@jheavenknows/bluerouter 5.3.76 → 5.3.78

package/app/.next-cli-build/static/chunks/app/(dashboard)/dashboard/audit-proxy/page-f449a07f91443cd5.js

@@ -1 +0,0 @@
-(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[5236],{29298:(e,t,s)=>{"use strict";s.d(t,{default:()=>n});var r=s(95155),a=s(12115);function n(){let[e,t]=(0,a.useState)(!1),[s,n]=(0,a.useState)(!1),[d,o]=(0,a.useState)([]),[i,l]=(0,a.useState)(!1),[c,x]=(0,a.useState)(""),[m,p]=(0,a.useState)(""),u=(e,s)=>{n(e?.proxyAuthEnabled===!0),o((e?.proxyAuthUsers||[]).map(e=>({username:e.username,hasPassword:!0===e.hasPassword,password:""}))),s&&t(!0===s.running)},h=(0,a.useCallback)(async()=>{try{let e=await fetch("/api/audit-proxy?limit=1",{cache:"no-store"}),t=await e.json();if(!e.ok)throw Error(t.error||"Cannot load proxy authentication");u(t.config,t.status)}catch(e){x(e.message||"Cannot load proxy authentication")}},[]);(0,a.useEffect)(()=>{h()},[h]);let b=(e,t)=>{o(s=>s.map((s,r)=>r===e?{...s,...t}:s))},g=async()=>{let e=d.map(e=>({...e,username:e.username.trim()}));if(s&&0===e.length)return void x("Add at least one account before enabling proxy authentication.");let t=e.find(e=>!e.hasPassword&&!e.password);if(t)return void x(`Set a password for ${t.username||"the new account"}.`);l(!0),x(""),p("");try{let t=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-proxy-auth",enabled:s,users:e.map(e=>e.password?{username:e.username,password:e.password}:{username:e.username})})}),r=await t.json().catch(()=>({}));if(!t.ok)throw Error(r.error||"Failed to save proxy authentication");p(r.restarted?"Proxy authentication saved and Audit Proxy restarted.":"Proxy authentication saved."),u(r.config,r.status)}catch(e){x(e.message||"Failed to save proxy authentication")}finally{l(!1)}};return(0,r.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,r.jsxs)("div",{className:"flex flex-wrap items-start justify-between gap-3",children:[(0,r.jsxs)("div",{className:"max-w-3xl",children:[(0,r.jsx)("h2",{className:"font-semibold text-text-main",children:"Proxy authentication"}),(0,r.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"Requires a username and password on every CONNECT, and records which account opened each tunnel, so the audit table answers who rather than only which IP. Give each person or CI job its own account: removing one leaves the others working."}),(0,r.jsx)("p",{className:"mt-2 rounded-lg border border-amber-500/30 bg-amber-500/5 p-2 text-[11px] leading-5 text-amber-700 dark:text-amber-300",children:"The proxy listener speaks plain HTTP, so the credential crosses the client-to-proxy hop unencrypted (Basic is base64, not encryption). This keeps out anyone without the password and attributes traffic to a person; it does not hide the password from someone capturing packets on that network. On an untrusted network use it alongside the client IP allowlist, not instead of it. The password also ends up in HTTPS_PROXY, and so in the process list and shell history."})]}),(0,r.jsxs)("label",{className:"flex shrink-0 items-center gap-2 text-sm text-text-main",children:[(0,r.jsx)("input",{type:"checkbox",checked:s,onChange:e=>n(e.target.checked),disabled:i,className:"h-4 w-4 accent-[var(--color-primary)]"}),"Require credentials"]})]}),(0,r.jsxs)("div",{className:"mt-4 grid gap-2",children:[0===d.length?(0,r.jsx)("p",{className:"rounded-xl border border-border bg-background/50 p-3 text-xs text-text-muted",children:"No accounts yet."}):null,d.map((e,t)=>(0,r.jsxs)("div",{className:"grid gap-2 rounded-xl border border-border bg-background/50 p-3 sm:grid-cols-[1fr_1fr_auto]",children:[(0,r.jsx)("input",{type:"text",value:e.username,onChange:e=>b(t,{username:e.target.value}),disabled:i,placeholder:"username",className:"min-w-0 rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,r.jsx)("input",{type:"password",value:e.password,onChange:e=>b(t,{password:e.target.value}),disabled:i,placeholder:e.hasPassword?"Saved — leave blank to keep":"Set a password",className:"min-w-0 rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,r.jsx)("button",{type:"button",onClick:()=>{let e;(!(e=d[t]).hasPassword||window.confirm(`Remove ${e.username}? Anything using this account stops working after the restart.`))&&o(e=>e.filter((e,s)=>s!==t))},disabled:i,className:"rounded-lg border border-border px-3 py-2 text-xs text-text-muted transition hover:border-red-500/40 hover:text-red-600 disabled:opacity-50",children:"Remove"})]},t))]}),(0,r.jsxs)("div",{className:"mt-3 flex flex-wrap items-center gap-2",children:[(0,r.jsx)("button",{type:"button",onClick:()=>o(e=>[...e,{username:"",hasPassword:!1,password:""}]),disabled:i,className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-muted transition hover:border-primary hover:text-primary disabled:opacity-50",children:"Add account"}),(0,r.jsx)("button",{type:"button",onClick:g,disabled:i,className:"rounded-lg bg-primary px-3 py-1.5 text-xs font-semibold text-white transition hover:opacity-90 disabled:opacity-50",children:i?"Saving…":e?"Save & Restart Proxy":"Save"}),(0,r.jsxs)("span",{className:"text-[11px] text-text-muted",children:["Clients pass credentials in the proxy URL: ",(0,r.jsx)("code",{className:"font-mono",children:"http://USER:PASSWORD@host:port"})," ","— URL-encode ",(0,r.jsx)("code",{className:"font-mono",children:"@ : / #"})," if the password contains them."]