@zincapp/znvault-cli 2.1.0

package/dist/lib/client.js

@@ -0,0 +1,734 @@
+import https from 'node:https';
+import http from 'node:http';
+import { getConfig, getCredentials, getApiKey, hasApiKey, storeCredentials, isTokenExpired, getEnvCredentials, hasEnvCredentials, } from './config.js';
+class VaultClient {
+    baseUrl;
+    insecure;
+    timeout;
+    constructor() {
+        const config = getConfig();
+        this.baseUrl = config.url;
+        this.insecure = config.insecure;
+        this.timeout = config.timeout;
+    }
+    /**
+     * Update client configuration
+     */
+    configure(url, insecure) {
+        if (url)
+            this.baseUrl = url;
+        if (insecure !== undefined)
+            this.insecure = insecure;
+    }
+    /**
+     * Make an HTTP request
+     */
+    async request(options) {
+        const url = new URL(this.baseUrl);
+        url.pathname = options.path;
+        if (options.query) {
+            for (const [key, value] of Object.entries(options.query)) {
+                if (value !== undefined) {
+                    url.searchParams.set(key, String(value));
+                }
+            }
+        }
+        const headers = {
+            'Content-Type': 'application/json',
+            'Accept': 'application/json',
+        };
+        // Add authentication
+        if (!options.skipAuth) {
+            if (hasApiKey()) {
+                headers['X-API-Key'] = getApiKey();
+            }
+            else {
+                const credentials = getCredentials();
+                if (credentials) {
+                    // Check if token is expired and try to refresh
+                    if (isTokenExpired() && credentials.refreshToken) {
+                        await this.refreshToken();
+                    }
+                    const updatedCredentials = getCredentials();
+                    if (updatedCredentials) {
+                        headers['Authorization'] = `Bearer ${updatedCredentials.accessToken}`;
+                    }
+                }
+                else if (hasEnvCredentials()) {
+                    // Auto-login with env credentials
+                    const envCreds = getEnvCredentials();
+                    await this.login(envCreds.username, envCreds.password);
+                    const newCredentials = getCredentials();
+                    if (newCredentials) {
+                        headers['Authorization'] = `Bearer ${newCredentials.accessToken}`;
+                    }
+                }
+            }
+        }
+        const requestOptions = {
+            hostname: url.hostname,
+            port: url.port || (url.protocol === 'https:' ? 443 : 80),
+            path: url.pathname + url.search,
+            method: options.method,
+            headers,
+            timeout: this.timeout,
+            rejectUnauthorized: !this.insecure,
+        };
+        return new Promise((resolve, reject) => {
+            const protocol = url.protocol === 'https:' ? https : http;
+            const req = protocol.request(requestOptions, (res) => {
+                let data = '';
+                res.on('data', (chunk) => (data += chunk));
+                res.on('end', () => {
+                    try {
+                        const parsed = data ? JSON.parse(data) : {};
+                        if (res.statusCode && res.statusCode >= 400) {
+                            const error = parsed;
+                            reject(new Error(error.message || `Request failed with status ${res.statusCode}`));
+                        }
+                        else {
+                            resolve(parsed);
+                        }
+                    }
+                    catch {
+                        if (res.statusCode && res.statusCode >= 400) {
+                            reject(new Error(`Request failed with status ${res.statusCode}`));
+                        }
+                        else {
+                            resolve(data);
+                        }
+                    }
+                });
+            });
+            req.on('error', reject);
+            req.on('timeout', () => {
+                req.destroy();
+                reject(new Error('Request timeout'));
+            });
+            if (options.body) {
+                req.write(JSON.stringify(options.body));
+            }
+            req.end();
+        });
+    }
+    // ============ Authentication ============
+    async login(username, password, totp) {
+        const response = await this.request({
+            method: 'POST',
