feat: add AiLPHA security platform service

services/ailpha__platform/README.md

@@ -0,0 +1,49 @@
+# AiLPHA Security Platform
+
+OctoBus service package for the AiLPHA SIEM/SOC platform (V5.1) REST API.
+
+## Import
+
+```bash
+octobus service import --id ailpha-platform ./services/ailpha__platform
+```
+
+## Configuration
+
+Set `endpoint` to the platform base URL. `timeoutMs` (default 1500), `headers`, and `skipTlsVerify` are optional.
+
+`timeoutMs` is enforced with `AbortSignal.timeout`; `skipTlsVerify` uses a per-request undici dispatcher and does not change global TLS settings.
+
+```json
+{
+  "endpoint": "https://ailpha.example.com",
+  "timeoutMs": 3000
+}
+```
+
+Secret: `apiKey` sent as the `apiKey` HTTP header.
+
+```json
+{
+  "apiKey": "<api-key>"
+}
+```
+
+## Behavior
+
+- `ListMergeAlarms` calls `GET /openapi/v2.0/merge-alarms` with optional filters (`order_by`, `page`, `size`, `condition`, `connect_type`, `start_time`, `end_time`). Returns alarm list as Struct.
+- `GetMergeAlarmDetail` calls `GET /openapi/v1.0/merge-alarm/detail`. Requires `agg_condition` and `window_id`.
+- `UpdateMergeAlarmStatus` calls `POST /openapi/v2.0/merge-alarms/status`. Requires `alarm_status` and a selector (`condition` or `start_time`+`end_time`).
+- `ListLinkageStrategies` calls `GET /openapi/v1.0/linkage-strategies` to list blocking strategies.
+- `BlockIp` calls `POST /openapi/v1.0/linkage-strategies/{ids}/accessIp`.
+- `UnblockIp` calls `DELETE /openapi/v1.0/linkage-strategies/{ids}/blockIp`. Idempotent: 404 returns empty success.
+- Missing endpoint or API key returns `INVALID_ARGUMENT`. HTTP 401 maps to `UNAUTHENTICATED`. HTTP 403 maps to `PERMISSION_DENIED`. HTTP 404 (non-idempotent) maps to `NOT_FOUND`. Other 4xx maps to `FAILED_PRECONDITION`. Network errors and 5xx map to `UNAVAILABLE`.
+
+## Local Checks
+
+```bash
+cd services
+npm run validate -- --service-dir ailpha__platform
+npm test -- --service-dir ailpha__platform --coverage
+npm run pack:check
+```

services/ailpha__platform/bin/ailpha-platform.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+
+import { runServiceMain } from "@chaitin-ai/octobus-sdk";
+
+import { service } from "../src/service.js";
+
+runServiceMain(service);

services/ailpha__platform/config.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "endpoint": {
+      "type": "string",
+      "description": "AiLPHA platform base URL, for example https://ailpha.example.com (the /openapi paths are appended)."
+    },
+    "baseUrl": {
+      "type": "string",
+      "description": "Legacy alias for endpoint."
+    },
+    "headers": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      },
+      "description": "Optional extra HTTP headers sent to AiLPHA."
+    },
+    "timeoutMs": {
+      "type": "integer",
+      "minimum": 1,
+      "default": 1500,
+      "description": "HTTP timeout in milliseconds."
+    },
+    "skipTlsVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip TLS certificate verification for private AiLPHA deployments."
+    }
+  }
+}

services/ailpha__platform/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "ailpha-platform",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "bin": {
+    "ailpha-platform": "bin/ailpha-platform.js"
+  },
+  "dependencies": {
+    "@chaitin-ai/octobus-sdk": "^0.5.0",
+    "undici": "^7.16.0"
+  }
+}

