merge: replace legacy openflare-server with Wavelet rename

openflare-server/internal/apps/openflare/waf/errs.go

@@ -0,0 +1,9 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+const (
+	errWAFRuleGroupNotFound = "WAF 规则组不存在"
+	errWAFIPGroupNotFound   = "IP 组不存在"
+)

openflare-server/internal/apps/openflare/waf/ip_group_sync.go

@@ -0,0 +1,475 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/netip"
+	"strings"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/agent"
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/websocket"
+	"github.com/Rain-kl/Wavelet/internal/model"
+
+	exprlang "github.com/expr-lang/expr"
+	"github.com/expr-lang/expr/vm"
+)
+
+const maxWAFIPGroupSubscriptionBytes = 2 * 1024 * 1024
+
+type ipGroupAutoRuleEnv struct {
+	IP               string  `expr:"ip"`
+	RequestCount     int     `expr:"request_count"`
+	Status404Count   int     `expr:"status_404_count"`
+	Status404Ratio   float64 `expr:"status_404_ratio"`
+	IPHostCount      int     `expr:"ip_host_count"`
+	IPHostRatio      float64 `expr:"ip_host_ratio"`
+	ClientErrorCount int     `expr:"client_error_count"`
+	ServerErrorCount int     `expr:"server_error_count"`
+	LastSeenUnix     int64   `expr:"last_seen_unix"`
+	statusCounts     map[int]int
+}
+
+func (env ipGroupAutoRuleEnv) StatusCount(code int) int {
+	if env.statusCounts == nil {
+		return 0
+	}
+	return env.statusCounts[code]
+}
+
+func (env ipGroupAutoRuleEnv) StatusRatio(code int) float64 {
+	if env.RequestCount <= 0 || env.statusCounts == nil {
+		return 0.0
+	}
+	return float64(env.statusCounts[code]) / float64(env.RequestCount)
+}
+
+type ipGroupAutoAccumulator struct {
+	ip               string
+	requestCount     int
+	status404Count   int
+	ipHostCount      int
+	clientErrorCount int
+	serverErrorCount int
+	lastSeen         time.Time
+	statusCounts     map[int]int
+}
+
+// SyncDueWAFIPGroups syncs all enabled automatic/subscription IP groups that are due.
+func SyncDueWAFIPGroups(ctx context.Context) error {
+	now := time.Now().UTC()
+	groups, err := model.ListDueOpenFlareWAFIPGroups(ctx, now)
+	if err != nil {
+		return err
+	}
+	for _, group := range groups {
+		if _, err := syncOpenFlareWAFIPGroup(ctx, group, now); err != nil {
+			continue
+		}
+	}
+	return nil
+}
+
+func syncOpenFlareWAFIPGroup(ctx context.Context, group *model.OpenFlareWAFIPGroup, now time.Time) (*IPGroupSyncResult, error) {
+	if group == nil {
+		return nil, errors.New("IP 组不存在")
+	}
+	switch group.Type {
+	case wafIPGroupTypeSubscription:
+		return syncIPGroupSubscription(ctx, group, now)
+	case wafIPGroupTypeAutomatic:
+		return syncIPGroupAutomatic(ctx, group, now)
+	default:
+		return nil, errors.New("只有自动和订阅类型 IP 组支持同步")
+	}
+}
+
+func syncIPGroupSubscription(ctx context.Context, group *model.OpenFlareWAFIPGroup, now time.Time) (*IPGroupSyncResult, error) {
+	content, err := downloadIPGroupSubscription(group.SubscriptionURL)
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+	ips, err := parseIPGroupSubscription(content, group.SubscriptionFormat, group.SubscriptionMappingRule)
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+	ipListJSON, _ := json.Marshal(ips)
+	nextSyncAt := now.Add(time.Duration(group.SyncIntervalMinutes) * time.Minute)
+	group.IPList = string(ipListJSON)
+	group.LastSyncedAt = &now
+	group.NextSyncAt = &nextSyncAt
+	group.LastSyncStatus = "success"
+	group.LastSyncMessage = fmt.Sprintf("同步成功，共 %d 条 IP/IP 段", len(ips))
+	if err := model.UpdateOpenFlareWAFIPGroupSyncResult(ctx, group); err != nil {
+		return nil, err
+	}
+	broadcastIPGroupToAgents(ctx, group.ID)
+	view, err := GetIPGroup(ctx, group.ID)
+	if err != nil {
+		return nil, err
+	}
+	return &IPGroupSyncResult{
+		Group:      *view,
+		IPCount:    len(ips),
+		SyncedAt:   now.Format(time.RFC3339),
+		NextSyncAt: nextSyncAt.Format(time.RFC3339),
+		Status:     group.LastSyncStatus,
+		Message:    group.LastSyncMessage,
+	}, nil
+}
+
+func syncIPGroupAutomatic(ctx context.Context, group *model.OpenFlareWAFIPGroup, now time.Time) (*IPGroupSyncResult, error) {
+	config, err := parseIPGroupAutoConfig(json.RawMessage(group.AutoConfig))
