feat(waf): 新增 UA 检查节点 ua_check

支持要求携带 UA、浏览器/OS 白名单 and-or 匹配，以及优先屏蔽爬虫与非正常 UA。

internal/apps/openflare/waf/graph_compile.go

@@ -88,6 +88,17 @@ func compileRuleNodeConfig(node RuleNode) (any, error) {
 	case RuleNodePoW:
 		var config PoWNodeConfig
 		return config, decodeStrictConfig(node.Config, &config)
+	case RuleNodeUACheck:
+		var config UACheckConfig
+		if err := decodeStrictConfig(node.Config, &config); err != nil {
+			return nil, err
+		}
+		config.Browsers = sortedUniqueStrings(config.Browsers)
+		config.OperatingSystems = sortedUniqueStrings(config.OperatingSystems)
+		if config.MatchMode == "" {
+			config.MatchMode = UACheckMatchModeOr
+		}
+		return config, nil
 	case RuleNodeBlock:
 		var config BlockNodeConfig
 		return config, decodeStrictConfig(node.Config, &config)

internal/apps/openflare/waf/graph_compile_test.go

@@ -42,6 +42,39 @@ func TestCompileRuleGraph(t *testing.T) {
 	}
 }
 
+func TestCompileUACheckConfigNormalizesListsAndMatchMode(t *testing.T) {
+	graph := RuleGraph{SchemaVersion: RuleGraphSchemaVersion, Nodes: []RuleNode{
+		{ID: "start", Type: RuleNodeStart, Config: rawConfig(`{}`)},
+		{ID: "ua", Type: RuleNodeUACheck, Config: rawConfig(`{"browsers":["Safari","Chrome","Chrome"],"operating_systems":["iOS","Android"],"require_ua":true,"block_common_bots":true}`)},
+		{ID: "allow", Type: RuleNodeAllow, Config: rawConfig(`{}`)},
+		{ID: "block", Type: RuleNodeBlock, Config: rawConfig(`{"status_code":403}`)},
+	}, Edges: []RuleEdge{
+		{ID: "e1", Source: "start", SourceHandle: "next", Target: "ua"},
+		{ID: "e2", Source: "ua", SourceHandle: "true", Target: "allow"},
+		{ID: "e3", Source: "ua", SourceHandle: "false", Target: "block"},
+	}}
+	compiled, err := CompileRuleGraph(graph)
+	if err != nil {
+		t.Fatalf("CompileRuleGraph() error = %v", err)
+	}
+	cfg, ok := compiled.Nodes["ua"].Config.(UACheckConfig)
+	if !ok {
+		t.Fatalf("config type = %T", compiled.Nodes["ua"].Config)
+	}
+	if !reflect.DeepEqual(cfg.Browsers, []string{"Chrome", "Safari"}) {
+		t.Fatalf("browsers = %#v", cfg.Browsers)
+	}
+	if !reflect.DeepEqual(cfg.OperatingSystems, []string{"Android", "iOS"}) {
+		t.Fatalf("os = %#v", cfg.OperatingSystems)
+	}
+	if cfg.MatchMode != UACheckMatchModeOr {
+		t.Fatalf("match_mode = %q, want or", cfg.MatchMode)
+	}
+	if !cfg.RequireUA || !cfg.BlockCommonBots || cfg.BlockAbnormalUA {
+		t.Fatalf("flags = %#v", cfg)
+	}
+}
+
 func TestCompileRuleGraphIsDeterministicForNodeAndEdgeOrder(t *testing.T) {
 	first := RuleGraph{SchemaVersion: RuleGraphSchemaVersion, Nodes: []RuleNode{
 		{ID: "start", Type: RuleNodeStart, Config: rawConfig(`{}`)},

internal/apps/openflare/waf/graph_types.go

@@ -24,6 +24,8 @@ const (
 	RuleNodeGeoMatch RuleNodeType = "geo_match"
 	// RuleNodePoW runs a proof-of-work challenge before continuing.
 	RuleNodePoW RuleNodeType = "pow"
+	// RuleNodeUACheck branches on User-Agent presence, classification, and lists.
+	RuleNodeUACheck RuleNodeType = "ua_check"
 )
 
 // RuleGraph is the editor-facing representation of an executable WAF graph.
@@ -83,6 +85,22 @@ type BlockNodeConfig struct {
 	ResponseBody string `json:"response_body,omitempty"`
 }
 
