feat(waf): complete composable rule orchestration

Add the React Flow rule editor, ordered graph APIs and runtime DAG execution.\n\nPublish rules only on OpenResty reload and reconcile checksum-driven IP group snapshots in bounded shared memory.
This commit is contained in:
ryan
2026-07-13 14:16:55 +08:00
parent d36409fbf9
commit a1a997bcda
72 changed files with 5897 additions and 3080 deletions
+1 -32
View File
@@ -26,6 +26,7 @@ func setupWAFTestDB(t *testing.T) func() {
&model.OpenFlareWAFRuleGroup{},
&model.OpenFlareWAFIPGroup{},
&model.OpenFlareWAFRuleGroupBinding{},
&model.OriginProxyRoute{},
))
db.SetDB(sqliteDB)
@@ -34,38 +35,6 @@ func setupWAFTestDB(t *testing.T) func() {
}
}
func TestCreateRuleGroup(t *testing.T) {
cleanup := setupWAFTestDB(t)
defer cleanup()
ctx := context.Background()
group, err := CreateRuleGroup(ctx, RuleGroupInput{
Name: "edge guard",
Enabled: true,
BlockStatusCode: 451,
IPWhitelist: []string{" 192.0.2.1 ", "192.0.2.1", "198.51.100.0/24"},
IPBlacklist: []string{"203.0.113.10"},
CountryBlacklist: []string{" cn ", "CN", "us"},
})
require.NoError(t, err)
assert.NotZero(t, group.ID)
assert.False(t, group.IsGlobal)
assert.Equal(t, "edge guard", group.Name)
require.Len(t, group.IPWhitelist, 2)
assert.Equal(t, "192.0.2.1", group.IPWhitelist[0])
assert.Equal(t, "198.51.100.0/24", group.IPWhitelist[1])
require.Len(t, group.CountryBlacklist, 2)
assert.Equal(t, "CN", group.CountryBlacklist[0])
assert.Equal(t, "US", group.CountryBlacklist[1])
_, err = CreateRuleGroup(ctx, RuleGroupInput{
Name: "bad ip",
Enabled: true,
IPBlacklist: []string{"not-an-ip"},
})
require.Error(t, err)
}
func TestPruneIPGroupExtIPs(t *testing.T) {
group := &model.OpenFlareWAFIPGroup{
ExtIPs: `[{"ip":"203.0.113.10","captured_at":"2026-06-18T10:00:00Z"},{"ip":"203.0.113.11","captured_at":"2026-06-18T11:00:00Z"}]`,