Skip to content

Commit cba7006

Browse files
sebassimoessebassimoes
committed
GFI-618: support biso control v2 settings
With this commit, it becomes possible to configure gateway isolate policies with the new version of BISO admin control settings.
1 parent 984c5c7 commit cba7006

6 files changed

+139
-8
lines changed

‎.changelog/4962.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/cloudflare_zero_trust_gateway_policy: allow configuring isolate rules with BISO admin control V2 settings
3+
```

‎go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.23.3
44

55
require (
66
github.com/agext/levenshtein v1.2.3 // indirect
7-
github.com/cloudflare/cloudflare-go v0.114.0
7+
github.com/cloudflare/cloudflare-go v0.115.0
88
github.com/fatih/color v1.16.0 // indirect
99
github.com/google/uuid v1.6.0
1010
github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -68,7 +68,7 @@ require (
6868
github.com/aws/smithy-go v1.21.0 // indirect
6969
github.com/cloudflare/circl v1.3.7 // indirect
7070
github.com/davecgh/go-spew v1.1.1 // indirect
71-
github.com/goccy/go-json v0.10.4 // indirect
71+
github.com/goccy/go-json v0.10.5 // indirect
7272
github.com/golang/protobuf v1.5.4 // indirect
7373
github.com/google/go-querystring v1.1.0 // indirect
7474
github.com/hashicorp/go-checkpoint v0.5.0 // indirect

‎go.sum

+4
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vc
5353
github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
5454
github.com/cloudflare/cloudflare-go v0.114.0 h1:ucoti4/7Exo0XQ+rzpn1H+IfVVe++zgiM+tyKtf0HUA=
5555
github.com/cloudflare/cloudflare-go v0.114.0/go.mod h1:O7fYfFfA6wKqKFn2QIR9lhj7FDw6VQCGOY6hd2TBtd0=
56+
github.com/cloudflare/cloudflare-go v0.115.0 h1:84/dxeeXweCc0PN5Cto44iTA8AkG1fyT11yPO5ZB7sM=
57+
github.com/cloudflare/cloudflare-go v0.115.0/go.mod h1:Ds6urDwn/TF2uIU24mu7H91xkKP8gSAHxQ44DSZgVmU=
5658
github.com/cloudflare/cloudflare-go/v2 v2.4.0 h1:gys/26GoVDklgfq8NYV39WgvOEwzK/XAqYObmnI6iFg=
5759
github.com/cloudflare/cloudflare-go/v2 v2.4.0/go.mod h1:AoIzb05z/rvdJLztPct4tSa+3IqXJJ6c+pbUFMOlTr8=
5860
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -80,6 +82,8 @@ github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
8082
github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
8183
github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
8284
github.com/goccy/go-json v0.10.4/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
85+
github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
86+
github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
8387
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
8488
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
8589
github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=

‎internal/sdkv2provider/resource_cloudflare_teams_rules.go

+21
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,13 @@ func flattenTeamsRuleBisoAdminControls(settings *cloudflare.TeamsBISOAdminContro
344344
"disable_upload": settings.DisableUpload,
345345
"disable_keyboard": settings.DisableKeyboard,
346346
"disable_clipboard_redirection": settings.DisableClipboardRedirection,
347+
"version": settings.Version,
348+
"copy": settings.Copy,
349+
"download": settings.Download,
350+
"keyboard": settings.Keyboard,
351+
"paste": settings.Paste,
352+
"printing": settings.Printing,
353+
"upload": settings.Upload,
347354
}}
348355
}
349356

@@ -370,13 +377,27 @@ func inflateTeamsRuleBisoAdminControls(settings interface{}) *cloudflare.TeamsBI
370377
disableUpload := settingsMap["disable_upload"].(bool)
371378
disableKeyboard := settingsMap["disable_keyboard"].(bool)
372379
disableClipboardRedirection := settingsMap["disable_clipboard_redirection"].(bool)
380+
version := settingsMap["version"].(string)
