@automattic/vip 4.1.5 → 4.1.6

package/cmd/vip-next/commands/db_phpmyadmin.go

@@ -1,122 +0,0 @@
-package commands
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"time"
-
-	"github.com/fatih/color"
-	"github.com/pkg/browser"
-	"github.com/spf13/cobra"
-
-	"github.com/Automattic/vip/internal/appctx"
-	"github.com/Automattic/vip/internal/phpmyadmin"
-)
-
-// openURLFn is a package-level seam so tests can avoid actually opening
-// the user's browser when exercising the default (non --print) path.
-// Production wires browser.OpenURL.
-var openURLFn = browser.OpenURL
-
-// DBPhpmyadminCmd returns `vip db phpmyadmin`. Node parity:
-// src/bin/vip-db-phpmyadmin.ts + src/commands/phpmyadmin.ts. The actual
-// three-op enable+poll+generate flow lives in internal/phpmyadmin; this
-// command just resolves --print / --silent and dispatches.
-func DBPhpmyadminCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "phpmyadmin",
-		Short: "Generate access to a read-only phpMyAdmin web interface",
-		Long: "Generate access to a read-only phpMyAdmin web interface for the environment's database.\n\n" +
-			"By default the URL is opened in your browser. Use --print to write it to stdout instead.",
-	}
-	cmd.Flags().BoolP("print", "p", false, "Print the phpMyAdmin URL to stdout instead of opening it in a browser.")
-	cmd.Flags().BoolP("silent", "s", false, "Do not print any output to the console.")
-	return buildAppEnvCmd(cmd, runDBPhpmyadmin)
-}
-
-// The phpMyAdmin timings follow the documented VIP_*_MS knob shape
-// (VIP_BACKUP_DB_INTERVAL_MS, VIP_EXPORT_SQL_INTERVAL_MS) so the 6h ceiling
-// and the 30s load-balancer settle are reachable in a test.
-
-// phpmyadminPollInterval — pollUntil's 1000ms tick (phpmyadmin.ts:217).
-func phpmyadminPollInterval() time.Duration {
-	if v := os.Getenv("VIP_PHPMYADMIN_INTERVAL_MS"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			return time.Duration(n) * time.Millisecond
-		}
-	}
-	return phpmyadmin.DefaultPollInterval
-}
-
-// phpmyadminPollTimeout — pollUntil's default 6h ceiling (utils.ts:18).
-func phpmyadminPollTimeout() time.Duration {
-	if v := os.Getenv("VIP_PHPMYADMIN_TIMEOUT_MS"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			return time.Duration(n) * time.Millisecond
-		}
-	}
-	return phpmyadmin.DefaultPollTimeout
-}
-
-// phpmyadminPostEnableWait — the 30s LB settle after a cold enable
-// (phpmyadmin.ts:219-220). An explicit 0 disables the wait entirely, which
-// is expressed to internal/phpmyadmin as a negative duration (its zero value
-// means "use the default").
-func phpmyadminPostEnableWait() time.Duration {
-	if v := os.Getenv("VIP_PHPMYADMIN_POST_ENABLE_WAIT_MS"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil {
-			if n <= 0 {
-				return -1
-			}
-			return time.Duration(n) * time.Millisecond
-		}
-	}
-	return phpmyadmin.DefaultPostEnableWait
-}
-
-func runDBPhpmyadmin(cmd *cobra.Command, args []string) error {
-	ae := appctx.FromContext(cmd.Context())
-	if ae == nil {
-		return errors.New("appctx not set; this is a wiring bug")
-	}
-	printURL, _ := cmd.Flags().GetBool("print")
-	silent, _ := cmd.Flags().GetBool("silent")
-	cfg := GetConfig()
-
-	trackEvent("phpmyadmin_command_execute", map[string]any{
-		"app": ae.App.ID,
-		"env": ae.Env.ID,
-	})
-
-	// Node prints a yellow warning that PMA sessions are read-only before
-	// kicking the progress tracker. We match that here, but on stderr to
-	// keep stdout clean for --print consumers.
-	if !silent {
-		fmt.Fprintln(cmd.ErrOrStderr(), color.YellowString(
-			"Note: PHPMyAdmin sessions are read-only. If you run a query that writes to DB, it will fail."))
