pangea-aws 0.1.0

data/lib/pangea/resources/aws_wafv2_rule_group/resource/actions.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module WafV2RuleGroupDSL
+        module Actions
+          def build_action(rule_attrs)
+            action do
+              if rule_attrs[:action][:allow]
+                build_allow_action(rule_attrs[:action][:allow])
+              elsif rule_attrs[:action][:block]
+                build_block_action(rule_attrs[:action][:block])
+              elsif rule_attrs[:action][:count]
+                build_count_action(rule_attrs[:action][:count])
+              elsif rule_attrs[:action][:captcha]
+                build_captcha_action(rule_attrs[:action][:captcha])
+              elsif rule_attrs[:action][:challenge]
+                build_challenge_action(rule_attrs[:action][:challenge])
+              end
+            end
+          end
+
+          def build_allow_action(allow_config)
+            allow do
+              build_custom_request_handling(allow_config[:custom_request_handling]) if allow_config[:custom_request_handling]
+            end
+          end
+
+          def build_block_action(block_config)
+            block do
+              build_custom_response(block_config[:custom_response]) if block_config[:custom_response]
+            end
+          end
+
+          def build_count_action(count_config)
+            count do
+              build_custom_request_handling(count_config[:custom_request_handling]) if count_config[:custom_request_handling]
+            end
+          end
+
+          def build_captcha_action(captcha_config)
+            captcha do
+              build_custom_request_handling(captcha_config[:custom_request_handling]) if captcha_config[:custom_request_handling]
+            end
+          end
+
+          def build_challenge_action(challenge_config)
+            challenge do
+              build_custom_request_handling(challenge_config[:custom_request_handling]) if challenge_config[:custom_request_handling]
+            end
+          end
+
+          def build_custom_request_handling(config)
+            custom_request_handling do
+              config[:insert_headers].each do |header|
+                insert_header do
+                  name header[:name]
+                  value header[:value]
+                end
+              end
+            end
+          end
+
+          def build_custom_response(config)
+            custom_response do
+              response_code config[:response_code]
+              custom_response_body_key config[:custom_response_body_key] if config[:custom_response_body_key]
+              config[:response_headers]&.each do |header|
+                response_header do
+                  name header[:name]
+                  value header[:value]
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_wafv2_rule_group/resource/dsl_builder.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require_relative 'actions'
+require_relative 'statements'
+require_relative 'field_to_match'
+
+module Pangea
+  module Resources
+    module AWS
+      module WafV2RuleGroupDSL
+        class DSLBuilder
+          include Actions
+          include Statements
+          include FieldToMatch
+
+          attr_reader :attrs, :dsl
+
+          def initialize(rule_group_attrs, dsl_context)
+            @attrs = rule_group_attrs
+            @dsl = dsl_context
+          end
+
+          def build
+            build_basic_config
+            build_rules
+            build_visibility_config
+            build_custom_response_bodies
+            build_tags
+          end
+
+          private
+
+          def build_basic_config
+            dsl.name attrs.name
+            dsl.scope attrs.scope.downcase
+            dsl.capacity attrs.capacity
+            dsl.description attrs.description if attrs.description
+          end
+
+          def build_rules
+            attrs.rules.each { |rule_attrs| build_rule(rule_attrs) }
+          end
+
+          def build_rule(rule_attrs)
+            dsl.rule do
+              name rule_attrs[:name]
+              priority rule_attrs[:priority]
+              instance_exec(rule_attrs, &method(:build_action))
+              statement { instance_exec(rule_attrs[:statement], &method(:build_statement)) }
+              build_visibility_config_block(rule_attrs[:visibility_config])
