feat(api): unify policy handling with default action updates

- Updated `evofw-firewall.sh` and related scripts to replace `policy_mode` with `default_action`, enhancing clarity and consistency in policy management.
- Adjusted agent routes and evaluation logic to accommodate the new default action structure, ensuring backward compatibility with legacy modes.
- Enhanced tests to validate the new default action behavior and its integration within the agent policy framework.
- Refactored related components in the web interface to align with the updated policy handling, improving user experience and reducing confusion around policy modes.

packages/db/src/repositories/index.ts

@@ -215,22 +215,12 @@ export function listSetsForAgent(db: Db, agentId: string) {
     .all()
 }
 
-/** Replace agent↔set assignments; set_ids order = sort. All sets must share policy_mode. */
+/** Replace agent↔set assignments; set_ids order = sort. */
 export function setAgentPolicySets(db: Db, agentId: string, setIds: string[]) {
-  if (setIds.length > 0) {
-    const modes = new Set<string>()
-    for (const setId of setIds) {
-      const s = getPolicySet(db, setId)
-      if (!s) throw new Error(`policy set not found: ${setId}`)
-      modes.add(s.policyMode === 'whitelist' ? 'whitelist' : 'blacklist')
+  for (const setId of setIds) {
+    if (!getPolicySet(db, setId)) {
+      throw new Error(`policy set not found: ${setId}`)
     }
-    if (modes.size > 1) {
-      throw new Error(
-        'все наборы агента должны иметь один режим (blacklist или whitelist)',
-      )
-    }
-    const mode = [...modes][0] ?? 'blacklist'
-    updateAgent(db, agentId, { policyMode: mode })
   }
 
   db.delete(agentPolicySets).where(eq(agentPolicySets.agentId, agentId)).run()
@@ -498,7 +488,7 @@ export function cloneRulesFrom(
   }
 
   updateAgent(db, targetAgentId, {
-    policyMode: source.policyMode,
+    defaultAction: source.defaultAction,
     policyGeneration: (target.policyGeneration ?? 1) + 1,
   })
   return getAgent(db, targetAgentId)

packages/db/src/schema.ts

@@ -19,7 +19,8 @@ export const agents = sqliteTable(
     tokenPrefix: text('token_prefix').notNull(),
     tokenHash: text('token_hash').notNull(),
     status: text('status').notNull().default('pending'), // invited | pending | approved | revoked
-    policyMode: text('policy_mode').notNull().default('blacklist'), // blacklist | whitelist
+    /** Packet default when not in deny/allow sets: accept | drop */
+    defaultAction: text('default_action').notNull().default('accept'),
     policyGeneration: integer('policy_generation').notNull().default(1),
     lastSeenAt: text('last_seen_at'),
     lastSeenIp: text('last_seen_ip'),
@@ -84,7 +85,8 @@ export const policySets = sqliteTable('policy_sets', {
   name: text('name').notNull(),
   description: text('description'),
   enabled: integer('enabled').notNull().default(1),
-  policyMode: text('policy_mode').notNull().default('blacklist'), // blacklist | whitelist
+  /** Legacy unused; sets no longer carry exclusive mode. */
+  policyMode: text('policy_mode').notNull().default('blacklist'),
   createdAt: text('created_at')
     .notNull()
     .default(sql`(strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))`),