})]}),c?(0,r.jsx)("p",{className:"mt-3 rounded-lg border border-red-500/30 bg-red-500/5 p-2 text-xs text-red-600 dark:text-red-400",children:c}):null,m?(0,r.jsx)("p",{className:"mt-3 rounded-lg border border-green-500/30 bg-green-500/5 p-2 text-xs text-green-600 dark:text-green-400",children:m}):null]})}},31874:(e,t,s)=>{"use strict";s.d(t,{default:()=>f});var r=s(95155),a=s(12115),n=s(98500),d=s.n(n);let o=["api.anthropic.com","*.anthropic.com","claude.ai","*.claude.ai"],i=["api.openai.com","*.openai.com","chatgpt.com","*.chatgpt.com"],l="localhost,127.0.0.1,::1",c=[{id:"claude-code",label:"Claude Code"},{id:"codex",label:"OpenAI Codex"},{id:"gemini-cli",label:"Gemini CLI"},{id:"cursor",label:"Cursor"},{id:"curl",label:"curl / scripts"}];function x({ok:e,children:t}){return(0,r.jsxs)("span",{className:`inline-flex items-center gap-1 rounded-full border px-2 py-0.5 text-xs font-medium ${e?"border-green-500/30 bg-green-500/10 text-green-600 dark:text-green-400":"border-border bg-surface text-text-muted"}`,children:[(0,r.jsx)("span",{className:"material-symbols-outlined text-[13px]",children:e?"check_circle":"radio_button_unchecked"}),t]})}function m(e){let t=Number(e||0);return!Number.isFinite(t)||t<=0?"0":t>=1e6?`${(t/1e6).toFixed(2)}M`:t>=1e3?`${(t/1e3).toFixed(1)}k`:String(t)}function p(e){let t=Number(e||0);return!Number.isFinite(t)||t<=0?"$0.00":t<.01?`$${t.toFixed(4)}`:`$${t.toFixed(2)}`}function u({label:e,value:t,hint:s}){return(0,r.jsxs)("div",{className:"rounded-xl border border-border bg-background/50 p-3",children:[(0,r.jsx)("div",{className:"text-[11px] font-medium uppercase tracking-wide text-text-muted",children:e}),(0,r.jsx)("div",{className:"mt-1 text-lg font-semibold text-text-main",children:t}),s?(0,r.jsx)("div",{className:"mt-0.5 text-[11px] leading-4 text-text-muted",children:s}):null]})}function h({title:e,rows:t}){return t?.length?(0,r.jsxs)("div",{className:"min-w-0",children:[(0,r.jsx)("h3",{className:"text-xs font-semibold uppercase tracking-wide text-text-muted",children:e}),(0,r.jsx)("div",{className:"mt-2 overflow-x-auto",children:(0,r.jsxs)("table",{className:"w-full min-w-[420px] text-left text-xs",children:[(0,r.jsx)("thead",{className:"border-b border-border text-text-muted",children:(0,r.jsxs)("tr",{children:[(0,r.jsx)("th",{className:"px-2 py-1.5 font-medium",children:"Name"}),(0,r.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Reqs"}),(0,r.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"In"}),(0,r.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Out"}),(0,r.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Cache R/W"}),(0,r.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Cost"})]})}),(0,r.jsx)("tbody",{children:t.map(e=>(0,r.jsxs)("tr",{className:"border-b border-border/60 text-text-main",children:[(0,r.jsx)("td",{className:"max-w-[220px] truncate px-2 py-1.5 font-mono text-[11px]",title:e.label,children:e.label}),(0,r.jsx)("td",{className:"px-2 py-1.5 text-right",children:e.requests}),(0,r.jsx)("td",{className:"px-2 py-1.5 text-right",children:m(e.inputTokens)}),(0,r.jsx)("td",{className:"px-2 py-1.5 text-right",children:m(e.outputTokens)}),(0,r.jsxs)("td",{className:"px-2 py-1.5 text-right text-text-muted",children:[m(e.cacheReadTokens),"/",m(e.cacheCreationTokens)]}),(0,r.jsx)("td",{className:"px-2 py-1.5 text-right",children:p(e.cost)})]},e.label))})]})})]}):null}function b({label:e,hint:t,children:s}){return(0,r.jsxs)("label",{className:"grid gap-1.5",children:[(0,r.jsx)("span",{className:"text-sm font-semibold text-text-main",children:e}),s,t?(0,r.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:t}):null]})}function g({label:e,description:t,checked:s,onChange:a,disabled:n=!1}){return(0,r.jsxs)("label",{className:"flex items-start justify-between gap-4 rounded-xl border border-border bg-background/50 p-3",children:[(0,r.jsxs)("span",{children:[(0,r.jsx)("span",{className:"block text-sm font-semibold text-text-main",children:e}),(0,r.jsx)("span",{className:"mt-0.5 block text-xs leading-5 text-text-muted",children:t})]}),(0,r.jsx)("input",{type:"checkbox",checked:s,onChange:e=>a(e.target.checked),disabled:n,className:"mt-1 h-4 w-4 accent-[var(--color-primary)]"})]})}function y({title:e,subtitle:t,command:s,copyKey:a,copied:n,onCopy:d,recommended:o=!1}){return(0,r.jsxs)("div",{className:`rounded-xl border bg-background p-3 ${o?"border-green-500/30":"border-border"}`,children:[(0,r.jsxs)("div",{className:"flex items-start justify-between gap-3",children:[(0,r.jsxs)("div",{children:[(0,r.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,r.jsx)("span",{className:"text-xs font-semibold text-text-main",children:e}),o?(0,r.jsx)("span",{className:"rounded-full bg-green-500/10 px-2 py-0.5 text-[10px] font-semibold text-green-600 dark:text-green-400",children:"Recommended"}):null]}),t?