fix: 修复 WAF 规则组保存/绑定网站时报 of_waf_rule_group_bindings_pkey 冲突

internal/apps/agent/nginx/pow_assets.go

@@ -71,7 +71,7 @@ local function load_pow_config()
                     local groups = {}
                     for _, group in ipairs(decoded.rule_groups) do
                         if group.pow_enabled then
-                            groups[tostring(group.id)] = group.pow_config
+                            groups[tostring(group.id)] = group.pow_config or {}
                         end
                     end
                     -- Build site name to pow_config map
@@ -88,12 +88,12 @@ local function load_pow_config()
                         if not pow_config then
                             for _, group in ipairs(decoded.rule_groups) do
                                 if group.is_global and group.pow_enabled then
-                                    pow_config = group.pow_config
+                                    pow_config = group.pow_config or {}
                                     break
                                 end
                             end
                         end
-                        if pow_config then
+                        if pow_config ~= nil then
                             pow_config_dict:set(site, cjson.encode({enabled = true, config = pow_config}), 0)
                             domain_keys[#domain_keys+1] = site
                         end

internal/apps/openflare/config_version/logics_test.go

@@ -177,3 +177,52 @@ func TestBuildSnapshotWAFDocumentUsesNormalizedSiteNames(t *testing.T) {
 	assert.Contains(t, bundle.RouteConfig, `set $openflare_waf_site "example.com"`)
 	assert.Contains(t, bundle.RouteConfig, `require("pow.runtime").check()`)
 }
+
+func TestBuildCurrentConfigBundleEnablesGlobalPoWWithoutExplicitBinding(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	route := &model.ProxyRoute{
+		Domain:    "pow-global.example.com",
+		Domains:   `["pow-global.example.com"]`,
+		OriginURL: "http://origin.example.com:8080",
+		Upstreams: `["http://origin.example.com:8080"]`,
+		Enabled:   true,
+	}
+	require.NoError(t, model.CreateProxyRouteRecord(ctx, route))
+
+	require.NoError(t, waf.EnsureDefaultRuleGroup(ctx))
+	globalGroup, err := model.GetGlobalOpenFlareWAFRuleGroup(ctx)
+	require.NoError(t, err)
+	globalGroup.PoWEnabled = true
+	globalGroup.PoWConfig = `{"difficulty":4,"algorithm":"fast","session_ttl":600,"challenge_ttl":300}`
+	require.NoError(t, model.UpdateOpenFlareWAFRuleGroup(ctx, globalGroup))
+
+	bundle, err := buildCurrentConfigBundle(ctx, true)
+	require.NoError(t, err)
+	assert.Contains(t, bundle.RouteConfig, `require("pow.runtime").check()`)
+
+	var wafRuntime struct {
+		RuleGroups []struct {
+			ID         uint `json:"id"`
+			PoWEnabled bool `json:"pow_enabled"`
+			PoWConfig  *struct {
+				Difficulty int `json:"difficulty"`
+			} `json:"pow_config"`
+		} `json:"rule_groups"`
+		SiteRuleGroups map[string][]uint `json:"site_rule_groups"`
+	}
+	for _, file := range bundle.SupportFiles {
+		if file.Path != "waf_config.json" {
+			continue
+		}
+		require.NoError(t, json.Unmarshal([]byte(file.Content), &wafRuntime))
+	}
+	require.Contains(t, wafRuntime.SiteRuleGroups, "pow-global.example.com")
+	require.Contains(t, wafRuntime.SiteRuleGroups["pow-global.example.com"], globalGroup.ID)
+	require.NotEmpty(t, wafRuntime.RuleGroups)
+	assert.True(t, wafRuntime.RuleGroups[0].PoWEnabled)
+	require.NotNil(t, wafRuntime.RuleGroups[0].PoWConfig)
+	assert.Equal(t, 4, wafRuntime.RuleGroups[0].PoWConfig.Difficulty)
+}

internal/apps/openflare/config_version/snapshot.go

@@ -308,7 +308,7 @@ func buildSnapshotWAFDocument(ctx context.Context, routes []*model.ProxyRoute) (
 			RegionWhitelist:   view.RegionWhitelist,
 			RegionBlacklist:   view.RegionBlacklist,
 			PoWEnabled:        view.PoWEnabled,
-			PoWConfig:         convertPoWConfig(view.PoWConfig),
+			PoWConfig:         convertPoWConfig(view.PoWEnabled, view.PoWConfig),
 		})
 	}
 	ipGroups, err := buildSnapshotWAFIPGroups(ctx, ruleGroups)
@@ -415,10 +415,14 @@ func decodeIPList(raw string) ([]string, error) {
 	return items, nil
 }
 
-func convertPoWConfig(config *waf.PoWConfig) *openrestyrender.PoWConfig {
-	if config == nil {
+func convertPoWConfig(enabled bool, config *waf.PoWConfig) *openrestyrender.PoWConfig {
+	if !enabled {
 		return nil
 	}
+	if config == nil {
+		defaultConfig := openrestyrender.DefaultPoWConfig()
+		return &defaultConfig
+	}
 	return &openrestyrender.PoWConfig{
 		Difficulty:   config.Difficulty,
 		Algorithm:    config.Algorithm,

internal/db/migrator/202606200006_migrate_legacy_data.go

@@ -102,7 +102,8 @@ func up202606200006(ctx context.Context, tx *sql.Tx) error {
 		if _, err := tx.ExecContext(ctx, `
 			SELECT setval(
 				pg_get_serial_sequence('of_waf_rule_group_bindings', 'id'),
-				COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0)
+				GREATEST(COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0), 1),
+				COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0) > 0
 			)
 		`); err != nil {
 			return fmt.Errorf("sync of_waf_rule_group_bindings sequence failed: %w", err)

internal/db/migrator/goose/postgres/202606200007_sync_of_waf_binding_sequence.sql

@@ -1,7 +1,8 @@
 -- +goose Up
 SELECT setval(
     pg_get_serial_sequence('of_waf_rule_group_bindings', 'id'),
-    COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0)
+    GREATEST(COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0), 1),
+    COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0) > 0
 );
 
 -- +goose Down

internal/model/openflare_waf.go

@@ -319,7 +319,8 @@ func syncWAFBindingIDSequence(tx *gorm.DB) error {
 	return tx.Exec(`
 		SELECT setval(
 			pg_get_serial_sequence('of_waf_rule_group_bindings', 'id'),
-			COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0)
+			GREATEST(COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0), 1),
+			COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0) > 0
 		)
 	`).Error
 }