zeuslock-dlp-cli 0.2.0

package/src/commands/keys.js

@@ -0,0 +1,211 @@
+import { Command } from "commander";
+
+import { requestAuthenticatedJson } from "../lib/api-client.js";
+import { promptText } from "../lib/prompt.js";
+import { dash, formatTable } from "../lib/table.js";
+
+const KEY_STATUSES = ["all", "active", "revoked"];
+
+export function createKeysCommand({
+  stdin = process.stdin,
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("keys")
+    .description("Manage ZeusLock API keys");
+
+  command.addCommand(createKeysListCommand({ stdout, env }));
+  command.addCommand(createKeysCreateCommand({ stdout, env }));
+  command.addCommand(createKeysRevokeCommand({ stdin, stdout, env }));
+
+  return command;
+}
+
+function createKeysListCommand({ stdout, env }) {
+  return new Command("list")
+    .description("List API keys")
+    .option("--status <status>", "status filter: all, active, or revoked", "all")
+    .option("--show-secret", "include returned full key values when available")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const status = parseChoice(options.status, KEY_STATUSES, "--status");
+      const keys = normalizeApiKeys(await requestAuthenticatedJson("/api/keys", { env }));
+      const filtered = applyKeyFilters(keys, { status });
+      const output = {
+        total: keys.length,
+        matched: filtered.length,
+        filters: {
+          status
+        },
+        keys: filtered.map((key) => serializeKey(key, { showSecret: Boolean(options.showSecret) }))
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`API keys: ${output.total} total, ${output.matched} matched\n`);
+      if (!filtered.length) {
+        stdout.write("No API keys found.\n");
+        return;
+      }
+
+      stdout.write("\n");
+      stdout.write(`${formatKeysTable(filtered, { showSecret: Boolean(options.showSecret) })}\n`);
+    });
+}
+
+function createKeysCreateCommand({ stdout, env }) {
+  return new Command("create")
+    .description("Create an API key")
+    .requiredOption("--name <name>", "API key name")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const name = String(options.name || "").trim();
+      if (!name) {
+        throw new Error("--name is required.");
+      }
+
+      const result = await requestAuthenticatedJson("/api/keys", {
+        env,
+        method: "POST",
+        body: { name }
+      });
+      const created = normalizeApiKey(result);
+      const output = {
+        created: true,
+        key: serializeKey(created, { showSecret: true })
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`Created API key: ${created.name || name}\n`);
+      stdout.write(`Key ID: ${created.id || "unknown"}\n`);
+      stdout.write(`API key: ${created.api_key || "not returned"}\n`);
+    });
+}
+
+function createKeysRevokeCommand({
+  stdin = process.stdin,
+  stdout = process.stdout,
+  env = process.env
+}) {
+  return new Command("revoke")
+    .description("Revoke one active API key")
+    .argument("<key_id>", "API key id from keys list")
+    .option("-y, --yes", "skip confirmation prompt")
+    .option("--json", "print machine-readable output")
+    .action(async (keyId, options) => {
+      const keys = normalizeApiKeys(await requestAuthenticatedJson("/api/keys", { env }));
+      const target = keys.find((key) => key.id === keyId);
+      if (!target) {
+        throw new Error(`API key not found: ${keyId}`);
+      }
+      if (!target.active) {
+        throw new Error("API key is already revoked. Refusing to call DELETE because the dashboard backend would permanently delete it.");
+      }
+
+      if (!options.yes) {
+        const answer = await promptText({
+          message: `Revoke API key ${target.name || keyId}? Type "yes" to confirm: `,
+          stdin,
+          stdout,
+          optionName: "--yes"
+        });
+        if (answer.toLowerCase() !== "yes") {
+          stdout.write("API key revocation cancelled.\n");
+          return;
+        }
+      }
+
+      const data = await requestAuthenticatedJson(`/api/keys/${encodeURIComponent(keyId)}`, {
+        env,
+        method: "DELETE"
+      });
+      const output = {
+        revoked: true,
+        key_id: keyId,
+        name: target.name || null,
+        message: data?.message || "API key revoked"
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`${output.message}: ${target.name || keyId}\n`);
+    });
