portal-mojo 0.1.0

package/src/admin/monitoring/metrics-explorer-data.ts

@@ -0,0 +1,158 @@
+/** Pure identifiers and wire-independent state for the recorded-metrics explorer. */
+
+export const METRIC_ACCOUNT_MAX_LENGTH = 256;
+export const METRIC_SEARCH_MAX_LENGTH = 128;
+export const METRIC_DISCOVERY_PAGE_SIZE = 50;
+
+export type MetricAccount =
+    | { kind: 'public'; value: 'public' }
+    | { kind: 'global'; value: 'global' }
+    | { kind: 'group'; value: string; id: number }
+    | { kind: 'user'; value: string; id: number }
+    | { kind: 'custom'; value: string };
+
+export interface MetricCategory {
+    account: string;
+    name: string;
+}
+
+export interface MetricSeriesSelection {
+    account: string;
+    category: string | null;
+    slugs: string[];
+}
+
+export interface MetricPoint {
+    slug: string;
+    value: number;
+    previous: number;
+    delta: number;
+    deltaPct?: number;
+}
+
+export interface MetricGaugeValue {
+    account: string;
+    slug: string;
+    value: unknown;
+}
+
+export type MetricsDiscoveryResource = 'accounts' | 'categories' | 'slugs';
+
+export interface MetricsDiscoveryFilters {
+    account?: string;
+    category?: string | null;
+    search: string;
+}
+
+export interface MetricsDiscoveryRequest {
+    resource: MetricsDiscoveryResource;
+    account?: string;
+    category?: string;
+    search?: string;
+    start?: number;
+    size?: number;
+}
+
+export interface MetricsDiscoveryPage {
+    resource: MetricsDiscoveryResource;
+    filters: MetricsDiscoveryFilters;
+    data: string[];
+    start: number;
+    size: number;
+    count: number;
+    pageCount: number;
+    nextStart: number | null;
+}
+
+export interface MetricsFanoutSelection {
+    mode: 'off' | 'sum' | 'breakdown';
+    childKind: string;
+}
+
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+
+/**
+ * Parse the public account grammar. Reserved prefixes fail closed instead of
+ * becoming custom account names when their positive integer suffix is bad.
+ */
+export function parseMetricAccount(input: string): MetricAccount {
+    const value = input.trim();
+    if (!value) throw new Error('Metric account is required.');
+    if (value.length > METRIC_ACCOUNT_MAX_LENGTH) {
+        throw new Error(`Metric account must be ${METRIC_ACCOUNT_MAX_LENGTH} characters or fewer.`);
+    }
+    if (CONTROL_CHARS.test(value)) throw new Error('Metric account cannot contain control characters.');
+    if (value === 'public') return { kind: 'public', value };
+    if (value === 'global') return { kind: 'global', value };
+    for (const kind of ['group', 'user'] as const) {
+        const prefix = `${kind}-`;
+        if (!value.startsWith(prefix)) continue;
+        const suffix = value.slice(prefix.length);
+        if (!/^[1-9]\d*$/.test(suffix) || !Number.isSafeInteger(Number(suffix))) {
+            throw new Error(`${kind === 'group' ? 'Group' : 'User'} metric accounts require a positive integer id.`);
+        }
+        return { kind, value, id: Number(suffix) };
+    }
+    return { kind: 'custom', value };
+}
+
+/** Preserve first occurrence and exact spelling; empty selections are ignored. */
+export function dedupeMetricSlugs(slugs: readonly string[]): string[] {
+    const seen = new Set<string>();
+    const result: string[] = [];
+    for (const raw of slugs) {
+        const slug = raw;
+        if (!slug || seen.has(slug)) continue;
+        assertAddressableMetricSlug(slug);
+        seen.add(slug);
+        result.push(slug);
+    }
+    return result;
+}
+
+export function assertAddressableMetricSlug(slug: string): void {
+    if (slug.includes(',')) {
+        throw new Error(`Metric slug "${slug}" cannot be fetched because the backend uses comma-delimited slug lists.`);
+    }
+    if (CONTROL_CHARS.test(slug)) throw new Error('Metric slugs cannot contain control characters.');
+}
+
+export function metricSlugTail(slug: string): string {
+    const tail = slug.split(':').at(-1) ?? '';
+    if (!tail) throw new Error(`Metric slug "${slug}" has an empty final segment.`);
+    return tail;
+}
+
+/**
+ * The live history response loses everything before the last colon. Batch
+ * only globally unique tails and isolate each member of a colliding group.
