Merge pull request #84 from wallarm/refactor/v2.3.9

Author: concentrator

CHANGELOG.md

@@ -1,3 +1,35 @@
+## [v2.3.9] - 2026-05-04
+
+> Rules polish batch — naming cleanup, schema-shape audit (symmetric remove-restores-default), safety hardening, test gap fills. Bumps `wallarm-go` to v0.12.2.
+>
+> **Migration note:** the `Optional+Computed` → `Optional+Default(<value>)` flips below cover ~13 fields. Resources whose API value differs from the new schema default will produce a one-time plan diff after upgrade — review `terraform plan` output before applying. Affects `active` (all resources), `additional_parameters`/`plain_parameters` (brute/bola/enum), `introspection`/`debug_enabled`/`max_depth`/`max_value_size_kb`/`max_doc_size_kb`/`max_doc_per_batch`/`max_aliases` (graphql_detection), `mode` (overlimit_res_settings, file_upload_size_limit), `time_unit` (rate_limit).
+
+### Upgrade Steps
+
+* [ACTION REQUIRED] `wallarm_rule_graphql_detection`: rename `max_alias_size_kb` → `max_aliases` in HCL.
+
+### Breaking Changes
+
+* **`wallarm_rule_graphql_detection.max_alias_size_kb` renamed to `max_aliases`** (count, not size; wire JSON tag unchanged).
+* **`mitigation` (all rule resources) now `Computed` only** (was `Optional+Computed`); HCL setting it now fails validation.
+* **`wallarm_rule_regex.experimental` default behaviour**: HCL omitting the field now creates a regular `regex` rule (was `experimental_regex`).
+
+### Bug Fixes
+
+* **`wallarm_rule_graphql_detection.introspection` / `.debug_enabled` now `Optional+Default(true)`** — symmetric remove-restores-default.
+* **`active` (all rule resources) now `Optional+Default(true)`** — same.
+* **`enumerated_parameters.additional_parameters` / `.plain_parameters` now `Optional+Default(false)`** (rule_brute/_bola/_enum) — same.
+* **`wallarm_rule_graphql_detection` int fields now `Optional+Default(<API default>)`** — `max_depth`, `max_value_size_kb` (range `1..100` validator added), `max_doc_size_kb`, `max_doc_per_batch`.
+* **`wallarm_rule_graphql_detection.max_aliases` now `Optional+Default(5)`** (was `Optional+Computed+ForceNew`); mutates in place. Adds `wallarm-go.HintUpdateV3Params.MaxAliases` + `resourcerule.WithMaxAliases`.
+* **`wallarm_rule_overlimit_res_settings.mode` now `Optional+Default("monitoring")`.**
+* **`wallarm_rule_rate_limit.time_unit` now `Optional+Default("rps")`.**
+* **`wallarm_rule_file_upload_size_limit.mode` now `Optional+Default("monitoring")`**; `size` gains `IntAtLeast(1)` validator.
+* **`wallarm_rule_regex.experimental` now `Optional+Computed+ForceNew`** (was `Optional+Default(true)+ForceNew`; ForceNew retained); Read derives from `rule_type`. Prevents destroy-on-import for regular `regex` rules.
+* **`findActionByConditionsHash` 200-page pagination cap** — bounds previously unbounded loop.
+* **`setIfExists` panic-swallow removed** — replaced with explicit cty guards in `rawStateHasKey`.
+* **Plan-time enum validators added**: `attack_type` on rule_disable_attack_type/vpatch (17 values each), rule_regex (16); `block_by_session/ip+graylist_by_ip` accept `0` (unset, dropped on wire) OR `600..315569520` — preserves `terraform import` + `-generate-config-out` round-trip on partially-set reactions; `threshold.count`/`.period` `IntAtLeast(1)` — surfaces API constraint at plan time.
+* **Generic helper `resourcerule.GetPointerIfConfigured[T any]`** replaces type-specific variants — used by rate_limit `delay`/`burst` where 0 is meaningful.
+
 ## [v2.3.8] - 2026-05-01
 