+}
+
+function parseChoice(value, allowed, optionName) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (!allowed.includes(normalized)) {
+    throw new Error(`Invalid ${optionName}. Allowed values: ${allowed.join(", ")}.`);
+  }
+  return normalized;
+}
+
+function normalizeApiKeys(data) {
+  const keys = Array.isArray(data) ? data : (data?.api_keys || data?.keys || []);
+  return keys.map(normalizeApiKey);
+}
+
+function normalizeApiKey(key = {}) {
+  const active = typeof key.active === "boolean"
+    ? key.active
+    : key.revoked !== true;
+  return {
+    id: key.id || "",
+    name: key.name || "",
+    api_key: key.api_key || key.key || "",
+    api_key_masked: key.api_key_masked || formatMaskedPrefix(key.prefix),
+    active,
+    status: active ? "active" : "revoked",
+    created_at: key.created_at || "",
+    last_used_at: key.last_used_at || key.last_used || ""
+  };
+}
+
+function applyKeyFilters(keys, { status }) {
+  if (status === "all") {
+    return keys;
+  }
+  return keys.filter((key) => key.status === status);
+}
+
+function serializeKey(key, { showSecret = false } = {}) {
+  const serialized = {
+    id: key.id,
+    name: key.name,
+    api_key_masked: key.api_key_masked,
+    status: key.status,
+    active: key.active,
+    created_at: key.created_at || null,
+    last_used_at: key.last_used_at || null
+  };
+
+  if (showSecret && key.api_key) {
+    serialized.api_key = key.api_key;
+  }
+
+  return serialized;
+}
+
+function formatKeysTable(keys, { showSecret = false } = {}) {
+  return formatTable(keys, [
+    { header: "KEY ID", value: (key) => dash(key.id) },
+    { header: "NAME", value: (key) => dash(key.name) },
+    { header: "KEY", value: (key) => showSecret && key.api_key ? key.api_key : dash(key.api_key_masked) },
+    { header: "STATUS", value: (key) => key.status },
+    { header: "CREATED", value: (key) => dash(key.created_at) }
+  ]);
+}
+
+function formatMaskedPrefix(prefix) {
+  return prefix ? `${prefix}***...****` : "";
+}

package/src/commands/mcp.js

@@ -0,0 +1,322 @@
+import { Command } from "commander";
+
+import { requestAuthenticatedJson } from "../lib/api-client.js";
+import { dash, formatTable } from "../lib/table.js";
+import { parseApiTimestamp } from "../lib/time.js";
+
+const DAYS = [7, 30, 90];
+const TRANSPORTS = ["all", "http", "sse", "stdio"];
+const DIRECTIONS = ["all", "client_to_server", "server_to_client"];
+const DECISIONS = ["all", "allow", "alert", "block"];
+const EVENTS_LIMIT = 50;
+const SERVERS_DAYS = 90;
+const DISABLED_MESSAGE = "MCP monitoring is not enabled for this organization.";
+
+export function createMcpCommand({
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("mcp")
+    .description("Review MCP monitoring activity");
+
+  command.addCommand(createStatsCommand({ stdout, env }));
+  command.addCommand(createEventsCommand({ stdout, env }));
+  command.addCommand(createServersCommand({ stdout, env }));
+
+  return command;
+}
+
+function createStatsCommand({ stdout, env }) {
+  return new Command("stats")
+    .description("Show MCP monitoring statistics")
+    .option("--days <days>", "history window: 7, 30, or 90", "30")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const filters = { days: parseAllowedInt(options.days, DAYS, "--days") };
+      if (!await isMcpEnabled(env)) {
+        writeDisabled(stdout, options, filters);
+        return;
+      }
+
+      const stats = await requestAuthenticatedJson(`/api/v1/mcp/stats?days=${filters.days}`, { env });
+      const output = { enabled: true, filters, stats };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(formatMcpStats(stats, filters.days));
+    });
+}
+
+function createEventsCommand({ stdout, env }) {
+  return new Command("events")
+    .description("List MCP audit events")
+    .option("--days <days>", "history window: 7, 30, or 90", "30")
+    .option("--transport <transport>", "transport filter: all, http, sse, or stdio", "all")
+    .option("--direction <direction>", "direction filter: all, client_to_server, or server_to_client", "all")
+    .option("--decision <decision>", "decision filter: all, allow, alert, or block", "all")
+    .option("--method <method>", "MCP method filter, for example tools/call")
+    .option("--search <text>", "search server, tool, user, method, hostname, or path")
