fix: 修复 WAF 规则组 PoW 策略发布后边缘不生效

docs/changelog/index.md

@@ -18,6 +18,8 @@ sidebar: false
 
 ### 修复
 
+- 修复 WAF 规则组 PoW 策略发布后边缘不生效：统一 WAF 绑定站点名与 OpenResty 路由 `site_name` 解析逻辑，并为所有已启用网站生成 `site_rule_groups` 条目（含仅依赖全局规则组的站点）。
+
 - 修复全球态势板在仅有 `geo_name`（如 mmdb 的 Germany）而无经纬度时误用美国 fallback 坐标的问题；按国家名/ISO 匹配地图质心。
 
 - 修复 Agent 心跳上报公网 IP 后节点地理位置未自动更新：进程启动时按 `GeoIPProvider` 初始化 `pkg/geoip`，`mmdb` 模式从内置 GeoLite2 种子到 `data/`，并在 Relay 心跳同步地理位置。

internal/apps/openflare/config_version/logics_test.go

@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"testing"
 
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/waf"
 	"github.com/Rain-kl/Wavelet/internal/db"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/glebarez/sqlite"
@@ -81,3 +82,63 @@ func TestPublishConfigVersionCreatesVersion(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotEqual(t, version.ID, forced.ID)
 }
+
+func TestBuildSnapshotWAFDocumentUsesNormalizedSiteNames(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	route := &model.ProxyRoute{
+		Domain:    "Example.COM",
+		Domains:   `["example.com","www.example.com"]`,
+		OriginURL: "http://origin.example.com:8080",
+		Upstreams: `["http://origin.example.com:8080"]`,
+		Enabled:   true,
+	}
+	require.NoError(t, model.CreateProxyRouteRecord(ctx, route))
+
+	require.NoError(t, waf.EnsureDefaultRuleGroup(ctx))
+	globalGroup, err := model.GetGlobalOpenFlareWAFRuleGroup(ctx)
+	require.NoError(t, err)
+
+	customGroup := &model.OpenFlareWAFRuleGroup{
+		Name:       "pow-group",
+		Enabled:    true,
+		PoWEnabled: true,
+		PoWConfig:  `{"difficulty":4,"algorithm":"fast","session_ttl":600,"challenge_ttl":300}`,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFRuleGroup(ctx, customGroup))
+	require.NoError(t, model.ReplaceOpenFlareWAFRuleGroupBindings(ctx, customGroup.ID, []uint{route.ID}))
+
+	bundle, err := buildCurrentConfigBundle(ctx, true)
+	require.NoError(t, err)
+	require.Len(t, bundle.SnapshotRoutes, 1)
+	assert.Equal(t, "example.com", bundle.SnapshotRoutes[0].SiteName)
+
+	require.NotEmpty(t, bundle.WAFSnapshot.Bindings)
+	found := false
+	for _, binding := range bundle.WAFSnapshot.Bindings {
+		if binding.RouteID != route.ID {
+			continue
+		}
+		found = true
+		assert.Equal(t, "example.com", binding.SiteName)
+		assert.Contains(t, binding.RuleGroupIDs, customGroup.ID)
+	}
+	assert.True(t, found, "expected WAF binding for enabled route")
+
+	var wafRuntime struct {
+		SiteRuleGroups map[string][]uint `json:"site_rule_groups"`
+	}
+	for _, file := range bundle.SupportFiles {
+		if file.Path != "waf_config.json" {
+			continue
+		}
+		require.NoError(t, json.Unmarshal([]byte(file.Content), &wafRuntime))
+	}
+	require.Contains(t, wafRuntime.SiteRuleGroups, "example.com")
+	require.Contains(t, wafRuntime.SiteRuleGroups["example.com"], customGroup.ID)
+	require.Contains(t, wafRuntime.SiteRuleGroups["example.com"], globalGroup.ID)
+	assert.Contains(t, bundle.RouteConfig, `set $openflare_waf_site "example.com"`)
+	assert.Contains(t, bundle.RouteConfig, `require("pow.runtime").check()`)
+}

