zeuslock-dlp-cli 0.2.0

package/src/lib/dlp-scan.js

@@ -0,0 +1,146 @@
+import { requestApiKeyFormData } from "./api-client.js";
+import { dash, formatTable } from "./table.js";
+
+export const FAIL_ON_VALUES = ["alert", "block", "never"];
+
+const DECISION_RANK = {
+  allow: 0,
+  alert: 1,
+  block: 2
+};
+
+export async function analyzeDlpBatch({
+  text = "",
+  files = [],
+  metadata = {},
+  apiKey,
+  env = process.env
+}) {
+  const form = new FormData();
+  if (text) {
+    form.append("text", text);
+  }
+  for (const file of files) {
+    const blob = new Blob([file.data], {
+      type: file.contentType || "application/octet-stream"
+    });
+    form.append("files", blob, file.filename || "file");
+  }
+
+  for (const [key, value] of Object.entries(normalizeMetadata(metadata))) {
+    form.append(key, value);
+  }
+
+  return requestApiKeyFormData("/api/v1/dlp/analyze", form, {
+    apiKey,
+    env
+  });
+}
+
+export function parseFailOn(value, optionName = "--fail-on") {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (!FAIL_ON_VALUES.includes(normalized)) {
+    throw new Error(`Invalid ${optionName}. Allowed values: ${FAIL_ON_VALUES.join(", ")}.`);
+  }
+  return normalized;
+}
+
+export function shouldFailDecision(decision, failOn) {
+  if (failOn === "never") {
+    return false;
+  }
+  const rank = DECISION_RANK[String(decision || "").toLowerCase()] ?? 0;
+  return rank >= DECISION_RANK[failOn];
+}
+
+export function sanitizeDlpResponse(response) {
+  const sanitized = deepClone(response || {});
+  delete sanitized.anonymizationMap;
+  for (const artifact of sanitized.artifacts || []) {
+    delete artifact.anonymizationMap;
+  }
+  return sanitized;
+}
+
+export function summarizeDlpResponses(responses, { failOn, includeSensitive = false } = {}) {
+  const normalized = responses.map((response) =>
+    includeSensitive ? response : sanitizeDlpResponse(response)
+  );
+  const worst = normalized.reduce((current, response) => {
+    const decision = String(response?.decision || "allow").toLowerCase();
+    return (DECISION_RANK[decision] ?? 0) > (DECISION_RANK[current] ?? 0)
+      ? decision
+      : current;
+  }, "allow");
+  const failed = normalized.some((response) => shouldFailDecision(response?.decision, failOn));
+
+  return {
+    decision: worst,
+    failed,
+    failOn,
+    totalRequests: normalized.length,
+    incidents: normalized.map((response) => response?.incident_id).filter(Boolean),
+    responses: normalized
+  };
+}
+
+export function formatDlpSummary(summary, { scannedFiles = 0, scannedText = false } = {}) {
+  const lines = [];
+  lines.push(`Scan decision: ${summary.decision}`);
+  lines.push(`Fail threshold: ${summary.failOn}`);
+  if (scannedText) {
+    lines.push("Text input: scanned");
+  }
+  lines.push(`Files scanned: ${scannedFiles}`);
+  if (summary.incidents.length) {
+    lines.push(`Incidents: ${summary.incidents.join(", ")}`);
+  }
+
+  const rows = summary.responses.map((response, index) => ({
+    request: index + 1,
+    decision: response?.decision || "-",
+    risk: response?.riskLevel || "-",
+    message: response?.message || "-",
+    incident: response?.incident_id || "-"
+  }));
+  if (rows.length) {
+    lines.push("");
+    lines.push(formatTable(rows, [
+      { header: "REQUEST", value: (row) => row.request },
+      { header: "DECISION", value: (row) => dash(row.decision) },
+      { header: "RISK", value: (row) => dash(row.risk) },
+      { header: "MESSAGE", value: (row) => dash(row.message) },
+      { header: "INCIDENT", value: (row) => dash(row.incident) }
+    ]));
+  }
+
+  return `${lines.join("\n")}\n`;
+}
+
+function normalizeMetadata(metadata) {
+  return {
+    source: stringOr(metadata.source, "cli"),
+    platform: stringOr(metadata.platform, "cli"),
+    hostname: stringOr(metadata.hostname, "unknown"),
+    path: normalizePathSuffix(metadata.path || "/cli"),
+    method: stringOr(metadata.method, "CLI"),
+    ...(metadata.userEmail ? { user_email: String(metadata.userEmail) } : {})
+  };
+}
+
+function normalizePathSuffix(value) {
+  const text = String(value || "").trim();
+  if (!text) {
+    return "/cli";
+  }
+  return text.startsWith("/") ? text : `/${text}`;
+}
+
+function stringOr(value, fallback) {
+  const text = String(value || "").trim();
+  return text || fallback;
+}
+
+function deepClone(value) {
+  return JSON.parse(JSON.stringify(value));
+}

package/src/lib/package-info.js

@@ -0,0 +1,11 @@
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const packageJson = require("../../package.json");
+
+export function getPackageInfo() {
+  return {
+    name: packageJson.name,
+    version: packageJson.version
+  };
+}

