pal-explorer-cli 0.4.12 → 0.4.13

package/lib/commands/audit.js

@@ -1,235 +1,235 @@
-import chalk from 'chalk';
-import { createHash } from 'crypto';
-import path from 'path';
-import os from 'os';
-
-function isPrivateIP(hostname) {
-  if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1') return true;
-  const parts = hostname.split('.').map(Number);
-  if (parts.length === 4) {
-    if (parts[0] === 10) return true;
-    if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) return true;
-    if (parts[0] === 192 && parts[1] === 168) return true;
-    if (parts[0] === 169 && parts[1] === 254) return true;
-    if (parts[0] === 0) return true;
-  }
-  return false;
-}
-
-function validateWebhookUrl(url) {
-  let parsed;
-  try { parsed = new URL(url); } catch { throw new Error('Invalid URL'); }
-  if (parsed.protocol !== 'https:') throw new Error('Webhook URL must use HTTPS');
-  if (isPrivateIP(parsed.hostname)) throw new Error('Webhook URL must not point to private/internal addresses');
-  return url;
-}
-
-function validateOutputPath(filePath) {
-  const resolved = path.resolve(filePath);
-  const home = os.homedir();
-  const cwd = process.cwd();
-  if (!resolved.startsWith(home) && !resolved.startsWith(cwd)) {
-    throw new Error('Output path must be within home directory or current working directory');
-  }
-  if (resolved.includes('..')) {
-    throw new Error('Path traversal not allowed');
-  }
-  return resolved;
-}
-
-export default function auditCommand(program) {
-  const cmd = program
-    .command('audit')
-    .description('tamper-proof audit logging (Enterprise)')
-    .addHelpText('after', `
-Examples:
-  $ pe audit export --format json -o audit.json
-  $ pe audit export --from 2026-01-01 --to 2026-03-20 --format csv
-  $ pe audit verify                            Verify hash chain integrity
-  $ pe audit alerts --webhook https://hooks.example.com/audit
-  $ pe audit siem --endpoint https://siem.example.com/ingest
-`)
-    .action(() => { cmd.outputHelp(); });
-
-  cmd
-    .command('export')
-    .description('export audit log')
-    .option('--format <json|csv>', 'output format', 'json')
-    .option('--from <date>', 'start date (ISO format)')
-    .option('--to <date>', 'end date (ISO format)')
-    .option('-o, --output <path>', 'output file path')
-    .action(async (opts) => {
-      try {
-        const extConfig = (await import('../utils/config.js')).default;
-        const store = extConfig.get('ext_store.advanced-audit') || {};
-        let entries = store.auditLog || [];
-
-        if (opts.from) {
-          const fromDate = new Date(opts.from).getTime();
-          entries = entries.filter(e => new Date(e.timestamp).getTime() >= fromDate);
-        }
-        if (opts.to) {
-          const toDate = new Date(opts.to).getTime();
-          entries = entries.filter(e => new Date(e.timestamp).getTime() <= toDate);
-        }
-
-        if (!entries.length) {
-          console.log(chalk.gray('No audit log entries found.'));
-          return;
-        }
-
-        let output;
-        if (opts.format === 'csv') {
-          const header = 'id,timestamp,action,user,details,hash';
-          const rows = entries.map(e =>
-            `${e.id},${e.timestamp},${e.action},${e.user},"${JSON.stringify(e.details).replace(/"/g, '""')}",${e.hash}`
-          );
-          output = [header, ...rows].join('\n');
-        } else {
-          output = JSON.stringify(entries, null, 2);
-        }
-
-        if (opts.output) {
-          const validatedPath = validateOutputPath(opts.output);
-          const fs = await import('fs');
-          fs.writeFileSync(validatedPath, output, 'utf8');
-          console.log(chalk.green(`✔ Exported ${entries.length} entries to ${validatedPath}`));
-        } else {
-          console.log(output);
-        }
-      } catch (err) {
-        console.error(chalk.red(`Export failed: ${err.message}`));
-        process.exitCode = 1;
-      }
-    });
-
-  cmd
-    .command('verify')
-    .description('verify hash chain integrity of audit log')
-    .action(async () => {
-      try {
-        const extConfig = (await import('../utils/config.js')).default;
-        const store = extConfig.get('ext_store.advanced-audit') || {};
-        const entries = store.auditLog || [];
-
-        if (!entries.length) {
-          console.log(chalk.gray('No audit log entries to verify.'));
