quoxcli 0.0.0-stage → 0.2.0

package/lib/commands/security.js

@@ -0,0 +1,157 @@
+/**
+ * Security commands: org session policy, IP allowlist, org-level MFA policy
+ *
+ * quox security session-policy get|set
+ * quox security ip-allowlist list|add|remove
+ * quox security mfa get|set
+ *
+ * Backend: services/auth/routes/orgSecurity.js, mounted at plain `/api`
+ * (org-scoped IN the URL: /api/orgs/:orgId/security/...). Enterprise-tier +
+ * ORG_MANAGE_SETTINGS gated — expect 402/403 on non-enterprise orgs.
+ *
+ * `mfa` here is the ORG-WIDE policy mode (disabled|optional|required), not
+ * a specific user's MFA enrollment — see `quox mfa` (endpoints/mfa.js,
+ * lib/commands/*.js's personal-MFA equivalent) for that.
+ */
+
+import { formatOutput, formatDetail, printSuccess, printInfo } from '../core/output.js';
+import { resolveOrgId } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+export function registerSecurityCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const security = program
+    .command('security')
+    .description('Manage org security policy (enterprise — session, IP allowlist, MFA)');
+
+  // ── security session-policy ─────────────────────────────────────────────────
+
+  const sessionPolicy = security
+    .command('session-policy')
+    .description('Manage the org session timeout policy');
+
+  sessionPolicy
+    .command('get')
+    .description('Show the active session policy')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('security.session-policy.get', { orgId });
+      const data = await client.get(ep.path, { service: ep.service });
+      formatDetail(data.policy || data, { format: program.opts().output, title: 'Session Policy' });
+    });
+
+  sessionPolicy
+    .command('set')
+    .description('Update the session policy (0 = disabled for that dimension)')
+    .option('--idle-timeout-sec <n>', 'idle timeout in seconds', (v) => parseInt(v, 10))
+    .option('--max-session-sec <n>', 'max session lifetime in seconds', (v) => parseInt(v, 10))
+    .option('--remember-me <bool>', 'true|false — allow "remember me" opt-in')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+
+      const body = {};
+      if (options.idleTimeoutSec !== undefined) body.idleTimeoutSec = options.idleTimeoutSec;
+      if (options.maxSessionSec !== undefined) body.maxSessionSec = options.maxSessionSec;
+      if (options.rememberMe !== undefined) {
+        if (options.rememberMe !== 'true' && options.rememberMe !== 'false') {
+          throw new Error('--remember-me must be "true" or "false".');
+        }
+        body.rememberMeEnabled = options.rememberMe === 'true';
+      }
+      if (Object.keys(body).length === 0) {
+        throw new Error('Specify at least one of --idle-timeout-sec, --max-session-sec, --remember-me.');
+      }
+
+      const ep = resolveEndpoint('security.session-policy.set', { orgId });
+      const data = await client.put(ep.path, { service: ep.service, body });
+      printSuccess('Session policy updated.');
+      formatDetail(data.policy || data, { format: program.opts().output });
+    });
+
+  // ── security ip-allowlist ───────────────────────────────────────────────────
+
+  const ipAllowlist = security
+    .command('ip-allowlist')
+    .description('Manage the org IP allowlist (empty list = allow all)');
+
+  ipAllowlist
+    .command('list')
+    .description('List IP allowlist entries')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('security.ip-allowlist.list', { orgId });
+      const data = await client.get(ep.path, { service: ep.service });
+      const rows = data.entries || data || [];
+
+      formatOutput({
+        columns: ['id', 'cidr', 'label', 'created_at'],
+        headers: ['ID', 'CIDR', 'Label', 'Created'],
+        rows,
+      }, { format: program.opts().output, emptyMessage: 'No IP allowlist entries (all IPs allowed).' });
+    });
+
+  ipAllowlist
+    .command('add')
+    .description('Add an IP allowlist entry')
+    .argument('<cidr>', 'IPv4 CIDR (e.g. "203.0.113.0/24")')
+    .option('--label <label>', 'human-readable label')
+    .action(async (cidr, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = { cidr };
+      if (options.label) body.label = options.label;
+
+      const ep = resolveEndpoint('security.ip-allowlist.add', { orgId });
+      const data = await client.post(ep.path, { service: ep.service, body });
+      printSuccess(`IP allowlist entry "${cidr}" added.`);
+      formatDetail(data.entry || data, { format: program.opts().output });
+    });
+
+  ipAllowlist
+    .command('remove')
+    .description('Remove an IP allowlist entry')
+    .argument('<entryId>', 'entry ID')
+    .action(async (entryId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('security.ip-allowlist.remove', { orgId, entryId });
+      await client.delete(ep.path, { service: ep.service });
+      printSuccess('IP allowlist entry removed.');
+    });
+
+  // ── security mfa ────────────────────────────────────────────────────────────
+
+  const mfa = security
+    .command('mfa')
+    .description('Manage the org-wide MFA policy mode');
+
+  mfa
+    .command('get')
+    .description('Show the active org MFA policy mode')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('security.mfa.get', { orgId });
+      const data = await client.get(ep.path, { service: ep.service });
+      formatDetail(data, { format: program.opts().output, title: 'Org MFA Policy' });
+    });
+
+  mfa
+    .command('set')
+    .description('Set the org-wide MFA policy mode')
+    .argument('<mode>', 'disabled|optional|required')
+    .action(async (mode) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('security.mfa.set', { orgId });
+      const data = await client.put(ep.path, { service: ep.service, body: { mode } });
+      printSuccess(`Org MFA policy set to "${data.mode || mode}".`);
+      if (mode === 'required') {
+        printInfo('Members without MFA enrolled will be required to enroll on next login.');
+      }
+    });
+}

