From fe15de879d4bb5810b510bc0a630ec6d9547181a Mon Sep 17 00:00:00 2001 From: Ziad Abdelgwad Date: Mon, 14 Sep 2026 21:11:27 +0300 Subject: [PATCH] docs: Update Network Policy findings - OPA/Rego UI editor, not API accessible - Network Policy exists as Rego editor in console UI - cumin.dev/network-policy returns 405 (endpoint exists) not 404 - Not accessible via MCP or bearer token - UI only feature - Rating updated: 2/10 -> 7/10 --- docs/REPORT.md | 33 +++++++-- scripts/test_features.js | 147 +++++++++------------------------------ 2 files changed, 60 insertions(+), 120 deletions(-) diff --git a/docs/REPORT.md b/docs/REPORT.md index 393e058..14faefb 100644 --- a/docs/REPORT.md +++ b/docs/REPORT.md @@ -436,13 +436,36 @@ await callTool("update_constellation", { --- -### 5.8 Network Policy +### 5.8 Network Policy (OPA/Rego) -**Rating: ⭐ 2/10** +**Rating: ⭐⭐⭐⭐ 7/10 — UI Only** -Expected to allow ingress/egress rules, rate limiting, and IP allowlisting. +Network Policy in Cumin is implemented as an **OPA (Open Policy Agent) Rego policy editor**, visible in the console sidebar. It uses Rego syntax to define allowed ingress/egress rules for the namespace mesh. -**Result:** `404 Not Found` — feature either in beta or undocumented for standard tokens. +**The default policy loaded in the UI:** +```rego +package runtime +import rego.v1 +default allow := false +allow if true +default group_ingress := false +group_ingress if true +egress_allow_cidr contains "0.0.0.0/0" +``` + +**Endpoint discovery results:** + +| Domain | Method | Path | Response | Conclusion | +|--------|--------|------|----------|------------| +| `api.cumin.dev` | ALL | `/network-policy` | 404 | Not on API domain | +| `cumin.dev` | GET | `/network-policy` | 404 | No GET handler | +| `cumin.dev` | PUT/PATCH | `/network-policy` | **405** | **Endpoint exists!** | +| MCP | — | `list_network_policies` | tool not found | Not in MCP tools | + +**Conclusion:** The Network Policy endpoint lives on `cumin.dev` (not `api.cumin.dev`) and returns **405 Method Not Allowed** for PUT/PATCH — meaning the route is registered by nginx but handled differently (likely via a session cookie from the console UI, not a bearer token). It is currently a **UI-only feature** not accessible via the standard MCP/bearer-token API. + +> [!NOTE] +> This is consistent with the feature being an account-level control plane setting, not a per-project data plane setting. To configure Network Policy, use the Cumin Console sidebar: `api.cumin.dev/console#/network-policy` --- @@ -836,7 +859,7 @@ xychart-beta | 🪣 S3 Buckets | **8.5/10** | S3-compatible, instant setup | | 🔐 Secrets | **9/10** | ✅ Works — value must be base64, project_id required | | 🌐 Constellations | **9.5/10** | ✅ Works — creates private net + shared endpoint | -| 🔒 Network Policy | **2/10** | Tool not found in MCP tools list | +| 🔒 Network Policy | **7/10** | ⚠️ UI only (OPA/Rego editor) — no MCP/API access | | 🔑 Pull Secrets | **8/10** | ✅ Works — validates real registry credentials live | | 📖 Documentation | **6/10** | Good for basics, sparse on advanced features | | 💻 Developer Experience | **9.5/10** | Clean UI, great DX, all core features accessible | diff --git a/scripts/test_features.js b/scripts/test_features.js index befbb59..59c6219 100644 --- a/scripts/test_features.js +++ b/scripts/test_features.js @@ -1,127 +1,44 @@ -// Full advanced features test + integration with SOC system const TOKEN = "cumin_GjynCIFJtyoZ_73wasCoWNYf7Y-Pk0jMffHEdRzblBg"; -const PROJECT_ID = "178bfad9-5edc-409f-833c-6fffca7aed5a"; -const API = "https://api.cumin.dev"; -let SESSION_ID = null; -async function mcpRequest(method, params, id) { - const body = { jsonrpc: "2.0", method, id }; - if (params) body.params = params; - const headers = { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", Accept: "application/json, text/event-stream" }; - if (SESSION_ID) headers["Mcp-Session-Id"] = SESSION_ID; - const res = await fetch(`${API}/mcp`, { method: "POST", headers, body: JSON.stringify(body) }); - const sid = res.headers.get("Mcp-Session-Id"); - if (sid) SESSION_ID = sid; - const data = await res.json(); - if (data.error) throw new Error(`MCP error: ${JSON.stringify(data.error)}`); - return data.result; -} +const policy = ["package runtime", "import rego.v1", "default allow := false", + "allow if true", "default group_ingress := false", "group_ingress if true", + 'egress_allow_cidr contains "0.0.0.0/0"'].join("\n"); -async function callTool(name, args) { - const r = await mcpRequest("tools/call", { name, arguments: args }, Date.now()); - const text = r.content?.map(c => c.text || "").join("") || JSON.stringify(r); - if (r.isError) return { error: text }; - try { return JSON.parse(text); } catch { return text; } +async function t(method, url, body) { + const opts = { method, headers: { Authorization: "Bearer " + TOKEN, "Content-Type": "application/json" } }; + if (body) opts.body = JSON.stringify(body); + try { + const r = await fetch(url, opts); + const text = await r.text(); + const hit = r.status !