securenow 8.11.1 → 8.11.3

package/cli/firewall.js

@@ -1,12 +1,12 @@
-'use strict';
-
+'use strict';
+
 const { api, requireAuth } = require('./client');
 const ui = require('./ui');
 
 function resolveEnvironment(flags) {
   return flags.env || flags.environment || 'production';
 }
-
+
 async function status(args, flags) {
   requireAuth();
   const s = ui.spinner('Checking firewall status');
@@ -17,64 +17,64 @@ async function status(args, flags) {
     const query = { environment };
     if (appKey) query.appKey = appKey;
     const data = await api.get('/firewall/status', { query });
-
-    s.stop('Firewall status retrieved');
-
-    if (flags.json) {
-      ui.json(data);
-      return;
-    }
-
-    console.log('');
+
+    s.stop('Firewall status retrieved');
+
+    if (flags.json) {
+      ui.json(data);
+      return;
+    }
+
+    console.log('');
     const enabledLabel = data.firewallEnabled === false
       ? ui.c.bold(ui.c.yellow('Firewall: DISABLED FOR APP/ENV'))
       : ui.c.bold(ui.c.green('Firewall: ENABLED'));
     console.log(`  ${enabledLabel}`);
-    console.log('');
-    ui.keyValue([
+    console.log('');
+    ui.keyValue([
       ['Blocked IPs', `${data.totalIps} total`],
       ['Global blocked IPs', `${data.globalBlockIps ?? data.totalIps} total (${data.exactCount} exact + ${data.cidrCount} CIDR ranges)`],
       ['Scoped block rules', String(data.scopedBlockRuleCount ?? 0)],
       ['App scope', appKey || 'all apps'],
       ['Environment', data.environment || environment],
-      ['Last updated', data.updatedAt || 'unknown'],
+      ['Last updated', data.updatedAt || 'unknown'],
       ['Allowed IPs', data.allowlistCount != null ? `${data.allowlistCount} total (${data.allowlistExactCount} exact + ${data.allowlistCidrCount} CIDR ranges)` : '0'],
       ['Allowlist updated', data.allowlistUpdatedAt || 'never'],
       ['Rate limit rules', String(data.rateLimitCount ?? 0)],
       ['Sync TTL', `${data.ttl || 60}s`],
     ]);
-    if (data.allowlistCount > 0) {
-      console.log('');
-      console.log(`  ${ui.c.yellow('!')} Allowlist is active — only ${data.allowlistCount} IP(s) can reach your app`);
-    }
-    console.log('');
-    console.log(`  ${ui.c.dim('Manage your blocklist:')} securenow blocklist`);
-    console.log(`  ${ui.c.dim('Manage your allowlist:')} securenow allowlist`);
-    console.log(`  ${ui.c.dim('Test an IP:')} securenow firewall test-ip <ip>`);
-    console.log('');
-  } catch (err) {
-    if (err.statusCode === 401 || err.status === 401) {
-      s.fail('Authentication failed');
-      ui.error('API key is invalid or missing the firewall:read scope.');
-      ui.info('Create an API key with firewall:read scope in the dashboard.');
-    } else {
-      s.fail('Failed to check firewall status');
-      throw err;
-    }
-  }
-}
-
-async function testIp(args, flags) {
-  requireAuth();
-  const ip = args[0];
-  if (!ip) {
-    ui.error('Usage: securenow firewall test-ip <ip-address>');
-    process.exit(1);
-  }
-
-  const s = ui.spinner(`Testing IP ${ip}`);
-
-  try {
+    if (data.allowlistCount > 0) {
+      console.log('');
+      console.log(`  ${ui.c.yellow('!')} Allowlist is active — only ${data.allowlistCount} IP(s) can reach your app`);
+    }
+    console.log('');
+    console.log(`  ${ui.c.dim('Manage your blocklist:')} securenow blocklist`);
+    console.log(`  ${ui.c.dim('Manage your allowlist:')} securenow allowlist`);
+    console.log(`  ${ui.c.dim('Test an IP:')} securenow firewall test-ip <ip>`);
+    console.log('');
+  } catch (err) {
+    if (err.statusCode === 401 || err.status === 401) {
+      s.fail('Authentication failed');
+      ui.error('API key is invalid or missing the firewall:read scope.');
+      ui.info('Create an API key with firewall:read scope in the dashboard.');
+    } else {
+      s.fail('Failed to check firewall status');
+      throw err;
+    }
+  }
+}
+
+async function testIp(args, flags) {
+  requireAuth();
+  const ip = args[0];
+  if (!ip) {
+    ui.error('Usage: securenow firewall test-ip <ip-address>');
+    process.exit(1);
+  }
+
