kanopi/firewall 2.33, and parity with drupal/basic_firewall 2.0.0-beta9

[sean-e-dietrich]

Summary

Bumps kanopi/firewall to ^2.33 (2.33.0) and brings the plugin up to parity with drupal/basic_firewall 2.x (2.0.0-beta9), porting everything the Drupal module has shipped since this plugin last caught up. Along the way it fixes several existing WordPress-side bugs where rules loaded, reported healthy, and matched nothing.

One commit per feature; each passed unit, PHPStan, PHPCS and the WordPress integration suite before it was committed.

Ported from the Drupal module

Commit	Feature	Drupal
1013bc2	kanopi/firewall 2.33.0	#74
ccbf13b	Panic file: turn the firewall down without a deploy (General screen, Site Health, Status, wp basic-firewall status)	#56, #69
938994a	Lockdown: refuse everyone but an allowlist, record nobody	#63
49d16e5	Every decision announced as basic_firewall_decision / basic_firewall_decision_{type} actions	#57
e4d50d5	Redirect and mark: validation, form fixes, request tester reporting	#62
b812ee4	Per-rule observe mode	#45
1a71712	Activity windows: awake/asleep in the rule list, multi-range hours compile correctly	#67
37c160b	Redirect handled in exception mode; rate limit docs corrected	#65
3bfa48d	Reverse-DNS crawler verification (never disabled by the offline sources flag)	#44
0c1cdbb	Composable rate limit keys, with the address/identity pairing check	#66
d641c6a	Edge signal rule type (Cloudflare / Fastly / custom CDN headers)	#73
f25e3c1	Redis block list	#51
1ccfa9e	Cache backend: files, APCu or the persistent object cache; clear-cache	#71
c2e4678	Agent corpus warm-up: wp basic-firewall warm-cache, a button, and WP-Cron after each rebuild	#72

Existing bugs fixed

• Numeric and "does not contain" conditions never matched on any rule type: gt/gte/lt/lte/not_contains compiled to operator names the library does not know. Translated at compile time, so stored rules are fixed without a re-save (d641c6a).
• Geolocation and ASN rules could not be saved from their own screen, and compiled reader keys the library never reads (aa15a6b).
• Geolocation/ASN offered variable names the library does not resolve (country_name, timezone, latitude, longitude, organization), and asn equals N never matched because the value compiled as a string. Stored rules rewritten by schema upgrade 7 and translated at compile time (9a2a351).
• Saving a user agent rule switched its detection cache off, costing ~600 ms per worker on first detection (3bfa48d).
• A new redirect rule's first save stored an empty destination (e4d50d5).
• User_Agent compiled a cache_dir key the library never read (1ccfa9e).

Deliberate differences from Drupal

• BASIC_FIREWALL_MODE really does win over the panic file (Drupal's README says so; its code does not — drupal #78).
• The lockdown allowlist refuses start-end ranges, which the library never matches (drupal #79).
• Parsed-config and list-body cache location moves only with a BASIC_FIREWALL_CACHE_DIR constant, so both evaluation paths agree (drupal #85).
• Rate limit keys stay per line rather than Drupal's rule-wide "Count by".

Bugs found in the Drupal module while porting were filed as drupal/basic_firewall #78–#81 and #83–#88.

Testing

• Unit: 154 tests. Integration (DDEV, real WordPress): 282 tests; the only warnings are the two expected short-DB_PASSWORD ones.
• composer analyse and composer lint clean.
• build/build-zip.sh builds the scoped release and verify-scope.php passes, including the new capability probes.
• Not tested against a live Redis server (DDEV has ext-redis, no server); the extension-missing paths were tested by running the suite without the extension.

Known open items

• With the wp-config.php early path active, exception mode fails open for block/challenge outcomes; whether to hand them to the mu-plugin (as marks already are) is undecided.

• An ASN referenced list with equals still cannot match (the library substitutes list values as strings) — needs an upstream change.

• Independent of Add PHP 8.5 to the matrix #4 (PHP 8.5 / CircleCI); either can merge first.

• Was AI used in this pull request?