+            path: '/auth/login',
+            body: { username, password, totp },
+            skipAuth: true,
+        });
+        // Store credentials
+        storeCredentials({
+            accessToken: response.accessToken,
+            refreshToken: response.refreshToken,
+            expiresAt: Date.now() + response.expiresIn * 1000,
+            userId: response.user.id,
+            username: response.user.username,
+            role: response.user.role,
+            tenantId: response.user.tenantId,
+        });
+        return response;
+    }
+    async refreshToken() {
+        const credentials = getCredentials();
+        if (!credentials?.refreshToken) {
+            throw new Error('No refresh token available');
+        }
+        const response = await this.request({
+            method: 'POST',
+            path: '/auth/refresh',
+            body: { refreshToken: credentials.refreshToken },
+            skipAuth: true,
+        });
+        storeCredentials({
+            ...credentials,
+            accessToken: response.accessToken,
+            refreshToken: response.refreshToken,
+            expiresAt: Date.now() + response.expiresIn * 1000,
+        });
+    }
+    // ============ Health ============
+    async health() {
+        return this.request({
+            method: 'GET',
+            path: '/v1/health',
+            skipAuth: true,
+        });
+    }
+    async leaderHealth() {
+        return this.request({
+            method: 'GET',
+            path: '/v1/health/leader',
+            skipAuth: true,
+        });
+    }
+    // ============ Cluster ============
+    async clusterStatus() {
+        return this.request({
+            method: 'GET',
+            path: '/v1/admin/cluster',
+        });
+    }
+    async clusterTakeover() {
+        return this.request({
+            method: 'POST',
+            path: '/v1/admin/cluster/takeover',
+        });
+    }
+    async clusterPromote(nodeId) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/admin/cluster/nodes/${nodeId}/promote`,
+        });
+    }
+    async clusterRelease() {
+        return this.request({
+            method: 'POST',
+            path: '/v1/admin/cluster/release',
+        });
+    }
+    async clusterMaintenance(enable) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/admin/cluster/maintenance',
+            body: { enable },
+        });
+    }
+    // ============ Tenants ============
+    async listTenants(options) {
+        const response = await this.request({
+            method: 'GET',
+            path: '/v1/tenants',
+            query: {
+                status: options?.status,
+                withUsage: options?.withUsage,
+                pageSize: 1000,
+            },
+        });
+        return response.items;
+    }
+    async createTenant(data) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/tenants',
+            body: data,
+        });
+    }
+    async getTenant(id, withUsage) {
+        return this.request({
+            method: 'GET',
+            path: `/v1/tenants/${id}`,
+            query: { withUsage },
+        });
+    }
+    async updateTenant(id, data) {
+        return this.request({
+            method: 'PATCH',
+            path: `/v1/tenants/${id}`,
+            body: data,
+        });
+    }
+    async deleteTenant(id) {
+        await this.request({
+            method: 'DELETE',
+            path: `/v1/tenants/${id}`,
+        });
+    }
+    async getTenantUsage(id) {
+        return this.request({
+            method: 'GET',
+            path: `/v1/tenants/${id}/usage`,
+        });
+    }
+    // ============ Users ============
+    async listUsers(options) {
+        const response = await this.request({
+            method: 'GET',
+            path: '/v1/users',
+            query: {
+                tenantId: options?.tenantId,
+                role: options?.role,
+                status: options?.status,
+                pageSize: 1000,
+            },
+        });
+        return response.items;
+    }
+    async createUser(data) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/users',
+            body: data,
+        });
+    }
+    async getUser(id) {
+        return this.request({
+            method: 'GET',
+            path: `/v1/users/${id}`,
+        });
+    }
+    async updateUser(id, data) {
+        return this.request({
+            method: 'PUT',
+            path: `/v1/users/${id}`,
+            body: data,
+        });
+    }
+    async deleteUser(id) {
+        await this.request({
+            method: 'DELETE',
+            path: `/v1/users/${id}`,