-	}
-
-	res, err := phpmyadmin.Run(cmd.Context(), cfg.GQLClient, ae.App.ID, ae.Env.ID, phpmyadmin.RunOpts{
-		Silent:         silent,
-		Stderr:         cmd.ErrOrStderr(),
-		PollInterval:   phpmyadminPollInterval(),
-		PollTimeout:    phpmyadminPollTimeout(),
-		PostEnableWait: phpmyadminPostEnableWait(),
-	})
-	if err != nil {
-		trackEvent("phpmyadmin_command_error", map[string]any{"error": err.Error()})
-		return err
-	}
-	trackEvent("phpmyadmin_command_success", nil)
-
-	if printURL {
-		fmt.Fprintln(cmd.OutOrStdout(), res.URL)
-		return nil
-	}
-	if !silent {
-		fmt.Fprintln(cmd.ErrOrStderr(), "phpMyAdmin is opened in your default browser.")
-	}
-	return openURLFn(res.URL)
-}

package/cmd/vip-next/commands/db_phpmyadmin_test.go

@@ -1,277 +0,0 @@
-package commands
-
-import (
-	"bytes"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/Khan/genqlient/graphql"
-
-	"github.com/Automattic/vip/internal/phpmyadmin"
-)
-
-// phpmyadminStubServer dispatches on operationName so a single test stub can
-// answer all three ops in the enable + poll + generate flow.
-type phpmyadminStubServer struct {
-	enableBody   []byte
-	statusBody   []byte
-	generateBody []byte
-	enableHits   int32
-	statusHits   int32
-	generateHits int32
-}
-
-func (s *phpmyadminStubServer) handler(t *testing.T) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, err := io.ReadAll(r.Body)
-		if err != nil {
-			t.Errorf("read body: %v", err)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		ops := string(body)
-		switch {
-		case strings.Contains(ops, `"operationName":"EnablePhpMyAdmin"`):
-			atomic.AddInt32(&s.enableHits, 1)
-			_, _ = w.Write(s.enableBody)
-		case strings.Contains(ops, `"operationName":"PhpMyAdminStatus"`):
-			atomic.AddInt32(&s.statusHits, 1)
-			_, _ = w.Write(s.statusBody)
-		case strings.Contains(ops, `"operationName":"GeneratePhpMyAdminAccess"`):
-			atomic.AddInt32(&s.generateHits, 1)
-			_, _ = w.Write(s.generateBody)
-		default:
-			_, _ = w.Write([]byte(`{"data":null}`))
-		}
-	})
-}
-
-// setupPhpmyadminConfig swaps the openURLFn seam in addition to wiring the
-// genqlient client, so the default (non --print) branch doesn't actually
-// launch a browser. Returns a cleanup func that restores both.
-func setupPhpmyadminConfig(srv *httptest.Server, opened *string) func() {
-	c := graphql.NewClient(srv.URL+"/graphql", srv.Client())
-	prevCfg := GetConfig()
-	SetConfig(Config{GQLClient: c})
-	prevOpen := openURLFn
-	openURLFn = func(url string) error {
-		if opened != nil {
-			*opened = url
-		}
-		return nil
-	}
-	return func() {
-		SetConfig(prevCfg)
-		openURLFn = prevOpen
-	}
-}
-
-func successStub() *phpmyadminStubServer {
-	return &phpmyadminStubServer{
-		enableBody:   []byte(`{"data":{"enablePHPMyAdmin":{"success":true}}}`),
-		statusBody:   []byte(`{"data":{"app":{"environments":[{"phpMyAdminStatus":{"status":"running"}}]}}}`),
-		generateBody: []byte(`{"data":{"generatePHPMyAdminAccess":{"url":"https://pma.example/abc"}}}`),
-	}
-}
-
-func TestDBPhpmyadminPrintWritesURLToStdout(t *testing.T) {
-	stub := successStub()
-	srv := httptest.NewServer(stub.handler(t))
-	defer srv.Close()
-	var opened string
-	cleanup := setupPhpmyadminConfig(srv, &opened)
-	defer cleanup()
-
-	cmd := DBPhpmyadminCmd()
-	_ = cmd.Flags().Set("print", "true")
-	var stdout, stderr bytes.Buffer
