cloudflare 3.1.0 → 3.2.0

package/src/resources/zero-trust/gateway/rules.ts

@@ -54,12 +54,11 @@ export class Rules extends APIResource {
     params: RuleDeleteParams,
     options?: Core.RequestOptions,
   ): Core.APIPromise<RuleDeleteResponse> {
-    const { account_id, body } = params;
+    const { account_id } = params;
     return (
-      this._client.delete(`/accounts/${account_id}/gateway/rules/${ruleId}`, {
-        body: body,
-        ...options,
-      }) as Core.APIPromise<{ result: RuleDeleteResponse }>
+      this._client.delete(`/accounts/${account_id}/gateway/rules/${ruleId}`, options) as Core.APIPromise<{
+        result: RuleDeleteResponse;
+      }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -102,6 +101,30 @@ export interface DNSResolverSettingsV4 {
   vnet_id?: string;
 }
 
+export interface DNSResolverSettingsV4Param {
+  /**
+   * IPv4 address of upstream resolver.
+   */
+  ip: string;
+
+  /**
+   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   */
+  port?: number;
+
+  /**
+   * Whether to connect to this resolver over a private network. Must be set when
+   * vnet_id is set.
+   */
+  route_through_private_network?: boolean;
+
+  /**
+   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * network id if omitted.
+   */
+  vnet_id?: string;
+}
+
 export interface DNSResolverSettingsV6 {
   /**
    * IPv6 address of upstream resolver.
@@ -126,11 +149,40 @@ export interface DNSResolverSettingsV6 {
   vnet_id?: string;
 }
 
+export interface DNSResolverSettingsV6Param {
+  /**
+   * IPv6 address of upstream resolver.
+   */
+  ip: string;
+
+  /**
+   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   */
+  port?: number;
+
+  /**
+   * Whether to connect to this resolver over a private network. Must be set when
+   * vnet_id is set.
+   */
+  route_through_private_network?: boolean;
+
+  /**
+   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * network id if omitted.
+   */
+  vnet_id?: string;
+}
+
 /**
  * The protocol or layer to use.
  */
 export type GatewayFilter = 'http' | 'dns' | 'l4' | 'egress';
 
+/**
+ * The protocol or layer to use.
+ */
+export type GatewayFilterParam = 'http' | 'dns' | 'l4' | 'egress';
+
 export interface GatewayRule {
   /**
    * The API resource UUID.
@@ -490,6 +542,274 @@ export namespace RuleSetting {
   }
 }
 