services/ailpha__platform/proto/ailpha_platform.proto

@@ -0,0 +1,123 @@
+syntax = "proto3";
+
+package AiLPHA_Platform;
+
+import "google/protobuf/struct.proto";
+import "google/protobuf/wrappers.proto";
+
+option go_package = "miner/grpc-service/AiLPHA_Platform";
+
+// AiLPHA 安全分析与管理平台 (SIEM/SOC) - 归并告警查询/详情/处置 + 联动策略封禁/解封。
+// 认证：apiKey HTTP 头。响应形如 { "$page":N, "$size":N, "total":N, "data":... }，无 code/msg 信封，成败看 HTTP 状态码。
+// 大对象（告警/策略）字段繁多，统一用 google.protobuf.Struct 原样透传。
+service AiLPHA_Platform {
+  // GET /openapi/v2.0/merge-alarms — 归并告警列表查询（只读，核心）
+  rpc ListMergeAlarms(ListMergeAlarmsRequest) returns (ListMergeAlarmsResponse) {}
+
+  // GET /openapi/v1.0/merge-alarm/detail — 按 aggCondition + windowId 查询单条归并告警详情（只读）
+  rpc GetMergeAlarmDetail(GetMergeAlarmDetailRequest) returns (GetMergeAlarmDetailResponse) {}
+
+  // POST /openapi/v2.0/merge-alarms/status — 写：批量处置归并告警
+  rpc UpdateMergeAlarmStatus(UpdateMergeAlarmStatusRequest) returns (UpdateMergeAlarmStatusResponse) {}
+
+  // GET /openapi/v1.0/linkage-strategies — 联动策略列表（只读，用于获取策略 id）
+  rpc ListLinkageStrategies(ListLinkageStrategiesRequest) returns (ListLinkageStrategiesResponse) {}
+
+  // POST /openapi/v1.0/linkage-strategies/{ids}/accessIp — 写：对指定联动策略下发/生效 IP 阻断
+  rpc BlockIp(BlockIpRequest) returns (BlockIpResponse) {}
+
+  // DELETE /openapi/v1.0/linkage-strategies/{ids}/blockIp — 写：解除指定联动策略的 IP 阻断（缺失幂等）
+  rpc UnblockIp(UnblockIpRequest) returns (UnblockIpResponse) {}
+}
+
+// ============================ ListMergeAlarms ============================
+
+message ListMergeAlarmsRequest {
+  google.protobuf.StringValue order_by = 1;       // $orderBy，例 "endTime desc"，原样透传
+  google.protobuf.Int64Value page = 2;            // $page，>=1
+  google.protobuf.Int64Value size = 3;            // $size，1~1000
+  google.protobuf.StringValue cascade_org_id = 4; // cascadeOrgId 组织架构ID
+  google.protobuf.StringValue condition = 5;      // condition，AiQL 查询语句
+  string connect_type = 6;                        // connectType：ALL/DIRECT_CONNECT/ONLY_CURRENT；ALL 或空则省略
+  google.protobuf.StringValue end_time = 7;       // endTime "yyyy-MM-dd HH:mm:ss"，默认当天 23:59:59
+  google.protobuf.BoolValue field_mapping = 8;    // fieldMapping 是否属性映射
+  google.protobuf.StringValue params = 9;         // params
+  google.protobuf.StringValue start_time = 10;    // startTime，默认当天 00:00:00
+}
+
+message ListMergeAlarmsResponse {
+  int64 page = 1;                            // $page
+  int64 size = 2;                            // $size
+  int64 total = 3;                           // 总数
+  repeated google.protobuf.Struct data = 4; // 告警对象列表，原样透传
+  string order_by = 5;                       // $orderBy 实际生效排序
+}
+
+// ============================ GetMergeAlarmDetail ============================
+
+message GetMergeAlarmDetailRequest {
+  string agg_condition = 1; // aggCondition 归并字段MD5，必填
+  string window_id = 2;     // windowId 时间窗口id，必填
+}
+
+message GetMergeAlarmDetailResponse {
+  google.protobuf.Struct detail = 1; // 单条告警详情，原样透传
+}
+
+// ============================ UpdateMergeAlarmStatus ============================
+
+message UpdateMergeAlarmStatusRequest {
+  string alarm_status = 1;                       // alarmStatus 处置状态，必填，例 falsePositives/processed/unprocessed/ignored
+  google.protobuf.StringValue alarm_notes = 2;   // alarmNotes 处置备注
+  google.protobuf.StringValue alarm_source = 3;  // alarmSource 告警来源，例 MSS
+  google.protobuf.StringValue condition = 4;     // condition；与 start_time+end_time 二选一作为选择器
+  google.protobuf.StringValue start_time = 5;    // startTime
+  google.protobuf.StringValue end_time = 6;      // endTime
+  google.protobuf.StringValue url = 7;           // url
+}
+
+message UpdateMergeAlarmStatusResponse {
+  int64 page = 1;  // $page
+  int64 size = 2;  // $size
+  string data = 3; // 处置结果描述
+}
+
+// ============================ ListLinkageStrategies ============================
+
+message ListLinkageStrategiesRequest {
+  google.protobuf.StringValue order_by = 1; // $orderBy，可排序字段：blockIp/effectTime/status/linkDevice
+  google.protobuf.Int64Value page = 2;      // $page，>=1
+  google.protobuf.Int64Value size = 3;      // $size，1~1000
+  google.protobuf.StringValue age = 4;      // age
+}
+
+message ListLinkageStrategiesResponse {
+  int64 page = 1;                            // $page
+  int64 size = 2;                            // $size
+  int64 total = 3;                           // 总数
+  repeated google.protobuf.Struct data = 4; // 联动策略列表，原样透传
+}
+
+// ============================ BlockIp ============================
+
+message BlockIpRequest {
+  repeated string ids = 1; // 联动策略 id 列表，必填且非空；逗号拼接进 path，元素不可含 "/"
+}
+
+message BlockIpResponse {
+  int64 page = 1;  // $page
+  int64 size = 2;  // $size
+  string data = 3; // 操作结果描述
+}
+
+// ============================ UnblockIp ============================
+
+message UnblockIpRequest {
+  repeated string ids = 1; // 联动策略 id 列表，必填且非空
+}
+
+message UnblockIpResponse {
+  int64 page = 1;  // $page
+  int64 size = 2;  // $size
+  string data = 3; // 操作结果描述；策略不存在(404)时为空字符串（幂等）
+}