+              build_rule_labels(rule_attrs[:rule_labels])
+              build_captcha_config(rule_attrs[:captcha_config])
+              build_challenge_config(rule_attrs[:challenge_config])
+            end
+          end
+
+          def build_visibility_config_block(config)
+            visibility_config do
+              cloudwatch_metrics_enabled config[:cloudwatch_metrics_enabled]
+              metric_name config[:metric_name]
+              sampled_requests_enabled config[:sampled_requests_enabled]
+            end
+          end
+
+          def build_rule_labels(labels)
+            labels&.each { |label| rule_label { name label[:name] } }
+          end
+
+          def build_captcha_config(config)
+            return unless config
+            captcha_config { immunity_time_property { immunity_time config[:immunity_time_property][:immunity_time] } }
+          end
+
+          def build_challenge_config(config)
+            return unless config
+            challenge_config { immunity_time_property { immunity_time config[:immunity_time_property][:immunity_time] } }
+          end
+
+          def build_visibility_config
+            dsl.visibility_config do
+              cloudwatch_metrics_enabled attrs.visibility_config[:cloudwatch_metrics_enabled]
+              metric_name attrs.visibility_config[:metric_name]
+              sampled_requests_enabled attrs.visibility_config[:sampled_requests_enabled]
+            end
+          end
+
+          def build_custom_response_bodies
+            attrs.custom_response_bodies.each do |key, body|
+              dsl.custom_response_body do
+                self.key key.to_s
+                content body[:content]
+                content_type body[:content_type]
+              end
+            end
+          end
+
+          def build_tags
+            return unless attrs.tags.any?
+            dsl.tags { attrs.tags.each { |k, v| public_send(k, v) } }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_wafv2_rule_group/resource/field_to_match.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module WafV2RuleGroupDSL
+        module FieldToMatch
+          def build_field_to_match(config)
+            return unless config
+            if config[:all_query_arguments] then all_query_arguments
+            elsif config[:body] then build_body_field(config[:body])
+            elsif config[:method] then method
+            elsif config[:query_string] then query_string
+            elsif config[:single_header] then single_header { name config[:single_header][:name] }
+            elsif config[:single_query_argument] then single_query_argument { name config[:single_query_argument][:name] }
+            elsif config[:uri_path] then uri_path
+            elsif config[:json_body] then build_json_body_field(config[:json_body])
+            end
+          end
+
+          def build_body_field(config)
+            body { oversize_handling config[:oversize_handling] if config[:oversize_handling] }
+          end
+
+          def build_json_body_field(config)
+            json_body do
+              match_scope config[:match_scope]
+              match_pattern do
+                if config[:match_pattern][:all]
+                  all
+                elsif config[:match_pattern][:included_paths]
+                  config[:match_pattern][:included_paths].each { |path| included_paths path }
+                end
+              end
+              invalid_fallback_behavior config[:invalid_fallback_behavior] if config[:invalid_fallback_behavior]
+              oversize_handling config[:oversize_handling] if config[:oversize_handling]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_wafv2_rule_group/resource/statements.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module WafV2RuleGroupDSL
+        module Statements
+          def build_statement(stmt)
+            return unless stmt
+            if stmt[:byte_match_statement] then build_byte_match(stmt[:byte_match_statement])
+            elsif stmt[:sqli_match_statement] then build_sqli_match(stmt[:sqli_match_statement])
+            elsif stmt[:xss_match_statement] then build_xss_match(stmt[:xss_match_statement])
+            elsif stmt[:size_constraint_statement] then build_size_constraint(stmt[:size_constraint_statement])
