Skip to content

Commit 5f9ce8f

Browse files
jcbsfilhojcbsfilho
authored
Merge pull request #397 from aziontech/stage
Release 3.1.2
2 parents 2208fb9 + 0f42a3c commit 5f9ce8f

7 files changed

Lines changed: 167 additions & 34 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
## <small>3.1.2-stage.2 (2026-03-03)</small>
2+
3+
* fix: update firewall schema to accept variables (#396) ([607d246](https://github.com/aziontech/lib/commit/607d246)), closes [#396](https://github.com/aziontech/lib/issues/396)
4+
5+
## <small>3.1.2-stage.1 (2026-03-02)</small>
6+
7+
* fix: firewall functions instances support (#395) ([8d24afc](https://github.com/aziontech/lib/commit/8d24afc)), closes [#395](https://github.com/aziontech/lib/issues/395)
8+
19
## <small>3.1.1 (2026-02-13)</small>
210

311
* Merge pull request #389 from aziontech/stage ([c9bff59](https://github.com/aziontech/lib/commit/c9bff59)), closes [#389](https://github.com/aziontech/lib/issues/389)

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "azion",
3-
"version": "3.1.1",
3+
"version": "3.1.2-stage.2",
44
"description": "Azion Packages for Edge Computing.",
55
"scripts": {
66
"prepare": "husky",

‎packages/config/src/configProcessor/helpers/azion.config.example.ts‎

Lines changed: 30 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -477,40 +477,56 @@ const config: AzionConfig = {
477477
],
478478
firewall: [
479479
{
480-
name: 'my_firewall',
480+
name: 'my-firewall',
481481
active: true,
482482
functions: true,
483483
networkProtection: true,
484484
waf: true,
485+
functionsInstances: [
486+
{
487+
name: 'my_func_instance',
488+
ref: 'my_func_name',
489+
},
490+
],
485491
rules: [
486492
{
487-
name: 'rateLimit_Then_Drop',
488-
active: true,
489-
match: '^/api/sensitive/',
490-
variable: 'request_uri',
493+
name: 'rule-network',
494+
description: 'Rule Network List',
495+
criteria: [
496+
{
497+
variable: 'network',
498+
conditional: 'if',
499+
operator: 'is_in_list',
500+
argument: 'my-ip-allowlist',
501+
},
502+
{
503+
variable: 'network',
504+
conditional: 'and',
505+
operator: 'is_in_list',
506+
argument: 'trusted-asn-list',
507+
},
508+
],
491509
behaviors: [
492510
{
493-
setRateLimit: {
494-
type: 'second',
495-
limitBy: 'clientIp',
496-
averageRateLimit: '10',
497-
maximumBurstSize: '20',
498-
},
511+
deny: true,
499512
},
500513
],
501514
},
502515
{
503-
name: 'customResponse_Only',
516+
name: 'rateLimit_Then_Drop',
504517
active: true,
505518
criteria: [
506519
{
507520
variable: 'request_uri',
508-
operator: 'matches',
509521
conditional: 'if',
510-
argument: '^/custom-error/',
522+
operator: 'matches',
523+
argument: '^/api/sensitive/',
511524
},
512525
],
513526
behaviors: [
527+
{
528+
runFunction: 'my_func_instance',
529+
},
514530
{
515531
setCustomResponse: {
516532
statusCode: 403,

‎packages/config/src/configProcessor/helpers/schema.ts‎

Lines changed: 59 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -624,6 +624,32 @@ const firewallRulesBehaviorsSchema = {
624624
errorMessage: 'The behaviors array must contain between 1 and 10 behavior items.',
625625
};
626626

