zeuslock-dlp-cli 0.2.0

package/src/commands/deploy.js

@@ -0,0 +1,515 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Command } from "commander";
+
+import {
+  requestAuthenticatedJson,
+  resolveApiUrlForRequest
+} from "../lib/api-client.js";
+import { dash, formatTable } from "../lib/table.js";
+import { parseApiTimestamp } from "../lib/time.js";
+
+const ARTIFACT_SETS = ["all", "extension", "agent"];
+const BROWSERS = ["all", "chrome", "edge"];
+const VERIFY_PLATFORMS = ["windows", "macos", "linux"];
+const VERIFY_STATUSES = ["online", "offline", "any"];
+const BUSINESS_PLANS = new Set(["business", "enterprise"]);
+const EXTENSION_ID = "hgooghpcnalhpjbemnnmdoabfjhchoip";
+const EXTENSION_UPDATE_URL = "https://clients2.google.com/service/update2/crx";
+const AGENT_ONLINE_WINDOW_MS = 5 * 60 * 1000;
+
+export function createDeployCommand({
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("deploy")
+    .description("Generate and verify ZeusLock deployment artifacts");
+
+  command.addCommand(createGpoConfigCommand({ stdout, env }));
+  command.addCommand(createAgentVerifyCommand({ stdout, env }));
+
+  return command;
+}
+
+function createGpoConfigCommand({ stdout, env }) {
+  return new Command("gpo-config")
+    .description("Generate dashboard-supported GPO and agent deployment artifacts")
+    .option("--artifact <set>", "artifact set: all, extension, or agent", "all")
+    .option("--browser <browser>", "extension browser policy: chrome, edge, or all", "all")
+    .option("--output <dir>", "output directory", "zeuslock-deploy")
+    .option("--api-key <key>", "full organization API key to embed")
+    .option("--key-id <id>", "existing API key id from keys list")
+    .option("--create-key-name <name>", "create and use a new API key with this name")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const artifactSet = parseChoice(options.artifact, ARTIFACT_SETS, "--artifact");
+      const browser = parseChoice(options.browser, BROWSERS, "--browser");
+      const requested = {
+        extension: includesArtifact(artifactSet, "extension"),
+        agent: includesArtifact(artifactSet, "agent")
+      };
+
+      const org = await requestAuthenticatedJson("/api/org", { env });
+      if (requested.extension && !BUSINESS_PLANS.has(String(org?.plan || "free").toLowerCase())) {
+        throw new Error("Extension GPO deployment is only available on Business and Enterprise plans.");
+      }
+
+      const apiUrl = await resolveApiUrlForRequest(env);
+      validateApiUrl(apiUrl);
+      const selectedKey = await resolveDeploymentApiKey(options, { env });
+      const outputDir = path.resolve(options.output || "zeuslock-deploy");
+      const artifacts = [];
+
+      if (requested.extension) {
+        artifacts.push(...await writeExtensionArtifacts({
+          outputDir,
+          browser,
+          apiUrl,
+          apiKey: selectedKey.api_key
+        }));
+      }
+
+      if (requested.agent) {
+        artifacts.push(...await writeAgentArtifacts({
+          outputDir,
+          apiUrl,
+          apiKey: selectedKey.api_key
+        }));
+      }
+
+      const summary = {
+        schema_version: "zeuslock.deploy.v1",
+        generated_at: new Date().toISOString(),
+        api_url: apiUrl,
+        org: {
+          org_id: org?.org_id || org?.id || null,
+          name: org?.name || null,
+          plan: org?.plan || null
+        },
+        api_key: {
+          id: selectedKey.id || null,
+          name: selectedKey.name || null,
