| - `CreateCacheRule` / `UpdateCacheRule` - Cache rules |
| - `CreateWafRule` / `UpdateWafRule` - WAF custom rules |
| - `CreateRatePlanRule` - Rate limiting rules |
| - `CreateRewriteUrlRule` / `UpdateRewriteUrlRule` - URL rewrite rules |
| - Origin rules, redirect rules, header modification rules, etc. |
| ### Expression format |
| ``` |
| (condition) |
| (condition1 and condition2) |
| (condition1) or (condition2) |
| ``` |
| Max nesting depth: **2 levels**. |
| ### Operator syntax - two styles |
| **Infix style** (operator between field and value): |
| ``` |
| (field eq "value") |
| (field ne "value") |
| (field contains "value") |
| (field in {"value1" "value2"}) |
| (field matches "regex") |
| ``` |
| **Function style** (operator wraps field): |
| ``` |
| (starts_with(field, "value")) |
| (ends_with(field, "value")) |
| (exists(field)) |
| (len(field) gt 100) |
| (lower(field) eq "value") |
| ``` |
| ### Common patterns |
| ```bash |
| # Match file extension |
| --Rule '(http.request.uri.path.extension eq "html")' |
| # Match multiple extensions |
| --Rule '(http.request.uri.path.extension in {"js" "css" "png" "jpg"})' |
| # Match URL prefix |
| --Rule '(starts_with(http.request.uri, "/api/"))' |
| # Match URL suffix |
| --Rule '(ends_with(http.request.uri, ".html"))' |
| # Match URL containing substring (value MUST start with /) |
| --Rule '(http.request.uri contains "/test")' |
| # Match specific host |
| --Rule '(http.host eq "www.example.com")' |
| # Combined conditions |
| --Rule '(http.request.uri contains "/test" and ip.geoip.country eq "CN")' |
| # Match by country |
| --Rule '(ip.geoip.country eq "CN")' |
| # Exclude path |
| --Rule '(not starts_with(http.request.uri, "/admin/"))' |
| # Negating set membership |
| --Rule '(not http.host in {"a.com" "b.com"})' |
| ``` |
| ### Key Gotchas |
| 1. `ends_with` and `starts_with` must use **function-call syntax**, NOT infix. |
| 2. `matches` (regex) requires **standard plan or above**; basic plan returns `RuleRegexQuotaCheckFailed`. |
| 3. `contains` with URI must include path separator: `"/test"` is correct; `"test"` alone causes `CompileRuleError`. |
| 4. List values in `in` operator are **space-separated** inside braces: `{"a.com" "b.com"}`. |
| 5. Outer parentheses are **optional** for single conditions. |
| 6. Use `ne` for "not equal", **never** use `not...eq`. |
| 7. Use `not...in` for negating set membership (not before field), not `not in`. |
| ### Plan Limitations |
| | Plan | eq/ne/in/starts_with/ends_with | contains | matches (regex) | |
| |------|-------------------------------|----------|----------------| |
| | Basic | Supported | Supported | Not supported | |
| | Standard | Supported | Supported | Supported | |
| | Enterprise | Supported | Supported | Supported | |