627+
const firewallFunctionsInstances = {
628+
type: 'object',
629+
properties: {
630+
name: {
631+
type: 'string',
632+
minLength: 1,
633+
maxLength: 100,
634+
errorMessage: 'The name must be a string between 1 and 100 characters long',
635+
},
636+
args: {
637+
type: 'object',
638+
default: {},
639+
errorMessage: "The 'args' field must be an object",
640+
},
641+
ref: {
642+
type: ['string', 'number'],
643+
errorMessage: "The 'ref' field must be a string or number referencing an existing Function name or ID",
644+
},
645+
},
646+
required: ['name', 'ref'],
647+
additionalProperties: false,
648+
errorMessage: {
649+
additionalProperties: 'No additional properties are allowed in the firewallFunctionsInstance object',
650+
},
651+
};
652+
627653
const azionConfigSchema = {
628654
$id: 'azionConfig',
629655
definitions: {
@@ -1361,9 +1387,19 @@ const azionConfigSchema = {
13611387
errorMessage: "The rule's 'match' field must be a string containing a valid regex pattern",
13621388
},
13631389
variable: {
1364-
type: 'string',
1365-
enum: FIREWALL_VARIABLES,
1366-
errorMessage: `The 'variable' field must be one of: ${FIREWALL_VARIABLES.join(', ')}`,
1390+
anyOf: [
1391+
{
1392+
type: 'string',
1393+
pattern: '^\\$\\{(' + [...new Set(FIREWALL_VARIABLES)].join('|') + ')\\}$',
1394+
errorMessage: "The 'variable' field must be a valid variable wrapped in ${}",
1395+
},
1396+
{
1397+
type: 'string',
1398+
enum: [...FIREWALL_VARIABLES],
1399+
errorMessage: "The 'variable' field must be a valid firewall variable",
1400+
},
1401+
],
1402+
errorMessage: "The 'variable' field must be a valid variable (with or without ${})",
13671403
},
13681404
behaviors: firewallRulesBehaviorsSchema,
13691405
criteria: {
@@ -1379,18 +1415,28 @@ const azionConfigSchema = {
13791415
errorMessage: `The 'conditional' field must be one of: ${FIREWALL_RULE_CONDITIONAL.join(', ')}`,
13801416
},
13811417
variable: {
1382-
type: 'string',
1383-
enum: FIREWALL_VARIABLES,
1384-
errorMessage: `The 'variable' field must be one of: ${FIREWALL_VARIABLES.join(', ')}`,
1418+
anyOf: [
1419+
{
1420+
type: 'string',
1421+
pattern: '^\\$\\{(' + [...new Set(FIREWALL_VARIABLES)].join('|') + ')\\}$',
1422+
errorMessage: "The 'variable' field must be a valid variable wrapped in ${}",
1423+
},
1424+
{
1425+
type: 'string',
1426+
enum: [...FIREWALL_VARIABLES],
1427+
errorMessage: "The 'variable' field must be a valid firewall variable",
1428+
},
1429+
],
1430+
errorMessage: "The 'variable' field must be a valid variable (with or without ${})",
13851431
},
13861432
operator: {
13871433
type: 'string',
13881434
enum: FIREWALL_RULE_OPERATORS,
13891435
errorMessage: `The 'operator' field must be one of: ${FIREWALL_RULE_OPERATORS.join(', ')}`,
13901436
},
13911437
argument: {
1392-
type: 'string',
1393-
errorMessage: 'The argument must be a string',
1438+
type: ['string', 'number'],
1439+
errorMessage: 'The argument must be a string or number',
13941440
},
13951441
},
13961442
required: ['conditional', 'variable', 'operator', 'argument'],
@@ -1428,6 +1474,10 @@ const azionConfigSchema = {
14281474
},
14291475
},
14301476
},
1477+
functionsInstances: {
1478+
type: 'array',
1479+
items: firewallFunctionsInstances,
1480+
},
14311481
},
14321482
required: ['name'],
14331483
additionalProperties: false,
@@ -2026,10 +2076,9 @@ const azionConfigSchema = {
20262076
},
20272077
},
20282078
additionalProperties: false,
2029-
required: ['build', 'applications', 'workloads'],
20302079
errorMessage: {
20312080
additionalProperties:
2032-
'Config can only contain the following properties: build, functions, applications, workloads, purge, edgefirewall, networkList, waf, connectors, customPages',
2081+
'Config can only contain the following properties: build, functions, applications, workloads, purge, firewall, networkList, waf, connectors, customPages',
20332082
type: 'Configuration must be an object',
20342083
},
20352084
},

‎packages/config/src/configProcessor/processStrategy/implementations/secure/firewallProcessConfigStrategy.test.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -148,8 +148,8 @@ describe('FirewallProcessConfigStrategy', () => {
148148
// criteria wrapped into array-of-arrays
149149
expect(rule.criteria).toEqual([
150150
[
151-
{ variable: 'host', operator: 'is_equal', conditional: 'if', argument: 'example.com' },
152-
{ variable: 'request_method', operator: 'exists', conditional: 'and' },
151+
{ variable: '${host}', operator: 'is_equal', conditional: 'if', argument: 'example.com' },
152+
{ variable: '${request_method}', operator: 'exists', conditional: 'and' },
153153
],
154154
]);
155155
});
@@ -301,8 +301,8 @@ describe('FirewallProcessConfigStrategy', () => {
301301

302302
expect(rule.criteria).toEqual([
303303
[
304-
{ variable: 'host', operator: 'is_equal', conditional: 'if', argument: 'example.com' },
305-
{ variable: 'request_method', operator: 'matches', conditional: 'and', argument: '^(GET|POST)$' },
304+
{ variable: '${host}', operator: 'is_equal', conditional: 'if', argument: 'example.com' },
305+
{ variable: '${request_method}', operator: 'matches', conditional: 'and', argument: '^(GET|POST)$' },
306306
],
307307
]);
308308
expect(rule.behaviors).toEqual([{ type: 'deny' }]);

‎packages/config/src/configProcessor/processStrategy/implementations/secure/firewallProcessConfigStrategy.ts‎

Lines changed: 46 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
1-
import { AzionConfig, AzionFirewall, AzionFirewallCriteriaWithValue, AzionFirewallRule } from '../../../../types';
1+
import {
2+
AzionConfig,
3+
AzionFirewall,
4+
AzionFirewallCriteriaWithValue,
5+
AzionFirewallRule,
6+
AzionFunction,
7+
} from '../../../../types';
28
import ProcessConfigStrategy from '../../processConfigStrategy';
39