+/**
+ * Additional settings that modify the rule's action.
+ */
+export interface RuleSettingParam {
+  /**
+   * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
+   * header names, pointing to an array with its header value(s).
+   */
+  add_headers?: unknown;
+
+  /**
+   * Set by parent MSP accounts to enable their children to bypass this rule.
+   */
+  allow_child_bypass?: boolean;
+
+  /**
+   * Settings for the Audit SSH action.
+   */
+  audit_ssh?: RuleSettingParam.AuditSSH;
+
+  /**
+   * Configure how browser isolation behaves.
+   */
+  biso_admin_controls?: RuleSettingParam.BisoAdminControls;
+
+  /**
+   * Enable the custom block page.
+   */
+  block_page_enabled?: boolean;
+
+  /**
+   * The text describing why this block occurred, displayed on the custom block page
+   * (if enabled).
+   */
+  block_reason?: string;
+
+  /**
+   * Set by children MSP accounts to bypass their parent's rules.
+   */
+  bypass_parent_rule?: boolean;
+
+  /**
+   * Configure how session check behaves.
+   */
+  check_session?: RuleSettingParam.CheckSession;
+
+  /**
+   * Add your own custom resolvers to route queries that match the resolver policy.
+   * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
+   * route to the address closest to their origin. Only valid when a rule's action is
+   * set to 'resolve'.
+   */
+  dns_resolvers?: RuleSettingParam.DNSResolvers;
+
+  /**
+   * Configure how Gateway Proxy traffic egresses. You can enable this setting for
+   * rules with Egress actions and filters, or omit it to indicate local egress via
+   * WARP IPs.
+   */
+  egress?: RuleSettingParam.Egress;
+
+  /**
+   * INSECURE - disable DNSSEC validation (for Allow actions).
+   */
+  insecure_disable_dnssec_validation?: boolean;
+
+  /**
+   * Set to true to enable IPs in DNS resolver category blocks. By default categories
+   * only block based on domain names.
+   */
+  ip_categories?: boolean;
+
+  /**
+   * Set to true to include IPs in DNS resolver indicator feed blocks. By default
+   * indicator feeds only block based on domain names.
+   */
+  ip_indicator_feeds?: boolean;
+
+  /**
+   * Send matching traffic to the supplied destination IP address and port.
+   */
+  l4override?: RuleSettingParam.L4override;
+
+  /**
+   * Configure a notification to display on the user's device when this rule is
+   * matched.
+   */
+  notification_settings?: RuleSettingParam.NotificationSettings;
+
+  /**
+   * Override matching DNS queries with a hostname.
+   */
+  override_host?: string;
+
+  /**
+   * Override matching DNS queries with an IP or set of IPs.
+   */
+  override_ips?: Array<string>;
+
+  /**
+   * Configure DLP payload logging.
+   */
+  payload_log?: RuleSettingParam.PayloadLog;
+
+  /**
+   * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
+   * resolver. Cannot be set when dns_resolvers are specified. Only valid when a
+   * rule's action is set to 'resolve'.
+   */
+  resolve_dns_through_cloudflare?: boolean;
+
+  /**
+   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   */
+  untrusted_cert?: RuleSettingParam.UntrustedCERT;
+}
+
+export namespace RuleSettingParam {
+  /**
+   * Settings for the Audit SSH action.
+   */
+  export interface AuditSSH {
+    /**
+     * Enable to turn on SSH command logging.
+     */
+    command_logging?: boolean;
+  }
+
+  /**
+   * Configure how browser isolation behaves.
+   */
+  export interface BisoAdminControls {
+    /**
+     * Set to true to enable copy-pasting.
+     */
+    dcp?: boolean;
+
+    /**
+     * Set to true to enable downloading.
+     */
+    dd?: boolean;
+
+    /**
+     * Set to true to enable keyboard usage.
+     */
+    dk?: boolean;
+
+    /**
+     * Set to true to enable printing.
+     */
+    dp?: boolean;
+
+    /**
+     * Set to true to enable uploading.
+     */
+    du?: boolean;
+  }
+
+  /**
+   * Configure how session check behaves.
+   */
+  export interface CheckSession {
+    /**
+     * Configure how fresh the session needs to be to be considered valid.
+     */
+    duration?: string;
+
+    /**
+     * Set to true to enable session enforcement.
+     */
+    enforce?: boolean;
+  }
+
+  /**
+   * Add your own custom resolvers to route queries that match the resolver policy.
+   * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
+   * route to the address closest to their origin. Only valid when a rule's action is
+   * set to 'resolve'.
+   */
+  export interface DNSResolvers {
+    ipv4?: Array<RulesAPI.DNSResolverSettingsV4Param>;
+
+    ipv6?: Array<RulesAPI.DNSResolverSettingsV6Param>;
+  }
+
+  /**
+   * Configure how Gateway Proxy traffic egresses. You can enable this setting for
+   * rules with Egress actions and filters, or omit it to indicate local egress via
+   * WARP IPs.
+   */
+  export interface Egress {
+    /**
+     * The IPv4 address to be used for egress.
+     */
+    ipv4?: string;
+
+    /**
+     * The fallback IPv4 address to be used for egress in the event of an error
+     * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
+     * WARP IPs.
+     */
+    ipv4_fallback?: string;
+
+    /**
+     * The IPv6 range to be used for egress.
+     */
+    ipv6?: string;
+  }
+
+  /**
+   * Send matching traffic to the supplied destination IP address and port.
+   */
+  export interface L4override {
+    /**
+     * IPv4 or IPv6 address.
+     */
+    ip?: string;
+
+    /**
+     * A port number to use for TCP/UDP overrides.
+     */
+    port?: number;
+  }
+
+  /**
+   * Configure a notification to display on the user's device when this rule is
+   * matched.
+   */
+  export interface NotificationSettings {
+    /**
+     * Set notification on
+     */
+    enabled?: boolean;
+
+    /**
+     * Customize the message shown in the notification.
+     */
+    msg?: string;
+
+    /**
+     * Optional URL to direct users to additional information. If not set, the
+     * notification will open a block page.
+     */
+    support_url?: string;
+  }
+
+  /**
+   * Configure DLP payload logging.
+   */
+  export interface PayloadLog {
+    /**
+     * Set to true to enable DLP payload logging for this rule.
+     */
+    enabled?: boolean;
+  }
+
+  /**
+   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   */
+  export interface UntrustedCERT {
+    /**
+     * The action performed when an untrusted certificate is seen. The default action
+     * is an error with HTTP code 526.
+     */
+    action?: 'pass_through' | 'block' | 'error';
+  }
+}
+
 /**
  * The schedule for activating DNS policies. This does not apply to HTTP or network
  * policies.
@@ -556,6 +876,72 @@ export interface Schedule {
   wed?: string;
 }
 