+    .option("--cursor <cursor>", "opaque next_cursor from a previous events response")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const filters = parseEventFilters(options);
+      if (!await isMcpEnabled(env)) {
+        writeDisabled(stdout, options, filters);
+        return;
+      }
+
+      const data = await requestAuthenticatedJson(`/api/v1/mcp/events?${buildEventsQuery(filters)}`, { env });
+      const events = normalizeEvents(data);
+      const output = {
+        enabled: true,
+        filters,
+        events,
+        next_cursor: data?.next_cursor || null
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`MCP events: ${events.length} shown (${filters.days} days)\n`);
+      if (output.next_cursor) {
+        stdout.write(`Next cursor: ${output.next_cursor}\n`);
+      }
+      if (!events.length) {
+        stdout.write("No MCP events found.\n");
+        return;
+      }
+
+      stdout.write("\n");
+      stdout.write(`${formatTable(events, [
+        { header: "TIME", value: (event) => dash(formatTimestamp(event.timestamp)) },
+        { header: "USER", value: (event) => dash(event.user) },
+        { header: "SERVER", value: (event) => dash(event.server_name || event.hostname) },
+        { header: "METHOD", value: (event) => dash(event.mcp_method || event.event_type) },
+        { header: "TOOL / RESOURCE", value: (event) => dash(event.tool_name || event.resource_uri) },
+        { header: "DIRECTION", value: (event) => dash(event.direction) },
+        { header: "DECISION", value: (event) => dash(event.decision) },
+        { header: "RISK", value: (event) => dash(event.risk_level) }
+      ])}\n`);
+    });
+}
+
+function createServersCommand({ stdout, env }) {
+  return new Command("servers")
+    .description("List discovered MCP servers")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const filters = { days: SERVERS_DAYS };
+      if (!await isMcpEnabled(env)) {
+        writeDisabled(stdout, options, filters);
+        return;
+      }
+
+      const data = await requestAuthenticatedJson(`/api/v1/mcp/servers?days=${SERVERS_DAYS}`, { env });
+      const servers = normalizeServers(data);
+      const output = {
+        enabled: true,
+        total: typeof data?.total === "number" ? data.total : servers.length,
+        filters,
+        servers
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`MCP servers: ${output.total} discovered (${SERVERS_DAYS} days)\n`);
+      if (!servers.length) {
+        stdout.write("No MCP servers found.\n");
+        return;
+      }
+
+      stdout.write("\n");
+      stdout.write(`${formatTable(servers, [
+        { header: "SERVER", value: (server) => dash(server.server_name) },
+        { header: "CLIENT", value: (server) => dash(server.client_name) },
+        { header: "TRANSPORT", value: (server) => dash(server.transport) },
+        { header: "STATUS", value: (server) => dash(server.status) },
+        { header: "ACTIVITY", value: (server) => numberOrZero(server.activity_count) },
+        { header: "LAST DECISION", value: (server) => dash(server.last_decision) },
+        { header: "FIRST SEEN", value: (server) => dash(formatTimestamp(server.first_seen)) },
+        { header: "LAST SEEN", value: (server) => dash(formatTimestamp(server.last_seen)) }
+      ])}\n`);
+    });
+}
+
+async function isMcpEnabled(env) {
+  const org = await requestAuthenticatedJson("/api/org", { env });
+  return org?.settings?.mcp_enabled !== false;
+}
+
+function writeDisabled(stdout, options, filters) {
+  if (options.json) {
+    stdout.write(`${JSON.stringify({
+      enabled: false,
+      message: DISABLED_MESSAGE,
+      filters
+    })}\n`);
+    return;
+  }
+  stdout.write(`${DISABLED_MESSAGE}\n`);
+}
+
+function parseEventFilters(options) {
+  return {
+    days: parseAllowedInt(options.days, DAYS, "--days"),
+    limit: EVENTS_LIMIT,
+    transport: parseOptionalChoice(options.transport, TRANSPORTS, "--transport") || "all",
+    direction: parseOptionalChoice(options.direction, DIRECTIONS, "--direction") || "all",
+    decision: parseOptionalChoice(options.decision, DECISIONS, "--decision") || "all",
+    mcp_method: parseMethod(options.method),
+    search: normalizeOptionalText(options.search),
+    cursor: normalizeOptionalText(options.cursor)
+  };
+}
+
+function buildEventsQuery(filters) {
+  const params = new URLSearchParams();
+  params.set("days", String(filters.days));
+  params.set("limit", String(filters.limit));