-	cmd.SetOut(&stdout)
-	cmd.SetErr(&stderr)
-	cmd.SetContext(ctxWithAppEnv(1, 2))
-
-	if err := runDBPhpmyadmin(cmd, nil); err != nil {
-		t.Fatalf("runDBPhpmyadmin: %v", err)
-	}
-	if strings.TrimSpace(stdout.String()) != "https://pma.example/abc" {
-		t.Errorf("stdout = %q, want URL", stdout.String())
-	}
-	if opened != "" {
-		t.Errorf("--print must not open browser; got %q", opened)
-	}
-}
-
-func TestDBPhpmyadminPrintSilentSuppressesStderr(t *testing.T) {
-	stub := successStub()
-	srv := httptest.NewServer(stub.handler(t))
-	defer srv.Close()
-	cleanup := setupPhpmyadminConfig(srv, nil)
-	defer cleanup()
-
-	cmd := DBPhpmyadminCmd()
-	_ = cmd.Flags().Set("print", "true")
-	_ = cmd.Flags().Set("silent", "true")
-	var stdout, stderr bytes.Buffer
-	cmd.SetOut(&stdout)
-	cmd.SetErr(&stderr)
-	cmd.SetContext(ctxWithAppEnv(1, 2))
-
-	if err := runDBPhpmyadmin(cmd, nil); err != nil {
-		t.Fatalf("runDBPhpmyadmin: %v", err)
-	}
-	if strings.TrimSpace(stdout.String()) != "https://pma.example/abc" {
-		t.Errorf("stdout = %q, want URL even when silent", stdout.String())
-	}
-	if stderr.Len() != 0 {
-		t.Errorf("--silent must suppress stderr; got %q", stderr.String())
-	}
-}
-
-func TestDBPhpmyadminDefaultOpensBrowser(t *testing.T) {
-	stub := successStub()
-	srv := httptest.NewServer(stub.handler(t))
-	defer srv.Close()
-	var opened string
-	cleanup := setupPhpmyadminConfig(srv, &opened)
-	defer cleanup()
-
-	cmd := DBPhpmyadminCmd()
-	var stdout, stderr bytes.Buffer
-	cmd.SetOut(&stdout)
-	cmd.SetErr(&stderr)
-	cmd.SetContext(ctxWithAppEnv(1, 2))
-
-	if err := runDBPhpmyadmin(cmd, nil); err != nil {
-		t.Fatalf("runDBPhpmyadmin: %v", err)
-	}
-	if opened != "https://pma.example/abc" {
-		t.Errorf("openURLFn called with %q, want URL", opened)
-	}
-	if stdout.Len() != 0 {
-		t.Errorf("default mode must not write to stdout; got %q", stdout.String())
-	}
-	if !strings.Contains(stderr.String(), "phpMyAdmin is opened in your default browser") {
-		t.Errorf("default mode missing 'opened in your default browser' line; stderr=%q", stderr.String())
-	}
-}
-
-// TestDBPhpmyadminAlreadyRunningSkipsEnableMutation is the command-level
-// regression test for the extra enable mutation: `vip db phpmyadmin` used to
-// fire EnablePhpMyAdmin on EVERY invocation, even against an environment
-// whose phpMyAdmin was already running (phpmyadmin.ts:214-215 checks first).
-func TestDBPhpmyadminAlreadyRunningSkipsEnableMutation(t *testing.T) {
-	stub := successStub()
-	srv := httptest.NewServer(stub.handler(t))
-	defer srv.Close()
-	cleanup := setupPhpmyadminConfig(srv, nil)
-	defer cleanup()
-
-	cmd := DBPhpmyadminCmd()
-	_ = cmd.Flags().Set("print", "true")
-	var stdout, stderr bytes.Buffer
-	cmd.SetOut(&stdout)
-	cmd.SetErr(&stderr)
-	cmd.SetContext(ctxWithAppEnv(1, 2))
-
-	if err := runDBPhpmyadmin(cmd, nil); err != nil {
-		t.Fatalf("runDBPhpmyadmin: %v", err)
-	}
-	if stub.enableHits != 0 {
-		t.Errorf("EnablePhpMyAdmin fired %d times against a running environment, want 0",
-			stub.enableHits)
-	}
-}
-
-// TestPhpmyadminPollTimeoutKnob: the ceiling defaults to Node's 6h (NOT the
-// 60s Go used to hard-code) and is overridable through the same
-// VIP_*_MS knob shape as VIP_BACKUP_DB_INTERVAL_MS / VIP_EXPORT_SQL_INTERVAL_MS,
-// so the ceiling is exercisable in a test without a six-hour wait.