+ */
+export function planMetricHistoryRequests(slugs: readonly string[]): string[][] {
+    const ordered = dedupeMetricSlugs(slugs);
+    const counts = new Map<string, number>();
+    for (const slug of ordered) {
+        const tail = metricSlugTail(slug);
+        counts.set(tail, (counts.get(tail) ?? 0) + 1);
+    }
+    const unique = ordered.filter((slug) => counts.get(metricSlugTail(slug)) === 1);
+    return [
+        ...(unique.length ? [unique] : []),
+        ...ordered.filter((slug) => counts.get(metricSlugTail(slug))! > 1).map((slug) => [slug]),
+    ];
+}
+
+export function metricsDiscoveryKey(callerId: number | string, request: MetricsDiscoveryRequest) {
+    return [
+        'metrics-discover', callerId, request.resource,
+        request.account ?? null, request.category ?? null, request.search ?? '',
+        request.start ?? 0, request.size ?? METRIC_DISCOVERY_PAGE_SIZE,
+    ] as const;
+}
+
+/** Repeated URL parameters keep full slug boundaries; commas are never flattened. */
+export function replaceMetricSlugParams(params: URLSearchParams, slugs: readonly string[]): URLSearchParams {
+    const next = new URLSearchParams(params);
+    next.delete('slug');
+    for (const slug of dedupeMetricSlugs(slugs)) next.append('slug', slug);
+    return next;
+}

package/src/admin/monitoring/models.ts

@@ -0,0 +1,155 @@
+import { defineModel, mojoCall, mojoList, type Envelope } from '../../client';
+
+/** Exact system-pinned gates from logit.Log.RestMeta.VIEW_PERMS. */
+export const LOGS_ADMIN_PERMISSIONS = [
+    'sys.manage_logs',
+    'sys.view_logs',
+    'sys.security',
+];
+
+/** Exact system-pinned gate on /api/metrics/permissions. */
+export const METRICS_PERMISSIONS_ADMIN_PERMISSIONS = [
+    'sys.manage_incidents',
+    'sys.metrics',
+    'sys.manage_metrics',
+];
+
+/** Exact global read clause used by metrics account discovery/history. */
+export const METRICS_EXPLORER_PERMISSIONS = [
+    'sys.view_metrics',
+    'sys.metrics',
+];
+
+/** /api/logs default graph. Stored request, response, and message rows share it. */
+export interface LogRow {
+    id: number;
+    created: number;
+    level: string;
+    kind: string | null;
+    method: string | null;
+    path: string | null;
+    payload: string | null;
+    ip: string | null;
+    duid: string | null;
+    uid: number;
+    gid: number;
+    username: string | null;
+    user_agent: string | null;
+    log: string | null;
+    model_name: string | null;
+    model_id: number;
+}
+
+export const LogModel = defineModel<LogRow>({
+    name: 'log',
+    endpoint: '/api/logs',
+    // This package exposes no save/delete controls. RestMeta's save gate is
+    // security|admin; the admin wildcard is handled by hasPermission.
+    permissions: {
+        view: LOGS_ADMIN_PERMISSIONS,
+    },
+});
+
+export const LOG_LEVEL_OPTIONS = [
+    { value: 'info', label: 'Info' },
+    { value: 'warning', label: 'Warning' },
+    { value: 'error', label: 'Error' },
+    { value: 'critical', label: 'Critical' },
+];
+
+export interface MetricsPermissionRow {
+    id: string;
+    account: string;
+    view_permissions: string[];
+    write_permissions: string[];
+}
+
+interface RawMetricsPermissionRow {
+    id?: unknown;
+    account?: unknown;
+    view_permissions?: unknown;
+    write_permissions?: unknown;
+}
+
+type MetricsMutationEnvelope = Envelope & RawMetricsPermissionRow & {
+    action?: unknown;
+};
+
+export const METRICS_PERMISSIONS_ENDPOINT = '/api/metrics/permissions';
+export const metricsPermissionKeys = {
+    all: [METRICS_PERMISSIONS_ENDPOINT] as const,
+};
+
+/** Redis returns a string for one slug, a list for many, and null for none. */
+export function normalizeMetricPermissions(value: unknown): string[] {
+    const raw = Array.isArray(value)
+        ? value
+        : typeof value === 'string'
+            ? value.split(',')
+            : [];
+    return [...new Set(raw.map((entry) => String(entry).trim()).filter(Boolean))];
+}
+
+export function normalizeMetricsPermissionRow(raw: RawMetricsPermissionRow): MetricsPermissionRow {
+    const account = typeof raw.account === 'string'
+        ? raw.account
+        : typeof raw.id === 'string'
+            ? raw.id
+            : '';
+    return {
+        id: account,
+        account,
+        view_permissions: normalizeMetricPermissions(raw.view_permissions),
+        write_permissions: normalizeMetricPermissions(raw.write_permissions),
+    };
+}
+
+/**
+ * The list endpoint is a normal `{data, count}` envelope, but Redis account
+ * order is undefined. This page deliberately client-sorts the complete list;
+ * the endpoint has no real paging/search contract.
