securenow 8.11.2 → 8.11.3

package/TELEMETRY-SQL.md

@@ -81,10 +81,15 @@ Event properties are stored in the logs table:
 | `userId` | `attributes_string['enduser.id']` |
 | `sessionId` | `attributes_string['session.id']` |
 | `ip` | `attributes_string['http.client_ip']` |
-| `userAgent` | `attributes_string['http.user_agent']` |
+| `userAgent` | `attributes_string['user_agent.original']` (HTTP spans use `http.user_agent`) |
 | String custom attribute | `attributes_string['<key>']` |
 | Numeric custom attribute | `attributes_number['<key>']` |
 | Boolean custom attribute | `attributes_bool['<key>']` |
+| ASN of `ip` (when the instance has ASN enrichment) | `attributes_string['client.asn']`, `attributes_string['client.as_org']` |
+
+Custom attribute keys that start with a reserved prefix — `event.`, `enduser.`, `session.`, `http.`, `service.`, `securenow.`, `client.` — are stored as `attr.<key>`. Name custom attributes without those prefixes (`auth_method`, `device_hash`, …). Events carry the timestamp the sender supplied; there is no separate ingest time and no event ID.
+
+The logs `timestamp` is UInt64 nanoseconds: filter with `timestamp >= toUnixTimestamp64Nano(now64() - INTERVAL 15 MINUTE)`. `timestamp >= now() - INTERVAL …` is accepted by ClickHouse but always true on this table, so the rule would scan the whole retention period — the API rejects it on rule create/update.
 
 Never send raw passwords, tokens, OTPs, session secrets, email addresses, phone numbers, or other unnecessary personal data. Hash destinations when correlation is required.
 

