@faable/faable 1.40.0 → 2.1.0

package/dist/api/FaableApi.js

@@ -241,6 +241,22 @@ class FaableApi {
             headers: { 'x-faable-team': team }
         }));
     }
+    // ── per-app WAF ───────────────────────────────────────────────────────────
+    //
+    // No `x-faable-team` header on any of these: the routes are scoped by the
+    // app in the path (the server reads the team off the App row), and sending
+    // a team override would only narrow the lookup.
+    async getAppWaf(app_id) {
+        return data(this.client.get(`/app/${app_id}/waf`));
+    }
+    async addAppWafRule(app_id, params) {
+        return data(this.client.post(`/app/${app_id}/waf/rules`, params));
+    }
+    async removeAppWafRule(app_id, pattern) {
+        return data(this.client.delete(`/app/${app_id}/waf/rules`, {
+            data: { pattern }
+        }));
+    }
 }
 
 export { FaableApi };

package/dist/commands/auth/actions/create.js

@@ -3,6 +3,7 @@ import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
 import { json_option, tenant_options } from '../options.js';
 import { print_json } from '../render.js';
+import { formatTriggers } from './triggers.js';
 
 const actions_create = {
     command: 'create',
@@ -13,18 +14,12 @@ const actions_create = {
         type: 'string',
         demandOption: true,
         description: 'Action name (max 200 chars)'
-    })
-        .option('trigger', {
-        alias: 't',
-        type: 'string',
-        choices: ['post-login', 'continue', 'client-credentials'],
-        demandOption: true,
-        description: 'Trigger point (client-credentials runs on M2M token grants: no user, no redirect)'
     })
         .option('code-file', {
         alias: 'f',
         type: 'string',
-        description: 'Path to a JS file with the action code'
+        demandOption: true,
+        description: 'Path to a JS file with the action code. The triggers are derived from the hooks it exports (exports.onExecutePostLogin / onExecuteContinue / onExecuteClientCredentials)'
     })
         .option('disabled', {
         type: 'boolean',
@@ -35,27 +30,25 @@ const actions_create = {
         type: 'number',
         description: 'Execution order (lower runs first, default 0)'
     })
-        .example('$0 auth actions create -n add-claims -t post-login -f ./claims.js', 'Create a post-login action from a file')
+        .example('$0 auth actions create -n add-claims -f ./claims.js', 'Create an action from a file; its triggers follow the exported hooks')
         .showHelpOnFail(false),
     handler: withAuthHints(async (args) => {
-        let code;
-        if (args.codeFile) {
-            if (!(await fs.pathExists(args.codeFile))) {
-                throw new Error(`Code file not found: ${args.codeFile}`);
-            }
-            code = await fs.readFile(args.codeFile, 'utf8');
+        if (!(await fs.pathExists(args.codeFile))) {
+            throw new Error(`Code file not found: ${args.codeFile}`);
         }
+        const code = await fs.readFile(args.codeFile, 'utf8');
         const api = await requireAuthAdmin(args);
         const action = await api.actionCreate({
             name: args.name,
-            trigger: args.trigger,
-            ...(code !== undefined ? { code } : {}),
+            code,
             ...(args.disabled ? { enabled: false } : {}),
             ...(args.order !== undefined ? { order: args.order } : {})
+            // `trigger` is gone from the API (auth ≥ v1.58): triggers are derived
+            // from the code. Cast until the SDK types catch up with that release.
         });
         if (args.json)
             return print_json(action);
-        log.info(`✅ Created action ${action.id} (${action.name}, trigger ${action.trigger})`);
+        log.info(`✅ Created action ${action.id} (${action.name}, triggers ${formatTriggers(action)})`);
     })
 };
 

package/dist/commands/auth/actions/get.js

@@ -2,6 +2,7 @@ import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
 import { json_option, tenant_options } from '../options.js';
 import { print_json, yes_no } from '../render.js';
+import { formatTriggers } from './triggers.js';
 
 const actions_get = {
     command: 'get <action_id>',
@@ -25,7 +26,7 @@ const actions_get = {
             return print_json(action);
         log.info(`⚙️ ${action.id}`);
         log.info(`  Name:    ${action.name ?? '-'}`);
-        log.info(`  Trigger: ${action.trigger ?? '-'}`);
+        log.info(`  Triggers: ${formatTriggers(action)}`);
         log.info(`  Enabled: ${yes_no(action.enabled)}`);
         log.info(`  Order:   ${action.order ?? 0}`);
         log.info(`  Revision: ${action.revision ?? 1} (updated ${action.updatedAt ?? '-'})`);

