Repository: cloudflare/cloudflare-go
Pull request #1214 (2023-02-22 19:05:42)

Teams untrusted cert action
## Description

Add new teams rule setting field, "untrusted_cert". This is an object containing an "action" field which can have 3 values: pass_through, block, or error.

Ignore commit 7e6a0e7053a69595ee2fdc12838aa3c7ee4227fe which is being used for terraform-provider PR -- will delete before merging

## Has your change been tested?

Updated the serialization tests, nothing else to test here.

## Screenshots (if appropriate):

## Types of changes

What sort of change does your code introduce/modify?

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ x ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)

## Checklist:

- [  x ] My code follows the code style of this project.
- [ ] My change requires a change to the documentation.
- [ ] I have updated the documentation accordingly.
- [ x ] I have added tests to cover my changes.
- [ x ] All new and existing tests passed.
- [ ] This change is using publicly documented (api.cloudflare.com or developers.cloudflare.com) and stable APIs.

[1]: https://help.github.com/articles/closing-issues-using-keywords/


github-actions[bot]: Oops! It looks like no changelog entry is attached to this PR. Please include a release note as described in https://github.com/cloudflare/cloudflare-go/blob/master/docs/changelog-process.md.

Example: 

~~~
```release-note:TYPE
Release note
```
~~~

If you do not require a release note to be included, please add the `workflow/skip-changelog-entry` label.

Patch:
diff --git a/.changelog/1214.txt b/.changelog/1214.txt
new file mode 100644
index 000000000..e41d1a146
--- /dev/null
+++ b/.changelog/1214.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+teams_rules: Add `untrusted_cert` rule setting
+```
\ No newline at end of file
diff --git a/teams_rules.go b/teams_rules.go
index 6fdf7cbcd..7950d1082 100644
--- a/teams_rules.go
+++ b/teams_rules.go
@@ -40,6 +40,20 @@ type TeamsRuleSettings struct {
 
 	// DLP payload logging configuration
 	PayloadLog *TeamsDlpPayloadLogSettings `json:"payload_log"`
+
+	UntrustedCertSettings *UntrustedCertSettings `json:"untrusted_cert"`
+}
+
+type TeamsGatewayUntrustedCertAction string
+
+const (
+	UntrustedCertPassthrough TeamsGatewayUntrustedCertAction = "pass_through"
+	UntrustedCertBlock       TeamsGatewayUntrustedCertAction = "block"
+	UntrustedCertError       TeamsGatewayUntrustedCertAction = "error"
+)
+
+type UntrustedCertSettings struct {
+	Action TeamsGatewayUntrustedCertAction `json:"action"`
 }
 
 type EgressSettings struct {
@@ -116,6 +130,14 @@ func TeamsRulesActionValues() []string {
 	}
 }
 
+func TeamsRulesUntrustedCertActionValues() []string {
+	return []string{
+		string(UntrustedCertPassthrough),
+		string(UntrustedCertBlock),
+		string(UntrustedCertError),
+	}
+}
+
 // TeamsRule represents an Teams wirefilter rule.
 type TeamsRule struct {
 	ID            string             `json:"id,omitempty"`


Test patch:
diff --git a/teams_rules_test.go b/teams_rules_test.go
index e86642b2e..167f16b06 100644
--- a/teams_rules_test.go
+++ b/teams_rules_test.go
@@ -50,7 +50,10 @@ func TestTeamsRules(t *testing.T) {
 						"enforce": true,
 						"duration": "15m0s"
 					},
-                    "insecure_disable_dnssec_validation": false
+                    "insecure_disable_dnssec_validation": false,
+					"untrusted_cert": {
+						"action": "error"
+					}
 				  }
 				},
 				{
@@ -78,7 +81,10 @@ func TestTeamsRules(t *testing.T) {
 					"biso_admin_controls": null,
 					"add_headers": null,
 					"check_session": null,
-                    "insecure_disable_dnssec_validation": true
+                    "insecure_disable_dnssec_validation": true,
+					"untrusted_cert": {
+						"action": "pass_through"
+					}
 				  }
 				}
 			]
@@ -114,6 +120,9 @@ func TestTeamsRules(t *testing.T) {
 				Duration: Duration{900 * time.Second},
 			},
 			InsecureDisableDNSSECValidation: false,
+			UntrustedCertSettings: &UntrustedCertSettings{
+				Action: UntrustedCertError,
+			},
 		},
 		CreatedAt: &createdAt,
 		UpdatedAt: &updatedAt,
@@ -142,6 +151,9 @@ func TestTeamsRules(t *testing.T) {
 				CheckSession:      nil,
 				// setting is invalid for block rules, just testing serialization here
 				InsecureDisableDNSSECValidation: true,
+				UntrustedCertSettings: &UntrustedCertSettings{
+					Action: UntrustedCertPassthrough,
+				},
 			},
 			CreatedAt: &createdAt,
 			UpdatedAt: &updatedAt,
@@ -196,7 +208,10 @@ func TestTeamsRule(t *testing.T) {
 						"enforce": true,
 						"duration": "15m0s"
 					},
-                    "insecure_disable_dnssec_validation": false
+                    "insecure_disable_dnssec_validation": false,
+					"untrusted_cert": {
+						"action": "block"
+					}
 				}
 			}
 		}
@@ -231,6 +246,9 @@ func TestTeamsRule(t *testing.T) {
 				Duration: Duration{900 * time.Second},
 			},
 			InsecureDisableDNSSECValidation: false,
+			UntrustedCertSettings: &UntrustedCertSettings{
+				Action: UntrustedCertBlock,
+			},
 		},
 		CreatedAt: &createdAt,
 		UpdatedAt: &updatedAt,