@jheavenknows/bluerouter 5.4.13 → 5.4.15

package/app/.next-cli-build/server/app/(dashboard)/dashboard/audit-proxy/page.js

@@ -18,4 +18,4 @@ else {
   if (Test-Path $cfg) { Copy-Item $cfg "$cfg.bak" -Force }
   [IO.File]::WriteAllText($cfg, $block + $body, (New-Object Text.UTF8Encoding $false))
   Write-Host 'Injected at top of config.toml (backup: config.toml.bak).'
-}`,o=async(a,b)=>{try{await navigator.clipboard.writeText(b),l(a),setTimeout(()=>l(""),1500)}catch{c?.("Kh\xf4ng truy cập được clipboard của tr\xecnh duyệt.")}};return(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Hướng dẫn cấu h\xecnh m\xe1y trạm"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"C\xe1c lệnh dưới đ\xe2y chỉ đặt biến m\xf4i trường trong tiến tr\xecnh con — kh\xf4ng d\xf9ng setx, kh\xf4ng đổi proxy của Windows/hệ thống. NO_PROXY giữ cho OAuth callback ở localhost v\xe0 MCP chạy nội bộ kh\xf4ng đi qua proxy."}),(0,d.jsxs)("div",{className:"mt-3 rounded-xl border border-primary/20 bg-primary/5 p-3 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("div",{className:"font-semibold text-primary",children:"L\xe0m một lần trước khi d\xf9ng"}),"Lưu file Root CA vừa tải v\xe0o đ\xfang đường dẫn: ",(0,d.jsx)("code",{className:"rounded bg-background px-1 py-0.5",children:g})," tr\xean Windows, hoặc ",(0,d.jsx)("code",{className:"rounded bg-background px-1 py-0.5",children:h})," tr\xean Linux/macOS. Nếu CA đ\xe3 được c\xe0i v\xe0o hệ điều h\xe0nh th\xec biến CA trong lệnh vẫn v\xf4 hại, cứ để nguy\xean."]}),(0,d.jsxs)("div",{className:"mt-3 grid gap-3",children:[(0,d.jsxs)("div",{className:"rounded-xl border border-border bg-background p-3",children:[(0,d.jsxs)("div",{className:"flex items-center justify-between gap-2",children:[(0,d.jsx)("span",{className:"text-xs font-semibold text-text-main",children:"Địa chỉ proxy"}),(0,d.jsx)("button",{type:"button",onClick:()=>o("url",m.proxyUrl),className:"text-xs text-primary",children:"url"===k?"Đ\xe3 copy":"Copy"})]}),(0,d.jsx)("code",{className:"mt-1 block break-all text-xs text-text-muted",children:m.proxyUrl})]}),(0,d.jsx)(i,{title:"Claude Code \xb7 Windows PowerShell",subtitle:"Biến proxy chỉ tồn tại trong tiến tr\xecnh con, đ\xf3ng cửa sổ l\xe0 hết.",command:m.claudePowerShell,copyKey:"claude-ps",copied:k,onCopy:o,recommended:!0}),(0,d.jsx)(i,{title:"Codex \xb7 Windows PowerShell",subtitle:"Kh\xf4ng ghi g\xec v\xe0o biến m\xf4i trường của user hay hệ thống.",command:m.codexPowerShell,copyKey:"codex-ps",copied:k,onCopy:o,recommended:!0}),(0,d.jsxs)("details",{className:"rounded-xl border border-border bg-background p-3",children:[(0,d.jsx)("summary",{className:"cursor-pointer text-xs font-semibold text-text-main",children:"Codex \xb7 bỏ 7 gi\xe2y chờ WebSocket l\xfac khởi động (kh\xf4ng bắt buộc)"}),(0,d.jsxs)("p",{className:"mt-2 text-[11px] leading-5 text-text-muted",children:["Codex thử mở ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"wss://chatgpt.com/backend-api/codex/responses"})," trước khi chịu d\xf9ng HTTPS. Proxy từ chối n\xe2ng cấp WebSocket để mọi request đều ghi log được, n\xean mỗi lần khởi động Codex tốn 5 lần thử lại — khoảng 7 gi\xe2y — rồi mới tự chuyển sang HTTPS. Request vẫn chạy v\xe0 vẫn được ghi log b\xecnh thường; cấu h\xecnh dưới đ\xe2y chỉ để khỏi phải chờ."]}),(0,d.jsxs)("p",{className:"mt-2 text-[11px] leading-5 text-text-muted",children:["Chạy một lần trong PowerShell. Lệnh chạy lại nhiều lần vẫn an to\xe0n, ghi kho\xe1 v\xe0o đ\xfang đầu file (TOML y\xeau cầu vậy) v\xe0 giữ lại bản backup ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"config.toml.bak"}),"."]}),(0,d.jsxs)("p",{className:"mt-2 text-[11px] leading-5 text-text-muted",children:["Trong config.toml chỉ cấu h\xecnh được phần transport. Codex kh\xf4ng c\xf3 kho\xe1 proxy ở đ\xf3 — n\xf3 chỉ đọc ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"HTTP_PROXY"}),"/",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"HTTPS_PROXY"}),"/",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"NO_PROXY"})," từ m\xf4i trường, n\xean vẫn phải khởi động bằng lệnh ở tr\xean."]}),(0,d.jsx)("div",{className:"mt-3",children:(0,d.jsx)(i,{title:"Ghim Codex v\xe0o transport HTTPS",subtitle:"Sửa file %USERPROFILE%\\.codex\\config.toml",command:n,copyKey:"codex-https-config",copied:k,onCopy:o})}),(0,d.jsxs)("p",{className:"mt-2 text-[11px] leading-5 text-amber-600 dark:text-amber-400",children:["Đ\xe1nh đổi: provider ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"openai"})," c\xf3 sẵn l\xe0 t\xean d\xe0nh ri\xeang, kh\xf4ng ghi đ\xe8 được, n\xean cấu h\xecnh n\xe0y nh\xe2n bản n\xf3. Bản nh\xe2n bản kh\xf4ng gửi ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"content-encoding"})," (n\xe9n request), ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"x-codex-routing-hint"})," v\xe0 ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"version"}),", đồng thời ghim cứng ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"base_url"}),". Muốn trả về mặc định th\xec xo\xe1 cả hai khối trong config.toml."]})]}),(0,d.jsxs)("details",{className:"rounded-xl border border-border bg-background p-3",children:[(0,d.jsx)("summary",{className:"cursor-pointer text-xs font-semibold text-text-main",children:"Lệnh cho Linux / macOS"}),(0,d.jsxs)("div",{className:"mt-3 grid gap-3",children:[(0,d.jsx)(i,{title:"Claude Code \xb7 Bash/zsh",command:m.claudeBash,copyKey:"claude-bash",copied:k,onCopy:o}),(0,d.jsx)(i,{title:"Codex \xb7 Bash/zsh",command:m.codexBash,copyKey:"codex-bash",copied:k,onCopy:o})]})]})]})]})}},8128:a=>{"use strict";a.exports=require("next/dist/server/runtime-reacts.external.js")},10381:(a,b)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"ReadonlyURLSearchParams",{enumerable:!0,get:function(){return d}});class c extends Error{constructor(){super("Method unavailable on `ReadonlyURLSearchParams`. Read more: https://nextjs.org/docs/app/api-reference/functions/use-search-params#updating-searchparams"),Object.defineProperty(this,"__NEXT_ERROR_CODE",{value:"E1174",enumerable:!1,configurable:!0})}}class d extends URLSearchParams{append(){throw new c}delete(){throw new c}set(){throw new c}sort(){throw new c}}("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},10846:a=>{"use strict";a.exports=require("next/dist/compiled/next-server/app-page.runtime.prod.js")},19121:a=>{"use strict";a.exports=require("next/dist/server/app-render/action-async-storage.external.js")},19771:a=>{"use strict";a.exports=require("process")},21820:a=>{"use strict";a.exports=require("os")},27910:a=>{"use strict";a.exports=require("stream")},28354:a=>{"use strict";a.exports=require("util")},29021:a=>{"use strict";a.exports=require("fs")},29294:a=>{"use strict";a.exports=require("next/dist/server/app-render/work-async-storage.external.js")},32171:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});var d={getRedirectError:function(){return i},getRedirectStatusCodeFromError:function(){return n},getRedirectTypeFromError:function(){return m},getURLFromRedirectError:function(){return l},permanentRedirect:function(){return k},redirect:function(){return j}};for(var e in d)Object.defineProperty(b,e,{enumerable:!0,get:d[e]});let f=c(81494),g=c(52220),h=c(73565);function i(a,b,c=f.RedirectStatusCode.TemporaryRedirect){let d=Object.defineProperty(Error(g.REDIRECT_ERROR_CODE),"__NEXT_ERROR_CODE",{value:"E394",enumerable:!1,configurable:!0});return d.digest=`${g.REDIRECT_ERROR_CODE};${b};${a};${c};`,d}function j(a,b){throw i(a,b??=h.actionAsyncStorage?.getStore()?.isAction?"push":"replace",f.RedirectStatusCode.TemporaryRedirect)}function k(a,b="replace"){throw i(a,b,f.RedirectStatusCode.PermanentRedirect)}function l(a){return(0,g.isRedirectError)(a)?a.digest.split(";").slice(2,-2).join(";"):null}function m(a){if(!(0,g.isRedirectError)(a))throw Object.defineProperty(Error("Not a redirect error"),"__NEXT_ERROR_CODE",{value:"E260",enumerable:!1,configurable:!0});return a.digest.split(";",2)[1]}function n(a){if(!(0,g.isRedirectError)(a))throw Object.defineProperty(Error("Not a redirect error"),"__NEXT_ERROR_CODE",{value:"E260",enumerable:!1,configurable:!0});return Number(a.digest.split(";").at(-2))}("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},33873:a=>{"use strict";a.exports=require("path")},34631:a=>{"use strict";a.exports=require("tls")},38522:a=>{"use strict";a.exports=require("node:zlib")},41025:a=>{"use strict";a.exports=require("next/dist/server/app-render/dynamic-access-async-storage.external.js")},41204:a=>{"use strict";a.exports=require("string_decoder")},42477:(a,b,c)=>{Promise.resolve().then(c.bind(c,1568)),Promise.resolve().then(c.bind(c,91202))},44057:(a,b,c)=>{"use strict";function d(){throw Object.defineProperty(Error("`unauthorized()` is experimental and only allowed to be used when `experimental.authInterrupts` is enabled."),"__NEXT_ERROR_CODE",{value:"E411",enumerable:!1,configurable:!0})}Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"unauthorized",{enumerable:!0,get:function(){return d}}),c(7638).HTTP_ERROR_FALLBACK_ERROR_CODE,("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},46060:a=>{"use strict";a.exports=require("next/dist/shared/lib/no-fallback-error.external.js")},46293:a=>{"use strict";a.exports=require("sql.js")},51455:a=>{"use strict";a.exports=require("node:fs/promises")},52283:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"notFound",{enumerable:!0,get:function(){return f}});let d=c(7638),e=`${d.HTTP_ERROR_FALLBACK_ERROR_CODE};404`;function f(){let a=Object.defineProperty(Error(e),"__NEXT_ERROR_CODE",{value:"E1041",enumerable:!1,configurable:!0});throw a.digest=e,a}("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},53053:a=>{"use strict";a.exports=require("node:diagnostics_channel")},55511:a=>{"use strict";a.exports=require("crypto")},63033:a=>{"use strict";a.exports=require("next/dist/server/app-render/work-unit-async-storage.external.js")},64939:a=>{"use strict";a.exports=import("pg")},66136:a=>{"use strict";a.exports=require("timers")},66445:(a,b,c)=>{Promise.resolve().then(c.bind(c,93831)),Promise.resolve().then(c.bind(c,80532))},66610:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});var d={ReadonlyURLSearchParams:function(){return f.ReadonlyURLSearchParams},RedirectType:function(){return m},forbidden:function(){return i.forbidden},notFound:function(){return h.notFound},permanentRedirect:function(){return g.permanentRedirect},redirect:function(){return g.redirect},unauthorized:function(){return j.unauthorized},unstable_isUnrecognizedActionError:function(){return l},unstable_rethrow:function(){return k.unstable_rethrow}};for(var e in d)Object.defineProperty(b,e,{enumerable:!0,get:d[e]});let f=c(10381),g=c(32171),h=c(52283),i=c(92606),j=c(44057),k=c(98621);function l(){throw Object.defineProperty(Error("`unstable_isUnrecognizedActionError` can only be used on the client."),"__NEXT_ERROR_CODE",{value:"E776",enumerable:!1,configurable:!0})}let m={push:"push",replace:"replace"};("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},73024:a=>{"use strict";a.exports=require("node:fs")},73565:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});var d={actionAsyncStorage:function(){return f.actionAsyncStorage},workAsyncStorage:function(){return g.workAsyncStorage},workUnitAsyncStorage:function(){return h.workUnitAsyncStorage}};for(var e in d)Object.defineProperty(b,e,{enumerable:!0,get:d[e]});let f=c(19121),g=c(29294),h=c(63033);("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},74075:a=>{"use strict";a.exports=require("zlib")},76760:a=>{"use strict";a.exports=require("node:path")},77598:a=>{"use strict";a.exports=require("node:crypto")},78474:a=>{"use strict";a.exports=require("node:events")},79413:(a,b,c)=>{"use strict";c.r(b),c.d(b,{__next_app__:()=>w,handler:()=>y,routeModule:()=>x});var d=c(21635),e=c(86315),f=c(1020),g=c(61287),h={};for(let a in g)0>["default","__next_app__","routeModule","handler"].indexOf(a)&&(h[a]=()=>g[a]);c.d(b,h);let i=(0,d.p)(()=>Promise.resolve().then(c.bind(c,32059))),j=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,95547,23))),k=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,55091,23))),l=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,45270,23))),m=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,28193,23))),n=(0,d.p)(()=>Promise.resolve().then(c.bind(c,30508))),o=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,95547,23))),p=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,55091,23))),q=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,45270,23))),r=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,28193,23))),s=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,95547,23))),t=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,95547,23))),u={children:["",{children:["(dashboard)",{children:["dashboard",{children:["audit-proxy",{children:["__PAGE__",{},{page:[(0,d.p)(()=>Promise.resolve().then(c.bind(c,86282))),"D:\\bluerouter\\src\\app\\(dashboard)\\dashboard\\audit-proxy\\page.js"]}]},{"global-error":[t,"next/dist/client/components/builtin/global-error.js"]},[]]},{"global-error":[s,"next/dist/client/components/builtin/global-error.js"]},[]]},{layout:[n,"D:\\bluerouter\\src\\app\\(dashboard)\\layout.js"],"global-error":[o,"next/dist/client/components/builtin/global-error.js"],"not-found":[p,"next/dist/client/components/builtin/not-found.js"],forbidden:[q,"next/dist/client/components/builtin/forbidden.js"],unauthorized:[r,"next/dist/client/components/builtin/unauthorized.js"],metadata:{icon:[async a=>(await (0,d.p)(()=>Promise.resolve().then(c.bind(c,70440)))()).default(a)],apple:[],openGraph:[],twitter:[],manifest:"/manifest.webmanifest"}},[]]},{layout:[i,"D:\\bluerouter\\src\\app\\layout.js"],"global-error":[j,"next/dist/client/components/builtin/global-error.js"],"not-found":[k,"next/dist/client/components/builtin/not-found.js"],forbidden:[l,"next/dist/client/components/builtin/forbidden.js"],unauthorized:[m,"next/dist/client/components/builtin/unauthorized.js"],metadata:{icon:[async a=>(await (0,d.p)(()=>Promise.resolve().then(c.bind(c,70440)))()).default(a)],apple:[],openGraph:[],twitter:[],manifest:"/manifest.webmanifest"}},[]]}.children,v=(0,e.H)({tree:u,page:"/(dashboard)/dashboard/audit-proxy/page",pathname:"/dashboard/audit-proxy",require:c,loadChunk:()=>Promise.resolve(),interopDefault:f.T}),w=v.__next_app__,x=v.routeModule,y=v.handler},79428:a=>{"use strict";a.exports=require("buffer")},79748:a=>{"use strict";a.exports=require("fs/promises")},80099:a=>{"use strict";a.exports=require("node:sqlite")},80532:(a,b,c)=>{"use strict";c.d(b,{default:()=>h});var d=c(48249),e=c(67484),f=c(5243);function g({ok:a,children:b}){return(0,d.jsxs)("span",{className:`inline-flex items-center gap-1 rounded-full border px-2 py-0.5 text-xs font-medium ${a?"border-green-500/30 bg-green-500/10 text-green-600 dark:text-green-400":"border-border bg-surface text-text-muted"}`,children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-[13px]",children:a?"check_circle":"radio_button_unchecked"}),b]})}function h(){let[a,b]=(0,e.useState)(null),[c,h]=(0,e.useState)("");if((0,e.useCallback)(async()=>{try{let a=await fetch("/api/audit-proxy/me",{cache:"no-store"}),c=await a.json().catch(()=>({}));if(!a.ok)throw Error(c.error||"Kh\xf4ng tải được th\xf4ng tin truy cập Audit Proxy của bạn");b(c)}catch(a){h(a.message||"Kh\xf4ng tải được th\xf4ng tin truy cập Audit Proxy của bạn")}},[]),c&&!a)return(0,d.jsx)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-600 dark:text-red-400",children:c});if(!a)return(0,d.jsx)("div",{className:"rounded-xl border border-border bg-surface p-5 text-sm text-text-muted",children:"Đang tải Enterprise AI Audit Proxy…"});let i=a.rootCA||{},j=a.grant?.ips||[];return(0,d.jsxs)("div",{className:"space-y-4",children:[(0,d.jsxs)("div",{className:"rounded-2xl border border-primary/20 bg-primary/5 p-4",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-primary",children:"policy"}),(0,d.jsx)("h1",{className:"text-lg font-bold text-text-main",children:"Enterprise AI Audit Proxy"}),(0,d.jsx)(g,{ok:!0===a.running,children:a.running?"Đang chạy":"Đ\xe3 dừng"}),(0,d.jsx)(g,{ok:!0===i.validated,children:"Root CA"})]}),(0,d.jsx)("p",{className:"mt-2 max-w-4xl text-sm leading-6 text-text-muted",children:"T\xe0i khoản của bạn được ph\xe9p d\xf9ng audit proxy cho Claude Code v\xe0 Codex. C\xe0i Root CA một lần, sau đ\xf3 khởi động CLI bằng một trong c\xe1c lệnh b\xean dưới. Mọi request đi qua proxy đều được quản trị vi\xean ghi log để phục vụ kiểm to\xe1n."})]}),c?(0,d.jsx)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-600 dark:text-red-400",children:c}):null,(0,d.jsxs)("div",{className:"grid gap-4 xl:grid-cols-[0.8fr_1.2fr]",children:[(0,d.jsxs)("div",{className:"space-y-4",children:[(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Quyền truy cập của bạn"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"Proxy chỉ nhận kết nối từ c\xe1c địa chỉ IP dưới đ\xe2y. Từ m\xe1y c\xf3 IP kh\xe1c, kết nối sẽ bị đ\xf3ng ngay — cần th\xeam địa chỉ th\xec li\xean hệ quản trị vi\xean."}),(0,d.jsxs)("div",{className:"mt-3 grid gap-2 text-xs",children:[(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"T\xe0i khoản"}),(0,d.jsx)("span",{className:"break-all font-mono text-text-main",children:a.grant?.userId||a.userId||"-"})]}),a.grant?.note?(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Ghi ch\xfa"}),(0,d.jsx)("span",{className:"break-all text-text-main",children:a.grant.note})]}):null]}),(0,d.jsxs)("div",{className:"mt-3",children:[(0,d.jsx)("div",{className:"text-[11px] font-medium uppercase tracking-wide text-text-muted",children:"IP được cấp ph\xe9p"}),j.length?