+        });
+    }
+    async unlockUser(id) {
+        return this.request({
+            method: 'PUT',
+            path: `/v1/users/${id}`,
+            body: { status: 'active', failedAttempts: 0, lockedUntil: null },
+        });
+    }
+    async resetUserPassword(id, newPassword) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/users/${id}/reset-password`,
+            body: { newPassword },
+        });
+    }
+    async disableUserTotp(id) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/users/${id}/totp/disable`,
+        });
+    }
+    // ============ Superadmins ============
+    async listSuperadmins() {
+        const users = await this.listUsers({ role: 'superadmin' });
+        return users.map(u => ({
+            id: u.id,
+            username: u.username,
+            email: u.email,
+            status: u.status,
+            totpEnabled: u.totpEnabled,
+            failedAttempts: u.failedAttempts,
+            lockedUntil: u.lockedUntil,
+            lastLogin: u.lastLogin,
+            createdAt: u.createdAt,
+        }));
+    }
+    async createSuperadmin(data) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/superadmins',
+            body: data,
+        });
+    }
+    async resetSuperadminPassword(username, password) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/superadmins/${username}/password`,
+            body: { password },
+        });
+    }
+    async unlockSuperadmin(username) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/superadmins/${username}/unlock`,
+        });
+    }
+    async disableSuperadmin(username) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/superadmins/${username}/disable`,
+        });
+    }
+    async enableSuperadmin(username) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/superadmins/${username}/enable`,
+        });
+    }
+    // ============ Lockdown ============
+    async getLockdownStatus() {
+        return this.request({
+            method: 'GET',
+            path: '/v1/admin/lockdown/status',
+        });
+    }
+    async triggerLockdown(level, reason) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/admin/lockdown/trigger',
+            body: { level, reason },
+        });
+    }
+    async clearLockdown(reason) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/admin/lockdown/clear',
+            body: { reason },
+        });
+    }
+    async getLockdownHistory(limit) {
+        const response = await this.request({
+            method: 'GET',
+            path: '/v1/admin/lockdown/history',
+            query: { limit: limit || 50 },
+        });
+        return response.items;
+    }
+    async getThreats(options) {
+        const response = await this.request({
+            method: 'GET',
+            path: '/v1/admin/lockdown/threats',
+            query: {
+                category: options?.category,
+                since: options?.since,
+                limit: options?.limit || 100,
+            },
+        });
+        return response.items;
+    }
+    // ============ Audit ============
+    async listAudit(options) {
+        const response = await this.request({
+            method: 'GET',
+            path: '/v1/audit',
+            query: {
+                client_cn: options?.user,
+                action: options?.action,
+                start_date: options?.startDate,
+                end_date: options?.endDate,
+                limit: options?.limit || 100,
+            },
+        });
+        return response.items;
+    }
+    async verifyAuditChain() {
+        return this.request({
+            method: 'GET',
+            path: '/v1/audit/verify',
+        });
+    }
+    async exportAudit(options) {
+        return this.request({
+            method: 'GET',
+            path: '/v1/audit',
+            query: {
+                format: options?.format || 'json',
+                start_date: options?.startDate,
+                end_date: options?.endDate,
+                limit: 10000,
+            },
+        });
+    }
+    // ============ API Keys (Independent, tenant-scoped) ============
+    async createApiKey(data) {
+        return this.request({
+            method: 'POST',
+            path: '/auth/api-keys',
+            query: data.tenantId ? { tenantId: data.tenantId } : undefined,
+            body: {
+                name: data.name,
+                description: data.description,
+                expiresInDays: data.expiresInDays,
+                permissions: data.permissions,
+                ipAllowlist: data.ipAllowlist,
+                conditions: data.conditions,
