>.* prefix to

proxy/internal/restrict/restrict.go

@@ -50,59 +50,6 @@ const (
 	CrowdSecObserve CrowdSecMode = "observe"
 )
 
-// AppSecMode is the per-service CrowdSec AppSec (WAF) enforcement mode.
-type AppSecMode string
-
-const (
-	// AppSecOff disables request inspection.
-	AppSecOff AppSecMode = ""
-	// AppSecEnforce blocks requests the engine flags, and fails closed when the
-	// engine is unreachable.
-	AppSecEnforce AppSecMode = "enforce"
-	// AppSecObserve records the verdict without blocking.
-	AppSecObserve AppSecMode = "observe"
-)
-
-// ParseAppSecMode maps a wire value to an AppSecMode. Unrecognized values map
-// to AppSecOff so a typo never turns inspection into an unintended block.
-func ParseAppSecMode(s string) AppSecMode {
-	switch AppSecMode(s) {
-	case AppSecEnforce:
-		return AppSecEnforce
-	case AppSecObserve:
-		return AppSecObserve
-	default:
-		return AppSecOff
-	}
-}
-
-// Enabled reports whether the mode asks for request inspection.
-func (m AppSecMode) Enabled() bool {
-	return m == AppSecEnforce || m == AppSecObserve
-}
-
-// AllowMatch controls how the configured allowlists (CIDR, country) combine.
-// Blocklists are always a separate hard-deny gate and are unaffected by it.
-type AllowMatch string
-
-const (
-	// AllowMatchAll requires the address to match every configured allowlist
-	// (AND). This is the default and preserves the historical behavior.
-	AllowMatchAll AllowMatch = "all"
-	// AllowMatchAny requires the address to match at least one configured
-	// allowlist (OR), e.g. "allowed country OR allowed CIDR".
-	AllowMatchAny AllowMatch = "any"
-)
-
-// normalizeAllowMatch maps unknown or empty values to the restrictive default
-// (AllowMatchAll) so an unrecognized mode never loosens access.
-func normalizeAllowMatch(m AllowMatch) AllowMatch {
-	if m == AllowMatchAny {
-		return AllowMatchAny
-	}
-	return AllowMatchAll
-}
-
 // Filter evaluates IP restrictions. CIDR checks are performed first
 // (cheap), followed by country lookups (more expensive) only when needed.
 type Filter struct {
@@ -112,9 +59,6 @@ type Filter struct {
 	BlockedCountries []string
 	CrowdSec         CrowdSecChecker
 	CrowdSecMode     CrowdSecMode
-	// AllowMatch controls how the allowlists combine (AND vs OR). Empty means
-	// AllowMatchAll.
-	AllowMatch AllowMatch
 }
 
 // FilterConfig holds the raw configuration for building a Filter.
@@ -125,7 +69,6 @@ type FilterConfig struct {
 	BlockedCountries []string
 	CrowdSec         CrowdSecChecker
 	CrowdSecMode     CrowdSecMode
-	AllowMatch       AllowMatch
 	Logger           *log.Entry
 }
 
@@ -146,7 +89,6 @@ func ParseFilter(cfg FilterConfig) *Filter {
 	f := &Filter{
 		AllowedCountries: normalizeCountryCodes(cfg.AllowedCountries),
 		BlockedCountries: normalizeCountryCodes(cfg.BlockedCountries),
-		AllowMatch:       normalizeAllowMatch(cfg.AllowMatch),
 	}
 	if hasCS {
 		f.CrowdSec = cfg.CrowdSec
@@ -204,13 +146,6 @@ const (
 	// DenyCrowdSecUnavailable indicates enforce mode but the bouncer has not
 	// completed its initial sync.
 	DenyCrowdSecUnavailable
-	// DenyAppSecBan indicates a CrowdSec AppSec "ban" remediation.
-	DenyAppSecBan
-	// DenyAppSecCaptcha indicates a CrowdSec AppSec "captcha" remediation.
-	DenyAppSecCaptcha
-	// DenyAppSecUnavailable indicates enforce mode but the AppSec engine could
-	// not produce a verdict (unreachable, timed out, or it rejected the call).
-	DenyAppSecUnavailable
 )
 
 // String returns the deny reason string matching the HTTP auth mechanism names.
@@ -232,27 +167,11 @@ func (v Verdict) String() string {
 		return "crowdsec_throttle"
 	case DenyCrowdSecUnavailable:
 		return "crowdsec_unavailable"
-	case DenyAppSecBan:
-		return "appsec_ban"
-	case DenyAppSecCaptcha:
-		return "appsec_captcha"
-	case DenyAppSecUnavailable:
-		return "appsec_unavailable"
 	default:
 		return "unknown"
 	}
 }
 
-// IsAppSec returns true when the verdict originates from an AppSec inspection.
-func (v Verdict) IsAppSec() bool {
-	switch v {
-	case DenyAppSecBan, DenyAppSecCaptcha, DenyAppSecUnavailable:
-		return true
-	default:
-		return false
-	}
-}
-
 // IsCrowdSec returns true when the verdict originates from a CrowdSec check.
 func (v Verdict) IsCrowdSec() bool {
 	switch v {
@@ -297,10 +216,6 @@ func (f *Filter) Check(addr netip.Addr, geo GeoResolver) Verdict {
 	// IPv4 CIDR rules match regardless of how the address was received.
 	addr = addr.Unmap()
 
-	if f.AllowMatch == AllowMatchAny {
-		return f.checkAny(addr, geo)
-	}
-
 	if v := f.checkCIDR(addr); v != Allow {
 		return v
 	}
@@ -310,77 +225,6 @@ func (f *Filter) Check(addr netip.Addr, geo GeoResolver) Verdict {
 	return f.checkCrowdSec(addr)
 }
 
