72f793552e
- Migration 0037: waf_configs-Tabelle (domain_id FK, enabled=false default, mode/paranoia_level/rule_exclusions/trusted_proxies/custom_rules) - models/waf.go: WafConfig-Model - services/waf/waf.go: Repo (List, GetByDomain, Upsert, ListEnabled) - handlers/waf.go: GET /waf/configs, GET /waf/configs/:id, PUT /waf/configs/:id — GET liefert Default-Config (disabled) wenn noch kein Row existiert - main.go: WafHandler registriert Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
115 lines
3.1 KiB
Go
115 lines
3.1 KiB
Go
// Package waf implements CRUD for per-domain WAF policies (waf_configs).
|
|
package waf
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/models"
|
|
)
|
|
|
|
var ErrNotFound = errors.New("waf config not found")
|
|
|
|
type Repo struct {
|
|
Pool *pgxpool.Pool
|
|
}
|
|
|
|
func New(pool *pgxpool.Pool) *Repo { return &Repo{Pool: pool} }
|
|
|
|
const baseSelect = `
|
|
SELECT id, domain_id, enabled, mode, paranoia_level,
|
|
rule_exclusions, trusted_proxies, custom_rules, updated_at
|
|
FROM waf_configs
|
|
`
|
|
|
|
func scan(row pgx.Row) (*models.WafConfig, error) {
|
|
var c models.WafConfig
|
|
err := row.Scan(
|
|
&c.ID, &c.DomainID, &c.Enabled, &c.Mode, &c.ParanoiaLevel,
|
|
&c.RuleExclusions, &c.TrustedProxies, &c.CustomRules, &c.UpdatedAt,
|
|
)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &c, nil
|
|
}
|
|
|
|
// List returns all WAF configs ordered by domain_id.
|
|
func (r *Repo) List(ctx context.Context) ([]models.WafConfig, error) {
|
|
rows, err := r.Pool.Query(ctx, baseSelect+" ORDER BY domain_id ASC")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
out := make([]models.WafConfig, 0, 16)
|
|
for rows.Next() {
|
|
c, err := scan(rows)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, *c)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
// GetByDomain returns the WAF config for a domain, or ErrNotFound.
|
|
func (r *Repo) GetByDomain(ctx context.Context, domainID int64) (*models.WafConfig, error) {
|
|
row := r.Pool.QueryRow(ctx, baseSelect+" WHERE domain_id = $1", domainID)
|
|
c, err := scan(row)
|
|
if err != nil {
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return nil, ErrNotFound
|
|
}
|
|
return nil, err
|
|
}
|
|
return c, nil
|
|
}
|
|
|
|
// Upsert inserts or updates the WAF config for a domain.
|
|
// Returns the resulting row.
|
|
func (r *Repo) Upsert(ctx context.Context, c models.WafConfig) (*models.WafConfig, error) {
|
|
c.UpdatedAt = time.Now()
|
|
row := r.Pool.QueryRow(ctx, `
|
|
INSERT INTO waf_configs
|
|
(domain_id, enabled, mode, paranoia_level,
|
|
rule_exclusions, trusted_proxies, custom_rules, updated_at)
|
|
VALUES ($1,$2,$3,$4,$5,$6,$7,$8)
|
|
ON CONFLICT (domain_id) DO UPDATE SET
|
|
enabled = EXCLUDED.enabled,
|
|
mode = EXCLUDED.mode,
|
|
paranoia_level = EXCLUDED.paranoia_level,
|
|
rule_exclusions = EXCLUDED.rule_exclusions,
|
|
trusted_proxies = EXCLUDED.trusted_proxies,
|
|
custom_rules = EXCLUDED.custom_rules,
|
|
updated_at = EXCLUDED.updated_at
|
|
RETURNING id, domain_id, enabled, mode, paranoia_level,
|
|
rule_exclusions, trusted_proxies, custom_rules, updated_at
|
|
`,
|
|
c.DomainID, c.Enabled, c.Mode, c.ParanoiaLevel,
|
|
c.RuleExclusions, c.TrustedProxies, c.CustomRules, c.UpdatedAt,
|
|
)
|
|
return scan(row)
|
|
}
|
|
|
|
// ListEnabled returns only configs with enabled=true (used by the WAF agent).
|
|
func (r *Repo) ListEnabled(ctx context.Context) ([]models.WafConfig, error) {
|
|
rows, err := r.Pool.Query(ctx, baseSelect+" WHERE enabled = true ORDER BY domain_id ASC")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
out := make([]models.WafConfig, 0, 8)
|
|
for rows.Next() {
|
|
c, err := scan(rows)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, *c)
|
|
}
|
|
return out, rows.Err()
|
|
}
|