securenow 8.11.2 → 8.12.0

package/firewall-cloud.js

@@ -1,212 +1,212 @@
-'use strict';
-
-/**
- * Layer 4: Cloud/Edge WAF integration.
- * Pushes the blocklist to the customer's cloud WAF provider so traffic is
- * blocked at the CDN/edge before it ever reaches the origin server.
- *
- * Supported providers: cloudflare, aws, gcp
- * Cloud SDKs are optional peer dependencies — only required when enabled.
- * Cloud credentials are never logged.
- */
-
-const https = require('https');
-
-let _options = null;
-let _active = false;
-let _provider = null;
-let _lastPushTime = 0;
-
-const MIN_PUSH_INTERVAL_MS = 30000;
-
-// ────── Cloudflare ──────
-
+'use strict';
+
+/**
+ * Layer 4: Cloud/Edge WAF integration.
+ * Pushes the blocklist to the customer's cloud WAF provider so traffic is
+ * blocked at the CDN/edge before it ever reaches the origin server.
+ *
+ * Supported providers: cloudflare, aws, gcp
+ * Cloud SDKs are optional peer dependencies — only required when enabled.
+ * Cloud credentials are never logged.
+ */
+
+const https = require('https');
+
+let _options = null;
+let _active = false;
+let _provider = null;
+let _lastPushTime = 0;
+
+const MIN_PUSH_INTERVAL_MS = 30000;
+
+// ────── Cloudflare ──────
+
 async function cloudflareSync(ips) {
   const token = _options?.cloudflare?.apiToken;
   const accountId = _options?.cloudflare?.accountId;
   if (!token || !accountId) throw new Error('Missing CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID');
-
-  const listName = 'securenow-blocklist';
-
-  const lists = await cfApi('GET', `/accounts/${accountId}/rules/lists`, token);
-  let list = lists.result?.find(l => l.name === listName);
-
-  if (!list) {
-    const created = await cfApi('POST', `/accounts/${accountId}/rules/lists`, token, {
-      name: listName,
-      kind: 'ip',
-      description: 'Managed by SecureNow firewall SDK',
-    });
-    list = created.result;
-  }
-
-  const items = ips.map(ip => ({ ip: ip.includes('/') ? ip : ip + '/32' }));
-
-  await cfApi('PUT', `/accounts/${accountId}/rules/lists/${list.id}/items`, token, items);
-}
-
-function cfApi(method, path, token, body) {
-  return new Promise((resolve, reject) => {
-    const data = body ? JSON.stringify(body) : null;
-    const req = https.request({
-      hostname: 'api.cloudflare.com',
-      path: '/client/v4' + path,
-      method,
-      headers: {
-        'Authorization': `Bearer ${token}`,
-        'Content-Type': 'application/json',
-        ...(data ? { 'Content-Length': Buffer.byteLength(data) } : {}),
-      },
-      timeout: 15000,
-    }, (res) => {
-      let chunks = '';
-      res.on('data', c => chunks += c);
-      res.on('end', () => {
-        try { resolve(JSON.parse(chunks)); } catch (e) { reject(new Error(`CF parse error: ${chunks.slice(0, 200)}`)); }
-      });
-    });
-    req.on('error', reject);
-    req.on('timeout', () => { req.destroy(); reject(new Error('Cloudflare API timeout')); });
-    if (data) req.write(data);
-    req.end();
-  });
-}
-
-// ────── AWS WAF ──────
-
-async function awsSync(ips) {
-  let WAFV2;
-  try {
-    WAFV2 = require('@aws-sdk/client-wafv2');
-  } catch {
-    throw new Error('AWS WAF requires @aws-sdk/client-wafv2 — install it: npm i @aws-sdk/client-wafv2');
-  }
-
+
+  const listName = 'securenow-blocklist';
+
+  const lists = await cfApi('GET', `/accounts/${accountId}/rules/lists`, token);
+  let list = lists.result?.find(l => l.name === listName);
+
+  if (!list) {
+    const created = await cfApi('POST', `/accounts/${accountId}/rules/lists`, token, {
+      name: listName,
+      kind: 'ip',
+      description: 'Managed by SecureNow firewall SDK',
+    });
+    list = created.result;
+  }
+
+  const items = ips.map(ip => ({ ip: ip.includes('/') ? ip : ip + '/32' }));
+
+  await cfApi('PUT', `/accounts/${accountId}/rules/lists/${list.id}/items`, token, items);
+}
+
+function cfApi(method, path, token, body) {
+  return new Promise((resolve, reject) => {
+    const data = body ? JSON.stringify(body) : null;
+    const req = https.request({
+      hostname: 'api.cloudflare.com',
+      path: '/client/v4' + path,
+      method,
+      headers: {
+        'Authorization': `Bearer ${token}`,
+        'Content-Type': 'application/json',
+        ...(data ? { 'Content-Length': Buffer.byteLength(data) } : {}),
+      },