-// checkAny evaluates the filter with OR semantics across allowlists: the
-// address is admitted if it matches any configured allowlist (CIDR or country).
-// Blocklists remain a hard-deny gate evaluated first and are independent of the
-// allow-combine mode, so a blocklist match (or unverifiable country block) still
-// denies. CrowdSec runs last, as in the default path.
-func (f *Filter) checkAny(addr netip.Addr, geo GeoResolver) Verdict {
-	if v := f.checkBlocked(addr, geo); v != Allow {
-		return v
-	}
-	if v := f.checkAllowedAny(addr, geo); v != Allow {
-		return v
-	}
-	return f.checkCrowdSec(addr)
-}
-
-// checkBlocked is the hard-deny gate: it denies on any blocklist match,
-// regardless of the allow-combine mode. A configured country blocklist with an
-// unavailable geo lookup fails closed.
-func (f *Filter) checkBlocked(addr netip.Addr, geo GeoResolver) Verdict {
-	for _, prefix := range f.BlockedCIDRs {
-		if prefix.Contains(addr) {
-			return DenyCIDR
-		}
-	}
-
-	if len(f.BlockedCountries) == 0 {
-		return Allow
-	}
-	if geo == nil || !geo.Available() {
-		return DenyGeoUnavailable
-	}
-	if code := geo.LookupAddr(addr).CountryCode; code != "" && slices.Contains(f.BlockedCountries, code) {
-		return DenyCountry
-	}
-	return Allow
-}
-
-// checkAllowedAny admits the address if it matches any active allowlist. The
-// CIDR allowlist is evaluated first so a match admits without a geo lookup;
-// only when it does not match is the country allowlist consulted, where an
-// unavailable geo lookup fails closed.
-func (f *Filter) checkAllowedAny(addr netip.Addr, geo GeoResolver) Verdict {
-	cidrActive := len(f.AllowedCIDRs) > 0
-	countryActive := len(f.AllowedCountries) > 0
-	if !cidrActive && !countryActive {
-		return Allow
-	}
-
-	if cidrActive {
-		for _, prefix := range f.AllowedCIDRs {
-			if prefix.Contains(addr) {
-				return Allow
-			}
-		}
-	}
-
-	if countryActive {
-		if geo == nil || !geo.Available() {
-			return DenyGeoUnavailable
-		}
-		if code := geo.LookupAddr(addr).CountryCode; code != "" && slices.Contains(f.AllowedCountries, code) {
-			return Allow
-		}
-	}
-
-	if cidrActive {
-		return DenyCIDR
-	}
-	return DenyCountry
-}
-
 func (f *Filter) checkCIDR(addr netip.Addr) Verdict {
 	if len(f.AllowedCIDRs) > 0 {
 		allowed := false

proxy/internal/restrict/restrict_test.go

@@ -150,187 +150,6 @@ func TestFilter_Check_CIDRAllowThenCountryBlock(t *testing.T) {
 	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("192.168.1.1"), geo), "CIDR denied before country check")
 }
 
