feat(cdn): Add support for configuring WAF

[matheuspolitano]

Description

https://jira.schwarz/browse/STACKITCDN-723

I want to add support for the waf configuration block in the CDN distribution resource,so that users can programmatically manage security tiers, paranoia levels, and granular rule overrides (Enabled/Disabled/Log-only) via Terraform.

Checklist

• Issue was linked above
• Code format was applied: make fmt
• Examples were added / adjusted (see examples/ directory)
• Docs are up-to-date: make generate-docs (will be checked by CI)
• Unit tests got implemented or updated
• Acceptance tests got implemented or updated (see e.g. here)
• Unit tests are passing: make test (will be checked by CI)
• No linter issues: make lint (will be checked by CI)

[matheuspolitano]

@Fyusel @marceljk Kindly prioritize the review of PR #1333, as the current pull request builds upon those changes.

[marceljk]

Why is it needed to sort the slice? Takes the API care of the order? If not, you can use conversion.StringSetToSlice() instead this function, there you shouldn't ignore the error like it was done here

[matheuspolitano]

i've removed the sort

[marceljk]

same here, remove this function and use instead everywhere conversion.StringSetToSlice()

Suggested change

	// getWafSet extracts strings from HCL set, sorts them and returns the slice
	func getWafSet(ctx context.Context, tfSet basetypes.SetValue) []string {
	if utils.IsUndefined(tfSet) {
	return nil
	}
	var elements []string
	diags := tfSet.ElementsAs(ctx, &elements, true)
	if diags.HasError() {
	return []string{}
	}
	sort.Strings(elements)
	return elements
	}

[marceljk]

you can use the function types.StringPointerValue() from the terraform framework itself instead of this function

[matheuspolitano]

Done

[marceljk]

I meant here to remove the whole mapWafString function and use everywhere types.StringPointerValue() instead. It does the same thing but keeps the code clean because this is a function of the framework

Suggested change

	mapWafString := func(apiVal *string) types.String {
	if apiVal != nil {
	return types.StringValue(*apiVal)
	}
	return types.StringNull()
	}

[marceljk]

I meant here to remove the whole mapWafString function and use everywhere types.StringPointerValue() instead. It does the same thing but keeps the code clean because this is a function of the framework

Suggested change

	mapWafString := func(apiVal *string) types.String {
	if apiVal != nil {
	return types.StringValue(*apiVal)
	}
	return types.StringNull()
	}

[marceljk]

same here, remove this function and use instead everywhere conversion.StringSetToSlice()

Suggested change

	// getWafSet extracts strings from HCL set, sorts them and returns the slice
	func getWafSet(ctx context.Context, tfSet basetypes.SetValue) []string {
	if utils.IsUndefined(tfSet) {
	return nil
	}
	var elements []string
	diags := tfSet.ElementsAs(ctx, &elements, true)
	if diags.HasError() {
	return []string{}
	}
	sort.Strings(elements)
	return elements
	}

[marceljk]

Move this to the conversion package and name it to something like SliceToStringSet and avoid context if possible and don't ignore the error.

Could be something like this:

func SliceToStringSet(list []string) (types.Set, error) {
	if list == nil {
		return types.SetNull(types.StringType), nil
	}
	set := make([]attr.Value, len(list))
	for idx, v := range list {
		stringValue := types.StringValue(v)
		set[idx] = stringValue
	}
	result, diags := types.SetValue(types.StringType, set)
	if diags.HasError() {
		return types.SetNull(types.StringType), fmt.Errorf("converting to SetValue: %v", diags.Errors())
	}
	return result, nil
}

[marceljk]

I'm against this workaround here. The datasource shows always waf with the attributes and the resource should behave the same, even if it's not configured by the customer

[marceljk]

Don't set the values here by hand. Use them from you config.

Suggested change

	resource.TestCheckResourceAttr("stackit_cdn_distribution.distribution", "config.waf.allowed_http_methods.#", "1"),
	resource.TestCheckResourceAttr("stackit_cdn_distribution.distribution", "config.waf.allowed_http_methods.0", "GET"),
	resource.TestCheckResourceAttr("stackit_cdn_distribution.distribution", "config.waf.allowed_http_methods.#", "1"),
	resource.TestCheckResourceAttr("stackit_cdn_distribution.distribution", "config.waf.allowed_http_methods.0", testConfigVarsHttp["waf_allowed_http_methods"]),

Change it also for all other checks, even in the Read via datasource and update step