[新增] POW 与 WAF 规则合并

openflare_server/service/agent_test.go

@@ -11,39 +11,6 @@ import (
 	"gorm.io/gorm"
 )
 
-func TestGetActiveConfigForAgentIncludesPoWConfig(t *testing.T) {
-	setupServiceTestDB(t)
-
-	_, err := CreateProxyRoute(ProxyRouteInput{
-		Domain:     "pow-agent.example.com",
-		OriginURL:  "https://origin.internal",
-		Enabled:    true,
-		PoWEnabled: true,
-		PoWConfig:  `{"difficulty":4,"algorithm":"fast","session_ttl":86400,"challenge_ttl":300,"whitelist":{"paths":["/.well-known/*","/favicon.ico","/robots.txt"],"user_agents":["Googlebot","bingbot","Baiduspider"]},"blacklist":{"ips":[],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]}}`,
-	})
-	if err != nil {
-		t.Fatalf("CreateProxyRoute failed: %v", err)
-	}
-
-	if _, err := PublishConfigVersion("root", false); err != nil {
-		t.Fatalf("PublishConfigVersion failed: %v", err)
-	}
-
-	activeConfig, err := GetActiveConfigForAgent()
-	if err != nil {
-		t.Fatalf("GetActiveConfigForAgent failed: %v", err)
-	}
-
-	for _, file := range activeConfig.SupportFiles {
-		if file.Path == "pow_config.json" || file.Path == "waf_config.json" {
-			t.Fatalf("agent config should not receive rendered runtime config file %s", file.Path)
-		}
-	}
-	if !strings.Contains(activeConfig.SourceConfigJSON, `"pow_enabled":true`) {
-		t.Fatal("expected agent config source json to include PoW source configuration")
-	}
-}
-
 func TestGetActiveConfigForAgentIncludesWAFConfig(t *testing.T) {
 	setupServiceTestDB(t)
 
@@ -144,39 +111,6 @@ func TestChangedWAFIPGroupsForAgentReturnsChecksumDelta(t *testing.T) {
 	}
 }
 
-func TestGetActiveConfigForAgentUsesTenMinutePoWSessionDefault(t *testing.T) {
-	setupServiceTestDB(t)
-
-	_, err := CreateProxyRoute(ProxyRouteInput{
-		Domain:     "pow-default.example.com",
-		OriginURL:  "https://origin.internal",
-		Enabled:    true,
-		PoWEnabled: true,
-		PoWConfig:  `{}`,
-	})
-	if err != nil {
-		t.Fatalf("CreateProxyRoute failed: %v", err)
-	}
-
-	if _, err := PublishConfigVersion("root", false); err != nil {
-		t.Fatalf("PublishConfigVersion failed: %v", err)
-	}
-
-	activeConfig, err := GetActiveConfigForAgent()
-	if err != nil {
-		t.Fatalf("GetActiveConfigForAgent failed: %v", err)
-	}
-
-	for _, file := range activeConfig.SupportFiles {
-		if file.Path == "pow_config.json" {
-			t.Fatal("agent config should not receive rendered pow_config.json")
-		}
-	}
-	if !strings.Contains(activeConfig.SourceConfigJSON, `"session_ttl":600`) {
-		t.Fatalf("expected default PoW session TTL to be in source json, got %s", activeConfig.SourceConfigJSON)
-	}
-}
-
 func TestRegisterNodeWithAccessToken(t *testing.T) {
 	setupServiceTestDB(t)
 