+            elsif stmt[:geo_match_statement] then build_geo_match(stmt[:geo_match_statement])
+            elsif stmt[:ip_set_reference_statement] then build_ip_set_reference(stmt[:ip_set_reference_statement])
+            elsif stmt[:regex_pattern_set_reference_statement] then build_regex_pattern_set(stmt[:regex_pattern_set_reference_statement])
+            elsif stmt[:rate_based_statement] then build_rate_based(stmt[:rate_based_statement])
+            elsif stmt[:and_statement] then build_and_statement(stmt[:and_statement])
+            elsif stmt[:or_statement] then build_or_statement(stmt[:or_statement])
+            elsif stmt[:not_statement] then build_not_statement(stmt[:not_statement])
+            elsif stmt[:label_match_statement] then build_label_match(stmt[:label_match_statement])
+            end
+          end
+
+          def build_byte_match(config)
+            byte_match_statement do
+              positional_constraint config[:positional_constraint]
+              search_string config[:search_string]
+              field_to_match { build_field_to_match(config[:field_to_match]) }
+              build_text_transformations(config[:text_transformations])
+            end
+          end
+
+          def build_sqli_match(config)
+            sqli_match_statement do
+              field_to_match { build_field_to_match(config[:field_to_match]) }
+              build_text_transformations(config[:text_transformations])
+            end
+          end
+
+          def build_xss_match(config)
+            xss_match_statement do
+              field_to_match { build_field_to_match(config[:field_to_match]) }
+              build_text_transformations(config[:text_transformations])
+            end
+          end
+
+          def build_size_constraint(config)
+            size_constraint_statement do
+              comparison_operator config[:comparison_operator]
+              size config[:size]
+              field_to_match { build_field_to_match(config[:field_to_match]) }
+              build_text_transformations(config[:text_transformations])
+            end
+          end
+
+          def build_geo_match(config)
+            geo_match_statement do
+              country_codes config[:country_codes]
+              if config[:forwarded_ip_config]
+                forwarded_ip_config do
+                  header_name config[:forwarded_ip_config][:header_name]
+                  fallback_behavior config[:forwarded_ip_config][:fallback_behavior]
+                end
+              end
+            end
+          end
+
+          def build_ip_set_reference(config)
+            ip_set_reference_statement do
+              arn config[:arn]
+              if config[:ip_set_forwarded_ip_config]
+                ip_set_forwarded_ip_config do
+                  header_name config[:ip_set_forwarded_ip_config][:header_name]
+                  fallback_behavior config[:ip_set_forwarded_ip_config][:fallback_behavior]
+                  position config[:ip_set_forwarded_ip_config][:position]
+                end
+              end
+            end
+          end
+
+          def build_regex_pattern_set(config)
+            regex_pattern_set_reference_statement do
+              arn config[:arn]
+              field_to_match { build_field_to_match(config[:field_to_match]) }
+              build_text_transformations(config[:text_transformations])
+            end
+          end
+
+          def build_rate_based(config)
+            rate_based_statement do
+              limit config[:limit]
+              aggregate_key_type config[:aggregate_key_type]
+              if config[:forwarded_ip_config]
+                forwarded_ip_config do
+                  header_name config[:forwarded_ip_config][:header_name]
+                  fallback_behavior config[:forwarded_ip_config][:fallback_behavior]
+                end
+              end
+              scope_down_statement { build_statement(config[:scope_down_statement]) } if config[:scope_down_statement]
+            end
+          end
+
+          def build_and_statement(config)
+            and_statement { config[:statements].each { |s| statement { build_statement(s) } } }
+          end
+
+          def build_or_statement(config)
+            or_statement { config[:statements].each { |s| statement { build_statement(s) } } }
+          end
+
