#
# Copyright (c) 2026. Broadcom Inc. and its subsidiaries. All Rights Reserved.
#

extend type Query {
  "Get all Firewall Rules"
  firewallRules: [FirewallRule!]!
  "Get the Firewall Rule by goid"
  firewallRuleByGoid(goid : ID!) : FirewallRule
  "Get the Firewall Rule with the given name"
  firewallRuleByName(name : String!) : FirewallRule
  "Get filtered Firewall Rules"
  firewallRulesByFilters(filters: [EntityFilterInput!]!): [FirewallRule!]!
}

extend type Mutation {
  """
  Create or update existing firewall rules.  If a firewall rule with the given name does not
  exist, one will be created, otherwise the existing one will be updated. This returns the list of
  entities created and/or updated
  """
  setFirewallRules(input: [FirewallRuleInput!]!): FirewallRulesPayload!

  """
  Update an existing firewall rule. Match is carried by refInput
  """
  updateFirewallRule(refInput: FirewallRuleRefInput!, input: FirewallRulePartialInput!): FirewallRulePayload!

  """
  Update an existing firewall rule with new properties. Match is carried by refInput.
  If a property is new, it will be added; if the value is new, it will be updated.
  If only the property name is specified without a value, the property will be deleted.
  Providing empty input properties will preserve the current properties and will not delete any existing ones.
  """
  updateFirewallRuleProperties(refInput: FirewallRuleRefInput!, properties: [EntityPropertyPartialInput!]!): FirewallRulePayload!

  "Delete existing firewall rules"
  deleteFirewallRules(refInputs: [FirewallRuleRefInput!]!): FirewallRulesPayload!
}

"""
A firewall rule configuration.
> @l7-entity
> @l7-identity-fields name
> @l7-summary-fields goid,name,ordinal,enabled,checksum
> @l7-excluded-fields
> @l7-name-fields name
"""
type FirewallRule {
    "The goid for the firewall rule"
    goid : ID!
    "The name of the firewall rule (unique identifier)"
    name : String!
    "The ordinal position of the rule (execution order, lower numbers execute first)"
    ordinal : Int!
    "Whether the rule is enabled (true=active, false=disabled)"
    enabled : Boolean!
    "The configuration checksum of this firewall rule"
    checksum: String!
    """
    The protocol for the rule
    Possible values: tcp, udp, icmp, all, esp, ah, sctp, or any valid protocol name
    """
    protocol : String
    """
    The destination port
    Formats:
    - Single port: "80", "443", "8080"
    - Port range: "8000:9000", "1024:65535"
    - Negated: "!80", "!443"
    Range: 1-65535
    """
    port : String
    """
    The action/target for the rule
    Common values: ACCEPT, DROP, REJECT, REDIRECT, DNAT, SNAT, LOG, MASQUERADE
    """
    action : String
    """
    The interface tag name or IP address
    Examples: eth0, eth1, lo, wlan0, 192.168.1.1
    Special value: (ALL) for all interfaces
    """
    interfaceTagName : String
    """
    Additional properties for the firewall rule
    Common properties:
    - chain: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING
    - table: filter, nat, mangle, raw
    - source: source IP address/CIDR (e.g., 192.168.1.0/24)
    - destination: destination IP address/CIDR
    - source-port: source port number or range
    - tcp-flags: TCP flags to match (e.g., SYN,ACK,FIN,RST SYN)
    - tcp-option: TCP option number
    - icmp-type: ICMP type number or name
    - to-ports: redirect target port (for REDIRECT action)
    - to-destination: DNAT target IP:port (for DNAT action)
    """
    properties : [EntityProperty!]
}