+  const s = ui.spinner(`Testing IP ${ip}`);
+
+  try {
     const environment = resolveEnvironment(flags);
     const appKey = await resolveAppKey(flags);
     const query = { environment };
@@ -82,14 +82,14 @@ async function testIp(args, flags) {
     if (flags.path || flags.route) query.path = flags.path || flags.route;
     if (flags.method) query.method = flags.method;
     const data = await api.get(`/firewall/check/${encodeURIComponent(ip)}`, { query });
-
-    s.stop(`IP ${ip} checked`);
-
-    if (flags.json) {
-      ui.json(data);
-      return;
-    }
-
+
+    s.stop(`IP ${ip} checked`);
+
+    if (flags.json) {
+      ui.json(data);
+      return;
+    }
+
     console.log('');
     if (data.firewallEnabled === false) {
       console.log(`  ${ui.c.bold(ui.c.yellow('NOT ENFORCED'))} — firewall is disabled for ${appKey || 'this app'} (${data.environment || environment})`);
@@ -98,11 +98,11 @@ async function testIp(args, flags) {
       return;
     }
     if (data.blocked) {
-      if (data.allowlistActive && !data.allowlisted) {
-        console.log(`  ${ui.c.bold(ui.c.red('BLOCKED'))} — ${ip} is not on the allowlist`);
-        console.log(`  ${ui.c.dim('Allowlist is active — only listed IPs are permitted')}`);
-      } else {
-        console.log(`  ${ui.c.bold(ui.c.red('BLOCKED'))} — ${ip} is in the blocklist`);
+      if (data.allowlistActive && !data.allowlisted) {
+        console.log(`  ${ui.c.bold(ui.c.red('BLOCKED'))} — ${ip} is not on the allowlist`);
+        console.log(`  ${ui.c.dim('Allowlist is active — only listed IPs are permitted')}`);
+      } else {
+        console.log(`  ${ui.c.bold(ui.c.red('BLOCKED'))} — ${ip} is in the blocklist`);
         if (data.matchedEntry && data.matchedEntry !== ip) {
           console.log(`  ${ui.c.dim(`Matched by: ${data.matchedEntry}`)}`);
         }
@@ -113,89 +113,89 @@ async function testIp(args, flags) {
           console.log(`  ${ui.c.dim(`Rule scope: ${scope}`)}`);
         }
       }
-    } else {
-      if (data.allowlisted) {
-        console.log(`  ${ui.c.bold(ui.c.green('ALLOWED'))} — ${ip} is on the allowlist`);
-      } else {
-        console.log(`  ${ui.c.bold(ui.c.green('ALLOWED'))} — ${ip} is not in the blocklist`);
-      }
+    } else {
+      if (data.allowlisted) {
+        console.log(`  ${ui.c.bold(ui.c.green('ALLOWED'))} — ${ip} is on the allowlist`);
+      } else {
+        console.log(`  ${ui.c.bold(ui.c.green('ALLOWED'))} — ${ip} is not in the blocklist`);
+      }
     }
     console.log(`  ${ui.c.dim(`App scope: ${appKey || 'all apps'} · Environment: ${data.environment || environment}`)}`);
     if (data.path) console.log(`  ${ui.c.dim(`Request scope: ${data.method || 'GET'} ${data.path}`)}`);
     if (data.scopedMatchRequiresPath) console.log(`  ${ui.c.dim('Scoped block rules exist; pass --path to test route-specific matches')}`);
     console.log(`  ${ui.c.dim(`Blocklist contains ${data.totalBlockedIps} entries (${data.scopedBlockRuleCount || 0} scoped)`)}`);
-    if (data.allowlistActive) {
-      console.log(`  ${ui.c.dim('Allowlist is active')}`);
-    }
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to test IP');
-    throw err;
-  }
-}
-
-async function resolveAppKey(flags) {
-  if (flags && flags.app) return String(flags.app);
-  try {
-    const { resolveAppKey: r } = require('../app-config');
-    const k = r();
-    if (k) return k;
-  } catch (_) {}
-  return null;
-}
-
-async function setEnabled(args, flags, enabled) {
-  requireAuth();
-  const appKey = await resolveAppKey(flags);
-  if (!appKey) {
+    if (data.allowlistActive) {
+      console.log(`  ${ui.c.dim('Allowlist is active')}`);
+    }
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to test IP');
+    throw err;
+  }
+}
+
+async function resolveAppKey(flags) {
+  if (flags && flags.app) return String(flags.app);
+  try {
+    const { resolveAppKey: r } = require('../app-config');
+    const k = r();
+    if (k) return k;
+  } catch (_) {}
+  return null;
+}
+
+async function setEnabled(args, flags, enabled) {
+  requireAuth();
+  const appKey = await resolveAppKey(flags);