package/src/lib/prompt.js

@@ -0,0 +1,55 @@
+import { createInterface } from "node:readline";
+import { createInterface as createPromisesInterface } from "node:readline/promises";
+
+export async function promptText({
+  message,
+  stdin = process.stdin,
+  stdout = process.stdout,
+  optionName
+}) {
+  assertInteractive(stdin, stdout, optionName);
+
+  const rl = createPromisesInterface({ input: stdin, output: stdout });
+  try {
+    return (await rl.question(message)).trim();
+  } finally {
+    rl.close();
+  }
+}
+
+export async function promptPassword({
+  message = "Password: ",
+  stdin = process.stdin,
+  stdout = process.stdout,
+  optionName = "--password"
+}) {
+  assertInteractive(stdin, stdout, optionName);
+
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: stdin, output: stdout, terminal: true });
+    const originalWrite = rl._writeToOutput;
+
+    rl._writeToOutput = function writeMuted(stringToWrite) {
+      if (rl.stdoutMuted) {
+        if (stringToWrite.includes("\n") || stringToWrite.includes("\r")) {
+          rl.output.write(stringToWrite.replace(/[^\r\n]/g, ""));
+        }
+        return;
+      }
+      originalWrite.call(rl, stringToWrite);
+    };
+
+    rl.question(message, (answer) => {
+      rl.close();
+      stdout.write("\n");
+      resolve(answer);
+    });
+    rl.stdoutMuted = true;
+  });
+}
+
+function assertInteractive(stdin, stdout, optionName) {
+  if (!stdin.isTTY || !stdout.isTTY) {
+    throw new Error(`${optionName} is required when running non-interactively`);
+  }
+}

package/src/lib/siem-cursors.js

@@ -0,0 +1,64 @@
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { getConfigDir } from "./auth-store.js";
+
+const CURSOR_FILE_NAME = "siem-cursors.json";
+
+export function buildSiemCursorKey({ apiUrl, cursorName = "default", category = null, severity = null }) {
+  const raw = JSON.stringify({
+    apiUrl: String(apiUrl || "").replace(/\/+$/, ""),
+    cursorName: cursorName || "default",
+    category: category || null,
+    severity: severity || null
+  });
+  return Buffer.from(raw, "utf8").toString("base64url");
+}
+
+export async function readSiemCursor(key, env = process.env) {
+  const store = await readCursorStore(env);
+  const record = store.cursors?.[key];
+  return typeof record?.cursor === "string" && record.cursor ? record.cursor : null;
+}
+
+export async function writeSiemCursor(key, record, env = process.env) {
+  const store = await readCursorStore(env);
+  store.cursors[key] = {
+    ...record,
+    updatedAt: new Date().toISOString()
+  };
+  await writeCursorStore(store, env);
+}
+
+async function readCursorStore(env) {
+  try {
+    const raw = await readFile(getCursorFilePath(env), "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      version: 1,
+      cursors: parsed?.cursors && typeof parsed.cursors === "object" ? parsed.cursors : {}
+    };
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return { version: 1, cursors: {} };
+    }
+    throw error;
+  }
+}
+
+async function writeCursorStore(store, env) {
+  const dir = getConfigDir(env);
+  const filePath = getCursorFilePath(env);
+  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  await chmod(dir, 0o700).catch(() => {});
+  await writeFile(tempPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 0o600 });
+  await chmod(tempPath, 0o600).catch(() => {});
+  await rename(tempPath, filePath);
+  await chmod(filePath, 0o600).catch(() => {});
+}
+
+function getCursorFilePath(env) {
+  return path.join(getConfigDir(env), CURSOR_FILE_NAME);
+}

package/src/lib/table.js

@@ -0,0 +1,30 @@
+export function formatTable(rows, columns) {
+  if (!rows.length) {
+    return "";
+  }
+
+  const widths = columns.map((column) => {
+    const headerLength = column.header.length;
+    const cellLengths = rows.map((row) => String(column.value(row)).length);
+    return Math.max(headerLength, ...cellLengths);
+  });
+
+  const header = columns
+    .map((column, index) => column.header.padEnd(widths[index]))
+    .join("  ");
+  const separator = widths.map((width) => "-".repeat(width)).join("  ");
+  const body = rows.map((row) =>
+    columns
+      .map((column, index) => String(column.value(row)).padEnd(widths[index]))
+      .join("  ")
+  );
+
+  return [header, separator, ...body].join("\n");
+}
+
+export function dash(value) {
+  if (value === null || value === undefined || value === "") {
+    return "-";
+  }
+  return String(value);
+}

package/src/lib/time.js

@@ -0,0 +1,33 @@
+const DURATION_UNITS = {
+  m: 60 * 1000,
+  h: 60 * 60 * 1000,
+  d: 24 * 60 * 60 * 1000
+};
+
+export function parseDuration(value) {
+  const raw = String(value || "").trim();
+  const match = /^([1-9]\d*)([mhd])$/.exec(raw);
+  if (!match) {
+    throw new Error("Duration must be a positive integer followed by m, h, or d, for example 30m, 12h, or 7d.");
+  }
+
+  const amount = Number(match[1]);
+  const unit = match[2];
+  return {
+    raw,
+    amount,
+    unit,
+    milliseconds: amount * DURATION_UNITS[unit]
+  };
+}
+
+export function parseApiTimestamp(value) {
+  if (!value) {
+    return null;
+  }
+
+  const raw = String(value);
+  const normalized = /[zZ]|[+-]\d{2}:?\d{2}$/.test(raw) ? raw : `${raw}Z`;
+  const parsed = new Date(normalized);
+  return Number.isNaN(parsed.getTime()) ? null : parsed;
+}

package/src/lib/version.js

@@ -0,0 +1,24 @@
+export function compareVersions(a, b) {
+  const parse = (value) =>
+    String(value || "")
+      .replace(/^v/, "")
+      .split("-")[0]
+      .split(".")
+      .map(Number);
+
+  const left = parse(a);
+  const right = parse(b);
+
+  if (left.some(Number.isNaN) || right.some(Number.isNaN)) {
+    return 0;
+  }
+
+  for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
+    const diff = (left[i] || 0) - (right[i] || 0);
+    if (diff !== 0) {
+      return diff;
+    }
+  }
+
+  return 0;
+}