"The inputs sent with the setFirewallRule Mutation"
input FirewallRuleInput {
   "The goid for the firewall rule"
    goid : ID
    "The name of the firewall rule"
    name : String!
    "The ordinal position of the rule"
    ordinal : Int!
    "Whether the rule is enabled"
    enabled : Boolean!
    """
    The protocol for the rule (optional)
    Possible values: tcp, udp, icmp, all, esp, ah, sctp, or any valid protocol name
    """
    protocol : String
    """
    The destination port (optional)
    Formats: Single port ("80"), Port range ("8000:9000"), Negated ("!80")
    Range: 1-65535
    """
    port : String
    """
    The action/target for the rule (optional)
    Common values: ACCEPT, DROP, REJECT, REDIRECT, DNAT, SNAT, LOG, MASQUERADE
    """
    action : String
    """
    The interface tag name or IP address (optional)
    Examples: eth0, eth1, lo, wlan0, 192.168.1.1
    """
    interfaceTagName : String
    """
    Additional properties for the firewall rule (optional)
    Common properties:
    - chain: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING (required for most rules)
    - table: filter, nat, mangle, raw (default: filter)
    - source: source IP/CIDR (e.g., "192.168.1.0/24", "!10.0.0.1")
    - destination: destination IP/CIDR
    - source-port: source port number or range
    - tcp-flags: TCP flags (e.g., "SYN,ACK,FIN,RST SYN")
    - tcp-option: TCP option number
    - icmp-type: ICMP type number or name
    - to-ports: redirect target port (for REDIRECT action)
    - to-destination: DNAT target IP:port (for DNAT action)
    """
    properties : [EntityPropertyInput!]
    "Ignored at creation time but can be used to compare bundle with gw state"
    checksum : String
}

"""
The partial inputs sent with the updateFirewallRule Mutation
All fields are optional for partial updates
"""
input FirewallRulePartialInput {
   "The goid for the firewall rule (optional)"
    goid : ID
    "The name of the firewall rule (optional)"
    name : String
    "The ordinal position of the rule (optional, execution order)"
    ordinal : Int
    "Whether the rule is enabled (optional, true=active, false=disabled)"
    enabled : Boolean
    """
    The protocol for the rule (optional)
    Possible values: tcp, udp, icmp, all, esp, ah, sctp
    """
    protocol : String
    """
    The destination port (optional)
    Formats: Single port ("80"), Port range ("8000:9000"), Negated ("!80")
    Range: 1-65535
    """
    port : String
    """
    The action/target for the rule (optional)
    Common values: ACCEPT, DROP, REJECT, REDIRECT, DNAT, SNAT, LOG, MASQUERADE
    """
    action : String
    """
    The interface tag name or IP address (optional)
    Examples: eth0, eth1, lo, wlan0, 192.168.1.1
    """
    interfaceTagName : String
    """
    Additional properties for the firewall rule (optional)
    To delete a property, provide only the name without a value
    Common properties:
    - chain: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING
    - table: filter, nat, mangle, raw
    - source: source IP/CIDR
    - destination: destination IP/CIDR
    - source-port: source port number or range
    - tcp-flags: TCP flags (e.g., "SYN,ACK,FIN,RST SYN")
    - icmp-type: ICMP type number
    - to-ports: redirect target port
    - to-destination: DNAT target IP:port
    """
    properties : [EntityPropertyInput!]
}

type FirewallRulesPayload implements EntityMutationsPayload {
    status: [EntityMutationStatus!]!
    detailedStatus: [EntityMutationDetailedStatus!]!
    firewallRules: [FirewallRule]!
}

type FirewallRulePayload implements EntityMutationPayload {
    status: EntityMutationStatus!
    detailedStatus: EntityMutationDetailedStatus!
    firewallRule: FirewallRule
}

input FirewallRuleMappingInstructionInput{
    action: EntityMutationAction!
    default: Boolean
    failOnNew: Boolean
    failOnExisting: Boolean
    nodef: Boolean
    "one or more name-value pairs to identify a FirewallRule entity uniquely"
    source: FirewallRuleRefInput
}
input FirewallRuleRefInput{
    "The firewall rule name"
    name: String!
}