(0,r.jsx)("div",{className:"mt-0.5 text-[10px] leading-4 text-text-muted",children:t}):null]}),(0,r.jsx)("button",{type:"button",onClick:()=>d(a,s),className:"shrink-0 text-xs font-medium text-primary",children:n===a?"Copied":"Copy"})]}),(0,r.jsx)("pre",{className:"mt-2 overflow-x-auto whitespace-pre-wrap break-all rounded-lg bg-surface px-3 py-2 text-[11px] leading-5 text-text-muted",children:s})]})}function f(){let[e,t]=(0,a.useState)(null),[s,n]=(0,a.useState)(null),[f,j]=(0,a.useState)(""),[N,v]=(0,a.useState)(""),[w,C]=(0,a.useState)(""),[k,P]=(0,a.useState)(null),[S,T]=(0,a.useState)(""),[A,E]=(0,a.useState)("configuration"),R=(0,a.useCallback)(async(e=!0)=>{try{let s=await fetch("/api/audit-proxy?limit=50",{cache:"no-store"}),r=await s.json();if(!s.ok)throw Error(r.error||"Cannot load Audit Proxy");t(r),e?n(e=>e||r.config):n(r.config)}catch(e){v(e.message||"Cannot load Audit Proxy")}},[]);(0,a.useEffect)(()=>{R(!1);let e=setInterval(()=>R(!0),5e3);return()=>clearInterval(e)},[R]);let I=e?.status||{},O=I.security||{},$=I.rootCA||{},_=!0===I.running,H=(0,a.useMemo)(()=>{let e;return(e=String(s?.clientProxyHost||"").trim()||"<bluerouter-host>").includes(":")&&!e.startsWith("[")?`[${e}]`:e},[s?.clientProxyHost]),L=s?`http://${H}:${s.port}`:"",F=(s?.allowedHosts||[]).join("\n"),q=(e,t)=>n(s=>({...s,[e]:t})),D=async(e,t={})=>{j(e),v(""),C("");try{let s=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:e,...t})}),r=await s.json().catch(()=>({}));if(!s.ok)throw Error(r.error||`${e} failed`);return"test"===e?(P(r.test),C(`Simulation passed ${r.test.passed}/${r.test.total} checks.`)):C("clear-logs"===e?"Audit logs cleared.":`Audit Proxy ${e} completed.`),await R("start"!==e&&"restart"!==e),r}catch(t){return v(t.message||`${e} failed`),null}finally{j("")}},U=async()=>{j("save"),v(""),C("");try{let e=await fetch("/api/audit-proxy",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({config:s})}),t=await e.json();if(!e.ok)throw Error(t.error||"Save failed");n(t.config),C("Configuration saved."),await R(!0)}catch(e){v(e.message||"Save failed")}finally{j("")}},B=async()=>{j("save-client-host"),v(""),C("");try{let e=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-client-host",clientProxyHost:s?.clientProxyHost||""})}),t=await e.json().catch(()=>({}));if(!e.ok)throw Error(t.error||"Failed to save Client proxy host");n(e=>({...e,clientProxyHost:t.config?.clientProxyHost||""})),C("Client proxy host saved."),await R(!0)}catch(e){v(e.message||"Failed to save Client proxy host")}finally{j("")}},M=async()=>{j("ca"),v("");try{let e=await fetch("/api/audit-proxy/ca",{method:"POST"}),t=await e.json();if(!e.ok)throw Error(t.error||"CA validation failed");C("Root CA is ready. Existing enterprise CA material was not rotated."),await R(!0)}catch(e){v(e.message||"CA validation failed")}finally{j("")}},X=e=>q("allowedHosts",[...new Set([...s?.allowedHosts||[],...e])]),W=async(e,t)=>{try{await navigator.clipboard.writeText(t),T(e),setTimeout(()=>T(""),1500)}catch{v("Clipboard access failed.")}};if(!s)return(0,r.jsx)("div",{className:"rounded-xl border border-border bg-surface p-5 text-sm text-text-muted",children:"Loading Enterprise AI Audit Proxy…"});let Y=Math.round(Number(s.captureLimitBytes||0)/1024/1024*10)/10,J=["0.0.0.0","::"].includes(s.bindHost)||!String(s.bindHost).startsWith("127.")&&"localhost"!==s.bindHost&&"::1"!==s.bindHost,K="C:\\BlueRouter\\bluerouter-audit-root-ca.crt",V="$HOME/.bluerouter/bluerouter-audit-root-ca.crt",G=`set "HTTP_PROXY=${L}"&&set "HTTPS_PROXY=${L}"&&set "NO_PROXY=${l}"&&set "no_proxy=${l}"`,z=`cmd.exe /d /c '${G}&&set "NODE_EXTRA_CA_CERTS=${K}"&&claude'`,Q=`cmd.exe /d /c '${G}&&set "CODEX_CA_CERTIFICATE=${K}"&&codex'`,Z=`HTTP_PROXY='${L}' HTTPS_PROXY='${L}' NO_PROXY='${l}' no_proxy='${l}'`,ee=`env ${Z} NODE_EXTRA_CA_CERTS="${V}" claude`,et=`env ${Z} CODEX_CA_CERTIFICATE="${V}" codex`;return(0,r.jsxs)("div",{className:"space-y-4",children:[(0,r.jsxs)("div",{className:"flex flex-col gap-3 rounded-2xl border border-primary/20 bg-primary/5 p-4 sm:flex-row sm:items-start sm:justify-between",children:[(0,r.jsxs)("div",{children:[(0,r.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,r.jsx)("span",{className:"material-symbols-outlined text-primary",children:"policy"}),(0,r.jsx)("h1",{className:"text-lg font-bold text-text-main",children:"Enterprise AI Audit Proxy"}),(0,r.jsx)(x,{ok:_,children:_?"Running":"Stopped"}),(0,r.jsx)(x,{ok:!0===$.validated,children:"Root CA"}),(0,r.jsx)(x,{ok:s.verifyUpstreamTls,children:"Verified upstream TLS"}),(0,r.jsx)(x,{ok:!0,children:I.capabilities?.http2===!0?"HTTP/1.1 + HTTP/2":"HTTP/1.1"})]}),(0,r.jsx)("p",{className:"mt-2 max-w-5xl text-sm leading-6 text-text-muted",children:"Explicit HTTPS CONNECT proxy for Claude Code and Codex. Request method, path, query, authentication values and body bytes are forwarded without content rewriting. Standard hop-by-hop headers and BlueRouter internal headers remain intentionally removed."})]}),(0,r.jsxs)(d(),{href:"/dashboard/mitm",className:"inline-flex items-center gap-1 text-xs font-medium text-primary hover:underline",children:[(0,r.jsx)("span",{className:"material-symbols-outlined text-[16px]",children:"arrow_back"})," AI Traffic Gateway"]})]}),N?(0,r.jsx)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-600 dark:text-red-400",children:N}):null,w?