 > Schema actualisation against API ground truth, zero-value pointer fixes, plan-time validator for `enumerated_parameters`, full rule-test harness migration. Bumps `wallarm-go` to v0.12.1.

docs/guides/mitigation_controls.md

@@ -16,7 +16,7 @@ For detailed documentation, see [Mitigation Controls Overview](https://docs.wall
 | Wallarm UI name | Terraform resource | Key parameters |
 |-----------------|-------------------|----------------|
 | Real-time blocking mode | [`wallarm_rule_mode`](../resources/rule_mode) | `mode` |
-| GraphQL API protection | [`wallarm_rule_graphql_detection`](../resources/rule_graphql_detection) | `mode`, `max_depth`, `max_value_size_kb`, `max_doc_size_kb`, `max_alias_size_kb`, `max_doc_per_batch` |
+| GraphQL API protection | [`wallarm_rule_graphql_detection`](../resources/rule_graphql_detection) | `mode`, `max_depth`, `max_value_size_kb`, `max_doc_size_kb`, `max_aliases`, `max_doc_per_batch` |
 | Enumeration attack protection | [`wallarm_rule_enum`](../resources/rule_enum) | `mode`, `threshold`, `reaction`, `advanced_conditions`, `arbitrary_conditions` |
 | BOLA protection | [`wallarm_rule_bola`](../resources/rule_bola) | `mode`, `threshold`, `reaction`, `advanced_conditions`, `arbitrary_conditions` |
 | Forced browsing protection | [`wallarm_rule_forced_browsing`](../resources/rule_forced_browsing) | `mode`, `threshold`, `reaction`, `advanced_conditions`, `arbitrary_conditions` |

docs/resources/rule_disable_attack_type.md

@@ -30,7 +30,7 @@ resource "wallarm_rule_disable_attack_type" "disable_sqli" {
 
 * `client_id` - (optional) ID of the client to apply the rules to. The value is required for [multi-tenant scenarios][2].
 * `action` - (optional) rule conditions. See the [Action Guide](../guides/action) for full documentation on action conditions, point types, and usage examples.
-* `attack_type` - (**required**) attack type to ignore. Possible values: `sqli`, `xss`, `rce`, `ptrav`, `crlf`, `nosqli`, `xxe`, `ldapi`, `scanner`, `ssti`, `ssi`, `mail_injection`, `vpatch`.
+* `attack_type` - (**required**) attack type to ignore. Possible values: `xss`, `sqli`, `rce`, `xxe`, `ptrav`, `crlf`, `redir`, `nosqli`, `ldapi`, `scanner`, `mass_assignment`, `ssrf`, `ssi`, `mail_injection`, `ssti`, `any`, `invalid_xml`. The canonical list is served by `GET /v2/attack_types` on the Wallarm API.
 * `point` - (**required**) request parts to apply the rules to. See the [Point Guide](../guides/point) for the full list of possible values and examples.
 
 ## Attributes Reference

docs/resources/rule_graphql_detection.md

@@ -27,7 +27,7 @@ resource "wallarm_rule_graphql_detection" "graphql_detection" {
   max_doc_size_kb = 100
   max_value_size_kb = 10
   max_depth = 10
-  max_alias_size_kb = 5
+  max_aliases = 5
   max_doc_per_batch = 10
   introspection = true
   debug_enabled = true
@@ -43,7 +43,7 @@ resource "wallarm_rule_graphql_detection" "graphql_detection" {
 * `max_doc_size_kb` - (optional) the limit for the size in kilobytes of an entire GraphQL query.
 * `max_value_size_kb` - (optional) the limit for the size in kilobytes of an entire GraphQL query
 * `max_depth` - (optional) the maximum allowed depth for a GraphQL query. By limiting query depth.
-* `max_alias_size_kb` - (optional) the limit on the number of aliases that can be used in a single GraphQL query.
+* `max_aliases` - (optional) the limit on the number of aliases that can be used in a single GraphQL query.
 * `max_doc_per_batch` - (optional) the number of batched queries that can be sent in a single request.
 * `introspection` - (optional) when enabled, the server will treat introspection requests—which can reveal the structure of your GraphQL schema—as potential attacks. Can be: `true`, `false`.
 * `debug_enabled` - (optional) enabling this option means that requests containing the debug mode parameter will be considered potential attacks. Can be: `true`, `false`.