-func TestPhpmyadminPollTimeoutKnob(t *testing.T) {
-	if got := phpmyadminPollTimeout(); got != phpmyadmin.DefaultPollTimeout {
-		t.Errorf("phpmyadminPollTimeout() = %v, want %v", got, phpmyadmin.DefaultPollTimeout)
-	}
-	t.Setenv("VIP_PHPMYADMIN_TIMEOUT_MS", "25")
-	if got := phpmyadminPollTimeout(); got != 25*time.Millisecond {
-		t.Errorf("with knob set: %v, want 25ms", got)
-	}
-
-	if got := phpmyadminPollInterval(); got != phpmyadmin.DefaultPollInterval {
-		t.Errorf("phpmyadminPollInterval() = %v, want %v", got, phpmyadmin.DefaultPollInterval)
-	}
-	t.Setenv("VIP_PHPMYADMIN_INTERVAL_MS", "3")
-	if got := phpmyadminPollInterval(); got != 3*time.Millisecond {
-		t.Errorf("with knob set: %v, want 3ms", got)
-	}
-
-	if got := phpmyadminPostEnableWait(); got != phpmyadmin.DefaultPostEnableWait {
-		t.Errorf("phpmyadminPostEnableWait() = %v, want %v", got, phpmyadmin.DefaultPostEnableWait)
-	}
-	t.Setenv("VIP_PHPMYADMIN_POST_ENABLE_WAIT_MS", "0")
-	if got := phpmyadminPostEnableWait(); got >= 0 {
-		t.Errorf("with knob set to 0: %v, want a negative value (skip the wait)", got)
-	}
-}
-
-// TestDBPhpmyadminStopsAtPollCeiling drives the whole command against an
-// environment that never reports "running": with the ceiling knob turned
-// down the command must fail instead of polling forever.
-func TestDBPhpmyadminStopsAtPollCeiling(t *testing.T) {
-	t.Setenv("VIP_PHPMYADMIN_INTERVAL_MS", "1")
-	t.Setenv("VIP_PHPMYADMIN_TIMEOUT_MS", "30")
-	t.Setenv("VIP_PHPMYADMIN_POST_ENABLE_WAIT_MS", "0")
-	stub := &phpmyadminStubServer{
-		enableBody:   []byte(`{"data":{"enablePHPMyAdmin":{"success":true}}}`),
-		statusBody:   []byte(`{"data":{"app":{"environments":[{"phpMyAdminStatus":{"status":"pending"}}]}}}`),
-		generateBody: []byte(`{"data":null}`),
-	}
-	srv := httptest.NewServer(stub.handler(t))
-	defer srv.Close()
-	cleanup := setupPhpmyadminConfig(srv, nil)
-	defer cleanup()
-
-	cmd := DBPhpmyadminCmd()
-	_ = cmd.Flags().Set("print", "true")
-	cmd.SetOut(io.Discard)
-	cmd.SetErr(io.Discard)
-	cmd.SetContext(ctxWithAppEnv(1, 2))
-
-	done := make(chan error, 1)
-	go func() { done <- runDBPhpmyadmin(cmd, nil) }()
-	select {
-	case err := <-done:
-		const want = "Failed to enable phpMyAdmin. Please try again. If the problem persists, please contact support."