+/**
+ * The schedule for activating DNS policies. This does not apply to HTTP or network
+ * policies.
+ */
+export interface ScheduleParam {
+  /**
+   * The time intervals when the rule will be active on Fridays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Fridays.
+   */
+  fri?: string;
+
+  /**
+   * The time intervals when the rule will be active on Mondays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Mondays.
+   */
+  mon?: string;
+
+  /**
+   * The time intervals when the rule will be active on Saturdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Saturdays.
+   */
+  sat?: string;
+
+  /**
+   * The time intervals when the rule will be active on Sundays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Sundays.
+   */
+  sun?: string;
+
+  /**
+   * The time intervals when the rule will be active on Thursdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Thursdays.
+   */
+  thu?: string;
+
+  /**
+   * The time zone the rule will be evaluated against. If a
+   * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
+   * is provided, Gateway will always use the current time at that time zone. If this
+   * parameter is omitted, then Gateway will use the time zone inferred from the
+   * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
+   * from the IP, we will fall back to the time zone of the user's connected data
+   * center.
+   */
+  time_zone?: string;
+
+  /**
+   * The time intervals when the rule will be active on Tuesdays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Tuesdays.
+   */
+  tue?: string;
+
+  /**
+   * The time intervals when the rule will be active on Wednesdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Wednesdays.
+   */
+  wed?: string;
+}
+
 export type RuleDeleteResponse = unknown | string | null;
 
 export interface RuleCreateParams {
@@ -609,7 +995,7 @@ export interface RuleCreateParams {
    * Body param: The protocol or layer to evaluate the traffic, identity, and device
    * posture expressions.
    */
-  filters?: Array<GatewayFilter>;
+  filters?: Array<GatewayFilterParam>;
 
   /**
    * Body param: The wirefilter expression used for identity matching.
@@ -626,13 +1012,13 @@ export interface RuleCreateParams {
   /**
    * Body param: Additional settings that modify the rule's action.
    */
-  rule_settings?: RuleSetting;
+  rule_settings?: RuleSettingParam;
 
   /**
    * Body param: The schedule for activating DNS policies. This does not apply to
    * HTTP or network policies.
    */
-  schedule?: Schedule;
+  schedule?: ScheduleParam;
 
   /**
    * Body param: The wirefilter expression used for traffic matching.
@@ -691,7 +1077,7 @@ export interface RuleUpdateParams {
    * Body param: The protocol or layer to evaluate the traffic, identity, and device
    * posture expressions.
    */
-  filters?: Array<GatewayFilter>;
+  filters?: Array<GatewayFilterParam>;
 
   /**
    * Body param: The wirefilter expression used for identity matching.
@@ -708,13 +1094,13 @@ export interface RuleUpdateParams {
   /**
    * Body param: Additional settings that modify the rule's action.
    */
-  rule_settings?: RuleSetting;
+  rule_settings?: RuleSettingParam;
 
   /**
    * Body param: The schedule for activating DNS policies. This does not apply to
    * HTTP or network policies.
    */
-  schedule?: Schedule;
+  schedule?: ScheduleParam;
 
   /**
    * Body param: The wirefilter expression used for traffic matching.
@@ -727,15 +1113,7 @@ export interface RuleListParams {
 }
 
 export interface RuleDeleteParams {
-  /**
-   * Path param:
-   */
   account_id: string;
-
-  /**
-   * Body param:
-   */
-  body: unknown;
 }
 
 export interface RuleGetParams {