geoip and config editor online

internal/crowdsec/cli.go

@@ -308,6 +308,74 @@ func (c *CLIClient) GetVersion(ctx context.Context) (string, error) {
 	return strings.TrimSpace(string(out)), nil
 }
 
+// -----------------------------------------------------------------------
+// Allowlists
+// -----------------------------------------------------------------------
+
+// ListAllowlists returns all configured allowlists.
+func (c *CLIClient) ListAllowlists(ctx context.Context) ([]Allowlist, error) {
+	out, err := c.run(ctx, "allowlists", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	if len(out) == 0 || string(out) == "null\n" || string(out) == "null" {
+		return []Allowlist{}, nil
+	}
+
+	var lists []Allowlist
+	if err := json.Unmarshal(out, &lists); err != nil {
+		// try wrapped: {"allowlists": [...]}
+		var wrapper struct {
+			Allowlists []Allowlist `json:"allowlists"`
+		}
+		if err2 := json.Unmarshal(out, &wrapper); err2 != nil {
+			return nil, fmt.Errorf("parse allowlists: %w\noutput: %s", err, string(out))
+		}
+		return wrapper.Allowlists, nil
+	}
+	return lists, nil
+}
+
+// InspectAllowlist returns details and items for a named allowlist.
+func (c *CLIClient) InspectAllowlist(ctx context.Context, name string) (*Allowlist, error) {
+	if !safeArg.MatchString(name) {
+		return nil, fmt.Errorf("invalid allowlist name: %q", name)
+	}
+	out, err := c.run(ctx, "allowlists", "inspect", name, "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	var al Allowlist
+	if err := json.Unmarshal(out, &al); err != nil {
+		return nil, fmt.Errorf("parse allowlist inspect: %w\noutput: %s", err, string(out))
+	}
+	return &al, nil
+}
+
+// AddAllowlistEntry adds a value to a named allowlist.
+func (c *CLIClient) AddAllowlistEntry(ctx context.Context, listName, value string) error {
+	if !safeArg.MatchString(listName) {
+		return fmt.Errorf("invalid allowlist name: %q", listName)
+	}
+	if !safeArg.MatchString(value) {
+		return fmt.Errorf("invalid allowlist value: %q", value)
+	}
+	_, err := c.run(ctx, "allowlists", "items", "add", listName, value)
+	return err
+}
+
+// RemoveAllowlistEntry removes a value from a named allowlist.
+func (c *CLIClient) RemoveAllowlistEntry(ctx context.Context, listName, value string) error {
+	if !safeArg.MatchString(listName) {
+		return fmt.Errorf("invalid allowlist name: %q", listName)
+	}
+	if !safeArg.MatchString(value) {
+		return fmt.Errorf("invalid allowlist value: %q", value)
+	}
+	_, err := c.run(ctx, "allowlists", "items", "del", listName, value)
+	return err
+}
+
 // -----------------------------------------------------------------------
 // Internal helpers
 // -----------------------------------------------------------------------
@@ -347,6 +415,7 @@ var allowedSubcommands = map[string]bool{
 	"metrics":       true,
 	"version":       true,
 	"decisions":     true,
+	"allowlists":    true,
 }
 
 // allowedActions for each subcommand.
@@ -359,6 +428,10 @@ var allowedActions = map[string]bool{
 	"update":    true,
 	"upgrade":   true,
 	"validate":  true,
+	"create":    true,
+	"inspect":   true,
+	"items":     true,
+	"del":       true,
 }
 
 // safeArg matches strings that are safe to pass as arguments (no shell metacharacters).

internal/crowdsec/types.go

@@ -135,3 +135,19 @@ type MetricsSection struct {
 	Headers []string
 	Rows    [][]string
 }
+
+// -----------------------------------------------------------------------
+// Allowlist types (cscli allowlists)
+// -----------------------------------------------------------------------
+
+type AllowlistItem struct {
+	Comment string `json:"comment"`
+	Expiry  string `json:"expiry"`
+	Value   string `json:"value"`
+}
+
+type Allowlist struct {
+	Description string          `json:"description"`
+	Items       []AllowlistItem `json:"items"`
+	Name        string          `json:"name"`
+}