-		if err == nil || err.Error() != want {
-			t.Errorf("err = %v, want %q", err, want)
-		}
-	case <-time.After(5 * time.Second):
-		t.Fatal("runDBPhpmyadmin never returned")
-	}
-}
-
-func TestDBPhpmyadminEnableUnauthorizedReturnsPermissionMessage(t *testing.T) {
-	stub := &phpmyadminStubServer{
-		enableBody:   []byte(`{"errors":[{"message":"Unauthorized"}],"data":null}`),
-		statusBody:   []byte(`{"data":null}`),
-		generateBody: []byte(`{"data":null}`),
-	}
-	srv := httptest.NewServer(stub.handler(t))
-	defer srv.Close()
-	cleanup := setupPhpmyadminConfig(srv, nil)
-	defer cleanup()
-
-	cmd := DBPhpmyadminCmd()
-	_ = cmd.Flags().Set("print", "true")
-	cmd.SetContext(ctxWithAppEnv(1, 2))
-
-	err := runDBPhpmyadmin(cmd, nil)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	const want = "You do not have sufficient permission to access phpMyAdmin for this environment."
-	if err.Error() != want {
-		t.Errorf("error = %q, want %q", err.Error(), want)
-	}
-}

package/cmd/vip-next/commands/defensive_mode.go

@@ -1,106 +0,0 @@
-package commands
-
-import (
-	"github.com/spf13/cobra"
-
-	"github.com/Automattic/vip/internal/appctx"
-)
-
-// NewDefensiveModeCmd returns the `defensive-mode` parent with all three
-// subcommands attached. M4: root's --app/--env flags (alias-aware) replace
-// the M3 numeric ID placeholders; WithAppContext + WithEnvContext middleware
-// resolve them into the cmd.Context() AppEnv via GraphQL.
-func NewDefensiveModeCmd() *cobra.Command {
-	parent := &cobra.Command{
-		Use:   "defensive-mode",
-		Short: "Manage WAF defensive mode for an environment.",
-		Long:  "Enable, disable, or configure WAF defensive mode for an environment. Mutations on production require step-up authentication.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return cmd.Help()
-		},
-	}
-	// --non-interactive lives at root (cmd/vip-next/root.go) so the
-	// rechallenge middleware in main.go can resolve interactivity from a
-	// single source. --skip-confirmation is command-tree-local to defensive-
-	// mode because no other command has a production-confirm gate.
-	parent.PersistentFlags().Bool("skip-confirmation", false, "Skip the production confirmation prompt.")
-	// --rechallenge-wait is registered here, on the only command tree that
-	// deliberately trips step-up, matching where Node registers it
-	// (src/bin/vip-defensive-mode-{enable,disable,configure}.js). The flag is
-	// read off the raw command line by rechallenge.ShouldWaitForRechallenge
-	// rather than through cobra: the step-up middleware is constructed once at
-	// startup and has no access to a command's parsed options. Registering it
-	// is still required — otherwise cobra rejects it as an unknown flag before
-	// the middleware ever runs. VIP_RECHALLENGE_WAIT=1 does the same thing
-	// everywhere, and is what the fail-fast error points people at.
-	parent.PersistentFlags().Bool("rechallenge-wait", false,
-		"When step-up verification is required non-interactively, print the URL and wait for verification on another device instead of failing fast.")
-
-	parent.AddCommand(newDefensiveModeEnableCmd())
-	parent.AddCommand(newDefensiveModeDisableCmd())
-	parent.AddCommand(newDefensiveModeConfigureCmd())
-	return parent
-}
-
-// addAppEnvFlags registers command-LOCAL --app/--env flags carrying the -a/-e
-// shorthands Node derives for every command with appContext/envContext
-// (src/lib/cli/command.js:1075-1084 feeding createOptionDefinition).
-//
-// vip-next keeps --app/--env as root persistent flags so the @app.env alias
-// has one place to land. They cannot carry the shorthands there: dev-env
-// leaves legitimately use -a for --all/--app-code and -e for
-// --elasticsearch/--editor/--extended, and pflag panics when a persistent
-// shorthand collides with a local one. A same-named local flag is the
-// per-command registration Node actually has — cobra's mergePersistentFlags
-// skips a parent flag whose name is already present locally, and every reader
-// (root's PersistentPreRunE, appctx's app/env resolvers) goes through
-// cmd.Flag/cmd.Flags, so the local flag is the one that is read.
-func addAppEnvFlags(c *cobra.Command) {
-	if c.Flags().Lookup("app") == nil {
-		c.Flags().StringP("app", "a", "",
-			"Target an application. Accepts a string value for the application name or an integer for the application ID.")