package/dist/commands/auth/actions/list.js

@@ -3,6 +3,7 @@ import { log } from '../../../log.js';
 import { json_option, list_options, tenant_options } from '../options.js';
 import { fetch_items } from '../paging.js';
 import { print_json, yes_no, when, table_lines } from '../render.js';
+import { formatTriggers } from './triggers.js';
 
 const actions_list = {
     command: 'list',
@@ -10,7 +11,7 @@ const actions_list = {
     builder: yargs => json_option(list_options(tenant_options(yargs)))
         .option('query', {
         type: 'string',
-        description: 'FaableQL filter, e.g. "trigger:post-login"'
+        description: 'FaableQL filter, e.g. "enabled:true"'
     })
         .showHelpOnFail(false),
     handler: withAuthHints(async (args) => {
@@ -26,7 +27,7 @@ const actions_list = {
         const rows = items.map(a => [
             a.id ?? '-',
             a.name ?? '-',
-            a.trigger ?? '-',
+            formatTriggers(a),
             yes_no(a.enabled),
             String(a.order ?? 0),
             when(a.createdAt)

package/dist/commands/auth/actions/rm.js

@@ -1,6 +1,7 @@
 import prompts from 'prompts';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
+import { formatTriggers } from './triggers.js';
 import { tenant_options } from '../options.js';
 
 const actions_rm = {
@@ -27,7 +28,7 @@ const actions_rm = {
             const { confirm } = await prompts({
                 type: 'toggle',
                 name: 'confirm',
-                message: `Delete action "${action.name}" (${action.id}, trigger ${action.trigger})?`,
+                message: `Delete action "${action.name}" (${action.id}, triggers ${formatTriggers(action)})?`,
                 initial: false,
                 active: 'yes',
                 inactive: 'no'

package/dist/commands/auth/actions/triggers.js

@@ -0,0 +1,13 @@
+// `triggers` (auth ≥ v1.58) replaced the hand-picked `trigger`: an action runs
+// on every trigger whose hook its code exports. Tolerates both shapes so the
+// CLI prints something sensible against either server version.
+const formatTriggers = (action) => {
+    const list = action.triggers?.length
+        ? action.triggers
+        : action.trigger
+            ? [action.trigger]
+            : [];
+    return list.length ? list.join(',') : '-';
+};
+
+export { formatTriggers };

package/dist/commands/auth/actions/update.js

@@ -3,6 +3,7 @@ import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
 import { json_option, tenant_options } from '../options.js';
 import { print_json } from '../render.js';
+import { formatTriggers } from './triggers.js';
 
 const actions_update = {
     command: 'update <action_id>',
@@ -21,7 +22,7 @@ const actions_update = {
         .option('code-file', {
         alias: 'f',
         type: 'string',
-        description: 'Path to a JS file with the new action code'
+        description: 'Path to a JS file with the new action code (triggers are re-derived from the hooks it exports)'
     })
         .option('order', {
         type: 'number',
@@ -55,7 +56,7 @@ const actions_update = {
         const action = await api.actionUpdate(args.action_id, patch);
         if (args.json)
             return print_json(action);
-        log.info(`✅ Updated action ${action.id} (${action.name}, trigger ${action.trigger}, enabled: ${action.enabled ? '✓' : '✗'}, revision ${action.revision ?? '-'})`);
+        log.info(`✅ Updated action ${action.id} (${action.name}, triggers ${formatTriggers(action)}, enabled: ${action.enabled ? '✓' : '✗'}, revision ${action.revision ?? '-'})`);
     })
 };
 

package/dist/commands/deploy/index.js

@@ -19,6 +19,7 @@ import { deploy_remote } from './remote/index.js';
 import { resolve_app_id } from './resolve_app_id.js';
 import { secrets } from './secrets/index.js';
 import { is_superseded } from './superseded.js';
+import { waf } from './waf/index.js';
 
 const deploy = {
     command: 'deploy [app_id]',
@@ -31,6 +32,7 @@ const deploy = {
         return yargs
             .command(secrets)
             .command(domains)
+            .command(waf)
             .command(logs)
             .command(status)
             .command(apps_list)