docs/resources/rule_regex.md

@@ -66,9 +66,10 @@ resource "wallarm_rule_regex" "scanner_rule" {
 ## Argument Reference
 
 * `client_id` - (optional) ID of the client to apply the rules to. The value is required for [multi-tenant scenarios][2].
-* `attack_type` - (**required**) attack type that will be detected when the parameter value in the request matches the regular expression. Can be: `any`, `sqli`, `rce`, `crlf`, `nosqli`, `ptrav`, `xxe`, `ptrav`, `xss`, `scanner`, `redir`, `ldapi`.
+* `attack_type` - (**required**) attack type that will be detected when the parameter value in the request matches the regular expression. Possible values for custom attack-detector rules: `xss`, `sqli`, `rce`, `xxe`, `ptrav`, `crlf`, `redir`, `nosqli`, `ldapi`, `scanner`, `mass_assignment`, `ssrf`, `ssi`, `mail_injection`, `ssti`, `vpatch`. Note: `any` and `invalid_xml` are not valid here (a regex rule must detect a specific attack class). The canonical attack-types list is served by `GET /v2/attack_types` on the Wallarm API.
 * `action` - (optional) rule conditions. See the [Action Guide](../guides/action) for full documentation on action conditions, point types, and usage examples.
 * `point` - (**required**) request parts to apply the rules to. See the [Point Guide](../guides/point) for the full list of possible values and examples.
+* `experimental` - (optional) when `true`, the rule is created with `rule_type = "experimental_regex"` (matches surface as attacks but are never blocked, even in block mode). When `false` or omitted, a regular `regex` rule is created. ForceNew — flipping this destroys and recreates the rule. Default behaviour when omitted: regular `regex`. _v2.3.9 behaviour change: previously omitting this field defaulted to `experimental_regex`._
 
 
 ## Attributes Reference

docs/resources/rule_vpatch.md

@@ -42,9 +42,7 @@ resource "wallarm_rule_vpatch" "splunk" {
 ## Argument Reference
 
 * `client_id` - (optional) ID of the client to apply the rules to. The value is required for [multi-tenant scenarios][2].
-* `attack_type` - (**required**) attack type. The request with this attack will be blocked. Can be:
-  * `any` to block the request with the specified `point` even if the attack is not detected.
-  * One of the names of attack types to block the requests with the specified `point` if these malicious payloads are detected. Possible attack types: `sqli`, `rce`, `crlf`, `nosqli`, `ptrav`, `xxe`, `ptrav`, `xss`, `scanner`, `redir`, `ldapi`.
+* `attack_type` - (**required**) attack type. The request with this attack will be blocked. Possible values: `xss`, `sqli`, `rce`, `xxe`, `ptrav`, `crlf`, `redir`, `nosqli`, `ldapi`, `scanner`, `mass_assignment`, `ssrf`, `ssi`, `mail_injection`, `ssti`, `any`, `invalid_xml`. Use `any` to block the request with the specified `point` even if the attack is not detected. The canonical list is served by `GET /v2/attack_types` on the Wallarm API.
 * `point` - (**required**) request parts to apply the rules to. See the [Point Guide](../guides/point) for the full list of possible values and examples.
 * `action` - (optional) rule conditions. See the [Action Guide](../guides/action) for full documentation on action conditions, point types, and usage examples.
 