-	}
-	if c.Flags().Lookup("env") == nil {
-		c.Flags().StringP("env", "e", "",
-			"Target an environment. Accepts a string value for the environment type.")
-	}
-}
-
-// buildAppEnvCmd wires the standard WithAppContext + WithEnvContext middleware
-// chain onto a leaf command. Shared by enable / disable / configure so the
-// handlers can read a fully resolved AppEnv from cmd.Context().
-func buildAppEnvCmd(c *cobra.Command, handler appctx.RunFunc) *cobra.Command {
-	addAppEnvFlags(c)
-	cfg := GetConfig()
-	return appctx.Build(c,
-		appctx.WithAppContext(cfg.AppCtxConfig),
-		appctx.WithEnvContext(),
-	).WithRun(handler)
-}
-
-// buildAppEnvRenderableCmd is buildAppEnvCmd's parallel for handlers that
-// return (any, error) — i.e. handlers behind WithFormat. The WithFormat
-// middleware is applied here against the handler before passing to
-// WithRenderableRun.
-func buildAppEnvRenderableCmd(c *cobra.Command, defaultFormat string, allowed []string, handler appctx.RenderableRunFunc) *cobra.Command {
-	addAppEnvFlags(c)
-	cfg := GetConfig()
-	return appctx.Build(c,
-		appctx.WithAppContext(cfg.AppCtxConfig),
-		appctx.WithEnvContext(),
-	).WithRenderableRun(
-		appctx.WithFormat(c, defaultFormat, allowed...)(handler),
-	)
-}
-
-// trackEvent is a nil-safe wrapper over cfg.Tracker.TrackEvent. Tracker is
-// non-nil in production (telemetry.NewDefault always returns a value), but
-// some tests construct a Config without a Tracker and we don't want them to
-// panic.
-func trackEvent(name string, props map[string]any) {
-	cfg := GetConfig()
-	if cfg.Tracker == nil {
-		return
-	}
-	cfg.Tracker.TrackEvent(name, props)
-}

package/cmd/vip-next/commands/defensive_mode_configure.go

@@ -1,150 +0,0 @@
-package commands
-
-import (
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-
-	"github.com/spf13/cobra"
-
-	"github.com/Automattic/vip/internal/appctx"
-	"github.com/Automattic/vip/internal/defensivemode"
-)
-
-func newDefensiveModeConfigureCmd() *cobra.Command {
-	c := &cobra.Command{
-		Use:   "configure",
-		Short: "Update the defensive mode configuration (step-up auth required).",
-		Long:  "Update the defensive mode configuration for the target environment. Use --enabled and --challenge-type as required flags.",
-	}
-	c.Flags().String("enabled", "", "Whether defensive mode should be enabled (true|false). Required.")
-	c.Flags().String("challenge-type", "", "Challenge type integer. Required.")
-	c.Flags().String("connection-threshold-absolute", "", "Absolute connection threshold.")
-	c.Flags().String("connection-threshold-percentage", "", "Connection threshold percentage.")
-	return buildAppEnvCmd(c, runDefensiveModeConfigure)
-}
-
-func runDefensiveModeConfigure(cmd *cobra.Command, args []string) error {
-	ae := appctx.FromContext(cmd.Context())
-	if ae == nil {
-		return errors.New("appctx not set; this is a wiring bug")
-	}
-	cfg := GetConfig()
-
-	skipConfirm, _ := cmd.Flags().GetBool("skip-confirmation")
-	enabledRaw, _ := cmd.Flags().GetString("enabled")
-	challengeTypeRaw, _ := cmd.Flags().GetString("challenge-type")
-	absRaw, _ := cmd.Flags().GetString("connection-threshold-absolute")
-	pctRaw, _ := cmd.Flags().GetString("connection-threshold-percentage")
-
-	// Validate flag formats first.
