From 26713b53f6006e551bfdc1a44816628dfd0e2a4b Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Mon, 20 Jul 2026 09:04:43 -0400
Subject: [PATCH] Fix #3462

---
 server/routers/resource/createResourceRule.ts | 49 +++----------
 server/routers/resource/updateResourceRule.ts | 70 ++++---------------
 2 files changed, 24 insertions(+), 95 deletions(-)

diff --git a/server/routers/resource/createResourceRule.ts b/server/routers/resource/createResourceRule.ts
index f75922722..4cb9967ed 100644
--- a/server/routers/resource/createResourceRule.ts
+++ b/server/routers/resource/createResourceRule.ts
@@ -9,16 +9,14 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import {
-    isValidCIDR,
-    isValidIP,
-    isValidUrlGlobPattern
+    RESOURCE_RULE_MATCH_TYPES,
+    getResourceRuleValueValidationError
 } from "@server/lib/validators";
 import { OpenAPITags, registry } from "@server/openApi";
-import { isValidRegionId } from "@server/db/regions";
 
 const createResourceRuleSchema = z.strictObject({
     action: z.enum(["ACCEPT", "DROP", "PASS"]),
-    match: z.enum(["CIDR", "IP", "PATH", "COUNTRY", "ASN", "REGION"]),
+    match: z.enum(RESOURCE_RULE_MATCH_TYPES),
     value: z.string().min(1),
     priority: z.int(),
     enabled: z.boolean().optional()
@@ -151,39 +149,14 @@ export async function createResourceRule(
             );
         }
 
-        if (match === "CIDR") {
-            if (!isValidCIDR(value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid CIDR provided"
-                    )
-                );
-            }
-        } else if (match === "IP") {
-            if (!isValidIP(value)) {
-                return next(
-                    createHttpError(HttpCode.BAD_REQUEST, "Invalid IP provided")
-                );
-            }
-        } else if (match === "PATH") {
-            if (!isValidUrlGlobPattern(value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid URL glob pattern provided"
-                    )
-                );
-            }
-        } else if (match === "REGION") {
-            if (!isValidRegionId(value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid region ID provided"
-                    )
-                );
-            }
+        const valueValidationError = getResourceRuleValueValidationError(
+            match,
+            value
+        );
+        if (valueValidationError) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, valueValidationError)
+            );
         }
 
         // Create the new resource rule
diff --git a/server/routers/resource/updateResourceRule.ts b/server/routers/resource/updateResourceRule.ts
index 0ca574017..5eba8aaa0 100644
--- a/server/routers/resource/updateResourceRule.ts
+++ b/server/routers/resource/updateResourceRule.ts
@@ -9,12 +9,11 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import {
-    isValidCIDR,
-    isValidIP,
-    isValidUrlGlobPattern
+    RESOURCE_RULE_MATCH_TYPES,
+    getResourceRuleValueValidationError,
+    ResourceRuleMatchType
 } from "@server/lib/validators";
 import { OpenAPITags, registry } from "@server/openApi";
-import { isValidRegionId } from "@server/db/regions";
 
 // Define Zod schema for request parameters validation
 const updateResourceRuleParamsSchema = z.strictObject({
@@ -22,15 +21,7 @@ const updateResourceRuleParamsSchema = z.strictObject({
     resourceId: z.coerce.number().int().positive()
 });
 
-const resourceRuleMatchSchema = z.enum([
-    "CIDR",
-    "IP",
-    "PATH",
-    "COUNTRY",
-    "COUNTRY_IS_NOT",
-    "ASN",
-    "REGION"
-]);
+const resourceRuleMatchSchema = z.enum(RESOURCE_RULE_MATCH_TYPES);
 
 // Define Zod schema for request body validation
 const updateResourceRuleSchema = z
@@ -173,14 +164,7 @@ export async function updateResourceRule(
             resource.resourcePolicyId === null &&
             resource.defaultResourcePolicyId !== null;
 
-        let existingMatch:
-            | "CIDR"
-            | "IP"
-            | "PATH"
-            | "COUNTRY"
-            | "COUNTRY_IS_NOT"
-            | "ASN"
-            | "REGION";
+        let existingMatch: ResourceRuleMatchType;
 
         if (isInlinePolicy) {
             const policyId = resource.defaultResourcePolicyId!;
@@ -264,42 +248,14 @@ export async function updateResourceRule(
         const { value } = updateData;
 
         if (value !== undefined) {
-            if (match === "CIDR") {
-                if (!isValidCIDR(value)) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Invalid CIDR provided"
-                        )
-                    );
-                }
-            } else if (match === "IP") {
-                if (!isValidIP(value)) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Invalid IP provided"
-                        )
-                    );
-                }
-            } else if (match === "PATH") {
-                if (!isValidUrlGlobPattern(value)) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Invalid URL glob pattern provided"
-                        )
-                    );
-                }
-            } else if (match === "REGION") {
-                if (!isValidRegionId(value)) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Invalid region ID provided"
-                        )
-                    );
-                }
+            const valueValidationError = getResourceRuleValueValidationError(
+                match,
+                value
+            );
+            if (valueValidationError) {
+                return next(
+                    createHttpError(HttpCode.BAD_REQUEST, valueValidationError)
+                );
             }
         }