Add scoped unspecified firewall rule handling

[Steve Lee (SteveL-MSFT)]

Authoritative firewall rule reconciliation currently applies to every undeclared local rule, which can unintentionally disable or remove rules outside the direction and profiles managed by a configuration. Empty rule lists also cannot express that no local rules are permitted in a scope.

This change replaces unspecifiedRulesAction with an unspecifiedRules object containing a required action and optional direction and profiles filters. Direction and profile filters use logical AND when both are present, while profile arrays match any overlapping firewall profile, including rules applying to All. Empty rules arrays are now accepted so scoped authoritative reconciliation can operate without declared rules.

The resource version is bumped to 0.3.0 for the schema change. Rust unit tests cover scope matching and required action deserialization, and expanded Pester coverage exercises direction-only, profiles-only, combined filtering, empty lists, both destructive actions in what-if mode, and declared-rule exclusion.

Closes #1667

[Copilot]

Pull request overview

This PR updates the Microsoft.Windows/FirewallRuleList resource to make authoritative reconciliation of “unspecified” local firewall rules scoped (by optional direction and/or profiles) and to allow empty rules: [] as a valid input so “no local rules permitted in this scope” can be expressed. It also bumps the resource version to 0.3.0 to reflect the schema breaking change.

Changes:

• Replace unspecifiedRulesAction with an unspecifiedRules object containing required action plus optional direction and profiles filters.
• Allow empty rules arrays for both set and get flows, enabling scoped authoritative behavior without declared rules.
• Expand Rust unit tests and Pester coverage around scope matching, deserialization requirements, and what-if behavior.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
resources/windows_firewall/windows_firewall.dsc.resource.json	Schema update to introduce unspecifiedRules object and bump manifest version.
resources/windows_firewall/src/types.rs	Update input model to support unspecifiedRules and add deserialization test coverage.
resources/windows_firewall/src/firewall.rs	Implement scoped matching for unspecified-rule reconciliation and accept empty rules arrays.
resources/windows_firewall/tests/windows_firewall_set.tests.ps1	Add/adjust Pester tests for empty rules and scoped what-if behavior (direction/profiles/both).
resources/windows_firewall/tests/windows_firewall_get.tests.ps1	Update get tests to accept rules: [].
resources/windows_firewall/locales/en-us.toml	Remove no-longer-used “rules array cannot be empty” strings.
resources/windows_firewall/Cargo.toml	Bump crate version to 0.3.0.
Cargo.lock	Update locked version for windows_firewall to 0.3.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

😢 Code Coverage Report

Changed Code Coverage

21% (less than 70% coverage)

Metric	Value
Changed lines analyzed	301
Lines covered by tests	65
Coverage percentage	21%

🔵 Full Codebase Coverage

82% (good)

Metric	Value
Total executable lines	18653
Lines covered by tests	15350
Coverage percentage	82%

Changed code coverage measures only Rust lines added/modified in this PR.
Full codebase coverage measures all instrumented Rust lines across the project.