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+
+	var existingExtIPs []ipGroupExtIP
+	if group.ExtIPs != "" && group.ExtIPs != "[]" {
+		_ = json.Unmarshal([]byte(group.ExtIPs), &existingExtIPs)
+	}
+
+	activeExtIPs := make([]ipGroupExtIP, 0, len(existingExtIPs))
+	for _, extIP := range existingExtIPs {
+		if config.TTL > 0 {
+			expirationTime := extIP.CapturedAt.Add(time.Duration(config.TTL) * time.Second)
+			if expirationTime.Before(now) {
+				continue
+			}
+		}
+		activeExtIPs = append(activeExtIPs, extIP)
+	}
+
+	ips, err := evaluateParsedIPGroupAutoConfig(ctx, config, now)
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+
+	extIPMap := make(map[string]int)
+	for idx, extIP := range activeExtIPs {
+		extIPMap[extIP.IP] = idx
+	}
+
+	for _, ip := range ips {
+		if idx, ok := extIPMap[ip]; ok {
+			activeExtIPs[idx].CapturedAt = now
+		} else {
+			activeExtIPs = append(activeExtIPs, ipGroupExtIP{
+				IP:         ip,
+				CapturedAt: now,
+			})
+		}
+	}
+
+	finalIPs := make([]string, 0, len(activeExtIPs))
+	for _, extIP := range activeExtIPs {
+		finalIPs = append(finalIPs, extIP.IP)
+	}
+	finalIPs, err = normalizeIPList(finalIPs)
+	if err != nil {
+		recordIPGroupSyncFailure(ctx, group, now, err)
+		return nil, err
+	}
+
+	extIPsJSON, _ := json.Marshal(activeExtIPs)
+	ipListJSON, _ := json.Marshal(finalIPs)
+
+	nextSyncAt := now.Add(time.Duration(normalizeIPGroupSyncInterval(group.SyncIntervalMinutes)) * time.Minute)
+	group.IPList = string(ipListJSON)
+	group.ExtIPs = string(extIPsJSON)
+	group.LastSyncedAt = &now
+	group.NextSyncAt = &nextSyncAt
+	group.LastSyncStatus = "success"
+	group.LastSyncMessage = fmt.Sprintf("自动规则执行成功，共命中 %d 个 IP，当前生效 %d 个 IP", len(ips), len(finalIPs))
+	if err := model.UpdateOpenFlareWAFIPGroupSyncResult(ctx, group); err != nil {
+		return nil, err
+	}
+	broadcastIPGroupToAgents(ctx, group.ID)
+	view, err := GetIPGroup(ctx, group.ID)
+	if err != nil {
+		return nil, err
+	}
+	return &IPGroupSyncResult{
+		Group:      *view,
+		IPCount:    len(finalIPs),
+		SyncedAt:   now.Format(time.RFC3339),
+		NextSyncAt: nextSyncAt.Format(time.RFC3339),
+		Status:     group.LastSyncStatus,
+		Message:    group.LastSyncMessage,
+	}, nil
+}
+
+func recordIPGroupSyncFailure(ctx context.Context, group *model.OpenFlareWAFIPGroup, now time.Time, syncErr error) {
+	nextSyncAt := now.Add(time.Duration(normalizeIPGroupSyncInterval(group.SyncIntervalMinutes)) * time.Minute)
+	group.LastSyncedAt = &now
+	group.NextSyncAt = &nextSyncAt
+	group.LastSyncStatus = "failed"
+	group.LastSyncMessage = syncErr.Error()
+	_ = model.UpdateOpenFlareWAFIPGroupSyncResult(ctx, group)
+}
+
+func evaluateParsedIPGroupAutoConfig(ctx context.Context, config ipGroupAutoConfig, now time.Time) ([]string, error) {
+	if len(config.Rules) == 0 {
+		return []string{}, nil
+	}
+	programs := make([]*vm.Program, 0, len(config.Rules))
+	for i, rule := range config.Rules {
+		program, err := exprlang.Compile(rule.Expr, exprlang.Env(ipGroupAutoRuleEnv{}), exprlang.AsBool())
+		if err != nil {
+			return nil, fmt.Errorf("自动规则 %s Expr 无效: %w", displayIPGroupAutoRuleName(rule, i), err)
+		}
+		programs = append(programs, program)
+	}
+	logs, err := model.ListOpenFlareAccessLogsForWAFIPGroup(ctx, model.OpenFlareAccessLogQuery{
+		Since: now.Add(-time.Duration(config.LookbackMinutes) * time.Minute),
+		Until: now,
+	})
+	if err != nil {
+		return nil, err
+	}
+	accumulators := make(map[string]*ipGroupAutoAccumulator)
+	for _, item := range logs {
+		if item == nil {
+			continue
+		}
+		ip, ok := normalizeIPLiteral(item.RemoteAddr)
+		if !ok {
+			continue
+		}
+		acc := accumulators[ip]
+		if acc == nil {
+			acc = &ipGroupAutoAccumulator{
+				ip:           ip,
+				statusCounts: make(map[int]int),
+			}
+			accumulators[ip] = acc
+		}
+		acc.requestCount++
+		acc.statusCounts[item.StatusCode]++
+		if item.StatusCode == http.StatusNotFound {
+			acc.status404Count++
+		}
+		if item.StatusCode >= 400 && item.StatusCode < 500 {
+			acc.clientErrorCount++
+		}
+		if item.StatusCode >= 500 {
+			acc.serverErrorCount++
+		}
