@heroku/skynet 2.3.0 → 2.5.0

package/dist/commands/suspend/user.js

@@ -2,7 +2,7 @@ import SkynetAPI from '../../lib/skynet.js';
 import { requireSudo } from '../../lib/sudo.js';
 import { Command } from '@heroku-cli/command';
 import { Flags, ux } from '@oclif/core';
-import { processSuspensionResult, parseResponse, handleApiError } from '../../lib/utils.js';
+import { processSuspensionResult, parseResponse, handleApiError, confirmLegalHold } from '../../lib/utils.js';
 import { color } from '@heroku-cli/color';
 export default class SuspendUser extends Command {
     static id = 'skynet:suspend:user';
@@ -63,6 +63,11 @@ export default class SuspendUser extends Command {
             name: 'async',
             description: 'do not wait for suspension to complete',
             required: false
+        }),
+        'legal-hold': Flags.boolean({
+            name: 'legal-hold',
+            description: 'mark suspension with legal hold status (prevents unsuspension until cleared)',
+            required: false
         })
     };
     async run() {
@@ -75,6 +80,7 @@ export default class SuspendUser extends Command {
         const category = flags.category;
         const force = flags.bypass || process.env.HEROKU_FORCE === '1';
         const deprovision = flags.deprovision;
+        const legalHold = flags['legal-hold'] || false;
         if (flags.notify && flags.no_notify) {
             ux.error('Flag --notify and --no-notify cannot be used together');
         }
@@ -90,10 +96,18 @@ export default class SuspendUser extends Command {
         if ((user && file) || (!user && !file)) {
             ux.error('Either --user USER or --infile must be passed, but not both');
         }
+        // Legal hold confirmation
+        if (legalHold) {
+            const confirmed = await confirmLegalHold();
+            if (!confirmed) {
+                this.log(color.yellow('Legal hold suspension cancelled'));
+                return;
+            }
+        }
         if (file) {
             ux.action.start(color.blue.bold('Starting bulk suspend...'));
             try {
-                let response = await skynet.bulkSuspendUsers(file, notes, category, notify, force, deprovision);
+                let response = await skynet.bulkSuspendUsers(file, notes, category, notify, force, deprovision, legalHold);
                 response = parseResponse(response);
                 ux.action.stop();
                 // For bulk operations, use a custom message if no message is in response
@@ -110,7 +124,7 @@ export default class SuspendUser extends Command {
         else {
             ux.action.start(color.blue.bold(`Suspending user ${color.cyan(user)}...`));
             try {
-                let response = await skynet.suspendUser(user, notes, category, notify, force, deprovision, flags.async);
+                let response = await skynet.suspendUser(user, notes, category, notify, force, deprovision, flags.async, legalHold);
                 response = parseResponse(response);
                 ux.action.stop();
                 processSuspensionResult(user, response);

package/dist/commands/suspensions/upload.d.ts

@@ -0,0 +1,9 @@
+import { Command } from '@heroku-cli/command';
+export default class SuspensionsUpload extends Command {
+    static id: string;
+    static aliases: string[];
+    static description: string;
+    static hidden: boolean;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/suspensions/upload.js