+          api_key_masked: selectedKey.api_key_masked || maskSecret(selectedKey.api_key),
+          source: selectedKey.source
+        },
+        requested: {
+          artifact: artifactSet,
+          browser
+        },
+        skipped: skippedArtifacts({ requested, browser }),
+        artifacts
+      };
+      const summaryArtifact = await writeArtifact(
+        outputDir,
+        "deployment-summary.json",
+        `${JSON.stringify(summary, null, 2)}\n`,
+        "summary"
+      );
+      const output = {
+        ...summary,
+        output_dir: outputDir,
+        artifacts: [...artifacts, summaryArtifact]
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`Generated deployment artifacts in ${outputDir}\n`);
+      stdout.write(`API URL: ${apiUrl}\n`);
+      stdout.write(`API key: ${output.api_key.api_key_masked || "masked"}\n`);
+      stdout.write("\n");
+      stdout.write(`${formatTable(output.artifacts, [
+        { header: "TYPE", value: (artifact) => artifact.type },
+        { header: "PATH", value: (artifact) => artifact.path }
+      ])}\n`);
+
+      if (output.skipped.length) {
+        stdout.write("\nSkipped:\n");
+        for (const skipped of output.skipped) {
+          stdout.write(`- ${skipped.feature}: ${skipped.reason}\n`);
+        }
+      }
+    });
+}
+
+function createAgentVerifyCommand({ stdout, env }) {
+  return new Command("agent-verify")
+    .description("Verify agent enrollment and heartbeat state from the dashboard backend")
+    .option("--agent-id <id>", "exact agent id")
+    .option("--hostname <name>", "exact hostname, case-insensitive")
+    .option("--platform <platform>", "platform filter: windows, macos, or linux")
+    .option("--status <status>", "expected status: online, offline, or any", "online")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const platform = options.platform
+        ? parseChoice(options.platform, VERIFY_PLATFORMS, "--platform")
+        : null;
+      const expectedStatus = parseChoice(options.status, VERIFY_STATUSES, "--status");
+      const data = await requestAuthenticatedJson("/api/agents", { env });
+      const agents = normalizeAgents(Array.isArray(data) ? data : (data?.agents || []));
+      const filters = {
+        agent_id: options.agentId || null,
+        hostname: options.hostname || null,
+        platform,
+        status: expectedStatus
+      };
+      const matchingIdentity = agents.filter((agent) => matchesAgentIdentity(agent, filters));
+      const matchingStatus = expectedStatus === "any"
+        ? matchingIdentity
+        : matchingIdentity.filter((agent) => agent.status === expectedStatus);
+      const outcome = buildVerifyOutcome({
+        total: typeof data?.total === "number" ? data.total : agents.length,
+        onlineCount: typeof data?.online_count === "number"
+          ? data.online_count
+          : agents.filter((agent) => agent.is_online).length,
+        offlineCount: typeof data?.offline_count === "number"
+          ? data.offline_count
+          : agents.filter((agent) => !agent.is_online).length,
+        filters,
+        matchingIdentity,
+        matchingStatus,
+        expectedStatus
+      });
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(outcome)}\n`);
+        if (!outcome.verified) {
+          process.exitCode = 1;
+        }
+        return;
+      }
+
+      stdout.write(`Agent verification: ${outcome.status}\n`);
+      stdout.write(`Matched agents: ${outcome.matched}\n`);
