infracensus-collector 1.3.0 → 1.4.0

package/dist/index.js

@@ -15409,6 +15409,74 @@ ${tokenCss()}
     };
   };
 
+  /**
+   * PASTE A LIST OF LOGINS, GET ONE ROW EACH.
+   *
+   * Restored from the pre-migration console, where an operator kept their
+   * device logins in a password manager or a spreadsheet and pasted the lot.
+   * The row-at-a-time editor that replaced it asks for six clicks and twelve
+   * tabs to enter four credentials, which is why people stopped entering the
+   * second and third \u2014 and a sweep with one credential finds the devices that
+   * credential opens and reports the rest as unreachable.
+   *
+   * \u2500\u2500 THE FORMAT IS FORGIVING ON PURPOSE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+   *
+   * One login per line, fields in the order username, password, enable. The
+   * separator may be a comma, a colon, a tab, or runs of spaces, because that
+   * is what the places people paste FROM actually produce: a CSV export, a
+   * password manager\u2019s user:pass, a column copied out of a spreadsheet. A
+   * parser that accepted exactly one of those would be a parser that rejected
+   * most real pastes, and the operator would have no idea which one it wanted.
+   *
+   * \u2500\u2500 AND ITS ONE HONEST LIMIT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+   *
+   * The split stops after three fields, so every line is unambiguous EXCEPT
+   * one whose PASSWORD contains the separator: pasted as admin:p@ss:w0rd
+   * this reads as password p@ss and enable w0rd. Nothing in a flat line can
+   * tell those apart, so the limit is stated rather than guessed at \u2014 the
+   * hint on screen sends a password with a comma or colon in it to the rows
+   * below, which is what the rows are still there for.
+   *
+   * A line with one field is a username with no password, which is a real
+   * thing (key-based logins) and is kept rather than dropped.
+   */
+  function parsePastedLogins(text) {
+    const out = [];
+    for (const line of String(text || "").split(/\\r?\\n/)) {
+      const row = line.trim();
+      // Blank lines and comments: a pasted block often carries both.
+      if (!row || row.charAt(0) === "#") continue;
+      let parts;
+      if (row.indexOf("\\t") >= 0) parts = row.split("\\t");
+      else if (row.indexOf(",") >= 0) parts = splitLimited(row, ",", 3);
+      else if (row.indexOf(":") >= 0) parts = splitLimited(row, ":", 3);
+      else parts = row.split(/\\s+/);
+      const username = (parts[0] || "").trim();
+      if (!username) continue;
+      out.push({
+        username: username,
+        // Not trimmed per field: whitespace INSIDE a line is kept, because a
+        password: parts[1] === undefined ? "" : parts[1],
+        enable: parts[2] === undefined ? "" : parts[2],
+      });
+    }
+    return out;
+  }
+
+  /** Split on the first (max - 1) separators; the remainder is the last field. */
+  function splitLimited(text, sep, max) {
+    const out = [];
+    let rest = text;
+    while (out.length < max - 1) {
+      const at = rest.indexOf(sep);
+      if (at < 0) break;
+      out.push(rest.slice(0, at));
+      rest = rest.slice(at + sep.length);
+    }
+    out.push(rest);
+    return out;
+  }
+
   const trimmed = (v) => (typeof v === "string" ? v.trim() : v);
   const nonEmpty = (list) => list.filter((v) => v !== "" && v !== null && v !== undefined);
   const lines = (value) => nonEmpty(String(value || "").split(/\\r?\\n/).map((s) => s.trim()));
@@ -16395,6 +16463,56 @@ ${tokenCss()}
       const addSsh = el("button", { type: "button", class: "subtle", text: "Add an SSH login" });
       addSsh.addEventListener("click", () => sshRows.add());
       host.appendChild(addSsh);
+
+      // \u2500\u2500 PASTE THE LIST INSTEAD OF TYPING IT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+      //
+      // Four credentials is six clicks and twelve tabs through the rows above,
+      // which is why operators stopped entering the second and third \u2014 and a
+      // sweep carrying one credential finds the devices that credential opens
+      // and reports every other device as unreachable. The rows stay: they are
+      // how you fix one field, and how you enter a password with a comma in it.
+      const pasteWrap = el("details", { style: "margin-top:8px" });
+      const pasteSummary = el("summary", { style: "cursor:pointer",
+        text: "Paste several logins at once" });
+      pasteWrap.appendChild(pasteSummary);
+      const pasteBox = el("textarea", { id: prefix + "SshPaste", spellcheck: "false", rows: "4",
+        placeholder: "admin,P@ssw0rd,EnableSecret\\nreadonly:viewpass\\nsvc-net secret123" });
+      pasteWrap.appendChild(field("One login per line \u2014 username, password, enable secret", pasteBox,
+        "Separate the fields with a comma, a colon, a tab, or spaces. The enable secret is optional. A password that itself contains a comma or colon has to go in the rows above, because a flat line cannot say which separator was part of the password."));
+      const pasteBtn = el("button", { type: "button", class: "subtle", text: "Add these logins" });
+      const pasteNote = el("div", { class: "hint" });
+      pasteBtn.addEventListener("click", () => {
+        const parsed = parsePastedLogins(pasteBox.value);
+        if (!parsed.length) {
+          pasteNote.textContent = "Nothing to add \u2014 one login per line, username first.";
+          return;
+        }
+        // APPENDED, not replacing. Somebody who has typed two rows and then
+        // pastes six means eight, and silently discarding the two would be the
+        // kind of data loss that is only noticed when a scan comes back short.
+        //
+        // A row whose username is already listed is skipped rather than
+        // duplicated: the SSH loop tries each credential in turn against every
+        // host, so a duplicate is a second identical login attempt per device \u2014
+        // which on a locked-down estate is how an account lockout policy trips.
+        const already = sshRows.values().map((r) => trimmed(r.username)).filter(Boolean);
+        let added = 0;
+        let skipped = 0;
+        for (const cred of parsed) {
+          if (already.indexOf(cred.username) >= 0) { skipped += 1; continue; }
+          already.push(cred.username);
+          sshRows.add(cred);
+          added += 1;
+        }
+        pasteBox.value = "";
+        pasteNote.textContent =
+          "Added " + added + " login" + (added === 1 ? "" : "s")
+          + (skipped ? ", skipped " + skipped + " already listed by that username" : "")
+          + ". They are tried in the order shown, top first.";
+      });
+      pasteWrap.appendChild(pasteBtn);
+      pasteWrap.appendChild(pasteNote);
+      host.appendChild(pasteWrap);
       host.appendChild(el("h3", { text: "Windows logins (WMI enrichment)" }));
       const win = el("div", null, []); host.appendChild(win);
       const winRows = rowsEditor(win, [