(0,d.jsx)("div",{className:"mt-1.5 flex flex-wrap gap-1.5",children:j.map(a=>(0,d.jsx)("span",{className:"rounded-full border border-primary/30 bg-primary/5 px-2.5 py-1 font-mono text-[11px] text-primary",children:a},a))}):(0,d.jsx)("p",{className:"mt-1.5 rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-[11px] leading-5 text-amber-700 dark:text-amber-300",children:a.isAdmin?"T\xe0i khoản admin của bạn kh\xf4ng c\xf3 grant ri\xeang. Grant chỉ d\xf9ng cho allowlist IP của proxy.":"Chưa c\xf3 địa chỉ n\xe0o được cấp, n\xean proxy sẽ từ chối kết nối của bạn. H\xe3y gửi IP m\xe1y trạm của bạn cho quản trị vi\xean."})]})]}),(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Root CA"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"Tải certificate v\xe0 lưu v\xe0o đ\xfang đường dẫn ghi trong phần hướng dẫn b\xean cạnh. Đ\xe2y l\xe0 certificate c\xf4ng khai, kh\xf4ng chứa private key."}),(0,d.jsxs)("div",{className:"mt-3 grid gap-2 text-xs",children:[(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Trạng th\xe1i"}),(0,d.jsx)("span",{className:"font-medium text-text-main",children:i.validated?"Đ\xe3 x\xe1c thực":i.certExists?"Cần kiểm tra lại":"Chưa tạo"})]}),i.subject?(0,d.jsxs)("div",{className:"grid gap-1",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Subject"}),(0,d.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:i.subject})]}):null,i.fingerprint?(0,d.jsxs)("div",{className:"grid gap-1",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Fingerprint public key"}),(0,d.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:i.fingerprint})]}):null,i.notAfter?(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Hết hạn"}),(0,d.jsx)("span",{className:"text-text-main",children:new Date(i.notAfter).toLocaleString()})]}):null]}),(0,d.jsx)("div",{className:"mt-4",children:(0,d.jsx)("a",{href:"/api/audit-proxy/ca?download=cert",className:`inline-flex rounded-lg border border-primary/30 bg-primary/10 px-3 py-2 text-xs font-semibold text-primary ${i.certExists?"":"pointer-events-none opacity-50"}`,children:"Tải Root CA"})})]})]}),(0,d.jsx)(f.Ay,{clientProxyHost:a.endpoint?.clientProxyHost,port:a.endpoint?.port,onError:h})]})]})}},81787:a=>{"use strict";a.exports=require("bun:sqlite")},86282:(a,b,c)=>{"use strict";c.r(b),c.d(b,{default:()=>i});var d=c(5735),e=c(91970),f=c(9471),g=c(1568),h=c(91202);async function i(){let a=await (0,f.Su)();return a.authenticated||(0,e.redirect)("/login"),a.canView||(0,e.redirect)("/dashboard/endpoint"),a.isAdmin?(0,d.jsx)(g.default,{}):(0,d.jsx)(h.default,{})}},87550:a=>{"use strict";a.exports=require("better-sqlite3")},91202:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(77943).registerClientReference)(function(){throw Error("Attempted to call the default export of \"D:\\\\bluerouter\\\\src\\\\app\\\\(dashboard)\\\\dashboard\\\\audit-proxy\\\\AuditProxyUserView.js\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"D:\\bluerouter\\src\\app\\(dashboard)\\dashboard\\audit-proxy\\AuditProxyUserView.js","default")},91645:a=>{"use strict";a.exports=require("net")},91970:(a,b,c)=>{"use strict";var d=c(66610);c.o(d,"notFound")&&c.d(b,{notFound:function(){return d.notFound}}),c.o(d,"redirect")&&c.d(b,{redirect:function(){return d.redirect}})},92606:(a,b,c)=>{"use strict";function d(){throw Object.defineProperty(Error("`forbidden()` is experimental and only allowed to be enabled when `experimental.authInterrupts` is enabled."),"__NEXT_ERROR_CODE",{value:"E488",enumerable:!1,configurable:!0})}Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"forbidden",{enumerable:!0,get:function(){return d}}),c(7638).HTTP_ERROR_FALLBACK_ERROR_CODE,("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},93831:(a,b,c)=>{"use strict";c.d(b,{default:()=>w});var d=c(48249),e=c(67484),f=c(2116),g=c.n(f);function h(){let[a,b]=(0,e.useState)(null),[c,f]=(0,e.useState)(!1),[g,h]=(0,e.useState)(!1),[i,j]=(0,e.useState)(!1),[k,l]=(0,e.useState)([]),[m,n]=(0,e.useState)(!1),[o,p]=(0,e.useState)(""),[q,r]=(0,e.useState)(!1),[s,t]=(0,e.useState)(""),[u,v]=(0,e.useState)("");(0,e.useCallback)(async()=>{try{let a=await fetch("/api/audit-proxy?limit=1",{cache:"no-store"}),c=await a.json();if(!a.ok)throw Error(c.error||"Cannot load Audit Proxy IP filter");b(c.config),f(c.status?.running===!0),h(c.status?.standby===!0),n(c.config?.clientIpFilterEnabled===!0),p((c.config?.allowedClientIps||[]).join("\n")),j(c.status?.security?.clientIpFilterSource==="grants"),l((c.config?.accessGrants||[]).flatMap(a=>a?.ips||[]))}catch(a){t(a.message||"Cannot load Audit Proxy IP filter")}},[]);let w=(0,e.useMemo)(()=>o.split(/\r?\n/).map(a=>a.trim()).filter(Boolean),[o]),x=async()=>{if(a){if(m&&0===w.length)return void t("Add at least one client IP or CIDR before enabling the filter.");r(!0),t(""),v("");try{let c=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-ip-filter",enabled:m,allowedClientIps:w})}),d=await c.json().catch(()=>({}));if(!c.ok)throw Error(d.error||"Failed to save client IP filter");v("Client IP filter saved and applied to the running proxy."),b(d.config||a),f(d.status?.running===!0),h(d.status?.standby===!0),n(d.config?.clientIpFilterEnabled===!0),p((d.config?.allowedClientIps||[]).join("\n")),j(d.status?.security?.clientIpFilterSource==="grants"),l((d.config?.accessGrants||[]).flatMap(a=>a?.ips||[]))}catch(a){t(a.message||"Failed to save client IP filter")}finally{r(!1)}}};return a?(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between",children:[(0,d.jsxs)("div",{children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-primary",children:"shield_lock"}),(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Client IP filter"}),(0,d.jsx)("span",{className:`rounded-full px-2 py-0.5 text-[10px] font-semibold ${m?"bg-green-500/10 text-green-600 dark:text-green-400":"bg-surface text-text-muted"}`,children:m?"ENABLED":"DISABLED"})]}),(0,d.jsxs)("p",{className:"mt-1 max-w-4xl text-xs leading-5 text-text-muted",children:["Restrict TCP access to the Audit Proxy itself. Only client IPs/CIDRs below can use port ",a.port,". The decision uses the socket peer IP; X-Forwarded-For and other HTTP headers are ignored."]}),i?(0,d.jsxs)("p",{className:"mt-2 max-w-4xl rounded-lg border border-primary/30 bg-primary/5 px-3 py-2 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("strong",{className:"text-primary",children:"Superseded by Access grants."})," The proxy is enforcing the ",new Set(k).size," address(es) granted to users above, and this list is ignored until every grant has no IP left. Manage access there."]}):null]}),(0,d.jsxs)("label",{className:"flex shrink-0 items-center gap-2 text-sm font-medium text-text-main",children:[(0,d.jsx)("input",{type:"checkbox",checked:m,onChange:a=>n(a.target.checked),disabled:i||g,className:"h-4 w-4 accent-[var(--color-primary)] disabled:opacity-50"}),"Enable IP filter"]})]}),s?(0,d.jsx)("div",{className:"mt-3 rounded-lg border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-600 dark:text-red-400",children:s}):null,u?(0,d.jsx)("div",{className:"mt-3 rounded-lg border border-green-500/30 bg-green-500/10 px-3 py-2 text-xs text-green-600 dark:text-green-400",children:u}):null,(0,d.jsxs)("div",{className:"mt-4 grid gap-4 lg:grid-cols-[1fr_320px]",children:[(0,d.jsxs)("label",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Allowed client IPs / CIDRs"}),(0,d.jsx)("textarea",{rows:6,value:o,onChange:a=>p(a.target.value),disabled:i||g,placeholder:"172.16.253.3\n172.16.253.0/24\n10.20.30.15\n2001:db8::/64",className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary"}),(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"One IPv4, IPv6, or CIDR per line. IPv4-mapped IPv6 addresses are normalized automatically."})]}),(0,d.jsxs)("div",{className:"grid content-start gap-3",children:[(0,d.jsxs)("div",{className:"rounded-xl border border-primary/20 bg-primary/5 p-3 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("div",{className:"font-semibold text-primary",children:"Security behavior"}),(0,d.jsx)("div",{className:"mt-1",children:"Allowed IP → proxy works normally."}),(0,d.jsx)("div",{children:"Other IP → TCP connection is immediately closed before CONNECT/HTTP parsing."}),(0,d.jsx)("div",{children:"Empty list + enabled → configuration is rejected."})]}),(0,d.jsx)("button",{type:"button",onClick:x,disabled:q||i||g,className:"rounded-lg bg-primary px-4 py-2 text-sm font-semibold text-white disabled:opacity-50",children:q?"Saving…":"Save IP Filter"}),c?(0,d.jsxs)("div",{className:"text-[11px] leading-4 text-text-muted",children:["Applied to the running listener on port ",a.port,"; no restart, and connections from an address you just removed are closed."]}):null]})]})]}):null}function i(){let[a,b]=(0,e.useState)(!1),[c,f]=(0,e.useState)(!1),[g,h]=(0,e.useState)([]),[i,j]=(0,e.useState)(!1),[k,l]=(0,e.useState)(""),[m,n]=(0,e.useState)(""),o=(a,c)=>{f(a?.proxyAuthEnabled===!0),h((a?.proxyAuthUsers||[]).map(a=>({username:a.username,hasPassword:!0===a.hasPassword,password:""}))),c&&b(!0===c.running)};(0,e.useCallback)(async()=>{try{let a=await fetch("/api/audit-proxy?limit=1",{cache:"no-store"}),b=await a.json();if(!a.ok)throw Error(b.error||"Cannot load proxy authentication");o(b.config,b.status)}catch(a){l(a.message||"Cannot load proxy authentication")}},[]);let p=(a,b)=>{h(c=>c.map((c,d)=>d===a?{...c,...b}:c))},q=async()=>{let a=g.map(a=>({...a,username:a.username.trim()}));if(c&&0===a.length)return void l("Add at least one account before enabling proxy authentication.");let b=a.find(a=>!a.hasPassword&&!a.password);if(b)return void l(`Set a password for ${b.username||"the new account"}.`);j(!0),l(""),n("");try{let b=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-proxy-auth",enabled:c,users:a.map(a=>a.password?{username:a.username,password:a.password}:{username:a.username})})}),d=await b.json().catch(()=>({}));if(!b.ok)throw Error(d.error||"Failed to save proxy authentication");n(d.restarted?"Proxy authentication saved and Audit Proxy restarted.":"Proxy authentication saved."),o(d.config,d.status)}catch(a){l(a.message||"Failed to save proxy authentication")}finally{j(!1)}};return(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-start justify-between gap-3",children:[(0,d.jsxs)("div",{className:"max-w-3xl",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Proxy authentication"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"Requires a username and password on every CONNECT, and records which account opened each tunnel, so the audit table answers who rather than only which IP. Give each person or CI job its own account: removing one leaves the others working."}),(0,d.jsx)("p",{className:"mt-2 rounded-lg border border-amber-500/30 bg-amber-500/5 p-2 text-[11px] leading-5 text-amber-700 dark:text-amber-300",children:"The proxy listener speaks plain HTTP, so the credential crosses the client-to-proxy hop unencrypted (Basic is base64, not encryption). This keeps out anyone without the password and attributes traffic to a person; it does not hide the password from someone capturing packets on that network. On an untrusted network use it alongside the client IP allowlist, not instead of it. The password also ends up in HTTPS_PROXY, and so in the process list and shell history."})]}),(0,d.jsxs)("label",{className:"flex shrink-0 items-center gap-2 text-sm text-text-main",children:[(0,d.jsx)("input",{type:"checkbox",checked:c,onChange:a=>f(a.target.checked),disabled:i,className:"h-4 w-4 accent-[var(--color-primary)]"}),"Require credentials"]})]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-2",children:[0===g.length?(0,d.jsx)("p",{className:"rounded-xl border border-border bg-background/50 p-3 text-xs text-text-muted",children:"No accounts yet."}):null,g.map((a,b)=>(0,d.jsxs)("div",{className:"grid gap-2 rounded-xl border border-border bg-background/50 p-3 sm:grid-cols-[1fr_1fr_auto]",children:[(0,d.jsx)("input",{type:"text",value:a.username,onChange:a=>p(b,{username:a.target.value}),disabled:i,placeholder:"username",className:"min-w-0 rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,d.jsx)("input",{type:"password",value:a.password,onChange:a=>p(b,{password:a.target.value}),disabled:i,placeholder:a.hasPassword?"Saved — leave blank to keep":"Set a password",className:"min-w-0 rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,d.jsx)("button",{type:"button",onClick:()=>{let a;(!(a=g[b]).hasPassword||window.confirm(`Remove ${a.username}? Anything using this account stops working after the restart.`))&&h(a=>a.filter((a,c)=>c!==b))},disabled:i,className:"rounded-lg border border-border px-3 py-2 text-xs text-text-muted transition hover:border-red-500/40 hover:text-red-600 disabled:opacity-50",children:"Remove"})]},b))]}),(0,d.jsxs)("div",{className:"mt-3 flex flex-wrap items-center gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:()=>h(a=>[...a,{username:"",hasPassword:!1,password:""}]),disabled:i,className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-muted transition hover:border-primary hover:text-primary disabled:opacity-50",children:"Add account"}),(0,d.jsx)("button",{type:"button",onClick:q,disabled:i,className:"rounded-lg bg-primary px-3 py-1.5 text-xs font-semibold text-white transition hover:opacity-90 disabled:opacity-50",children:i?"Saving…":a?"Save & Restart Proxy":"Save"}),(0,d.jsxs)("span",{className:"text-[11px] text-text-muted",children:["Clients pass credentials in the proxy URL: ",(0,d.jsx)("code",{className:"font-mono",children:"http://USER:PASSWORD@host:port"})," ","— URL-encode ",(0,d.jsx)("code",{className:"font-mono",children:"@ : / #"})," if the password contains them."]})]}),k?(0,d.jsx)("p",{className:"mt-3 rounded-lg border border-red-500/30 bg-red-500/5 p-2 text-xs text-red-600 dark:text-red-400",children:k}):null,m?(0,d.jsx)("p",{className:"mt-3 rounded-lg border border-green-500/30 bg-green-500/5 p-2 text-xs text-green-600 dark:text-green-400",children:m}):null]})}let j={granted:"already granted",ldap:"directory","api-key-owner":"API key owner","oauth-grant":"OAuth access",local:"local login"};function k({onChanged:a}){let[b,c]=(0,e.useState)(null),[f,g]=(0,e.useState)("manual"),[h,i]=(0,e.useState)(0),[l,m]=(0,e.useState)(!1),[n,o]=(0,e.useState)(!1),[p,q]=(0,e.useState)(""),[r,s]=(0,e.useState)(""),[t,u]=(0,e.useState)(""),[v,w]=(0,e.useState)([]),[x,y]=(0,e.useState)(!1),[z,A]=(0,e.useState)(!1),[B,C]=(0,e.useState)(""),[D,E]=(0,e.useState)(""),[F,G]=(0,e.useState)(""),[H,I]=(0,e.useState)(""),J=(0,e.useCallback)(a=>{c(Array.isArray(a?.config?.accessGrants)?a.config.accessGrants:[]),g(a?.status?.security?.clientIpFilterSource||"manual"),i(Number(a?.status?.security?.enforcedClientIpCount||0)),m(a?.status?.running===!0),o(a?.status?.standby===!0)},[]);(0,e.useCallback)(async()=>{try{let a=await fetch("/api/audit-proxy?limit=1",{cache:"no-store"}),b=await a.json();if(!a.ok)throw Error(b.error||"Cannot load Audit Proxy access grants");J(b)}catch(a){E(a.message||"Cannot load Audit Proxy access grants")}},[J]);let K=(0,e.useMemo)(()=>String(r||"").split(/[\r\n,]+/).map(a=>a.trim()).filter(Boolean),[r]),L=async(b,c,d)=>{C(b),E(""),G("");try{let e=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:b,...c})}),f=await e.json().catch(()=>({}));if(!e.ok)throw Error(f.error||"Failed to save Audit Proxy access grant");J(f);let g=Number(f.droppedConnections||0);return G(`${d} Applied to the running proxy without a restart.${g?` ${g} open connection(s) from addresses that lost access were closed.`:""}`),a?.(),!0}catch(a){return E(a.message||"Failed to save Audit Proxy access grant"),!1}finally{C("")}},M=async()=>{let a=String(p||"").trim().toLowerCase();a?await L("save-access-grant",{userId:a,ips:K,note:t},`Access grant for ${a} saved.`)&&(q(""),s(""),u("")):E("Enter the dashboard username or email to grant access to.")},N=async a=>{await L("delete-access-grant",{userId:a},`Access grant for ${a} revoked.`)&&I("")};if(!b)return null;let O=b.reduce((a,b)=>a+(b.ips?.length||0),0);return(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("div",{className:"flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between",children:(0,d.jsxs)("div",{children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-primary",children:"group"}),(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Access grants — who may use this proxy"}),(0,d.jsx)("span",{className:`rounded-full px-2 py-0.5 text-[10px] font-semibold ${"grants"===f?"bg-green-500/10 text-green-600 dark:text-green-400":"bg-surface text-text-muted"}`,children:"grants"===f?`ENFORCING ${h} IP`:"NOT ENFORCING"})]}),(0,d.jsxs)("p",{className:"mt-1 max-w-4xl text-xs leading-5 text-text-muted",children:["Grant a dashboard user the client IPs they may connect from. As soon as one grant carries an IP, the proxy accepts ",(0,d.jsx)("strong",{children:"only granted addresses"})," and the free-text Client IP filter below is superseded. Each granted user also gets a read-only ",(0,d.jsx)("span",{className:"font-mono",children:"/dashboard/audit-proxy"})," page with the root CA download, the launcher commands and their own addresses — no configuration, no audited traffic."]})]})}),D?(0,d.jsx)("div",{className:"mt-3 rounded-lg border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-600 dark:text-red-400",children:D}):null,F?(0,d.jsx)("div",{className:"mt-3 rounded-lg border border-green-500/30 bg-green-500/10 px-3 py-2 text-xs text-green-600 dark:text-green-400",children:F}):null,(0,d.jsxs)("div",{className:"mt-4 grid gap-4 lg:grid-cols-[1fr_320px]",children:[(0,d.jsxs)("div",{className:"grid gap-3",children:[(0,d.jsxs)("div",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Dashboard username / email"}),(0,d.jsxs)("div",{className:"relative",children:[(0,d.jsx)("input",{value:p,onChange:a=>{q(a.target.value),y(!0)},onFocus:()=>y(!0),onBlur:()=>setTimeout(()=>y(!1),150),autoComplete:"off",placeholder:"anh-tct or anh-tct@fujinet.net",className:"w-full rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary"}),x&&(z||v.length>0)?(0,d.jsxs)("div",{className:"absolute z-20 mt-1 max-h-64 w-full overflow-y-auto rounded-lg border border-border bg-surface shadow-lg",children:[z&&0===v.length?