410
/**
@@ -7,6 +13,22 @@ import ProcessConfigStrategy from '../../processConfigStrategy';
713
* @description This class is implementation of the Firewall ProcessConfig Strategy.
814
*/
915
class FirewallProcessConfigStrategy extends ProcessConfigStrategy {
16+
/**
17+
* Validate that referenced Function exists
18+
*/
19+
private validateFunctionReference(
20+
functions: AzionFunction[] | undefined,
21+
functionNameOrId: string | number,
22+
instanceName: string,
23+
) {
24+
// Only validate if it's a string (name), skip validation for numbers (IDs)
25+
if (typeof functionNameOrId === 'string') {
26+
if (!Array.isArray(functions) || !functions.find((func) => func.name === functionNameOrId)) {
27+
throw new Error(`Function instance "${instanceName}" references non-existent Function "${functionNameOrId}".`);
28+
}
29+
}
30+
}
31+
1032
transformToManifest(config: AzionConfig) {
1133
if (!config.firewall || !Array.isArray(config.firewall)) {
1234
return [];
@@ -44,7 +66,7 @@ class FirewallProcessConfigStrategy extends ProcessConfigStrategy {
4466
const { argument, ...rest } = criterion as AzionFirewallCriteriaWithValue;
4567
return {
4668
...rest,
47-
variable: criterion.variable,
69+
variable: criterion.variable.startsWith('${') ? criterion.variable : `\${${criterion.variable}}`,
4870
...(isWithArgument && { argument }),
4971
};
5072
}),
@@ -62,6 +84,18 @@ class FirewallProcessConfigStrategy extends ProcessConfigStrategy {
6284
}));
6385
}
6486

87+
if (fw.functionsInstances && fw.functionsInstances.length > 0) {
88+
payload.functions_instances = fw.functionsInstances.map((instance) => {
89+
this.validateFunctionReference(config.functions, instance.ref, instance.name);
90+
return {
91+
name: instance.name,
92+
args: instance.args || {},
93+
active: instance.active ?? true,
94+
function: instance.ref,
95+
};
96+
});
97+
}
98+
6599
return payload;
66100
});
67101
}
@@ -184,6 +218,16 @@ class FirewallProcessConfigStrategy extends ProcessConfigStrategy {
184218
});
185219
}
186220

221+
if (fw.functions_instance && fw.functions_instance.length > 0) {
222+
// eslint-disable-next-line @typescript-eslint/no-explicit-any
223+
firewallConfig.functionsInstances = fw.functions_instance.map((instance: any) => ({
224+
name: instance.name,
225+
args: instance.args || {},
226+
active: instance.active ?? true,
227+
ref: instance.function,
228+
}));
229+
}
230+
187231
return firewallConfig;
188232
});
189233
return transformedPayload.firewall;

‎packages/config/src/types.ts‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,8 @@ export type CommonVariable =
5353
| 'request_method'
5454
| 'request_uri'
5555
| 'scheme'
56-
| 'uri';
56+
| 'uri'
57+
| 'network';
5758
export type RequestVariable =
5859
| CommonVariable
5960
| 'server_addr'
@@ -82,7 +83,9 @@ export type RuleOperatorWithValue =
8283
| 'starts_with'
8384
| 'does_not_start_with'
8485
| 'matches'
85-
| 'does_not_match';
86+
| 'does_not_match'
87+
| 'is_in_list'
88+
| 'is_not_in_list';
8689
export type RuleOperatorWithoutValue = 'exists' | 'does_not_exist';
8790
export type RuleConditional = 'if' | 'and' | 'or';
8891

@@ -597,7 +600,7 @@ export type AzionFirewallCriteriaWithValue = AzionFirewallCriteriaBase & {
597600
/** Operator for comparison that requires input value */
598601
operator: RuleOperatorWithValue;
599602
/** Argument for comparison */
600-
argument: string;
603+
argument: string | number;
601604
};
602605

603606
export type AzionFirewallCriteriaWithoutValue = AzionFirewallCriteriaBase & {
@@ -627,6 +630,17 @@ export type AzionFirewallRule = {
627630
behaviors: AzionFirewallBehavior;
628631
};
629632

633+
export type AzionFirewallFunctionsInstance = {
634+
/** Function instance name */
635+
name: string;
636+
/** Function instance arguments */
637+
args?: Record<string, string>;
638+
/** Active */
639+
active?: boolean;
640+
/** Reference to Function name or ID */
641+
ref: string | number;
642+
};
643+
630644
/**
631645
* Firewall configuration for Azion.
632646
*/
@@ -645,6 +659,8 @@ export type AzionFirewall = {
645659
rules?: AzionFirewallRule[];
646660
/** Debug mode */
647661
debugRules?: boolean;
662+
/** Functions Instances */
663+
functionsInstances?: AzionFirewallFunctionsInstance[];
648664
};
649665

650666
// WAF V4 Types

0 commit comments

Comments
 (0)