[ BUG ] deleting final rule from a rule group with `Edit-FalconFirewallGroup` requires `rule_id` of a previously deleted rule

[bherrin2]

Describe the bug
When using PSFaclson's Edit-FalconFirewallGroup to delete the final rule from a rule group you must provide the RuleId from a previously deleted rule or the command will not complete

To Reproduce
Case 1: Delete all rules
Create a rule group with 2 rules.
Create array of diff-opps and an empty array for RuleId

Edit-FalconFirewallGroup -Id $RuleGroup.id -DiffOperation $diffOpps -RuleId $RuleIDS

Will return 400 "the provided rule_ids do not match the operations (order difference is ok), expected=[], actual=[list, of, current, rule_ids]"

Case 2: Delete only rule in a rule group
Create a rule group with 1 rule or delete all but one rule from existing group
Create array of diff-opps and an empty array for RuleId

Edit-FalconFirewallGroup -Id $RuleGroup.id -DiffOperation $diffOpps -RuleId $RuleIDS

Will return 400 "the provided rule_ids do not match the operations (order difference is ok), expected=[], actual=[current rule_id]"

Expected behavior
API docs state that when deleting all rules from a rule group or the only remaining rule, RuleId should be an empty array. CrowdStrike support confirmed. Using swagger to interact directly with the api also confirms.

I would expect to be able to pass a collection of diff-ops that includes all array positions of existing rules (weather one or many) and an empty array for RuleId and have the command complete.

As it stands you cannot delete the final rule without providing a previously delted rule's rule_id

Environment (please complete the following information):

• OS: Windows 11
• PowerShell: 5.1.26100.1591
• PSFalcon: 2.2.9

Additional context
Not sure how this would work at all if a rule group were created with just a single rule

[bherrin2]

PS C:\temp> $DiffOpps = @(
  @{
    op = 'remove'
    path = '/rules/2'
  },
  @{
    op = 'remove'
    path = '/rules/1'
  },
  @{
    op = 'remove'
    path = '/rules/0'
  }
)
PS C:\temp> $RuleIDS = @()
PS C:\temp> Edit-FalconFirewallGroup -Id $RuleGroup.id -DiffOperation $diffOpps -RuleId $RuleIDS
Write-Result : {"code":400,"message":"the provided rule_ids do not match the operations (order difference is ok), expected=[], actual=[id id id]"}

[bk-cs]

The fwmgr APIs are a little different than most, in that they require all values to be supplied when making a modification to a policy/rule_group/rule/etc. instead of only the property that's being modified. When these commands were added, these were the only APIs that behaved like this.

In order to make them work like the other commands, I modified Edit-FalconFirewallGroup to retrieve the values from your existing group if they weren't supplied. I suspect that, because you're supplying an empty array, the command is adding rule_ids values to it automatically.

I'll investigate later this week. I think there will need to be a condition along the lines of "if rule_ids is empty and diff_op is not delete, retrieve existing rule_ids".