381+
copy := settingsMap["copy"].(string)
382+
download := settingsMap["download"].(string)
383+
keyboard := settingsMap["keyboard"].(string)
384+
paste := settingsMap["paste"].(string)
385+
printing := settingsMap["printing"].(string)
386+
upload := settingsMap["upload"].(string)
373387
return &cloudflare.TeamsBISOAdminControlSettings{
374388
DisablePrinting: disablePrinting,
375389
DisableCopyPaste: disableCopyPaste,
376390
DisableDownload: disableDownload,
377391
DisableUpload: disableUpload,
378392
DisableKeyboard: disableKeyboard,
379393
DisableClipboardRedirection: disableClipboardRedirection,
394+
Version: cloudflare.TeamsBISOAdminControlSettingsVersion(version),
395+
Copy: cloudflare.TeamsTeamsBISOAdminControlSettingsValue(copy),
396+
Download: cloudflare.TeamsTeamsBISOAdminControlSettingsValue(download),
397+
Keyboard: cloudflare.TeamsTeamsBISOAdminControlSettingsValue(keyboard),
398+
Paste: cloudflare.TeamsTeamsBISOAdminControlSettingsValue(paste),
399+
Printing: cloudflare.TeamsTeamsBISOAdminControlSettingsValue(printing),
400+
Upload: cloudflare.TeamsTeamsBISOAdminControlSettingsValue(upload),
380401
}
381402
}
382403

‎internal/sdkv2provider/resource_cloudflare_teams_rules_test.go

+67
Original file line numberDiff line numberDiff line change
@@ -348,3 +348,70 @@ resource "cloudflare_zero_trust_gateway_policy" "%[1]s" {
348348
}
349349
`, rnd, accountID)
350350
}
351+
352+
func TestAccCloudflareTeamsRule_WithBisoV2(t *testing.T) {
353+
// Temporarily unset CLOUDFLARE_API_TOKEN if it is set as the Access
354+
// service does not yet support the API tokens and it results in
355+
// misleading state error messages.
356+
if os.Getenv("CLOUDFLARE_API_TOKEN") != "" {
357+
t.Setenv("CLOUDFLARE_API_TOKEN", "")
358+
}
359+
360+
rnd := generateRandomResourceName()
361+
name := fmt.Sprintf("cloudflare_zero_trust_gateway_policy.%s", rnd)
362+
363+
resource.Test(t, resource.TestCase{
364+
PreCheck: func() {
365+
testAccPreCheck(t)
366+
},
367+
ProviderFactories: providerFactories,
368+
CheckDestroy: testAccCheckCloudflareTeamsRuleDestroy,
369+
Steps: []resource.TestStep{
370+
{
371+
Config: testAccCloudflareTeamsRuleConfigWithBisoV2(rnd, accountID),
372+
Check: resource.ComposeTestCheckFunc(
373+
resource.TestCheckResourceAttr(name, consts.AccountIDSchemaKey, accountID),
374+
resource.TestCheckResourceAttr(name, "name", rnd),
375+
resource.TestCheckResourceAttr(name, "description", "desc"),
376+
resource.TestCheckResourceAttr(name, "precedence", "12302"),
377+
resource.TestCheckResourceAttr(name, "action", "isolate"),
378+
resource.TestCheckResourceAttr(name, "filters.0", "http"),
379+
resource.TestCheckResourceAttr(name, "traffic", "http.conn.src_ip == 1.2.3.4"),
380+
resource.TestCheckResourceAttr(name, "rule_settings.#", "1"),
381+
resource.TestCheckResourceAttr(name, "rule_settings.0.biso_admin_controls.0.version", "v2"),
382+
resource.TestCheckResourceAttr(name, "rule_settings.0.biso_admin_controls.0.printing", "enabled"),
383+
resource.TestCheckResourceAttr(name, "rule_settings.0.biso_admin_controls.0.copy", "remote_only"),
384+
resource.TestCheckResourceAttr(name, "rule_settings.0.biso_admin_controls.0.paste", "remote_only"),
385+
resource.TestCheckResourceAttr(name, "rule_settings.0.biso_admin_controls.0.download", "disabled"),
386+
resource.TestCheckResourceAttr(name, "rule_settings.0.biso_admin_controls.0.upload", "enabled"),
387+
resource.TestCheckResourceAttr(name, "rule_settings.0.biso_admin_controls.0.keyboard", "disabled"),
388+
),
389+
},
390+
},
391+
})
392+
}
393+
394+
func testAccCloudflareTeamsRuleConfigWithBisoV2(rnd, accountID string) string {
395+
return fmt.Sprintf(`
396+
resource "cloudflare_zero_trust_gateway_policy" "%[1]s" {
397+
name = "%[1]s"