== 404; + console.log(hit ? "💡 HIT!" : " ", method.padEnd(6), url.replace("https://cumin.dev","").padEnd(30), "->", r.status, ":", text.substring(0, 200)); + return { status: r.status, text }; + } catch(e) { console.log(" ERR", method, url, e.message); } } async function main() { - console.log("═══ ADVANCED FEATURES - FULL INTEGRATION ═══\n"); + console.log("=== Network Policy — 405 means endpoint EXISTS, wrong method ===\n"); - await mcpRequest("initialize", { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "soc-features", version: "2.0" } }, 1); - console.log("✅ MCP Session:", SESSION_ID, "\n"); - - // List all available tools first - console.log("━━━ AVAILABLE MCP TOOLS ━━━"); - const tools = await mcpRequest("tools/list", {}, Date.now()); - if (tools?.tools) { - tools.tools.forEach(t => console.log(" -", t.name)); - } - console.log(); - - // ═══ 1. SECRETS ═══ - console.log("━━━ 1. SECRETS ━━━"); + // cumin.dev (not api.cumin.dev) returns 405 for PUT — endpoint exists! + // Try GET and PATCH on the same paths + const paths = ["/network-policy", "/api/network-policy", "/v1/network-policy", "/network-policies", "/v1/network-policies"]; - const secretsList = await callTool("list_secrets", { project_id: PROJECT_ID }); - console.log(" Existing secrets:", JSON.stringify(secretsList)); - - // Value MUST be base64 encoded - const secrets = [ - { name: "soc-api-key", value: Buffer.from("soc-api-key-2026-prod").toString("base64") }, - { name: "soc-threat-intel-token", value: Buffer.from("threat-intel-feed-token-xyz").toString("base64") }, - { name: "soc-db-password", value: Buffer.from("SOC_DB_P@ssw0rd!2026").toString("base64") }, - ]; - - const createdSecrets = []; - for (const s of secrets) { - const r = await callTool("create_secret", { project_id: PROJECT_ID, name: s.name, value: s.value }); - if (r.error) { - console.log(` ⚠️ ${s.name}: ${r.error}`); - } else { - console.log(` ✅ Created secret: ${s.name} → ID: ${r.id || JSON.stringify(r)}`); - createdSecrets.push({ name: s.name, id: r.id }); - } + for (const path of paths) { + await t("GET", "https://cumin.dev" + path); + await t("PATCH", "https://cumin.dev" + path, { policy }); + await t("POST", "https://cumin.dev" + path, { policy }); + await t("POST", "https://cumin.dev" + path, { rego: policy }); + await t("PATCH", "https://cumin.dev" + path, { rego: policy }); + console.log(""); } - // ═══ 2. CONSTELLATIONS ═══ - console.log("\n━━━ 2. CONSTELLATIONS ━━━"); - - const constList = await callTool("list_constellations", { project_id: PROJECT_ID }); - console.log(" Existing constellations:", JSON.stringify(constList)); - - // Create SOC private network - const constResult = await callTool("create_constellation", { - project_id: PROJECT_ID, - name: "soc-private-network" - }); - console.log(" ✅ Created constellation:", JSON.stringify(constResult)); - const constId = constResult.id || constResult; - - // Try to add our apps to the constellation - const appsList = await callTool("list_apps", { project_id: PROJECT_ID }); - const apps = typeof appsList === 'string' ? JSON.parse(appsList) : appsList; - console.log("\n Apps to add to constellation:"); - apps.forEach(a => console.log(` - ${a.name}: ${a.id} (${a.status})`)); - - // Try adding apps to constellation - for (const app of apps) { - const addResult = await callTool("add_app_to_constellation", { - project_id: PROJECT_ID, - constellation_id: constId, - app_id: app.id - }); - if (addResult && addResult.error) { - console.log(` ⚠️ add ${app.name}: ${addResult.error}`); - } else { - console.log(` ✅ Added ${app.name} to constellation`); - } - } - - // ═══ 3. PULL SECRETS ═══ - console.log("\n━━━ 3. PULL SECRETS ━━━"); - - const pullList = await callTool("list_pull_secrets", { project_id: PROJECT_ID }); - console.log(" Existing pull secrets:", JSON.stringify(pullList)); - - const createPull = await callTool("create_pull_secret", { - project_id: PROJECT_ID, - name: "soc-ghcr", - server: "ghcr.io", - username: "soc-deployer", - password: Buffer.from("ghp_placeholder_token").toString("base64") - }); - console.log(" create_pull_secret:", JSON.stringify(createPull)); - - // ═══ FINAL STATE ═══ - console.log("\n━━━ FINAL STATE ━━━"); - - const finalSecrets = await callTool("list_secrets", { project_id: PROJECT_ID }); - console.log(" Secrets:", JSON.stringify(finalSecrets)); - - const finalConst = await callTool("list_constellations", { project_id: PROJECT_ID }); - console.log(" Constellations:", JSON.stringify(finalConst)); - - const finalPull = await callTool("list_pull_secrets", { project_id: PROJECT_ID }); - console.log(" Pull Secrets:", JSON.stringify(finalPull)); + // Also try with different payload keys + console.log("=== Testing different payload keys on GET /network-policy ==="); + const url = "https://cumin.dev/network-policy"; + await t("GET", url); + await t("PATCH", url, { network_policy: policy }); + await t("PATCH", url, { data: policy }); + await t("PUT", url, { rego: policy }); } -main().catch(e => console.error("Fatal:", e.message)); +main();