@gfargo/doorman 3.15.1 → 3.15.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin/run.js +46 -46
- package/dist/bin/run.mjs +46 -46
- package/package.json +1 -1
- package/skills/doorman/references/cloudflare.md +21 -19
package/package.json
CHANGED
|
@@ -60,24 +60,26 @@ Doorman translates its unified rule format (`conditions`/`enabled`/`action: {typ
|
|
|
60
60
|
|
|
61
61
|
Cloudflare supports all 16 unified condition fields:
|
|
62
62
|
|
|
63
|
-
| Doorman Field | Cloudflare Field
|
|
64
|
-
| -------------- |
|
|
65
|
-
| `ip` | `ip.src`
|
|
66
|
-
| `country` | `ip.geoip.country`
|
|
67
|
-
| `region` | `ip.geoip.subdivision_1`
|
|
68
|
-
| `city` | `ip.geoip.city`
|
|
69
|
-
| `asn` | `ip.geoip.asnum`
|
|
70
|
-
| `path` | `http.request.uri.path`
|
|
71
|
-
| `host` | `http.host`
|
|
72
|
-
| `method` | `http.request.method`
|
|
73
|
-
| `header` | `http.request.headers["key"]` | Requires `key` (the header name)
|
|
74
|
-
| `query` | `http.request.uri.query
|
|
75
|
-
| `cookie` | `http.cookie["key"]`
|
|
76
|
-
| `user_agent` | `http.user_agent`
|
|
77
|
-
| `referer` | `http.referer`
|
|
78
|
-
| `scheme` | `ssl` (boolean)
|
|
79
|
-
| `port` | `cf.edge.server_port`
|
|
80
|
-
| `threat_score` | `cf.threat_score`
|
|
63
|
+
| Doorman Field | Cloudflare Field | Notes |
|
|
64
|
+
| -------------- | --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
|
|
65
|
+
| `ip` | `ip.src` | |
|
|
66
|
+
| `country` | `ip.geoip.country` | |
|
|
67
|
+
| `region` | `ip.geoip.subdivision_1` | Client geo subdivision (e.g. `"CA"`) — see the legacy-field note below for how this differs from Vercel's own `region` |
|
|
68
|
+
| `city` | `ip.geoip.city` | |
|
|
69
|
+
| `asn` | `ip.geoip.asnum` | |
|
|
70
|
+
| `path` | `http.request.uri.path` | |
|
|
71
|
+
| `host` | `http.host` | |
|
|
72
|
+
| `method` | `http.request.method` | |
|
|
73
|
+
| `header` | `any(http.request.headers["key"][*] op value)` / `has_key(...)` | Requires `key` (the header name, lowercased before compiling) — see the keyed-field note below |
|
|
74
|
+
| `query` | `http.request.uri.query`, or `any(http.request.uri.args["key"][*] op value)` when keyed | Unkeyed matches the whole query string; `key` scopes to one parameter — see the keyed-field note below |
|
|
75
|
+
| `cookie` | `http.cookie`, or `any(http.request.cookies["key"][*] op value)` when keyed | Unkeyed matches the whole `Cookie` header; keyed requires Cloudflare Pro/Business/Enterprise — see the keyed-field note below |
|
|
76
|
+
| `user_agent` | `http.user_agent` | |
|
|
77
|
+
| `referer` | `http.referer` | |
|
|
78
|
+
| `scheme` | `ssl` (boolean) | |
|
|
79
|
+
| `port` | `cf.edge.server_port` | |
|
|
80
|
+
| `threat_score` | `cf.threat_score` | Cloudflare bot/attack threat score (0-100) |
|
|
81
|
+
|
|
82
|
+
**Keyed `header`/`cookie`/`query` conditions** ([doorman#269](https://github.com/gfargo/doorman/issues/269)): `http.request.headers`, `http.request.cookies`, and (when keyed) `http.request.uri.args` all type as Cloudflare's `Map<Array<String>>`, not a scalar `String` — indexing one yields an `Array<String>`, so a bare `field["key"] eq "value"` is an Array-vs-String type mismatch the Cloudflare API rejects. Doorman compiles a keyed condition to the idiom Cloudflare's Ruleset Engine actually documents instead: `any(field["key"][*] <op> value)` for a value comparison, `has_key(field, "key")` for `exists`/`not_exists`. A `header` condition always requires `key` — there's no "all headers as one value" fallback the way `cookie`'s unkeyed `http.cookie` is. `http.request.cookies` requires Cloudflare Pro, Business, or Enterprise; doorman emits it regardless of plan and lets Cloudflare's API reject it on an unsupported plan, the same policy already applied to `matches`/regex below.
|
|
81
83
|
|
|
82
84
|
### Operator Mapping
|
|
83
85
|
|
|
@@ -134,7 +136,7 @@ The `RuleTranslator` surfaces warnings when a translation is lossy:
|
|
|
134
136
|
- **Unmapped managed-ruleset override action** — an `action`/`overrides[].action` in `managedRules` with no Cloudflare equivalent (only `log`/`deny`/`challenge`/`allow` map cleanly) is dropped with a warning
|
|
135
137
|
- **Negation edge cases** — complex negated conditions may produce subtly different behavior in Wirefilter
|
|
136
138
|
|
|
137
|
-
Doorman does **not** currently warn on the `rate_limit`/`redirect` omitted-config-object cases noted in Action Mapping above
|
|
139
|
+
Doorman does **not** currently warn on the `rate_limit`/`redirect` omitted-config-object cases noted in Action Mapping above — a known gap, not something `doorman validate` catches today. Double-check those specifically rather than relying on validation output.
|
|
138
140
|
|
|
139
141
|
Run `doorman validate` to surface the warnings that do exist before deploying — it auto-detects Cloudflare from the config's `provider` field.
|
|
140
142
|
|