services/ailpha__platform/secret.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "apiKey": {
+      "type": "string",
+      "description": "AiLPHA API key (login token), sent as the apiKey HTTP header. Created via 用户管理 → 新增API Key."
+    },
+    "api_key": {
+      "type": "string",
+      "description": "Legacy alias for apiKey."
+    }
+  }
+}

services/ailpha__platform/service.json

@@ -0,0 +1,49 @@
+{
+  "schema": "chaitin.octobus.service.v1",
+  "name": "ailpha-platform",
+  "displayName": "AiLPHA Security Platform",
+  "description": "OctoBus package for the AiLPHA security analysis & management platform (SIEM/SOC): merged-alarm query/detail/disposition and linkage-strategy IP block/unblock through the /openapi REST API.",
+  "runtime": {
+    "mode": "long-running"
+  },
+  "proto": {
+    "roots": [
+      "proto"
+    ],
+    "files": [
+      "proto/ailpha_platform.proto"
+    ]
+  },
+  "configSchema": "config.schema.json",
+  "secretSchema": "secret.schema.json",
+  "sdk": {
+    "cli": {
+      "commands": {
+        "AiLPHA_Platform.AiLPHA_Platform/ListMergeAlarms": {
+          "name": "list-merge-alarms",
+          "description": "List AiLPHA merged alarms."
+        },
+        "AiLPHA_Platform.AiLPHA_Platform/GetMergeAlarmDetail": {
+          "name": "get-merge-alarm-detail",
+          "description": "Get an AiLPHA merged alarm detail."
+        },
+        "AiLPHA_Platform.AiLPHA_Platform/UpdateMergeAlarmStatus": {
+          "name": "update-merge-alarm-status",
+          "description": "Update (dispose) AiLPHA merged alarm status."
+        },
+        "AiLPHA_Platform.AiLPHA_Platform/ListLinkageStrategies": {
+          "name": "list-linkage-strategies",
+          "description": "List AiLPHA linkage strategies."
+        },
+        "AiLPHA_Platform.AiLPHA_Platform/BlockIp": {
+          "name": "block-ip",
+          "description": "Apply IP block on AiLPHA linkage strategies."
+        },
+        "AiLPHA_Platform.AiLPHA_Platform/UnblockIp": {
+          "name": "unblock-ip",
+          "description": "Remove IP block from AiLPHA linkage strategies."
+        }
+      }
+    }
+  }
+}