🚧 add country is not rule

messages/en-US.json

@@ -2431,6 +2431,7 @@
     "noRemoteExitNodesAvailableDescription": "No nodes are available for this organization. Create a node first to use local sites.",
     "exitNode": "Exit Node",
     "country": "Country",
+    "countryIsNot": "Country Is Not",
     "rulesMatchCountry": "Currently based on source IP",
     "region": "Region",
     "selectRegion": "Select region",

server/db/pg/schema/schema.ts

@@ -981,7 +981,15 @@ export const resourcePolicyRules = pgTable("resourcePolicyRules", {
     priority: integer("priority").notNull(),
     action: varchar("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
     match: varchar("match")
-        .$type<"CIDR" | "PATH" | "IP" | "COUNTRY" | "ASN" | "REGION">()
+        .$type<
+            | "CIDR"
+            | "PATH"
+            | "IP"
+            | "COUNTRY"
+            | "COUNTRY_IS_NOT"
+            | "ASN"
+            | "REGION"
+        >()
         .notNull(),
     value: varchar("value").notNull()
 });
@@ -1553,3 +1561,4 @@ export type Label = InferSelectModel<typeof labels>;
 export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
 export type RolePolicy = InferSelectModel<typeof rolePolicies>;
 export type UserPolicy = InferSelectModel<typeof userPolicies>;
+export type ResourcePolicyRule = InferSelectModel<typeof resourcePolicyRules>;

server/db/sqlite/schema/schema.ts

@@ -1252,7 +1252,15 @@ export const resourcePolicyRules = sqliteTable("resourcePolicyRules", {
     priority: integer("priority").notNull(),
     action: text("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
     match: text("match")
-        .$type<"CIDR" | "PATH" | "IP" | "COUNTRY" | "ASN" | "REGION">()
+        .$type<
+            | "CIDR"
+            | "PATH"
+            | "IP"
+            | "COUNTRY"
+            | "COUNTRY_IS_NOT"
+            | "ASN"
+            | "REGION"
+        >()
         .notNull(),
     value: text("value").notNull()
 });

server/lib/blueprints/publicResources.ts

@@ -1321,7 +1321,7 @@ function getRuleAction(input: string) {
 
 function getRuleValue(match: string, value: string) {
     // if the match is a country, uppercase the value
-    if (match == "COUNTRY") {
+    if (match === "COUNTRY" || match === "COUNTRY_IS_NOT") {
         return value.toUpperCase();
     }
     return value;

server/lib/blueprints/resourcePolicies.ts

@@ -347,12 +347,13 @@ function getRuleAction(input: string): "ACCEPT" | "DROP" | "PASS" {
 
 function getRuleMatch(
     input: string
-): "CIDR" | "IP" | "PATH" | "COUNTRY" | "ASN" | "REGION" {
+): "CIDR" | "IP" | "PATH" | "COUNTRY" | "COUNTRY_IS_NOT" | "ASN" | "REGION" {
     return input.toUpperCase() as
         | "CIDR"
         | "IP"
         | "PATH"
         | "COUNTRY"
+        | "COUNTRY_IS_NOT"
         | "ASN"
         | "REGION";
 }

server/lib/validators.ts

@@ -74,6 +74,7 @@ export const RESOURCE_RULE_MATCH_TYPES = [
     "IP",
     "PATH",
     "COUNTRY",
+    "COUNTRY_IS_NOT",
     "ASN",
     "REGION"
 ] as const;
@@ -96,6 +97,7 @@ export function getResourceRuleValueValidationError(
         case "REGION":
             return isValidRegionId(value) ? null : "Invalid region ID provided";
         case "COUNTRY":
+        case "COUNTRY_IS_NOT":
             return COUNTRIES.some((country) => country.code === value)
                 ? null
                 : "Invalid country code provided";

src/components/resource-policy/PolicyAccessRulesTable.tsx

@@ -229,6 +229,7 @@ export function PolicyAccessRulesTable({
             IP: "IP",
             CIDR: t("ipAddressRange"),
             COUNTRY: t("country"),
+            COUNTRY_IS_NOT: t("countryIsNot"),
             ASN: "ASN",
             REGION: t("region")
         }),
@@ -441,13 +442,15 @@ export function PolicyAccessRulesTable({
                                 | "IP"
                                 | "PATH"
                                 | "COUNTRY"
+                                | "COUNTRY_IS_NOT"
                                 | "ASN"
                                 | "REGION"
                         ) =>
                             updateRule(row.original.ruleId, {
                                 match: value,
                                 value:
-                                    value === "COUNTRY"
+                                    value === "COUNTRY" ||
+                                    value === "COUNTRY_IS_NOT"
                                         ? "US"
                                         : value === "ASN"
                                           ? "AS15169"
@@ -469,9 +472,14 @@ export function PolicyAccessRulesTable({
                                 {RuleMatch.CIDR}
                             </SelectItem>
                             {isMaxmindAvailable && (
-                                <SelectItem value="COUNTRY">
-                                    {RuleMatch.COUNTRY}
-                                </SelectItem>
+                                <>
+                                    <SelectItem value="COUNTRY">
+                                        {RuleMatch.COUNTRY}
+                                    </SelectItem>
+                                    <SelectItem value="COUNTRY_IS_NOT">
+                                        {RuleMatch.COUNTRY_IS_NOT}
+                                    </SelectItem>
+                                </>
                             )}
                             {includeRegionMatch && isMaxmindAvailable && (
                                 <SelectItem value="REGION">
@@ -491,7 +499,8 @@ export function PolicyAccessRulesTable({
                 accessorKey: "value",
                 header: () => <span className="p-3">{t("value")}</span>,
                 cell: ({ row }) =>
-                    row.original.match === "COUNTRY" ? (
+                    row.original.match === "COUNTRY" ||
+                    row.original.match === "COUNTRY_IS_NOT" ? (
                         <Popover>
                             <PopoverTrigger asChild>
                                 <Button

src/components/resource-policy/policy-access-rule-validation.ts

@@ -17,6 +17,7 @@ export const POLICY_RULE_MATCH_TYPES = [
     "IP",
     "PATH",
     "COUNTRY",
+    "COUNTRY_IS_NOT",
     "ASN",
     "REGION"
 ] as const;