-// TestFilter_Check_CrossCategoryAllowlistsAreAND documents the current
-// behavior: when both a CIDR allowlist and a country allowlist are set, a
-// request must satisfy BOTH to be allowed (AND across categories). There is no
-// way today to express "allow if in allowed country OR in allowed CIDR", e.g.
-// "allow all US traffic plus our office IP abroad". This is the gap an
-// any/all allow-combine mode would close; the cases marked "GAP" are the ones
-// that would flip to Allow under an "any" mode.
-func TestFilter_Check_CrossCategoryAllowlistsAreAND(t *testing.T) {
-	officeAbroad := "203.0.113.7" // in allowed CIDR, but country not in allowlist
-	usOutsideOffice := "1.1.1.1"  // allowed country, but not in allowed CIDR
-	usOffice := "203.0.113.8"     // both
-	neither := "198.51.100.1"     // neither
-
-	geo := newMockGeo(map[string]string{
-		officeAbroad:    "DE",
-		usOutsideOffice: "US",
-		usOffice:        "US",
-		neither:         "CN",
-	})
-	f := ParseFilter(FilterConfig{
-		AllowedCIDRs:     []string{"203.0.113.0/24"},
-		AllowedCountries: []string{"US"},
-	})
-
-	assert.Equal(t, Allow, f.Check(netip.MustParseAddr(usOffice), geo), "in allowed CIDR and allowed country")
-	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr(officeAbroad), geo), "GAP: in allowed CIDR but country not allowed; any-mode should Allow")
-	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr(usOutsideOffice), geo), "GAP: allowed country but not in allowed CIDR; any-mode should Allow")
-	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr(neither), geo), "neither: denied under both modes")
-}
-
-// TestFilter_Check_CrossCategoryBlockAndAllow locks the current (all/AND)
-// cross-category semantics that the evaluator must preserve: a blocklist match
-// in any category denies regardless of allowlists, and blocklists across
-// categories are effectively OR (a match in either denies).
-func TestFilter_Check_CrossCategoryBlockAndAllow(t *testing.T) {
-	geo := newMockGeo(map[string]string{
-		"1.1.1.1":  "US",
-		"10.1.2.3": "US",
-		"2.2.2.2":  "CN",
-		"3.3.3.3":  "US",
-	})
-
-	t.Run("country allowlist with CIDR blocklist", func(t *testing.T) {
-		f := ParseFilter(FilterConfig{
-			AllowedCountries: []string{"US"},
-			BlockedCIDRs:     []string{"10.1.0.0/16"},
-		})
-		assert.Equal(t, Allow, f.Check(netip.MustParseAddr("1.1.1.1"), geo), "US and not in blocked CIDR")
-		assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("10.1.2.3"), geo), "US but in blocked CIDR, block wins")
-		assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("2.2.2.2"), geo), "not in allowed country")
-	})
-
-	t.Run("blocklists across categories are OR", func(t *testing.T) {
-		f := ParseFilter(FilterConfig{
-			BlockedCIDRs:     []string{"10.1.0.0/16"},
-			BlockedCountries: []string{"CN"},
-		})
-		assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("10.1.2.3"), geo), "in blocked CIDR")
-		assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("2.2.2.2"), geo), "in blocked country")
-		assert.Equal(t, Allow, f.Check(netip.MustParseAddr("3.3.3.3"), geo), "in neither blocklist")
-	})
-}
-
-// TestFilter_Check_AllowCIDRPlusAllowCountryDeniesGeolessLAN documents a trap
-// with all/AND mode: pairing an allowed CIDR (a private LAN) with an allowed
-// country denies the LAN source, because a private IP has no country in the
-// geo DB and an active country allowlist denies unknown countries. Under an
-// "any" mode the CIDR match alone would admit it. This is the strongest reason
-// allow-CIDR + allow-country usually wants OR, not AND.
-func TestFilter_Check_AllowCIDRPlusAllowCountryDeniesGeolessLAN(t *testing.T) {
-	geo := newMockGeo(map[string]string{}) // no entries: every lookup is unknown country
-	f := ParseFilter(FilterConfig{
-		AllowedCIDRs:     []string{"192.168.50.0/24"},
-		AllowedCountries: []string{"US"},
-	})
-
-	got := f.Check(netip.MustParseAddr("192.168.50.5"), geo)
-	assert.Equal(t, DenyCountry, got, "GAP: LAN source in allowed CIDR is denied by the country allowlist; any-mode should Allow")
-}
-
-func TestFilter_Check_AllowMatchAny(t *testing.T) {
-	bannedIP := "203.0.113.9"
-	geo := newMockGeo(map[string]string{
-		"1.1.1.1":      "US", // allowed country, outside allowed CIDR
-		"203.0.113.7":  "DE", // allowed CIDR, non-allowed country
-		"203.0.113.8":  "US", // both
-		bannedIP:       "US", // allowed CIDR, but CrowdSec-banned
-		"198.51.100.1": "CN", // neither
-		"2.2.2.2":      "CN", // blocked country, but in allowed CIDR
-	})
-
-	tests := []struct {
-		name   string
-		config FilterConfig
-		addr   string
-		geo    GeoResolver
-		want   Verdict
-	}{
-		{
-			name:   "in allowed CIDR only",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "203.0.113.7", geo: geo, want: Allow,
-		},
-		{
-			name:   "in allowed country only",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "1.1.1.1", geo: geo, want: Allow,
-		},
-		{
-			name:   "in both",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "203.0.113.8", geo: geo, want: Allow,
-		},
-		{
-			name:   "in neither",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "198.51.100.1", geo: geo, want: DenyCIDR,
-		},
-		{
-			name:   "geoless LAN admitted via CIDR (the #597 trap, fixed)",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"192.168.50.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "192.168.50.5", geo: newMockGeo(map[string]string{}), want: Allow,
-		},
-		{
-			name:   "CIDR match short-circuits geo when geo unavailable",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "203.0.113.7", geo: &unavailableGeo{}, want: Allow,
-		},
-		{
-			name:   "geo unavailable fails closed when CIDR does not match",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
-			addr:   "1.1.1.1", geo: &unavailableGeo{}, want: DenyGeoUnavailable,
-		},
-		{
-			name:   "block gate wins over allowed CIDR (blocked country)",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"0.0.0.0/0"}, BlockedCountries: []string{"CN"}},
-			addr:   "2.2.2.2", geo: geo, want: DenyCountry,
-		},
-		{
-			name:   "block gate wins over allowed country (blocked CIDR)",
-			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCountries: []string{"US"}, BlockedCIDRs: []string{"203.0.113.0/24"}},
-			addr:   "203.0.113.8", geo: geo, want: DenyCIDR,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			f := ParseFilter(tc.config)
-			assert.Equal(t, tc.want, f.Check(netip.MustParseAddr(tc.addr), tc.geo))
-		})
-	}
-}
-
-func TestFilter_Check_AllowMatchAny_CrowdSecStillRuns(t *testing.T) {
-	bannedIP := "203.0.113.9"
-	cs := &mockCrowdSec{decisions: map[string]*CrowdSecDecision{bannedIP: {Type: DecisionBan}}, ready: true}
-	geo := newMockGeo(map[string]string{bannedIP: "US", "203.0.113.7": "US"})
-
-	f := ParseFilter(FilterConfig{
-		AllowMatch:   AllowMatchAny,
-		AllowedCIDRs: []string{"203.0.113.0/24"},
-		CrowdSec:     cs,
-		CrowdSecMode: CrowdSecEnforce,
-	})
-	assert.Equal(t, DenyCrowdSecBan, f.Check(netip.MustParseAddr(bannedIP), geo), "CrowdSec ban denies even when allowlist admits")
-	assert.Equal(t, Allow, f.Check(netip.MustParseAddr("203.0.113.7"), geo), "clean IP in allowed CIDR is allowed")
-}
-
-func TestFilter_Check_UnknownAllowMatchDefaultsToAll(t *testing.T) {
-	// An unrecognized allow-combine mode must fall back to the restrictive
-	// AND default, never loosen access.
-	geo := newMockGeo(map[string]string{"203.0.113.7": "DE"})
-	f := ParseFilter(FilterConfig{
-		AllowMatch:       AllowMatch("bogus"),
-		AllowedCIDRs:     []string{"203.0.113.0/24"},
-		AllowedCountries: []string{"US"},
-	})
-	assert.Equal(t, AllowMatchAll, f.AllowMatch, "unknown mode normalizes to all")
-	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("203.0.113.7"), geo), "AND semantics: in CIDR but wrong country denied")
-}
-
 func TestParseFilter_Empty(t *testing.T) {
 	f := ParseFilter(FilterConfig{})
 	assert.Nil(t, f)

proxy/lifecycle.go

@@ -126,15 +126,6 @@ type Config struct {
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables
 	// CrowdSec.
 	CrowdSecAPIKey string
-	// CrowdSecAppSecURL is the CrowdSec AppSec (WAF) endpoint. Empty disables
-	// HTTP request inspection.
-	CrowdSecAppSecURL string
-	// CrowdSecAppSecTimeout bounds a single AppSec inspection call. Zero falls
-	// back to the internal default.
-	CrowdSecAppSecTimeout time.Duration
-	// CrowdSecAppSecMaxBodyBytes caps the request body mirrored to AppSec.
-	// Zero falls back to the internal default; negative forwards no body.
-	CrowdSecAppSecMaxBodyBytes int64
 }
 