-	enabled, err := parseBoolean(enabledRaw)
-	if enabledRaw != "" && err != nil {
-		return fmt.Errorf("invalid value for --enabled: %s. Expected true or false", enabledRaw)
-	}
-	challengeType, err := parsePositiveInt(challengeTypeRaw)
-	if challengeTypeRaw != "" && err != nil {
-		return fmt.Errorf("invalid value for --challenge-type: %s. Expected a non-negative integer", challengeTypeRaw)
-	}
-	abs, err := parsePositiveIntPtr(absRaw)
-	if absRaw != "" && err != nil {
-		return fmt.Errorf("invalid value for --connection-threshold-absolute: %s", absRaw)
-	}
-	pct, err := parsePositiveIntPtr(pctRaw)
-	if pctRaw != "" && err != nil {
-		return fmt.Errorf("invalid value for --connection-threshold-percentage: %s", pctRaw)
-	}
-
-	// Missing-required prompt path (interactive only). The Confirm/Input
-	// helpers themselves return ErrNonInteractive in non-interactive mode,
-	// so we don't have to gate on IsInteractive here.
-	if enabledRaw == "" {
-		picked, perr := appctx.Confirm(cmd, "Enable defensive mode?", true)
-		if perr != nil {
-			return fmt.Errorf("--enabled is required: %w", perr)
-		}
-		enabled = picked
-	}
-	if challengeTypeRaw == "" {
-		raw, perr := appctx.Input(cmd, "Challenge type (integer):", "")
-		if perr != nil {
-			return fmt.Errorf("--challenge-type is required: %w", perr)
-		}
-		n, ierr := strconv.Atoi(strings.TrimSpace(raw))
-		if ierr != nil || n < 0 {
-			return fmt.Errorf("invalid challenge type %q", raw)
-		}
-		challengeType = n
-	}
-
-	// Production guard.
-	if ae.Env.Type == "production" && !skipConfirm {
-		if !appctx.IsInteractive(cmd) {
-			trackEvent("defensive_mode_configure_command_cancelled", nil)
-			return fmt.Errorf("refusing to configure defensive mode on production without --skip-confirmation in non-interactive mode")
-		}
-		ok, perr := appctx.Confirm(cmd,
-			fmt.Sprintf("Configure defensive mode on production for %s?", ae.App.Name), false)
-		if perr != nil || !ok {
-			trackEvent("defensive_mode_configure_command_cancelled", nil)
-			if perr != nil {
-				return perr
-			}
-			fmt.Fprintln(cmd.ErrOrStderr(), "Command cancelled")
-			return nil
-		}
-	}
-
-	input := defensivemode.UpdateConfigInput{
-		AppID:                         ae.App.ID,
-		EnvID:                         ae.Env.ID,
-		Enabled:                       enabled,
-		ChallengeType:                 challengeType,
-		ConnectionThresholdAbsolute:   abs,
-		ConnectionThresholdPercentage: pct,
-	}
-	result, err := defensivemode.UpdateDefensiveModeConfig(cmd.Context(), cfg.GQLClient, input)
-	if err != nil {
-		return err
-	}
-	if !result.Success {
-		trackEvent("defensive_mode_configure_command_error", map[string]any{"error": result.Message})
-		return fmt.Errorf("failed to update defensive mode config: %s", result.Message)
-	}
-	trackEvent("defensive_mode_configure_command_success", nil)
-	fmt.Fprintf(cmd.OutOrStdout(), "✓ Defensive mode configuration updated for %s.%s — %s\n", ae.App.Name, ae.Env.Type, result.Message)
-	return nil
-}
-
-func parseBoolean(raw string) (bool, error) {
-	switch strings.ToLower(strings.TrimSpace(raw)) {
-	case "true", "yes", "1", "on", "enable", "enabled":
-		return true, nil
-	case "false", "no", "0", "off", "disable", "disabled":
-		return false, nil
-	}
-	return false, fmt.Errorf("unparseable boolean: %q", raw)
-}
-
-func parsePositiveInt(raw string) (int, error) {
-	if raw == "" {
-		return 0, fmt.Errorf("empty")
-	}
-	n, err := strconv.Atoi(strings.TrimSpace(raw))
-	if err != nil || n < 0 {
-		return 0, fmt.Errorf("not a non-negative integer: %q", raw)
-	}
-	return n, nil
-}
-
-func parsePositiveIntPtr(raw string) (*int, error) {
-	if raw == "" {
-		return nil, nil
-	}
-	n, err := parsePositiveInt(raw)
-	if err != nil {
-		return nil, err
-	}
-	return &n, nil
-}