feat: show cleared high-cost approvals and record budget-skipped scheduled runs

[crypt0rr]

Summary

Makes high-cost approval and probe-budget refusals visible (#1223). Before this change an operator's scope edit could silently clear an administrator's approval, and from then on every scheduled run was refused before a scan record existed, with nothing in history, Activity or notifications.

Approval cleared on a scope change

• Clearing the approval on a scope change stays as designed ([P2] Reapprove high-cost scans when an operator expands approved scope #523). What changes is that people are told:
  • The scope-change confirmation (409 rebaseline_confirmation_required, details.changes) now includes "high-cost approval: cleared; an administrator must approve the new scope again". It adds whether the new scope exceeds the probe budget, with the estimate and limit, or that it fits without the approval.
  • The 200 save response carries high_cost_approval_cleared: true.
  • The editor tells an operator editing an approved job that changing targets, ports or scanner clears the approval.

Budget state on the job

• GET, create and update responses for a job now include scan_budget:
  • exceeded
  • estimated_probes and limit
  • approval_would_fit: whether an administrator's approval would let the job run.
• The job page shows a warning when scheduled scans are skipped. An approval can fix that ("…until an administrator approves high-cost scans") unless the job exceeds the hard ceiling ("…until its scope is reduced").
• The page header notes "High-cost scans approved".

Scheduled budget skips are recorded

• A scheduled run that its probe budget stops before a scan record exists now records a scan-budget-exceeded event. It goes into the outbox for the job's destinations, is published live, and appears in Activity as Scheduled scan skipped in the warning tone.
• Deduplication: a BudgetSkipAlertKey (scope hash and budget) in the job's runtime state stops an hourly job from alerting every hour.
  • The key is stored in the job's runtime state JSON, so there is no schema change.
  • Any finalized scan of the job clears it, and a scope or budget change produces a new key.
• If the destinations cannot be resolved, nothing is recorded, as the silence watchdog does, and the next scheduled run tries again.
• Manual Scan now keeps its existing visible 422.

Docs: the scanning guide covers budget refusals, the job-page warning and approval clearing; the notifications guide lists the new alert.

Compatibility

• Additive:
  • scan_budget and high_cost_approval_cleared in job responses;
  • a new entry in the confirmation's changes list;
  • a new scan-budget-exceeded event type and notification.
• There are no schema changes.

Validation

• gofmt, go vet ./...
• go test -race for internal/app, internal/engine, internal/model and internal/web.
• npm run lint
• Vitest: 45 files passed. One footprint test timed out once under local load and passes on its own.
• npm --prefix docs run build

New tests:

• internal/app/budget_skip_test.go: a scheduled over-budget run records one delivered and published event; a repeat records nothing; after a scan runs, the next skip is reported again.
• internal/web/high_cost_visibility_test.go:
  • an approved job's budget fits;
  • an operator's scope edit gets the cleared approval, with the budget overrun, in the 409;
  • the confirmed save reports high_cost_approval_cleared and scan_budget with approval_would_fit;
  • a routine edit reports nothing.
• Console: the job-page warning in both variants and the approved note; the editor hint; the Activity label and tone; the stream invalidation.

Fixes #1223

[cloudflare-workers-and-pages]

Deploying edgewatch with    Cloudflare Pages

Latest commit:	de7749a
Status:	✅  Deploy successful!
Preview URL:	https://ad00d34f.edgewatch-cpd.pages.dev
Branch Preview URL:	https://feat-high-cost-approval-visi.edgewatch-cpd.pages.dev

View logs