feat: add Sangfor AF service adapter

services/bin/octobus-tentacles.js

@@ -165,6 +165,10 @@ const services = {
     entryFile: "../ruijie__behavior_firewall_r2-3-2-t0/bin/ruijie-behavior-firewall-r2-3-2-t0.js",
     serviceModule: "../ruijie__behavior_firewall_r2-3-2-t0/src/service.js",
   },
+  "sangfor-af-v8-0-35r1": {
+    entryFile: "../sangfor__af_v8-0-35r1/bin/sangfor-af-v8-0-35r1.js",
+    serviceModule: "../sangfor__af_v8-0-35r1/src/service.js",
+  },
   "sangfor-fw-v8-0-45": {
     entryFile: "../sangfor__fw_v8-0-45/bin/sangfor-fw-v8-0-45.js",
     serviceModule: "../sangfor__fw_v8-0-45/src/service.js",

services/bin/sangfor-af-v8-0-35r1.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { fileURLToPath } from "node:url";
+import { runServiceMain } from "@chaitin-ai/octobus-sdk";
+
+import { service } from "../sangfor__af_v8-0-35r1/src/service.js";
+
+runServiceMain(service, {
+  entryFile: fileURLToPath(new URL("../sangfor__af_v8-0-35r1/bin/sangfor-af-v8-0-35r1.js", import.meta.url)),
+});

services/package.json

@@ -67,7 +67,8 @@
     "volcengine-cloud-firewall": "bin/volcengine-cloud-firewall.js",
     "wangsu-label-ip": "bin/wangsu-label-ip.js",
     "wd-k01": "bin/wd-k01.js",
-    "opencti": "bin/opencti.js"
+    "opencti": "bin/opencti.js",
+    "sangfor-af-v8-0-35r1": "bin/sangfor-af-v8-0-35r1.js"
   },
   "files": [
     "bin/alibaba-cloud-simple-application-server-firewall.js",
@@ -197,7 +198,9 @@
     "fofa__network-space-mapper",
     "wangsu__label-ip",
     "scripts",
-    "bin/octobus-tentacles.js"
+    "bin/octobus-tentacles.js",
+    "bin/sangfor-af-v8-0-35r1.js",
+    "sangfor__af_v8-0-35r1"
   ],
   "scripts": {
     "validate": "node scripts/validate-service-package.mjs",