+ */
+export async function listMetricsPermissions(): Promise<MetricsPermissionRow[]> {
+    const result = await mojoList<RawMetricsPermissionRow>(METRICS_PERMISSIONS_ENDPOINT);
+    return result.rows
+        .map(normalizeMetricsPermissionRow)
+        .filter((row) => row.account !== '')
+        .sort((a, b) => a.account.localeCompare(b.account));
+}
+
+export interface SaveMetricsPermissions {
+    account: string;
+    view_permissions: string[];
+    write_permissions: string[];
+}
+
+/**
+ * Mutations are intentionally read from TOP-LEVEL response fields. Unlike the
+ * list route, django-mojo does not put this result under `data`.
+ */
+export async function saveMetricsPermissions(input: SaveMetricsPermissions): Promise<MetricsPermissionRow> {
+    const response = await mojoCall(
+        `${METRICS_PERMISSIONS_ENDPOINT}/${encodeURIComponent(input.account)}`,
+        {
+            method: 'POST',
+            body: {
+                view_permissions: normalizeMetricPermissions(input.view_permissions).join(','),
+                write_permissions: normalizeMetricPermissions(input.write_permissions).join(','),
+            },
+        },
+    ) as MetricsMutationEnvelope;
+    return normalizeMetricsPermissionRow({
+        id: response.id ?? input.account,
+        account: response.account ?? input.account,
+        view_permissions: response.view_permissions,
+        write_permissions: response.write_permissions,
+    });
+}
+
+/** DELETE clears both Redis permission keys but deliberately retains account. */
+export async function clearMetricsPermissions(account: string): Promise<MetricsPermissionRow> {
+    await mojoCall(`${METRICS_PERMISSIONS_ENDPOINT}/${encodeURIComponent(account)}`, {
+        method: 'DELETE',
+    });
+    return { id: account, account, view_permissions: [], write_permissions: [] };
+}

package/src/admin/network/BlockedIPsPage.tsx

@@ -0,0 +1,194 @@
+// Blocked IPs — the `is_blocked=true` projection over the SHIPPED
+// `GeoLocatedIPModel` (#1291 owns `/api/system/geoip`; this page defines no
+// model of its own). Port of web-mojo `admin/security/BlockedIPsTablePage.js`.
+//
+// Corrections carried over the source, each verified against
+// `mojo/apps/account/models/geolocated_ip.py`:
+//   · the threat-level filter offered a literal `none` value that matched no
+//     row on any deployment (the column is NULL, not 'none'). It is now a
+//     multiselect over the four real values plus an explicit isnull filter.
+//   · the search placeholder promised "IP, country, or rule". The model's real
+//     SEARCH_FIELDS are ip_address, city, country_name, asn_org, isp — there
+//     is no rule text on this model at all.
+//   · `blocked_until = null` means PERMANENT. The source rendered it through a
+//     datetime formatter, i.e. blank, which reads as "unknown".
+//   · Enforcement is COMPUTED (`block_active` / `whitelist_active` are
+//     properties serialized only on the `basic` graph): a whitelist beats a
+//     block and an expired block stops enforcing, while `is_blocked` stays set.