examples/import-rules/Makefile

@@ -6,7 +6,7 @@ IMPORT_BLOCKS_FILE = ./import_rule_blocks.tf
 RULE_CONFIGS_FILE = ./import_rule_configs.tf
 RULE_STAMP_CONFIGS_FILE = ./import_rule_stamp_configs.tf
 
-FILES_DIRS_TO_CLEAN = ${LOG_FILES} ${TMP_FILES} ${TF_DIR} ${TF_STATE_FILE} ${IMPORT_BLOCKS_FILE} ${RULE_CONFIGS_FILE}
+FILES_DIRS_TO_CLEAN = ${LOG_FILES} ${TMP_FILES} ${TF_DIR} ${TF_STATE_FILE} ${IMPORT_BLOCKS_FILE} ${RULE_CONFIGS_FILE} ${RULE_STAMP_CONFIGS_FILE}
 
 
 default: list
@@ -73,12 +73,19 @@ import-stamps-conf-gen:
 # - comment=null → "Managed by Terraform"
 # - remove all remaining =null lines
 # - remove all remaining =[] lines
+# - drop reaction.{block_by_session,block_by_ip,graylist_by_ip} = 0 lines:
+#   SDKv2's flat state model has no NullVal slot for TypeInt inside a nested
+#   block, so partially-set reactions ({block_by_ip = 3600}, others absent)
+#   round-trip through state as 0 and emit literal `= 0` lines that the
+#   schema validator rejects. The mapper drops 0 on the wire, so removing
+#   these lines is round-trip safe.
 import-configs-fix:
 	-@sed -E \
 		-e 's/(variativity_disabled[[:space:]]*)=[[:space:]]*false/\1= true/' \
 		-e 's/(comment[[:space:]]*)=[[:space:]]*null/\1= "Managed by Terraform"/' \
 		-e '/=[[:space:]]*null/d' \
 		-e '/=[[:space:]]*\[\]/d' \
+		-e '/(block_by_session|block_by_ip|graylist_by_ip)[[:space:]]*=[[:space:]]*0/d' \
 		$(RULE_CONFIGS_FILE) > $(RULE_CONFIGS_FILE).tmp && mv $(RULE_CONFIGS_FILE).tmp $(RULE_CONFIGS_FILE)
 
 # ─── Case 1: Native import (all rules) ─────────────────────────────────────

examples/wallarm_rule_graphql_detection.tf

@@ -11,7 +11,7 @@ resource "wallarm_rule_graphql_detection" "graphql_block" {
 
   # All max_*, introspection, debug_enabled fields are Optional+Computed —
   # API defaults apply when omitted (max_depth=10, max_value_size_kb=10,
-  # max_doc_size_kb=100, max_doc_per_batch=10, max_alias_size_kb=5,
+  # max_doc_size_kb=100, max_doc_per_batch=10, max_aliases=5,
   # introspection=true, debug_enabled=true). Override here if needed:
   #
   #   max_depth         = 20

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.39.0
 	github.com/pkg/errors v0.9.1
 	github.com/samber/lo v1.51.0
-	github.com/wallarm/wallarm-go v0.12.1
+	github.com/wallarm/wallarm-go v0.12.2
 	github.com/zclconf/go-cty v1.17.0
 )
 

go.sum

@@ -157,8 +157,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/wallarm/wallarm-go v0.12.1 h1:2NodWNssSMSGeZgp6Im7Dg8hM2gHpLaA7Aa/BN0E1ZA=
-github.com/wallarm/wallarm-go v0.12.1/go.mod h1:yqZcNkOdSXL7K0CXRDJ3WyjyjDOHyk41iAv9fXsFP8o=
+github.com/wallarm/wallarm-go v0.12.2 h1:Yb0QVuMzBUWTn48MLxh/JQIUReQuFFVxJSsKualJqUk=
+github.com/wallarm/wallarm-go v0.12.2/go.mod h1:yqZcNkOdSXL7K0CXRDJ3WyjyjDOHyk41iAv9fXsFP8o=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=