+		if hostIsIPLiteral(item.Host) {
+			acc.ipHostCount++
+		}
+		if item.LoggedAt.After(acc.lastSeen) {
+			acc.lastSeen = item.LoggedAt
+		}
+	}
+	matched := make([]string, 0)
+	for _, acc := range accumulators {
+		env := acc.toExprEnv()
+		for _, program := range programs {
+			output, err := exprlang.Run(program, env)
+			if err != nil {
+				return nil, fmt.Errorf("执行自动规则失败: %w", err)
+			}
+			if matchedRule, ok := output.(bool); ok && matchedRule {
+				matched = append(matched, acc.ip)
+				break
+			}
+		}
+	}
+	return normalizeIPList(matched)
+}
+
+func (acc *ipGroupAutoAccumulator) toExprEnv() ipGroupAutoRuleEnv {
+	env := ipGroupAutoRuleEnv{
+		IP:               acc.ip,
+		RequestCount:     acc.requestCount,
+		Status404Count:   acc.status404Count,
+		IPHostCount:      acc.ipHostCount,
+		ClientErrorCount: acc.clientErrorCount,
+		ServerErrorCount: acc.serverErrorCount,
+		statusCounts:     acc.statusCounts,
+	}
+	if acc.requestCount > 0 {
+		env.Status404Ratio = float64(acc.status404Count) / float64(acc.requestCount)
+		env.IPHostRatio = float64(acc.ipHostCount) / float64(acc.requestCount)
+	}
+	if !acc.lastSeen.IsZero() {
+		env.LastSeenUnix = acc.lastSeen.Unix()
+	}
+	return env
+}
+
+func displayIPGroupAutoRuleName(rule ipGroupAutoRule, index int) string {
+	if rule.Name != "" {
+		return rule.Name
+	}
+	return fmt.Sprintf("#%d", index+1)
+}
+
+func normalizeIPLiteral(value string) (string, bool) {
+	host := strings.TrimSpace(value)
+	if host == "" {
+		return "", false
+	}
+	if parsedHost, _, err := net.SplitHostPort(host); err == nil {
+		host = parsedHost
+	}
+	host = strings.Trim(host, "[]")
+	addr, err := netip.ParseAddr(host)
+	if err != nil {
+		return "", false
+	}
+	return addr.String(), true
+}
+
+func hostIsIPLiteral(value string) bool {
+	_, ok := normalizeIPLiteral(value)
+	return ok
+}
+
+func downloadIPGroupSubscription(rawURL string) ([]byte, error) {
+	if err := validateSubscriptionURL(rawURL); err != nil {
+		return nil, err
+	}
+	client := http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Get(rawURL)
+	if err != nil {
+		return nil, fmt.Errorf("下载订阅失败: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("订阅返回状态码 %d", resp.StatusCode)
+	}
+	var buffer bytes.Buffer
+	reader := io.LimitReader(resp.Body, maxWAFIPGroupSubscriptionBytes+1)
+	if _, err := buffer.ReadFrom(reader); err != nil {
+		return nil, fmt.Errorf("读取订阅内容失败: %w", err)
+	}
+	if buffer.Len() > maxWAFIPGroupSubscriptionBytes {
+		return nil, fmt.Errorf("订阅内容不能超过 %d 字节", maxWAFIPGroupSubscriptionBytes)
+	}
+	return buffer.Bytes(), nil
+}
+
+func parseIPGroupSubscription(content []byte, format string, mappingRule string) ([]string, error) {
+	switch normalizeIPGroupSubscriptionFormat(format) {
+	case wafIPGroupSubscriptionFormatJSON:
+		items, err := parseIPGroupJSONSubscription(content, mappingRule)
+		if err != nil {
+			return nil, err
+		}
+		return normalizeIPList(items)
+	default:
+		return normalizeIPList(parseIPGroupTextSubscription(string(content)))
+	}
+}
+
+func parseIPGroupTextSubscription(text string) []string {
+	lines := strings.Split(text, "\n")
+	items := make([]string, 0, len(lines))
+	for _, line := range lines {
+		item := strings.TrimSpace(line)
+		if item == "" || strings.HasPrefix(item, "#") {
+			continue
+		}
+		items = append(items, item)
+	}
+	return items
+}
+
+func parseIPGroupJSONSubscription(content []byte, mappingRule string) ([]string, error) {
+	var payload any
+	if err := json.Unmarshal(content, &payload); err != nil {
+		return nil, fmt.Errorf("JSON 订阅解析失败: %w", err)
+	}
+	nodes, err := selectJSONMappingNodes(payload, mappingRule)
+	if err != nil {
+		return nil, err
+	}
+	items := make([]string, 0, len(nodes))
+	for _, node := range nodes {
+		collectJSONStrings(node, &items)
+	}
+	if len(items) == 0 {
+		return nil, errors.New("JSON 订阅没有解析到 IP/IP 段")
+	}
+	return items, nil
+}
+
+func selectJSONMappingNodes(payload any, mappingRule string) ([]any, error) {
+	rule := strings.TrimSpace(mappingRule)
+	if rule == "" || rule == "$" {
+		return []any{payload}, nil
+	}
+	rule = strings.TrimPrefix(rule, "$.")