(0,d.jsx)("div",{className:"px-3 py-2 text-xs text-text-muted",children:"Searching…"}):null,v.map(a=>{let c=b.some(b=>b.userId===a.id);return(0,d.jsxs)("button",{type:"button",onMouseDown:a=>a.preventDefault(),onClick:()=>{q(a.id),y(!1)},className:"flex w-full items-center justify-between gap-2 px-3 py-2 text-left hover:bg-background",children:[(0,d.jsxs)("span",{className:"min-w-0",children:[(0,d.jsx)("span",{className:"block truncate font-mono text-xs text-text-main",children:a.id}),a.displayName||a.email?(0,d.jsx)("span",{className:"block truncate text-[11px] text-text-muted",children:[a.displayName,a.email].filter(Boolean).join(" \xb7 ")}):null]}),(0,d.jsxs)("span",{className:"flex shrink-0 items-center gap-1",children:[c?(0,d.jsx)("span",{className:"rounded-full bg-green-500/10 px-2 py-0.5 text-[10px] font-semibold text-green-600 dark:text-green-400",children:"granted"}):null,(0,d.jsx)("span",{className:"rounded-full border border-border px-2 py-0.5 text-[10px] text-text-muted",children:j[a.source]||a.source})]})]},`${a.source}:${a.id}`)})]}):null]}),(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"The identity the user logs into this dashboard with (LDAP/OIDC/local). Either the username or the email form is matched. Suggestions come from the directory and from accounts this install already knows; a name that is not listed can still be typed."})]}),(0,d.jsxs)("label",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Allowed client IPs / CIDRs"}),(0,d.jsx)("textarea",{rows:4,value:r,onChange:a=>s(a.target.value),placeholder:"172.16.253.2\n172.16.6.0/24",className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary"}),(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"One IPv4, IPv6 or CIDR per line — the workstation addresses this user runs Claude Code / Codex from."})]}),(0,d.jsxs)("label",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Note (optional)"}),(0,d.jsx)("input",{value:t,onChange:a=>u(a.target.value),placeholder:"Laptop + VDI",className:"rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary"})]})]}),(0,d.jsxs)("div",{className:"grid content-start gap-3",children:[(0,d.jsxs)("div",{className:"rounded-xl border border-primary/20 bg-primary/5 p-3 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("div",{className:"font-semibold text-primary",children:"What a grant changes"}),(0,d.jsx)("div",{className:"mt-1",children:"Granted IP → proxy works normally."}),(0,d.jsx)("div",{children:"Any other IP → TCP connection closed before CONNECT is parsed."}),(0,d.jsx)("div",{children:"Granted user → read-only Audit Proxy page + CA download."}),(0,d.jsx)("div",{children:"No grant with an IP → falls back to the Client IP filter below."}),(0,d.jsx)("div",{className:"mt-1 text-[11px]",children:"Applied without restarting the listener."})]}),(0,d.jsx)("button",{type:"button",onClick:M,disabled:!!B||n,className:"rounded-lg bg-primary px-4 py-2 text-sm font-semibold text-white disabled:opacity-50",children:"save-access-grant"===B?"Saving…":"Save grant"}),l?(0,d.jsx)("div",{className:"text-[11px] leading-4 text-text-muted",children:"The listener keeps running: the change governs the next connection, and tunnels held by an address you just removed are closed."}):null]})]}),(0,d.jsxs)("div",{className:"mt-4 border-t border-border pt-4",children:[(0,d.jsxs)("div",{className:"mb-3 flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsx)("h3",{className:"text-sm font-semibold text-text-main",children:"Granted users"}),(0,d.jsxs)("span",{className:"text-[11px] text-text-muted",children:[b.length," user \xb7 ",O," address"]})]}),0===b.length?(0,d.jsx)("div",{className:"rounded-xl border border-dashed border-border p-6 text-center text-xs text-text-muted",children:"No grant yet. The proxy still follows the Client IP filter below, and only admins can open this page."}):(0,d.jsx)("div",{className:"overflow-x-auto rounded-xl border border-border",children:(0,d.jsxs)("table",{className:"min-w-full divide-y divide-border text-xs",children:[(0,d.jsx)("thead",{className:"bg-surface/80 text-left uppercase tracking-wide text-text-muted",children:(0,d.jsxs)("tr",{children:[(0,d.jsx)("th",{className:"px-3 py-2 font-medium",children:"User"}),(0,d.jsx)("th",{className:"px-3 py-2 font-medium",children:"Allowed client IPs"}),(0,d.jsx)("th",{className:"px-3 py-2 font-medium",children:"Note"}),(0,d.jsx)("th",{className:"px-3 py-2 text-right font-medium",children:"Actions"})]})}),(0,d.jsx)("tbody",{className:"divide-y divide-border bg-background",children:b.map(a=>(0,d.jsxs)("tr",{className:"align-top",children:[(0,d.jsx)("td",{className:"px-3 py-3 font-mono text-text-main",children:a.userId}),(0,d.jsx)("td",{className:"px-3 py-3",children:a.ips?.length?(0,d.jsx)("div",{className:"flex flex-wrap gap-1",children:a.ips.map(a=>(0,d.jsx)("span",{className:"rounded-full border border-border bg-surface px-2 py-0.5 font-mono text-[10px] text-text-muted",children:a},a))}):(0,d.jsx)("span",{className:"text-amber-600 dark:text-amber-400",children:"No IP — page access only, proxy will refuse this user"})}),(0,d.jsx)("td",{className:"px-3 py-3 text-text-muted",children:a.note||"-"}),(0,d.jsx)("td",{className:"px-3 py-3",children:(0,d.jsxs)("div",{className:"flex flex-wrap justify-end gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:()=>{q(a.userId),s((a.ips||[]).join("\n")),u(a.note||"")},disabled:n,className:"rounded-lg border border-border px-2.5 py-1 font-semibold text-text-main hover:bg-surface",children:"Edit"}),H===a.userId?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("button",{type:"button",onClick:()=>N(a.userId),disabled:!!B||n,className:"rounded-lg border border-red-500/30 bg-red-500/10 px-2.5 py-1 font-semibold text-red-600 disabled:opacity-50",children:"Confirm revoke"}),(0,d.jsx)("button",{type:"button",onClick:()=>I(""),className:"rounded-lg border border-border px-2.5 py-1 text-text-muted",children:"Cancel"})]}):(0,d.jsx)("button",{type:"button",onClick:()=>I(a.userId),disabled:n,className:"rounded-lg border border-red-500/30 px-2.5 py-1 font-semibold text-red-600 hover:bg-red-500/10",children:"Revoke"})]})})]},a.userId))})]})})]})]})}var l=c(5243);let m=["api.anthropic.com","*.anthropic.com","claude.ai","*.claude.ai"],n=["api.openai.com","*.openai.com","chatgpt.com","*.chatgpt.com"],o=[{id:"claude-code",label:"Claude Code"},{id:"codex",label:"OpenAI Codex"},{id:"gemini-cli",label:"Gemini CLI"},{id:"cursor",label:"Cursor"},{id:"curl",label:"curl / scripts"}];function p({ok:a,children:b}){return(0,d.jsxs)("span",{className:`inline-flex items-center gap-1 rounded-full border px-2 py-0.5 text-xs font-medium ${a?"border-green-500/30 bg-green-500/10 text-green-600 dark:text-green-400":"border-border bg-surface text-text-muted"}`,children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-[13px]",children:a?"check_circle":"radio_button_unchecked"}),b]})}function q(a){let b=Number(a||0);return!Number.isFinite(b)||b<=0?"0":b>=1e6?`${(b/1e6).toFixed(2)}M`:b>=1e3?`${(b/1e3).toFixed(1)}k`:String(b)}function r(a){let b=Number(a||0);return!Number.isFinite(b)||b<=0?"$0.00":b<.01?`$${b.toFixed(4)}`:`$${b.toFixed(2)}`}function s({label:a,value:b,hint:c}){return(0,d.jsxs)("div",{className:"rounded-xl border border-border bg-background/50 p-3",children:[(0,d.jsx)("div",{className:"text-[11px] font-medium uppercase tracking-wide text-text-muted",children:a}),(0,d.jsx)("div",{className:"mt-1 text-lg font-semibold text-text-main",children:b}),c?(0,d.jsx)("div",{className:"mt-0.5 text-[11px] leading-4 text-text-muted",children:c}):null]})}function t({title:a,rows:b}){return b?.length?(0,d.jsxs)("div",{className:"min-w-0",children:[(0,d.jsx)("h3",{className:"text-xs font-semibold uppercase tracking-wide text-text-muted",children:a}),(0,d.jsx)("div",{className:"mt-2 overflow-x-auto",children:(0,d.jsxs)("table",{className:"w-full min-w-[420px] text-left text-xs",children:[(0,d.jsx)("thead",{className:"border-b border-border text-text-muted",children:(0,d.jsxs)("tr",{children:[(0,d.jsx)("th",{className:"px-2 py-1.5 font-medium",children:"Name"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Reqs"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"In"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Out"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Cache R/W"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Cost"})]})}),(0,d.jsx)("tbody",{children:b.map(a=>(0,d.jsxs)("tr",{className:"border-b border-border/60 text-text-main",children:[(0,d.jsx)("td",{className:"max-w-[220px] truncate px-2 py-1.5 font-mono text-[11px]",title:a.label,children:a.label}),(0,d.jsx)("td",{className:"px-2 py-1.5 text-right",children:a.requests}),(0,d.jsx)("td",{className:"px-2 py-1.5 text-right",children:q(a.inputTokens)}),(0,d.jsx)("td",{className:"px-2 py-1.5 text-right",children:q(a.outputTokens)}),(0,d.jsxs)("td",{className:"px-2 py-1.5 text-right text-text-muted",children:[q(a.cacheReadTokens),"/",q(a.cacheCreationTokens)]}),(0,d.jsx)("td",{className:"px-2 py-1.5 text-right",children:r(a.cost)})]},a.label))})]})})]}):null}function u({label:a,hint:b,children:c}){return(0,d.jsxs)("label",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:a}),c,b?(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:b}):null]})}function v({label:a,description:b,checked:c,onChange:e,disabled:f=!1}){return(0,d.jsxs)("label",{className:"flex items-start justify-between gap-4 rounded-xl border border-border bg-background/50 p-3",children:[(0,d.jsxs)("span",{children:[(0,d.jsx)("span",{className:"block text-sm font-semibold text-text-main",children:a}),(0,d.jsx)("span",{className:"mt-0.5 block text-xs leading-5 text-text-muted",children:b})]}),(0,d.jsx)("input",{type:"checkbox",checked:c,onChange:a=>e(a.target.checked),disabled:f,className:"mt-1 h-4 w-4 accent-[var(--color-primary)]"})]})}function w(){let[a,b]=(0,e.useState)(null),[c,f]=(0,e.useState)(null),[j,w]=(0,e.useState)(""),[x,y]=(0,e.useState)(""),[z,A]=(0,e.useState)(""),[B,C]=(0,e.useState)(null),[D,E]=(0,e.useState)("configuration"),F=(0,e.useCallback)(async(a=!0)=>{try{let c=await fetch("/api/audit-proxy?limit=50",{cache:"no-store"}),d=await c.json();if(!c.ok)throw Error(d.error||"Cannot load Audit Proxy");b(d),a?f(a=>a||d.config):f(d.config)}catch(a){y(a.message||"Cannot load Audit Proxy")}},[]),G=a?.status||{},H=G.security||{},I=G.rootCA||{},J=!0===G.running,K=!0===G.pendingListenerRestart,L=!0===G.standby,M=(c?.allowedHosts||[]).join("\n"),N=(a,b)=>f(c=>({...c,[a]:b})),O=async(a,b={})=>{w(a),y(""),A("");try{let c=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:a,...b})}),d=await c.json().catch(()=>({}));if(!c.ok)throw Error(d.error||`${a} failed`);return"test"===a?(C(d.test),A(`Simulation passed ${d.test.passed}/${d.test.total} checks.`)):A("clear-logs"===a?"Audit logs cleared.":`Audit Proxy ${a} completed.`),await F("start"!==a&&"restart"!==a),d}catch(b){return y(b.message||`${a} failed`),null}finally{w("")}},P=async()=>{w("save"),y(""),A("");try{let a=await fetch("/api/audit-proxy",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({config:c})}),b=await a.json();if(!a.ok)throw Error(b.error||"Save failed");f(b.config);let d=Number(b.droppedConnections||0);A(b.rebindRequired?`Configuration saved and applied. The listener address/port change waits for Save & Restart — the proxy is still on ${G.address?.address||c.bindHost}:${G.address?.port||c.port}.`:`Configuration saved and applied to the running proxy${J?" without a restart":""}.${d?` ${d} connection(s) from addresses that lost access were closed.`:""}`),await F(!0)}catch(a){y(a.message||"Save failed")}finally{w("")}},Q=async()=>{w("save-client-host"),y(""),A("");try{let a=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-client-host",clientProxyHost:c?.clientProxyHost||""})}),b=await a.json().catch(()=>({}));if(!a.ok)throw Error(b.error||"Failed to save Client proxy host");f(a=>({...a,clientProxyHost:b.config?.clientProxyHost||""})),A("Client proxy host saved."),await F(!0)}catch(a){y(a.message||"Failed to save Client proxy host")}finally{w("")}},R=async()=>{w("ca"),y("");try{let a=await fetch("/api/audit-proxy/ca",{method:"POST"}),b=await a.json();if(!a.ok)throw Error(b.error||"CA validation failed");A("Root CA is ready. Existing enterprise CA material was not rotated."),await F(!0)}catch(a){y(a.message||"CA validation failed")}finally{w("")}},S=a=>N("allowedHosts",[...new Set([...c?.allowedHosts||[],...a])]);if(!c)return(0,d.jsx)("div",{className:"rounded-xl border border-border bg-surface p-5 text-sm text-text-muted",children:"Loading Enterprise AI Audit Proxy…"});let T=Math.round(Number(c.captureLimitBytes||0)/1024/1024*10)/10,U=["0.0.0.0","::"].includes(c.bindHost)||!String(c.bindHost).startsWith("127.")&&"localhost"!==c.bindHost&&"::1"!==c.bindHost;return(0,d.jsxs)("div",{className:"space-y-4",children:[(0,d.jsxs)("div",{className:"flex flex-col gap-3 rounded-2xl border border-primary/20 bg-primary/5 p-4 sm:flex-row sm:items-start sm:justify-between",children:[(0,d.jsxs)("div",{children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-primary",children:"policy"}),(0,d.jsx)("h1",{className:"text-lg font-bold text-text-main",children:"Enterprise AI Audit Proxy"}),(0,d.jsx)(p,{ok:J,children:J?"Running":"Stopped"}),(0,d.jsx)(p,{ok:!0===I.validated,children:"Root CA"}),(0,d.jsx)(p,{ok:c.verifyUpstreamTls,children:"Verified upstream TLS"}),(0,d.jsx)(p,{ok:!0,children:G.capabilities?.http2===!0?"HTTP/1.1 + HTTP/2":"HTTP/1.1"})]}),(0,d.jsx)("p",{className:"mt-2 max-w-5xl text-sm leading-6 text-text-muted",children:"Explicit HTTPS CONNECT proxy for Claude Code and Codex. Request method, path, query, authentication values and body bytes are forwarded without content rewriting. Standard hop-by-hop headers and BlueRouter internal headers remain intentionally removed."})]}),(0,d.jsxs)(g(),{href:"/dashboard/mitm",className:"inline-flex items-center gap-1 text-xs font-medium text-primary hover:underline",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-[16px]",children:"arrow_back"})," AI Traffic Gateway"]})]}),x?(0,d.jsx)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-600 dark:text-red-400",children:x}):null,z?(0,d.jsx)("div",{className:"rounded-xl border border-green-500/30 bg-green-500/10 px-4 py-3 text-sm text-green-600 dark:text-green-400",children:z}):null,(0,d.jsxs)("div",{className:"flex w-fit items-center gap-1 rounded-xl border border-border bg-surface p-1",children:[(0,d.jsx)("button",{type:"button",onClick:()=>E("configuration"),className:`rounded-lg px-3 py-1.5 text-xs font-semibold transition ${"configuration"===D?"bg-primary text-white":"text-text-muted hover:bg-background hover:text-text-main"}`,children:"Configuration"}),(0,d.jsx)("button",{type:"button",onClick:()=>E("audit"),className:`rounded-lg px-3 py-1.5 text-xs font-semibold transition ${"audit"===D?"bg-primary text-white":"text-text-muted hover:bg-background hover:text-text-main"}`,children:"Audit & Usage"})]}),(0,d.jsxs)("div",{className:"configuration"===D?"space-y-4":"hidden",children:[L?(0,d.jsxs)("div",{className:"rounded-xl border border-blue-500/30 bg-blue-500/10 px-4 py-3 text-sm text-blue-700 dark:text-blue-300",children:[(0,d.jsx)("strong",{children:"Node n\xe0y đang l\xe0 Cluster Standby."})," Access grants, TLS allowlist, client tool filter v\xe0 capture được đồng bộ từ Master qua cluster snapshot, n\xean form ở đ\xe2y chỉ đọc. Sửa tr\xean Master rồi để sync \xe1p xuống. Bind address/port, Proxy authentication v\xe0 Root CA vẫn l\xe0 của ri\xeang node n\xe0y."]}):null,K?(0,d.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-3 rounded-xl border border-amber-500/30 bg-amber-500/10 px-4 py-3 text-sm text-amber-700 dark:text-amber-300",children:[(0,d.jsxs)("span",{children:[(0,d.jsx)("strong",{children:"Listener address/port change is pending."})," Saved as ",c.bindHost,":",c.port,", still bound to ",G.address?.address,":",G.address?.port,". A bound socket cannot move — restart the listener to apply it. Everything else you saved is already live."]}),(0,d.jsx)("button",{type:"button",onClick:()=>O("restart",{config:c}),disabled:!!j,className:"shrink-0 rounded-lg border border-amber-500/40 bg-amber-500/10 px-3 py-1.5 text-xs font-semibold disabled:opacity-50",children:"restart"===j?"Restarting…":"Restart listener now"})]}):null,H.lanExposedWithoutIpFilter?(0,d.jsxs)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-700 dark:text-red-300",children:[(0,d.jsx)("strong",{children:"LAN listener has no Client IP filter."})," Enable the IP allowlist below before broad deployment. Plain HTTP, private destinations and CONNECT ports other than 443 are blocked, but the listener should still be restricted by firewall/VLAN."]}):U?(0,d.jsxs)("div",{className:"rounded-xl border border-amber-500/30 bg-amber-500/10 px-4 py-3 text-sm text-amber-700 dark:text-amber-300",children:[(0,d.jsx)("strong",{children:"LAN listener enabled."})," Keep TCP ",c.port," restricted to the intended LAN/VPN and maintain the Client IP allowlist."]}):null,I.expiringSoon?(0,d.jsx)("div",{className:"rounded-xl border border-amber-500/30 bg-amber-500/10 px-4 py-3 text-sm text-amber-700 dark:text-amber-300",children:"Root CA expires soon. Audit Proxy will not rotate enterprise CA material automatically; prepare and deploy the replacement CA through Advanced CA management."}):null,(0,d.jsxs)("div",{className:"grid gap-4 xl:grid-cols-[1.25fr_0.75fr]",children:[(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"mb-4 flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Proxy configuration"}),(0,d.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"All server-side setup is managed here. No proxy daemon CLI is required."