(0,r.jsx)("div",{className:"rounded-xl border border-green-500/30 bg-green-500/10 px-4 py-3 text-sm text-green-600 dark:text-green-400",children:w}):null,(0,r.jsxs)("div",{className:"flex w-fit items-center gap-1 rounded-xl border border-border bg-surface p-1",children:[(0,r.jsx)("button",{type:"button",onClick:()=>E("configuration"),className:`rounded-lg px-3 py-1.5 text-xs font-semibold transition ${"configuration"===A?"bg-primary text-white":"text-text-muted hover:bg-background hover:text-text-main"}`,children:"Configuration"}),(0,r.jsx)("button",{type:"button",onClick:()=>E("audit"),className:`rounded-lg px-3 py-1.5 text-xs font-semibold transition ${"audit"===A?"bg-primary text-white":"text-text-muted hover:bg-background hover:text-text-main"}`,children:"Audit & Usage"})]}),(0,r.jsxs)("div",{className:"configuration"===A?"space-y-4":"hidden",children:[O.lanExposedWithoutIpFilter?(0,r.jsxs)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-700 dark:text-red-300",children:[(0,r.jsx)("strong",{children:"LAN listener has no Client IP filter."})," Enable the IP allowlist below before broad deployment. Plain HTTP, private destinations and CONNECT ports other than 443 are blocked, but the listener should still be restricted by firewall/VLAN."]}):J?(0,r.jsxs)("div",{className:"rounded-xl border border-amber-500/30 bg-amber-500/10 px-4 py-3 text-sm text-amber-700 dark:text-amber-300",children:[(0,r.jsx)("strong",{children:"LAN listener enabled."})," Keep TCP ",s.port," restricted to the intended LAN/VPN and maintain the Client IP allowlist."]}):null,$.expiringSoon?(0,r.jsx)("div",{className:"rounded-xl border border-amber-500/30 bg-amber-500/10 px-4 py-3 text-sm text-amber-700 dark:text-amber-300",children:"Root CA expires soon. Audit Proxy will not rotate enterprise CA material automatically; prepare and deploy the replacement CA through Advanced CA management."}):null,(0,r.jsxs)("div",{className:"grid gap-4 xl:grid-cols-[1.25fr_0.75fr]",children:[(0,r.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,r.jsxs)("div",{className:"mb-4 flex flex-wrap items-center justify-between gap-2",children:[(0,r.jsxs)("div",{children:[(0,r.jsx)("h2",{className:"font-semibold text-text-main",children:"Proxy configuration"}),(0,r.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"All server-side setup is managed here. No proxy daemon CLI is required."})]}),(0,r.jsxs)("div",{className:"flex flex-wrap gap-2",children:[(0,r.jsx)("button",{type:"button",onClick:()=>X(o),disabled:_,className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-main hover:bg-background disabled:opacity-50",children:"+ Anthropic preset"}),(0,r.jsx)("button",{type:"button",onClick:()=>X(i),disabled:_,className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-main hover:bg-background disabled:opacity-50",children:"+ OpenAI preset"})]})]}),(0,r.jsxs)("div",{className:"grid gap-4 md:grid-cols-2",children:[(0,r.jsx)(b,{label:"Bind address",hint:"127.0.0.1 = local only. Use 0.0.0.0 or a LAN IP for other workstations.",children:(0,r.jsx)("input",{value:s.bindHost,onChange:e=>q("bindHost",e.target.value),disabled:_,className:"rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary disabled:opacity-60"})}),(0,r.jsx)(b,{label:"Proxy port",hint:"Default 3128; Docker deployments must publish this port explicitly.",children:(0,r.jsx)("input",{type:"number",min:"1",max:"65535",value:s.port,onChange:e=>q("port",Number(e.target.value)),disabled:_,className:"rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary disabled:opacity-60"})}),(0,r.jsx)(b,{label:"Client proxy host",hint:"Manual persistent hostname/IP used only in deployment commands; it does not change the listener.",children:(0,r.jsxs)("div",{className:"flex gap-2",children:[(0,r.jsx)("input",{value:s.clientProxyHost||"",onChange:e=>q("clientProxyHost",e.target.value),placeholder:"172.16.6.8 or proxy.example.local",className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary"}),(0,r.jsx)("button",{type:"button",onClick:B,disabled:!!f,className:"shrink-0 rounded-lg border border-primary/30 bg-primary/10 px-3 py-2 text-xs font-semibold text-primary disabled:opacity-50",children:"save-client-host"===f?"Saving…":"Save host"})]})}),(0,r.jsx)(b,{label:"Capture limit / request",hint:"Traffic streams immediately; only this bounded prefix is retained for audit.",children:(0,r.jsxs)("div",{className:"flex items-center gap-2",children:[(0,r.jsx)("input",{type:"number",min:"0",max:"16",step:"0.5",value:Y,onChange:e=>q("captureLimitBytes",Math.round(1024*Number(e.target.value)*1024)),disabled:_||!s.captureBodies,className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,r.jsx)("span",{className:"text-xs text-text-muted",children:"MB"})]})})]}),(0,r.jsxs)("div",{className:"mt-4 grid gap-3 md:grid-cols-2",children:[(0,r.jsx)(g,{label:"Pass through non-audited hosts",description:"Unknown hosts use a blind TLS tunnel only when they resolve to public addresses on TCP 443. Private/reserved destinations are denied.",checked:s.passthroughUnknown,onChange:e=>q("passthroughUnknown",e),disabled:_}),(0,r.jsx)(g,{label:"Capture request/response bodies",description:"Credentials are redacted before persistence. Disable to retain metadata and wire hashes only.",checked:s.captureBodies,onChange:e=>q("captureBodies",e),disabled:_})]}),(0,r.jsxs)("div",{className:"mt-4 grid gap-3",children:[(0,r.jsx)(g,{label:"Restrict which client tools may connect",description:"Refuses a CONNECT whose User-Agent identifies a tool that is not listed. Catches a browser pointed at the proxy, or a script that inherited HTTPS_PROXY. It cannot catch a client that sends no User-Agent — Claude Code sends none at all and Codex only on its first tunnel, so those are always let through, and anyone can do the same by dropping the header. Hygiene, not access control: the client IP allowlist and who holds the root CA are what bound access.",checked:!0===s.clientToolFilterEnabled,onChange:e=>q("clientToolFilterEnabled",e),disabled:_}),s.clientToolFilterEnabled?