package/lib/commands/service.js

@@ -0,0 +1,89 @@
+/**
+ * Service health commands
+ */
+
+import chalk from 'chalk';
+import { formatOutput, printInfo } from '../core/output.js';
+import { SERVICE_PORTS } from '../core/config.js';
+
+async function runHealthCheck(name, ctx, program) {
+  const { config } = ctx;
+
+  const services = name
+    ? { [name]: SERVICE_PORTS[name] }
+    : SERVICE_PORTS;
+
+  if (name && !SERVICE_PORTS[name]) {
+    console.error(chalk.red(`Unknown service: ${name}`));
+    console.error(`Available: ${Object.keys(SERVICE_PORTS).join(', ')}`);
+    process.exit(2);
+  }
+
+  const results = [];
+
+  for (const [svc, port] of Object.entries(services)) {
+    const baseUrl = config.getServiceUrl(svc);
+    const start = Date.now();
+    let status = 'down';
+    let responseTime = '-';
+
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 5000);
+      const res = await fetch(`${baseUrl}/health`, { signal: controller.signal });
+      clearTimeout(timer);
+      const elapsed = Date.now() - start;
+      responseTime = `${elapsed}ms`;
+
+      if (res.ok) {
+        status = 'operational';
+      } else {
+        status = 'degraded';
+      }
+    } catch (err) {
+      if (err.name === 'AbortError') {
+        status = 'timeout';
+      }
+      // else stays 'down'
+    }
+
+    results.push({
+      service: svc,
+      port,
+      status,
+      response: responseTime,
+    });
+  }
+
+  formatOutput({
+    columns: ['service', 'port', 'status', 'response'],
+    headers: ['Service', 'Port', 'Status', 'Response'],
+    rows: results,
+  }, { format: program.opts().output });
+
+  const downCount = results.filter(r => r.status === 'down' || r.status === 'timeout').length;
+  if (downCount > 0) {
+    printInfo(`\n${downCount} service(s) unreachable.`);
+  }
+}
+
+export function registerServiceCommands(program, ctx) {
+  const service = program
+    .command('service')
+    .description('Check service health and status');
+
+  service
+    .command('health')
+    .description('Check health of all QuoxCORE services')
+    .argument('[name]', 'specific service to check (auth, collector, memory, files, orchestrator)')
+    .action(async (name) => runHealthCheck(name, ctx, program));
+
+  // Top-level alias — `quox health` is what deploy scripts / muscle memory
+  // reach for first; keep it a thin wrapper over `service health` so there
+  // is exactly one health-check implementation.
+  program
+    .command('health')
+    .description('Check health of all QuoxCORE services (alias for `service health`)')
+    .argument('[name]', 'specific service to check (auth, collector, memory, files, orchestrator)')
+    .action(async (name) => runHealthCheck(name, ctx, program));
+}