openflare_server/service/config_version.go

@@ -83,8 +83,6 @@ type snapshotRoute struct {
 	CachePolicy        string                        `json:"cache_policy,omitempty"`
 	CacheRules         []string                      `json:"cache_rules,omitempty"`
 	CustomHeaders      []ProxyRouteCustomHeaderInput `json:"custom_headers,omitempty"`
-	PoWEnabled         bool                          `json:"pow_enabled,omitempty"`
-	PoWConfig          *ProxyRoutePoWConfig          `json:"pow_config,omitempty"`
 	BasicAuthEnabled   bool                          `json:"basic_auth_enabled,omitempty"`
 	BasicAuthUsername  string                        `json:"basic_auth_username,omitempty"`
 	BasicAuthPassword  string                        `json:"basic_auth_password,omitempty"`
@@ -551,13 +549,6 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 		if err != nil {
 			return nil, fmt.Errorf("路由 %s 缓存规则无效", route.Domain)
 		}
-		powConfig, err := decodeStoredPoWConfig(route.PoWEnabled, route.PoWConfig)
-		if err != nil {
-			return nil, fmt.Errorf("路由 %s PoW 配置无效", route.Domain)
-		}
-		if !route.PoWEnabled {
-			powConfig = nil
-		}
 		items = append(items, snapshotRoute{
 			ID:                 route.ID,
 			SiteName:           normalizeProxyRouteSiteNameInput(route, route.SiteName, domains[0]),
@@ -579,8 +570,6 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 			CachePolicy:        route.CachePolicy,
 			CacheRules:         cacheRules,
 			CustomHeaders:      customHeaders,
-			PoWEnabled:         route.PoWEnabled,
-			PoWConfig:          powConfig,
 			BasicAuthEnabled:   route.BasicAuthEnabled,
 			BasicAuthUsername:  route.BasicAuthUsername,
 			BasicAuthPassword:  route.BasicAuthPassword,
@@ -861,17 +850,6 @@ func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
 		if err == nil {
 			routes[index].LimitRate = normalizedLimitRate
 		}
-		if routes[index].PoWEnabled {
-			raw, err := json.Marshal(routes[index].PoWConfig)
-			if err == nil {
-				normalizedPoWConfig, err := normalizePoWConfig(true, string(raw))
-				if err == nil {
-					routes[index].PoWConfig = &normalizedPoWConfig
-				}
-			}
-		} else {
-			routes[index].PoWConfig = nil
-		}
 		if !routes[index].BasicAuthEnabled {
 			routes[index].BasicAuthUsername = ""
 			routes[index].BasicAuthPassword = ""
@@ -918,7 +896,7 @@ func flattenSnapshotRoutesByDomain(routes []snapshotRoute) map[string]snapshotRo
 }
 
 func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
-	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || left.PoWEnabled != right.PoWEnabled || left.BasicAuthEnabled != right.BasicAuthEnabled || left.BasicAuthUsername != right.BasicAuthUsername || left.BasicAuthPassword != right.BasicAuthPassword || left.UpstreamType != right.UpstreamType || !uintPtrEqual(left.TunnelNodeID, right.TunnelNodeID) || left.TunnelTargetAddr != right.TunnelTargetAddr || left.TunnelTargetProto != right.TunnelTargetProto || !uintPtrEqual(left.PagesProjectID, right.PagesProjectID) || !snapshotPagesDeploymentEqual(left.PagesDeployment, right.PagesDeployment) || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
+	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || left.BasicAuthEnabled != right.BasicAuthEnabled || left.BasicAuthUsername != right.BasicAuthUsername || left.BasicAuthPassword != right.BasicAuthPassword || left.UpstreamType != right.UpstreamType || !uintPtrEqual(left.TunnelNodeID, right.TunnelNodeID) || left.TunnelTargetAddr != right.TunnelTargetAddr || left.TunnelTargetProto != right.TunnelTargetProto || !uintPtrEqual(left.PagesProjectID, right.PagesProjectID) || !snapshotPagesDeploymentEqual(left.PagesDeployment, right.PagesDeployment) || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
 		return false
 	}
 	if len(left.Domains) != len(right.Domains) {
@@ -953,9 +931,6 @@ func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
 			return false
 		}
 	}
-	if !snapshotPoWConfigEqual(left.PoWConfig, right.PoWConfig) {
-		return false
-	}
 	return true
 }
 