services/sangfor__af_v8-0-35r1/README.md

@@ -0,0 +1,153 @@
+# Sangfor AF 8.0.35R1
+
+OctoBus service adapter for Sangfor AF 8.0.35R1 black/white list entries.
+
+## Supported capabilities
+
+This first version supports the unified Sangfor AF black/white list API:
+
+- `ListWhiteBlackListEntries` — list blacklist or whitelist entries
+- `GetWhiteBlackListEntry` — get one entry
+- `CreateWhiteBlackListEntry` — create one entry
+- `DeleteWhiteBlackListEntry` — delete one entry
+
+Blacklist and whitelist are selected with `type`:
+
+- `BLACK` — blacklist
+- `WHITE` — whitelist
+
+Batch create, batch delete, update, batch update, and clear-all custom entries are intentionally not included in this first version.
+
+## Authentication
+
+The adapter logs in with username/password:
+
+```text
+POST /api/v1/namespaces/{namespace}/login
+```
+
+Sangfor AF returns `data.loginResult.token`. Business requests send the token as:
+
+```text
+Cookie: token=<token>
+```
+
+Tokens, passwords, and cookies must not be committed or included in PR evidence.
+
+## Config
+
+```json
+{
+  "host": "https://af.example.test",
+  "namespace": "public",
+  "timeoutMs": 10000,
+  "skipTlsVerify": false
+}
+```
+
+- `host`: direct Sangfor AF base URL. The formal target is direct device access, not an external proxy.
+- `namespace`: Sangfor AF API namespace. Defaults to `public`.
+- `timeoutMs`: upstream timeout in milliseconds.
+- `skipTlsVerify`: set to `true` only for controlled test devices with self-signed certificates.
+
+## Secret
+
+```json
+{
+  "username": "<af-username>",
+  "password": "<af-password>"
+}
+```
+
+## Example requests
+
+List whitelist entries:
+
+```json
+{
+  "type": "WHITE",
+  "start": 0,
+  "length": 100
+}
+```
+
+List blacklist entries:
+
+```json
+{
+  "type": "BLACK",
+  "start": 0,
+  "length": 100
+}
+```
+
+Create a controlled blacklist test entry:
+
+```json
+{
+  "url": "198.51.100.203",
+  "type": "BLACK",
+  "enable": true,
+  "description": "octobus-test-delete-me"
+}
+```
+
+Delete the controlled test entry:
+
+```json
+{
+  "url": "198.51.100.203",
+  "type": "BLACK"
+}
+```
+
+## Risk boundary
+
+Risk classification: `writable`.
+
+This adapter can create and delete single black/white list entries. It does not expose batch operations or clear-all operations. For write validation, use a dedicated test object and delete it after verification.
+
+Create defaults:
+
+- `enable`: defaults to `true`
+- `type`: required, `BLACK` or `WHITE`
+- rollback path: call `DeleteWhiteBlackListEntry` with the same `url` and `type`
+
+## Suggested capset
+
+Default operational capset:
+
+- `ListWhiteBlackListEntries`
+- `GetWhiteBlackListEntry`
+
+Controlled operation capset:
+
+- add `CreateWhiteBlackListEntry`
+- add `DeleteWhiteBlackListEntry`
+
+Only expose write methods to agents that are allowed to change AF black/white list entries.
+
+## Validation
+
+Local checks:
+
+```bash
+cd services
+npm run validate -- --service-dir sangfor__af_v8-0-35r1
+npm test -- --service-dir sangfor__af_v8-0-35r1
+npm run pack:check
+```
+
+Live validation performed during development through an approved test path confirmed:
+
+- login returned AF `code: 0`
+- whitelist list returned AF `code: 0` and 28 entries
+- blacklist list returned AF `code: 0` and 0 entries
+
+The proxy cookie used for the development test path is not part of this adapter design. Production usage should configure `host` as a direct Sangfor AF device base URL.
+
+## Known limitations
+
+- Only Sangfor AF 8.0.35R1 black/white list entry APIs are covered.
+- Batch operations and clear-all operations are intentionally omitted.
+- The adapter returns Sangfor AF business fields useful to operators and does not expose the raw upstream response body.

services/sangfor__af_v8-0-35r1/bin/sangfor-af-v8-0-35r1.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { fileURLToPath } from 'node:url';
+import { runServiceMain } from '@chaitin-ai/octobus-sdk';
+
+import { service } from '../src/service.js';
+
+runServiceMain(service, {
+  entryFile: fileURLToPath(import.meta.url),
+});

services/sangfor__af_v8-0-35r1/config.schema.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "required": [
+    "host"
+  ],
+  "properties": {
+    "host": {
+      "type": "string",
+      "description": "Direct Sangfor AF base URL such as https://192.0.2.10 or https://192.0.2.10:4433"
+    },
+    "namespace": {
+      "type": "string",
+      "default": "public",
+      "description": "Sangfor AF API namespace"
+    },
+    "timeoutMs": {
+      "type": "integer",
+      "default": 10000,
+      "minimum": 1,
+      "description": "Upstream request timeout in milliseconds"
+    },
+    "skipTlsVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip upstream TLS certificate verification for test devices with self-signed certificates"
+    }
+  }
+}

services/sangfor__af_v8-0-35r1/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "sangfor-af-v8-0-35r1",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "bin": {
+    "sangfor-af-v8-0-35r1": "bin/sangfor-af-v8-0-35r1.js"
+  },
+  "dependencies": {
+    "@chaitin-ai/octobus-sdk": "^0.6.0",
+    "undici": "^7.16.0"
+  }
+}