})]}),(0,d.jsxs)("div",{className:"flex flex-wrap gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:()=>S(m),className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-main hover:bg-background disabled:opacity-50",children:"+ Anthropic preset"}),(0,d.jsx)("button",{type:"button",onClick:()=>S(n),className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-main hover:bg-background disabled:opacity-50",children:"+ OpenAI preset"})]})]}),(0,d.jsxs)("div",{className:"grid gap-4 md:grid-cols-2",children:[(0,d.jsx)(u,{label:"Bind address",hint:"127.0.0.1 = local only. Use 0.0.0.0 or a LAN IP for other workstations. The only setting that needs Save & Restart while the proxy runs — a bound socket cannot move.",children:(0,d.jsx)("input",{value:c.bindHost,onChange:a=>N("bindHost",a.target.value),className:`rounded-lg border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary ${K?"border-amber-500/50":"border-border"}`})}),(0,d.jsx)(u,{label:"Proxy port",hint:"Default 3128; Docker deployments must publish this port explicitly. Also needs Save & Restart to take effect.",children:(0,d.jsx)("input",{type:"number",min:"1",max:"65535",value:c.port,onChange:a=>N("port",Number(a.target.value)),className:`rounded-lg border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary ${K?"border-amber-500/50":"border-border"}`})}),(0,d.jsx)(u,{label:"Client proxy host",hint:"Manual persistent hostname/IP used only in deployment commands; it does not change the listener.",children:(0,d.jsxs)("div",{className:"flex gap-2",children:[(0,d.jsx)("input",{value:c.clientProxyHost||"",onChange:a=>N("clientProxyHost",a.target.value),placeholder:"172.16.6.8 or proxy.example.local",className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary"}),(0,d.jsx)("button",{type:"button",onClick:Q,disabled:!!j||L,className:"shrink-0 rounded-lg border border-primary/30 bg-primary/10 px-3 py-2 text-xs font-semibold text-primary disabled:opacity-50",children:"save-client-host"===j?"Saving…":"Save host"})]})}),(0,d.jsx)(u,{label:"Capture limit / request",hint:"Traffic streams immediately; only this bounded prefix is retained for audit.",children:(0,d.jsxs)("div",{className:"flex items-center gap-2",children:[(0,d.jsx)("input",{type:"number",min:"0",max:"16",step:"0.5",value:T,onChange:a=>N("captureLimitBytes",Math.round(1024*Number(a.target.value)*1024)),disabled:!c.captureBodies,className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,d.jsx)("span",{className:"text-xs text-text-muted",children:"MB"})]})})]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-3 md:grid-cols-2",children:[(0,d.jsx)(v,{label:"Pass through non-audited hosts",description:"Unknown hosts use a blind TLS tunnel only when they resolve to public addresses on TCP 443. Private/reserved destinations are denied.",checked:c.passthroughUnknown,onChange:a=>N("passthroughUnknown",a)}),(0,d.jsx)(v,{label:"Capture request/response bodies",description:"Credentials are redacted before persistence. Disable to retain metadata and wire hashes only.",checked:c.captureBodies,onChange:a=>N("captureBodies",a)})]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-3",children:[(0,d.jsx)(v,{label:"Restrict which client tools may connect",description:"Refuses a CONNECT whose User-Agent identifies a tool that is not listed. Catches a browser pointed at the proxy, or a script that inherited HTTPS_PROXY. It cannot catch a client that sends no User-Agent — Claude Code sends none at all and Codex only on its first tunnel, so those are always let through, and anyone can do the same by dropping the header. Hygiene, not access control: the client IP allowlist and who holds the root CA are what bound access.",checked:!0===c.clientToolFilterEnabled,onChange:a=>N("clientToolFilterEnabled",a)}),c.clientToolFilterEnabled?(0,d.jsxs)("div",{className:"grid gap-2",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-1.5",children:[(0,d.jsx)("span",{className:"text-[11px] font-medium text-text-muted",children:"Add:"}),o.map(a=>(0,d.jsx)("button",{type:"button",disabled:(c.allowedClientTools||[]).includes(a.id),onClick:()=>N("allowedClientTools",[...new Set([...c.allowedClientTools||[],a.id])]),className:"rounded-lg border border-border px-2 py-1 text-[11px] text-text-muted transition hover:border-primary hover:text-primary disabled:opacity-40",children:a.label},a.id))]}),(0,d.jsx)(u,{label:"Allowed client tools",hint:"One entry per line: a preset id above, or any substring matched against the User-Agent. Only clients that send a User-Agent are checked. Refused connections appear in the audit table with the User-Agent that was rejected, so you can add what you actually use.",children:(0,d.jsx)("textarea",{rows:4,value:(c.allowedClientTools||[]).join("\n"),onChange:a=>N("allowedClientTools",a.target.value.split(/\r?\n/).map(a=>a.trim().toLowerCase()).filter(Boolean)),disabled:J,placeholder:"claude-code\ncodex",className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"})})]}):null]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-4 md:grid-cols-[1fr_190px]",children:[(0,d.jsx)(u,{label:"TLS inspection allowlist",hint:"One hostname/wildcard per line. Only these public HTTPS hosts are decrypted and audited.",children:(0,d.jsx)("textarea",{rows:9,value:M,onChange:a=>N("allowedHosts",a.target.value.split(/\r?\n/).map(a=>a.trim()).filter(Boolean)),className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"})}),(0,d.jsxs)("div",{className:"grid content-start gap-4",children:[(0,d.jsx)(u,{label:"Retention",hint:"Daily local JSONL segments older than this value are deleted hourly.",children:(0,d.jsxs)("div",{className:"flex items-center gap-2",children:[(0,d.jsx)("input",{type:"number",min:"1",max:"365",value:c.retentionDays,onChange:a=>N("retentionDays",Number(a.target.value)),className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,d.jsx)("span",{className:"text-xs text-text-muted",children:"days"})]})}),(0,d.jsxs)("div",{className:"rounded-xl border border-green-500/20 bg-green-500/5 p-3 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("div",{className:"font-semibold text-green-600 dark:text-green-400",children:"Transport controls enforced"}),"TLS verification ON \xb7 HTTP/1.1 \xb7 HTTPS CONNECT only \xb7 public TCP 443 only."]})]})]}),(0,d.jsxs)("div",{className:"mt-4 flex flex-wrap items-center gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:P,disabled:!!j||L,className:"rounded-lg bg-primary px-4 py-2 text-sm font-semibold text-white disabled:opacity-50",children:"save"===j?"Saving…":J?"Save & apply":"Save"}),J?(0,d.jsx)("button",{type:"button",onClick:()=>O("stop"),disabled:!!j,className:"rounded-lg border border-red-500/30 bg-red-500/10 px-4 py-2 text-sm font-semibold text-red-500 disabled:opacity-50",children:"stop"===j?"Stopping…":"Stop Proxy"}):(0,d.jsx)("button",{type:"button",onClick:()=>O("start",{config:c}),disabled:!!j,className:"rounded-lg border border-green-500/30 bg-green-500/10 px-4 py-2 text-sm font-semibold text-green-600 disabled:opacity-50",children:"start"===j?"Starting…":"Start Proxy"}),(0,d.jsx)("button",{type:"button",onClick:()=>O("restart",{config:c}),disabled:!!j,className:"rounded-lg border border-border px-4 py-2 text-sm font-semibold text-text-main hover:bg-background disabled:opacity-50",children:"restart"===j?"Restarting…":"Save & Restart"}),(0,d.jsx)("button",{type:"button",onClick:()=>O("test"),disabled:!!j,className:"rounded-lg border border-primary/30 bg-primary/10 px-4 py-2 text-sm font-semibold text-primary disabled:opacity-50",children:"test"===j?"Testing…":"Run Simulated Test"}),(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"Save applies to the running proxy immediately — open tunnels keep streaming. Restart is only for the bind address and port."})]})]}),(0,d.jsxs)("div",{className:"space-y-4",children:[(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Root CA"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"The existing Root CA/key pair is validated and reused. Audit Proxy never auto-rotates enterprise CA material."}),(0,d.jsxs)("div",{className:"mt-3 grid gap-2 text-xs",children:[(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Status"}),(0,d.jsx)("span",{className:"font-medium text-text-main",children:I.validated?"Validated":I.certExists?"Needs attention":"Not generated"})]}),I.subject?(0,d.jsxs)("div",{className:"grid gap-1",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Subject"}),(0,d.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:I.subject})]}):null,I.fingerprint?(0,d.jsxs)("div",{className:"grid gap-1",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Public key fingerprint"}),(0,d.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:I.fingerprint})]}):null,I.notAfter?(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Expires"}),(0,d.jsx)("span",{className:"text-text-main",children:new Date(I.notAfter).toLocaleString()})]}):null,I.error?(0,d.jsx)("div",{className:"rounded-lg bg-red-500/10 p-2 text-red-600 dark:text-red-300",children:I.error}):null]}),(0,d.jsxs)("div",{className:"mt-4 flex flex-wrap gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:R,disabled:!!j,className:"rounded-lg border border-border px-3 py-2 text-xs font-semibold text-text-main hover:bg-background disabled:opacity-50",children:I.certExists?"Validate / Reuse CA":"Generate CA"}),(0,d.jsx)("a",{href:"/api/audit-proxy/ca?download=cert",className:`rounded-lg border border-primary/30 bg-primary/10 px-3 py-2 text-xs font-semibold text-primary ${!I.certExists?"pointer-events-none opacity-50":""}`,children:"Download Root CA"}),(0,d.jsx)(g(),{href:"/dashboard/mitm",className:"rounded-lg border border-border px-3 py-2 text-xs font-semibold text-text-main hover:bg-background",children:"Advanced CA management"})]})]}),(0,d.jsx)(l.Ay,{clientProxyHost:c.clientProxyHost,port:c.port,onError:y})]})]}),B?(0,d.jsxs)("section",{className:`rounded-2xl border p-4 ${B.ok?"border-green-500/30 bg-green-500/5":"border-red-500/30 bg-red-500/5"}`,children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Simulated end-to-end test"}),(0,d.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"Local throwaway TLS endpoints; no cloud credential or external API call is used."})]}),(0,d.jsxs)(p,{ok:B.ok,children:[B.passed,"/",B.total," passed \xb7 ",B.durationMs," ms"]})]}),(0,d.jsx)("div",{className:"mt-3 grid gap-2 md:grid-cols-2 xl:grid-cols-3",children:B.checks?.map(a=>(0,d.jsxs)("div",{className:"flex items-start gap-2 rounded-lg border border-border/70 bg-background/60 px-3 py-2 text-xs",children:[(0,d.jsx)("span",{className:`material-symbols-outlined text-[16px] ${a.ok?"text-green-500":"text-red-500"}`,children:a.ok?"check_circle":"error"}),(0,d.jsxs)("span",{children:[(0,d.jsx)("span",{className:"font-medium text-text-main",children:a.name}),a.detail?(0,d.jsx)("span",{className:"mt-0.5 block text-text-muted",children:a.detail}):null]})]},a.name))})]}):null,(0,d.jsx)(k,{onChanged:()=>F(!0)}),(0,d.jsx)(h,{}),H.proxyAuthFeatureEnabled?(0,d.jsx)(i,{}):null]}),(0,d.jsxs)("div",{className:"audit"===D?"space-y-4":"hidden",children:[(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Token usage"}),(0,d.jsxs)("p",{className:"mt-1 text-xs text-text-muted",children:["Counts are read out of the audited provider responses themselves — ",(0,d.jsx)("code",{className:"font-mono",children:"message_start"})," carries input and cache tokens, the closing ",(0,d.jsx)("code",{className:"font-mono",children:"message_delta"})," carries output. Scope is the same window as the table below."]})]}),a?.usageSummary?.incompleteUsageCount?(0,d.jsxs)("span",{className:"rounded-lg border border-amber-500/30 bg-amber-500/10 px-2.5 py-1 text-[11px] font-medium text-amber-700 dark:text-amber-300",children:[a.usageSummary.incompleteUsageCount," response(s) truncated before the final usage event — output tokens under-counted"]}):null]}),a?.usageSummary?.totals?.requests?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsxs)("div",{className:"mt-3 grid gap-2 sm:grid-cols-2 lg:grid-cols-5",children:[(0,d.jsx)(s,{label:"Requests with usage",value:a.usageSummary.totals.requests}),(0,d.jsx)(s,{label:"Input",value:q(a.usageSummary.totals.inputTokens),hint:"new (uncached) input tokens"}),(0,d.jsx)(s,{label:"Output",value:q(a.usageSummary.totals.outputTokens)}),(0,d.jsx)(s,{label:"Cache read / write",value:`${q(a.usageSummary.totals.cacheReadTokens)} / ${q(a.usageSummary.totals.cacheCreationTokens)}`}),(0,d.jsx)(s,{label:"Est. cost",value:r(a.usageSummary.totals.cost),hint:"from the pricing table"})]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-5 lg:grid-cols-2",children:[(0,d.jsx)(t,{title:"By model",rows:a.usageSummary.byModel}),(0,d.jsx)(t,{title:"By client tool",rows:a.usageSummary.bySourceTool})]})]}):(0,d.jsx)("p",{className:"mt-3 rounded-xl border border-border bg-background/50 p-3 text-xs text-text-muted",children:"No token usage recorded yet. Usage appears once an audited request reaches a provider that reports it (Anthropic and OpenAI both do)."})]}),(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Recent audit requests"}),(0,d.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"Credentials are redacted before persistence. Local writes and MySQL mirroring run through a bounded asynchronous queue."})]}),(0,d.jsxs)("div",{className:"flex items-center gap-3 text-xs text-text-muted",children:[(0,d.jsxs)("span",{children:["Queue ",G.auditStore?.queueDepth||0,"/",G.auditStore?.queueLimit||1e3]}),(0,d.jsx)("button",{type:"button",onClick:()=>O("clear-logs"),disabled:!!j||L,className:"rounded-lg border border-border px-3 py-1.5 hover:bg-background disabled:opacity-50",children:"Clear logs"})]})]}),(0,d.jsx)("div",{className:"mt-3 overflow-x-auto",children:(0,d.jsxs)("table",{className:"w-full min-w-[1250px] text-left text-xs",children:[(0,d.jsx)("thead",{className:"border-b border-border text-text-muted",children:(0,d.jsxs)("tr",{children:[(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Time"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Protocol"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Client"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"User"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Provider"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Host"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Model"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Request"}),(0,d.jsx)("th",{className:"px-2 py-2 text-right font-medium",children:"Tokens (in/out)"}),(0,d.jsx)("th",{className:"px-2 py-2 text-right font-medium",children:"Cache (r/w)"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Status"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Latency"})]})}),(0,d.jsxs)("tbody",{children:[(a?.events||[]).map(a=>(0,d.jsxs)("tr",{className:"border-b border-border/60 align-top text-text-main",children:[(0,d.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-text-muted",children:new Date(a.timestamp).toLocaleTimeString()}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.protocol||"http/1.1"}),(0,d.jsx)("td",{className:"px-2 py-2 font-mono text-[11px]",children:a.client?.ip||"-"}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.client?.proxyUser||"-"}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.provider||"-"}),(0,d.jsx)("td",{className:"px-2 py-2 font-mono text-[11px]",children:a.host||"-"}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.model||"-"}),(0,d.jsx)("td",{className:"max-w-[300px] px-2 py-2",children:(0,d.jsxs)("details",{children:[(0,d.jsxs)("summary",{className:"cursor-pointer truncate",children:[a.method," ",a.path]}),(0,d.jsx)("pre",{className:"mt-2 max-h-72 overflow-auto whitespace-pre-wrap rounded-lg bg-background p-2 text-[10px] leading-4 text-text-muted",children:JSON.stringify({request:a.request,response:a.response,error:a.error},null,2)})]})}),(0,d.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-right",children:a.usage?(0,d.jsxs)("span",{title:!1===a.usage.complete?"Response was truncated before the final usage event; output is a lower bound":void 0,children:[q(a.usage.inputTokens),"/",q(a.usage.outputTokens),!1===a.usage.complete?(0,d.jsx)("span",{className:"text-amber-600 dark:text-amber-400",children:"*"}):null]}):(0,d.jsx)("span",{className:"text-text-muted",children:"-"})}),(0,d.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-right text-text-muted",children:a.usage?`${q(a.usage.cacheReadTokens)}/${q(a.usage.cacheCreationTokens)}`:"-"}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.status||"ERR"}),(0,d.jsxs)("td",{className:"whitespace-nowrap px-2 py-2",children:[a.durationMs??"-"," ms"]})]},a.id)),a?.events?.length?null:(0,d.jsx)("tr",{children:(0,d.jsx)("td",{colSpan:"12",className:"px-2 py-8 text-center text-text-muted",children:"No audited requests yet."})})]})]})})]})]})]})}},94735:a=>{"use strict";a.exports=require("events")},98621:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"unstable_rethrow",{enumerable:!0,get:function(){return function a(b){if((0,g.isNextRouterError)(b)||(0,f.isBailoutToCSRError)(b)||(0,i.isDynamicServerError)(b)||(0,h.isDynamicPostpone)(b)||(0,e.isPostpone)(b)||(0,d.isHangingPromiseRejectionError)(b)||(0,h.isPrerenderInterruptedError)(b))throw b;b instanceof Error&&"cause"in b&&a(b.cause)}}});let d=c(48894),e=c(64491),f=c(62880),g=c(76484),h=c(23445),i=c(43449);("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)}};var b=require("../../../../webpack-runtime.js");b.C(a);var c=b.X(0,[4741,5592,5573,4433,2430,8316,8946,1370,402,5681,4404,6064,6328,8640,3096,9471],()=>b(b.s=79413));module.exports=c})();