+          def build_not_statement(config)
+            not_statement { statement { build_statement(config[:statement]) } }
+          end
+
+          def build_label_match(config)
+            label_match_statement do
+              scope config[:scope]
+              key config[:key]
+            end
+          end
+
+          def build_text_transformations(transforms)
+            transforms.each do |transform|
+              text_transformation do
+                priority transform[:priority]
+                type transform[:type]
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_wafv2_rule_group/resource.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_wafv2_rule_group/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      def aws_wafv2_rule_group(name, attributes = {})
+        rule_group_attrs = Types::WafV2RuleGroupAttributes.new(attributes)
+
+        resource(:aws_wafv2_rule_group, name) do
+          name rule_group_attrs.name
+          scope rule_group_attrs.scope.downcase
+          capacity rule_group_attrs.capacity
+          description rule_group_attrs.description if rule_group_attrs.description
+
+          rule_group_attrs.rules.each do |rule_attrs|
+            rule do
+              name rule_attrs[:name]
+              priority rule_attrs[:priority]
+              action { generate_rule_group_action(rule_attrs[:action]) }
+              statement { generate_rule_group_statement_block(rule_attrs[:statement]) }
+              visibility_config do
+                cloudwatch_metrics_enabled rule_attrs[:visibility_config][:cloudwatch_metrics_enabled]
+                metric_name rule_attrs[:visibility_config][:metric_name]
+                sampled_requests_enabled rule_attrs[:visibility_config][:sampled_requests_enabled]
+              end
+              rule_attrs[:rule_labels]&.each { |label| rule_label { name label[:name] } }
+              captcha_config { immunity_time_property { immunity_time rule_attrs[:captcha_config][:immunity_time_property][:immunity_time] } } if rule_attrs[:captcha_config]
+              challenge_config { immunity_time_property { immunity_time rule_attrs[:challenge_config][:immunity_time_property][:immunity_time] } } if rule_attrs[:challenge_config]
+            end
+          end
+
+          visibility_config do
+            cloudwatch_metrics_enabled rule_group_attrs.visibility_config&.dig(:cloudwatch_metrics_enabled)
+            metric_name rule_group_attrs.visibility_config&.dig(:metric_name)
+            sampled_requests_enabled rule_group_attrs.visibility_config&.dig(:sampled_requests_enabled)
+          end
+
+          rule_group_attrs.custom_response_bodies&.each do |key, body|
+            custom_response_body { self.key key.to_s; content body[:content]; content_type body[:content_type] }
+          end
+
+          tags { rule_group_attrs.tags.each { |k, v| public_send(k, v) } } if rule_group_attrs.tags&.any?
+        end
+
+        ResourceReference.new(
+          type: 'aws_wafv2_rule_group', name: name, resource_attributes: rule_group_attrs.to_h,
+          outputs: { id: "${aws_wafv2_rule_group.#{name}.id}", arn: "${aws_wafv2_rule_group.#{name}.arn}",
+                     capacity: "${aws_wafv2_rule_group.#{name}.capacity}", lock_token: "${aws_wafv2_rule_group.#{name}.lock_token}" },
+          computed: { total_rule_count: rule_group_attrs.total_rule_count, has_rate_limiting: rule_group_attrs.has_rate_limiting?,
+                      has_geo_blocking: rule_group_attrs.has_geo_blocking?, has_string_matching: rule_group_attrs.has_string_matching?,
+                      has_size_constraints: rule_group_attrs.has_size_constraints?, uses_custom_responses: rule_group_attrs.uses_custom_responses?,
+                      rule_priorities: rule_group_attrs.rule_priorities, cloudfront_compatible: rule_group_attrs.cloudfront_compatible?,
+                      scope: rule_group_attrs.scope, capacity: rule_group_attrs.capacity }
+        )
+      end
+
+      private
+
+      def generate_rule_group_action(action_config)
+        if action_config[:allow]
+          allow { build_custom_request_handling(action_config[:allow][:custom_request_handling]) if action_config[:allow][:custom_request_handling] }
+        elsif action_config[:block]
+          block { build_custom_response(action_config[:block][:custom_response]) if action_config[:block][:custom_response] }