+      timeout: 15000,
+    }, (res) => {
+      let chunks = '';
+      res.on('data', c => chunks += c);
+      res.on('end', () => {
+        try { resolve(JSON.parse(chunks)); } catch (e) { reject(new Error(`CF parse error: ${chunks.slice(0, 200)}`)); }
+      });
+    });
+    req.on('error', reject);
+    req.on('timeout', () => { req.destroy(); reject(new Error('Cloudflare API timeout')); });
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+// ────── AWS WAF ──────
+
+async function awsSync(ips) {
+  let WAFV2;
+  try {
+    WAFV2 = require('@aws-sdk/client-wafv2');
+  } catch {
+    throw new Error('AWS WAF requires @aws-sdk/client-wafv2 — install it: npm i @aws-sdk/client-wafv2');
+  }
+
   const ipSetId = _options?.aws?.wafIpSetId;
   const ipSetName = _options?.aws?.wafIpSetName || 'securenow-blocklist';
   const scope = _options?.aws?.wafScope || 'REGIONAL';
-  if (!ipSetId) throw new Error('Missing AWS_WAF_IP_SET_ID');
-
-  const client = new WAFV2.WAFV2Client({});
-
-  const { IPSet, LockToken } = await client.send(new WAFV2.GetIPSetCommand({
-    Name: ipSetName,
-    Scope: scope,
-    Id: ipSetId,
-  }));
-
-  const addresses = ips.map(ip => ip.includes('/') ? ip : ip + '/32');
-
-  await client.send(new WAFV2.UpdateIPSetCommand({
-    Name: ipSetName,
-    Scope: scope,
-    Id: ipSetId,
-    Addresses: addresses,
-    LockToken,
-    Description: 'Managed by SecureNow firewall SDK',
-  }));
-}
-
-// ────── GCP Cloud Armor ──────
-
-async function gcpSync(ips) {
-  let compute;
-  try {
-    compute = require('@google-cloud/compute');
-  } catch {
-    throw new Error('GCP Cloud Armor requires @google-cloud/compute — install it: npm i @google-cloud/compute');
-  }
-
+  if (!ipSetId) throw new Error('Missing AWS_WAF_IP_SET_ID');
+
+  const client = new WAFV2.WAFV2Client({});
+
+  const { IPSet, LockToken } = await client.send(new WAFV2.GetIPSetCommand({
+    Name: ipSetName,
+    Scope: scope,
+    Id: ipSetId,
+  }));
+
+  const addresses = ips.map(ip => ip.includes('/') ? ip : ip + '/32');
+
+  await client.send(new WAFV2.UpdateIPSetCommand({
+    Name: ipSetName,
+    Scope: scope,
+    Id: ipSetId,
+    Addresses: addresses,
+    LockToken,
+    Description: 'Managed by SecureNow firewall SDK',
+  }));
+}
+
+// ────── GCP Cloud Armor ──────
+
+async function gcpSync(ips) {
+  let compute;
+  try {
+    compute = require('@google-cloud/compute');
+  } catch {
+    throw new Error('GCP Cloud Armor requires @google-cloud/compute — install it: npm i @google-cloud/compute');
+  }
+
   const project = _options?.gcp?.projectId;
   const policyName = _options?.gcp?.securityPolicy;
-  if (!project || !policyName) throw new Error('Missing GCP_PROJECT_ID or GCP_SECURITY_POLICY');
-
-  const client = new compute.SecurityPoliciesClient();
-  const rulePriority = 2000;
-
-  const srcRanges = ips.map(ip => ip.includes('/') ? ip : ip + '/32');
-
-  try {
-    await client.patchRule({
-      project,
-      securityPolicy: policyName,
-      priority: String(rulePriority),
-      securityPolicyRuleResource: {
-        priority: rulePriority,
-        action: 'deny(403)',
-        match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: srcRanges } },
-        description: 'Managed by SecureNow firewall SDK',
-      },
-    });
-  } catch (e) {
-    if (e.code === 404 || e.message?.includes('not found')) {
-      await client.addRule({
-        project,
-        securityPolicy: policyName,
-        securityPolicyRuleResource: {
-          priority: rulePriority,
-          action: 'deny(403)',
-          match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: srcRanges } },
-          description: 'Managed by SecureNow firewall SDK',
-        },
-      });
-    } else {
-      throw e;
-    }
-  }
-}
-
-// ────── Provider dispatch ──────
-
-const PROVIDERS = {
-  cloudflare: cloudflareSync,
-  aws: awsSync,
-  gcp: gcpSync,
-};
-
-// ────── Public API ──────
-
-function init(options) {
-  _options = options;
-  const provider = (options.cloud || '').toLowerCase();
-
-  if (!PROVIDERS[provider]) {
-    if (_options.log) console.warn('[securenow] Firewall cloud: unknown provider "%s", expected cloudflare|aws|gcp', provider);
-    return;
-  }
-
-  _provider = provider;
-  _active = true;
-}
-
-/**
- * Called by the firewall core after each successful blocklist sync.