-          return;
-        }
-
-        let valid = true;
-        let checked = 0;
-
-        for (let i = 0; i < entries.length; i++) {
-          const entry = entries[i];
-          const previousHash = entry.previousHash || '';
-          const data = `${entry.timestamp}${entry.action}${entry.user}${JSON.stringify(entry.details)}${previousHash}`;
-          const expectedHash = createHash('sha256').update(data).digest('hex');
-
-          if (entry.hash !== expectedHash) {
-            console.log(chalk.red(`✘ Entry ${i} (${entry.id}) hash mismatch`));
-            console.log(chalk.red(`  Expected: ${expectedHash}`));
-            console.log(chalk.red(`  Got:      ${entry.hash}`));
-            valid = false;
-          }
-
-          if (i > 0 && entry.previousHash !== entries[i - 1].hash) {
-            console.log(chalk.red(`✘ Entry ${i} (${entry.id}) chain broken — previousHash does not match`));
-            valid = false;
-          }
-
-          checked++;
-        }
-
-        if (valid) {
-          console.log(chalk.green(`✔ Audit log integrity verified (${checked} entries)`));
-        } else {
-          console.log(chalk.red(`✘ Audit log integrity check FAILED`));
-          process.exitCode = 1;
-        }
-      } catch (err) {
-        console.error(chalk.red(`Verify failed: ${err.message}`));
-        process.exitCode = 1;
-      }
-    });
-
-  cmd
-    .command('alerts')
-    .description('configure real-time alerts')
-    .option('--webhook <url>', 'set alert webhook URL')
-    .option('--disable', 'disable alerts')
-    .action(async (opts) => {
-      try {
-        const extConfig = (await import('../utils/config.js')).default;
-        const config = extConfig.get('ext.advanced-audit') || {};
-
-        if (opts.disable) {
-          config.realTimeAlerts = false;
-          config.alertWebhook = null;
-          extConfig.set('ext.advanced-audit', config);
-          console.log(chalk.green('✔ Real-time alerts disabled'));
-          return;
-        }
-
-        if (opts.webhook) {
-          validateWebhookUrl(opts.webhook);
-          config.realTimeAlerts = true;
-          config.alertWebhook = opts.webhook;
-          extConfig.set('ext.advanced-audit', config);
-          console.log(chalk.green('✔ Real-time alerts enabled'));
-          console.log(`  Webhook: ${chalk.white(opts.webhook)}`);
-          return;
-        }
-
-        console.log('');
-        console.log(chalk.cyan.bold('Alert Configuration'));
-        console.log(chalk.gray('─'.repeat(40)));
-        console.log(`  Enabled: ${config.realTimeAlerts ? chalk.green('yes') : chalk.red('no')}`);
-        console.log(`  Webhook: ${config.alertWebhook ? chalk.white(config.alertWebhook) : chalk.gray('not set')}`);
-        console.log('');
-      } catch (err) {
-        console.error(chalk.red(`Alerts failed: ${err.message}`));
-        process.exitCode = 1;
-      }
-    });
-
-  cmd
-    .command('siem')
-    .description('configure SIEM forwarding')
-    .option('--endpoint <url>', 'set SIEM endpoint')
-    .option('--disable', 'disable SIEM forwarding')
-    .action(async (opts) => {
-      try {
-        const extConfig = (await import('../utils/config.js')).default;
-        const config = extConfig.get('ext.advanced-audit') || {};
-
-        if (opts.disable) {
-          config.siem = false;
-          config.siemEndpoint = null;
-          extConfig.set('ext.advanced-audit', config);
-          console.log(chalk.green('✔ SIEM forwarding disabled'));
-          return;
-        }
-
-        if (opts.endpoint) {
-          validateWebhookUrl(opts.endpoint);
-          config.siem = true;
-          config.siemEndpoint = opts.endpoint;
-          extConfig.set('ext.advanced-audit', config);
-          console.log(chalk.green('✔ SIEM forwarding enabled'));
-          console.log(`  Endpoint: ${chalk.white(opts.endpoint)}`);
-          return;
-        }
-
-        console.log('');
-        console.log(chalk.cyan.bold('SIEM Configuration'));
-        console.log(chalk.gray('─'.repeat(40)));
-        console.log(`  Enabled:  ${config.siem ? chalk.green('yes') : chalk.red('no')}`);
-        console.log(`  Endpoint: ${config.siemEndpoint ? chalk.white(config.siemEndpoint) : chalk.gray('not set')}`);
-        console.log('');
-      } catch (err) {
-        console.error(chalk.red(`SIEM failed: ${err.message}`));
