Conversation
Add 'Test rules (dry run)' to the WAF page: expression vs zone-draft modes, sample-request fields, result shape, and the simulation caveats (user-supplied country/asn, empty body / zero content_length, HTTP/1.1 proto, unsimulated baseline+managed layers, per-expression vs whole-walk eval budget, filterMatched vs counted vs limited). Add waf.test to the API function catalog. Console Test-panel screenshot (light+dark) captured via a new waf-test entry in scripts/screenshots/capture.mjs — the panel needs interaction (expand, fill sample, run), like the deploy form. Also fix the pre-existing request.ip references: the engine's request map exposes request.remote_ip (parapet pkg/waf), and request.ip always eval-errors and fail-opens, so the documented allow-your-egress-IP pattern could never match. The dry-run section is what surfaces this — waf.test reports the error per rule.
|
Preview deleted (PR closed). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the
waf.testdry-run RPC (design doc: PLAN-waf-test.md, §4 — PR 4 of 4).outcome/rules[]/limits[]/valid), and the simulation caveats (user-suppliedcountry/asn, empty body & zerocontent_length,HTTP/1.1proto, unsimulated baseline + managed WAF layers, per-expression vs whole-walk eval budget,filterMatchedvscountedvs "would be limited").waf-testbranch via a newwaf-testentry inscripts/screenshots/capture.mjs(the panel needs interaction — expand, fill sample, run — like the deploy-form capture).waf.testrow in the API function catalog (content/api/conventions.md), anchored to the new section.request.ipreferences: the engine's request map exposesrequest.remote_ip(parapetpkg/waf/request.go);request.ipcompiles but always eval-errors and fails open, so the documented "allow your own egress IPs" pattern could never match. The dry-run section is exactly what surfaces this — pasting the old example intowaf.testreturns a per-rule error.Screenshot
Test evidence
make build(hugo --minify) passes clean.#test-rules-dry-runanchor present (conventions.md link resolves), both fingerprintedwaf-test*.pngimages referenced, no stray TODO comments, zero remainingrequest.ipoccurrences on the WAF page.dev:mockwith the real panel flow (GET /admin → blocked byblock-admin, 403; per-ip limit "matches filter — not counted").Merge gating / post-merge notes (from the plan's rollout order)
waf.test) is deployed — until then the documented curl returns unknown-action. Order: api → apiserver (deploy) → console → docs.'*'row forwaf.test(plan §6 — cheapest authenticated CPU-burn surface).Follow-ups (pre-existing, not blocking)
scripts/screenshots/mock-enrichment.patchstill targetssrc/lib/server/mock.js, but the console migrated tomock.ts—refresh.shfails atgit applybefore capturing anything. Needs a patch regeneration againstmock.ts(separate change; affects all screenshots equally).refresh.shneeds the fixture switched to builder form (noted incapture.mjs; suggest doing it in the consolewaf-testPR).content/networking/transform.mdalso mentionsrequest.ip— that's the edge-transform CEL surface (ingress controller, notpkg/waf), so it was left alone; worth a separate check.