+            },
+        });
+    }
+    async listApiKeys(tenantId) {
+        return this.request({
+            method: 'GET',
+            path: '/auth/api-keys',
+            query: tenantId ? { tenantId } : undefined,
+        });
+    }
+    async getApiKey(id, tenantId) {
+        return this.request({
+            method: 'GET',
+            path: `/auth/api-keys/${id}`,
+            query: tenantId ? { tenantId } : undefined,
+        });
+    }
+    async deleteApiKey(id, tenantId) {
+        await this.request({
+            method: 'DELETE',
+            path: `/auth/api-keys/${id}`,
+            query: tenantId ? { tenantId } : undefined,
+        });
+    }
+    async rotateApiKey(id, name, tenantId) {
+        return this.request({
+            method: 'POST',
+            path: `/auth/api-keys/${id}/rotate`,
+            query: tenantId ? { tenantId } : undefined,
+            body: name ? { name } : {},
+        });
+    }
+    async updateApiKeyPermissions(id, permissions, tenantId) {
+        return this.request({
+            method: 'PATCH',
+            path: `/auth/api-keys/${id}/permissions`,
+            query: tenantId ? { tenantId } : undefined,
+            body: { permissions },
+        });
+    }
+    async updateApiKeyConditions(id, conditions, tenantId) {
+        const response = await this.request({
+            method: 'PATCH',
+            path: `/auth/api-keys/${id}/conditions`,
+            query: tenantId ? { tenantId } : undefined,
+            body: { conditions },
+        });
+        return response.apiKey;
+    }
+    async setApiKeyEnabled(id, enabled, tenantId) {
+        const response = await this.request({
+            method: 'PATCH',
+            path: `/auth/api-keys/${id}/enabled`,
+            query: tenantId ? { tenantId } : undefined,
+            body: { enabled },
+        });
+        return response.apiKey;
+    }
+    // =========================================================================
+    // Permissions API
+    // =========================================================================
+    /**
+     * Get all available permissions from the database
+     * This is the single source of truth for valid permission IDs
+     */
+    async getPermissions(category) {
+        return this.request({
+            method: 'GET',
+            path: '/v1/permissions',
+            query: category ? { category } : undefined,
+        });
+    }
+    /**
+     * Validate a list of permission IDs against the database
+     */
+    async validatePermissions(permissions) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/permissions/validate',
+            body: { permissions },
+        });
+    }
+    async getApiKeyPolicies(id, tenantId) {
+        return this.request({
+            method: 'GET',
+            path: `/auth/api-keys/${id}/policies`,
+            query: tenantId ? { tenantId } : undefined,
+        });
+    }
+    async attachApiKeyPolicy(keyId, policyId, tenantId) {
+        return this.request({
+            method: 'POST',
+            path: `/auth/api-keys/${keyId}/policies/${policyId}`,
+            query: tenantId ? { tenantId } : undefined,
+        });
+    }
+    async detachApiKeyPolicy(keyId, policyId, tenantId) {
+        return this.request({
+            method: 'DELETE',
+            path: `/auth/api-keys/${keyId}/policies/${policyId}`,
+            query: tenantId ? { tenantId } : undefined,
+        });
+    }
+    async getApiKeySelf() {
+        return this.request({
+            method: 'GET',
+            path: '/auth/api-keys/self',
+        });
+    }
+    async rotateApiKeySelf(name) {
+        return this.request({
+            method: 'POST',
+            path: '/auth/api-keys/self/rotate',
+            body: name ? { name } : {},
+        });
+    }
+    // ============ ABAC Policies ============
+    async listPolicies(options) {
+        return this.request({
+            method: 'GET',
+            path: '/v1/policies',
+            query: {
+                tenantId: options?.tenantId,
+                enabled: options?.enabled,
+                effect: options?.effect,
+                search: options?.search,
+                page: options?.page,
+                pageSize: options?.pageSize || 100,
+            },
+        });
+    }
+    async getPolicy(id) {
+        return this.request({
+            method: 'GET',
+            path: `/v1/policies/${id}`,
+        });
+    }
+    async createPolicy(data) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/policies',
+            body: data,
