import { WebApplicationFirewall, REGIONAL, CLOUDFRONT } from '@aligent/cdk-waf';

// Minimal configuration
const waf = new WebApplicationFirewall(this, 'WAF', {
  wafName: 'my-application-waf',
});

// Access the WebACL ARN for use with other resources
const webAclArn = waf.webAclArn;

const waf = new WebApplicationFirewall(this, 'WAF', {
  wafName: 'php-waf',
  activate: true,
  allowedIPs: [
    '10.0.0.0/8',     // Internal network
    '203.0.113.0/24', // Office IPs
  ],
  rateLimit: 2000,
});

const waf = new WebApplicationFirewall(this, 'WAF', {
  wafName: 'nodejs-api-waf',
  activate: true,
  enablePhpRules: false,        // Disable PHP-specific rules
  enableSqlInjection: true,     // Enable SQL injection protection
  rateLimit: 1000,
  rateLimitAggregation: 'IP',   // Use source IP instead of X-Forwarded-For
});

const waf = new WebApplicationFirewall(this, 'WAF', {
  wafName: 'secure-waf',
  activate: true,
  blockedIPs: ['192.0.2.0/24'],           // Block known bad actors
  blockedIPv6s: ['2001:db8:bad::/48'],
  allowedIPs: ['10.0.0.0/8'],
  enablePhpRules: false,
  enableIpReputationList: true,           // Block IPs with poor reputation
  enableAnonymousIpList: true,            // Block VPNs, proxies, Tor
  enableSqlInjection: true,
  enableBotControl: true,                  // Note: Additional costs apply
  rateLimit: 500,
});

const waf = new WebApplicationFirewall(this, 'WAF', {
  wafName: 'cloudfront-waf',
  scope: CLOUDFRONT,  // Must be deployed in us-east-1
  activate: true,
  rateLimit: 5000,
});

// Use with CloudFront
new cloudfront.Distribution(this, 'Distribution', {
  webAclId: waf.webAclArn,
  // ... other config
});

const waf = new WebApplicationFirewall(this, 'WAF', {
  wafName: 'alb-waf',
  scope: REGIONAL,
  activate: true,
  associations: [alb.loadBalancerArn],
  rateLimit: 1000,
});