+      stdout.write(`Fleet: ${outcome.total} total, ${outcome.online_count} online, ${outcome.offline_count} offline\n`);
+
+      if (!outcome.agents.length) {
+        stdout.write("No matching agents found.\n");
+        if (!outcome.verified) {
+          process.exitCode = 1;
+        }
+        return;
+      }
+
+      stdout.write("\n");
+      stdout.write(`${formatTable(outcome.agents, [
+        { header: "AGENT ID", value: (agent) => dash(agent.agent_id) },
+        { header: "HOSTNAME", value: (agent) => dash(agent.hostname) },
+        { header: "PLATFORM", value: (agent) => dash(agent.platform) },
+        { header: "VERSION", value: (agent) => dash(agent.version) },
+        { header: "STATUS", value: (agent) => agent.status },
+        { header: "LAST HEARTBEAT", value: (agent) => dash(agent.last_seen) }
+      ])}\n`);
+      if (!outcome.verified) {
+        process.exitCode = 1;
+      }
+    });
+}
+
+function parseChoice(value, allowed, optionName) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (!allowed.includes(normalized)) {
+    throw new Error(`Invalid ${optionName}. Allowed values: ${allowed.join(", ")}.`);
+  }
+  return normalized;
+}
+
+function includesArtifact(artifactSet, artifact) {
+  return artifactSet === "all" || artifactSet === artifact;
+}
+
+function validateApiUrl(apiUrl) {
+  try {
+    new URL(apiUrl);
+  } catch {
+    throw new Error(`Invalid API URL: ${apiUrl}`);
+  }
+}
+
+async function resolveDeploymentApiKey(options, { env }) {
+  const provided = String(options.apiKey || "").trim();
+  if (provided) {
+    return {
+      id: "",
+      name: "",
+      api_key: provided,
+      api_key_masked: maskSecret(provided),
+      active: true,
+      source: "provided"
+    };
+  }
+
+  const createKeyName = String(options.createKeyName || "").trim();
+  if (createKeyName) {
+    const created = normalizeApiKey(await requestAuthenticatedJson("/api/keys", {
+      env,
+      method: "POST",
+      body: { name: createKeyName }
+    }));
+    if (!created.api_key) {
+      throw new Error("Created API key response did not include the full key.");
+    }
+    return {
+      ...created,
+      source: "created"
+    };
+  }
+
+  const keys = normalizeApiKeys(await requestAuthenticatedJson("/api/keys", { env }));
+  const keyId = String(options.keyId || "").trim();
+  if (keyId) {
+    const selected = keys.find((key) => key.id === keyId);
+    if (!selected) {
+      throw new Error(`API key not found: ${keyId}`);
+    }
+    if (!selected.active) {
+      throw new Error(`API key is revoked: ${keyId}`);
+    }
+    if (!selected.api_key) {
+      throw new Error(`API key ${keyId} does not include a decryptable full key. Provide --api-key or create a new key with --create-key-name.`);
+    }
+    return {
+      ...selected,
+      source: "existing"
+    };
+  }
+
+  const activeDecryptable = keys.filter((key) => key.active && key.api_key);
+  if (activeDecryptable.length === 1) {
+    return {
+      ...activeDecryptable[0],
+      source: "existing"
+    };
+  }
+  if (activeDecryptable.length > 1) {
+    throw new Error("Multiple active API keys are available. Provide --key-id, --api-key, or --create-key-name.");
+  }
+  throw new Error("No active decryptable API key is available. Provide --api-key or create a new key with --create-key-name.");
+}
+
+function normalizeApiKeys(data) {
+  const keys = Array.isArray(data) ? data : (data?.api_keys || data?.keys || []);
+  return keys.map(normalizeApiKey);
+}
+
+function normalizeApiKey(key = {}) {
+  const active = typeof key.active === "boolean"