 // New builds a Server from cfg without performing any I/O. No goroutines
@@ -144,45 +135,42 @@ type Config struct {
 // directly) byte-for-byte equivalent.
 func New(ctx context.Context, cfg Config) *Server {
 	return &Server{
-		ctx:                        ctx,
-		ListenAddr:                 cfg.ListenAddr,
-		ID:                         cfg.ID,
-		Logger:                     cfg.Logger,
-		Version:                    cfg.Version,
-		ProxyURL:                   cfg.ProxyURL,
-		ManagementAddress:          cfg.ManagementAddress,
-		ProxyToken:                 cfg.ProxyToken,
-		CertificateDirectory:       cfg.CertificateDirectory,
-		CertificateFile:            cfg.CertificateFile,
-		CertificateKeyFile:         cfg.CertificateKeyFile,
-		GenerateACMECertificates:   cfg.GenerateACMECertificates,
-		ACMEChallengeAddress:       cfg.ACMEChallengeAddress,
-		ACMEDirectory:              cfg.ACMEDirectory,
-		ACMEEABKID:                 cfg.ACMEEABKID,
-		ACMEEABHMACKey:             cfg.ACMEEABHMACKey,
-		ACMEChallengeType:          cfg.ACMEChallengeType,
-		CertLockMethod:             cfg.CertLockMethod,
-		WildcardCertDir:            cfg.WildcardCertDir,
-		DebugEndpointEnabled:       cfg.DebugEndpointEnabled,
-		DebugEndpointAddress:       cfg.DebugEndpointAddress,
-		HealthAddress:              cfg.HealthAddr,
-		ForwardedProto:             cfg.ForwardedProto,
-		TrustedProxies:             cfg.TrustedProxies,
-		WireguardPort:              cfg.WireguardPort,
-		ProxyProtocol:              cfg.ProxyProtocol,
-		PreSharedKey:               cfg.PreSharedKey,
-		Performance:                cfg.Performance,
-		SupportsCustomPorts:        cfg.SupportsCustomPorts,
-		RequireSubdomain:           cfg.RequireSubdomain,
-		Private:                    cfg.Private,
-		MaxDialTimeout:             cfg.MaxDialTimeout,
-		MaxSessionIdleTimeout:      cfg.MaxSessionIdleTimeout,
-		MappingBatchWatchdog:       cfg.MappingBatchWatchdog,
-		GeoDataDir:                 cfg.GeoDataDir,
-		CrowdSecAPIURL:             cfg.CrowdSecAPIURL,
-		CrowdSecAPIKey:             cfg.CrowdSecAPIKey,
-		CrowdSecAppSecURL:          cfg.CrowdSecAppSecURL,
-		CrowdSecAppSecTimeout:      cfg.CrowdSecAppSecTimeout,
-		CrowdSecAppSecMaxBodyBytes: cfg.CrowdSecAppSecMaxBodyBytes,
+		ctx:                      ctx,
+		ListenAddr:               cfg.ListenAddr,
+		ID:                       cfg.ID,
+		Logger:                   cfg.Logger,
+		Version:                  cfg.Version,
+		ProxyURL:                 cfg.ProxyURL,
+		ManagementAddress:        cfg.ManagementAddress,
+		ProxyToken:               cfg.ProxyToken,
+		CertificateDirectory:     cfg.CertificateDirectory,
+		CertificateFile:          cfg.CertificateFile,
+		CertificateKeyFile:       cfg.CertificateKeyFile,
+		GenerateACMECertificates: cfg.GenerateACMECertificates,
+		ACMEChallengeAddress:     cfg.ACMEChallengeAddress,
+		ACMEDirectory:            cfg.ACMEDirectory,
+		ACMEEABKID:               cfg.ACMEEABKID,
+		ACMEEABHMACKey:           cfg.ACMEEABHMACKey,
+		ACMEChallengeType:        cfg.ACMEChallengeType,
+		CertLockMethod:           cfg.CertLockMethod,
+		WildcardCertDir:          cfg.WildcardCertDir,
+		DebugEndpointEnabled:     cfg.DebugEndpointEnabled,
+		DebugEndpointAddress:     cfg.DebugEndpointAddress,
+		HealthAddress:            cfg.HealthAddr,
+		ForwardedProto:           cfg.ForwardedProto,
+		TrustedProxies:           cfg.TrustedProxies,
+		WireguardPort:            cfg.WireguardPort,
+		ProxyProtocol:            cfg.ProxyProtocol,
+		PreSharedKey:             cfg.PreSharedKey,
+		Performance:              cfg.Performance,
+		SupportsCustomPorts:      cfg.SupportsCustomPorts,
+		RequireSubdomain:         cfg.RequireSubdomain,
+		Private:                  cfg.Private,
+		MaxDialTimeout:           cfg.MaxDialTimeout,
+		MaxSessionIdleTimeout:    cfg.MaxSessionIdleTimeout,
+		MappingBatchWatchdog:     cfg.MappingBatchWatchdog,
+		GeoDataDir:               cfg.GeoDataDir,
+		CrowdSecAPIURL:           cfg.CrowdSecAPIURL,
+		CrowdSecAPIKey:           cfg.CrowdSecAPIKey,
 	}
 }

proxy/management_integration_test.go

@@ -240,10 +240,6 @@ func (m *testProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
-func (m *testProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
-	return nil
-}
-
 func (m *testProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }
@@ -566,11 +562,16 @@ func TestIntegration_ProxyConnection_ReconnectDoesNotDuplicateState(t *testing.T
 				addMappingCalls.Add(1)
 
 				// Apply to real auth middleware (idempotent)
-				err := authMw.AddDomain(mapping.GetDomain(), auth.DomainSettings{
-					AccountID: proxytypes.AccountID(mapping.GetAccountId()),
-					ServiceID: proxytypes.ServiceID(mapping.GetId()),
-					Private:   mapping.GetPrivate(),
-				})
+				err := authMw.AddDomain(
+					mapping.GetDomain(),
+					nil,
+					"",
+					0,
+					proxytypes.AccountID(mapping.GetAccountId()),
+					proxytypes.ServiceID(mapping.GetId()),
+					nil,
+					mapping.GetPrivate(),
+				)
 				require.NoError(t, err)
 
 				// Apply to real proxy (idempotent)

proxy/server.go

@@ -45,7 +45,6 @@ import (
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy/internal/accesslog"
 	"github.com/netbirdio/netbird/proxy/internal/acme"
-	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/auth"
 	"github.com/netbirdio/netbird/proxy/internal/certwatch"
 	"github.com/netbirdio/netbird/proxy/internal/conntrack"
@@ -127,10 +126,6 @@ type Server struct {
 	crowdsecMu       sync.Mutex
 	crowdsecServices map[types.ServiceID]bool
 