+        });
+    }
+    async updatePolicy(id, data) {
+        return this.request({
+            method: 'PATCH',
+            path: `/v1/policies/${id}`,
+            body: data,
+        });
+    }
+    async deletePolicy(id) {
+        await this.request({
+            method: 'DELETE',
+            path: `/v1/policies/${id}`,
+        });
+    }
+    async togglePolicy(id, enabled) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/policies/${id}/toggle`,
+            body: { enabled },
+        });
+    }
+    async validatePolicy(policy) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/policies/validate',
+            body: policy,
+        });
+    }
+    async getPolicyAttachments(policyId) {
+        return this.request({
+            method: 'GET',
+            path: `/v1/policies/${policyId}/attachments`,
+        });
+    }
+    async attachPolicyToUser(policyId, userId) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/policies/${policyId}/attach/user`,
+            body: { userId },
+        });
+    }
+    async attachPolicyToRole(policyId, roleId) {
+        return this.request({
+            method: 'POST',
+            path: `/v1/policies/${policyId}/attach/role`,
+            body: { roleId },
+        });
+    }
+    async detachPolicyFromUser(policyId, userId) {
+        return this.request({
+            method: 'DELETE',
+            path: `/v1/policies/${policyId}/attach/user/${userId}`,
+        });
+    }
+    async detachPolicyFromRole(policyId, roleId) {
+        return this.request({
+            method: 'DELETE',
+            path: `/v1/policies/${policyId}/attach/role/${roleId}`,
+        });
+    }
+    async getUserPolicies(userId) {
+        const response = await this.request({
+            method: 'GET',
+            path: `/v1/users/${userId}/policies`,
+        });
+        return response.policies;
+    }
+    async getRolePolicies(roleId) {
+        const response = await this.request({
+            method: 'GET',
+            path: `/v1/roles/${roleId}/policies`,
+        });
+        return response.policies;
+    }
+    async testPolicy(request) {
+        return this.request({
+            method: 'POST',
+            path: '/v1/policies/test',
+            body: request,
+        });
+    }
+    // ============ Generic methods for arbitrary endpoints ============
+    /**
+     * Generic GET request
+     */
+    async get(path) {
+        return this.request({ method: 'GET', path });
+    }
+    /**
+     * Generic POST request
+     */
+    async post(path, body) {
+        return this.request({ method: 'POST', path, body });
+    }
+    /**
+     * Generic DELETE request
+     */
+    async delete(path) {
+        return this.request({ method: 'DELETE', path });
+    }
+    /**
+     * Generic PATCH request
+     */
+    async patch(path, body) {
+        return this.request({ method: 'PATCH', path, body });
+    }
+    /**
+     * Get WebSocket URL for a given endpoint path
+     */
+    getWebSocketUrl(wsPath) {
+        const url = new URL(this.baseUrl);
+        url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+        url.pathname = wsPath;
+        return url.toString();
+    }
+    /**
+     * Get authentication headers for WebSocket connection
+     */
+    async getAuthHeaders() {
+        const headers = {};
+        if (hasApiKey()) {
+            headers['X-API-Key'] = getApiKey();
+        }
+        else {
+            const credentials = getCredentials();
+            if (credentials) {
+                // Check if token is expired and try to refresh
+                if (isTokenExpired() && credentials.refreshToken) {
+                    await this.refreshToken();
+                }
+                const updatedCredentials = getCredentials();
+                if (updatedCredentials) {
+                    headers['Authorization'] = `Bearer ${updatedCredentials.accessToken}`;
+                }
+            }
+            else if (hasEnvCredentials()) {
+                // Auto-login with env credentials
+                const envCreds = getEnvCredentials();
+                await this.login(envCreds.username, envCreds.password);
+                const newCredentials = getCredentials();
+                if (newCredentials) {
+                    headers['Authorization'] = `Bearer ${newCredentials.accessToken}`;
+                }
+            }
+        }
+        return headers;
+    }
+}
+// Export singleton instance
+export const client = new VaultClient();
+// Export class for testing
+export { VaultClient };
+//# sourceMappingURL=client.js.map