@@ -986,26 +961,6 @@ func snapshotWAFConfigEqual(left snapshotWAFDocument, right snapshotWAFDocument)
 	return string(leftJSON) == string(rightJSON)
 }
 
-func snapshotPoWConfigEqual(left *ProxyRoutePoWConfig, right *ProxyRoutePoWConfig) bool {
-	if left == nil || right == nil {
-		return left == nil && right == nil
-	}
-	return left.Difficulty == right.Difficulty &&
-		left.Algorithm == right.Algorithm &&
-		left.SessionTTL == right.SessionTTL &&
-		left.ChallengeTTL == right.ChallengeTTL &&
-		stringSliceEqual(left.Whitelist.IPs, right.Whitelist.IPs) &&
-		stringSliceEqual(left.Whitelist.IPCidrs, right.Whitelist.IPCidrs) &&
-		stringSliceEqual(left.Whitelist.Paths, right.Whitelist.Paths) &&
-		stringSliceEqual(left.Whitelist.PathRegexes, right.Whitelist.PathRegexes) &&
-		stringSliceEqual(left.Whitelist.UserAgents, right.Whitelist.UserAgents) &&
-		stringSliceEqual(left.Blacklist.IPs, right.Blacklist.IPs) &&
-		stringSliceEqual(left.Blacklist.IPCidrs, right.Blacklist.IPCidrs) &&
-		stringSliceEqual(left.Blacklist.Paths, right.Blacklist.Paths) &&
-		stringSliceEqual(left.Blacklist.PathRegexes, right.Blacklist.PathRegexes) &&
-		stringSliceEqual(left.Blacklist.UserAgents, right.Blacklist.UserAgents)
-}
-
 func stringSliceEqual(left []string, right []string) bool {
 	if len(left) != len(right) {
 		return false

openflare_server/service/https_phase1_test.go

@@ -982,31 +982,31 @@ func TestPublishConfigVersionDetectsPoWChanges(t *testing.T) {
 	if err != nil {
 		t.Fatalf("initial PublishConfigVersion failed: %v", err)
 	}
-	if !strings.Contains(firstRelease.Version.SupportFilesJSON, `"path":"pow_config.json"`) {
-		t.Fatal("expected publish to include pow_config.json support file")
+	if !strings.Contains(firstRelease.Version.SupportFilesJSON, `"path":"waf_config.json"`) {
+		t.Fatal("expected publish to include waf_config.json support file")
 	}
 
-	_, err = UpdateProxyRoute(route.ID, ProxyRouteInput{
-		Domain:       route.Domain,
-		OriginURL:    route.OriginURL,
-		Enabled:      true,
-		PoWEnabled:   true,
-		PoWConfig:    `{"difficulty":5,"algorithm":"slow","session_ttl":7200,"challenge_ttl":180,"whitelist":{"ips":["127.0.0.1"],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]},"blacklist":{"ips":[],"ip_cidrs":[],"paths":["/login"],"path_regexes":[],"user_agents":[]}}`,
-		RedirectHTTP: false,
+	group, err := CreateWAFRuleGroup(WAFRuleGroupInput{
+		Name:            "pow group",
+		Enabled:         true,
+		BlockStatusCode: 418,
+		PoWEnabled:      true,
+		PoWConfig:       json.RawMessage(`{"difficulty":5,"algorithm":"slow","session_ttl":7200,"challenge_ttl":180,"whitelist":{"ips":["127.0.0.1"],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]},"blacklist":{"ips":[],"ip_cidrs":[],"paths":["/login"],"path_regexes":[],"user_agents":[]}}`),
 	})
 	if err != nil {
-		t.Fatalf("UpdateProxyRoute failed: %v", err)
+		t.Fatalf("CreateWAFRuleGroup failed: %v", err)
+	}
+
+	if _, err = ReplaceWAFSiteRuleGroups(route.ID, []uint{group.ID}); err != nil {
+		t.Fatalf("ReplaceWAFSiteRuleGroups failed: %v", err)
 	}
 