package/dist/commands/deploy/waf/add_rule.js

@@ -0,0 +1,24 @@
+import { log } from '../../../log.js';
+
+/**
+ * Shared handler for `block` and `sink` — the two differ only in the action
+ * they store and in what the edge answers, so the flow (resolve app, write,
+ * explain, tell the user how to check) lives here once.
+ */
+const add_rule = async (opts) => {
+    const { api, app_id, app_name, app_url, pattern, action, description } = opts;
+    await api.addAppWafRule(app_id, { pattern, action, description });
+    const answer = action === 'deny' ? '403' : '404';
+    log.info(`🛡️  ${pattern} → ${answer} at the edge for ${app_name} (${app_id}).`);
+    log.info(``);
+    log.info(action === 'deny'
+        ? `Matching requests are blocked before they reach your app, so they no longer wake it.`
+        : `Faable answers matching requests with a ${answer} itself, so they no longer wake your app.`);
+    log.info(``);
+    log.info(`It takes about 20s to reach the edge. Then check it with:`);
+    log.info(`  curl -s -o /dev/null -w '%{http_code}\\n' https://${app_url}<path>`);
+    log.info(``);
+    log.info(`Undo: faable deploy waf rm '${pattern}' -a ${app_id}`);
+};
+
+export { add_rule };

package/dist/commands/deploy/waf/block.js

@@ -0,0 +1,42 @@
+import { requireApi } from '../../../api/context.js';
+import { resolve_app_id } from '../resolve_app_id.js';
+import { add_rule } from './add_rule.js';
+
+const waf_block = {
+    command: 'block <pattern>',
+    describe: 'Block a path at the edge with a 403 (never reaches your app)',
+    builder: yargs => yargs
+        .positional('pattern', {
+        type: 'string',
+        demandOption: true,
+        description: 'Anchored path regex, e.g. ^/\\.well-known/ (quote it in your shell)'
+    })
+        .option('app', {
+        alias: 'a',
+        type: 'string',
+        description: 'App Identifier (defaults to the linked app)'
+    })
+        .option('description', {
+        alias: 'd',
+        type: 'string',
+        description: 'Why this rule exists (shown in `waf list`)'
+    })
+        .example("$0 deploy waf block '^/\\.well-known/'", 'Stop scanner probes under /.well-known from waking the app')
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        const ctx = await requireApi();
+        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        const app = await ctx.api.getApp(app_id);
+        await add_rule({
+            api: ctx.api,
+            app_id,
+            app_name: app.name,
+            app_url: app.url,
+            pattern: args.pattern,
+            action: 'deny',
+            description: args.description
+        });
+    }
+};
+
+export { waf_block };

package/dist/commands/deploy/waf/format.js

@@ -0,0 +1,43 @@
+/** Human label for a rule action, so `list` explains itself without docs. */
+const action_label = (action) => action === 'sink'
+    ? '404 (answered by Faable, app not woken)'
+    : action === 'deny'
+        ? '403 (blocked at the edge)'
+        : action;
+/**
+ * Render the effective WAF of an app.
+ *
+ * Platform profiles come back as names + counts for a normal user and with
+ * their patterns for an admin, so this prints whatever the server chose to
+ * send rather than assuming either shape.
+ */
+const format_waf = (waf) => {
+    const out = [];
+    if (!waf.enabled) {
+        out.push('⚠️  WAF disabled for this app — no rule below is enforced.');
+        out.push('');
+    }
+    out.push('Platform rules (managed by Faable):');
+    if (waf.platform_profiles.length === 0) {
+        out.push('  (none)');
+    }
+    for (const p of waf.platform_profiles) {
+        out.push(`  • ${p.name} — ${p.rule_count} rule(s), ${action_label(p.action)}`);
+        for (const r of p.rules ?? []) {
+            out.push(`      ${r.pattern}${r.description ? `  # ${r.description}` : ''}`);
+        }
+    }
+    out.push('');
+    out.push('Your rules:');
+    if (waf.rules.length === 0) {
+        out.push('  (none)');
+    }
+    for (const r of waf.rules) {
+        out.push(`  • ${r.pattern} → ${action_label(r.action)}`);
+        if (r.description)
+            out.push(`      ${r.description}`);
+    }
+    return out;
+};
+
+export { action_label, format_waf };