+	nodes := []any{payload}
+	for _, rawSegment := range strings.Split(rule, ".") {
+		segment := strings.TrimSpace(rawSegment)
+		if segment == "" {
+			continue
+		}
+		expandArray := strings.HasSuffix(segment, "[]")
+		segment = strings.TrimSuffix(segment, "[]")
+		next := make([]any, 0)
+		for _, node := range nodes {
+			object, ok := node.(map[string]any)
+			if !ok {
+				continue
+			}
+			value, ok := object[segment]
+			if !ok {
+				continue
+			}
+			if expandArray {
+				array, ok := value.([]any)
+				if !ok {
+					continue
+				}
+				next = append(next, array...)
+			} else {
+				next = append(next, value)
+			}
+		}
+		nodes = next
+	}
+	if len(nodes) == 0 {
+		return nil, fmt.Errorf("JSON 映射规则 %q 未匹配到内容", mappingRule)
+	}
+	return nodes, nil
+}
+
+func collectJSONStrings(node any, items *[]string) {
+	switch value := node.(type) {
+	case string:
+		*items = append(*items, value)
+	case []any:
+		for _, item := range value {
+			collectJSONStrings(item, items)
+		}
+	}
+}
+
+func broadcastIPGroupToAgents(ctx context.Context, id uint) {
+	groups, err := agent.WAFIPGroupsForAgent(ctx, []uint{id})
+	if err != nil || len(groups) == 0 {
+		if err != nil {
+			slog.Debug("build waf ip group broadcast payload failed", "id", id, "error", err)
+		}
+		return
+	}
+	websocket.BroadcastWAFIPGroups(groups)
+}

openflare-server/internal/apps/openflare/waf/ip_group_sync_test.go

@@ -0,0 +1,208 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/glebarez/sqlite"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupIPGroupSyncTestDB(t *testing.T) func() {
+	t.Helper()
+
+	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+	require.NoError(t, sqliteDB.AutoMigrate(
+		&model.OpenFlareWAFRuleGroup{},
+		&model.OpenFlareWAFIPGroup{},
+		&model.OpenFlareAccessLog{},
+	))
+
+	db.SetDB(sqliteDB)
+	return func() {
+		db.SetDB(nil)
+	}
+}
+
+func TestParseIPGroupSubscriptionParsers(t *testing.T) {
+	textItems, err := parseIPGroupSubscription([]byte("# comment\n203.0.113.10\n\n198.51.100.0/24\n"), "text", "")
+	require.NoError(t, err)
+	require.Len(t, textItems, 2)
+	assert.Equal(t, "198.51.100.0/24", textItems[0])
+	assert.Equal(t, "203.0.113.10", textItems[1])
+
+	jsonItems, err := parseIPGroupSubscription([]byte(`{"data":{"items":[{"ip":"203.0.113.11"},{"ip":"203.0.113.12"}]}}`), "json", "data.items[].ip")
+	require.NoError(t, err)
+	require.Len(t, jsonItems, 2)
+	assert.Equal(t, "203.0.113.11", jsonItems[0])
+	assert.Equal(t, "203.0.113.12", jsonItems[1])
+}
+
+func TestSyncIPGroupDownloadsSubscription(t *testing.T) {
+	cleanup := setupIPGroupSyncTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("203.0.113.20\n"))
+	}))
+	defer server.Close()
+
+	group, err := CreateIPGroup(ctx, IPGroupInput{
+		Name:                "subscription",
+		Type:                wafIPGroupTypeSubscription,
+		Enabled:             true,
+		SubscriptionURL:     server.URL,
+		SubscriptionFormat:  wafIPGroupSubscriptionFormatText,
+		SyncIntervalMinutes: 10,
+	})
+	require.NoError(t, err)
+
+	result, err := SyncIPGroup(ctx, group.ID)
+	require.NoError(t, err)
+	require.Equal(t, 1, result.IPCount)
+	assert.Equal(t, "203.0.113.20", result.Group.IPList[0])
+	assert.Equal(t, "success", result.Status)
+}
+
+func TestSyncIPGroupAutomaticExprRules(t *testing.T) {
+	cleanup := setupIPGroupSyncTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	now := time.Now().UTC()
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.10", "app.example.com", 101, 81)
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.11", "198.51.100.10", 60, 0)
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.12", "app.example.com", 120, 10)
+
+	group, err := CreateIPGroup(ctx, IPGroupInput{
+		Name:    "auto blacklist",
+		Type:    wafIPGroupTypeAutomatic,
+		Enabled: true,
+		AutoConfig: json.RawMessage(`{
+			"lookback_minutes": 60,
+			"rules": [
+				{"name":"单 IP 404 高频扫描","expr":"request_count > 100 && StatusRatio(404) >= 0.8"},
+				{"name":"单 IP 直连访问异常","expr":"ip_host_count > 50 && ip_host_ratio > 0.5"}
+			]
+		}`),
+	})
+	require.NoError(t, err)
+
+	result, err := SyncIPGroup(ctx, group.ID)
+	require.NoError(t, err)
+	require.Equal(t, 2, result.IPCount)