+    ? key.active
+    : key.revoked !== true;
+  return {
+    id: key.id || "",
+    name: key.name || "",
+    api_key: key.api_key || key.key || "",
+    api_key_masked: key.api_key_masked || formatMaskedPrefix(key.prefix),
+    active,
+    status: active ? "active" : "revoked"
+  };
+}
+
+function formatMaskedPrefix(prefix) {
+  return prefix ? `${prefix}***...****` : "";
+}
+
+async function writeExtensionArtifacts({ outputDir, browser, apiUrl, apiKey }) {
+  const artifacts = [];
+  const browsers = browser === "all" ? ["chrome", "edge"] : [browser];
+  for (const target of browsers) {
+    artifacts.push(await writeArtifact(
+      outputDir,
+      `extension/${target}-extension-forcelist.txt`,
+      `${EXTENSION_ID};${EXTENSION_UPDATE_URL}\n`,
+      "extension"
+    ));
+    artifacts.push(await writeArtifact(
+      outputDir,
+      `extension/${target}-extension-settings.json`,
+      `${JSON.stringify(buildExtensionSettings({ apiUrl, apiKey }), null, 2)}\n`,
+      "extension"
+    ));
+  }
+  return artifacts;
+}
+
+function buildExtensionSettings({ apiUrl, apiKey }) {
+  const apiHost = new URL(apiUrl).host;
+  return {
+    [EXTENSION_ID]: {
+      installation_mode: "force_installed",
+      runtime_allowed_hosts: [`*://${apiHost}`],
+      runtime_blocked_hosts: [],
+      configuration: {
+        api_url: apiUrl,
+        api_key: apiKey,
+        monitor_clipboard: true,
+        monitor_ai_apps: true,
+        show_notifications: true
+      }
+    }
+  };
+}
+
+async function writeAgentArtifacts({ outputDir, apiUrl, apiKey }) {
+  return [
+    await writeArtifact(
+      outputDir,
+      "agent/windows-agent-policy.reg",
+      buildWindowsAgentRegistry({ apiUrl, apiKey }),
+      "agent"
+    ),
+    await writeArtifact(
+      outputDir,
+      "agent/agent-config.json",
+      `${JSON.stringify(buildAgentConfig({ apiUrl, apiKey }), null, 2)}\n`,
+      "agent"
+    )
+  ];
+}
+
+function buildWindowsAgentRegistry({ apiUrl, apiKey }) {
+  return [
+    "Windows Registry Editor Version 5.00",
+    "",
+    "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\ZeusLock]",
+    `"ServerUrl"="${escapeRegString(apiUrl)}"`,
+    `"LicenseKey"="${escapeRegString(apiKey)}"`,
+    ""
+  ].join("\r\n");
+}
+
+function buildAgentConfig({ apiUrl, apiKey }) {
+  return {
+    ServerUrl: apiUrl,
+    LicenseKey: apiKey,
+    apiUrl,
+    apiKey
+  };
+}
+
+function escapeRegString(value) {
+  return String(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+
+async function writeArtifact(outputDir, relativePath, content, type) {
+  const fullPath = path.join(outputDir, relativePath);
+  await mkdir(path.dirname(fullPath), { recursive: true });
+  await writeFile(fullPath, content, "utf8");
+  return {
+    type,
+    path: fullPath
+  };
+}
+
+function skippedArtifacts({ requested, browser }) {
+  const skipped = [];
+  skipped.push({
+    feature: "proxy .reg artifact",
+    reason: "Not implemented in the dashboard or backend; skipped."
+  });
+  if (!requested.extension) {
+    skipped.push({
+      feature: "extension deployment artifacts",
+      reason: "Not requested by --artifact."
+    });
+  }
+  if (!requested.agent) {
+    skipped.push({
+      feature: "agent deployment artifacts",
+      reason: "Not requested by --artifact."
+    });
+  }
+  if (requested.extension && browser !== "all") {
+    skipped.push({
+      feature: `${browser === "chrome" ? "Edge" : "Chrome"} extension artifacts`,
+      reason: "Not requested by --browser."