-	// appsecClient is the shared CrowdSec AppSec client, nil when no AppSec
-	// endpoint is configured. Stateless, so it needs no per-service lifecycle.
-	appsecClient *appsec.Client
-
 	// routerReady is closed once mainRouter is fully initialized.
 	// The mapping worker waits on this before processing updates.
 	routerReady chan struct{}
@@ -243,17 +238,6 @@ type Server struct {
 	CrowdSecAPIURL string
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables CrowdSec.
 	CrowdSecAPIKey string
-	// CrowdSecAppSecURL is the CrowdSec AppSec (WAF) endpoint, e.g.
-	// http://127.0.0.1:7422/. Empty disables request inspection. Requires
-	// CrowdSecAPIKey, which the AppSec component validates against LAPI.
-	CrowdSecAppSecURL string
-	// CrowdSecAppSecTimeout bounds a single AppSec inspection call.
-	// Zero means appsec.DefaultTimeout.
-	CrowdSecAppSecTimeout time.Duration
-	// CrowdSecAppSecMaxBodyBytes caps the request body mirrored to the AppSec
-	// engine. Zero means appsec.DefaultMaxBodyBytes; negative disables body
-	// forwarding, leaving header and URI inspection.
-	CrowdSecAppSecMaxBodyBytes int64
 	// MaxSessionIdleTimeout caps the per-service session idle timeout.
 	// Zero means no cap (the proxy honors whatever management sends).
 	// Set via NB_PROXY_MAX_SESSION_IDLE_TIMEOUT for shared deployments.
@@ -427,10 +411,6 @@ func (s *Server) Start(ctx context.Context) error {
 	}()
 
 	s.auth = auth.NewMiddleware(s.Logger, s.mgmtClient, s.geo)
-	// Must follow the auth middleware: the AppSec client is installed on it.
-	if err := s.initAppSec(); err != nil {
-		return err
-	}
 	s.accessLog = accesslog.NewLogger(s.mgmtClient, s.Logger, s.TrustedProxies)
 
 	s.startDebugEndpoint()
@@ -1294,7 +1274,6 @@ func (s *Server) newManagementMappingWorker(ctx context.Context, client proto.Pr
 
 func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 	supportsCrowdSec := s.crowdsecRegistry.Available()
-	supportsAppSec := s.appsecClient != nil
 	privateCapability := s.Private
 	// Always true: this build enforces ProxyMapping.private via the auth middleware.
 	supportsPrivateService := true
@@ -1302,7 +1281,6 @@ func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 		SupportsCustomPorts:    &s.SupportsCustomPorts,
 		RequireSubdomain:       &s.RequireSubdomain,
 		SupportsCrowdsec:       &supportsCrowdSec,
-		SupportsAppsec:         &supportsAppSec,
 		Private:                &privateCapability,
 		SupportsPrivateService: &supportsPrivateService,
 	}
@@ -1926,51 +1904,10 @@ func (s *Server) parseRestrictions(mapping *proto.ProxyMapping) *restrict.Filter
 		BlockedCountries: r.GetBlockedCountries(),
 		CrowdSec:         checker,
 		CrowdSecMode:     csMode,
-		AllowMatch:       restrict.AllowMatch(r.GetAllowMatch()),
 		Logger:           log.NewEntry(s.Logger),
 	})
 }
 
-// initAppSec builds the shared AppSec client when an endpoint is configured.
-// A configured-but-invalid endpoint is a startup error rather than a silent
-// downgrade: services asking for enforce would otherwise fail closed on every
-// request with no indication why.
-func (s *Server) initAppSec() error {
-	if s.CrowdSecAppSecURL == "" {
-		return nil
-	}
-	if s.CrowdSecAPIKey == "" {
-		return errors.New("crowdsec appsec url is set but the crowdsec api key is empty")
-	}
-
-	client, err := appsec.New(appsec.Config{
-		URL:          s.CrowdSecAppSecURL,
-		APIKey:       s.CrowdSecAPIKey,
-		Timeout:      s.CrowdSecAppSecTimeout,
-		MaxBodyBytes: s.CrowdSecAppSecMaxBodyBytes,
-		Logger:       log.NewEntry(s.Logger),
-	})
-	if err != nil {
-		return fmt.Errorf("init crowdsec appsec: %w", err)
-	}
-
-	s.appsecClient = client
-	s.auth.SetAppSec(client)
-	s.Logger.Infof("CrowdSec AppSec inspection available at %s", s.CrowdSecAppSecURL)
-	return nil
-}
-
-// appSecMode resolves the per-service AppSec mode. A service asking for
-// inspection on a proxy with no AppSec endpoint keeps its mode so the auth
-// middleware fails closed for enforce, mirroring the CrowdSec behavior.
-func (s *Server) appSecMode(mapping *proto.ProxyMapping) restrict.AppSecMode {
-	mode := restrict.ParseAppSecMode(mapping.GetAccessRestrictions().GetAppsecMode())
-	if mode.Enabled() && s.appsecClient == nil {
-		s.Logger.Warnf("service %s requests AppSec mode %q but proxy has no AppSec endpoint configured", mapping.GetId(), mode)
-	}
-	return mode
-}
-
 // releaseCrowdSec releases the CrowdSec bouncer reference for the given
 // service if it had one.
 func (s *Server) releaseCrowdSec(svcID types.ServiceID) {
@@ -2137,17 +2074,7 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 	s.warnIfGeoUnavailable(mapping.GetDomain(), mapping.GetAccessRestrictions())
 
 	maxSessionAge := time.Duration(mapping.GetAuth().GetMaxSessionAgeSeconds()) * time.Second
-	settings := auth.DomainSettings{
-		Schemes:           schemes,
-		SessionPublicKey:  mapping.GetAuth().GetSessionKey(),
-		SessionExpiration: maxSessionAge,
-		AccountID:         accountID,
-		ServiceID:         svcID,
-		IPRestrictions:    ipRestrictions,
-		Private:           mapping.GetPrivate(),
-		AppSecMode:        s.appSecMode(mapping),
-	}
-	if err := s.auth.AddDomain(mapping.GetDomain(), settings); err != nil {
+	if err := s.auth.AddDomain(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, accountID, svcID, ipRestrictions, mapping.GetPrivate()); err != nil {
 		return fmt.Errorf("auth setup for domain %s: %w", mapping.GetDomain(), err)
 	}
 	m := s.protoToMapping(ctx, mapping)