(0,r.jsxs)("div",{className:"grid gap-2",children:[(0,r.jsxs)("div",{className:"flex flex-wrap items-center gap-1.5",children:[(0,r.jsx)("span",{className:"text-[11px] font-medium text-text-muted",children:"Add:"}),c.map(e=>(0,r.jsx)("button",{type:"button",disabled:_||(s.allowedClientTools||[]).includes(e.id),onClick:()=>q("allowedClientTools",[...new Set([...s.allowedClientTools||[],e.id])]),className:"rounded-lg border border-border px-2 py-1 text-[11px] text-text-muted transition hover:border-primary hover:text-primary disabled:opacity-40",children:e.label},e.id))]}),(0,r.jsx)(b,{label:"Allowed client tools",hint:"One entry per line: a preset id above, or any substring matched against the User-Agent. Only clients that send a User-Agent are checked. Refused connections appear in the audit table with the User-Agent that was rejected, so you can add what you actually use.",children:(0,r.jsx)("textarea",{rows:4,value:(s.allowedClientTools||[]).join("\n"),onChange:e=>q("allowedClientTools",e.target.value.split(/\r?\n/).map(e=>e.trim().toLowerCase()).filter(Boolean)),disabled:_,placeholder:"claude-code\ncodex",className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"})})]}):null]}),(0,r.jsxs)("div",{className:"mt-4 grid gap-4 md:grid-cols-[1fr_190px]",children:[(0,r.jsx)(b,{label:"TLS inspection allowlist",hint:"One hostname/wildcard per line. Only these public HTTPS hosts are decrypted and audited.",children:(0,r.jsx)("textarea",{rows:9,value:F,onChange:e=>q("allowedHosts",e.target.value.split(/\r?\n/).map(e=>e.trim()).filter(Boolean)),disabled:_,className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"})}),(0,r.jsxs)("div",{className:"grid content-start gap-4",children:[(0,r.jsx)(b,{label:"Retention",hint:"Daily local JSONL segments older than this value are deleted hourly.",children:(0,r.jsxs)("div",{className:"flex items-center gap-2",children:[(0,r.jsx)("input",{type:"number",min:"1",max:"365",value:s.retentionDays,onChange:e=>q("retentionDays",Number(e.target.value)),disabled:_,className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,r.jsx)("span",{className:"text-xs text-text-muted",children:"days"})]})}),(0,r.jsxs)("div",{className:"rounded-xl border border-green-500/20 bg-green-500/5 p-3 text-xs leading-5 text-text-muted",children:[(0,r.jsx)("div",{className:"font-semibold text-green-600 dark:text-green-400",children:"Transport controls enforced"}),"TLS verification ON \xb7 HTTP/1.1 \xb7 HTTPS CONNECT only \xb7 public TCP 443 only."]})]})]}),(0,r.jsxs)("div",{className:"mt-4 flex flex-wrap gap-2",children:[(0,r.jsx)("button",{type:"button",onClick:U,disabled:!!f||_,className:"rounded-lg bg-primary px-4 py-2 text-sm font-semibold text-white disabled:opacity-50",children:"save"===f?"Saving…":"Save"}),_?(0,r.jsx)("button",{type:"button",onClick:()=>D("stop"),disabled:!!f,className:"rounded-lg border border-red-500/30 bg-red-500/10 px-4 py-2 text-sm font-semibold text-red-500 disabled:opacity-50",children:"stop"===f?"Stopping…":"Stop Proxy"}):(0,r.jsx)("button",{type:"button",onClick:()=>D("start",{config:s}),disabled:!!f,className:"rounded-lg border border-green-500/30 bg-green-500/10 px-4 py-2 text-sm font-semibold text-green-600 disabled:opacity-50",children:"start"===f?"Starting…":"Start Proxy"}),(0,r.jsx)("button",{type:"button",onClick:()=>D("restart",{config:s}),disabled:!!f,className:"rounded-lg border border-border px-4 py-2 text-sm font-semibold text-text-main hover:bg-background disabled:opacity-50",children:"restart"===f?"Restarting…":"Save & Restart"}),(0,r.jsx)("button",{type:"button",onClick:()=>D("test"),disabled:!!f,className:"rounded-lg border border-primary/30 bg-primary/10 px-4 py-2 text-sm font-semibold text-primary disabled:opacity-50",children:"test"===f?"Testing…":"Run Simulated Test"})]})]}),(0,r.jsxs)("div",{className:"space-y-4",children:[(0,r.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,r.jsx)("h2",{className:"font-semibold text-text-main",children:"Root CA"}),(0,r.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"The existing Root CA/key pair is validated and reused. Audit Proxy never auto-rotates enterprise CA material."}),(0,r.jsxs)("div",{className:"mt-3 grid gap-2 text-xs",children:[(0,r.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,r.jsx)("span",{className:"text-text-muted",children:"Status"}),(0,r.jsx)("span",{className:"font-medium text-text-main",children:$.validated?"Validated":$.certExists?"Needs attention":"Not generated"})]}),$.subject?