+
+	want := map[string]bool{"203.0.113.10": true, "203.0.113.11": true}
+	for _, item := range result.Group.IPList {
+		assert.True(t, want[item], "unexpected matched IP %s", item)
+		delete(want, item)
+	}
+	assert.Empty(t, want)
+}
+
+func TestTestIPGroupAutoConfigReturnsMatchedIPs(t *testing.T) {
+	cleanup := setupIPGroupSyncTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	now := time.Now().UTC()
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.10", "app.example.com", 101, 81)
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.11", "198.51.100.10", 60, 0)
+	seedWAFAccessLogs(t, ctx, now, "203.0.113.12", "app.example.com", 120, 10)
+
+	result, err := TestIPGroupAutoConfig(ctx, IPGroupAutoTestInput{
+		AutoConfig: json.RawMessage(`{
+			"lookback_minutes": 60,
+			"rules": [
+				{"name":"单 IP 404 高频扫描","expr":"request_count > 100 && StatusRatio(404) >= 0.8"},
+				{"name":"单 IP 直连访问异常","expr":"ip_host_count > 50 && ip_host_ratio > 0.5"}
+			]
+		}`),
+	})
+	require.NoError(t, err)
+	assert.Equal(t, 2, result.MatchedCount)
+	assert.Equal(t, 2, result.RuleCount)
+	assert.Equal(t, 60, result.LookbackMinutes)
+
+	want := map[string]bool{"203.0.113.10": true, "203.0.113.11": true}
+	for _, item := range result.MatchedIPs {
+		assert.True(t, want[item], "unexpected matched IP %s", item)
+		delete(want, item)
+	}
+	assert.Empty(t, want)
+}
+
+func TestListDueOpenFlareWAFIPGroups(t *testing.T) {
+	cleanup := setupIPGroupSyncTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	past := time.Now().UTC().Add(-time.Hour)
+	future := time.Now().UTC().Add(time.Hour)
+
+	dueAuto := &model.OpenFlareWAFIPGroup{
+		Name: "due auto", Type: wafIPGroupTypeAutomatic, Enabled: true,
+		IPList: "[]", AutoConfig: "{}", ExtIPs: "[]", NextSyncAt: &past,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFIPGroup(ctx, dueAuto))
+
+	futureAuto := &model.OpenFlareWAFIPGroup{
+		Name: "future auto", Type: wafIPGroupTypeAutomatic, Enabled: true,
+		IPList: "[]", AutoConfig: "{}", ExtIPs: "[]", NextSyncAt: &future,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFIPGroup(ctx, futureAuto))
+
+	dueSub := &model.OpenFlareWAFIPGroup{
+		Name: "due sub", Type: wafIPGroupTypeSubscription, Enabled: true,
+		IPList: "[]", AutoConfig: "{}", ExtIPs: "[]",
+		SubscriptionURL: "https://example.com/list", NextSyncAt: &past,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFIPGroup(ctx, dueSub))
+
+	manual := &model.OpenFlareWAFIPGroup{
+		Name: "manual", Type: wafIPGroupTypeManual, Enabled: true,
+		IPList: "[]", AutoConfig: "{}", ExtIPs: "[]", NextSyncAt: &past,
+	}
+	require.NoError(t, model.CreateOpenFlareWAFIPGroup(ctx, manual))
+
+	groups, err := model.ListDueOpenFlareWAFIPGroups(ctx, time.Now().UTC())
+	require.NoError(t, err)
+	require.Len(t, groups, 2)
+	ids := []uint{groups[0].ID, groups[1].ID}
+	assert.Contains(t, ids, dueAuto.ID)
+	assert.Contains(t, ids, dueSub.ID)
+}
+
+func seedWAFAccessLogs(t *testing.T, ctx context.Context, loggedAt time.Time, remoteAddr string, host string, total int, notFound int) {
+	t.Helper()
+	for i := 0; i < total; i++ {
+		statusCode := http.StatusOK
+		if i < notFound {
+			statusCode = http.StatusNotFound
+		}
+		require.NoError(t, db.DB(ctx).Create(&model.OpenFlareAccessLog{
+			NodeID:     "node-waf-auto",
+			LoggedAt:   loggedAt.Add(-time.Duration(i%30) * time.Second),
+			RemoteAddr: remoteAddr,
+			Host:       host,
+			Path:       "/probe",
+			StatusCode: statusCode,
+		}).Error)
+	}
+}

openflare-server/internal/apps/openflare/waf/logics_test.go

@@ -0,0 +1,110 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+import (
+	"context"
+	"testing"
+
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/glebarez/sqlite"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupWAFTestDB(t *testing.T) func() {
+	t.Helper()
+
+	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+	require.NoError(t, sqliteDB.AutoMigrate(
+		&model.OpenFlareWAFRuleGroup{},
+		&model.OpenFlareWAFIPGroup{},
+		&model.OpenFlareWAFRuleGroupBinding{},
+	))
+
+	db.SetDB(sqliteDB)
+	return func() {
+		db.SetDB(nil)
+	}
+}
+
+func TestCreateRuleGroup(t *testing.T) {