shared/management/http/api/openapi.yml

@@ -3379,30 +3379,6 @@ components:
             - "observe"
           default: "off"
           description: CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
-        allow_match:
-          type: string
-          enum:
-            - "all"
-            - "any"
-          default: "all"
-          description: >-
-            How the allowlists (allowed_cidrs, allowed_countries) combine.
-            "all" (default) requires a connection to match every configured
-            allowlist (AND); "any" requires it to match at least one (OR), e.g.
-            an allowed country OR an allowed CIDR. Blocklists always reject on
-            match regardless of this setting.
-        appsec_mode:
-          type: string
-          enum:
-            - "off"
-            - "enforce"
-            - "observe"
-          default: "off"
-          description: >-
-            CrowdSec AppSec (WAF) request inspection mode. Only available when
-            the proxy cluster supports AppSec, and only applied to HTTP
-            services. "enforce" blocks requests the WAF flags; "observe" records
-            the verdict in the access log without blocking.
     PasswordAuthConfig:
       type: object
       properties:
@@ -3539,10 +3515,6 @@ components:
           type: boolean
           description: Whether all active proxies in the cluster have CrowdSec configured
           example: false
-        supports_appsec:
-          type: boolean
-          description: Whether all active proxies in the cluster have a CrowdSec AppSec (WAF) endpoint configured
-          example: false
         private:
           type: boolean
           description: True when at least one connected proxy in this cluster is running embedded in a netbird client (`netbird proxy`) and serving over a WireGuard tunnel. Lets the dashboard distinguish per-peer / private clusters from centralised ones.
@@ -3602,10 +3574,6 @@ components:
           type: boolean
           description: Whether the proxy cluster has CrowdSec configured
           example: false
-        supports_appsec:
-          type: boolean
-          description: Whether the proxy cluster has a CrowdSec AppSec (WAF) endpoint configured
-          example: false
         supports_private:
           type: boolean
           description: Whether the proxy cluster supports private (NetBird-only) services. True when at least one connected proxy in the cluster runs embedded in a netbird client.
@@ -5854,13 +5822,48 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens consumed.
+          description: Total tokens consumed, including prompt-cache tokens.
           example: 1840
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Input tokens read from the provider's prompt cache. Additive to input_tokens for Anthropic-shape providers; a subset of input_tokens for OpenAI.
+          example: 0
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Input tokens written to the provider's prompt cache. Zero for providers without a cache-write bucket.
+          example: 30528
         cost_usd:
           type: number
           format: double
           description: Estimated USD cost of the request.
           example: 0.0231
+        input_cost_usd:
+          type: number
+          format: double
+          description: Cost of the non-cached input tokens. Base component of cost_usd.
+          example: 0.0048
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Cost of the prompt-cache read tokens. Base component of cost_usd, and part of cache_cost_usd.
+          example: 0.0015
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Cost of the prompt-cache write tokens. Base component of cost_usd, and part of cache_cost_usd.
+          example: 0.1130
+        output_cost_usd:
+          type: number
+          format: double
+          description: Cost of the output tokens. Base component of cost_usd.
+          example: 0.0038
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage.
+          example: 0.1145
         stream:
           type: boolean
           description: Whether the request was a streaming completion.
@@ -5884,7 +5887,14 @@ components:
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
     AgentNetworkAccessLogsResponse:
       type: object
       properties:
@@ -5958,13 +5968,48 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens across the session.
+          description: Total tokens across the session, including prompt-cache tokens.
           example: 12880
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache read tokens across the session.
+          example: 0
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache write tokens across the session.
+          example: 30528
         cost_usd:
           type: number
           format: double
           description: Total estimated USD cost across the session.
           example: 0.1617
+        input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of non-cached input tokens across the session.
+          example: 0.0210
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache read tokens across the session.
+          example: 0.0015
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache write tokens across the session.
+          example: 0.1130
+        output_cost_usd:
+          type: number
+          format: double
+          description: Total cost of output tokens across the session.
+          example: 0.0262
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage across the session.
+          example: 0.1145
         providers:
           type: array
           items:
@@ -5991,7 +6036,14 @@ components:
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
         - decision
         - entries
     AgentNetworkAccessLogSessionsResponse:
@@ -6045,19 +6097,61 @@ components:
         total_tokens:
           type: integer
           format: int64
-          description: Total tokens in the bucket.
+          description: Total tokens in the bucket, including prompt-cache tokens.
           example: 184000
+        cached_input_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache read tokens in the bucket.
+          example: 20000
+        cache_creation_tokens:
+          type: integer
+          format: int64
+          description: Total prompt-cache write tokens in the bucket.
+          example: 45000
+        input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of non-cached input tokens in the bucket.
+          example: 1.12
+        cached_input_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache read tokens in the bucket.
+          example: 0.06
+        cache_creation_cost_usd:
+          type: number
+          format: double
+          description: Total cost of prompt-cache write tokens in the bucket.
+          example: 0.36
+        output_cost_usd:
+          type: number
+          format: double
+          description: Total cost of output tokens in the bucket.
+          example: 0.77
         cost_usd:
           type: number
           format: double
           description: Total estimated USD spend in the bucket.
           example: 2.31
+        cache_cost_usd:
+          type: number
+          format: double
+          description: Portion of cost_usd billed for prompt-cache usage in the bucket.
+          example: 0.42
       required:
         - period_start
         - input_tokens
         - output_tokens
         - total_tokens
+        - cached_input_tokens
+        - cache_creation_tokens
+        - input_cost_usd
+        - cached_input_cost_usd
+        - cache_creation_cost_usd
+        - output_cost_usd
         - cost_usd
+        - cache_cost_usd
     AgentNetworkSettings:
       type: object
       description: Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.

shared/management/http/api/types.gen.go

@@ -17,45 +17,6 @@ const (
 	TokenAuthScopes  tokenAuthContextKey  = "TokenAuth.Scopes"
 )
 