+// UACheckConfig configures User-Agent presence, whitelist, and block switches.
+type UACheckConfig struct {
+	RequireUA        bool     `json:"require_ua"`
+	Browsers         []string `json:"browsers,omitempty"`
+	OperatingSystems []string `json:"operating_systems,omitempty"`
+	MatchMode        string   `json:"match_mode,omitempty"`
+	BlockCommonBots  bool     `json:"block_common_bots"`
+	BlockAbnormalUA  bool     `json:"block_abnormal_ua"`
+}
+
+// UA check match modes.
+const (
+	UACheckMatchModeAnd = "and"
+	UACheckMatchModeOr  = "or"
+)
+
 // DefaultRuleGraph returns the minimal start-to-allow graph.
 func DefaultRuleGraph() RuleGraph {
 	return RuleGraph{SchemaVersion: RuleGraphSchemaVersion, Nodes: []RuleNode{

internal/apps/openflare/waf/graph_validate.go

@@ -87,7 +87,7 @@ func validateRuleGraphNodes(ctx context.Context, graphNodes []RuleNode, ipGroupE
 			startID = node.ID
 		case RuleNodeAllow:
 			allowCount++
-		case RuleNodeBlock, RuleNodeIPMatch, RuleNodeGeoMatch, RuleNodePoW:
+		case RuleNodeBlock, RuleNodeIPMatch, RuleNodeGeoMatch, RuleNodePoW, RuleNodeUACheck:
 		default:
 			return nil, "", fmt.Errorf("节点 %s 的类型 %s 未知", node.ID, node.Type)
 		}
@@ -180,6 +180,8 @@ func validateRuleNodeConfig(ctx context.Context, node RuleNode, exists func(cont
 		return validateGeoMatchNodeConfig(node)
 	case RuleNodePoW:
 		return validatePoWNodeConfig(node)
+	case RuleNodeUACheck:
+		return validateUACheckNodeConfig(node)
 	case RuleNodeBlock:
 		return validateBlockNodeConfig(node)
 	}
@@ -283,6 +285,42 @@ func validateBlockNodeConfig(node RuleNode) error {
 	return nil
 }
 
+func validateUACheckNodeConfig(node RuleNode) error {
+	var cfg UACheckConfig
+	if err := decodeNodeConfig(node, &cfg); err != nil {
+		return err
+	}
+	mode := cfg.MatchMode
+	if mode == "" {
+		mode = UACheckMatchModeOr
+	}
+	if mode != UACheckMatchModeAnd && mode != UACheckMatchModeOr {
+		return fmt.Errorf("节点 %s 的匹配模式必须为 and 或 or", node.ID)
+	}
+	for _, label := range cfg.Browsers {
+		if !uaBrowserLabels[label] {
+			return fmt.Errorf("节点 %s 的浏览器标签 %s 无效", node.ID, label)
+		}
+	}
+	for _, label := range cfg.OperatingSystems {
+		if !uaOSLabels[label] {
+			return fmt.Errorf("节点 %s 的操作系统标签 %s 无效", node.ID, label)
+		}
+	}
+	return nil
+}
+
+var uaBrowserLabels = map[string]bool{
+	"Chrome": true, "Safari": true, "Firefox": true, "Edge": true, "Opera": true,
+	"Chromium": true, "WeChat": true, "Postman": true, "CLI": true, "Bot": true,
+	"Unknown": true, "Other": true,
+}
+
+var uaOSLabels = map[string]bool{
+	"Android": true, "iOS": true, "Windows": true, "macOS": true, "Chrome OS": true,
+	"Linux": true, "Bot": true, "Unknown": true, "Other": true,
+}
+
 func decodeNodeConfig(node RuleNode, dst any) error {
 	if err := decodeStrictConfig(node.Config, dst); err != nil {
 		return fmt.Errorf("节点 %s 的配置无效: %w", node.ID, err)
@@ -321,7 +359,7 @@ func requiredHandles(t RuleNodeType) []string {
 	switch t {
 	case RuleNodeStart, RuleNodePoW:
 		return []string{"next"}
-	case RuleNodeIPMatch, RuleNodeGeoMatch:
+	case RuleNodeIPMatch, RuleNodeGeoMatch, RuleNodeUACheck:
 		return []string{"true", "false"}
 	default:
 		return nil

internal/apps/openflare/waf/graph_validate_test.go

@@ -77,6 +77,14 @@ func TestValidateRuleGraph(t *testing.T) {
 			g.Edges[1].SourceHandle = "next"
 			g.Edges = g.Edges[:2]
 		}, "节点 match-1 的 PoW 难度必须在 1-16 之间"},
+		{"invalid ua browser", func(g *RuleGraph) {
+			g.Nodes[1].Type = RuleNodeUACheck
+			g.Nodes[1].Config = rawConfig(`{"browsers":["NotABrowser"],"match_mode":"or"}`)
+		}, "节点 match-1 的浏览器标签 NotABrowser 无效"},
+		{"invalid ua match mode", func(g *RuleGraph) {
+			g.Nodes[1].Type = RuleNodeUACheck
+			g.Nodes[1].Config = rawConfig(`{"match_mode":"xor"}`)
+		}, "节点 match-1 的匹配模式必须为 and 或 or"},
 		{"unknown config field", func(g *RuleGraph) { g.Nodes[1].Config = rawConfig(`{"ips":[],"surprise":true}`) }, "节点 match-1 的配置无效"},
 		{"null config", func(g *RuleGraph) { g.Nodes[1].Config = rawConfig(`null`) }, "节点 match-1 的配置无效"},
 		{"too many nodes", func(g *RuleGraph) {