package/dist/commands/deploy/waf/index.js

@@ -0,0 +1,21 @@
+import { waf_block } from './block.js';
+import { waf_list } from './list.js';
+import { waf_rm } from './rm.js';
+import { waf_sink } from './sink.js';
+
+const waf = {
+    command: 'waf <command>',
+    describe: 'Block or silence request paths at the edge, before the app wakes',
+    builder: yargs => yargs
+        .command(waf_list)
+        .command(waf_block)
+        .command(waf_sink)
+        .command(waf_rm)
+        .demandCommand(1, 'Specify a waf command: list, block, sink or rm'),
+    handler: () => {
+        // Unreachable: demandCommand(1) either routes to a subcommand or fails
+        // through the global .fail() in src/index.ts.
+    }
+};
+
+export { waf };

package/dist/commands/deploy/waf/list.js

@@ -0,0 +1,29 @@
+import { requireApi } from '../../../api/context.js';
+import { log } from '../../../log.js';
+import { resolve_app_id } from '../resolve_app_id.js';
+import { format_waf } from './format.js';
+
+const waf_list = {
+    command: 'list',
+    describe: 'Show the WAF rules in effect for the app',
+    builder: yargs => yargs
+        .option('app', {
+        alias: 'a',
+        type: 'string',
+        description: 'App Identifier (defaults to the linked app)'
+    })
+        .example('$0 deploy waf list', 'Show the rules protecting the linked app')
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        const ctx = await requireApi();
+        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        const app = await ctx.api.getApp(app_id);
+        const waf = await ctx.api.getAppWaf(app_id);
+        log.info(`🛡️  WAF for ${app.name} (${app_id})`);
+        log.info(``);
+        for (const line of format_waf(waf))
+            log.info(line);
+    }
+};
+
+export { waf_list };

package/dist/commands/deploy/waf/rm.js

@@ -0,0 +1,31 @@
+import { requireApi } from '../../../api/context.js';
+import { log } from '../../../log.js';
+import { resolve_app_id } from '../resolve_app_id.js';
+
+const waf_rm = {
+    command: 'rm <pattern>',
+    describe: 'Remove one of your WAF rules',
+    builder: yargs => yargs
+        .positional('pattern', {
+        type: 'string',
+        demandOption: true,
+        description: 'The exact pattern to remove (see `faable deploy waf list`)'
+    })
+        .option('app', {
+        alias: 'a',
+        type: 'string',
+        description: 'App Identifier (defaults to the linked app)'
+    })
+        .example("$0 deploy waf rm '^/robots\\.txt$'", 'Stop handling /robots.txt at the edge')
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        const ctx = await requireApi();
+        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        const app = await ctx.api.getApp(app_id);
+        await ctx.api.removeAppWafRule(app_id, args.pattern);
+        log.info(`🗑️  Removed ${args.pattern} from ${app.name} (${app_id}).`);
+        log.info(`Requests for it reach your app again within ~20s, once the edge picks up the change.`);
+    }
+};
+
+export { waf_rm };

package/dist/commands/deploy/waf/sink.js

@@ -0,0 +1,45 @@
+import { requireApi } from '../../../api/context.js';
+import { resolve_app_id } from '../resolve_app_id.js';
+import { add_rule } from './add_rule.js';
+
+const waf_sink = {
+    command: 'sink <pattern>',
+    describe: 'Answer a path with a 404 from Faable, without waking your app',
+    builder: yargs => yargs
+        .positional('pattern', {
+        type: 'string',
+        demandOption: true,
+        description: 'Anchored path regex, e.g. ^/robots\\.txt$ (quote it in your shell)'
+    })
+        .option('app', {
+        alias: 'a',
+        type: 'string',
+        description: 'App Identifier (defaults to the linked app)'
+    })
+        .option('description', {
+        alias: 'd',
+        type: 'string',
+        description: 'Why this rule exists (shown in `waf list`)'
+    })
+        .example("$0 deploy waf sink '^/robots\\.txt$'", 'Let Faable answer /robots.txt with a 404 instead of starting your app')
+        .epilogue('Use `sink` for paths your app does not serve anyway: Faable replies ' +
+        'with the same 404 your app would have, without the cold start. ' +
+        'Use `block` instead when you want the request refused outright.')
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        const ctx = await requireApi();
+        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        const app = await ctx.api.getApp(app_id);
+        await add_rule({
+            api: ctx.api,
+            app_id,
+            app_name: app.name,
+            app_url: app.url,
+            pattern: args.pattern,
+            action: 'sink',
+            description: args.description
+        });
+    }
+};
+
+export { waf_sink };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "1.40.0",
+  "version": "2.1.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",