internal/apps/openflare/config_version/snapshot.go

@@ -314,16 +314,16 @@ func buildSnapshotWAFDocument(ctx context.Context, routes []*model.ProxyRoute) (
 	if err != nil {
 		return snapshotWAFDocument{}, err
 	}
-	enabledRouteIDs := make(map[uint]string, len(routes))
+	enabledRouteSiteNames := make(map[uint]string, len(routes))
 	for _, route := range routes {
 		if route == nil {
 			continue
 		}
-		siteName := strings.TrimSpace(route.SiteName)
-		if siteName == "" {
-			siteName = route.Domain
+		domains, domainErr := decodeStoredDomains(route.Domains, route.Domain)
+		if domainErr != nil {
+			return snapshotWAFDocument{}, fmt.Errorf("route %s domains are invalid", route.Domain)
 		}
-		enabledRouteIDs[route.ID] = siteName
+		enabledRouteSiteNames[route.ID] = normalizeProxyRouteSiteName(route, route.SiteName, domains[0])
 	}
 	rawBindings, err := model.ListOpenFlareWAFRuleGroupBindings(ctx)
 	if err != nil {
@@ -331,17 +331,18 @@ func buildSnapshotWAFDocument(ctx context.Context, routes []*model.ProxyRoute) (
 	}
 	groupIDsByRoute := make(map[uint][]uint, len(rawBindings))
 	for _, binding := range rawBindings {
-		if _, ok := enabledRouteIDs[binding.ProxyRouteID]; !ok {
+		if _, ok := enabledRouteSiteNames[binding.ProxyRouteID]; !ok {
 			continue
 		}
 		groupIDsByRoute[binding.ProxyRouteID] = append(groupIDsByRoute[binding.ProxyRouteID], binding.RuleGroupID)
 	}
-	bindings := make([]snapshotWAFBinding, 0, len(groupIDsByRoute))
-	for routeID, groupIDs := range groupIDsByRoute {
+	bindings := make([]snapshotWAFBinding, 0, len(enabledRouteSiteNames))
+	for routeID, siteName := range enabledRouteSiteNames {
+		groupIDs := groupIDsByRoute[routeID]
 		sort.Slice(groupIDs, func(i, j int) bool { return groupIDs[i] < groupIDs[j] })
 		bindings = append(bindings, snapshotWAFBinding{
 			RouteID:      routeID,
-			SiteName:     enabledRouteIDs[routeID],
+			SiteName:     siteName,
 			RuleGroupIDs: groupIDs,
 		})
 	}

pkg/render/openresty/render_test.go

@@ -1,10 +1,68 @@
 package openresty
 
 import (
+	"encoding/json"
 	"strings"
 	"testing"
 )
 
+func TestRenderWAFConfigIncludesAllRouteSiteNames(t *testing.T) {
+	doc := Document{
+		Routes: []Route{
+			{ID: 1, SiteName: "", Domain: "Example.COM", Domains: []string{"example.com", "www.example.com"}},
+			{ID: 2, SiteName: "named-site", Domain: "other.example.com"},
+		},
+		WAF: WAFDocument{
+			RuleGroups: []WAFRuleGroup{
+				{
+					ID:         1,
+					Name:       "pow-group",
+					Enabled:    true,
+					PoWEnabled: true,
+					PoWConfig:  &PoWConfig{Difficulty: 4, Algorithm: "fast", SessionTTL: 600, ChallengeTTL: 300},
+				},
+			},
+			Bindings: []WAFBinding{
+				{RouteID: 1, SiteName: "example.com", RuleGroupIDs: []uint{1}},
+				{RouteID: 2, SiteName: "named-site", RuleGroupIDs: []uint{1}},
+			},
+		},
+	}
+
+	wafConfig, err := RenderWAFConfig(doc.WAF)
+	if err != nil {
+		t.Fatalf("RenderWAFConfig() error = %v", err)
+	}
+
+	var decoded struct {
+		SiteRuleGroups map[string][]uint `json:"site_rule_groups"`
+	}
+	if err := json.Unmarshal([]byte(wafConfig), &decoded); err != nil {
+		t.Fatalf("json.Unmarshal() error = %v", err)
+	}
+
+	for _, route := range doc.Routes {
+		siteName := strings.TrimSpace(route.SiteName)
+		if siteName == "" {
+			siteName = normalizedRouteDomains(route)[0]
+		}
+		if _, ok := decoded.SiteRuleGroups[siteName]; !ok {
+			t.Fatalf("site_rule_groups missing site %q, got %#v", siteName, decoded.SiteRuleGroups)
+		}
+	}
+
+	routeConfig, err := RenderRouteConfig(doc, nil)
+	if err != nil {
+		t.Fatalf("RenderRouteConfig() error = %v", err)
+	}
+	if !strings.Contains(routeConfig, `set $openflare_waf_site "example.com"`) {
+		t.Fatalf("expected route config to use normalized site name example.com, got:\n%s", routeConfig)
+	}
+	if !strings.Contains(routeConfig, `require("pow.runtime").check()`) {
+		t.Fatalf("expected route config to enable pow runtime, got:\n%s", routeConfig)
+	}
+}
+
 func TestRenderPagesAPIProxyLocationBlock(t *testing.T) {
 	tests := []struct {
 		name       string