+}`,o=async(a,b)=>{try{await navigator.clipboard.writeText(b),l(a),setTimeout(()=>l(""),1500)}catch{c?.("Kh\xf4ng truy cập được clipboard của tr\xecnh duyệt.")}};return(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Hướng dẫn cấu h\xecnh m\xe1y trạm"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"C\xe1c lệnh dưới đ\xe2y chỉ đặt biến m\xf4i trường trong tiến tr\xecnh con — kh\xf4ng d\xf9ng setx, kh\xf4ng đổi proxy của Windows/hệ thống. NO_PROXY giữ cho OAuth callback ở localhost v\xe0 MCP chạy nội bộ kh\xf4ng đi qua proxy."}),(0,d.jsxs)("div",{className:"mt-3 rounded-xl border border-primary/20 bg-primary/5 p-3 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("div",{className:"font-semibold text-primary",children:"L\xe0m một lần trước khi d\xf9ng"}),"Lưu file Root CA vừa tải v\xe0o đ\xfang đường dẫn: ",(0,d.jsx)("code",{className:"rounded bg-background px-1 py-0.5",children:g})," tr\xean Windows, hoặc ",(0,d.jsx)("code",{className:"rounded bg-background px-1 py-0.5",children:h})," tr\xean Linux/macOS. Nếu CA đ\xe3 được c\xe0i v\xe0o hệ điều h\xe0nh th\xec biến CA trong lệnh vẫn v\xf4 hại, cứ để nguy\xean."]}),(0,d.jsxs)("div",{className:"mt-3 grid gap-3",children:[(0,d.jsxs)("div",{className:"rounded-xl border border-border bg-background p-3",children:[(0,d.jsxs)("div",{className:"flex items-center justify-between gap-2",children:[(0,d.jsx)("span",{className:"text-xs font-semibold text-text-main",children:"Địa chỉ proxy"}),(0,d.jsx)("button",{type:"button",onClick:()=>o("url",m.proxyUrl),className:"text-xs text-primary",children:"url"===k?"Đ\xe3 copy":"Copy"})]}),(0,d.jsx)("code",{className:"mt-1 block break-all text-xs text-text-muted",children:m.proxyUrl})]}),(0,d.jsx)(i,{title:"Claude Code \xb7 Windows PowerShell",subtitle:"Biến proxy chỉ tồn tại trong tiến tr\xecnh con, đ\xf3ng cửa sổ l\xe0 hết.",command:m.claudePowerShell,copyKey:"claude-ps",copied:k,onCopy:o,recommended:!0}),(0,d.jsx)(i,{title:"Codex \xb7 Windows PowerShell",subtitle:"Kh\xf4ng ghi g\xec v\xe0o biến m\xf4i trường của user hay hệ thống.",command:m.codexPowerShell,copyKey:"codex-ps",copied:k,onCopy:o,recommended:!0}),(0,d.jsxs)("details",{className:"rounded-xl border border-border bg-background p-3",children:[(0,d.jsx)("summary",{className:"cursor-pointer text-xs font-semibold text-text-main",children:"Codex \xb7 bỏ 7 gi\xe2y chờ WebSocket l\xfac khởi động (kh\xf4ng bắt buộc)"}),(0,d.jsxs)("p",{className:"mt-2 text-[11px] leading-5 text-text-muted",children:["Codex thử mở ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"wss://chatgpt.com/backend-api/codex/responses"})," trước khi chịu d\xf9ng HTTPS. Proxy từ chối n\xe2ng cấp WebSocket để mọi request đều ghi log được, n\xean mỗi lần khởi động Codex tốn 5 lần thử lại — khoảng 7 gi\xe2y — rồi mới tự chuyển sang HTTPS. Request vẫn chạy v\xe0 vẫn được ghi log b\xecnh thường; cấu h\xecnh dưới đ\xe2y chỉ để khỏi phải chờ."]}),(0,d.jsxs)("p",{className:"mt-2 text-[11px] leading-5 text-text-muted",children:["Chạy một lần trong PowerShell. Lệnh chạy lại nhiều lần vẫn an to\xe0n, ghi kho\xe1 v\xe0o đ\xfang đầu file (TOML y\xeau cầu vậy) v\xe0 giữ lại bản backup ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"config.toml.bak"}),"."]}),(0,d.jsxs)("p",{className:"mt-2 text-[11px] leading-5 text-text-muted",children:["Trong config.toml chỉ cấu h\xecnh được phần transport. Codex kh\xf4ng c\xf3 kho\xe1 proxy ở đ\xf3 — n\xf3 chỉ đọc ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"HTTP_PROXY"}),"/",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"HTTPS_PROXY"}),"/",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"NO_PROXY"})," từ m\xf4i trường, n\xean vẫn phải khởi động bằng lệnh ở tr\xean."]}),(0,d.jsx)("div",{className:"mt-3",children:(0,d.jsx)(i,{title:"Ghim Codex v\xe0o transport HTTPS",subtitle:"Sửa file %USERPROFILE%\\.codex\\config.toml",command:n,copyKey:"codex-https-config",copied:k,onCopy:o})}),(0,d.jsxs)("p",{className:"mt-2 text-[11px] leading-5 text-amber-600 dark:text-amber-400",children:["Đ\xe1nh đổi: provider ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"openai"})," c\xf3 sẵn l\xe0 t\xean d\xe0nh ri\xeang, kh\xf4ng ghi đ\xe8 được, n\xean cấu h\xecnh n\xe0y nh\xe2n bản n\xf3. Bản nh\xe2n bản kh\xf4ng gửi ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"content-encoding"})," (n\xe9n request), ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"x-codex-routing-hint"})," v\xe0 ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"version"}),", đồng thời ghim cứng ",(0,d.jsx)("code",{className:"rounded bg-surface px-1 py-0.5",children:"base_url"}),". Muốn trả về mặc định th\xec xo\xe1 cả hai khối trong config.toml."]})]}),(0,d.jsxs)("details",{className:"rounded-xl border border-border bg-background p-3",children:[(0,d.jsx)("summary",{className:"cursor-pointer text-xs font-semibold text-text-main",children:"Lệnh cho Linux / macOS"}),(0,d.jsxs)("div",{className:"mt-3 grid gap-3",children:[(0,d.jsx)(i,{title:"Claude Code \xb7 Bash/zsh",command:m.claudeBash,copyKey:"claude-bash",copied:k,onCopy:o}),(0,d.jsx)(i,{title:"Codex \xb7 Bash/zsh",command:m.codexBash,copyKey:"codex-bash",copied:k,onCopy:o})]})]})]})]})}},8128:a=>{"use strict";a.exports=require("next/dist/server/runtime-reacts.external.js")},10381:(a,b)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"ReadonlyURLSearchParams",{enumerable:!0,get:function(){return d}});class c extends Error{constructor(){super("Method unavailable on `ReadonlyURLSearchParams`. Read more: https://nextjs.org/docs/app/api-reference/functions/use-search-params#updating-searchparams"),Object.defineProperty(this,"__NEXT_ERROR_CODE",{value:"E1174",enumerable:!1,configurable:!0})}}class d extends URLSearchParams{append(){throw new c}delete(){throw new c}set(){throw new c}sort(){throw new c}}("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},10846:a=>{"use strict";a.exports=require("next/dist/compiled/next-server/app-page.runtime.prod.js")},19121:a=>{"use strict";a.exports=require("next/dist/server/app-render/action-async-storage.external.js")},19771:a=>{"use strict";a.exports=require("process")},21820:a=>{"use strict";a.exports=require("os")},27910:a=>{"use strict";a.exports=require("stream")},28354:a=>{"use strict";a.exports=require("util")},29021:a=>{"use strict";a.exports=require("fs")},29294:a=>{"use strict";a.exports=require("next/dist/server/app-render/work-async-storage.external.js")},32171:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});var d={getRedirectError:function(){return i},getRedirectStatusCodeFromError:function(){return n},getRedirectTypeFromError:function(){return m},getURLFromRedirectError:function(){return l},permanentRedirect:function(){return k},redirect:function(){return j}};for(var e in d)Object.defineProperty(b,e,{enumerable:!0,get:d[e]});let f=c(81494),g=c(52220),h=c(73565);function i(a,b,c=f.RedirectStatusCode.TemporaryRedirect){let d=Object.defineProperty(Error(g.REDIRECT_ERROR_CODE),"__NEXT_ERROR_CODE",{value:"E394",enumerable:!1,configurable:!0});return d.digest=`${g.REDIRECT_ERROR_CODE};${b};${a};${c};`,d}function j(a,b){throw i(a,b??=h.actionAsyncStorage?.getStore()?.isAction?"push":"replace",f.RedirectStatusCode.TemporaryRedirect)}function k(a,b="replace"){throw i(a,b,f.RedirectStatusCode.PermanentRedirect)}function l(a){return(0,g.isRedirectError)(a)?a.digest.split(";").slice(2,-2).join(";"):null}function m(a){if(!(0,g.isRedirectError)(a))throw Object.defineProperty(Error("Not a redirect error"),"__NEXT_ERROR_CODE",{value:"E260",enumerable:!1,configurable:!0});return a.digest.split(";",2)[1]}function n(a){if(!(0,g.isRedirectError)(a))throw Object.defineProperty(Error("Not a redirect error"),"__NEXT_ERROR_CODE",{value:"E260",enumerable:!1,configurable:!0});return Number(a.digest.split(";").at(-2))}("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},33873:a=>{"use strict";a.exports=require("path")},34631:a=>{"use strict";a.exports=require("tls")},38522:a=>{"use strict";a.exports=require("node:zlib")},41025:a=>{"use strict";a.exports=require("next/dist/server/app-render/dynamic-access-async-storage.external.js")},41204:a=>{"use strict";a.exports=require("string_decoder")},42477:(a,b,c)=>{Promise.resolve().then(c.bind(c,1568)),Promise.resolve().then(c.bind(c,91202))},44057:(a,b,c)=>{"use strict";function d(){throw Object.defineProperty(Error("`unauthorized()` is experimental and only allowed to be used when `experimental.authInterrupts` is enabled."),"__NEXT_ERROR_CODE",{value:"E411",enumerable:!1,configurable:!0})}Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"unauthorized",{enumerable:!0,get:function(){return d}}),c(7638).HTTP_ERROR_FALLBACK_ERROR_CODE,("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},46060:a=>{"use strict";a.exports=require("next/dist/shared/lib/no-fallback-error.external.js")},46293:a=>{"use strict";a.exports=require("sql.js")},51455:a=>{"use strict";a.exports=require("node:fs/promises")},52283:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"notFound",{enumerable:!0,get:function(){return f}});let d=c(7638),e=`${d.HTTP_ERROR_FALLBACK_ERROR_CODE};404`;function f(){let a=Object.defineProperty(Error(e),"__NEXT_ERROR_CODE",{value:"E1041",enumerable:!1,configurable:!0});throw a.digest=e,a}("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},53053:a=>{"use strict";a.exports=require("node:diagnostics_channel")},55511:a=>{"use strict";a.exports=require("crypto")},63033:a=>{"use strict";a.exports=require("next/dist/server/app-render/work-unit-async-storage.external.js")},63988:(a,b,c)=>{"use strict";c.r(b),c.d(b,{__next_app__:()=>w,handler:()=>y,routeModule:()=>x});var d=c(21635),e=c(86315),f=c(1020),g=c(61287),h={};for(let a in g)0>["default","__next_app__","routeModule","handler"].indexOf(a)&&(h[a]=()=>g[a]);c.d(b,h);let i=(0,d.p)(()=>Promise.resolve().then(c.bind(c,32059))),j=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,95547,23))),k=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,55091,23))),l=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,45270,23))),m=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,28193,23))),n=(0,d.p)(()=>Promise.resolve().then(c.bind(c,30508))),o=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,95547,23))),p=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,55091,23))),q=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,45270,23))),r=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,28193,23))),s=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,95547,23))),t=(0,d.p)(()=>Promise.resolve().then(c.t.bind(c,95547,23))),u={children:["",{children:["(dashboard)",{children:["dashboard",{children:["audit-proxy",{children:["__PAGE__",{},{page:[(0,d.p)(()=>Promise.resolve().then(c.bind(c,86282))),"D:\\bluerouter\\src\\app\\(dashboard)\\dashboard\\audit-proxy\\page.js"]}]},{"global-error":[t,"next/dist/client/components/builtin/global-error.js"]},[]]},{"global-error":[s,"next/dist/client/components/builtin/global-error.js"]},[]]},{layout:[n,"D:\\bluerouter\\src\\app\\(dashboard)\\layout.js"],"global-error":[o,"next/dist/client/components/builtin/global-error.js"],"not-found":[p,"next/dist/client/components/builtin/not-found.js"],forbidden:[q,"next/dist/client/components/builtin/forbidden.js"],unauthorized:[r,"next/dist/client/components/builtin/unauthorized.js"],metadata:{icon:[async a=>(await (0,d.p)(()=>Promise.resolve().then(c.bind(c,70440)))()).default(a)],apple:[],openGraph:[],twitter:[],manifest:"/manifest.webmanifest"}},[]]},{layout:[i,"D:\\bluerouter\\src\\app\\layout.js"],"global-error":[j,"next/dist/client/components/builtin/global-error.js"],"not-found":[k,"next/dist/client/components/builtin/not-found.js"],forbidden:[l,"next/dist/client/components/builtin/forbidden.js"],unauthorized:[m,"next/dist/client/components/builtin/unauthorized.js"],metadata:{icon:[async a=>(await (0,d.p)(()=>Promise.resolve().then(c.bind(c,70440)))()).default(a)],apple:[],openGraph:[],twitter:[],manifest:"/manifest.webmanifest"}},[]]}.children,v=(0,e.H)({tree:u,page:"/(dashboard)/dashboard/audit-proxy/page",pathname:"/dashboard/audit-proxy",require:c,loadChunk:()=>Promise.resolve(),interopDefault:f.T}),w=v.__next_app__,x=v.routeModule,y=v.handler},64939:a=>{"use strict";a.exports=import("pg")},66136:a=>{"use strict";a.exports=require("timers")},66445:(a,b,c)=>{Promise.resolve().then(c.bind(c,93831)),Promise.resolve().then(c.bind(c,80532))},66610:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});var d={ReadonlyURLSearchParams:function(){return f.ReadonlyURLSearchParams},RedirectType:function(){return m},forbidden:function(){return i.forbidden},notFound:function(){return h.notFound},permanentRedirect:function(){return g.permanentRedirect},redirect:function(){return g.redirect},unauthorized:function(){return j.unauthorized},unstable_isUnrecognizedActionError:function(){return l},unstable_rethrow:function(){return k.unstable_rethrow}};for(var e in d)Object.defineProperty(b,e,{enumerable:!0,get:d[e]});let f=c(10381),g=c(32171),h=c(52283),i=c(92606),j=c(44057),k=c(98621);function l(){throw Object.defineProperty(Error("`unstable_isUnrecognizedActionError` can only be used on the client."),"__NEXT_ERROR_CODE",{value:"E776",enumerable:!1,configurable:!0})}let m={push:"push",replace:"replace"};("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},73024:a=>{"use strict";a.exports=require("node:fs")},73565:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});var d={actionAsyncStorage:function(){return f.actionAsyncStorage},workAsyncStorage:function(){return g.workAsyncStorage},workUnitAsyncStorage:function(){return h.workUnitAsyncStorage}};for(var e in d)Object.defineProperty(b,e,{enumerable:!0,get:d[e]});let f=c(19121),g=c(29294),h=c(63033);("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},74075:a=>{"use strict";a.exports=require("zlib")},76760:a=>{"use strict";a.exports=require("node:path")},77598:a=>{"use strict";a.exports=require("node:crypto")},78474:a=>{"use strict";a.exports=require("node:events")},79428:a=>{"use strict";a.exports=require("buffer")},79748:a=>{"use strict";a.exports=require("fs/promises")},80099:a=>{"use strict";a.exports=require("node:sqlite")},80532:(a,b,c)=>{"use strict";c.d(b,{default:()=>h});var d=c(48249),e=c(67484),f=c(5243);function g({ok:a,children:b}){return(0,d.jsxs)("span",{className:`inline-flex items-center gap-1 rounded-full border px-2 py-0.5 text-xs font-medium ${a?"border-green-500/30 bg-green-500/10 text-green-600 dark:text-green-400":"border-border bg-surface text-text-muted"}`,children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-[13px]",children:a?"check_circle":"radio_button_unchecked"}),b]})}function h(){let[a,b]=(0,e.useState)(null),[c,h]=(0,e.useState)("");if((0,e.useCallback)(async()=>{try{let a=await fetch("/api/audit-proxy/me",{cache:"no-store"}),c=await a.json().catch(()=>({}));if(!a.ok)throw Error(c.error||"Kh\xf4ng tải được th\xf4ng tin truy cập Audit Proxy của bạn");b(c)}catch(a){h(a.message||"Kh\xf4ng tải được th\xf4ng tin truy cập Audit Proxy của bạn")}},[]),c&&!a)return(0,d.jsx)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-600 dark:text-red-400",children:c});if(!a)return(0,d.jsx)("div",{className:"rounded-xl border border-border bg-surface p-5 text-sm text-text-muted",children:"Đang tải Enterprise AI Audit Proxy…"});let i=a.rootCA||{},j=a.grant?.ips||[];return(0,d.jsxs)("div",{className:"space-y-4",children:[(0,d.jsxs)("div",{className:"rounded-2xl border border-primary/20 bg-primary/5 p-4",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-primary",children:"policy"}),(0,d.jsx)("h1",{className:"text-lg font-bold text-text-main",children:"Enterprise AI Audit Proxy"}),(0,d.jsx)(g,{ok:!0===a.running,children:a.running?"Đang chạy":"Đ\xe3 dừng"}),(0,d.jsx)(g,{ok:!0===i.validated,children:"Root CA"})]}),(0,d.jsx)("p",{className:"mt-2 max-w-4xl text-sm leading-6 text-text-muted",children:"T\xe0i khoản của bạn được ph\xe9p d\xf9ng audit proxy cho Claude Code v\xe0 Codex. C\xe0i Root CA một lần, sau đ\xf3 khởi động CLI bằng một trong c\xe1c lệnh b\xean dưới. Mọi request đi qua proxy đều được quản trị vi\xean ghi log để phục vụ kiểm to\xe1n."})]}),c?(0,d.jsx)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-600 dark:text-red-400",children:c}):null,(0,d.jsxs)("div",{className:"grid gap-4 xl:grid-cols-[0.8fr_1.2fr]",children:[(0,d.jsxs)("div",{className:"space-y-4",children:[(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Quyền truy cập của bạn"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"Proxy chỉ nhận kết nối từ c\xe1c địa chỉ IP dưới đ\xe2y. Từ m\xe1y c\xf3 IP kh\xe1c, kết nối sẽ bị đ\xf3ng ngay — cần th\xeam địa chỉ th\xec li\xean hệ quản trị vi\xean."}),(0,d.jsxs)("div",{className:"mt-3 grid gap-2 text-xs",children:[(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"T\xe0i khoản"}),(0,d.jsx)("span",{className:"break-all font-mono text-text-main",children:a.grant?.userId||a.userId||"-"})]}),a.grant?.note?(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Ghi ch\xfa"}),(0,d.jsx)("span",{className:"break-all text-text-main",children:a.grant.note})]}):null]}),(0,d.jsxs)("div",{className:"mt-3",children:[(0,d.jsx)("div",{className:"text-[11px] font-medium uppercase tracking-wide text-text-muted",children:"IP được cấp ph\xe9p"}),j.length?(0,d.jsx)("div",{className:"mt-1.5 flex flex-wrap gap-1.5",children:j.map(a=>(0,d.jsx)("span",{className:"rounded-full border border-primary/30 bg-primary/5 px-2.5 py-1 font-mono text-[11px] text-primary",children:a},a))}):(0,d.jsx)("p",{className:"mt-1.5 rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-[11px] leading-5 text-amber-700 dark:text-amber-300",children:a.isAdmin?"T\xe0i khoản admin của bạn kh\xf4ng c\xf3 grant ri\xeang. Grant chỉ d\xf9ng cho allowlist IP của proxy.":"Chưa c\xf3 địa chỉ n\xe0o được cấp, n\xean proxy sẽ từ chối kết nối của bạn. H\xe3y gửi IP m\xe1y trạm của bạn cho quản trị vi\xean."})]})]}),(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Root CA"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"Tải certificate v\xe0 lưu v\xe0o đ\xfang đường dẫn ghi trong phần hướng dẫn b\xean cạnh. Đ\xe2y l\xe0 certificate c\xf4ng khai, kh\xf4ng chứa private key."