-// Defines values for AccessRestrictionsAllowMatch.
-const (
-	AccessRestrictionsAllowMatchAll AccessRestrictionsAllowMatch = "all"
-	AccessRestrictionsAllowMatchAny AccessRestrictionsAllowMatch = "any"
-)
-
-// Valid indicates whether the value is a known member of the AccessRestrictionsAllowMatch enum.
-func (e AccessRestrictionsAllowMatch) Valid() bool {
-	switch e {
-	case AccessRestrictionsAllowMatchAll:
-		return true
-	case AccessRestrictionsAllowMatchAny:
-		return true
-	default:
-		return false
-	}
-}
-
-// Defines values for AccessRestrictionsAppsecMode.
-const (
-	AccessRestrictionsAppsecModeEnforce AccessRestrictionsAppsecMode = "enforce"
-	AccessRestrictionsAppsecModeObserve AccessRestrictionsAppsecMode = "observe"
-	AccessRestrictionsAppsecModeOff     AccessRestrictionsAppsecMode = "off"
-)
-
-// Valid indicates whether the value is a known member of the AccessRestrictionsAppsecMode enum.
-func (e AccessRestrictionsAppsecMode) Valid() bool {
-	switch e {
-	case AccessRestrictionsAppsecModeEnforce:
-		return true
-	case AccessRestrictionsAppsecModeObserve:
-		return true
-	case AccessRestrictionsAppsecModeOff:
-		return true
-	default:
-		return false
-	}
-}
-
 // Defines values for AccessRestrictionsCrowdsecMode.
 const (
 	AccessRestrictionsCrowdsecModeEnforce AccessRestrictionsCrowdsecMode = "enforce"
@@ -1573,18 +1534,12 @@ func (e PutApiIntegrationsMspTenantsIdInviteJSONBodyValue) Valid() bool {
 
 // AccessRestrictions Connection-level access restrictions based on IP address or geography. Applies to both HTTP and L4 services.
 type AccessRestrictions struct {
-	// AllowMatch How the allowlists (allowed_cidrs, allowed_countries) combine. "all" (default) requires a connection to match every configured allowlist (AND); "any" requires it to match at least one (OR), e.g. an allowed country OR an allowed CIDR. Blocklists always reject on match regardless of this setting.
-	AllowMatch *AccessRestrictionsAllowMatch `json:"allow_match,omitempty"`
-
 	// AllowedCidrs CIDR allowlist. If non-empty, only IPs matching these CIDRs are allowed.
 	AllowedCidrs *[]string `json:"allowed_cidrs,omitempty"`
 
 	// AllowedCountries ISO 3166-1 alpha-2 country codes to allow. If non-empty, only these countries are permitted.
 	AllowedCountries *[]string `json:"allowed_countries,omitempty"`
 
-	// AppsecMode CrowdSec AppSec (WAF) request inspection mode. Only available when the proxy cluster supports AppSec, and only applied to HTTP services. "enforce" blocks requests the WAF flags; "observe" records the verdict in the access log without blocking.
-	AppsecMode *AccessRestrictionsAppsecMode `json:"appsec_mode,omitempty"`
-
 	// BlockedCidrs CIDR blocklist. Connections from these CIDRs are rejected. Evaluated after allowed_cidrs.
 	BlockedCidrs *[]string `json:"blocked_cidrs,omitempty"`
 
@@ -1595,12 +1550,6 @@ type AccessRestrictions struct {
 	CrowdsecMode *AccessRestrictionsCrowdsecMode `json:"crowdsec_mode,omitempty"`
 }
 
-// AccessRestrictionsAllowMatch How the allowlists (allowed_cidrs, allowed_countries) combine. "all" (default) requires a connection to match every configured allowlist (AND); "any" requires it to match at least one (OR), e.g. an allowed country OR an allowed CIDR. Blocklists always reject on match regardless of this setting.
-type AccessRestrictionsAllowMatch string
-
-// AccessRestrictionsAppsecMode CrowdSec AppSec (WAF) request inspection mode. Only available when the proxy cluster supports AppSec, and only applied to HTTP services. "enforce" blocks requests the WAF flags; "observe" records the verdict in the access log without blocking.
-type AccessRestrictionsAppsecMode string
-
 // AccessRestrictionsCrowdsecMode CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
 type AccessRestrictionsCrowdsecMode string
 
@@ -1783,6 +1732,21 @@ type AccountSettings struct {
 
 // AgentNetworkAccessLog One per-request agent-network (LLM) access log entry with flattened, queryable LLM dimensions.
 type AgentNetworkAccessLog struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Cost of the prompt-cache write tokens. Base component of cost_usd, and part of cache_cost_usd.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Input tokens written to the provider's prompt cache. Zero for providers without a cache-write bucket.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Cost of the prompt-cache read tokens. Base component of cost_usd, and part of cache_cost_usd.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Input tokens read from the provider's prompt cache. Additive to input_tokens for Anthropic-shape providers; a subset of input_tokens for OpenAI.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Estimated USD cost of the request.
 	CostUsd float64 `json:"cost_usd"`
 
@@ -1804,6 +1768,9 @@ type AgentNetworkAccessLog struct {
 	// Id Unique identifier for the access log entry.
 	Id string `json:"id"`
 
+	// InputCostUsd Cost of the non-cached input tokens. Base component of cost_usd.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Input (prompt) tokens consumed.
 	InputTokens int64 `json:"input_tokens"`
 
@@ -1813,6 +1780,9 @@ type AgentNetworkAccessLog struct {
 	// Model Requested LLM model.
 	Model *string `json:"model,omitempty"`
 
+	// OutputCostUsd Cost of the output tokens. Base component of cost_usd.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Output (completion) tokens produced.
 	OutputTokens int64 `json:"output_tokens"`
 
@@ -1852,7 +1822,7 @@ type AgentNetworkAccessLog struct {
 	// Timestamp Timestamp when the request was made.
 	Timestamp time.Time `json:"timestamp"`
 
-	// TotalTokens Total tokens consumed.
+	// TotalTokens Total tokens consumed, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 
 	// UserId NetBird user id of the authenticated caller, if applicable.
@@ -1861,6 +1831,21 @@ type AgentNetworkAccessLog struct {
 
