apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: clinic-block-cluster-scan-script
  annotations:
    kubernetes.io/ingress.class: kong-prod-cloud
plugin: pre-function
config:
  access:
    - |
      local path = kong.request.get_path()
      if path ~= "/clinic/api/v1/dashboard/clusters" then
        return
      end

      local ua = kong.request.get_header("user-agent") or ""
      local page = tonumber(kong.request.get_query_arg("page") or "1") or 1
      local limit = tonumber(kong.request.get_query_arg("limit") or "0") or 0
      local show_deleted = kong.request.get_query_arg("show_deleted") or ""
      local cluster_status = kong.request.get_query_arg("cluster_status") or ""
      local query = kong.request.get_query_arg("query")
      local cluster_id = kong.request.get_query_arg("cluster_id")

      local is_scan = ua:find("Python%-urllib")
        and show_deleted == "false"
        and cluster_status == "active"
        and limit >= 100
        and page >= 1000
        and not query
        and not cluster_id

      if is_scan then
        return kong.response.exit(403, { message = "cluster list scan blocked" })
      end