+	cleanup := setupWAFTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	group, err := CreateRuleGroup(ctx, RuleGroupInput{
+		Name:             "edge guard",
+		Enabled:          true,
+		BlockStatusCode:  451,
+		IPWhitelist:      []string{" 192.0.2.1 ", "192.0.2.1", "198.51.100.0/24"},
+		IPBlacklist:      []string{"203.0.113.10"},
+		CountryBlacklist: []string{" cn ", "CN", "us"},
+	})
+	require.NoError(t, err)
+	assert.NotZero(t, group.ID)
+	assert.False(t, group.IsGlobal)
+	assert.Equal(t, "edge guard", group.Name)
+	require.Len(t, group.IPWhitelist, 2)
+	assert.Equal(t, "192.0.2.1", group.IPWhitelist[0])
+	assert.Equal(t, "198.51.100.0/24", group.IPWhitelist[1])
+	require.Len(t, group.CountryBlacklist, 2)
+	assert.Equal(t, "CN", group.CountryBlacklist[0])
+	assert.Equal(t, "US", group.CountryBlacklist[1])
+
+	_, err = CreateRuleGroup(ctx, RuleGroupInput{
+		Name:        "bad ip",
+		Enabled:     true,
+		IPBlacklist: []string{"not-an-ip"},
+	})
+	require.Error(t, err)
+}
+
+func TestPruneIPGroupExtIPs(t *testing.T) {
+	group := &model.OpenFlareWAFIPGroup{
+		ExtIPs: `[{"ip":"203.0.113.10","captured_at":"2026-06-18T10:00:00Z"},{"ip":"203.0.113.11","captured_at":"2026-06-18T11:00:00Z"}]`,
+	}
+	err := pruneIPGroupExtIPs(group, []string{"203.0.113.10"})
+	require.NoError(t, err)
+	assert.JSONEq(t, `[{"ip":"203.0.113.10","captured_at":"2026-06-18T10:00:00Z"}]`, group.ExtIPs)
+}
+
+func TestUpdateIPGroupPrunesAutomaticExtIPs(t *testing.T) {
+	cleanup := setupWAFTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	created, err := CreateIPGroup(ctx, IPGroupInput{
+		Name:       "auto group",
+		Type:       wafIPGroupTypeAutomatic,
+		Enabled:    true,
+		AutoConfig: []byte(`{"lookback_minutes":60,"ttl":-1,"rules":[{"name":"scan","expr":"request_count > 1"}]}`),
+	})
+	require.NoError(t, err)
+
+	group, err := model.GetOpenFlareWAFIPGroupByID(ctx, created.ID)
+	require.NoError(t, err)
+	group.IPList = `["203.0.113.10","203.0.113.11"]`
+	group.ExtIPs = `[{"ip":"203.0.113.10","captured_at":"2026-06-18T10:00:00Z"},{"ip":"203.0.113.11","captured_at":"2026-06-18T11:00:00Z"}]`
+	require.NoError(t, model.UpdateOpenFlareWAFIPGroup(ctx, group))
+
+	updated, err := UpdateIPGroup(ctx, created.ID, IPGroupInput{
+		Name:       created.Name,
+		Type:       created.Type,
+		Enabled:    created.Enabled,
+		IPList:     []string{"203.0.113.10"},
+		AutoConfig: created.AutoConfig,
+		Remark:     created.Remark,
+	})
+	require.NoError(t, err)
+	require.Len(t, updated.IPList, 1)
+	assert.Equal(t, "203.0.113.10", updated.IPList[0])
+	require.Len(t, updated.ExtIPs, 1)
+	assert.Equal(t, "203.0.113.10", updated.ExtIPs[0].IP)
+}

openflare-server/internal/apps/openflare/waf/routers.go

@@ -0,0 +1,435 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package waf
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/Rain-kl/Wavelet/internal/apps/openflare/apiutil"
+	"github.com/Rain-kl/Wavelet/internal/common/response"
+	"github.com/gin-gonic/gin"
+)
+
+
+func handleLogicError(c *gin.Context, err error) bool {
+	if err == nil {
+		return false
+	}
+	return apiutil.AbortNotFoundIfMissing(c, err, "记录不存在")
+}
+
+func routeIDParam(c *gin.Context) (uint, bool) {
+	raw := c.Param("route_id")
+	if raw == "" {
+		response.AbortBadRequest(c, "invalid id")
+		return 0, false
+	}
+	id64, err := strconv.ParseUint(raw, 10, 64)
+	if err != nil || id64 == 0 {
+		response.AbortBadRequest(c, "invalid id")
+		return 0, false
+	}
+	return uint(id64), true
+}
+
+// ListRuleGroupsHandler 列出全部 WAF 规则组。
+// @Summary 列出 WAF 规则组
+// @Description 返回全部 WAF 规则组，需要管理员权限
+// @Tags openflare-waf
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=[]waf.RuleGroupView} "规则组列表"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/rule-groups [get]
+func ListRuleGroupsHandler(c *gin.Context) {
+	groups, err := ListRuleGroups(c.Request.Context())
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(groups))
+}
+
+// GetRuleGroupHandler 获取 WAF 规则组详情。
+// @Summary 获取 WAF 规则组详情
+// @Description 按 ID 返回 WAF 规则组详情，需要管理员权限
+// @Tags openflare-waf
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "规则组 ID"
+// @Success 200 {object} response.Any{data=waf.RuleGroupView} "规则组详情"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/rule-groups/{id} [get]