+        elsif action_config[:count]
+          count { build_custom_request_handling(action_config[:count][:custom_request_handling]) if action_config[:count][:custom_request_handling] }
+        elsif action_config[:captcha]
+          captcha { build_custom_request_handling(action_config[:captcha][:custom_request_handling]) if action_config[:captcha][:custom_request_handling] }
+        elsif action_config[:challenge]
+          challenge { build_custom_request_handling(action_config[:challenge][:custom_request_handling]) if action_config[:challenge][:custom_request_handling] }
+        end
+      end
+
+      def build_custom_request_handling(config)
+        return unless config
+        custom_request_handling { config[:insert_headers].each { |h| insert_header { name h[:name]; value h[:value] } } }
+      end
+
+      def build_custom_response(config)
+        return unless config
+        custom_response do
+          response_code config[:response_code]
+          custom_response_body_key config[:custom_response_body_key] if config[:custom_response_body_key]
+          config[:response_headers]&.each { |h| response_header { name h[:name]; value h[:value] } }
+        end
+      end
+
+      def generate_rule_group_statement_block(stmt)
+        return unless stmt
+        if stmt[:byte_match_statement] then byte_match_statement { build_byte_match(stmt[:byte_match_statement]) }
+        elsif stmt[:sqli_match_statement] then sqli_match_statement { build_match_with_transforms(stmt[:sqli_match_statement]) }
+        elsif stmt[:xss_match_statement] then xss_match_statement { build_match_with_transforms(stmt[:xss_match_statement]) }
+        elsif stmt[:size_constraint_statement] then size_constraint_statement { build_size_constraint(stmt[:size_constraint_statement]) }
+        elsif stmt[:geo_match_statement] then geo_match_statement { build_geo_match(stmt[:geo_match_statement]) }
+        elsif stmt[:ip_set_reference_statement] then ip_set_reference_statement { build_ip_set_ref(stmt[:ip_set_reference_statement]) }
+        elsif stmt[:regex_pattern_set_reference_statement] then regex_pattern_set_reference_statement { build_regex_ref(stmt[:regex_pattern_set_reference_statement]) }
+        elsif stmt[:rate_based_statement] then rate_based_statement { build_rate_based(stmt[:rate_based_statement]) }
+        elsif stmt[:and_statement] then and_statement { stmt[:and_statement][:statements].each { |s| statement { generate_rule_group_statement_block(s) } } }
+        elsif stmt[:or_statement] then or_statement { stmt[:or_statement][:statements].each { |s| statement { generate_rule_group_statement_block(s) } } }
+        elsif stmt[:not_statement] then not_statement { statement { generate_rule_group_statement_block(stmt[:not_statement][:statement]) } }
+        elsif stmt[:label_match_statement] then label_match_statement { scope stmt[:label_match_statement][:scope]; key stmt[:label_match_statement][:key] }
+        end
+      end
+
+      def build_byte_match(c)
+        positional_constraint c[:positional_constraint]; search_string c[:search_string]
+        field_to_match { generate_rule_group_field_to_match_block(c[:field_to_match]) }
+        c[:text_transformations].each { |t| text_transformation { priority t[:priority]; type t[:type] } }
+      end
+
+      def build_match_with_transforms(c)
+        field_to_match { generate_rule_group_field_to_match_block(c[:field_to_match]) }
+        c[:text_transformations].each { |t| text_transformation { priority t[:priority]; type t[:type] } }
+      end
+
+      def build_size_constraint(c)
+        comparison_operator c[:comparison_operator]; size c[:size]
+        field_to_match { generate_rule_group_field_to_match_block(c[:field_to_match]) }
+        c[:text_transformations].each { |t| text_transformation { priority t[:priority]; type t[:type] } }
+      end
+
+      def build_geo_match(c)
+        country_codes c[:country_codes]
+        forwarded_ip_config { header_name c[:forwarded_ip_config][:header_name]; fallback_behavior c[:forwarded_ip_config][:fallback_behavior] } if c[:forwarded_ip_config]
+      end
+
+      def build_ip_set_ref(c)
+        arn c[:arn]
+        if c[:ip_set_forwarded_ip_config]