package/lib/commands/settings.js

@@ -0,0 +1,99 @@
+/**
+ * Org platform settings (feature flags) commands.
+ *
+ * quox settings list|get|set|history
+ *
+ * Backend: services/collector/server.js
+ *   GET   /api/v1/platform/settings/flags          effective flags for the caller's org
+ *   PATCH /api/v1/platform/settings/flags/:key     { value } (human org admin)
+ *   GET   /api/v1/platform/settings/flags/history  change audit trail (admin)
+ */
+
+import { formatOutput, formatDetail } from '../core/output.js';
+import { line as glyphLine, printEvent } from '../core/quoxglyph.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+async function fetchFlags(client) {
+  const ep = resolveEndpoint('v1.settings.list');
+  const data = await client.get(ep.path, { service: ep.service });
+  return data.flags || [];
+}
+
+export function registerSettingsCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const settings = program
+    .command('settings')
+    .description('View and change org platform settings (feature flags)');
+
+  settings
+    .command('list')
+    .description('List effective platform settings for the active org')
+    .action(async () => {
+      auth.requireAuth();
+      const flags = await fetchFlags(client);
+      formatOutput(
+        {
+          columns: ['key', 'value', 'source'],
+          headers: ['KEY', 'VALUE', 'SOURCE'],
+          rows: flags.map((f) => ({ key: f.key, value: f.value, source: f.source })),
+        },
+        { format: program.opts().output, raw: flags, emptyMessage: 'No settings.' }
+      );
+    });
+
+  settings
+    .command('get <key>')
+    .description('Show one platform setting')
+    .action(async (key) => {
+      auth.requireAuth();
+      const flags = await fetchFlags(client);
+      const flag = flags.find((f) => f.key === key);
+      if (!flag) throw new Error(`Unknown setting: ${key}. Run "quox settings list" for valid keys.`);
+      formatDetail(flag, { format: program.opts().output, title: key });
+    });
+
+  settings
+    .command('set <key> <value>')
+    .description('Change a platform setting for the active org (human org admin)')
+    .action(async (key, value) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('v1.settings.set', { key });
+      const data = await client.patch(ep.path, { service: ep.service, body: { value } });
+      if (program.opts().output === 'json') {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      printEvent(glyphLine('quox', `setting ${key}`, {
+        result: `${data.old_value ?? '(unset)'} -> ${data.new_value}`,
+        status: 'ok',
+      }));
+    });
+
+  settings
+    .command('history')
+    .description('Show the platform settings change history (admin)')
+    .option('--key <key>', 'filter to one setting')
+    .option('--limit <n>', 'max rows', '50')
+    .action(async (options) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('v1.settings.history');
+      const query = { limit: options.limit };
+      if (options.key) query.key = options.key;
+      const data = await client.get(ep.path, { service: ep.service, query });
+      const history = data.history || [];
+      formatOutput(
+        {
+          columns: ['when', 'key', 'change', 'by'],
+          headers: ['WHEN', 'KEY', 'CHANGE', 'BY'],
+          rows: history.map((h) => ({
+            when: h.created_at,
+            key: h.key,
+            change: `${h.old_value ?? '(unset)'} -> ${h.new_value}`,
+            by: h.actor_label || h.actor_id || '',
+          })),
+        },
+        { format: program.opts().output, raw: history, emptyMessage: 'No history.' }
+      );
+    });
+}