@@ -0,0 +1,111 @@
+import SkynetAPI from '../../lib/skynet.js';
+import { requireSudo } from '../../lib/sudo.js';
+import { Command } from '@heroku-cli/command';
+import { color } from '@heroku-cli/color';
+import { ux } from '@oclif/core';
+import { confirm } from '../../lib/utils.js';
+import { getPendingSuspensionRecords, deleteSuspensionRecord, getPendingSuspensionCount } from '../../lib/local-storage.js';
+export default class SuspensionsUpload extends Command {
+    static id = 'skynet:suspensions:upload';
+    static aliases = ['skynet:suspensions:upload'];
+    static description = '(requires sudo) uploads locally stored suspension records to Skynet';
+    static hidden = true;
+    static examples = [
+        '$ heroku sudo skynet:suspensions:upload'
+    ];
+    async run() {
+        requireSudo();
+        await this.parse(SuspensionsUpload);
+        // Get count first
+        const count = await getPendingSuspensionCount();
+        if (count === 0) {
+            this.log(color.yellow('No pending suspension records found to upload'));
+            return;
+        }
+        this.log(color.blue(`Found ${color.bold(String(count))} pending suspension record(s)`));
+        // Confirm before uploading
+        const confirmed = await confirm(`Upload ${count} suspension record(s) to Skynet? (y/n)`);
+        if (!confirmed) {
+            this.log(color.yellow('Upload cancelled'));
+            return;
+        }
+        // Get all pending records
+        const records = await getPendingSuspensionRecords();
+        if (records.length === 0) {
+            this.log(color.yellow('No pending suspension records found to upload'));
+            return;
+        }
+        const skynet = new SkynetAPI(this.heroku.auth);
+        ux.action.start(color.blue.bold(`Uploading ${records.length} suspension record(s) to Skynet...`));
+        try {
+            // Upload records to Skynet
+            const response = await skynet.uploadSuspensionRecords(records.map(r => r.record));
+            ux.action.stop();
+            // Parse response
+            let parsedResponse = response;
+            if (typeof response === 'string') {
+                try {
+                    parsedResponse = JSON.parse(response);
+                }
+                catch {
+                    // Keep as string
+                }
+            }
+            // Check if upload was successful
+            const success = parsedResponse?.status === 'OK' ||
+                parsedResponse?.statusCode === 200 ||
+                parsedResponse?.status_code === 200;
+            if (success) {
+                this.log(color.green(`✓ Successfully uploaded ${records.length} suspension record(s) to Skynet`));
+                // Show details if available
+                if (parsedResponse.uploaded) {
+                    this.log(color.dim(`  Uploaded: ${parsedResponse.uploaded}`));
+                }
+                if (parsedResponse.failed && parsedResponse.failed > 0) {
+                    this.log(color.yellow(`  Failed: ${parsedResponse.failed}`));
+                }
+                if (parsedResponse.message) {
+                    this.log(color.dim(`  ${parsedResponse.message}`));
+                }
+                // Delete local files
+                ux.action.start(color.blue('Cleaning up local files...'));
+                let deletedCount = 0;
+                for (const { filepath } of records) {
+                    try {
+                        await deleteSuspensionRecord(filepath);
+                        deletedCount++;
+                    }
+                    catch (error) {
+                        console.error(`Failed to delete ${filepath}:`, error);
+                    }
+                }
+                ux.action.stop();
+                this.log(color.green(`✓ Deleted ${deletedCount} local file(s)`));
+            }
+            else {
+                ux.error(`Upload failed: ${parsedResponse?.message || parsedResponse?.error || 'Unknown error'}`);
+            }
+        }
+        catch (error) {
+            ux.action.stop();
+            if (error.response) {
+                const status = error.response.statusCode;
+                const body = error.response.body;
+                let errorMessage = 'Failed to upload suspension records';
+                if (typeof body === 'string') {
+                    errorMessage += `: ${body}`;
+                }
+                else if (body && body.message) {
+                    errorMessage += `: ${body.message}`;
+                }
+                else if (body && body.error) {
+                    errorMessage += `: ${body.error}`;
+                }
+                ux.error(`${errorMessage} (HTTP ${status})`);
+            }
+            else {
+                ux.error(`Failed to upload suspension records: ${error.message}`);
+            }
+        }
+    }
+}

package/dist/commands/suspensions.d.ts

@@ -5,7 +5,7 @@ export default class Suspensions extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        account: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        account: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/suspensions.js

@@ -1,6 +1,6 @@
 import SkynetAPI from '../lib/skynet.js';
 import { Command } from '@heroku-cli/command';
-import { Flags, ux } from '@oclif/core';
+import { Flags } from '@oclif/core';
 import { parseResponse } from '../lib/utils.js';
 export default class Suspensions extends Command {
     static id = 'skynet:suspensions';
@@ -23,6 +23,6 @@ export default class Suspensions extends Command {
         const skynet = new SkynetAPI(this.heroku.auth);
         let response = await skynet.suspensions(flags.account);
         response = parseResponse(response);
-        ux.log(response);
+        this.log(response);
     }
 }

package/dist/commands/unsuspend/apps.d.ts

@@ -5,9 +5,9 @@ export default class UnsuspendApp extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        app: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
-        category: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
-        notes: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        app: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        category: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        notes: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/unsuspend/user.d.ts

