Baffle-WAF/baffle-hub
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add a rules controller

Browse Source
This commit is contained in:
Dan Milne
2025-11-04 09:47:11 +11:00
parent 5ff166613e
commit c72d83acda
14 changed files with 272 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/rule-architecture.md
View File

@@ -200,7 +200,7 @@ GET /api/:public_key/rules/version
Response:
{
"version": "2024-11-03T12:30:45.123Z",
"version": 1730646645123000,
"count": 150,
"sampling": {
"allowed_requests": 0.5,
@@ -211,14 +211,16 @@ Response:
}
```
**Timestamp Format**: The `version` field uses **microsecond Unix timestamp** (e.g., `1730646645123000`) for efficient machine comparison. For backward compatibility, the API also accepts ISO8601 timestamps in the `since` parameter.
#### 2. Incremental Sync
```http
GET /api/:public_key/rules?since=2024-11-03T12:00:00.000Z
GET /api/:public_key/rules?since=1730646000000000
Response:
{
"version": "2024-11-03T12:30:45.123Z",
"version": 1730646645123000,
"sampling": { ... },
"rules": [
{
@@ -257,7 +259,7 @@ GET /api/:public_key/rules
Response:
{
"version": "2024-11-03T12:30:45.123Z",
"version": 1730646645123000,
"sampling": { ... },
"rules": [ ...all enabled rules... ]
}

48
docs/rule-system-implementation-summary.md
View File

@@ -92,7 +92,7 @@ GET /api/:public_key/rules/version
Response:
{
"version": "2025-11-03T08:14:23.648330Z",
"version": 1730646863648330,
"count": 150,
"sampling": {
"allowed_requests": 1.0,
@@ -108,11 +108,11 @@ Response:
#### Incremental Sync
```http
GET /api/:public_key/rules?since=2025-11-03T08:00:00.000Z
GET /api/:public_key/rules?since=1730646000000000
Response:
{
"version": "2025-11-03T08:14:23.648330Z",
"version": 1730646863648330,
"sampling": { ... },
"rules": [
{
@@ -230,7 +230,7 @@ curl http://localhost:3000/api/YOUR_PUBLIC_KEY/rules/version | jq
curl http://localhost:3000/api/YOUR_PUBLIC_KEY/rules | jq
# Test incremental sync
curl "http://localhost:3000/api/YOUR_PUBLIC_KEY/rules?since=2025-11-03T08:00:00.000Z" | jq
curl "http://localhost:3000/api/YOUR_PUBLIC_KEY/rules?since=1730646000000000" | jq
```
### Run Background Jobs
@@ -248,9 +248,47 @@ bin/rails runner 'puts HubLoad.stats.inspect'
## Agent Integration (Next Steps)
### Event Response Optimization (New!)
**Major Optimization**: The Hub now includes the latest rule version in event responses, eliminating the need for separate version checks!
```http
POST /api/{project_slug}/events
Authorization: Bearer {public_key}
Response:
{
"success": true,
"rule_version": 1730646863648330,
"sampling": {
"allowed_requests": 1.0,
"blocked_requests": 1.0,
"rate_limited_requests": 1.0,
"effective_until": "2025-11-03T13:44:23.475Z",
"load_level": "normal",
"queue_depth": 0
}
}
Headers:
X-Rule-Version: 1730646863648330
X-Sample-Rate: 1.0
```
**Benefits:**
- Zero extra HTTP requests for rule version checking
- Immediate rule change detection on next event post
- Always current sampling rates
The Agent needs to:
1. **Poll for updates** every 10 seconds or 1000 events:
1. **Check rule version in event responses**:
```python
if event_response.json()["rule_version"] != agent.last_rule_version:
agent.sync_rules()
```
2. **Poll for updates** only when rule version changes or every 10 seconds/1000 events:
```ruby
GET /api/:public_key/rules?since=<last_updated_at>
```