-        process.exitCode = 1;
-      }
-    });
-}
+import chalk from 'chalk';
+import { createHash } from 'crypto';
+import path from 'path';
+import os from 'os';
+
+function isPrivateIP(hostname) {
+  if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1') return true;
+  const parts = hostname.split('.').map(Number);
+  if (parts.length === 4) {
+    if (parts[0] === 10) return true;
+    if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) return true;
+    if (parts[0] === 192 && parts[1] === 168) return true;
+    if (parts[0] === 169 && parts[1] === 254) return true;
+    if (parts[0] === 0) return true;
+  }
+  return false;
+}
+
+function validateWebhookUrl(url) {
+  let parsed;
+  try { parsed = new URL(url); } catch { throw new Error('Invalid URL'); }
+  if (parsed.protocol !== 'https:') throw new Error('Webhook URL must use HTTPS');
+  if (isPrivateIP(parsed.hostname)) throw new Error('Webhook URL must not point to private/internal addresses');
+  return url;
+}
+
+function validateOutputPath(filePath) {
+  const resolved = path.resolve(filePath);
+  const home = os.homedir();
+  const cwd = process.cwd();
+  if (!resolved.startsWith(home) && !resolved.startsWith(cwd)) {
+    throw new Error('Output path must be within home directory or current working directory');
+  }
+  if (resolved.includes('..')) {
+    throw new Error('Path traversal not allowed');
+  }
+  return resolved;
+}
+
+export default function auditCommand(program) {
+  const cmd = program
+    .command('audit')
+    .description('tamper-proof audit logging (Enterprise)')
+    .addHelpText('after', `
+Examples:
+  $ pal audit export --format json -o audit.json
+  $ pal audit export --from 2026-01-01 --to 2026-03-20 --format csv
+  $ pal audit verify                            Verify hash chain integrity
+  $ pal audit alerts --webhook https://hooks.example.com/audit
+  $ pal audit siem --endpoint https://siem.example.com/ingest
+`)
+    .action(() => { cmd.outputHelp(); });
+
+  cmd
+    .command('export')
+    .description('export audit log')
+    .option('--format <json|csv>', 'output format', 'json')
+    .option('--from <date>', 'start date (ISO format)')
+    .option('--to <date>', 'end date (ISO format)')
+    .option('-o, --output <path>', 'output file path')
+    .action(async (opts) => {
+      try {
+        const extConfig = (await import('../utils/config.js')).default;
+        const store = extConfig.get('ext_store.advanced-audit') || {};
+        let entries = store.auditLog || [];
+
+        if (opts.from) {
+          const fromDate = new Date(opts.from).getTime();
+          entries = entries.filter(e => new Date(e.timestamp).getTime() >= fromDate);
+        }
+        if (opts.to) {
+          const toDate = new Date(opts.to).getTime();
+          entries = entries.filter(e => new Date(e.timestamp).getTime() <= toDate);
+        }
+
+        if (!entries.length) {
+          console.log(chalk.gray('No audit log entries found.'));
+          return;
+        }
+
+        let output;
+        if (opts.format === 'csv') {
+          const header = 'id,timestamp,action,user,details,hash';
+          const rows = entries.map(e =>
+            `${e.id},${e.timestamp},${e.action},${e.user},"${JSON.stringify(e.details).replace(/"/g, '""')}",${e.hash}`
+          );
+          output = [header, ...rows].join('\n');
+        } else {
+          output = JSON.stringify(entries, null, 2);
+        }
+
+        if (opts.output) {
+          const validatedPath = validateOutputPath(opts.output);
+          const fs = await import('fs');
+          fs.writeFileSync(validatedPath, output, 'utf8');
+          console.log(chalk.green(`✔ Exported ${entries.length} entries to ${validatedPath}`));
+        } else {
+          console.log(output);
+        }
+      } catch (err) {
+        console.error(chalk.red(`Export failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+
+  cmd
+    .command('verify')
+    .description('verify hash chain integrity of audit log')
+    .action(async () => {
+      try {
+        const extConfig = (await import('../utils/config.js')).default;
+        const store = extConfig.get('ext_store.advanced-audit') || {};
+        const entries = store.auditLog || [];
+
+        if (!entries.length) {
+          console.log(chalk.gray('No audit log entries to verify.'));