package/cidr.js

@@ -1,83 +1,83 @@
-'use strict';
-
-/**
- * Bitmask-based CIDR matching. No regex on user input — prevents ReDoS.
- * All operations use unsigned 32-bit integers for IPv4 addresses.
- */
-
-function ipToInt(ip) {
-  const parts = ip.split('.');
-  if (parts.length !== 4) return null;
-  let result = 0;
-  for (let i = 0; i < 4; i++) {
-    const n = parseInt(parts[i], 10);
-    if (isNaN(n) || n < 0 || n > 255) return null;
-    result = (result << 8) + n;
-  }
-  return result >>> 0;
-}
-
-function parseCidr(cidr) {
-  const slash = cidr.indexOf('/');
-  if (slash === -1) return null;
-  const ip = cidr.slice(0, slash);
-  const bits = parseInt(cidr.slice(slash + 1), 10);
-  if (isNaN(bits) || bits < 0 || bits > 32) return null;
-  const network = ipToInt(ip);
-  if (network === null) return null;
-  const mask = bits === 0 ? 0 : (~((1 << (32 - bits)) - 1)) >>> 0;
-  return { network: (network & mask) >>> 0, mask };
-}
-
-function matchesCidr(ipInt, cidrEntry) {
-  return ((ipInt & cidrEntry.mask) >>> 0) === cidrEntry.network;
-}
-
-/**
- * Create a matcher from a list of IPs and CIDRs.
- * Returns { isBlocked(ip), stats() }.
- * Exact IPs use a Set for O(1) lookup; CIDRs use array scan (typically < 100 entries).
- */
-function createMatcher(ipList) {
-  const exactSet = new Set();
-  const cidrRanges = [];
-
-  for (const entry of ipList) {
-    const trimmed = (entry || '').trim();
-    if (!trimmed) continue;
-
-    if (trimmed.includes('/')) {
-      const parsed = parseCidr(trimmed);
-      if (parsed) cidrRanges.push(parsed);
-    } else {
-      const normalized = trimmed.replace(/^::ffff:/, '');
-      exactSet.add(normalized);
-    }
-  }
-
-  function isBlocked(ip) {
-    if (!ip) return false;
-    const normalized = ip.replace(/^::ffff:/, '');
-
-    if (exactSet.has(normalized)) return true;
-
-    if (cidrRanges.length > 0) {
-      const ipInt = ipToInt(normalized);
-      if (ipInt !== null) {
-        for (const cidr of cidrRanges) {
-          if (matchesCidr(ipInt, cidr)) return true;
-        }
-      }
-    }
-
-    return false;
-  }
-
-  function stats() {
-    return { exact: exactSet.size, cidr: cidrRanges.length, total: exactSet.size + cidrRanges.length };
-  }
-
-  return { isBlocked, stats };
-}
-
-module.exports = { ipToInt, parseCidr, matchesCidr, createMatcher };
+'use strict';
+
+/**
+ * Bitmask-based CIDR matching. No regex on user input — prevents ReDoS.
+ * All operations use unsigned 32-bit integers for IPv4 addresses.
+ */
+
+function ipToInt(ip) {
+  const parts = ip.split('.');
+  if (parts.length !== 4) return null;
+  let result = 0;
+  for (let i = 0; i < 4; i++) {
+    const n = parseInt(parts[i], 10);
+    if (isNaN(n) || n < 0 || n > 255) return null;
+    result = (result << 8) + n;
+  }
+  return result >>> 0;
+}
+
+function parseCidr(cidr) {
+  const slash = cidr.indexOf('/');
+  if (slash === -1) return null;
+  const ip = cidr.slice(0, slash);
+  const bits = parseInt(cidr.slice(slash + 1), 10);
+  if (isNaN(bits) || bits < 0 || bits > 32) return null;
+  const network = ipToInt(ip);
+  if (network === null) return null;
+  const mask = bits === 0 ? 0 : (~((1 << (32 - bits)) - 1)) >>> 0;
+  return { network: (network & mask) >>> 0, mask };
+}
+
+function matchesCidr(ipInt, cidrEntry) {
+  return ((ipInt & cidrEntry.mask) >>> 0) === cidrEntry.network;
+}
+
+/**
+ * Create a matcher from a list of IPs and CIDRs.
+ * Returns { isBlocked(ip), stats() }.
+ * Exact IPs use a Set for O(1) lookup; CIDRs use array scan (typically < 100 entries).
+ */
+function createMatcher(ipList) {
+  const exactSet = new Set();
+  const cidrRanges = [];
+
+  for (const entry of ipList) {
+    const trimmed = (entry || '').trim();
+    if (!trimmed) continue;
+
+    if (trimmed.includes('/')) {
+      const parsed = parseCidr(trimmed);
+      if (parsed) cidrRanges.push(parsed);
+    } else {
+      const normalized = trimmed.replace(/^::ffff:/, '');
+      exactSet.add(normalized);
+    }
+  }
+
+  function isBlocked(ip) {
+    if (!ip) return false;
+    const normalized = ip.replace(/^::ffff:/, '');
+
+    if (exactSet.has(normalized)) return true;
+
+    if (cidrRanges.length > 0) {
+      const ipInt = ipToInt(normalized);
+      if (ipInt !== null) {
+        for (const cidr of cidrRanges) {
+          if (matchesCidr(ipInt, cidr)) return true;
+        }
+      }
+    }
+
+    return false;
+  }
+
+  function stats() {
+    return { exact: exactSet.size, cidr: cidrRanges.length, total: exactSet.size + cidrRanges.length };
+  }
+
+  return { isBlocked, stats };
+}
+
+module.exports = { ipToInt, parseCidr, matchesCidr, createMatcher };

