Description

Fixes #3432

Problem

Previously:

1. COUNTRY and COUNTRY_IS_NOT access rules only accepted a single country code (or ALL), preventing users from configuring multi-country rules (e.g., US, CA).
2. When users created multiple separate COUNTRY_IS_NOT rules (e.g. Rule 1: COUNTRY_IS_NOT US -> DROP and Rule 2: COUNTRY_IS_NOT CA -> DROP), sequential short-circuiting rule evaluation caused all traffic to be dropped (since an IP from US was not CA and was dropped by Rule 2, and an IP from CA was dropped by Rule 1).

Fix

• Multi-Country Support: Updated backend validators (server/lib/validators.ts), frontend validators (policy-access-rule-validation.ts), and blueprint schemas (server/lib/blueprints/types.ts) to accept comma-separated country codes (e.g. US, CA, MX).
• Engine Rule Grouping: Updated isIpInGeoIP and checkRules in server/routers/badger/verifySession.ts to parse comma-separated country lists and group consecutive COUNTRY_IS_NOT rules with matching actions. This evaluates them as a unified exclusion set (IP NOT IN {US, CA}) rather than prematurely dropping allowed countries.
• UI Multi-Select: Updated PolicyAccessRulesTable.tsx to provide a multi-select country popover UI with flag previews and summary counts.
• Unit Tests: Added test coverage in server/lib/validators.test.ts for single and multi-country rule validation.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

1. Added unit test cases for comma-separated country codes in server/lib/validators.test.ts.
2. Verified unit test execution via npx tsx server/lib/validators.test.ts.
3. Verified frontend multi-select country UI behavior and validation.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have added tests that prove my fix is effective or that my feature works
• Existing and new unit tests pass locally with my changes