}),(0,d.jsxs)("div",{className:"mt-3 grid gap-2 text-xs",children:[(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Trạng th\xe1i"}),(0,d.jsx)("span",{className:"font-medium text-text-main",children:i.validated?"Đ\xe3 x\xe1c thực":i.certExists?"Cần kiểm tra lại":"Chưa tạo"})]}),i.subject?(0,d.jsxs)("div",{className:"grid gap-1",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Subject"}),(0,d.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:i.subject})]}):null,i.fingerprint?(0,d.jsxs)("div",{className:"grid gap-1",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Fingerprint public key"}),(0,d.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:i.fingerprint})]}):null,i.notAfter?(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Hết hạn"}),(0,d.jsx)("span",{className:"text-text-main",children:new Date(i.notAfter).toLocaleString()})]}):null]}),(0,d.jsx)("div",{className:"mt-4",children:(0,d.jsx)("a",{href:"/api/audit-proxy/ca?download=cert",className:`inline-flex rounded-lg border border-primary/30 bg-primary/10 px-3 py-2 text-xs font-semibold text-primary ${i.certExists?"":"pointer-events-none opacity-50"}`,children:"Tải Root CA"})})]})]}),(0,d.jsx)(f.Ay,{clientProxyHost:a.endpoint?.clientProxyHost,port:a.endpoint?.port,onError:h})]})]})}},81787:a=>{"use strict";a.exports=require("bun:sqlite")},86282:(a,b,c)=>{"use strict";c.r(b),c.d(b,{default:()=>i});var d=c(5735),e=c(91970),f=c(9471),g=c(1568),h=c(91202);async function i(){let a=await (0,f.Su)();return a.authenticated||(0,e.redirect)("/login"),a.canView||(0,e.redirect)("/dashboard/endpoint"),a.isAdmin?(0,d.jsx)(g.default,{}):(0,d.jsx)(h.default,{})}},87550:a=>{"use strict";a.exports=require("better-sqlite3")},91202:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(77943).registerClientReference)(function(){throw Error("Attempted to call the default export of \"D:\\\\bluerouter\\\\src\\\\app\\\\(dashboard)\\\\dashboard\\\\audit-proxy\\\\AuditProxyUserView.js\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"D:\\bluerouter\\src\\app\\(dashboard)\\dashboard\\audit-proxy\\AuditProxyUserView.js","default")},91645:a=>{"use strict";a.exports=require("net")},91970:(a,b,c)=>{"use strict";var d=c(66610);c.o(d,"notFound")&&c.d(b,{notFound:function(){return d.notFound}}),c.o(d,"redirect")&&c.d(b,{redirect:function(){return d.redirect}})},92606:(a,b,c)=>{"use strict";function d(){throw Object.defineProperty(Error("`forbidden()` is experimental and only allowed to be enabled when `experimental.authInterrupts` is enabled."),"__NEXT_ERROR_CODE",{value:"E488",enumerable:!1,configurable:!0})}Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"forbidden",{enumerable:!0,get:function(){return d}}),c(7638).HTTP_ERROR_FALLBACK_ERROR_CODE,("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)},93831:(a,b,c)=>{"use strict";c.d(b,{default:()=>w});var d=c(48249),e=c(67484),f=c(2116),g=c.n(f);function h(){let[a,b]=(0,e.useState)(null),[c,f]=(0,e.useState)(!1),[g,h]=(0,e.useState)(!1),[i,j]=(0,e.useState)(!1),[k,l]=(0,e.useState)([]),[m,n]=(0,e.useState)(!1),[o,p]=(0,e.useState)(""),[q,r]=(0,e.useState)(!1),[s,t]=(0,e.useState)(""),[u,v]=(0,e.useState)("");(0,e.useCallback)(async()=>{try{let a=await fetch("/api/audit-proxy?limit=1",{cache:"no-store"}),c=await a.json();if(!a.ok)throw Error(c.error||"Cannot load Audit Proxy IP filter");b(c.config),f(c.status?.running===!0),h(c.status?.standby===!0),n(c.config?.clientIpFilterEnabled===!0),p((c.config?.allowedClientIps||[]).join("\n")),j(c.status?.security?.clientIpFilterSource==="grants"),l((c.config?.accessGrants||[]).flatMap(a=>a?.ips||[]))}catch(a){t(a.message||"Cannot load Audit Proxy IP filter")}},[]);let w=(0,e.useMemo)(()=>o.split(/\r?\n/).map(a=>a.trim()).filter(Boolean),[o]),x=async()=>{if(a){if(m&&0===w.length)return void t("Add at least one client IP or CIDR before enabling the filter.");r(!0),t(""),v("");try{let c=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-ip-filter",enabled:m,allowedClientIps:w})}),d=await c.json().catch(()=>({}));if(!c.ok)throw Error(d.error||"Failed to save client IP filter");v("Client IP filter saved and applied to the running proxy."),b(d.config||a),f(d.status?.running===!0),h(d.status?.standby===!0),n(d.config?.clientIpFilterEnabled===!0),p((d.config?.allowedClientIps||[]).join("\n")),j(d.status?.security?.clientIpFilterSource==="grants"),l((d.config?.accessGrants||[]).flatMap(a=>a?.ips||[]))}catch(a){t(a.message||"Failed to save client IP filter")}finally{r(!1)}}};return a?(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between",children:[(0,d.jsxs)("div",{children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-primary",children:"shield_lock"}),(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Client IP filter"}),(0,d.jsx)("span",{className:`rounded-full px-2 py-0.5 text-[10px] font-semibold ${m?"bg-green-500/10 text-green-600 dark:text-green-400":"bg-surface text-text-muted"}`,children:m?"ENABLED":"DISABLED"})]}),(0,d.jsxs)("p",{className:"mt-1 max-w-4xl text-xs leading-5 text-text-muted",children:["Restrict TCP access to the Audit Proxy itself. Only client IPs/CIDRs below can use port ",a.port,". The decision uses the socket peer IP; X-Forwarded-For and other HTTP headers are ignored."]}),i?(0,d.jsxs)("p",{className:"mt-2 max-w-4xl rounded-lg border border-primary/30 bg-primary/5 px-3 py-2 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("strong",{className:"text-primary",children:"Superseded by Access grants."})," The proxy is enforcing the ",new Set(k).size," address(es) granted to users above, and this list is ignored until every grant has no IP left. Manage access there."]}):null]}),(0,d.jsxs)("label",{className:"flex shrink-0 items-center gap-2 text-sm font-medium text-text-main",children:[(0,d.jsx)("input",{type:"checkbox",checked:m,onChange:a=>n(a.target.checked),disabled:i||g,className:"h-4 w-4 accent-[var(--color-primary)] disabled:opacity-50"}),"Enable IP filter"]})]}),s?(0,d.jsx)("div",{className:"mt-3 rounded-lg border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-600 dark:text-red-400",children:s}):null,u?(0,d.jsx)("div",{className:"mt-3 rounded-lg border border-green-500/30 bg-green-500/10 px-3 py-2 text-xs text-green-600 dark:text-green-400",children:u}):null,(0,d.jsxs)("div",{className:"mt-4 grid gap-4 lg:grid-cols-[1fr_320px]",children:[(0,d.jsxs)("label",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Allowed client IPs / CIDRs"}),(0,d.jsx)("textarea",{rows:6,value:o,onChange:a=>p(a.target.value),disabled:i||g,placeholder:"172.16.253.3\n172.16.253.0/24\n10.20.30.15\n2001:db8::/64",className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary"}),(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"One IPv4, IPv6, or CIDR per line. IPv4-mapped IPv6 addresses are normalized automatically."})]}),(0,d.jsxs)("div",{className:"grid content-start gap-3",children:[(0,d.jsxs)("div",{className:"rounded-xl border border-primary/20 bg-primary/5 p-3 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("div",{className:"font-semibold text-primary",children:"Security behavior"}),(0,d.jsx)("div",{className:"mt-1",children:"Allowed IP → proxy works normally."}),(0,d.jsx)("div",{children:"Other IP → TCP connection is immediately closed before CONNECT/HTTP parsing."}),(0,d.jsx)("div",{children:"Empty list + enabled → configuration is rejected."})]}),(0,d.jsx)("button",{type:"button",onClick:x,disabled:q||i||g,className:"rounded-lg bg-primary px-4 py-2 text-sm font-semibold text-white disabled:opacity-50",children:q?"Saving…":"Save IP Filter"}),c?(0,d.jsxs)("div",{className:"text-[11px] leading-4 text-text-muted",children:["Applied to the running listener on port ",a.port,"; no restart, and connections from an address you just removed are closed."]}):null]})]})]}):null}function i(){let[a,b]=(0,e.useState)(!1),[c,f]=(0,e.useState)(!1),[g,h]=(0,e.useState)([]),[i,j]=(0,e.useState)(!1),[k,l]=(0,e.useState)(""),[m,n]=(0,e.useState)(""),o=(a,c)=>{f(a?.proxyAuthEnabled===!0),h((a?.proxyAuthUsers||[]).map(a=>({username:a.username,hasPassword:!0===a.hasPassword,password:""}))),c&&b(!0===c.running)};(0,e.useCallback)(async()=>{try{let a=await fetch("/api/audit-proxy?limit=1",{cache:"no-store"}),b=await a.json();if(!a.ok)throw Error(b.error||"Cannot load proxy authentication");o(b.config,b.status)}catch(a){l(a.message||"Cannot load proxy authentication")}},[]);let p=(a,b)=>{h(c=>c.map((c,d)=>d===a?{...c,...b}:c))},q=async()=>{let a=g.map(a=>({...a,username:a.username.trim()}));if(c&&0===a.length)return void l("Add at least one account before enabling proxy authentication.");let b=a.find(a=>!a.hasPassword&&!a.password);if(b)return void l(`Set a password for ${b.username||"the new account"}.`);j(!0),l(""),n("");try{let b=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-proxy-auth",enabled:c,users:a.map(a=>a.password?{username:a.username,password:a.password}:{username:a.username})})}),d=await b.json().catch(()=>({}));if(!b.ok)throw Error(d.error||"Failed to save proxy authentication");n(d.restarted?"Proxy authentication saved and Audit Proxy restarted.":"Proxy authentication saved."),o(d.config,d.status)}catch(a){l(a.message||"Failed to save proxy authentication")}finally{j(!1)}};return(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-start justify-between gap-3",children:[(0,d.jsxs)("div",{className:"max-w-3xl",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Proxy authentication"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"Requires a username and password on every CONNECT, and records which account opened each tunnel, so the audit table answers who rather than only which IP. Give each person or CI job its own account: removing one leaves the others working."}),(0,d.jsx)("p",{className:"mt-2 rounded-lg border border-amber-500/30 bg-amber-500/5 p-2 text-[11px] leading-5 text-amber-700 dark:text-amber-300",children:"The proxy listener speaks plain HTTP, so the credential crosses the client-to-proxy hop unencrypted (Basic is base64, not encryption). This keeps out anyone without the password and attributes traffic to a person; it does not hide the password from someone capturing packets on that network. On an untrusted network use it alongside the client IP allowlist, not instead of it. The password also ends up in HTTPS_PROXY, and so in the process list and shell history."})]}),(0,d.jsxs)("label",{className:"flex shrink-0 items-center gap-2 text-sm text-text-main",children:[(0,d.jsx)("input",{type:"checkbox",checked:c,onChange:a=>f(a.target.checked),disabled:i,className:"h-4 w-4 accent-[var(--color-primary)]"}),"Require credentials"]})]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-2",children:[0===g.length?(0,d.jsx)("p",{className:"rounded-xl border border-border bg-background/50 p-3 text-xs text-text-muted",children:"No accounts yet."}):null,g.map((a,b)=>(0,d.jsxs)("div",{className:"grid gap-2 rounded-xl border border-border bg-background/50 p-3 sm:grid-cols-[1fr_1fr_auto]",children:[(0,d.jsx)("input",{type:"text",value:a.username,onChange:a=>p(b,{username:a.target.value}),disabled:i,placeholder:"username",className:"min-w-0 rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,d.jsx)("input",{type:"password",value:a.password,onChange:a=>p(b,{password:a.target.value}),disabled:i,placeholder:a.hasPassword?"Saved — leave blank to keep":"Set a password",className:"min-w-0 rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,d.jsx)("button",{type:"button",onClick:()=>{let a;(!(a=g[b]).hasPassword||window.confirm(`Remove ${a.username}? Anything using this account stops working after the restart.`))&&h(a=>a.filter((a,c)=>c!==b))},disabled:i,className:"rounded-lg border border-border px-3 py-2 text-xs text-text-muted transition hover:border-red-500/40 hover:text-red-600 disabled:opacity-50",children:"Remove"})]},b))]}),(0,d.jsxs)("div",{className:"mt-3 flex flex-wrap items-center gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:()=>h(a=>[...a,{username:"",hasPassword:!1,password:""}]),disabled:i,className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-muted transition hover:border-primary hover:text-primary disabled:opacity-50",children:"Add account"}),(0,d.jsx)("button",{type:"button",onClick:q,disabled:i,className:"rounded-lg bg-primary px-3 py-1.5 text-xs font-semibold text-white transition hover:opacity-90 disabled:opacity-50",children:i?"Saving…":a?"Save & Restart Proxy":"Save"}),(0,d.jsxs)("span",{className:"text-[11px] text-text-muted",children:["Clients pass credentials in the proxy URL: ",(0,d.jsx)("code",{className:"font-mono",children:"http://USER:PASSWORD@host:port"})," ","— URL-encode ",(0,d.jsx)("code",{className:"font-mono",children:"@ : / #"})," if the password contains them."]})]}),k?(0,d.jsx)("p",{className:"mt-3 rounded-lg border border-red-500/30 bg-red-500/5 p-2 text-xs text-red-600 dark:text-red-400",children:k}):null,m?(0,d.jsx)("p",{className:"mt-3 rounded-lg border border-green-500/30 bg-green-500/5 p-2 text-xs text-green-600 dark:text-green-400",children:m}):null]})}let j={granted:"already granted",ldap:"directory","api-key-owner":"API key owner","oauth-grant":"OAuth access",local:"local login"};function k({onChanged:a}){let[b,c]=(0,e.useState)(null),[f,g]=(0,e.useState)("manual"),[h,i]=(0,e.useState)(0),[l,m]=(0,e.useState)(!1),[n,o]=(0,e.useState)(!1),[p,q]=(0,e.useState)(""),[r,s]=(0,e.useState)(""),[t,u]=(0,e.useState)(""),[v,w]=(0,e.useState)([]),[x,y]=(0,e.useState)(!1),[z,A]=(0,e.useState)(!1),[B,C]=(0,e.useState)(""),[D,E]=(0,e.useState)(""),[F,G]=(0,e.useState)(""),[H,I]=(0,e.useState)(""),J=(0,e.useCallback)(a=>{c(Array.isArray(a?.config?.accessGrants)?a.config.accessGrants:[]),g(a?.status?.security?.clientIpFilterSource||"manual"),i(Number(a?.status?.security?.enforcedClientIpCount||0)),m(a?.status?.running===!0),o(a?.status?.standby===!0)},[]);(0,e.useCallback)(async()=>{try{let a=await fetch("/api/audit-proxy?limit=1",{cache:"no-store"}),b=await a.json();if(!a.ok)throw Error(b.error||"Cannot load Audit Proxy access grants");J(b)}catch(a){E(a.message||"Cannot load Audit Proxy access grants")}},[J]);let K=(0,e.useMemo)(()=>String(r||"").split(/[\r\n,]+/).map(a=>a.trim()).filter(Boolean),[r]),L=async(b,c,d)=>{C(b),E(""),G("");try{let e=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:b,...c})}),f=await e.json().catch(()=>({}));if(!e.ok)throw Error(f.error||"Failed to save Audit Proxy access grant");J(f);let g=Number(f.droppedConnections||0);return G(`${d} Applied to the running proxy without a restart.${g?` ${g} open connection(s) from addresses that lost access were closed.`:""}`),a?.(),!0}catch(a){return E(a.message||"Failed to save Audit Proxy access grant"),!1}finally{C("")}},M=async()=>{let a=String(p||"").trim().toLowerCase();a?await L("save-access-grant",{userId:a,ips:K,note:t},`Access grant for ${a} saved.`)&&(q(""),s(""),u("")):E("Enter the dashboard username or email to grant access to.")},N=async a=>{await L("delete-access-grant",{userId:a},`Access grant for ${a} revoked.`)&&I("")};if(!b)return null;let O=b.reduce((a,b)=>a+(b.ips?.length||0),0);return(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("div",{className:"flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between",children:(0,d.jsxs)("div",{children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-primary",children:"group"}),(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Access grants — who may use this proxy"}),(0,d.jsx)("span",{className:`rounded-full px-2 py-0.5 text-[10px] font-semibold ${"grants"===f?"bg-green-500/10 text-green-600 dark:text-green-400":"bg-surface text-text-muted"}`,children:"grants"===f?`ENFORCING ${h} IP`:"NOT ENFORCING"})]}),(0,d.jsxs)("p",{className:"mt-1 max-w-4xl text-xs leading-5 text-text-muted",children:["Grant a dashboard user the client IPs they may connect from. As soon as one grant carries an IP, the proxy accepts ",(0,d.jsx)("strong",{children:"only granted addresses"})," and the free-text Client IP filter below is superseded. Each granted user also gets a read-only ",(0,d.jsx)("span",{className:"font-mono",children:"/dashboard/audit-proxy"})," page with the root CA download, the launcher commands and their own addresses — no configuration, no audited traffic."]})]})}),D?(0,d.jsx)("div",{className:"mt-3 rounded-lg border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-600 dark:text-red-400",children:D}):null,F?(0,d.jsx)("div",{className:"mt-3 rounded-lg border border-green-500/30 bg-green-500/10 px-3 py-2 text-xs text-green-600 dark:text-green-400",children:F}):null,(0,d.jsxs)("div",{className:"mt-4 grid gap-4 lg:grid-cols-[1fr_320px]",children:[(0,d.jsxs)("div",{className:"grid gap-3",children:[(0,d.jsxs)("div",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Dashboard username / email"}),(0,d.jsxs)("div",{className:"relative",children:[(0,d.jsx)("input",{value:p,onChange:a=>{q(a.target.value),y(!0)},onFocus:()=>y(!0),onBlur:()=>setTimeout(()=>y(!1),150),autoComplete:"off",placeholder:"anh-tct or anh-tct@fujinet.net",className:"w-full rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary"}),x&&(z||v.length>0)?(0,d.jsxs)("div",{className:"absolute z-20 mt-1 max-h-64 w-full overflow-y-auto rounded-lg border border-border bg-surface shadow-lg",children:[z&&0===v.length?(0,d.jsx)("div",{className:"px-3 py-2 text-xs text-text-muted",children:"Searching…"}):null,v.map(a=>{let c=b.some(b=>b.userId===a.id);return(0,d.jsxs)("button",{type:"button",onMouseDown:a=>a.preventDefault(),onClick:()=>{q(a.id),y(!1)},className:"flex w-full items-center justify-between gap-2 px-3 py-2 text-left hover:bg-background",children:[(0,d.jsxs)("span",{className:"min-w-0",children:[(0,d.jsx)("span",{className:"block truncate font-mono text-xs text-text-main",children:a.id}),a.displayName||a.email?