 	diff, err := DiffConfigVersion()
 	if err != nil {
 		t.Fatalf("DiffConfigVersion failed: %v", err)
 	}
-	if len(diff.ModifiedDomains) != 1 || diff.ModifiedDomains[0] != "pow.example.com" {
-		t.Fatalf("expected PoW change to mark domain as modified, got %#v", diff.ModifiedDomains)
-	}
-	if len(diff.ModifiedSites) != 1 || diff.ModifiedSites[0] != "pow.example.com" {
-		t.Fatalf("expected PoW change to mark site as modified, got %#v", diff.ModifiedSites)
+	if !diff.WAFConfigChanged {
+		t.Fatal("expected PoW change (via WAF Rule Group) to trigger WAF config change")
 	}
 
 	secondRelease, err := PublishConfigVersion("root", false)
@@ -1053,18 +1053,18 @@ func TestPublishConfigVersionDetectsPoWChanges(t *testing.T) {
 	if err := json.Unmarshal([]byte(secondRelease.Version.SupportFilesJSON), &supportFiles); err != nil {
 		t.Fatalf("failed to decode support files: %v", err)
 	}
-	foundPowSupportFile := false
+	foundWafSupportFile := false
 	for _, file := range supportFiles {
-		if file.Path != "pow_config.json" {
+		if file.Path != "waf_config.json" {
 			continue
 		}
-		foundPowSupportFile = true
+		foundWafSupportFile = true
 		if !strings.Contains(file.Content, `"difficulty":5`) {
-			t.Fatalf("expected pow support file to persist config, got %s", file.Content)
+			t.Fatalf("expected waf support file to persist pow config, got %s", file.Content)
 		}
 	}
-	if !foundPowSupportFile {
-		t.Fatal("expected publish to include pow_config.json support file")
+	if !foundWafSupportFile {
+		t.Fatal("expected publish to include waf_config.json support file")
 	}
 }
 
@@ -1081,15 +1081,13 @@ func TestPublishConfigVersionRendersBasicAuthWithPoW(t *testing.T) {
 		t.Fatalf("CreateTLSCertificate failed: %v", err)
 	}
 
-	_, err = CreateProxyRoute(ProxyRouteInput{
+	route, err := CreateProxyRoute(ProxyRouteInput{
 		Domain:            "xbot.example.com",
 		OriginURL:         "http://c1:36185",
 		Enabled:           true,
 		EnableHTTPS:       true,
 		CertID:            &certificate.ID,
 		RedirectHTTP:      true,
-		PoWEnabled:        true,
-		PoWConfig:         `{"difficulty":4,"algorithm":"fast","session_ttl":600,"challenge_ttl":300,"whitelist":{"ips":[],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]},"blacklist":{"ips":[],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]}}`,
 		BasicAuthEnabled:  true,
 		BasicAuthUsername: "admin",
 		BasicAuthPassword: "123",
@@ -1098,6 +1096,21 @@ func TestPublishConfigVersionRendersBasicAuthWithPoW(t *testing.T) {
 		t.Fatalf("CreateProxyRoute failed: %v", err)
 	}
 
+	group, err := CreateWAFRuleGroup(WAFRuleGroupInput{
+		Name:            "pow group",
+		Enabled:         true,
+		BlockStatusCode: 418,
+		PoWEnabled:      true,
+		PoWConfig:       json.RawMessage(`{"difficulty":4,"algorithm":"fast","session_ttl":600,"challenge_ttl":300,"whitelist":{"ips":[],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]},"blacklist":{"ips":[],"ip_cidrs":[],"paths":[],"path_regexes":[],"user_agents":[]}}`),
+	})
+	if err != nil {
+		t.Fatalf("CreateWAFRuleGroup failed: %v", err)
+	}
+
+	if _, err = ReplaceWAFSiteRuleGroups(route.ID, []uint{group.ID}); err != nil {
+		t.Fatalf("ReplaceWAFSiteRuleGroups failed: %v", err)
+	}
+
 	result, err := PublishConfigVersion("root", false)
 	if err != nil {
 		t.Fatalf("PublishConfigVersion failed: %v", err)

