feat(wafv2): scaffold full 55-op JSON 1.1 control plane

[vieiralucas]

Summary

Adds AWS WAF v2 as fakecloud's 32nd service with the full 55-op JSON 1.1 control plane. 100% conformance.

• Resource CRUD (Web ACLs / Rule Groups / IP Sets / Regex Pattern Sets) with LockToken optimistic concurrency that rotates on every mutation; stale tokens get `WAFOptimisticLockException`.
• Web ACL <-> resource associations with `WAFAssociatedItemException` blocking delete-while-associated.
• CheckCapacity computes WCU as recursive count of statement leaves through `AndStatement` / `OrStatement` / `NotStatement`.
• API keys with deterministic base64 payload that round-trips `TokenDomains`.
• Logging configurations, permission policies, tags, managed rule catalog, mobile SDK release lookups.
• Both `REGIONAL` and `CLOUDFRONT` scope; ARN segment reflects scope.
• Wires `AWSWAF_*` X-Amz-Target dispatch, server registration, reset, testkit SDK client, audit mapping (also adds the missing ACM audit mapping).

Test plan

• `cargo build --workspace`
• `cargo clippy --workspace --all-targets -- -D warnings`
• `cargo fmt --all`
• `cargo test -p fakecloud-e2e --test wafv2` (15 tests pass)
• `cargo test -p fakecloud-conformance --test wafv2` (55 tests pass)
• Conformance baseline: 2141/2141 wafv2 (100%) — full Smithy parity
• README + website _index.md + new wafv2 service page + service-map.json + scripts/update-aws-models.sh updated
• No moto refs, no Co-Authored-By, ASCII arrows

---

Summary by cubic

Add AWS WAF v2 as the 32nd service with the full 55-operation JSON 1.1 control plane. 100% conformance, with accurate target dispatch and CloudFront ARN formatting.

• New Features

  • Full CRUD for Web ACLs, Rule Groups, IP Sets, and Regex Pattern Sets with LockToken optimistic concurrency and association-safe deletes.
  • Web ACL associations (Associate/Disassociate/Get/List), plus delete-while-referenced protection and scope-aware ARNs for REGIONAL and CLOUDFRONT.
  • CheckCapacity WCU computation and capacity enforcement in Create/UpdateRuleGroup.
  • API keys (Create/Delete/GetDecrypted/List) with deterministic base64 payload that round-trips TokenDomains.
  • Logging configs (Put/Get/Delete/List), permission policies, and tags.
  • Managed rule catalog discovery (List/Describe/Get) and vendor publishing no-ops that rotate lock tokens.
  • Mobile SDK release lookups and observability stubs (empty but shape-correct responses).
  • JSON 1.1 AWSWAF_20190729 target dispatch; legacy WAF Classic targets are not routed here.

• Bug Fixes

  • Match AWSWAF_20190729 exactly in target parsing to avoid capturing WAF Classic.
  • CLOUDFRONT-scope ARNs now use us-east-1 as the region segment to match AWS.
  • Docs: corrected smoke-test note about where WCU Capacity appears.

^{Written for commit 31c195a. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 0.45274% with 1759 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-wafv2/src/service.rs	0.00%	1746 Missing ⚠️
crates/fakecloud-server/src/reset.rs	27.27%	8 Missing ⚠️
crates/fakecloud-server/src/main.rs	0.00%	5 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

3 issues found across 24 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-core/src/protocol.rs">

<violation number="1" location="crates/fakecloud-core/src/protocol.rs:377">
P2: Match the WAFV2 target version exactly; this prefix also captures WAF Classic requests and routes them to the wrong service.</violation>
</file>

<file name="crates/fakecloud-wafv2/src/service.rs">

<violation number="1" location="crates/fakecloud-wafv2/src/service.rs:1763">
P2: CLOUDFRONT-scope ARNs are generated with an empty region field instead of `us-east-1`. Real AWS WAF v2 CLOUDFRONT ARNs always use `us-east-1` as the region segment (e.g., `arn:aws:wafv2:us-east-1:ACCOUNT:global/webacl/…`). Any client that parses the region out of these ARNs will get an empty string.</violation>
</file>

<file name="website/content/docs/services/wafv2.md">

<violation number="1" location="website/content/docs/services/wafv2.md:44">
P3: The `list-web-acls` command does not return the `Capacity` (WCU) field, making this comment inaccurate.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}