(0,d.jsx)("span",{className:"block truncate text-[11px] text-text-muted",children:[a.displayName,a.email].filter(Boolean).join(" \xb7 ")}):null]}),(0,d.jsxs)("span",{className:"flex shrink-0 items-center gap-1",children:[c?(0,d.jsx)("span",{className:"rounded-full bg-green-500/10 px-2 py-0.5 text-[10px] font-semibold text-green-600 dark:text-green-400",children:"granted"}):null,(0,d.jsx)("span",{className:"rounded-full border border-border px-2 py-0.5 text-[10px] text-text-muted",children:j[a.source]||a.source})]})]},`${a.source}:${a.id}`)})]}):null]}),(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"The identity the user logs into this dashboard with (LDAP/OIDC/local). Either the username or the email form is matched. Suggestions come from the directory and from accounts this install already knows; a name that is not listed can still be typed."})]}),(0,d.jsxs)("label",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Allowed client IPs / CIDRs"}),(0,d.jsx)("textarea",{rows:4,value:r,onChange:a=>s(a.target.value),placeholder:"172.16.253.2\n172.16.6.0/24",className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary"}),(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"One IPv4, IPv6 or CIDR per line — the workstation addresses this user runs Claude Code / Codex from."})]}),(0,d.jsxs)("label",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:"Note (optional)"}),(0,d.jsx)("input",{value:t,onChange:a=>u(a.target.value),placeholder:"Laptop + VDI",className:"rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary"})]})]}),(0,d.jsxs)("div",{className:"grid content-start gap-3",children:[(0,d.jsxs)("div",{className:"rounded-xl border border-primary/20 bg-primary/5 p-3 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("div",{className:"font-semibold text-primary",children:"What a grant changes"}),(0,d.jsx)("div",{className:"mt-1",children:"Granted IP → proxy works normally."}),(0,d.jsx)("div",{children:"Any other IP → TCP connection closed before CONNECT is parsed."}),(0,d.jsx)("div",{children:"Granted user → read-only Audit Proxy page + CA download."}),(0,d.jsx)("div",{children:"No grant with an IP → falls back to the Client IP filter below."}),(0,d.jsx)("div",{className:"mt-1 text-[11px]",children:"Applied without restarting the listener."})]}),(0,d.jsx)("button",{type:"button",onClick:M,disabled:!!B||n,className:"rounded-lg bg-primary px-4 py-2 text-sm font-semibold text-white disabled:opacity-50",children:"save-access-grant"===B?"Saving…":"Save grant"}),l?(0,d.jsx)("div",{className:"text-[11px] leading-4 text-text-muted",children:"The listener keeps running: the change governs the next connection, and tunnels held by an address you just removed are closed."}):null]})]}),(0,d.jsxs)("div",{className:"mt-4 border-t border-border pt-4",children:[(0,d.jsxs)("div",{className:"mb-3 flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsx)("h3",{className:"text-sm font-semibold text-text-main",children:"Granted users"}),(0,d.jsxs)("span",{className:"text-[11px] text-text-muted",children:[b.length," user \xb7 ",O," address"]})]}),0===b.length?(0,d.jsx)("div",{className:"rounded-xl border border-dashed border-border p-6 text-center text-xs text-text-muted",children:"No grant yet. The proxy still follows the Client IP filter below, and only admins can open this page."}):(0,d.jsx)("div",{className:"overflow-x-auto rounded-xl border border-border",children:(0,d.jsxs)("table",{className:"min-w-full divide-y divide-border text-xs",children:[(0,d.jsx)("thead",{className:"bg-surface/80 text-left uppercase tracking-wide text-text-muted",children:(0,d.jsxs)("tr",{children:[(0,d.jsx)("th",{className:"px-3 py-2 font-medium",children:"User"}),(0,d.jsx)("th",{className:"px-3 py-2 font-medium",children:"Allowed client IPs"}),(0,d.jsx)("th",{className:"px-3 py-2 font-medium",children:"Note"}),(0,d.jsx)("th",{className:"px-3 py-2 text-right font-medium",children:"Actions"})]})}),(0,d.jsx)("tbody",{className:"divide-y divide-border bg-background",children:b.map(a=>(0,d.jsxs)("tr",{className:"align-top",children:[(0,d.jsx)("td",{className:"px-3 py-3 font-mono text-text-main",children:a.userId}),(0,d.jsx)("td",{className:"px-3 py-3",children:a.ips?.length?(0,d.jsx)("div",{className:"flex flex-wrap gap-1",children:a.ips.map(a=>(0,d.jsx)("span",{className:"rounded-full border border-border bg-surface px-2 py-0.5 font-mono text-[10px] text-text-muted",children:a},a))}):(0,d.jsx)("span",{className:"text-amber-600 dark:text-amber-400",children:"No IP — page access only, proxy will refuse this user"})}),(0,d.jsx)("td",{className:"px-3 py-3 text-text-muted",children:a.note||"-"}),(0,d.jsx)("td",{className:"px-3 py-3",children:(0,d.jsxs)("div",{className:"flex flex-wrap justify-end gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:()=>{q(a.userId),s((a.ips||[]).join("\n")),u(a.note||"")},disabled:n,className:"rounded-lg border border-border px-2.5 py-1 font-semibold text-text-main hover:bg-surface",children:"Edit"}),H===a.userId?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("button",{type:"button",onClick:()=>N(a.userId),disabled:!!B||n,className:"rounded-lg border border-red-500/30 bg-red-500/10 px-2.5 py-1 font-semibold text-red-600 disabled:opacity-50",children:"Confirm revoke"}),(0,d.jsx)("button",{type:"button",onClick:()=>I(""),className:"rounded-lg border border-border px-2.5 py-1 text-text-muted",children:"Cancel"})]}):(0,d.jsx)("button",{type:"button",onClick:()=>I(a.userId),disabled:n,className:"rounded-lg border border-red-500/30 px-2.5 py-1 font-semibold text-red-600 hover:bg-red-500/10",children:"Revoke"})]})})]},a.userId))})]})})]})]})}var l=c(5243);let m=["api.anthropic.com","*.anthropic.com","claude.ai","*.claude.ai"],n=["api.openai.com","*.openai.com","chatgpt.com","*.chatgpt.com"],o=[{id:"claude-code",label:"Claude Code"},{id:"codex",label:"OpenAI Codex"},{id:"gemini-cli",label:"Gemini CLI"},{id:"cursor",label:"Cursor"},{id:"curl",label:"curl / scripts"}];function p({ok:a,children:b}){return(0,d.jsxs)("span",{className:`inline-flex items-center gap-1 rounded-full border px-2 py-0.5 text-xs font-medium ${a?"border-green-500/30 bg-green-500/10 text-green-600 dark:text-green-400":"border-border bg-surface text-text-muted"}`,children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-[13px]",children:a?"check_circle":"radio_button_unchecked"}),b]})}function q(a){let b=Number(a||0);return!Number.isFinite(b)||b<=0?"0":b>=1e6?`${(b/1e6).toFixed(2)}M`:b>=1e3?`${(b/1e3).toFixed(1)}k`:String(b)}function r(a){let b=Number(a||0);return!Number.isFinite(b)||b<=0?"$0.00":b<.01?`$${b.toFixed(4)}`:`$${b.toFixed(2)}`}function s({label:a,value:b,hint:c}){return(0,d.jsxs)("div",{className:"rounded-xl border border-border bg-background/50 p-3",children:[(0,d.jsx)("div",{className:"text-[11px] font-medium uppercase tracking-wide text-text-muted",children:a}),(0,d.jsx)("div",{className:"mt-1 text-lg font-semibold text-text-main",children:b}),c?(0,d.jsx)("div",{className:"mt-0.5 text-[11px] leading-4 text-text-muted",children:c}):null]})}function t({title:a,rows:b}){return b?.length?(0,d.jsxs)("div",{className:"min-w-0",children:[(0,d.jsx)("h3",{className:"text-xs font-semibold uppercase tracking-wide text-text-muted",children:a}),(0,d.jsx)("div",{className:"mt-2 overflow-x-auto",children:(0,d.jsxs)("table",{className:"w-full min-w-[420px] text-left text-xs",children:[(0,d.jsx)("thead",{className:"border-b border-border text-text-muted",children:(0,d.jsxs)("tr",{children:[(0,d.jsx)("th",{className:"px-2 py-1.5 font-medium",children:"Name"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Reqs"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"In"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Out"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Cache R/W"}),(0,d.jsx)("th",{className:"px-2 py-1.5 text-right font-medium",children:"Cost"})]})}),(0,d.jsx)("tbody",{children:b.map(a=>(0,d.jsxs)("tr",{className:"border-b border-border/60 text-text-main",children:[(0,d.jsx)("td",{className:"max-w-[220px] truncate px-2 py-1.5 font-mono text-[11px]",title:a.label,children:a.label}),(0,d.jsx)("td",{className:"px-2 py-1.5 text-right",children:a.requests}),(0,d.jsx)("td",{className:"px-2 py-1.5 text-right",children:q(a.inputTokens)}),(0,d.jsx)("td",{className:"px-2 py-1.5 text-right",children:q(a.outputTokens)}),(0,d.jsxs)("td",{className:"px-2 py-1.5 text-right text-text-muted",children:[q(a.cacheReadTokens),"/",q(a.cacheCreationTokens)]}),(0,d.jsx)("td",{className:"px-2 py-1.5 text-right",children:r(a.cost)})]},a.label))})]})})]}):null}function u({label:a,hint:b,children:c}){return(0,d.jsxs)("label",{className:"grid gap-1.5",children:[(0,d.jsx)("span",{className:"text-sm font-semibold text-text-main",children:a}),c,b?(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:b}):null]})}function v({label:a,description:b,checked:c,onChange:e,disabled:f=!1}){return(0,d.jsxs)("label",{className:"flex items-start justify-between gap-4 rounded-xl border border-border bg-background/50 p-3",children:[(0,d.jsxs)("span",{children:[(0,d.jsx)("span",{className:"block text-sm font-semibold text-text-main",children:a}),(0,d.jsx)("span",{className:"mt-0.5 block text-xs leading-5 text-text-muted",children:b})]}),(0,d.jsx)("input",{type:"checkbox",checked:c,onChange:a=>e(a.target.checked),disabled:f,className:"mt-1 h-4 w-4 accent-[var(--color-primary)]"})]})}function w(){let[a,b]=(0,e.useState)(null),[c,f]=(0,e.useState)(null),[j,w]=(0,e.useState)(""),[x,y]=(0,e.useState)(""),[z,A]=(0,e.useState)(""),[B,C]=(0,e.useState)(null),[D,E]=(0,e.useState)("configuration"),F=(0,e.useCallback)(async(a=!0)=>{try{let c=await fetch("/api/audit-proxy?limit=50",{cache:"no-store"}),d=await c.json();if(!c.ok)throw Error(d.error||"Cannot load Audit Proxy");b(d),a?f(a=>a||d.config):f(d.config)}catch(a){y(a.message||"Cannot load Audit Proxy")}},[]),G=a?.status||{},H=G.security||{},I=G.rootCA||{},J=!0===G.running,K=!0===G.pendingListenerRestart,L=!0===G.standby,M=(c?.allowedHosts||[]).join("\n"),N=(a,b)=>f(c=>({...c,[a]:b})),O=async(a,b={})=>{w(a),y(""),A("");try{let c=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:a,...b})}),d=await c.json().catch(()=>({}));if(!c.ok)throw Error(d.error||`${a} failed`);return"test"===a?(C(d.test),A(`Simulation passed ${d.test.passed}/${d.test.total} checks.`)):A("clear-logs"===a?"Audit logs cleared.":`Audit Proxy ${a} completed.`),await F("start"!==a&&"restart"!==a),d}catch(b){return y(b.message||`${a} failed`),null}finally{w("")}},P=async()=>{w("save"),y(""),A("");try{let a=await fetch("/api/audit-proxy",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({config:c})}),b=await a.json();if(!a.ok)throw Error(b.error||"Save failed");f(b.config);let d=Number(b.droppedConnections||0);A(b.rebindRequired?`Configuration saved and applied. The listener address/port change waits for Save & Restart — the proxy is still on ${G.address?.address||c.bindHost}:${G.address?.port||c.port}.`:`Configuration saved and applied to the running proxy${J?" without a restart":""}.${d?` ${d} connection(s) from addresses that lost access were closed.`:""}`),await F(!0)}catch(a){y(a.message||"Save failed")}finally{w("")}},Q=async()=>{w("save-client-host"),y(""),A("");try{let a=await fetch("/api/audit-proxy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({action:"save-client-host",clientProxyHost:c?.clientProxyHost||""})}),b=await a.json().catch(()=>({}));if(!a.ok)throw Error(b.error||"Failed to save Client proxy host");f(a=>({...a,clientProxyHost:b.config?.clientProxyHost||""})),A("Client proxy host saved."),await F(!0)}catch(a){y(a.message||"Failed to save Client proxy host")}finally{w("")}},R=async()=>{w("ca"),y("");try{let a=await fetch("/api/audit-proxy/ca",{method:"POST"}),b=await a.json();if(!a.ok)throw Error(b.error||"CA validation failed");A("Root CA is ready. Existing enterprise CA material was not rotated."),await F(!0)}catch(a){y(a.message||"CA validation failed")}finally{w("")}},S=a=>N("allowedHosts",[...new Set([...c?.allowedHosts||[],...a])]);if(!c)return(0,d.jsx)("div",{className:"rounded-xl border border-border bg-surface p-5 text-sm text-text-muted",children:"Loading Enterprise AI Audit Proxy…"});let T=Math.round(Number(c.captureLimitBytes||0)/1024/1024*10)/10,U=["0.0.0.0","::"].includes(c.bindHost)||!String(c.bindHost).startsWith("127.")&&"localhost"!==c.bindHost&&"::1"!==c.bindHost;return(0,d.jsxs)("div",{className:"space-y-4",children:[(0,d.jsxs)("div",{className:"flex flex-col gap-3 rounded-2xl border border-primary/20 bg-primary/5 p-4 sm:flex-row sm:items-start sm:justify-between",children:[(0,d.jsxs)("div",{children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-2",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-primary",children:"policy"}),(0,d.jsx)("h1",{className:"text-lg font-bold text-text-main",children:"Enterprise AI Audit Proxy"}),(0,d.jsx)(p,{ok:J,children:J?"Running":"Stopped"}),(0,d.jsx)(p,{ok:!0===I.validated,children:"Root CA"}),(0,d.jsx)(p,{ok:c.verifyUpstreamTls,children:"Verified upstream TLS"}),(0,d.jsx)(p,{ok:!0,children:G.capabilities?.http2===!0?"HTTP/1.1 + HTTP/2":"HTTP/1.1"})]}),(0,d.jsx)("p",{className:"mt-2 max-w-5xl text-sm leading-6 text-text-muted",children:"Explicit HTTPS CONNECT proxy for Claude Code and Codex. Request method, path, query, authentication values and body bytes are forwarded without content rewriting. Standard hop-by-hop headers and BlueRouter internal headers remain intentionally removed."})]}),(0,d.jsxs)(g(),{href:"/dashboard/mitm",className:"inline-flex items-center gap-1 text-xs font-medium text-primary hover:underline",children:[(0,d.jsx)("span",{className:"material-symbols-outlined text-[16px]",children:"arrow_back"})," AI Traffic Gateway"]})]}),x?(0,d.jsx)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-600 dark:text-red-400",children:x}):null,z?(0,d.jsx)("div",{className:"rounded-xl border border-green-500/30 bg-green-500/10 px-4 py-3 text-sm text-green-600 dark:text-green-400",children:z}):null,(0,d.jsxs)("div",{className:"flex w-fit items-center gap-1 rounded-xl border border-border bg-surface p-1",children:[(0,d.jsx)("button",{type:"button",onClick:()=>E("configuration"),className:`rounded-lg px-3 py-1.5 text-xs font-semibold transition ${"configuration"===D?"bg-primary text-white":"text-text-muted hover:bg-background hover:text-text-main"}`,children:"Configuration"}),(0,d.jsx)("button",{type:"button",onClick:()=>E("audit"),className:`rounded-lg px-3 py-1.5 text-xs font-semibold transition ${"audit"===D?"bg-primary text-white":"text-text-muted hover:bg-background hover:text-text-main"}`,children:"Audit & Usage"})]}),(0,d.jsxs)("div",{className:"configuration"===D?"space-y-4":"hidden",children:[L?(0,d.jsxs)("div",{className:"rounded-xl border border-blue-500/30 bg-blue-500/10 px-4 py-3 text-sm text-blue-700 dark:text-blue-300",children:[(0,d.jsx)("strong",{children:"Node n\xe0y đang l\xe0 Cluster Standby."})," Access grants, TLS allowlist, client tool filter v\xe0 capture được đồng bộ từ Master qua cluster snapshot, n\xean form ở đ\xe2y chỉ đọc. Sửa tr\xean Master rồi để sync \xe1p xuống. Bind address/port, Proxy authentication v\xe0 Root CA vẫn l\xe0 của ri\xeang node n\xe0y."]}):null,K?(0,d.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-3 rounded-xl border border-amber-500/30 bg-amber-500/10 px-4 py-3 text-sm text-amber-700 dark:text-amber-300",children:[(0,d.jsxs)("span",{children:[(0,d.jsx)("strong",{children:"Listener address/port change is pending."})," Saved as ",c.bindHost,":",c.port,", still bound to ",G.address?.address,":",G.address?.port,". A bound socket cannot move — restart the listener to apply it. Everything else you saved is already live."]}),(0,d.jsx)("button",{type:"button",onClick:()=>O("restart",{config:c}),disabled:!!j,className:"shrink-0 rounded-lg border border-amber-500/40 bg-amber-500/10 px-3 py-1.5 text-xs font-semibold disabled:opacity-50",children:"restart"===j?"Restarting…":"Restart listener now"})]}):null,H.lanExposedWithoutIpFilter?(0,d.jsxs)("div",{className:"rounded-xl border border-red-500/30 bg-red-500/10 px-4 py-3 text-sm text-red-700 dark:text-red-300",children:[(0,d.jsx)("strong",{children:"LAN listener has no Client IP filter."})," Enable the IP allowlist below before broad deployment. Plain HTTP, private destinations and CONNECT ports other than 443 are blocked, but the listener should still be restricted by firewall/VLAN."]}):U?(0,d.jsxs)("div",{className:"rounded-xl border border-amber-500/30 bg-amber-500/10 px-4 py-3 text-sm text-amber-700 dark:text-amber-300",children:[(0,d.jsx)("strong",{children:"LAN listener enabled."})," Keep TCP ",c.port," restricted to the intended LAN/VPN and maintain the Client IP allowlist."]}):null,I.expiringSoon?(0,d.jsx)("div",{className:"rounded-xl border border-amber-500/30 bg-amber-500/10 px-4 py-3 text-sm text-amber-700 dark:text-amber-300",children:"Root CA expires soon. Audit Proxy will not rotate enterprise CA material automatically; prepare and deploy the replacement CA through Advanced CA management."}):null,(0,d.jsxs)("div",{className:"grid gap-4 xl:grid-cols-[1.25fr_0.75fr]",children:[(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"mb-4 flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Proxy configuration"}),(0,d.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"All server-side setup is managed here. No proxy daemon CLI is required."