calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-06-26 17:19:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use the policy when updating rule

Browse Source 
Fixes #3273
This commit is contained in:
Owen
2026-06-23 11:25:09 -04:00
parent 19faa3a29c
commit 8004ae6870
1 changed files with 124 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

157
server/routers/resource/updateResourceRule.ts
View File

@@ -1,8 +1,8 @@
import { Request, Response, NextFunction } from "express";
import { z } from "zod";
import { db } from "@server/db";
import { resourceRules, resources } from "@server/db";
import { eq } from "drizzle-orm";
import { resourcePolicyRules, resourceRules, resources } from "@server/db";
import { and, eq } from "drizzle-orm";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
import createHttpError from "http-errors";
@@ -22,13 +22,20 @@ const updateResourceRuleParamsSchema = z.strictObject({
resourceId: z.coerce.number().int().positive()
});
const resourceRuleMatchSchema = z.enum([
"CIDR",
"IP",
"PATH",
"COUNTRY",
"ASN",
"REGION"
]);
// Define Zod schema for request body validation
const updateResourceRuleSchema = z
.strictObject({
action: z.enum(["ACCEPT", "DROP", "PASS"]).optional(),
match: z
.enum(["CIDR", "IP", "PATH", "COUNTRY", "ASN", "REGION"])
.optional(),
match: resourceRuleMatchSchema.optional(),
value: z.string().min(1).optional(),
priority: z.int(),
enabled: z.boolean().optional()
@@ -123,37 +130,102 @@ export async function updateResourceRule(
return next(
createHttpError(
HttpCode.BAD_REQUEST,
"Cannot create rule for non-http resource"
"Cannot update rule for non-http resource"
)
);
}
// Verify that the rule exists and belongs to the specified resource
const [existingRule] = await db
.select()
.from(resourceRules)
.where(eq(resourceRules.ruleId, ruleId))
.limit(1);
const isInlinePolicy =
resource.resourcePolicyId === null &&
resource.defaultResourcePolicyId !== null;
if (!existingRule) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource rule with ID ${ruleId} not found`
)
let existingMatch:
| "CIDR"
| "IP"
| "PATH"
| "COUNTRY"
| "ASN"
| "REGION";
if (isInlinePolicy) {
const policyId = resource.defaultResourcePolicyId!;
const [existingRule] = await db
.select()
.from(resourcePolicyRules)
.where(eq(resourcePolicyRules.ruleId, ruleId))
.limit(1);
if (!existingRule) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource rule with ID ${ruleId} not found`
)
);
}
if (existingRule.resourcePolicyId !== policyId) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
`Resource rule ${ruleId} does not belong to resource ${resourceId}`
)
);
}
const parsedExistingMatch = resourceRuleMatchSchema.safeParse(
existingRule.match
);
if (!parsedExistingMatch.success) {
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
"Resource rule has invalid match type"
)
);
}
existingMatch = parsedExistingMatch.data;
} else {
// Verify that the rule exists and belongs to the specified resource
const [existingRule] = await db
.select()
.from(resourceRules)
.where(eq(resourceRules.ruleId, ruleId))
.limit(1);
if (!existingRule) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`Resource rule with ID ${ruleId} not found`
)
);
}
if (existingRule.resourceId !== resourceId) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
`Resource rule ${ruleId} does not belong to resource ${resourceId}`
)
);
}
const parsedExistingMatch = resourceRuleMatchSchema.safeParse(
existingRule.match
);
if (!parsedExistingMatch.success) {
return next(
createHttpError(
HttpCode.INTERNAL_SERVER_ERROR,
"Resource rule has invalid match type"
)
);
}
existingMatch = parsedExistingMatch.data;
}
if (existingRule.resourceId !== resourceId) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
`Resource rule ${ruleId} does not belong to resource ${resourceId}`
)
);
}
const match = updateData.match || existingRule.match;
const match = updateData.match || existingMatch;
const { value } = updateData;
if (value !== undefined) {
@@ -197,11 +269,30 @@ export async function updateResourceRule(
}
// Update the rule
const [updatedRule] = await db
.update(resourceRules)
.set(updateData)
.where(eq(resourceRules.ruleId, ruleId))
.returning();
const [updatedRule] = isInlinePolicy
? await db
.update(resourcePolicyRules)
.set(updateData)
.where(
and(
eq(resourcePolicyRules.ruleId, ruleId),
eq(
resourcePolicyRules.resourcePolicyId,
resource.defaultResourcePolicyId!
)
)
)
.returning()
: await db
.update(resourceRules)
.set(updateData)
.where(
and(
eq(resourceRules.ruleId, ruleId),
eq(resourceRules.resourceId, resourceId)
)
)
.returning();
return response(res, {
data: updatedRule,