- * Throttled to max 1 push per MIN_PUSH_INTERVAL_MS.
- * @param {string[]} ips - Array of IPs and CIDRs to push
- */
-async function sync(ips) {
-  if (!_active || !_provider) return;
-
-  const now = Date.now();
-  if (now - _lastPushTime < MIN_PUSH_INTERVAL_MS) return;
-  _lastPushTime = now;
-
+  if (!project || !policyName) throw new Error('Missing GCP_PROJECT_ID or GCP_SECURITY_POLICY');
+
+  const client = new compute.SecurityPoliciesClient();
+  const rulePriority = 2000;
+
+  const srcRanges = ips.map(ip => ip.includes('/') ? ip : ip + '/32');
+
+  try {
+    await client.patchRule({
+      project,
+      securityPolicy: policyName,
+      priority: String(rulePriority),
+      securityPolicyRuleResource: {
+        priority: rulePriority,
+        action: 'deny(403)',
+        match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: srcRanges } },
+        description: 'Managed by SecureNow firewall SDK',
+      },
+    });
+  } catch (e) {
+    if (e.code === 404 || e.message?.includes('not found')) {
+      await client.addRule({
+        project,
+        securityPolicy: policyName,
+        securityPolicyRuleResource: {
+          priority: rulePriority,
+          action: 'deny(403)',
+          match: { versionedExpr: 'SRC_IPS_V1', config: { srcIpRanges: srcRanges } },
+          description: 'Managed by SecureNow firewall SDK',
+        },
+      });
+    } else {
+      throw e;
+    }
+  }
+}
+
+// ────── Provider dispatch ──────
+
+const PROVIDERS = {
+  cloudflare: cloudflareSync,
+  aws: awsSync,
+  gcp: gcpSync,
+};
+
+// ────── Public API ──────
+
+function init(options) {
+  _options = options;
+  const provider = (options.cloud || '').toLowerCase();
+
+  if (!PROVIDERS[provider]) {
+    if (_options.log) console.warn('[securenow] Firewall cloud: unknown provider "%s", expected cloudflare|aws|gcp', provider);
+    return;
+  }
+
+  _provider = provider;
+  _active = true;
+}
+
+/**
+ * Called by the firewall core after each successful blocklist sync.
+ * Throttled to max 1 push per MIN_PUSH_INTERVAL_MS.
+ * @param {string[]} ips - Array of IPs and CIDRs to push
+ */
+async function sync(ips) {
+  if (!_active || !_provider) return;
+
+  const now = Date.now();
+  if (now - _lastPushTime < MIN_PUSH_INTERVAL_MS) return;
+  _lastPushTime = now;
+
   const dryRun = _options?.cloudDryRun === true;
-  if (dryRun) {
-    if (_options.log) console.log('[securenow] Firewall cloud: dry-run — would push %d IPs to %s', ips.length, _provider);
-    return;
-  }
-
-  try {
-    await PROVIDERS[_provider](ips);
-    if (_options.log) console.log('[securenow] Firewall cloud: pushed %d IPs to %s', ips.length, _provider);
-  } catch (e) {
-    if (_options.log) console.warn('[securenow] Firewall cloud: push to %s failed:', _provider, e.message);
-  }
-}
-
-function shutdown() {
-  _active = false;
-}
-
-module.exports = { init, sync, shutdown };
+  if (dryRun) {
+    if (_options.log) console.log('[securenow] Firewall cloud: dry-run — would push %d IPs to %s', ips.length, _provider);
+    return;
+  }
+
+  try {
+    await PROVIDERS[_provider](ips);
+    if (_options.log) console.log('[securenow] Firewall cloud: pushed %d IPs to %s', ips.length, _provider);
+  } catch (e) {
+    if (_options.log) console.warn('[securenow] Firewall cloud: push to %s failed:', _provider, e.message);
+  }
+}
+
+function shutdown() {
+  _active = false;
+}
+
+module.exports = { init, sync, shutdown };