openflare_server/service/proxy_route.go

@@ -55,8 +55,6 @@ type ProxyRouteInput struct {
 	CachePolicy          string                        `json:"cache_policy"`
 	CacheRules           []string                      `json:"cache_rules"`
 	CustomHeaders        []ProxyRouteCustomHeaderInput `json:"custom_headers"`
-	PoWEnabled           bool                          `json:"pow_enabled"`
-	PoWConfig            string                        `json:"pow_config"`
 	BasicAuthEnabled     bool                          `json:"basic_auth_enabled"`
 	BasicAuthUsername    string                        `json:"basic_auth_username"`
 	BasicAuthPassword    string                        `json:"basic_auth_password"`
@@ -96,8 +94,6 @@ type ProxyRouteView struct {
 	CacheRuleList        []string                      `json:"cache_rule_list"`
 	CustomHeaders        string                        `json:"custom_headers"`
 	CustomHeaderList     []ProxyRouteCustomHeaderInput `json:"custom_header_list"`
-	PoWEnabled           bool                          `json:"pow_enabled"`
-	PoWConfig            *ProxyRoutePoWConfig          `json:"pow_config"`
 	BasicAuthEnabled     bool                          `json:"basic_auth_enabled"`
 	BasicAuthUsername    string                        `json:"basic_auth_username"`
 	BasicAuthPassword    string                        `json:"basic_auth_password"`
@@ -239,15 +235,6 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 		return nil, err
 	}
 
-	powConfig, err := normalizePoWConfig(input.PoWEnabled, input.PoWConfig)
-	if err != nil {
-		return nil, err
-	}
-	powConfigJSON, err := json.Marshal(powConfig)
-	if err != nil {
-		return nil, err
-	}
-
 	if !input.EnableHTTPS {
 		input.RedirectHTTP = false
 		input.CertID = nil
@@ -330,8 +317,6 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 	route.CachePolicy = normalizeCachePolicy(input.CacheEnabled, cachePolicy)
 	route.CacheRules = string(cacheRulesJSON)
 	route.CustomHeaders = string(customHeadersJSON)
-	route.PoWEnabled = input.PoWEnabled
-	route.PoWConfig = string(powConfigJSON)
 	route.BasicAuthEnabled = input.BasicAuthEnabled
 	route.BasicAuthUsername = input.BasicAuthUsername
 	route.BasicAuthPassword = input.BasicAuthPassword
@@ -395,10 +380,6 @@ func buildProxyRouteView(route *model.ProxyRoute) (*ProxyRouteView, error) {
 	if err != nil {
 		return nil, err
 	}
-	powConfig, err := decodeStoredPoWConfig(route.PoWEnabled, route.PoWConfig)
-	if err != nil {
-		return nil, err
-	}
 	certIDs, err := decodeStoredCertIDs(route.CertIDs, route.CertID)
 	if err != nil {
 		return nil, err
@@ -439,8 +420,6 @@ func buildProxyRouteView(route *model.ProxyRoute) (*ProxyRouteView, error) {
 		CacheRuleList:        cacheRules,
 		CustomHeaders:        route.CustomHeaders,
 		CustomHeaderList:     customHeaders,
-		PoWEnabled:           route.PoWEnabled,
-		PoWConfig:            powConfig,
 		BasicAuthEnabled:     route.BasicAuthEnabled,
 		BasicAuthUsername:    route.BasicAuthUsername,
 		BasicAuthPassword:    route.BasicAuthPassword,