Deleting application containing Firewall policy with irule issue

[JacobAx-OCD]

Environment

• Application Services Version:
• BIG-IP Version:

Summary

A clear and concise description of what the bug is.
Please also include information about the reproducibility and the severity/impact of the issue.

Steps To Reproduce

Steps to reproduce the behavior:

1. Submit the following declaration:

{
        "production": {
            "class": "Tenant",
            "myapplication": {
                "class": "Application",
                "myapplication_vs": {
                    "class": "Service_HTTPS",
                    "virtualAddresses": [
                        "10.0.0.1"
                    ],
                    "virtualPort": 443,
                    "serverTLS": {
                        "bigip": "/Common/clientssl"
                    }
                },
                "psp_dg": {
                    "keyDataType": "string",
                    "records": [
                        {
                            "key": "lol",
                            "value": "hi"
                        }
                    ],
                    "class": "Data_Group"
                },
                "rule1_iRule": {
                    "class": "iRule",
                    "iRule": "\nwhen HTTP_REQUEST {\n\nlog local0. \"hi from irule\"\n\n}"
                },
                "rule1_source_address_list": {
                    "class": "Firewall_Address_List",
                    "addresses": [
                        "127.0.0.1"
                    ]
                },
                "rule2_destination_address_list": {
                    "class": "Firewall_Address_List",
                    "addresses": [
                        "10.0.0.1"
                    ]
                },
                "rule2_destination_port_list": {
                    "class": "Firewall_Port_List",
                    "ports": [
                        443
                    ]
                },
                "rule3_destination_address_list": {
                    "class": "Firewall_Address_List",
                    "addresses": [
                        "10.0.0.1"
                    ]
                },
                "rule3_destination_port_list": {
                    "class": "Firewall_Port_List",
                    "ports": [
                        443
                    ]
                },
                "myapplication_firewall_policy": {
                    "class": "Firewall_Policy",
                    "rules": [
                        {
                            "name": "rule1",
                            "action": "accept",
                            "protocol": "tcp",
                            "iRule": {
                                "use": "rule1_iRule"
                            },
                            "source": {
                                "addressLists": [
                                    {
                                        "use": "rule1_source_address_list"
                                    }
                                ]
                            }
                        },
                        {
                            "name": "rule2",
                            "action": "drop",
                            "protocol": "tcp",
                            "destination": {
                                "addressLists": [
                                    {
                                        "use": "rule2_destination_address_list"
                                    }
                                ],
                                "portLists": [
                                    {
                                        "use": "rule2_destination_port_list"
                                    }
                                ]
                            }
                        },
                        {
                            "name": "rule3",
                            "action": "drop",
                            "protocol": "tcp",
                            "destination": {
                                "addressLists": [
                                    {
                                        "use": "rule3_destination_address_list"
                                    }
                                ],
                                "portLists": [
                                    {
                                        "use": "rule3_destination_port_list"
                                    }
                                ]
                            }
                        },
                        {
                            "name": "default_reject",
                            "action": "drop"
                        }
                    ]
                }
            }
        },
        "class": "ADC",
        "schemaVersion": "3.52.0",
        "id": "1729751105984",
        "updateMode": "selective",
        "controls": {
            "archiveTimestamp": "2024-10-24T06:25:07.673Z"
        }
    }

2. Observe the following error response:
   This is succesfull the declaration is valid

3. Now i try to delete with sending DELETE /mgmt/shared/appsvcs/declare/production
   {
   "results": [
   {
   "code": 422,
   "message": "declaration failed",
   "response": "01070830:3: The iRule (/production/myapplication/rule1_iRule) cannot be deleted because it is in use by a fw_rule (rule1) in Policy (/production/myapplication/myapplication_firewall_policy).",
   "host": "localhost",
   "tenant": "production",
   "runTime": 1453,
   "declarationId": "1729751105984"
   }
   ],
   "declaration": {
   "production": {
   "class": "Tenant",
   "myapplication": {
   "class": "Application",
   "myapplication_vs": {
   "class": "Service_HTTPS",
   "virtualAddresses": [
   "10.0.0.1"
   ],
   "virtualPort": 443,
   "serverTLS": {
   "bigip": "/Common/clientssl"
   }
   },
   "psp_dg": {
   "keyDataType": "string",
   "records": [
   {
   "key": "lol",
   "value": "hi"
   }
   ],
   "class": "Data_Group"
   },
   "rule1_iRule": {
   "class": "iRule",
   "iRule": "\nwhen HTTP_REQUEST {\n\nlog local0. "hi from irule"\n\n}"
   },
   "rule1_source_address_list": {
   "class": "Firewall_Address_List",
   "addresses": [
   "127.0.0.1"
   ]
   },
   "rule2_destination_address_list": {
   "class": "Firewall_Address_List",
   "addresses": [
   "10.0.0.1"
   ]
   },
   "rule2_destination_port_list": {
   "class": "Firewall_Port_List",
   "ports": [
   443
   ]
   },
   "rule3_destination_address_list": {
   "class": "Firewall_Address_List",
   "addresses": [
   "10.0.0.1"
   ]
   },
   "rule3_destination_port_list": {
   "class": "Firewall_Port_List",
   "ports": [
   443
   ]
   },
   "myapplication_firewall_policy": {
   "class": "Firewall_Policy",
   "rules": [
   {
   "name": "rule1",
   "action": "accept",
   "protocol": "tcp",
   "iRule": {
   "use": "rule1_iRule"
   },
   "source": {
   "addressLists": [
   {
   "use": "rule1_source_address_list"
   }
   ]
   }
   },
   {
   "name": "rule2",
   "action": "drop",
   "protocol": "tcp",
   "destination": {
   "addressLists": [
   {
   "use": "rule2_destination_address_list"
   }
   ],
   "portLists": [
   {
   "use": "rule2_destination_port_list"
   }
   ]
   }
   },
   {
   "name": "rule3",
   "action": "drop",
   "protocol": "tcp",
   "destination": {
   "addressLists": [
   {
   "use": "rule3_destination_address_list"
   }
   ],
   "portLists": [
   {
   "use": "rule3_destination_port_list"
   }
   ]
   }
   },
   {
   "name": "default_reject",
   "action": "drop"
   }
   ]
   }
   }
   },
   "class": "ADC",
   "schemaVersion": "3.52.0",
   "id": "1729751105984",
   "updateMode": "selective",
   "controls": {
   "archiveTimestamp": "2024-10-24T06:25:07.673Z"
   }
   },
   "code": 422
   }

### Expected Behavior
Excpect that the as3 will delete the tenant

### Actual Behavior
A clear and concise description of what actually happens.
Please include any applicable error output.
        {
            "code": 422,
            "message": "declaration failed",
            "response": "01070830:3: The iRule (/production/myapplication/rule1_iRule) cannot be deleted because it is in use by a fw_rule (rule1) in Policy (/production/myapplication/myapplication_firewall_policy).",
            "host": "localhost",
            "tenant": "production",
            "runTime": 1453,
            "declarationId": "1729751105984"
        }

### Workaround
 Disassociate the irules manually in the policy then delete

[JacobAx-OCD]

If i remove a firewall policy rule with irule reference and remove that irule in the same update, this works.
so delete this:
{
"name": "rule1",
"action": "accept",
"protocol": "tcp",
"iRule": {
"use": "rule1_iRule"
}
and this:
"rule1_iRule": {
"class": "iRule",
"iRule": "\nwhen HTTP_REQUEST {\n\nlog local0. "hi from irule"\n\n}"
}

and send the update to F5 , this works seems like only deletion of full Firewall_Policy containing irule references is an issue