[Ruleset Engine] Add raw.http.request.headers.* fields

Author: pedrosousa

src/content/fields/index.yaml

@@ -455,6 +455,68 @@ entries:
 
       **Note**: This raw field may include some basic normalization done by Cloudflare's HTTP server. However, this can change in the future.
 
+  - name: raw.http.request.headers
+    data_type: Map<Array<String>>
+    categories: [Request, Headers, Raw fields]
+    keywords: [request, client, visitor, raw]
+    summary: The HTTP request headers without any transformation represented as a Map (or associative array).
+    description: |-
+      This is the raw field version of the [`http.request.headers`](/ruleset-engine/rules-language/fields/reference/http.request.headers/) field. Raw fields, prefixed with `raw.`, preserve original request values for later evaluations. These fields are immutable during the entire request evaluation workflow, and they are not affected by the actions of previously matched rules.
+
+      When the HTTP request contains too many headers, this field may not contain all of the headers sent in the HTTP request. In this situation, the [`raw.http.request.headers.truncated`](/ruleset-engine/rules-language/fields/reference/raw.http.request.headers.truncated/) field will be set to `true`.
+    example_value: |-
+      {"content-type": ["application/json"]}
+    example_block: |-
+      any(raw.http.request.headers["content-type"][*] == "application/json")
+
+  - name: raw.http.request.headers.names
+    data_type: Array<String>
+    categories: [Request, Headers, Raw fields]
+    keywords: [request, client, visitor, raw]
+    summary: The names of the headers in the HTTP request without any transformation.
+    description: |-
+      This is the raw field version of the [`http.request.headers.names`](/ruleset-engine/rules-language/fields/reference/http.request.headers.names/) field. Raw fields, prefixed with `raw.`, preserve original request values for later evaluations. These fields are immutable during the entire request evaluation workflow, and they are not affected by the actions of previously matched rules.
+
+      When the HTTP request contains too many headers, this field may not contain the names of all of the headers sent in the HTTP request. In this situation, the [`raw.http.request.headers.truncated`](/ruleset-engine/rules-language/fields/reference/raw.http.request.headers.truncated/) field will be set to `true`.
+
+      **Note**: In HTTP/2, the names of HTTP headers are always in lowercase. Recent versions of the `curl` tool [enable HTTP/2 by default](https://curl.se/docs/manpage.html#--http2) for HTTPS connections.
+    example_value: |-
+      ["content-type"]
+    example_block: |-
+      any(raw.http.request.headers.names[*] == "content-type")
+
+  - name: raw.http.request.headers.values
+    data_type: Array<String>
+    categories: [Request, Headers, Raw fields]
+    keywords: [request, client, visitor, raw]
+    summary: The values of the headers in the HTTP request without any transformation.
+    description: |-
+      This is the raw field version of the [`http.request.headers.values`](/ruleset-engine/rules-language/fields/reference/http.request.headers.values/) field. Raw fields, prefixed with `raw.`, preserve original request values for later evaluations. These fields are immutable during the entire request evaluation workflow, and they are not affected by the actions of previously matched rules.
+
+      When the HTTP request contains too many headers, this field may not contain the values of all of the headers sent in the HTTP request. In this situation, the [`raw.http.request.headers.truncated`](/ruleset-engine/rules-language/fields/reference/raw.http.request.headers.truncated/) field will be set to `true`.
+
+      **Note**: In HTTP/2, the names of HTTP headers are always in lowercase. Recent versions of the `curl` tool [enable HTTP/2 by default](https://curl.se/docs/manpage.html#--http2) for HTTPS connections.
+    example_value: |-
+      Example 1: ["application/json"]
+      Example 2: ["This header value is longer than 10 bytes"]
+
+    example_block: |-
+      # Example 1: Check for specific header value.
+      any(raw.http.request.headers.values[*] == "application/json")
+
+      # Example 2: Match requests according to the specified operator and the length/size entered for the header value.
+      any(len(raw.http.request.headers.values[*])[*] gt 10)
+
+  - name: raw.http.request.headers.truncated
+    data_type: Boolean
+    categories: [Request, Headers, Raw fields]
+    keywords: [request, client, visitor, raw]
+    summary: Indicates whether the HTTP request contains too many headers.
+    description: |-
+      This is the raw field version of the [`http.request.headers.truncated`](/ruleset-engine/rules-language/fields/reference/http.request.headers.truncated/) field. Raw fields, prefixed with `raw.`, preserve original request values for later evaluations. These fields are immutable during the entire request evaluation workflow, and they are not affected by the actions of previously matched rules.
+
+      When `true`, [`raw.http.request.headers`](/ruleset-engine/rules-language/fields/reference/raw.http.request.headers/), [`raw.http.request.headers.names`](/ruleset-engine/rules-language/fields/reference/raw.http.request.headers.names/), and [`raw.http.request.headers.values`](/ruleset-engine/rules-language/fields/reference/raw.http.request.headers.values/) may not contain all of the headers sent in the HTTP request.
+
   - name: raw.http.response.headers
     data_type: Map<Array<String>>
     categories: [Response, Headers, Raw fields]