(0,r.jsxs)("div",{className:"grid gap-1",children:[(0,r.jsx)("span",{className:"text-text-muted",children:"Subject"}),(0,r.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:$.subject})]}):null,$.fingerprint?(0,r.jsxs)("div",{className:"grid gap-1",children:[(0,r.jsx)("span",{className:"text-text-muted",children:"Public key fingerprint"}),(0,r.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:$.fingerprint})]}):null,$.notAfter?(0,r.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,r.jsx)("span",{className:"text-text-muted",children:"Expires"}),(0,r.jsx)("span",{className:"text-text-main",children:new Date($.notAfter).toLocaleString()})]}):null,$.error?(0,r.jsx)("div",{className:"rounded-lg bg-red-500/10 p-2 text-red-600 dark:text-red-300",children:$.error}):null]}),(0,r.jsxs)("div",{className:"mt-4 flex flex-wrap gap-2",children:[(0,r.jsx)("button",{type:"button",onClick:M,disabled:!!f||_,className:"rounded-lg border border-border px-3 py-2 text-xs font-semibold text-text-main hover:bg-background disabled:opacity-50",children:$.certExists?"Validate / Reuse CA":"Generate CA"}),(0,r.jsx)("a",{href:"/api/audit-proxy/ca?download=cert",className:`rounded-lg border border-primary/30 bg-primary/10 px-3 py-2 text-xs font-semibold text-primary ${!$.certExists?"pointer-events-none opacity-50":""}`,children:"Download Root CA"}),(0,r.jsx)(d(),{href:"/dashboard/mitm",className:"rounded-lg border border-border px-3 py-2 text-xs font-semibold text-text-main hover:bg-background",children:"Advanced CA management"})]})]}),(0,r.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,r.jsx)("h2",{className:"font-semibold text-text-main",children:"Client deployment values"}),(0,r.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"Process-scoped launchers do not use setx or modify Windows/System proxy. NO_PROXY keeps localhost OAuth callbacks and local MCP services off the gateway."}),(0,r.jsxs)("div",{className:"mt-3 rounded-xl border border-primary/20 bg-primary/5 p-3 text-xs leading-5 text-text-muted",children:[(0,r.jsx)("div",{className:"font-semibold text-primary",children:"Before first use"}),"Save the CA as ",(0,r.jsx)("code",{className:"rounded bg-background px-1 py-0.5",children:K})," on Windows or ",(0,r.jsx)("code",{className:"rounded bg-background px-1 py-0.5",children:V})," on Linux/macOS. The extra CA variable is harmless when the CA is already trusted by the OS."]}),(0,r.jsxs)("div",{className:"mt-3 grid gap-3",children:[(0,r.jsxs)("div",{className:"rounded-xl border border-border bg-background p-3",children:[(0,r.jsxs)("div",{className:"flex items-center justify-between gap-2",children:[(0,r.jsx)("span",{className:"text-xs font-semibold text-text-main",children:"Proxy URL"}),(0,r.jsx)("button",{type:"button",onClick:()=>W("url",L),className:"text-xs text-primary",children:"url"===S?"Copied":"Copy"})]}),(0,r.jsx)("code",{className:"mt-1 block break-all text-xs text-text-muted",children:L})]}),(0,r.jsx)(y,{title:"Claude Code \xb7 Windows PowerShell",subtitle:"Proxy variables exist only in the child process.",command:z,copyKey:"claude-ps",copied:S,onCopy:W,recommended:!0}),(0,r.jsx)(y,{title:"Codex \xb7 Windows PowerShell",subtitle:"No persistent user/system environment changes.",command:Q,copyKey:"codex-ps",copied:S,onCopy:W,recommended:!0}),(0,r.jsxs)("details",{className:"rounded-xl border border-border bg-background p-3",children:[(0,r.jsx)("summary",{className:"cursor-pointer text-xs font-semibold text-text-main",children:"Linux / macOS process-scoped commands"}),(0,r.jsxs)("div",{className:"mt-3 grid gap-3",children:[(0,r.jsx)(y,{title:"Claude Code \xb7 Bash/zsh",command:ee,copyKey:"claude-bash",copied:S,onCopy:W}),(0,r.jsx)(y,{title:"Codex \xb7 Bash/zsh",command:et,copyKey:"codex-bash",copied:S,onCopy:W})]})]})]})]})]})]}),k?(0,r.jsxs)("section",{className:`rounded-2xl border p-4 ${k.ok?"border-green-500/30 bg-green-500/5":"border-red-500/30 bg-red-500/5"}`,children:[(0,r.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,r.jsxs)("div",{children:[(0,r.jsx)("h2",{className:"font-semibold text-text-main",children:"Simulated end-to-end test"}),(0,r.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"Local throwaway TLS endpoints; no cloud credential or external API call is used."})]}),(0,r.jsxs)(x,{ok:k.ok,children:[k.passed,"/",k.total," passed \xb7 ",k.durationMs," ms"]})]}),(0,r.jsx)("div",{className:"mt-3 grid gap-2 md:grid-cols-2 xl:grid-cols-3",children:k.checks?.map(e=>(0,r.jsxs)("div",{className:"flex items-start gap-2 rounded-lg border border-border/70 bg-background/60 px-3 py-2 text-xs",children:[(0,r.jsx)("span",{className:`material-symbols-outlined text-[16px] ${e.ok?"text-green-500":"text-red-500"}`,children:e.ok?"check_circle":"error"}),(0,r.jsxs)("span",{children:[(0,r.jsx)("span",{className:"font-medium text-text-main",children:e.name}),e.detail?(0,r.jsx)("span",{className:"mt-0.5 block text-text-muted",children:e.detail}):null]})]},e.name))})]}):null]}),(0,r.jsxs)("div",{className:"audit"===A?"space-y-4":"hidden",children:[(0,r.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,r.