package/cli/client.js

@@ -1,55 +1,55 @@
-'use strict';
-
-const https = require('https');
-const http = require('http');
-const { URL } = require('url');
-const config = require('./config');
-const ui = require('./ui');
-
-function buildQueryString(params) {
-  if (!params) return '';
-  const entries = Object.entries(params).filter(([, v]) => v != null && v !== '');
-  if (!entries.length) return '';
-  return '?' + entries.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join('&');
-}
-
-function request(method, endpoint, { body, query, token, raw } = {}) {
-  const baseUrl = config.getApiUrl();
-  const qs = buildQueryString(query);
-  const urlStr = `${baseUrl}/api${endpoint}${qs}`;
-  const url = new URL(urlStr);
-  const mod = url.protocol === 'https:' ? https : http;
-
-  const authToken = token || config.getToken();
-
-  return new Promise((resolve, reject) => {
-    const options = {
-      hostname: url.hostname,
-      port: url.port || (url.protocol === 'https:' ? 443 : 80),
-      path: url.pathname + url.search,
-      method,
-      headers: { 'Content-Type': 'application/json', 'User-Agent': 'securenow-cli' },
-    };
-
-    if (authToken) {
-      options.headers['Authorization'] = `Bearer ${authToken}`;
-    }
-
-    const req = mod.request(options, (res) => {
-      let data = '';
-      res.on('data', (chunk) => (data += chunk));
-      res.on('end', () => {
-        if (raw) {
-          return resolve({ status: res.statusCode, headers: res.headers, body: data });
-        }
-
-        let parsed;
-        try {
-          parsed = JSON.parse(data);
-        } catch {
-          parsed = data;
-        }
-
+'use strict';
+
+const https = require('https');
+const http = require('http');
+const { URL } = require('url');
+const config = require('./config');
+const ui = require('./ui');
+
+function buildQueryString(params) {
+  if (!params) return '';
+  const entries = Object.entries(params).filter(([, v]) => v != null && v !== '');
+  if (!entries.length) return '';
+  return '?' + entries.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join('&');
+}
+
+function request(method, endpoint, { body, query, token, raw } = {}) {
+  const baseUrl = config.getApiUrl();
+  const qs = buildQueryString(query);
+  const urlStr = `${baseUrl}/api${endpoint}${qs}`;
+  const url = new URL(urlStr);
+  const mod = url.protocol === 'https:' ? https : http;
+
+  const authToken = token || config.getToken();
+
+  return new Promise((resolve, reject) => {
+    const options = {
+      hostname: url.hostname,
+      port: url.port || (url.protocol === 'https:' ? 443 : 80),
+      path: url.pathname + url.search,
+      method,
+      headers: { 'Content-Type': 'application/json', 'User-Agent': 'securenow-cli' },
+    };
+
+    if (authToken) {
+      options.headers['Authorization'] = `Bearer ${authToken}`;
+    }
+
+    const req = mod.request(options, (res) => {
+      let data = '';
+      res.on('data', (chunk) => (data += chunk));
+      res.on('end', () => {
+        if (raw) {
+          return resolve({ status: res.statusCode, headers: res.headers, body: data });
+        }
+
+        let parsed;
+        try {
+          parsed = JSON.parse(data);
+        } catch {
+          parsed = data;
+        }
+
         if (res.statusCode === 401) {
           reject(new CLIError('Admin auth is missing or expired. Run `securenow admin login` to re-authenticate. Runtime app credentials are unrelated.', 401));
           return;
@@ -59,58 +59,58 @@ function request(method, endpoint, { body, query, token, raw } = {}) {
           reject(new CLIError(`${msg}. Admin auth is connected, but this user/plan may lack permission for this control-plane operation. Runtime app connection is unrelated.`, 403));
           return;
         }
-        if (res.statusCode >= 400) {