 // AgentNetworkAccessLogSession A session-grouped view of agent-network access logs — all requests sharing a session id (or a single session-less request) folded into one summary plus its ordered entries.
 type AgentNetworkAccessLogSession struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage across the session.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Total cost of prompt-cache write tokens across the session.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Total prompt-cache write tokens across the session.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Total cost of prompt-cache read tokens across the session.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Total prompt-cache read tokens across the session.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Total estimated USD cost across the session.
 	CostUsd float64 `json:"cost_usd"`
 
@@ -1876,12 +1861,18 @@ type AgentNetworkAccessLogSession struct {
 	// GroupIds Union of the authorising group ids across the session's entries.
 	GroupIds *[]string `json:"group_ids,omitempty"`
 
+	// InputCostUsd Total cost of non-cached input tokens across the session.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Total input (prompt) tokens across the session.
 	InputTokens int64 `json:"input_tokens"`
 
 	// Models Distinct models seen in the session.
 	Models *[]string `json:"models,omitempty"`
 
+	// OutputCostUsd Total cost of output tokens across the session.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Total output (completion) tokens across the session.
 	OutputTokens int64 `json:"output_tokens"`
 
@@ -1897,7 +1888,7 @@ type AgentNetworkAccessLogSession struct {
 	// StartedAt Timestamp of the session's earliest request.
 	StartedAt time.Time `json:"started_at"`
 
-	// TotalTokens Total tokens across the session.
+	// TotalTokens Total tokens across the session, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 
 	// UserId NetBird user id of the session's caller.
@@ -2398,19 +2389,40 @@ type AgentNetworkSettingsRequest struct {
 
 // AgentNetworkUsageBucket One aggregated agent-network usage time bucket (UTC). The bucket width is set by the request's granularity.
 type AgentNetworkUsageBucket struct {
+	// CacheCostUsd Portion of cost_usd billed for prompt-cache usage in the bucket.
+	CacheCostUsd float64 `json:"cache_cost_usd"`
+
+	// CacheCreationCostUsd Total cost of prompt-cache write tokens in the bucket.
+	CacheCreationCostUsd float64 `json:"cache_creation_cost_usd"`
+
+	// CacheCreationTokens Total prompt-cache write tokens in the bucket.
+	CacheCreationTokens int64 `json:"cache_creation_tokens"`
+
+	// CachedInputCostUsd Total cost of prompt-cache read tokens in the bucket.
+	CachedInputCostUsd float64 `json:"cached_input_cost_usd"`
+
+	// CachedInputTokens Total prompt-cache read tokens in the bucket.
+	CachedInputTokens int64 `json:"cached_input_tokens"`
+
 	// CostUsd Total estimated USD spend in the bucket.
 	CostUsd float64 `json:"cost_usd"`
 
+	// InputCostUsd Total cost of non-cached input tokens in the bucket.
+	InputCostUsd float64 `json:"input_cost_usd"`
+
 	// InputTokens Total input (prompt) tokens in the bucket.
 	InputTokens int64 `json:"input_tokens"`
 
+	// OutputCostUsd Total cost of output tokens in the bucket.
+	OutputCostUsd float64 `json:"output_cost_usd"`
+
 	// OutputTokens Total output (completion) tokens in the bucket.
 	OutputTokens int64 `json:"output_tokens"`
 
 	// PeriodStart Start of the bucket in YYYY-MM-DD (UTC) — the day, the week start (Monday), or the month start, depending on granularity.
 	PeriodStart string `json:"period_start"`
 
-	// TotalTokens Total tokens in the bucket.
+	// TotalTokens Total tokens in the bucket, including prompt-cache tokens.
 	TotalTokens int64 `json:"total_tokens"`
 }
 
@@ -4716,9 +4728,6 @@ type ProxyCluster struct {
 	// RequireSubdomain Whether services on this cluster must include a subdomain label
 	RequireSubdomain *bool `json:"require_subdomain,omitempty"`
 
-	// SupportsAppsec Whether all active proxies in the cluster have a CrowdSec AppSec (WAF) endpoint configured
-	SupportsAppsec *bool `json:"supports_appsec,omitempty"`
-
 	// SupportsCrowdsec Whether all active proxies in the cluster have CrowdSec configured
 	SupportsCrowdsec *bool `json:"supports_crowdsec,omitempty"`
 
@@ -4787,9 +4796,6 @@ type ReverseProxyDomain struct {
 	// RequireSubdomain Whether a subdomain label is required in front of this domain. When true, the domain cannot be used bare.
 	RequireSubdomain *bool `json:"require_subdomain,omitempty"`
 
-	// SupportsAppsec Whether the proxy cluster has a CrowdSec AppSec (WAF) endpoint configured
-	SupportsAppsec *bool `json:"supports_appsec,omitempty"`
-
 	// SupportsCrowdsec Whether the proxy cluster has CrowdSec configured
 	SupportsCrowdsec *bool `json:"supports_crowdsec,omitempty"`
 

shared/management/proto/proxy_service.proto

@@ -73,10 +73,6 @@ message ProxyCapabilities {
   optional bool private = 4;
   // Whether the proxy enforces ProxyMapping.private (fails closed on ValidateTunnelPeer failure). Management MUST NOT stream private mappings to proxies that don't claim this.
   optional bool supports_private_service = 5;
-  // Whether the proxy has a CrowdSec AppSec (WAF) endpoint configured and can
-  // inspect HTTP requests. Independent of supports_crowdsec: AppSec is a
-  // separate endpoint on the Security Engine and applies to HTTP services only.
-  optional bool supports_appsec = 6;
 }
 
 // GetMappingUpdateRequest is sent to initialise a mapping stream.
@@ -207,13 +203,6 @@ message AccessRestrictions {
   repeated string blocked_countries = 4;
   // CrowdSec IP reputation mode: "", "off", "enforce", or "observe".
   string crowdsec_mode = 5;
-  // How the allowlists (CIDR, country) combine: "" or "all" require matching
-  // every allowlist (AND); "any" requires matching at least one (OR).
-  // Blocklists are always a hard-deny gate, independent of this mode.
-  string allow_match = 6;
-  // CrowdSec AppSec (WAF) request inspection mode: "", "off", "enforce", or
-  // "observe". HTTP services only; ignored for TCP/UDP/TLS modes.
-  string appsec_mode = 7;
 }
 
 message ProxyMapping {