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,r.jsxs)("div",{children:[(0,r.jsx)("h2",{className:"font-semibold text-text-main",children:"Token usage"}),(0,r.jsxs)("p",{className:"mt-1 text-xs text-text-muted",children:["Counts are read out of the audited provider responses themselves — ",(0,r.jsx)("code",{className:"font-mono",children:"message_start"})," carries input and cache tokens, the closing ",(0,r.jsx)("code",{className:"font-mono",children:"message_delta"})," carries output. Scope is the same window as the table below."]})]}),e?.usageSummary?.incompleteUsageCount?(0,r.jsxs)("span",{className:"rounded-lg border border-amber-500/30 bg-amber-500/10 px-2.5 py-1 text-[11px] font-medium text-amber-700 dark:text-amber-300",children:[e.usageSummary.incompleteUsageCount," response(s) truncated before the final usage event — output tokens under-counted"]}):null]}),e?.usageSummary?.totals?.requests?(0,r.jsxs)(r.Fragment,{children:[(0,r.jsxs)("div",{className:"mt-3 grid gap-2 sm:grid-cols-2 lg:grid-cols-5",children:[(0,r.jsx)(u,{label:"Requests with usage",value:e.usageSummary.totals.requests}),(0,r.jsx)(u,{label:"Input",value:m(e.usageSummary.totals.inputTokens),hint:"new (uncached) input tokens"}),(0,r.jsx)(u,{label:"Output",value:m(e.usageSummary.totals.outputTokens)}),(0,r.jsx)(u,{label:"Cache read / write",value:`${m(e.usageSummary.totals.cacheReadTokens)} / ${m(e.usageSummary.totals.cacheCreationTokens)}`}),(0,r.jsx)(u,{label:"Est. cost",value:p(e.usageSummary.totals.cost),hint:"from the pricing table"})]}),(0,r.jsxs)("div",{className:"mt-4 grid gap-5 lg:grid-cols-2",children:[(0,r.jsx)(h,{title:"By model",rows:e.usageSummary.byModel}),(0,r.jsx)(h,{title:"By client tool",rows:e.usageSummary.bySourceTool})]})]}):(0,r.jsx)("p",{className:"mt-3 rounded-xl border border-border bg-background/50 p-3 text-xs text-text-muted",children:"No token usage recorded yet. Usage appears once an audited request reaches a provider that reports it (Anthropic and OpenAI both do)."})]}),(0,r.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,r.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,r.jsxs)("div",{children:[(0,r.jsx)("h2",{className:"font-semibold text-text-main",children:"Recent audit requests"}),(0,r.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"Credentials are redacted before persistence. Local writes and MySQL mirroring run through a bounded asynchronous queue."})]}),(0,r.jsxs)("div",{className:"flex items-center gap-3 text-xs text-text-muted",children:[(0,r.jsxs)("span",{children:["Queue ",I.auditStore?.queueDepth||0,"/",I.auditStore?.queueLimit||1e3]}),(0,r.jsx)("button",{type:"button",onClick:()=>D("clear-logs"),disabled:!!f,className:"rounded-lg border border-border px-3 py-1.5 hover:bg-background disabled:opacity-50",children:"Clear logs"})]})]}),(0,r.jsx)("div",{className:"mt-3 overflow-x-auto",children:(0,r.jsxs)("table",{className:"w-full min-w-[1250px] text-left text-xs",children:[(0,r.jsx)("thead",{className:"border-b border-border text-text-muted",children:(0,r.jsxs)("tr",{children:[(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Time"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Protocol"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Client"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"User"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Provider"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Host"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Model"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Request"}),(0,r.jsx)("th",{className:"px-2 py-2 text-right font-medium",children:"Tokens (in/out)"}),(0,r.jsx)("th",{className:"px-2 py-2 text-right font-medium",children:"Cache (r/w)"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Status"}),(0,r.jsx)("th",{className:"px-2 py-2 font-medium",children:"Latency"})]})}),(0,r.jsxs)("tbody",{children:[(e?.events||[]).map(e=>(0,r.jsxs)("tr",{className:"border-b border-border/60 align-top text-text-main",children:[(0,r.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-text-muted",children:new Date(e.timestamp).toLocaleTimeString()}),(0,r.jsx)("td",{className:"px-2 py-2",children:e.protocol||"http/1.1"}),(0,r.jsx)("td",{className:"px-2 py-2 font-mono text-[11px]",children:e.client?.ip||"-"}),(0,r.jsx)("td",{className:"px-2 py-2",children:e.client?.proxyUser||"-"}),(0,r.jsx)("td",{className:"px-2 py-2",children:e.provider||"-"}),(0,r.jsx)("td",{className:"px-2 py-2 font-mono text-[11px]",children:e.host||"-"}),(0,r.jsx)("td",{className:"px-2 py-2",children:e.model||"-"}),(0,r.jsx)("td",{className:"max-w-[300px] px-2 py-2",children:(0,r.jsxs)("details",{children:[(0,r.jsxs)("summary",{className:"cursor-pointer truncate",children:[e.method," ",e.path]}),(0,r.jsx)("pre",{className:"mt-2 max-h-72 overflow-auto whitespace-pre-wrap rounded-lg bg-background p-2 text-[10px] leading-4 text-text-muted",children:JSON.stringify({request:e.request,response:e.response,error:e.error},null,2)})]})}),(0,r.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-right",children:e.usage?(0,r.jsxs)("span",{title:!1===e.usage.complete?"Response was truncated before the final usage event; output is a lower bound":void 0,children:[m(e.usage.inputTokens),"/",m(e.usage.outputTokens),!1===e.usage.complete?(0,r.jsx)("span",{className:"text-amber-600 dark:text-amber-400",children:"*"}):null]}):(0,r.jsx)("span",{className:"text-text-muted",children:"-"})}),(0,r.