+  if (filters.transport !== "all") {
+    params.set("transport", filters.transport);
+  }
+  if (filters.direction !== "all") {
+    params.set("direction", filters.direction);
+  }
+  if (filters.decision !== "all") {
+    params.set("decision", filters.decision);
+  }
+  if (filters.mcp_method) {
+    params.set("mcp_method", filters.mcp_method);
+  }
+  if (filters.search) {
+    params.set("search", filters.search);
+  }
+  if (filters.cursor) {
+    params.set("cursor", filters.cursor);
+  }
+  return params.toString();
+}
+
+function parseAllowedInt(value, allowed, optionName) {
+  const number = Number(value);
+  if (!Number.isInteger(number) || !allowed.includes(number)) {
+    throw new Error(`Invalid ${optionName}. Allowed values: ${allowed.join(", ")}.`);
+  }
+  return number;
+}
+
+function parseOptionalChoice(value, allowed, optionName) {
+  if (value === undefined || value === null || value === "") {
+    return null;
+  }
+  const normalized = String(value).trim().toLowerCase();
+  if (!allowed.includes(normalized)) {
+    throw new Error(`Invalid ${optionName}. Allowed values: ${allowed.join(", ")}.`);
+  }
+  return normalized;
+}
+
+function parseMethod(value) {
+  const method = normalizeOptionalText(value);
+  if (!method || method.toLowerCase() === "all") {
+    return null;
+  }
+  return method;
+}
+
+function normalizeOptionalText(value) {
+  const text = String(value || "").trim();
+  return text || null;
+}
+
+function normalizeEvents(data) {
+  const events = Array.isArray(data) ? data : (data?.events || []);
+  return events.map((event) => ({
+    id: event.id || "",
+    timestamp: event.timestamp || "",
+    user: event.user || "",
+    event_type: event.event_type || "",
+    transport: event.transport || "",
+    direction: event.direction || "",
+    mcp_method: event.mcp_method || "",
+    tool_name: event.tool_name || "",
+    resource_uri: event.resource_uri || "",
+    server_name: event.server_name || "",
+    client_name: event.client_name || "",
+    decision: event.decision || "",
+    risk_level: event.risk_level || "",
+    incident_id: event.incident_id || null,
+    content_hash: event.content_hash || "",
+    byte_count: numberOrZero(event.byte_count),
+    hostname: event.hostname || "",
+    path: event.path || "",
+    url: event.url || "",
+    command: event.command || "",
+    source_path: event.source_path || "",
+    agent_id: event.agent_id || "",
+    platform: event.platform || ""
+  }));
+}
+
+function normalizeServers(data) {
+  const servers = Array.isArray(data) ? data : (data?.servers || []);
+  return servers.map((server) => ({
+    server_name: server.server_name || "",
+    client_name: server.client_name || "",
+    transport: server.transport || "",
+    endpoint: server.endpoint || "",
+    source_path: server.source_path || "",
+    agent_id: server.agent_id || "",
+    first_seen: server.first_seen || "",
+    last_seen: server.last_seen || "",
+    activity_count: numberOrZero(server.activity_count),
+    blocked_count: numberOrZero(server.blocked_count),
+    alerted_count: numberOrZero(server.alerted_count),
+    last_activity: server.last_activity || null,
+    last_decision: server.last_decision || "",
+    status: server.status || ""
+  }));
+}
+
+function formatMcpStats(stats, days) {
+  return [
+    `MCP stats (${days} days)`,
+    `Events: ${numberOrZero(stats?.total_events)}`,
+    `Tool calls: ${numberOrZero(stats?.tool_calls)}`,
+    `Blocked: ${numberOrZero(stats?.blocked)}`,
+    `Alerted: ${numberOrZero(stats?.alerted)}`,
+    `Active servers: ${numberOrZero(stats?.active_servers)}`,
+    `Affected users: ${numberOrZero(stats?.affected_users)}`,
+    formatCountMap("By transport", stats?.by_transport),
+    formatCountMap("By direction", stats?.by_direction),
+    formatCountMap("By method", stats?.by_method),
+    ""
+  ].filter((line) => line !== null).join("\n");
+}
+
+function formatCountMap(label, value) {
+  if (!value || typeof value !== "object" || !Object.keys(value).length) {
+    return null;
+  }
+  return `${label}: ${Object.entries(value).map(([key, count]) => `${key}: ${count}`).join(", ")}`;
+}
+
+function formatTimestamp(value) {
+  const date = parseApiTimestamp(value);
+  if (!date) {
+    return value || "";
+  }
+  return date.toISOString();
+}
+
+function numberOrZero(value) {
+  return Number.isFinite(Number(value)) ? Number(value) : 0;
+}