+          return;
+        }
+
+        let valid = true;
+        let checked = 0;
+
+        for (let i = 0; i < entries.length; i++) {
+          const entry = entries[i];
+          const previousHash = entry.previousHash || '';
+          const data = `${entry.timestamp}${entry.action}${entry.user}${JSON.stringify(entry.details)}${previousHash}`;
+          const expectedHash = createHash('sha256').update(data).digest('hex');
+
+          if (entry.hash !== expectedHash) {
+            console.log(chalk.red(`✘ Entry ${i} (${entry.id}) hash mismatch`));
+            console.log(chalk.red(`  Expected: ${expectedHash}`));
+            console.log(chalk.red(`  Got:      ${entry.hash}`));
+            valid = false;
+          }
+
+          if (i > 0 && entry.previousHash !== entries[i - 1].hash) {
+            console.log(chalk.red(`✘ Entry ${i} (${entry.id}) chain broken — previousHash does not match`));
+            valid = false;
+          }
+
+          checked++;
+        }
+
+        if (valid) {
+          console.log(chalk.green(`✔ Audit log integrity verified (${checked} entries)`));
+        } else {
+          console.log(chalk.red(`✘ Audit log integrity check FAILED`));
+          process.exitCode = 1;
+        }
+      } catch (err) {
+        console.error(chalk.red(`Verify failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+
+  cmd
+    .command('alerts')
+    .description('configure real-time alerts')
+    .option('--webhook <url>', 'set alert webhook URL')
+    .option('--disable', 'disable alerts')
+    .action(async (opts) => {
+      try {
+        const extConfig = (await import('../utils/config.js')).default;
+        const config = extConfig.get('ext.advanced-audit') || {};
+
+        if (opts.disable) {
+          config.realTimeAlerts = false;
+          config.alertWebhook = null;
+          extConfig.set('ext.advanced-audit', config);
+          console.log(chalk.green('✔ Real-time alerts disabled'));
+          return;
+        }
+
+        if (opts.webhook) {
+          validateWebhookUrl(opts.webhook);
+          config.realTimeAlerts = true;
+          config.alertWebhook = opts.webhook;
+          extConfig.set('ext.advanced-audit', config);
+          console.log(chalk.green('✔ Real-time alerts enabled'));
+          console.log(`  Webhook: ${chalk.white(opts.webhook)}`);
+          return;
+        }
+
+        console.log('');
+        console.log(chalk.cyan.bold('Alert Configuration'));
+        console.log(chalk.gray('─'.repeat(40)));
+        console.log(`  Enabled: ${config.realTimeAlerts ? chalk.green('yes') : chalk.red('no')}`);
+        console.log(`  Webhook: ${config.alertWebhook ? chalk.white(config.alertWebhook) : chalk.gray('not set')}`);
+        console.log('');
+      } catch (err) {
+        console.error(chalk.red(`Alerts failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+
+  cmd
+    .command('siem')
+    .description('configure SIEM forwarding')
+    .option('--endpoint <url>', 'set SIEM endpoint')
+    .option('--disable', 'disable SIEM forwarding')
+    .action(async (opts) => {
+      try {
+        const extConfig = (await import('../utils/config.js')).default;
+        const config = extConfig.get('ext.advanced-audit') || {};
+
+        if (opts.disable) {
+          config.siem = false;
+          config.siemEndpoint = null;
+          extConfig.set('ext.advanced-audit', config);
+          console.log(chalk.green('✔ SIEM forwarding disabled'));
+          return;
+        }
+
+        if (opts.endpoint) {
+          validateWebhookUrl(opts.endpoint);
+          config.siem = true;
+          config.siemEndpoint = opts.endpoint;
+          extConfig.set('ext.advanced-audit', config);
+          console.log(chalk.green('✔ SIEM forwarding enabled'));
+          console.log(`  Endpoint: ${chalk.white(opts.endpoint)}`);
+          return;
+        }
+
+        console.log('');
+        console.log(chalk.cyan.bold('SIEM Configuration'));
+        console.log(chalk.gray('─'.repeat(40)));
+        console.log(`  Enabled:  ${config.siem ? chalk.green('yes') : chalk.red('no')}`);
+        console.log(`  Endpoint: ${config.siemEndpoint ? chalk.white(config.siemEndpoint) : chalk.gray('not set')}`);
+        console.log('');
+      } catch (err) {
+        console.error(chalk.red(`SIEM failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+}