services/sangfor__af_v8-0-35r1/proto/sangfor_af_v8_0_35r1.proto

@@ -0,0 +1,78 @@
+syntax = "proto3";
+
+package Sangfor_AF_V8035R1;
+
+option go_package = "miner/grpc-service/Sangfor_AF_V8035R1";
+
+service Sangfor_AF_V8035R1 {
+  rpc ListWhiteBlackListEntries(ListWhiteBlackListEntriesRequest) returns (ListWhiteBlackListEntriesResponse) {}
+  rpc GetWhiteBlackListEntry(GetWhiteBlackListEntryRequest) returns (GetWhiteBlackListEntryResponse) {}
+  rpc CreateWhiteBlackListEntry(CreateWhiteBlackListEntryRequest) returns (CreateWhiteBlackListEntryResponse) {}
+  rpc DeleteWhiteBlackListEntry(DeleteWhiteBlackListEntryRequest) returns (DeleteWhiteBlackListEntryResponse) {}
+}
+
+enum WhiteBlackListType {
+  WHITE_BLACK_LIST_TYPE_UNSPECIFIED = 0;
+  BLACK = 1;
+  WHITE = 2;
+}
+
+message WhiteBlackListEntry {
+  string url = 1;
+  WhiteBlackListType type = 2;
+  bool enable = 3;
+  int32 domain = 4;
+  bool is_default = 5;
+  string description = 6;
+  string create_time = 7;
+}
+
+message ListWhiteBlackListEntriesRequest {
+  WhiteBlackListType type = 1;
+  int32 start = 2;
+  int32 length = 3;
+  string search = 4;
+  string url = 5;
+  string description = 6;
+  string sort_by = 7;
+  string order = 8;
+}
+
+message ListWhiteBlackListEntriesResponse {
+  int32 total_items = 1;
+  int32 total_pages = 2;
+  int32 page_number = 3;
+  int32 page_size = 4;
+  int32 items_offset = 5;
+  int32 item_length = 6;
+  repeated WhiteBlackListEntry items = 7;
+}
+
+message GetWhiteBlackListEntryRequest {
+  string url = 1;
+  WhiteBlackListType type = 2;
+}
+
+message GetWhiteBlackListEntryResponse {
+  WhiteBlackListEntry entry = 1;
+}
+
+message CreateWhiteBlackListEntryRequest {
+  string url = 1;
+  WhiteBlackListType type = 2;
+  optional bool enable = 3;
+  string description = 4;
+}
+
+message CreateWhiteBlackListEntryResponse {
+  WhiteBlackListEntry entry = 1;
+}
+
+message DeleteWhiteBlackListEntryRequest {
+  string url = 1;
+  WhiteBlackListType type = 2;
+}
+
+message DeleteWhiteBlackListEntryResponse {
+  WhiteBlackListEntry entry = 1;
+}

services/sangfor__af_v8-0-35r1/secret.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "required": [
+    "username",
+    "password"
+  ],
+  "properties": {
+    "username": {
+      "type": "string",
+      "description": "Sangfor AF administrator username"
+    },
+    "password": {
+      "type": "string",
+      "description": "Sangfor AF administrator password"
+    }
+  }
+}

services/sangfor__af_v8-0-35r1/service.json

@@ -0,0 +1,41 @@
+{
+  "schema": "chaitin.octobus.service.v1",
+  "name": "sangfor-af-v8-0-35r1",
+  "displayName": "Sangfor AF 8.0.35R1",
+  "description": "OctoBus package for Sangfor AF 8.0.35R1 black/white list query, create, and delete APIs.",
+  "runtime": {
+    "mode": "long-running"
+  },
+  "proto": {
+    "roots": [
+      "proto"
+    ],
+    "files": [
+      "proto/sangfor_af_v8_0_35r1.proto"
+    ]
+  },
+  "configSchema": "config.schema.json",
+  "secretSchema": "secret.schema.json",
+  "sdk": {
+    "cli": {
+      "commands": {
+        "Sangfor_AF_V8035R1.Sangfor_AF_V8035R1/ListWhiteBlackListEntries": {
+          "name": "list-white-black-list-entries",
+          "description": "List Sangfor AF blacklist or whitelist entries."
+        },
+        "Sangfor_AF_V8035R1.Sangfor_AF_V8035R1/GetWhiteBlackListEntry": {
+          "name": "get-white-black-list-entry",
+          "description": "Get one Sangfor AF blacklist or whitelist entry."
+        },
+        "Sangfor_AF_V8035R1.Sangfor_AF_V8035R1/CreateWhiteBlackListEntry": {
+          "name": "create-white-black-list-entry",
+          "description": "Create one Sangfor AF blacklist or whitelist entry."
+        },
+        "Sangfor_AF_V8035R1.Sangfor_AF_V8035R1/DeleteWhiteBlackListEntry": {
+          "name": "delete-white-black-list-entry",
+          "description": "Delete one Sangfor AF blacklist or whitelist entry."
+        }
+      }
+    }
+  }
+}