Feat: Add conditional (AND) resource rules - #90
Open
Blacks-Army wants to merge 2 commits into
Open
Conversation
A rule with match "METHOD" carries a comma-separated list of HTTP methods in its value, e.g. "POST,PUT", and applies when the request method is in that list.
A rule with match "AND" carries a JSON array of conditions in its value and applies only when every one of them matches, so a rule can finally combine a path with a method, a country with a CIDR, and so on. The per-condition matching that the rule loop used to do inline moves into matchesCondition, which both a plain rule and an AND rule now go through. Behaviour for existing rules is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Node-side half of fosrl/pangolin#3705, and a follow-up to #89, which should go in first.
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
AI Disclosure
Claude Code (Opus) helped me with this one, including the implementation. I set the design constraints, went through every hunk myself and verified the result before opening this.
Description
A rule with match
ANDcarries a JSON array of conditions in its existing value and applies only when every one of them matches, e.g.PATH/api/*together withMETHODPOST,PUT.The per-condition matching the rule loop used to do inline moves into
matchesCondition(match, value, context), which a plain rule and anANDrule both go through. The translation is mechanical: each formercontinuebecomes areturn false, which has the same effect because the chain iselse ifthroughout. Existing rules keep matching exactly as before.A value that is not a well-formed condition list is skipped and logged rather than applied, and an empty list counts as malformed, since it would otherwise match every request.
Validation, blueprints and the UI live in the hub, so this side only parses what it is handed and ignores condition entries it does not understand.
Merge alongside fosrl/pangolin#3705. An
ANDrule can only be created over there, and this side ignores match types it does not know, so neither order breaks anything in the meantime.How to test?
With fosrl/pangolin#3705 applied to the hub, create an
ANDrule combiningPATH/api/*andMETHODPOST,PUTon a resource served through a node, then confirm only POST and PUT under/api/are caught.npx tsc --noEmitreports nothing about this change. It does exit non-zero on the twotsconfig.jsondeprecation errors, but that is unrelated and pre-existing:devhas been failing the same way sincetypescriptwas bumped to 6.0.3, so thetestjob is currently red on every branch here.