+  if (!appKey) {
     ui.error('No app selected. Pass --app <key> or run `securenow app connect` / `securenow apps default <key>`.');
-    process.exit(1);
-  }
-
+    process.exit(1);
+  }
+
   const environment = resolveEnvironment(flags);
   const verb = enabled ? 'Enabling' : 'Disabling';
   const s = ui.spinner(`${verb} firewall for ${appKey} (${environment})`);
   try {
     const data = await api.patch(`/firewall/app/${encodeURIComponent(appKey)}`, { enabled, environment });
-    s.stop(`Firewall ${enabled ? 'enabled' : 'disabled'}`);
-
-    if (flags.json) { ui.json(data); return; }
-
-    const app = data.app || {};
-    console.log('');
-    console.log(`  ${ui.c.bold(enabled ? ui.c.green('Firewall: ENABLED') : ui.c.yellow('Firewall: DISABLED'))} — ${app.name || appKey}`);
+    s.stop(`Firewall ${enabled ? 'enabled' : 'disabled'}`);
+
+    if (flags.json) { ui.json(data); return; }
+
+    const app = data.app || {};
+    console.log('');
+    console.log(`  ${ui.c.bold(enabled ? ui.c.green('Firewall: ENABLED') : ui.c.yellow('Firewall: DISABLED'))} — ${app.name || appKey}`);
     console.log(`  ${ui.c.dim('App key:')} ${app.key || appKey}`);
     console.log(`  ${ui.c.dim('Environment:')} ${app.environment || environment}`);
-    console.log('');
-    console.log(`  ${ui.c.dim('Running SDK instances pick up the change within ~10s.')}`);
-    console.log('');
-  } catch (err) {
-    s.fail(`Failed to ${enabled ? 'enable' : 'disable'} firewall`);
-    throw err;
-  }
-}
-
-async function enable(args, flags) { return setEnabled(args, flags, true); }
-async function disable(args, flags) { return setEnabled(args, flags, false); }
-
-async function appsList(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Loading apps');
-  try {
-    const data = await api.get('/firewall/apps');
-    s.stop('Apps loaded');
-
-    if (flags.json) { ui.json(data); return; }
-
-    const apps = data.apps || [];
-    if (apps.length === 0) {
-      console.log('');
-      console.log(`  ${ui.c.dim('No apps yet. Create one with `securenow apps create <name>`.')}`);
-      console.log('');
-      return;
-    }
-
-    console.log('');
+    console.log('');
+    console.log(`  ${ui.c.dim('Running SDK instances pick up the change within ~10s.')}`);
+    console.log('');
+  } catch (err) {
+    s.fail(`Failed to ${enabled ? 'enable' : 'disable'} firewall`);
+    throw err;
+  }
+}
+
+async function enable(args, flags) { return setEnabled(args, flags, true); }
+async function disable(args, flags) { return setEnabled(args, flags, false); }
+
+async function appsList(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Loading apps');
+  try {
+    const data = await api.get('/firewall/apps');
+    s.stop('Apps loaded');
+
+    if (flags.json) { ui.json(data); return; }
+
+    const apps = data.apps || [];
+    if (apps.length === 0) {
+      console.log('');
+      console.log(`  ${ui.c.dim('No apps yet. Create one with `securenow apps create <name>`.')}`);
+      console.log('');
+      return;
+    }
+
+    console.log('');
     for (const a of apps) {
       const tag = a.firewallEnabled ? ui.c.green('ON ') : ui.c.yellow('OFF');
       console.log(`  ${tag}  ${ui.c.bold(a.name)}  ${ui.c.dim(a.key)}`);
@@ -206,14 +206,14 @@ async function appsList(args, flags) {
         if (envLine) console.log(`      ${ui.c.dim(envLine)}`);
       }
     }
-    console.log('');
-    console.log(`  ${ui.c.dim('Toggle:')} securenow firewall enable --app <key>`);
-    console.log(`  ${ui.c.dim('       :')} securenow firewall disable --app <key>`);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to list apps');
-    throw err;
-  }
-}
-
-module.exports = { status, testIp, enable, disable, appsList };
+    console.log('');
+    console.log(`  ${ui.c.dim('Toggle:')} securenow firewall enable --app <key>`);
+    console.log(`  ${ui.c.dim('       :')} securenow firewall disable --app <key>`);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to list apps');
+    throw err;
+  }
+}
+
+module.exports = { status, testIp, enable, disable, appsList };