398+
account_id = "%[2]s"
399+
description = "desc"
400+
precedence = 12302
401+
action = "isolate"
402+
filters = ["http"]
403+
traffic = "http.conn.src_ip == 1.2.3.4"
404+
rule_settings {
405+
biso_admin_controls {
406+
version = "v2"
407+
printing = "enabled"
408+
copy = "remote_only"
409+
paste = "remote_only"
410+
download = "disabled"
411+
upload = "enabled"
412+
keyboard = "disabled"
413+
}
414+
}
415+
}
416+
`, rnd, accountID)
417+
}

‎internal/sdkv2provider/schema_cloudflare_teams_rules.go

+42-6
Original file line numberDiff line numberDiff line change
@@ -310,35 +310,71 @@ var teamsAuditSSHSettings = map[string]*schema.Schema{
310310
}
311311

312312
var teamsBisoAdminControls = map[string]*schema.Schema{
313+
"version": {
314+
Type: schema.TypeString,
315+
Optional: true,
316+
Default: "v1",
317+
Description: "Indicates which version (v1 or v2) of the browser isolation controls should apply.",
318+
},
313319
"disable_printing": {
314320
Type: schema.TypeBool,
315321
Optional: true,
316-
Description: "Disable printing.",
322+
Description: "Disable printing. Only applies when version == v1.",
317323
},
318324
"disable_copy_paste": {
319325
Type: schema.TypeBool,
320326
Optional: true,
321-
Description: "Disable copy-paste.",
327+
Description: "Disable copy-paste. Only applies when version == v1.",
322328
},
323329
"disable_download": {
324330
Type: schema.TypeBool,
325331
Optional: true,
326-
Description: "Disable download.",
332+
Description: "Disable download. Only applies when version == v1.",
327333
},
328334
"disable_keyboard": {
329335
Type: schema.TypeBool,
330336
Optional: true,
331-
Description: "Disable keyboard usage.",
337+
Description: "Disable keyboard usage. Only applies when version == v1.",
332338
},
333339
"disable_upload": {
334340
Type: schema.TypeBool,
335341
Optional: true,
336-
Description: "Disable upload.",
342+
Description: "Disable upload. Only applies when version == v1.",
337343
},
338344
"disable_clipboard_redirection": {
339345
Type: schema.TypeBool,
340346
Optional: true,
341-
Description: "Disable clipboard redirection.",
347+
Description: "Disable clipboard redirection. Only applies when version == v1.",
348+
},
349+
"copy": {
350+
Type: schema.TypeString,
351+
Optional: true,
352+
Description: "Configure whether copy is enabled or not. When set with 'remote_only', copying isolated content from the remote browser to the user's local clipboard is disabled. When absent, copy is enabled. Only applies when version == v2.",
353+
},
354+
"download": {
355+
Type: schema.TypeString,
356+
Optional: true,
357+
Description: "Configure whether downloading enabled or not. When absent, downloading is enabled. Only applies when version == v2.",
358+
},
359+
"keyboard": {
360+
Type: schema.TypeString,
361+
Optional: true,
362+
Description: "Configure whether keyboard usage is enabled or not. When absent, keyboard usage is enabled. Only applies when version == v2.",
363+
},
364+
"paste": {
365+
Type: schema.TypeString,
366+
Optional: true,
367+
Description: "Configure whether pasting is enabled or not. When set with 'remote_only', pasting content from the user's local clipboard into isolated pages is disabled. When absent, paste is enabled. Only applies when version == v2.",
368+
},
369+
"printing": {
370+
Type: schema.TypeString,
371+
Optional: true,
372+
Description: "Configure whether printing is enabled or not. When absent, printing is enabled. Only applies when version == v2.",
373+
},
374+
"upload": {
375+
Type: schema.TypeString,
376+
Optional: true,
377+
Description: "Configure whether uploading is enabled or not. When absent, uploading is enabled. Only applies when version == v2.",
342378
},
343379
}
344380

0 commit comments

Comments
 (0)