From 278375f7be5eebbea677d6f8ab58fc208ebcaad5 Mon Sep 17 00:00:00 2001
From: Fred KISSIE <fredkiss3@gmail.com>
Date: Thu, 25 Jun 2026 21:26:13 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=9A=A7=20More=20`country=20is=20not`=20ru?=
 =?UTF-8?q?le?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/db/pg/schema/schema.ts                        | 12 +++++++++++-
 server/db/sqlite/schema/schema.ts                    | 12 +++++++++++-
 server/routers/resource/updateResourceRule.ts        |  2 ++
 .../resource-policy/policy-access-rule-validation.ts |  1 +
 4 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/server/db/pg/schema/schema.ts b/server/db/pg/schema/schema.ts
index 934eba1f6..04c0016c5 100644
--- a/server/db/pg/schema/schema.ts
+++ b/server/db/pg/schema/schema.ts
@@ -966,7 +966,17 @@ export const resourceRules = pgTable("resourceRules", {
     enabled: boolean("enabled").notNull().default(true),
     priority: integer("priority").notNull(),
     action: varchar("action").notNull(), // ACCEPT, DROP, PASS
-    match: varchar("match").notNull(), // CIDR, PATH, IP
+    match: varchar("match")
+        .$type<
+            | "CIDR"
+            | "PATH"
+            | "IP"
+            | "COUNTRY"
+            | "COUNTRY_IS_NOT"
+            | "ASN"
+            | "REGION"
+        >()
+        .notNull(), // CIDR, PATH, IP
     value: varchar("value").notNull()
 });
 
diff --git a/server/db/sqlite/schema/schema.ts b/server/db/sqlite/schema/schema.ts
index 76e6d22cf..d81cbb873 100644
--- a/server/db/sqlite/schema/schema.ts
+++ b/server/db/sqlite/schema/schema.ts
@@ -1205,7 +1205,17 @@ export const resourceRules = sqliteTable("resourceRules", {
     enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
     priority: integer("priority").notNull(),
     action: text("action").notNull(), // ACCEPT, DROP, PASS
-    match: text("match").notNull(), // CIDR, PATH, IP
+    match: text("match")
+        .$type<
+            | "CIDR"
+            | "PATH"
+            | "IP"
+            | "COUNTRY"
+            | "COUNTRY_IS_NOT"
+            | "ASN"
+            | "REGION"
+        >()
+        .notNull(), // CIDR, PATH, IP
     value: text("value").notNull()
 });
 
diff --git a/server/routers/resource/updateResourceRule.ts b/server/routers/resource/updateResourceRule.ts
index 84afb38b6..c724d00d2 100644
--- a/server/routers/resource/updateResourceRule.ts
+++ b/server/routers/resource/updateResourceRule.ts
@@ -27,6 +27,7 @@ const resourceRuleMatchSchema = z.enum([
     "IP",
     "PATH",
     "COUNTRY",
+    "COUNTRY_IS_NOT",
     "ASN",
     "REGION"
 ]);
@@ -144,6 +145,7 @@ export async function updateResourceRule(
             | "IP"
             | "PATH"
             | "COUNTRY"
+            | "COUNTRY_IS_NOT"
             | "ASN"
             | "REGION";
 
diff --git a/src/components/resource-policy/policy-access-rule-validation.ts b/src/components/resource-policy/policy-access-rule-validation.ts
index 702d387ce..718845a2b 100644
--- a/src/components/resource-policy/policy-access-rule-validation.ts
+++ b/src/components/resource-policy/policy-access-rule-validation.ts
@@ -79,6 +79,7 @@ export function createPolicyRuleValueSchema(t: TranslateFn, match: string) {
                 message: t("rulesErrorInvalidRegionDescription")
             });
         case "COUNTRY":
+        case "COUNTRY_IS_NOT":
             return required.refine(
                 (value) => COUNTRIES.some((country) => country.code === value),
                 { message: t("rulesErrorInvalidCountryDescription") }