@@ -5,9 +5,9 @@ export default class UnsuspendUser extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        user: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
-        category: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
-        notes: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        user: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        category: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        notes: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/userpass/add.d.ts

@@ -5,8 +5,8 @@ export default class AddUserpass extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        user: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
-        flag: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        user: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        flag: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/userpass/remove.d.ts

@@ -5,8 +5,8 @@ export default class RemoveUserpass extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        user: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
-        flag: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        user: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        flag: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/lib/local-storage.d.ts

@@ -0,0 +1,31 @@
+export interface LocalSuspensionRecord {
+    resourceId: string;
+    isApp: boolean;
+    reason: string;
+    category: string;
+    action: string;
+    createdAt: string;
+    method: string;
+    notify?: boolean;
+    deprovision?: boolean;
+    legalHold?: boolean;
+}
+/**
+ * Save a suspension record to local storage
+ */
+export declare function saveSuspensionRecord(record: LocalSuspensionRecord): Promise<string>;
+/**
+ * Get all pending suspension records from local storage
+ */
+export declare function getPendingSuspensionRecords(): Promise<Array<{
+    filepath: string;
+    record: LocalSuspensionRecord;
+}>>;
+/**
+ * Delete a suspension record file
+ */
+export declare function deleteSuspensionRecord(filepath: string): Promise<void>;
+/**
+ * Get count of pending suspension records
+ */
+export declare function getPendingSuspensionCount(): Promise<number>;

package/dist/lib/local-storage.js

@@ -0,0 +1,88 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { promisify } from 'util';
+const readdir = promisify(fs.readdir);
+const readFile = promisify(fs.readFile);
+const writeFile = promisify(fs.writeFile);
+const unlink = promisify(fs.unlink);
+const mkdir = promisify(fs.mkdir);
+const STORAGE_DIR_NAME = 'heroku-skynet-suspensions';
+/**
+ * Get the temp directory path for storing suspension records
+ */
+function getStorageDir() {
+    return path.join(os.tmpdir(), STORAGE_DIR_NAME);
+}
+/**
+ * Ensure the storage directory exists
+ */
+async function ensureStorageDir() {
+    const dir = getStorageDir();
+    try {
+        await mkdir(dir, { recursive: true });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST') {
+            throw error;
+        }
+    }
+    return dir;
+}
+/**
+ * Generate a unique filename for a suspension record
+ */
+function generateFilename(resourceId) {
+    const timestamp = Date.now();
+    const sanitized = resourceId.replace(/[^a-zA-Z0-9]/g, '_');
+    return `suspension_${sanitized}_${timestamp}.json`;
+}
+/**
+ * Save a suspension record to local storage
+ */
+export async function saveSuspensionRecord(record) {
+    const dir = await ensureStorageDir();
+    const filename = generateFilename(record.resourceId);
+    const filepath = path.join(dir, filename);
+    await writeFile(filepath, JSON.stringify(record, null, 2), 'utf8');
+    return filepath;
+}
+/**
+ * Get all pending suspension records from local storage
+ */
+export async function getPendingSuspensionRecords() {
+    const dir = getStorageDir();
+    // Check if directory exists
+    if (!fs.existsSync(dir)) {
+        return [];
+    }
+    const files = await readdir(dir);
+    const suspensionFiles = files.filter(f => f.startsWith('suspension_') && f.endsWith('.json'));
+    const records = [];
+    for (const file of suspensionFiles) {
+        const filepath = path.join(dir, file);
+        try {
+            const content = await readFile(filepath, 'utf8');
+            const record = JSON.parse(content);
+            records.push({ filepath, record });
+        }
+        catch (error) {
+            // Skip files that can't be read or parsed
+            console.error(`Error reading ${filepath}:`, error);
+        }
+    }
+    return records;
+}
+/**
+ * Delete a suspension record file
+ */
+export async function deleteSuspensionRecord(filepath) {
+    await unlink(filepath);
+}
+/**
+ * Get count of pending suspension records
+ */
+export async function getPendingSuspensionCount() {
+    const records = await getPendingSuspensionRecords();
+    return records.length;
+}

