From 49b869f0cade518d6c9d6a241524ac1931eead73 Mon Sep 17 00:00:00 2001
From: fuomag9 <1580624+fuomag9@users.noreply.github.com>
Date: Fri, 3 Apr 2026 10:15:13 +0200
Subject: [PATCH] fix: include WAF blocks in dashboard blocked counter

The Traffic (24h) card's "Blocked" percentage only counted
geo-blocks from trafficEvents. Now also queries wafEvents to
include WAF-blocked requests in the total.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/lib/analytics-db.ts | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/lib/analytics-db.ts b/src/lib/analytics-db.ts
index 60509de9..02f4a201 100644
--- a/src/lib/analytics-db.ts
+++ b/src/lib/analytics-db.ts
@@ -1,6 +1,6 @@
 import { sql, and, gte, lte, eq, inArray } from 'drizzle-orm';
 import db from './db';
-import { trafficEvents, proxyHosts } from './db/schema';
+import { trafficEvents, proxyHosts, wafEvents } from './db/schema';
 import { existsSync } from 'node:fs';
 
 export type Interval = '1h' | '12h' | '24h' | '7d' | '30d';
@@ -51,8 +51,23 @@ export async function getAnalyticsSummary(from: number, to: number, hosts: strin
     .where(where)
     .get();
 
+  // Count WAF blocks in the same time window
+  const wafConditions = [gte(wafEvents.ts, from), lte(wafEvents.ts, to), eq(wafEvents.blocked, true)];
+  if (hosts.length === 1) {
+    wafConditions.push(eq(wafEvents.host, hosts[0]));
+  } else if (hosts.length > 1) {
+    wafConditions.push(inArray(wafEvents.host, hosts));
+  }
+  const wafRow = db
+    .select({ blocked: sql<number>`count(*)` })
+    .from(wafEvents)
+    .where(and(...wafConditions))
+    .get();
+
   const total = row?.total ?? 0;
-  const blocked = row?.blocked ?? 0;
+  const geoBlocked = row?.blocked ?? 0;
+  const wafBlocked = wafRow?.blocked ?? 0;
+  const blocked = geoBlocked + wafBlocked;
 
   return {
     totalRequests: total,