+func GetRuleGroupHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	group, err := GetRuleGroup(c.Request.Context(), id)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(group))
+}
+
+// CreateRuleGroupHandler 创建 WAF 规则组。
+// @Summary 创建 WAF 规则组
+// @Description 创建新的 WAF 规则组，需要管理员权限
+// @Tags openflare-waf
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param request body waf.RuleGroupInput true "规则组参数"
+// @Success 200 {object} response.Any{data=waf.RuleGroupView} "创建成功的规则组"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/rule-groups [post]
+func CreateRuleGroupHandler(c *gin.Context) {
+	var input RuleGroupInput
+	if !apiutil.BindJSON(c, &input) {
+		return
+	}
+	group, err := CreateRuleGroup(c.Request.Context(), input)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(group))
+}
+
+// UpdateRuleGroupHandler 更新 WAF 规则组。
+// @Summary 更新 WAF 规则组
+// @Description 按 ID 更新 WAF 规则组，需要管理员权限
+// @Tags openflare-waf
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "规则组 ID"
+// @Param request body waf.RuleGroupInput true "规则组参数"
+// @Success 200 {object} response.Any{data=waf.RuleGroupView} "更新后的规则组"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/rule-groups/{id}/update [post]
+func UpdateRuleGroupHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	var input RuleGroupInput
+	if !apiutil.BindJSON(c, &input) {
+		return
+	}
+	group, err := UpdateRuleGroup(c.Request.Context(), id, input)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(group))
+}
+
+// DeleteRuleGroupHandler 删除 WAF 规则组。
+// @Summary 删除 WAF 规则组
+// @Description 按 ID 删除 WAF 规则组，需要管理员权限
+// @Tags openflare-waf
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "规则组 ID"
+// @Success 200 {object} response.Any "删除成功"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/rule-groups/{id}/delete [post]
+func DeleteRuleGroupHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	if err := DeleteRuleGroup(c.Request.Context(), id); handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OKNil())
+}
+
+// ReplaceRuleGroupSitesHandler 替换规则组绑定的站点。
+// @Summary 替换规则组站点绑定
+// @Description 替换 WAF 规则组关联的代理站点列表，需要管理员权限
+// @Tags openflare-waf
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "规则组 ID"
+// @Param request body waf.IDsRequest true "站点 ID 列表"
+// @Success 200 {object} response.Any{data=waf.RuleGroupView} "更新后的规则组"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/rule-groups/{id}/sites [post]
+func ReplaceRuleGroupSitesHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	var request IDsRequest
+	if !apiutil.BindJSON(c, &request) {
+		return
+	}
+	group, err := ReplaceRuleGroupSites(c.Request.Context(), id, request.IDs)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(group))
+}
+
+// GetSiteRuleGroupsHandler 获取站点的 WAF 规则组绑定。
+// @Summary 获取站点 WAF 规则组
+// @Description 返回代理站点关联的 WAF 规则组绑定，需要管理员权限
+// @Tags openflare-waf
+// @Produce json
+// @Security SessionCookie
+// @Param route_id path int true "代理路由 ID"
+// @Success 200 {object} response.Any{data=waf.SiteRuleGroupsView} "站点规则组绑定"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/sites/{route_id}/rule-groups [get]
+func GetSiteRuleGroupsHandler(c *gin.Context) {
+	routeID, ok := routeIDParam(c)
+	if !ok {
+		return
+	}
+	view, err := GetSiteRuleGroups(c.Request.Context(), routeID)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(view))
+}
+
+// ReplaceSiteRuleGroupsHandler 替换站点的 WAF 规则组绑定。
+// @Summary 替换站点 WAF 规则组
+// @Description 替换代理站点关联的 WAF 规则组列表，需要管理员权限
+// @Tags openflare-waf
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param route_id path int true "代理路由 ID"
+// @Param request body waf.IDsRequest true "规则组 ID 列表"
+// @Success 200 {object} response.Any{data=waf.SiteRuleGroupsView} "更新后的站点规则组绑定"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/sites/{route_id}/rule-groups [post]
+func ReplaceSiteRuleGroupsHandler(c *gin.Context) {
+	routeID, ok := routeIDParam(c)
+	if !ok {
+		return
+	}
+	var request IDsRequest
+	if !apiutil.BindJSON(c, &request) {
+		return
+	}
+	view, err := ReplaceSiteRuleGroups(c.Request.Context(), routeID, request.IDs)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(view))