-          const msg = parsed?.error || parsed?.message || `Request failed (HTTP ${res.statusCode})`;
-          const details = parsed?.details || parsed?.unauthorizedKeys;
-          const err = new CLIError(details ? `${msg} — ${details}` : msg, res.statusCode);
-          reject(err);
-          return;
-        }
-
-        resolve(parsed);
-      });
-    });
-
-    req.on('error', (err) => {
-      if (err.code === 'ECONNREFUSED') {
-        reject(new CLIError(`Cannot connect to ${baseUrl}. Is the API server running?`));
-      } else if (err.code === 'ENOTFOUND') {
-        reject(new CLIError(`Cannot resolve ${url.hostname}. Check your internet connection.`));
-      } else {
-        reject(new CLIError(`Network error: ${err.message}`));
-      }
-    });
-
-    if (body) {
-      req.write(JSON.stringify(body));
-    }
-    req.end();
-  });
-}
-
-class CLIError extends Error {
-  constructor(message, statusCode) {
-    super(message);
-    this.name = 'CLIError';
-    this.statusCode = statusCode;
-  }
-}
-
-function requireAuth() {
+        if (res.statusCode >= 400) {
+          const msg = parsed?.error || parsed?.message || `Request failed (HTTP ${res.statusCode})`;
+          const details = parsed?.details || parsed?.unauthorizedKeys;
+          const err = new CLIError(details ? `${msg} — ${details}` : msg, res.statusCode);
+          reject(err);
+          return;
+        }
+
+        resolve(parsed);
+      });
+    });
+
+    req.on('error', (err) => {
+      if (err.code === 'ECONNREFUSED') {
+        reject(new CLIError(`Cannot connect to ${baseUrl}. Is the API server running?`));
+      } else if (err.code === 'ENOTFOUND') {
+        reject(new CLIError(`Cannot resolve ${url.hostname}. Check your internet connection.`));
+      } else {
+        reject(new CLIError(`Network error: ${err.message}`));
+      }
+    });
+
+    if (body) {
+      req.write(JSON.stringify(body));
+    }
+    req.end();
+  });
+}
+
+class CLIError extends Error {
+  constructor(message, statusCode) {
+    super(message);
+    this.name = 'CLIError';
+    this.statusCode = statusCode;
+  }
+}
+
+function requireAuth() {
   const token = config.getToken();
   if (!token) {
     ui.error('Admin auth is not connected. Run `securenow admin login` first.');
     process.exit(1);
   }
-  return token;
-}
-
-const api = {
-  get: (endpoint, opts) => request('GET', endpoint, opts),
-  post: (endpoint, body, opts) => request('POST', endpoint, { body, ...opts }),
-  put: (endpoint, body, opts) => request('PUT', endpoint, { body, ...opts }),
-  patch: (endpoint, body, opts) => request('PATCH', endpoint, { body, ...opts }),
-  delete: (endpoint, opts) => request('DELETE', endpoint, opts),
-};
-
-module.exports = { api, CLIError, requireAuth, buildQueryString };
+  return token;
+}
+
+const api = {
+  get: (endpoint, opts) => request('GET', endpoint, opts),
+  post: (endpoint, body, opts) => request('POST', endpoint, { body, ...opts }),
+  put: (endpoint, body, opts) => request('PUT', endpoint, { body, ...opts }),
+  patch: (endpoint, body, opts) => request('PATCH', endpoint, { body, ...opts }),
+  delete: (endpoint, opts) => request('DELETE', endpoint, opts),
+};
+
+module.exports = { api, CLIError, requireAuth, buildQueryString };

package/cli/diagnostics.js

@@ -555,6 +555,10 @@ async function eventSend(args, flags) {
   if (Object.keys(attributes).length) ev.attributes = attributes;
 
   const headers = { 'Content-Type': 'application/json', ...cfg.headers };
+  // `--env` must win over the environment stored with the runtime credentials.
+  if ((flags.env || flags.environment) && cfg.deploymentEnvironment) {
+    headers['x-securenow-environment'] = cfg.deploymentEnvironment;
+  }
   const spin = ui.spinner(`Sending event to ${eventsEndpoint}`);
   try {
     const res = await httpRequest({ endpoint: eventsEndpoint, headers, body: JSON.stringify({ events: [ev] }) });