fix(cloudflare): stop the rate limiting action defaulting on a replacing update

Making action required on update_rate_limit_rule was only half the fix: the
Action dropdown still seeded block for the update operation too, so an update
that edited only the threshold kept sending block and converted a live log or
challenge rule into a hard block — exactly the harm the required flag was
meant to prevent. The update now has its own control with no seeded value, so
the action is something the caller states rather than inherits.

The certificate status filter also still offered Active and Pending, which
Cloudflare does not document for that endpoint; the only documented value is
all, and omitting it returns active packs.

Author: waleedlatif1

apps/sim/blocks/blocks/cloudflare.ts

@@ -35,7 +35,7 @@ const SUBBLOCK_ALIASES: Record<string, Record<string, string>> = {
   purge_cache: { tags: 'purgeTags' },
   create_ruleset: { name: 'rulesetName' },
   create_rate_limit_rule: { action: 'rateLimitAction' },
-  update_rate_limit_rule: { action: 'rateLimitAction' },
+  update_rate_limit_rule: { action: 'updateRateLimitAction' },
   create_access_application: { type: 'appType', tags: 'accessAppTags' },
   update_access_application: { type: 'appType', tags: 'accessAppTags' },
   list_access_applications: { name: 'listNameFilter', domain: 'accessAppDomainFilter' },
@@ -801,9 +801,8 @@ export const CloudflareBlock: BlockConfig<CloudflareResponse> = {
       title: 'Status Filter',
       type: 'dropdown',
       options: [
-        { label: 'All', id: 'all' },
-        { label: 'Active', id: 'active' },
-        { label: 'Pending', id: 'pending' },
+        { label: 'All statuses', id: 'all' },
+        { label: 'Active only', id: '' },
       ],
       value: () => 'all',
       condition: { field: 'operation', value: 'list_certificates' },
@@ -1346,10 +1345,27 @@ Return ONLY the JSON array - no explanations, no markdown fences.`,
         { label: 'Log', id: 'log' },
       ],
       value: () => 'block',
-      condition: {
-        field: 'operation',
-        value: ['create_rate_limit_rule', 'update_rate_limit_rule'],
-      },
+      condition: { field: 'operation', value: 'create_rate_limit_rule' },
+    },
+    {
+      /**
+       * The update endpoint replaces the rule, so a seeded action would rewrite
+       * whatever the rule currently does the moment anything else is edited.
+       * This control carries no default: the user has to state the action the
+       * replaced rule should end up with.
+       */
+      id: 'updateRateLimitAction',
+      title: 'Action',
+      type: 'dropdown',
+      options: [
+        { label: 'Block', id: 'block' },
+        { label: 'Managed Challenge', id: 'managed_challenge' },
+        { label: 'JS Challenge', id: 'js_challenge' },
+        { label: 'Interactive Challenge', id: 'challenge' },
+        { label: 'Log', id: 'log' },
+      ],
+      required: true,
+      condition: { field: 'operation', value: 'update_rate_limit_rule' },
     },
     {
       id: 'expression',
@@ -2511,6 +2527,10 @@ Return ONLY the JSON array - no explanations, no markdown fences.`,
       type: 'string',
       description: 'Action applied once a rate limit is exceeded',
     },
+    updateRateLimitAction: {
+      type: 'string',
+      description: 'Action a replaced rate limiting rule ends up applying',
+    },
     content: { type: 'string', description: 'DNS record content' },
     ttl: { type: 'number', description: 'Time to live in seconds' },
     proxied: { type: 'boolean', description: 'Whether Cloudflare proxy is enabled' },

apps/sim/tools/cloudflare/cloudflare.test.ts

@@ -101,13 +101,28 @@ describe('subBlock ids that share a tool param keep their own default', () => {
     expect(mapped.action).toBeUndefined()
   })
 
-  it('keeps the block default on the rate limiting operations', () => {
+  it('keeps the block default when creating a rate limiting rule', () => {
     expect(mapFor('create_rate_limit_rule', { zoneId: 'zone1', rulesetId: 'rs1' }).action).toBe(
       'block'
     )
+  })
+
+  it('never seeds an action onto a rate limiting rule it is about to replace', () => {
+    // The update endpoint replaces the rule, so a seeded block would convert a
+    // live log or challenge rule into a hard block the moment anything else is
+    // edited. The user has to state the action instead.
     expect(
       mapFor('update_rate_limit_rule', { zoneId: 'zone1', rulesetId: 'rs1', ruleId: 'r1' }).action
-    ).toBe('block')
+    ).toBeUndefined()
+
+    expect(
+      mapFor('update_rate_limit_rule', {
+        zoneId: 'zone1',
+        rulesetId: 'rs1',
+        ruleId: 'r1',
+        updateRateLimitAction: 'log',
+      }).action
+    ).toBe('log')
   })
 
   it('strips the aliased control ids so they never reach a tool as params', () => {
@@ -119,6 +134,7 @@ describe('subBlock ids that share a tool param keep their own default', () => {
       'certificateStatus',
       'appType',
       'rateLimitAction',
+      'updateRateLimitAction',
       'rulesetName',
       'zoneNameFilter',
       'zoneType',