})]}),(0,d.jsxs)("div",{className:"flex flex-wrap gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:()=>S(m),className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-main hover:bg-background disabled:opacity-50",children:"+ Anthropic preset"}),(0,d.jsx)("button",{type:"button",onClick:()=>S(n),className:"rounded-lg border border-border px-3 py-1.5 text-xs text-text-main hover:bg-background disabled:opacity-50",children:"+ OpenAI preset"})]})]}),(0,d.jsxs)("div",{className:"grid gap-4 md:grid-cols-2",children:[(0,d.jsx)(u,{label:"Bind address",hint:"127.0.0.1 = local only. Use 0.0.0.0 or a LAN IP for other workstations. The only setting that needs Save & Restart while the proxy runs — a bound socket cannot move.",children:(0,d.jsx)("input",{value:c.bindHost,onChange:a=>N("bindHost",a.target.value),className:`rounded-lg border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary ${K?"border-amber-500/50":"border-border"}`})}),(0,d.jsx)(u,{label:"Proxy port",hint:"Default 3128; Docker deployments must publish this port explicitly. Also needs Save & Restart to take effect.",children:(0,d.jsx)("input",{type:"number",min:"1",max:"65535",value:c.port,onChange:a=>N("port",Number(a.target.value)),className:`rounded-lg border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary ${K?"border-amber-500/50":"border-border"}`})}),(0,d.jsx)(u,{label:"Client proxy host",hint:"Manual persistent hostname/IP used only in deployment commands; it does not change the listener.",children:(0,d.jsxs)("div",{className:"flex gap-2",children:[(0,d.jsx)("input",{value:c.clientProxyHost||"",onChange:a=>N("clientProxyHost",a.target.value),placeholder:"172.16.6.8 or proxy.example.local",className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary"}),(0,d.jsx)("button",{type:"button",onClick:Q,disabled:!!j||L,className:"shrink-0 rounded-lg border border-primary/30 bg-primary/10 px-3 py-2 text-xs font-semibold text-primary disabled:opacity-50",children:"save-client-host"===j?"Saving…":"Save host"})]})}),(0,d.jsx)(u,{label:"Capture limit / request",hint:"Traffic streams immediately; only this bounded prefix is retained for audit.",children:(0,d.jsxs)("div",{className:"flex items-center gap-2",children:[(0,d.jsx)("input",{type:"number",min:"0",max:"16",step:"0.5",value:T,onChange:a=>N("captureLimitBytes",Math.round(1024*Number(a.target.value)*1024)),disabled:!c.captureBodies,className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,d.jsx)("span",{className:"text-xs text-text-muted",children:"MB"})]})})]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-3 md:grid-cols-2",children:[(0,d.jsx)(v,{label:"Pass through non-audited hosts",description:"Unknown hosts use a blind TLS tunnel only when they resolve to public addresses on TCP 443. Private/reserved destinations are denied.",checked:c.passthroughUnknown,onChange:a=>N("passthroughUnknown",a)}),(0,d.jsx)(v,{label:"Capture request/response bodies",description:"Credentials are redacted before persistence. Disable to retain metadata and wire hashes only.",checked:c.captureBodies,onChange:a=>N("captureBodies",a)})]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-3",children:[(0,d.jsx)(v,{label:"Restrict which client tools may connect",description:"Refuses a CONNECT whose User-Agent identifies a tool that is not listed. Catches a browser pointed at the proxy, or a script that inherited HTTPS_PROXY. It cannot catch a client that sends no User-Agent — Claude Code sends none at all and Codex only on its first tunnel, so those are always let through, and anyone can do the same by dropping the header. Hygiene, not access control: the client IP allowlist and who holds the root CA are what bound access.",checked:!0===c.clientToolFilterEnabled,onChange:a=>N("clientToolFilterEnabled",a)}),c.clientToolFilterEnabled?(0,d.jsxs)("div",{className:"grid gap-2",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center gap-1.5",children:[(0,d.jsx)("span",{className:"text-[11px] font-medium text-text-muted",children:"Add:"}),o.map(a=>(0,d.jsx)("button",{type:"button",disabled:(c.allowedClientTools||[]).includes(a.id),onClick:()=>N("allowedClientTools",[...new Set([...c.allowedClientTools||[],a.id])]),className:"rounded-lg border border-border px-2 py-1 text-[11px] text-text-muted transition hover:border-primary hover:text-primary disabled:opacity-40",children:a.label},a.id))]}),(0,d.jsx)(u,{label:"Allowed client tools",hint:"One entry per line: a preset id above, or any substring matched against the User-Agent. Only clients that send a User-Agent are checked. Refused connections appear in the audit table with the User-Agent that was rejected, so you can add what you actually use.",children:(0,d.jsx)("textarea",{rows:4,value:(c.allowedClientTools||[]).join("\n"),onChange:a=>N("allowedClientTools",a.target.value.split(/\r?\n/).map(a=>a.trim().toLowerCase()).filter(Boolean)),disabled:J,placeholder:"claude-code\ncodex",className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"})})]}):null]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-4 md:grid-cols-[1fr_190px]",children:[(0,d.jsx)(u,{label:"TLS inspection allowlist",hint:"One hostname/wildcard per line. Only these public HTTPS hosts are decrypted and audited.",children:(0,d.jsx)("textarea",{rows:9,value:M,onChange:a=>N("allowedHosts",a.target.value.split(/\r?\n/).map(a=>a.trim()).filter(Boolean)),className:"rounded-lg border border-border bg-background px-3 py-2 font-mono text-xs text-text-main outline-none focus:border-primary disabled:opacity-60"})}),(0,d.jsxs)("div",{className:"grid content-start gap-4",children:[(0,d.jsx)(u,{label:"Retention",hint:"Daily local JSONL segments older than this value are deleted hourly.",children:(0,d.jsxs)("div",{className:"flex items-center gap-2",children:[(0,d.jsx)("input",{type:"number",min:"1",max:"365",value:c.retentionDays,onChange:a=>N("retentionDays",Number(a.target.value)),className:"min-w-0 flex-1 rounded-lg border border-border bg-background px-3 py-2 text-sm text-text-main outline-none focus:border-primary disabled:opacity-60"}),(0,d.jsx)("span",{className:"text-xs text-text-muted",children:"days"})]})}),(0,d.jsxs)("div",{className:"rounded-xl border border-green-500/20 bg-green-500/5 p-3 text-xs leading-5 text-text-muted",children:[(0,d.jsx)("div",{className:"font-semibold text-green-600 dark:text-green-400",children:"Transport controls enforced"}),"TLS verification ON \xb7 HTTP/1.1 \xb7 HTTPS CONNECT only \xb7 public TCP 443 only."]})]})]}),(0,d.jsxs)("div",{className:"mt-4 flex flex-wrap items-center gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:P,disabled:!!j||L,className:"rounded-lg bg-primary px-4 py-2 text-sm font-semibold text-white disabled:opacity-50",children:"save"===j?"Saving…":J?"Save & apply":"Save"}),J?(0,d.jsx)("button",{type:"button",onClick:()=>O("stop"),disabled:!!j,className:"rounded-lg border border-red-500/30 bg-red-500/10 px-4 py-2 text-sm font-semibold text-red-500 disabled:opacity-50",children:"stop"===j?"Stopping…":"Stop Proxy"}):(0,d.jsx)("button",{type:"button",onClick:()=>O("start",{config:c}),disabled:!!j,className:"rounded-lg border border-green-500/30 bg-green-500/10 px-4 py-2 text-sm font-semibold text-green-600 disabled:opacity-50",children:"start"===j?"Starting…":"Start Proxy"}),(0,d.jsx)("button",{type:"button",onClick:()=>O("restart",{config:c}),disabled:!!j,className:"rounded-lg border border-border px-4 py-2 text-sm font-semibold text-text-main hover:bg-background disabled:opacity-50",children:"restart"===j?"Restarting…":"Save & Restart"}),(0,d.jsx)("button",{type:"button",onClick:()=>O("test"),disabled:!!j,className:"rounded-lg border border-primary/30 bg-primary/10 px-4 py-2 text-sm font-semibold text-primary disabled:opacity-50",children:"test"===j?"Testing…":"Run Simulated Test"}),(0,d.jsx)("span",{className:"text-[11px] leading-4 text-text-muted",children:"Save applies to the running proxy immediately — open tunnels keep streaming. Restart is only for the bind address and port."})]})]}),(0,d.jsxs)("div",{className:"space-y-4",children:[(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Root CA"}),(0,d.jsx)("p",{className:"mt-1 text-xs leading-5 text-text-muted",children:"The existing Root CA/key pair is validated and reused. Audit Proxy never auto-rotates enterprise CA material."}),(0,d.jsxs)("div",{className:"mt-3 grid gap-2 text-xs",children:[(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Status"}),(0,d.jsx)("span",{className:"font-medium text-text-main",children:I.validated?"Validated":I.certExists?"Needs attention":"Not generated"})]}),I.subject?(0,d.jsxs)("div",{className:"grid gap-1",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Subject"}),(0,d.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:I.subject})]}):null,I.fingerprint?(0,d.jsxs)("div",{className:"grid gap-1",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Public key fingerprint"}),(0,d.jsx)("span",{className:"break-all font-mono text-[11px] text-text-main",children:I.fingerprint})]}):null,I.notAfter?(0,d.jsxs)("div",{className:"flex justify-between gap-3",children:[(0,d.jsx)("span",{className:"text-text-muted",children:"Expires"}),(0,d.jsx)("span",{className:"text-text-main",children:new Date(I.notAfter).toLocaleString()})]}):null,I.error?(0,d.jsx)("div",{className:"rounded-lg bg-red-500/10 p-2 text-red-600 dark:text-red-300",children:I.error}):null]}),(0,d.jsxs)("div",{className:"mt-4 flex flex-wrap gap-2",children:[(0,d.jsx)("button",{type:"button",onClick:R,disabled:!!j,className:"rounded-lg border border-border px-3 py-2 text-xs font-semibold text-text-main hover:bg-background disabled:opacity-50",children:I.certExists?"Validate / Reuse CA":"Generate CA"}),(0,d.jsx)("a",{href:"/api/audit-proxy/ca?download=cert",className:`rounded-lg border border-primary/30 bg-primary/10 px-3 py-2 text-xs font-semibold text-primary ${!I.certExists?"pointer-events-none opacity-50":""}`,children:"Download Root CA"}),(0,d.jsx)(g(),{href:"/dashboard/mitm",className:"rounded-lg border border-border px-3 py-2 text-xs font-semibold text-text-main hover:bg-background",children:"Advanced CA management"})]})]}),(0,d.jsx)(l.Ay,{clientProxyHost:c.clientProxyHost,port:c.port,onError:y})]})]}),B?(0,d.jsxs)("section",{className:`rounded-2xl border p-4 ${B.ok?"border-green-500/30 bg-green-500/5":"border-red-500/30 bg-red-500/5"}`,children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Simulated end-to-end test"}),(0,d.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"Local throwaway TLS endpoints; no cloud credential or external API call is used."})]}),(0,d.jsxs)(p,{ok:B.ok,children:[B.passed,"/",B.total," passed \xb7 ",B.durationMs," ms"]})]}),(0,d.jsx)("div",{className:"mt-3 grid gap-2 md:grid-cols-2 xl:grid-cols-3",children:B.checks?.map(a=>(0,d.jsxs)("div",{className:"flex items-start gap-2 rounded-lg border border-border/70 bg-background/60 px-3 py-2 text-xs",children:[(0,d.jsx)("span",{className:`material-symbols-outlined text-[16px] ${a.ok?"text-green-500":"text-red-500"}`,children:a.ok?"check_circle":"error"}),(0,d.jsxs)("span",{children:[(0,d.jsx)("span",{className:"font-medium text-text-main",children:a.name}),a.detail?(0,d.jsx)("span",{className:"mt-0.5 block text-text-muted",children:a.detail}):null]})]},a.name))})]}):null,(0,d.jsx)(k,{onChanged:()=>F(!0)}),(0,d.jsx)(h,{}),H.proxyAuthFeatureEnabled?(0,d.jsx)(i,{}):null]}),(0,d.jsxs)("div",{className:"audit"===D?"space-y-4":"hidden",children:[(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Token usage"}),(0,d.jsxs)("p",{className:"mt-1 text-xs text-text-muted",children:["Counts are read out of the audited provider responses themselves — ",(0,d.jsx)("code",{className:"font-mono",children:"message_start"})," carries input and cache tokens, the closing ",(0,d.jsx)("code",{className:"font-mono",children:"message_delta"})," carries output. Scope is the same window as the table below."]})]}),a?.usageSummary?.incompleteUsageCount?(0,d.jsxs)("span",{className:"rounded-lg border border-amber-500/30 bg-amber-500/10 px-2.5 py-1 text-[11px] font-medium text-amber-700 dark:text-amber-300",children:[a.usageSummary.incompleteUsageCount," response(s) truncated before the final usage event — output tokens under-counted"]}):null]}),a?.usageSummary?.totals?.requests?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsxs)("div",{className:"mt-3 grid gap-2 sm:grid-cols-2 lg:grid-cols-5",children:[(0,d.jsx)(s,{label:"Requests with usage",value:a.usageSummary.totals.requests}),(0,d.jsx)(s,{label:"Input",value:q(a.usageSummary.totals.inputTokens),hint:"new (uncached) input tokens"}),(0,d.jsx)(s,{label:"Output",value:q(a.usageSummary.totals.outputTokens)}),(0,d.jsx)(s,{label:"Cache read / write",value:`${q(a.usageSummary.totals.cacheReadTokens)} / ${q(a.usageSummary.totals.cacheCreationTokens)}`}),(0,d.jsx)(s,{label:"Est. cost",value:r(a.usageSummary.totals.cost),hint:"from the pricing table"})]}),(0,d.jsxs)("div",{className:"mt-4 grid gap-5 lg:grid-cols-2",children:[(0,d.jsx)(t,{title:"By model",rows:a.usageSummary.byModel}),(0,d.jsx)(t,{title:"By client tool",rows:a.usageSummary.bySourceTool})]})]}):(0,d.jsx)("p",{className:"mt-3 rounded-xl border border-border bg-background/50 p-3 text-xs text-text-muted",children:"No token usage recorded yet. Usage appears once an audited request reaches a provider that reports it (Anthropic and OpenAI both do)."})]}),(0,d.jsxs)("section",{className:"rounded-2xl border border-border bg-surface p-4",children:[(0,d.jsxs)("div",{className:"flex flex-wrap items-center justify-between gap-2",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{className:"font-semibold text-text-main",children:"Recent audit requests"}),(0,d.jsx)("p",{className:"mt-1 text-xs text-text-muted",children:"Credentials are redacted before persistence. Local writes and MySQL mirroring run through a bounded asynchronous queue."})]}),(0,d.jsxs)("div",{className:"flex items-center gap-3 text-xs text-text-muted",children:[(0,d.jsxs)("span",{children:["Queue ",G.auditStore?.queueDepth||0,"/",G.auditStore?.queueLimit||1e3]}),(0,d.jsx)("button",{type:"button",onClick:()=>O("clear-logs"),disabled:!!j||L,className:"rounded-lg border border-border px-3 py-1.5 hover:bg-background disabled:opacity-50",children:"Clear logs"})]})]}),(0,d.jsx)("div",{className:"mt-3 overflow-x-auto",children:(0,d.jsxs)("table",{className:"w-full min-w-[1250px] text-left text-xs",children:[(0,d.jsx)("thead",{className:"border-b border-border text-text-muted",children:(0,d.jsxs)("tr",{children:[(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Time"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Protocol"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Client"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"User"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Provider"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Host"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Model"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Request"}),(0,d.jsx)("th",{className:"px-2 py-2 text-right font-medium",children:"Tokens (in/out)"}),(0,d.jsx)("th",{className:"px-2 py-2 text-right font-medium",children:"Cache (r/w)"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Status"}),(0,d.jsx)("th",{className:"px-2 py-2 font-medium",children:"Latency"})]})}),(0,d.jsxs)("tbody",{children:[(a?.events||[]).map(a=>(0,d.jsxs)("tr",{className:"border-b border-border/60 align-top text-text-main",children:[(0,d.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-text-muted",children:new Date(a.timestamp).toLocaleTimeString()}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.protocol||"http/1.1"}),(0,d.jsx)("td",{className:"px-2 py-2 font-mono text-[11px]",children:a.client?.ip||"-"}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.client?.proxyUser||"-"}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.provider||"-"}),(0,d.jsx)("td",{className:"px-2 py-2 font-mono text-[11px]",children:a.host||"-"}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.model||"-"}),(0,d.jsx)("td",{className:"max-w-[300px] px-2 py-2",children:(0,d.jsxs)("details",{children:[(0,d.jsxs)("summary",{className:"cursor-pointer truncate",children:[a.method," ",a.path]}),(0,d.jsx)("pre",{className:"mt-2 max-h-72 overflow-auto whitespace-pre-wrap rounded-lg bg-background p-2 text-[10px] leading-4 text-text-muted",children:JSON.stringify({request:a.request,response:a.response,error:a.error},null,2)})]})}),(0,d.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-right",children:a.usage?(0,d.jsxs)("span",{title:!1===a.usage.complete?"Response was truncated before the final usage event; output is a lower bound":void 0,children:[q(a.usage.inputTokens),"/",q(a.usage.outputTokens),!1===a.usage.complete?(0,d.jsx)("span",{className:"text-amber-600 dark:text-amber-400",children:"*"}):null]}):(0,d.jsx)("span",{className:"text-text-muted",children:"-"})}),(0,d.jsx)("td",{className:"whitespace-nowrap px-2 py-2 text-right text-text-muted",children:a.usage?`${q(a.usage.cacheReadTokens)}/${q(a.usage.cacheCreationTokens)}`:"-"}),(0,d.jsx)("td",{className:"px-2 py-2",children:a.status||"ERR"}),(0,d.jsxs)("td",{className:"whitespace-nowrap px-2 py-2",children:[a.durationMs??"-"," ms"]})]},a.id)),a?.events?.length?null:(0,d.jsx)("tr",{children:(0,d.jsx)("td",{colSpan:"12",className:"px-2 py-8 text-center text-text-muted",children:"No audited requests yet."})})]})]})})]})]})]})}},94735:a=>{"use strict";a.exports=require("events")},98621:(a,b,c)=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0}),Object.defineProperty(b,"unstable_rethrow",{enumerable:!0,get:function(){return function a(b){if((0,g.isNextRouterError)(b)||(0,f.isBailoutToCSRError)(b)||(0,i.isDynamicServerError)(b)||(0,h.isDynamicPostpone)(b)||(0,e.isPostpone)(b)||(0,d.isHangingPromiseRejectionError)(b)||(0,h.isPrerenderInterruptedError)(b))throw b;b instanceof Error&&"cause"in b&&a(b.cause)}}});let d=c(48894),e=c(64491),f=c(62880),g=c(76484),h=c(23445),i=c(43449);("function"==typeof b.default||"object"==typeof b.default&&null!==b.default)&&void 0===b.default.__esModule&&(Object.defineProperty(b.default,"__esModule",{value:!0}),Object.assign(b.default,b),a.exports=b.default)}};var b=require("../../../../webpack-runtime.js");b.C(a);var c=b.X(0,[4741,5592,5573,4433,2430,8316,8946,1370,402,5681,4404,6064,6328,8640,3096,9471],()=>b(b.s=63988));module.exports=c})();