package/dist/lib/skynet.d.ts

@@ -6,6 +6,17 @@ interface RequestOptions {
     json?: any;
     form?: any;
 }
+interface SuspensionRecord {
+    resourceId: string;
+    isApp: boolean;
+    reason: string;
+    category: string;
+    action: string;
+    createdAt: string;
+    method: string;
+    notify?: boolean;
+    deprovision?: boolean;
+}
 export default class SkynetAPI {
     private version;
     private token;
@@ -22,11 +33,14 @@ export default class SkynetAPI {
     suspendAppOwner(app: string, notes: string, category: string, force?: boolean, deprovision?: boolean, async?: boolean): Promise<any>;
     suspendApp(app: string, notes: string, category: string, force?: boolean, async?: boolean): Promise<any>;
     unsuspendApp(app: string, category: string, notes: string): Promise<any>;
-    suspendUser(user: string, notes: string, category: string, notify: boolean, force?: boolean, deprovision?: boolean, async?: boolean): Promise<any>;
+    suspendUser(user: string, notes: string, category: string, notify: boolean, force?: boolean, deprovision?: boolean, async?: boolean, legalHold?: boolean): Promise<any>;
     unsuspendUser(user: string, category: string, notes: string): Promise<any>;
-    bulkSuspendUsers(file: string, notes: string, category: string, notify: boolean, force?: boolean, deprovision?: boolean): Promise<any>;
+    bulkSuspendUsers(file: string, notes: string, category: string, notify: boolean, force?: boolean, deprovision?: boolean, legalHold?: boolean): Promise<any>;
     bulkSuspendAppOwner(apps: string, notes: string, category: string, deprovision?: boolean): Promise<any>;
     deprovision(user: string, notes: string, category: string, notify?: boolean, force?: boolean): Promise<any>;
     suspensions(account: string): Promise<any>;
+    uploadSuspensionRecords(records: SuspensionRecord[]): Promise<any>;
+    addLegalHold(user: string): Promise<any>;
+    removeLegalHold(user: string): Promise<any>;
 }
 export {};

package/dist/lib/skynet.js

@@ -140,7 +140,7 @@ export default class SkynetAPI {
             json: {}
         });
     }
-    suspendUser(user, notes, category, notify, force = false, deprovision = false, async = false) {
+    suspendUser(user, notes, category, notify, force = false, deprovision = false, async = false, legalHold = false) {
         const body = {
             value: user,
             reason: notes,
@@ -150,6 +150,7 @@ export default class SkynetAPI {
             notify,
             deprovision,
             sync: !async,
+            legal_hold: legalHold,
         };
         return this.request('/suspend/user', {
             method: 'POST',
@@ -162,7 +163,7 @@ export default class SkynetAPI {
             json: {}
         });
     }
-    bulkSuspendUsers(file, notes, category, notify, force = false, deprovision = false) {
+    bulkSuspendUsers(file, notes, category, notify, force = false, deprovision = false, legalHold = false) {
         const fileStream = fs.createReadStream(file);
         const form = new FormData();
         form.append('file', fileStream);
@@ -173,6 +174,7 @@ export default class SkynetAPI {
         form.append('force', String(force));
         form.append('notify', String(notify));
         form.append('deprovision', String(deprovision));
+        form.append('legal_hold', String(legalHold));
         return this.request('/bulk-suspend/user', {
             method: 'POST',
             body: form
@@ -211,5 +213,25 @@ export default class SkynetAPI {
             method: 'GET'
         });
     }
+    uploadSuspensionRecords(records) {
+        return this.request('/suspensions/upload', {
+            method: 'POST',
+            json: {
+                records
+            }
+        });
+    }
+    addLegalHold(user) {
+        return this.request(`/legal_hold/${user}`, {
+            method: 'POST',
+            json: {}
+        });
+    }
+    removeLegalHold(user) {
+        return this.request(`/legal_hold/${user}`, {
+            method: 'DELETE',
+            json: {}
+        });
+    }
 }
 ;