+          ip_set_forwarded_ip_config { header_name c[:ip_set_forwarded_ip_config][:header_name]; fallback_behavior c[:ip_set_forwarded_ip_config][:fallback_behavior]; position c[:ip_set_forwarded_ip_config][:position] }
+        end
+      end
+
+      def build_regex_ref(c)
+        arn c[:arn]
+        field_to_match { generate_rule_group_field_to_match_block(c[:field_to_match]) }
+        c[:text_transformations].each { |t| text_transformation { priority t[:priority]; type t[:type] } }
+      end
+
+      def build_rate_based(c)
+        limit c[:limit]; aggregate_key_type c[:aggregate_key_type]
+        forwarded_ip_config { header_name c[:forwarded_ip_config][:header_name]; fallback_behavior c[:forwarded_ip_config][:fallback_behavior] } if c[:forwarded_ip_config]
+        scope_down_statement { generate_rule_group_statement_block(c[:scope_down_statement]) } if c[:scope_down_statement]
+      end
+
+      def generate_rule_group_field_to_match_block(f)
+        return unless f
+        if f[:all_query_arguments] then all_query_arguments
+        elsif f[:body] then body { oversize_handling f[:body][:oversize_handling] if f[:body][:oversize_handling] }
+        elsif f[:method] then method
+        elsif f[:query_string] then query_string
+        elsif f[:single_header] then single_header { name f[:single_header][:name] }
+        elsif f[:single_query_argument] then single_query_argument { name f[:single_query_argument][:name] }
+        elsif f[:uri_path] then uri_path
+        elsif f[:json_body] then json_body { build_json_body(f[:json_body]) }
+        end
+      end
+
+      def build_json_body(c)
+        match_scope c[:match_scope]
+        match_pattern { c[:match_pattern][:all] ? all : c[:match_pattern][:included_paths]&.each { |p| included_paths p } }
+        invalid_fallback_behavior c[:invalid_fallback_behavior] if c[:invalid_fallback_behavior]
+        oversize_handling c[:oversize_handling] if c[:oversize_handling]
+      end
+    end
+  end
+end
+

data/lib/pangea/resources/aws_wafv2_rule_group/types/actions.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-types'
+require_relative 'schemas'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # WAF v2 rule action type definitions
+
+        module WafV2Actions
+          include Dry.Types()
+
+          # Allow action with optional custom request handling
+          AllowActionSchema = Resources::Types::Hash.schema(
+            custom_request_handling?: WafV2Schemas::CustomRequestHandlingSchema
+          ).lax.optional
+
+          # Block action with optional custom response
+          BlockActionSchema = Resources::Types::Hash.schema(
+            custom_response?: WafV2Schemas::CustomResponseSchema
+          ).lax.optional
+
+          # Count action with optional custom request handling
+          CountActionSchema = Resources::Types::Hash.schema(
+            custom_request_handling?: WafV2Schemas::CustomRequestHandlingSchema
+          ).lax.optional
+
+          # Captcha action with optional custom request handling
+          CaptchaActionSchema = Resources::Types::Hash.schema(
+            custom_request_handling?: WafV2Schemas::CustomRequestHandlingSchema
+          ).lax.optional
+
+          # Challenge action with optional custom request handling
+          ChallengeActionSchema = Resources::Types::Hash.schema(
+            custom_request_handling?: WafV2Schemas::CustomRequestHandlingSchema
+          ).lax.optional
+
+          # Combined action schema with validation
+          ACTION_TYPES = %i[allow block count captcha challenge].freeze
+
+          ActionSchema = Resources::Types::Hash.schema(
+            allow?: AllowActionSchema,
+            block?: BlockActionSchema,
+            count?: CountActionSchema,
+            captcha?: CaptchaActionSchema,
+            challenge?: ChallengeActionSchema
+          ).constructor do |attrs|
+            provided_actions = ACTION_TYPES.select { |type| attrs.key?(type) }
+
+            if provided_actions.empty?
+              raise Dry::Types::ConstraintError, 'Rule action must specify exactly one action type'
+            elsif provided_actions.size > 1
+              raise Dry::Types::ConstraintError,
+                    "Rule action must specify exactly one action type, got: #{provided_actions.join(', ')}"
+            end
+
+            attrs
+          end
+        end
+      end
+    end
+  end
+end