feat: add f5__awaf — F5 Advanced WAF IP 管理与策略控制（iControl REST）

[qiqi-chen]

Summary

New OctoBus service package for F5 Advanced WAF (AWAF) — exposes 7 RPCs via the iControl REST API.

Closes / references #34.

RPCs

RPC	Capability	Category
Login	Authenticate, obtain session token	read
BlockIP	Add IPs to ASM policy exception list (blockRequests=always)	write
UnblockIP	Remove IPs from ASM policy exception list	write
AllowIP	Whitelist IPs in ASM policy exception list (blockRequests=never)	write
SetEnforcementMode	Switch policy between blocking / transparent	write
ListPolicies	Enumerate all ASM policies with enforcement mode	read
Logout	Invalidate session token	read

Auth Pattern

Session-based (Option A from the submission spec): explicit Login → token passed as field in every subsequent RPC → Logout.

Implementation Notes

• TLS: verify_ssl defaults to false (F5 uses self-signed certs); set true in production with a trusted CA
• Idempotency: BlockIP/AllowIP PATCH existing exceptions; UnblockIP treats already-removed IPs as success
• Apply-policy: all write operations trigger POST /mgmt/tm/asm/tasks/apply-policy (best-effort, non-fatal)
• No real device needed: 39 tests pass against a local mock HTTP server that faithfully simulates the iControl REST endpoints

Files

services/f5__awaf/
  proto/f5_awaf_v1.proto     # protobuf definitions (7 RPCs)
  src/f5-awaf.js             # handler implementations
  service.json               # OctoBus manifest + 7 CLI commands
  config.schema.json         # host/port/verify_ssl/default_policy_name
  secret.schema.json         # username/password
  test/f5-awaf.test.js       # 39 unit + integration tests
  test/mock_upstream.js      # mock iControl REST server
  README.md                  # full RPC documentation

Test Plan

• node --test test/*.test.js → 39 passed, 0 failed (no real F5 device required)
• Unit tests: mock globalThis.fetch per suite, validate error mapping and request shape
• Integration tests: real HTTP against mock_upstream.js, covers full Login→BlockIP→Logout flow
• Real-device smoke test (pending access to F5 BIG-IP hardware — runbook in README)