+}
+
+// ListIPGroupsHandler 列出全部 WAF IP 组。
+// @Summary 列出 WAF IP 组
+// @Description 返回全部 WAF IP 组，需要管理员权限
+// @Tags openflare-waf
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=[]waf.IPGroupView} "IP 组列表"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/ip-groups [get]
+func ListIPGroupsHandler(c *gin.Context) {
+	groups, err := ListIPGroups(c.Request.Context())
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(groups))
+}
+
+// GetIPGroupHandler 获取 WAF IP 组详情。
+// @Summary 获取 WAF IP 组详情
+// @Description 按 ID 返回 WAF IP 组详情，需要管理员权限
+// @Tags openflare-waf
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "IP 组 ID"
+// @Success 200 {object} response.Any{data=waf.IPGroupView} "IP 组详情"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/ip-groups/{id} [get]
+func GetIPGroupHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	group, err := GetIPGroup(c.Request.Context(), id)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(group))
+}
+
+// CreateIPGroupHandler 创建 WAF IP 组。
+// @Summary 创建 WAF IP 组
+// @Description 创建新的 WAF IP 组，需要管理员权限
+// @Tags openflare-waf
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param request body waf.IPGroupInput true "IP 组参数"
+// @Success 200 {object} response.Any{data=waf.IPGroupView} "创建成功的 IP 组"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/ip-groups [post]
+func CreateIPGroupHandler(c *gin.Context) {
+	var input IPGroupInput
+	if !apiutil.BindJSON(c, &input) {
+		return
+	}
+	group, err := CreateIPGroup(c.Request.Context(), input)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(group))
+}
+
+// UpdateIPGroupHandler 更新 WAF IP 组。
+// @Summary 更新 WAF IP 组
+// @Description 按 ID 更新 WAF IP 组，需要管理员权限
+// @Tags openflare-waf
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "IP 组 ID"
+// @Param request body waf.IPGroupInput true "IP 组参数"
+// @Success 200 {object} response.Any{data=waf.IPGroupView} "更新后的 IP 组"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/ip-groups/{id}/update [post]
+func UpdateIPGroupHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	var input IPGroupInput
+	if !apiutil.BindJSON(c, &input) {
+		return
+	}
+	group, err := UpdateIPGroup(c.Request.Context(), id, input)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(group))
+}
+
+// DeleteIPGroupHandler 删除 WAF IP 组。
+// @Summary 删除 WAF IP 组
+// @Description 按 ID 删除 WAF IP 组，需要管理员权限
+// @Tags openflare-waf
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "IP 组 ID"
+// @Success 200 {object} response.Any "删除成功"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/ip-groups/{id}/delete [post]
+func DeleteIPGroupHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	if err := DeleteIPGroup(c.Request.Context(), id); handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OKNil())
+}
+
+// SyncIPGroupHandler 触发 WAF IP 组同步。
+// @Summary 同步 WAF IP 组
+// @Description 手动触发 WAF IP 组外部 IP 同步，需要管理员权限
+// @Tags openflare-waf
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "IP 组 ID"
+// @Success 200 {object} response.Any{data=waf.IPGroupSyncResult} "同步结果"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 404 {object} response.Any "记录不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/ip-groups/{id}/sync [post]
+func SyncIPGroupHandler(c *gin.Context) {
+	id, ok := apiutil.IDParam(c)
+	if !ok {
+		return
+	}
+	result, err := SyncIPGroup(c.Request.Context(), id)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(result))
+}
+
+// TestIPGroupAutoConfigHandler 测试 WAF IP 组自动配置。
+// @Summary 测试 WAF IP 组自动配置
+// @Description 根据自动配置规则测试 IP 匹配结果（桩实现），需要管理员权限
+// @Tags openflare-waf
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param request body waf.IPGroupAutoTestInput true "自动配置参数"
+// @Success 200 {object} response.Any{data=waf.IPGroupAutoTestResult} "测试结果"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Failure 500 {object} response.Any "内部错误"
+// @Router /api/v1/d/waf/ip-groups/test [post]
+func TestIPGroupAutoConfigHandler(c *gin.Context) {
+	var input IPGroupAutoTestInput
+	if !apiutil.BindJSON(c, &input) {
+		return
+	}
+	result, err := TestIPGroupAutoConfig(c.Request.Context(), input)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(result))
+}