+    });
+  }
+  return skipped;
+}
+
+function maskSecret(value) {
+  const secret = String(value || "");
+  if (!secret) {
+    return "";
+  }
+  if (secret.length <= 10) {
+    return `${secret.slice(0, 3)}***`;
+  }
+  return `${secret.slice(0, 6)}***...${secret.slice(-4)}`;
+}
+
+function normalizeAgents(agents) {
+  return agents.map((agent) => {
+    const online = computeOnline(agent);
+    return {
+      agent_id: agent.agent_id || agent.id || "",
+      hostname: agent.hostname || "",
+      platform: String(agent.platform || "").toLowerCase(),
+      version: agent.version || "",
+      username: agent.username || agent.user || agent.user_email || "",
+      last_seen: agent.last_seen || "",
+      first_seen: agent.first_seen || "",
+      is_online: online,
+      status: online ? "online" : "offline"
+    };
+  });
+}
+
+function computeOnline(agent, now = new Date()) {
+  if (typeof agent?.is_online === "boolean") {
+    return agent.is_online;
+  }
+
+  const lastSeen = parseApiTimestamp(agent?.last_seen);
+  if (!lastSeen) {
+    return false;
+  }
+
+  return now.getTime() - lastSeen.getTime() < AGENT_ONLINE_WINDOW_MS;
+}
+
+function matchesAgentIdentity(agent, filters) {
+  if (filters.agent_id && agent.agent_id !== filters.agent_id) {
+    return false;
+  }
+  if (filters.hostname && agent.hostname.toLowerCase() !== String(filters.hostname).toLowerCase()) {
+    return false;
+  }
+  if (filters.platform && agent.platform !== filters.platform) {
+    return false;
+  }
+  return true;
+}
+
+function buildVerifyOutcome({
+  total,
+  onlineCount,
+  offlineCount,
+  filters,
+  matchingIdentity,
+  matchingStatus,
+  expectedStatus
+}) {
+  let status = "not_found";
+  let verified = false;
+  if (matchingIdentity.length && matchingStatus.length) {
+    status = "verified";
+    verified = true;
+  } else if (matchingIdentity.length && expectedStatus === "online") {
+    status = "offline";
+  } else if (matchingIdentity.length && expectedStatus === "offline") {
+    status = "online";
+  }
+
+  return {
+    verified,
+    status,
+    total,
+    online_count: onlineCount,
+    offline_count: offlineCount,
+    matched: matchingStatus.length || matchingIdentity.length,
+    filters,
+    agents: matchingStatus.length ? matchingStatus : matchingIdentity
+  };
+}

package/src/commands/extensions.js

@@ -0,0 +1,73 @@
+import { Command } from "commander";
+
+import { requestAuthenticatedJson } from "../lib/api-client.js";
+import { dash, formatTable } from "../lib/table.js";
+
+export function createExtensionsCommand({
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("extensions")
+    .description("Review browser extension deployment status");
+
+  command.addCommand(createExtensionsStatusCommand({ stdout, env }));
+
+  return command;
+}
+
+function createExtensionsStatusCommand({ stdout = process.stdout, env = process.env } = {}) {
+  return new Command("status")
+    .description("Show active browser extensions")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const data = await requestAuthenticatedJson("/api/extensions", { env });
+      const extensions = normalizeExtensions(Array.isArray(data) ? data : (data.extensions || []));
+      const output = {
+        active_count: typeof data?.active_count === "number" ? data.active_count : extensions.length,
+        active_users: typeof data?.active_users === "number" ? data.active_users : countUniqueUsers(extensions),
+        last_minutes: typeof data?.last_minutes === "number" ? data.last_minutes : 30,
+        extensions
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`Active extensions: ${output.active_count}\n`);
+      stdout.write(`Active users: ${output.active_users}\n`);
+      stdout.write(`Window: last ${output.last_minutes} minutes\n`);
+
+      if (!extensions.length) {
+        stdout.write("No active extensions found.\n");
+        return;
+      }
+
+      stdout.write("\n");
+      stdout.write(`${formatTable(extensions, [
+        { header: "USER EMAIL", value: (extension) => dash(extension.user_email) },
+        { header: "BROWSER", value: (extension) => dash(extension.browser) },
+        { header: "VERSION", value: (extension) => dash(extension.version) },
+        { header: "LAST ACTIVITY", value: (extension) => dash(extension.last_activity) },
+        { header: "STATUS", value: (extension) => extension.status }
+      ])}\n`);
+    });
+}
+
+function normalizeExtensions(extensions) {
+  return extensions.map((extension) => {
+    const isActive = extension.is_active !== false;
+    return {
+      extension_id: extension.extension_id || extension.id || "",
+      user_email: extension.user_email || "",
+      browser: extension.browser || "",
+      version: extension.version || extension.extension_version || "",
+      last_activity: extension.timestamp || extension.last_seen || "",
+      status: isActive ? "active" : "inactive"
+    };
+  });
+}
+
+function countUniqueUsers(extensions) {
+  return new Set(extensions.map((extension) => extension.user_email).filter(Boolean)).size;
+}