Add allow_match toggle and browser-detected country to access rules

[lixmal]

Adds a UI for the reverse proxy allow_match mode and improves the country picker.

• Add a "Require all allow rules" toggle on the access control tab that controls how allow rules combine: off matches any allow category (country OR IP/CIDR), on requires all of them. It stays disabled until allow rules span both a country and an IP/CIDR, since that is the only case where the mode changes the outcome.
• Default new services to match-any; existing services without a stored value keep match-all for backward compatibility.
• Surface the browser-detected country at the top of the country selector.

Issue ticket number and link

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

netbirdio/docs#884

E2E tests

Optional: override the image tags used by the Playwright e2e workflow.
Defaults to main when omitted.

management-cloud-tag: main
reverse-proxy-tag: main

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features
  • Country selection now prioritizes the option matching the browser’s preferred region when available.
  • Reverse proxy access controls now support choosing whether users must match all configured allow rules or any of them.
  • The match mode is available when both country and IP/CIDR rules are configured, with sensible defaults for new and existing services.

[coderabbitai]

📝 Walkthrough

Walkthrough

CountrySelector prioritizes the browser’s detected country. Reverse-proxy access controls now support ALL and ANY allow matching, with conditional persistence and a new toggle in the access-control editor.

Changes

Browser-based country ordering

Layer / File(s)	Summary
Detect and prioritize browser country src/components/ui/CountrySelector.tsx	The selector derives a browser region, moves a matching country option to the front, and passes the reordered list to the dropdown.

Reverse-proxy allow matching

Layer / File(s)	Summary
Define allow-match restriction contract src/interfaces/ReverseProxy.ts	Access restrictions now expose ALL and ANY allow-match values through an exported constant, type, and optional property.
Wire allow-match rules and controls src/modules/reverse-proxy/ReverseProxyAccessControlRules.tsx, src/modules/reverse-proxy/ReverseProxyModal.tsx	The editor derives eligible rule categories, initializes and persists allow-match state, renders its toggle, and receives the new-service default from the modal.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReverseProxyModal
  participant ReverseProxyAccessControlRules
  participant onChangeRef
  ReverseProxyModal->>ReverseProxyAccessControlRules: render with isNewService
  ReverseProxyAccessControlRules->>ReverseProxyAccessControlRules: select ALL or ANY
  ReverseProxyAccessControlRules->>onChangeRef: send restrictions with allow_match when applicable

Loading

Suggested reviewers: heisbrot

Poem

I’m a rabbit with rules in my paws,
Sorting countries without any flaws.
“All” or “any,” the toggle now sings,
While browser clues guide country wings.
Hop, hop—cleaner choices take flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: adding allow_match support and browser-detected country sorting.
Description check	✅ Passed	The description follows the template and covers docs and E2E fields, but the issue ticket section is left blank.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch reverse-proxy-allow-match-toggle

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}