+import {
+    Badge, ModelTable, fmt, formModal,
+    type BatchAction, type Column, type FilterDef, type Tone,
+} from '../../ui';
+import { useCan } from '../../client';
+import { COUNTRY_OPTIONS } from '../../charts/worldmap/countryCentroids';
+import {
+    GEOIP_MANAGE_PERMS, GEOIP_UNBLOCK_FIELDS, GeoLocatedIPModel, blockActive, blockExpired,
+    countryFlag, geoIpSafeExporter, threatTone, whitelistActive, whitelistExpired,
+    type GeoLocatedIPRow,
+} from '../security/geoip';
+import { NETWORK_WHITELIST_FIELDS, showBlockedIpDetail } from './BlockedIpDetail';
+
+/** THREAT_LEVEL_ORDER minus the null slot — the four values the column holds. */
+const REAL_THREAT_LEVELS = [
+    { value: 'low', label: 'Low' },
+    { value: 'medium', label: 'Medium' },
+    { value: 'high', label: 'High' },
+    { value: 'critical', label: 'Critical' },
+];
+
+const COLUMNS: Column<GeoLocatedIPRow>[] = [
+    {
+        key: 'ip_address', label: 'IP address', sortable: true, hideable: false,
+        render: (row) => <code>{row.ip_address}</code>,
+    },
+    {
+        // The honest state, not the raw flag.
+        key: 'is_blocked', label: 'State', sortable: true,
+        render: (row) => {
+            if (blockActive(row)) return <Badge tone="danger"><i className="bi bi-slash-circle" /> Blocked</Badge>;
+            if (whitelistActive(row)) return <Badge tone="info"><i className="bi bi-shield-check" /> Whitelisted</Badge>;
+            if (blockExpired(row)) return <Badge tone="warning">Block expired</Badge>;
+            if (whitelistExpired(row)) return <Badge tone="warning">Whitelist expired</Badge>;
+            return <span className="dim">—</span>;
+        },
+    },
+    {
+        key: 'threat_level', label: 'Threat', sortable: true,
+        render: (row) => <Badge tone={threatTone(row.threat_level) as Tone}>{row.threat_level || 'none'}</Badge>,
+    },
+    {
+        key: 'country_code', label: 'Country', sortable: true,
+        render: (row) => {
+            if (!row.country_code) return <span className="dim">—</span>;
+            const flag = countryFlag(row.country_code);
+            return <>{flag && <span className="geoip-flag">{flag}</span>}{row.country_code}</>;
+        },
+    },
+    { key: 'city', label: 'City', sortable: true, render: (row) => row.city || <span className="dim">—</span> },
+    {
+        key: 'blocked_reason', label: 'Reason',
+        render: (row) => row.blocked_reason
+            ? <span title={row.blocked_reason}>{fmt.truncate(row.blocked_reason, 44)}</span>
+            : <span className="dim">—</span>,
+    },
+    {
+        key: 'blocked_at', label: 'Blocked at', sortable: true,
+        render: (row) => row.blocked_at == null
+            ? <span className="dim">—</span>
+            : <span title={fmt.datetime(row.blocked_at)}>{fmt.relative(row.blocked_at)}</span>,
+    },
+    {
+        // null = permanent. Rendering it as "" (a datetime formatter over
+        // null) was the source's most misleading cell.
+        key: 'blocked_until', label: 'Expires', sortable: true,
+        render: (row) => row.blocked_until == null
+            ? <b>Never</b>
+            : <span title={fmt.datetime(row.blocked_until)}>{fmt.relative(row.blocked_until)}</span>,
+    },
+    { key: 'block_count', label: 'Blocks', sortable: true, align: 'end', render: (row) => row.block_count },
+    {
+        key: 'is_whitelisted', label: 'Whitelisted', align: 'center',
+        render: (row) => <Badge tone={whitelistActive(row) ? 'info' : 'muted'}>{whitelistActive(row) ? 'Yes' : row.is_whitelisted ? 'Expired' : 'No'}</Badge>,
+    },
+];
+
+const FILTERS: FilterDef[] = [
+    { key: 'threat_level', label: 'Threat level', type: 'multiselect', options: REAL_THREAT_LEVELS },
+    { key: 'threat_level__isnull', label: 'Threat level unset', type: 'boolean', trueLabel: 'No threat level', falseLabel: 'Has a threat level' },
+    { key: 'country_code', label: 'Country', type: 'select', options: [...COUNTRY_OPTIONS] },
+    { key: 'city', label: 'City contains', type: 'text' },
+    { key: 'asn_org', label: 'ASN org contains', type: 'text' },
+    { key: 'isp', label: 'ISP contains', type: 'text' },
+    { key: 'is_whitelisted', label: 'Whitelisted', type: 'boolean' },
+    { key: 'blocked_until__isnull', label: 'Permanent', type: 'boolean', trueLabel: 'Never expires', falseLabel: 'Has an expiry' },
+    { key: 'blocked_at', label: 'Blocked at', type: 'daterange' },
+    { key: 'blocked_until', label: 'Expires', type: 'daterange' },
+];
+
+export function BlockedIPsPage() {
+    const canManage = useCan(GEOIP_MANAGE_PERMS).can;
+    const unblock = GeoLocatedIPModel.useAction('unblock');
+    const whitelist = GeoLocatedIPModel.useAction('whitelist');
+
+    /**
+     * Both batch actions are RELAXING. `prepare` collects the reason ONCE per
+     * batch so the audit trail carries a real sentence rather than a
+     * hard-coded "Bulk … from admin" on every row (the source's behaviour).