package/dist/lib/utils.d.ts

@@ -1,3 +1,5 @@
+export declare function confirm(message: string): Promise<boolean>;
+export declare function promptHidden(message: string): Promise<string>;
 export declare function readlines(file: string): Promise<string[]>;
 export declare function arrayChunks<T>(array: T[], chunkSize: number): T[][];
 /**
@@ -15,3 +17,4 @@ export declare function handleApiError(error: any, operation: string, throwError
 export declare function processSuspensionResult(suspendObject: any, response: any): void;
 export declare function processUnsuspendResult(unsuspendObject: any, response: any): void;
 export declare function logError(response: any): void;
+export declare function confirmLegalHold(): Promise<boolean>;

package/dist/lib/utils.js

@@ -1,7 +1,52 @@
 import split from 'split';
 import fs from 'fs';
+import * as readline from 'readline';
 import { ux } from '@oclif/core';
 import { color } from '@heroku-cli/color';
+// Helper to write to stdout consistently
+function log(message) {
+    process.stdout.write(message + '\n');
+}
+// Helper for confirm prompts - exported for use in commands
+export async function confirm(message) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+    return new Promise((resolve) => {
+        rl.question(`${message} `, (answer) => {
+            rl.close();
+            resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
+        });
+    });
+}
+// Helper for password/hidden input prompts - exported for use in commands
+export async function promptHidden(message) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+    // Hide the input
+    const stdin = process.stdin;
+    const originalSetRawMode = stdin.setRawMode ? stdin.setRawMode.bind(stdin) : null;
+    return new Promise((resolve) => {
+        rl.question(`${message}: `, (answer) => {
+            rl.close();
+            console.log(); // New line after hidden input
+            resolve(answer);
+        });
+        // Attempt to hide input (may not work in all terminals)
+        if (originalSetRawMode) {
+            stdin.setRawMode(true);
+            stdin.on('data', (char) => {
+                const c = char.toString();
+                if (c === '\r' || c === '\n') {
+                    stdin.setRawMode(false);
+                }
+            });
+        }
+    });
+}
 export function readlines(file) {
     return new Promise(function (resolve, reject) {
         const entries = [];
@@ -69,9 +114,9 @@ export function handleApiError(error, operation, throwError = true) {
     }
     else if (!error?.response?.body) {
         // Only log error message if we don't have a response body (already logged by logError)
-        ux.log(color.red(`Error: ${error?.message || error}`));
+        log(color.red(`Error: ${error?.message || error}`));
     }
-    ux.log(color.bgRed(`Failed to ${operation}`));
+    log(color.bgRed(`Failed to ${operation}`));
     if (throwError) {
         throw error;
     }
@@ -80,15 +125,15 @@ export function processSuspensionResult(suspendObject, response) {
     if (response?.success === 'ok' || response?.status === 'OK' || response?.statusCode === 200) {
         const message = response?.message || response?.Message;
         if (message) {
-            ux.log(color.green(message));
+            log(color.green(message));
         }
         else {
-            ux.log(color.green(`Suspended ${suspendObject}`));
+            log(color.green(`Suspended ${suspendObject}`));
         }
     }
     else {
         logError(response);
-        ux.log(color.bgRed(`Failed to suspend ${suspendObject}`));
+        log(color.bgRed(`Failed to suspend ${suspendObject}`));
     }
 }
 export function processUnsuspendResult(unsuspendObject, response) {
@@ -129,10 +174,22 @@ export function logError(response) {
     }
     // If we have parts, combine them into a single line
     if (parts.length > 0) {
-        ux.log(color.red(parts.join(' - ')));
+        log(color.red(parts.join(' - ')));
     }
     else {
         // If response doesn't have expected error format, log the whole thing
-        ux.log(color.red(`Error: ${JSON.stringify(response)}`));
+        log(color.red(`Error: ${JSON.stringify(response)}`));
     }
 }
+export async function confirmLegalHold() {
+    log('');
+    log(color.yellow.bold('⚠ LEGAL HOLD WARNING'));
+    log(color.yellow('This suspension will be marked with legal hold status.'));
+    log(color.yellow('Users under legal hold:'));
+    log(color.yellow('  • Cannot be unsuspended until legal hold is cleared'));
+    log(color.yellow('  • Are tracked for legal/compliance purposes'));
+    log(color.yellow('  • May have data retention requirements'));
+    log('');
+    const confirmed = await confirm('Proceed with legal hold suspension? (y/n)');
+    return confirmed;
+}