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-right text-text-muted",children:e.usage?`${m(e.usage.cacheReadTokens)}/${m(e.usage.cacheCreationTokens)}`:"-"}),(0,r.jsx)("td",{className:"px-2 py-2",children:e.status||"ERR"}),(0,r.jsxs)("td",{className:"whitespace-nowrap px-2 py-2",children:[e.durationMs??"-"," ms"]})]},e.id)),e?.events?.length?null:(0,r.jsx)("tr",{children:(0,r.jsx)("td",{colSpan:"12",className:"px-2 py-8 text-center text-text-muted",children:"No audited requests yet."})})]})]})})]})]})]})}},33522:(e,t,s)=>{Promise.resolve().then(s.bind(s,29298)),Promise.resolve().then(s.bind(s,46439)),Promise.resolve().then(s.bind(s,31874))},46439:(e,t,s)=>{"use strict";s.d(t,{default:()=>n});var r=s(95155),a=s(12115);function n(){let[e,t]=(0,a.useState)(null),[s,n]=(0,a.useState)(!1),[d,o]=(0,a.useState)(!1),[i,l]=(0,a.useState)(""),[c,x]=(0,a.useState)(!1),[m,p]=(0,a.useState)(""),[u,h]=(0,a.useState)(""),b=(0,a.useCallback)(async()=>{try{let e=await fetch("/api/audit-proxy?limit=1",{cache:"no-store"}),s=await e.json();if(!e.ok)throw Error(s.error||"Cannot load Audit Proxy IP filter");t(s.config),n(s.status?.running===!0),o(s.config?.clientIpFilterEnabled===!0),l((s.config?.allowedClientIps||[]).join("\n"))}catch(e){p(e.message||"Cannot load Audit Proxy IP filter")}},[]);(0,a.useEffect)(()=>{b()},[b]);let g=(0,a.useMemo)(()=>i.split(/\r?\n/).map(e=>e.trim()).filter(Boolean),[i]),y=async()=>{if(e){if(d&&0===g.length)return void p("Add at least one client IP or CIDR before enabling the filter.");x(!0),p(""),h("");try{let s=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-ip-filter",enabled:d,allowedClientIps:g})}),r=await s.json().catch(()=>({}));if(!s.ok)throw Error(r.error||"Failed to save client IP filter");h(r.restarted?"Client IP filter saved and Audit Proxy restarted.":"Client IP filter saved."),t(r.config||e),n(r.status?.running===!0),o(r.config?.clientIpFilterEnabled===!0),l((r.config?.allowedClientIps||[]).join("\n"))}catch(e){p(e.message||"Failed to save client IP filter")}finally{x(!1)}}};return e?(0,r.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,r.jsxs)("div",{className:"flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between",children:[(0,r.jsxs)("div",{children:[(0,r.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,r.jsx)("span",{className:"material-symbols-outlined text-primary",children:"shield_lock"}),(0,r.jsx)("h2",{className:"font-semibold text-text-main",children:"Client IP filter"}),(0,r.jsx)("span",{className:`rounded-full px-2 py-0.5 text-[10px] font-semibold ${d?"bg-green-500/10 text-green-600 dark:text-green-400":"bg-surface text-text-muted"}`,children:d?"ENABLED":"DISABLED"})]}),(0,r.jsxs)("p",{className:"mt-1 max-w-4xl text-xs leading-5 text-text-muted",children:["Restrict TCP access to the Audit Proxy itself. Only client IPs/CIDRs below can use port ",e.port,". The decision uses the socket peer IP; X-Forwarded-For and other HTTP headers are ignored."]})]}),(0,r.jsxs)("label",{className:"flex shrink-0 items-center gap-2 text-sm font-medium text-text-main",children:[(0,r.jsx)("input",{type:"checkbox",checked:d,onChange:e=>o(e.target.checked),className:"h-4 w-4 accent-[var(--color-primary)]"}),"Enable IP filter"]})]}),m?(0,r.jsx)("div",{className:"mt-3 rounded-lg border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-600 dark:text-red-400",children:m}):null,u?(0,r.jsx)("div",{className:"mt-3 rounded-lg border border-green-500/30 bg-green-500/10 px-3 py-2 text-xs text-green-600 dark:text-green-400",children:u}):null,(0,r.jsxs)("div",{className:"mt-4 grid gap-4 lg:grid-cols-[1fr_320px]",children:[(0,r.jsxs)("label",{className:"grid gap-1.5",children:[(0,r.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Allowed client IPs / CIDRs"}),(0,r.jsx)("textarea",{rows:6,value:i,onChange:e=>l(e.target.value),placeholder:"172.16.253.3\n172.16.253.0/24\n10.20.30.15\n2001:db8::/64",className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary"}),(0,r.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"One IPv4, IPv6, or CIDR per line. IPv4-mapped IPv6 addresses are normalized automatically."})]}),(0,r.jsxs)("div",{className:"grid content-start gap-3",children:[(0,r.jsxs)("div",{className:"rounded-xl border border-primary/20 bg-primary/5 p-3 text-xs leading-5 text-text-muted",children:[(0,r.jsx)("div",{className:"font-semibold text-primary",children:"Security behavior"}),(0,r.jsx)("div",{className:"mt-1",children:"Allowed IP → proxy works normally."}),(0,r.jsx)("div",{children:"Other IP → TCP connection is immediately closed before CONNECT/HTTP parsing."}),(0,r.jsx)("div",{children:"Empty list + enabled → configuration is rejected."})]}),(0,r.jsx)("button",{type:"button",onClick:y,disabled:c,className:"rounded-lg bg-primary px-4 py-2 text-sm font-semibold text-white disabled:opacity-50",children:c?"Saving…":s?"Save & Restart Proxy":"Save IP Filter"}),s?(0,r.jsxs)("div",{className:"text-[11px] leading-4 text-text-muted",children:["Proxy is running, so applying this security policy requires a short restart of port ",e.port,"."]}):null]})]})]}):null}}},e=>{e.O(0,[8500,8441,3794,7358],()=>e(e.s=33522)),_N_E=e.O()}]);