+     */
+    const batchActions: BatchAction<GeoLocatedIPRow>[] = [
+        {
+            key: 'unblock',
+            label: 'Unblock',
+            icon: 'bi-unlock',
+            eligible: (row) => row.is_blocked,
+            confirm: 'Unblock the selected addresses? Traffic from them is allowed fleet-wide again.',
+            prepare: async (rows) => {
+                const data = await formModal({
+                    title: `Unblock ${rows.length} address${rows.length === 1 ? '' : 'es'}`,
+                    fields: GEOIP_UNBLOCK_FIELDS,
+                    submitText: 'Unblock',
+                    initial: { reason: 'Bulk unblock from admin' },
+                });
+                return data ? String(data.reason) : null;
+            },
+            // `on_action_unblock` takes a STRING reason (a non-string falls
+            // back to "manual unblock: by <user>").
+            run: (row, prepared) => unblock.mutateAsync({ id: row.id, payload: String(prepared) }),
+        },
+        {
+            key: 'whitelist',
+            label: 'Whitelist',
+            icon: 'bi-shield-check',
+            // A whitelist clears an active block, so an already-whitelisted
+            // row has nothing to gain and would only reset its expiry.
+            eligible: (row) => !whitelistActive(row),
+            confirm: 'Whitelist the selected addresses? They will pass every rule, including the VPN and Tor checks.',
+            prepare: async (rows) => {
+                const data = await formModal({
+                    title: `Whitelist ${rows.length} address${rows.length === 1 ? '' : 'es'}`,
+                    fields: NETWORK_WHITELIST_FIELDS,
+                    submitText: 'Whitelist',
+                    intro: 'One reason and expiry are recorded against every selected address.',
+                });
+                if (!data) return null;
+                const until = typeof data.until === 'string' && data.until ? data.until : null;
+                // The DICT form — the source sent a bare string, so the audit
+                // trail got a reason but `whitelisted_until` was never set.
+                return until ? { reason: String(data.reason), until } : { reason: String(data.reason) };
+            },
+            run: (row, prepared) => whitelist.mutateAsync({ id: row.id, payload: prepared }),
+        },
+    ];
+
+    return (
+        <ModelTable<GeoLocatedIPRow>
+            model={GeoLocatedIPModel}
+            eyebrow="Security · Network"
+            title="Blocked IPs"
+            searchPlaceholder="Search IP, city, country, ASN org, or ISP"
+            columns={COLUMNS}
+            filters={FILTERS}
+            presets={[
+                { key: 'all', label: 'All blocks', params: {} },
+                { key: 'permanent', label: 'Permanent', params: { blocked_until__isnull: 'true' } },
+                { key: 'whitelisted', label: 'Whitelisted', params: { is_whitelisted: 'true' } },
+            ]}
+            // `is_blocked` is the projection; `dr_field` names the column a
+            // daterange lands on so a picked window filters the BLOCK, not
+            // last_seen. No window is preset: a Blocked IPs page whose default
+            // view hides every permanent block older than a week answers the
+            // wrong question (the source defaulted to 7d).
+            defaultParams={{ is_blocked: 'true', dr_field: 'blocked_at' }}
+            defaultSort="-modified"
+            selectable={canManage}
+            batchActions={canManage ? batchActions : []}
+            columnChooser
+            persistState
+            persistKey="admin:network:blocked-ips"
+            exporter={geoIpSafeExporter}
+            exportFormats={['csv', 'json']}
+            rowTone={(row) => blockActive(row) ? 'danger' : blockExpired(row) ? 'warning' : null}
+            onRowClick={(row) => showBlockedIpDetail(row.id)}
+        />
+    );
+}