feat(services): add CTDSG FW service package

services/bin/ctdsg-fw.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { fileURLToPath } from "node:url";
+import { runServiceMain } from "@chaitin-ai/octobus-sdk";
+
+import { service } from "../ctdsg__fw/src/service.js";
+
+runServiceMain(service, {
+  entryFile: fileURLToPath(new URL("../ctdsg__fw/bin/ctdsg-fw.js", import.meta.url)),
+});

services/bin/octobus-tentacles.js

@@ -21,6 +21,10 @@ const services = {
     entryFile: "../chaitin__cloudatlas/bin/cloudatlas.js",
     serviceModule: "../chaitin__cloudatlas/src/service.js",
   },
+  "ctdsg-fw": {
+    entryFile: "../ctdsg__fw/bin/ctdsg-fw.js",
+    serviceModule: "../ctdsg__fw/src/service.js",
+  },
   "das-gateway-v3": {
     entryFile: "../das__gateway_v3/bin/das-gateway-v3.js",
     serviceModule: "../das__gateway_v3/src/service.js",

services/ctdsg__fw/README.md

@@ -0,0 +1,151 @@
+# CTDSG FW
+
+OctoBus service package for CTDSG blacklist IP and domain block or unblock APIs.
+
+## Import
+
+```bash
+octobus service import --id ctdsg-fw ./services//ctdsg__fw
+```
+
+## Behavior
+
+- `BlockIP` maps to `POST {host}/api.php/inter/Inter?opt=addPatchblack2` and sends a single-element JSON array with newline-separated `ip_area` entries.
+- `UnblockIP` maps to `POST {host}/api.php/inter/Inter?opt=delblack2` and sends newline-separated `name` entries.
+- `BlockDomain` maps to `POST {host}/api.php/inter/Inter?opt=addPatchblack2` and sends a single-element JSON array with newline-separated `domainname` entries.
+- `UnblockDomain` maps to `POST {host}/api.php/inter/Inter?opt=delblack2` and sends newline-separated `name` entries.
+- Requests are signed with CTDSG HMAC-MD5 headers: `hy-bz-api-app-id`, `hy-bz-api-timestamp`, and `hy-bz-api-signature`.
+- Self-signed device certificates are handled inside the adapter when `skipTlsVerify` / `tlsInsecureSkipVerify` / `insecureSkipVerify` is enabled.
+- HTTP responses are returned as normalized `DeviceHttpResponse` objects, including status, response headers, raw body, parsed JSON when available, and effective URL.
+
+## Gateway Setup
+
+Start the gateway:
+
+```bash
+./bin/octobus serve
+```
+
+Import the CTDSG service package:
+
+```bash
+./bin/octobus service import ctdsg-fw ./services//ctdsg__fw
+```
+
+Create and start a test instance:
+
+```bash
+./bin/octobus instance create ctdsg-fw-test \
+  --service ctdsg-fw \
+  --config-json '{"host":"https://10.211.194.22:9090","appId":"h*****","skipTlsVerify":true}' \
+  --secret-json '{"secretKey":"REDACTED"}'
+```
+
+Create a capset and expose the instance:
+
+```bash
+./bin/octobus capset create dev --name DevAgent
+./bin/octobus capset add-instance dev ctdsg-fw-test
+```
+
+Confirm the exposed catalog:
+
+```bash
+./bin/octobus catalog dev --all --json
+```
+
+## Connect RPC Calls
+
+### BlockIP
+
+```bash
+curl -X POST \
+  http://127.0.0.1:9000/capsets/dev/connect/ctdsg-fw-test/CTDSG_FW.CTDSG_FW/BlockIP \
+  -H 'Content-Type: application/json' \
+  -d '{"ips":["43.143.110.163"],"permanent":false,"punishTime":1,"timeUnit":1}'
+```
+
+### UnblockIP
+
+```bash
+curl -X POST \
+  http://127.0.0.1:9000/capsets/dev/connect/ctdsg-fw-test/CTDSG_FW.CTDSG_FW/UnblockIP \
+  -H 'Content-Type: application/json' \
+  -d '{"ips":["43.143.110.163"]}'
+```
+
+### BlockDomain
+
+```bash
+curl -X POST \
+  http://127.0.0.1:9000/capsets/dev/connect/ctdsg-fw-test/CTDSG_FW.CTDSG_FW/BlockDomain \
+  -H 'Content-Type: application/json' \
+  -d '{"domains":["fget-career.com"],"permanent":false,"punishTime":1,"timeUnit":1}'
+```
+
+### UnblockDomain
+
+```bash
+curl -X POST \
+  http://127.0.0.1:9000/capsets/dev/connect/ctdsg-fw-test/CTDSG_FW.CTDSG_FW/UnblockDomain \
+  -H 'Content-Type: application/json' \
+  -d '{"domains":["fget-career.com"]}'
+```
+
+## MCP Calls
+
+List tools:
+
+```bash
+curl -X POST http://127.0.0.1:9000/capsets/dev/mcp \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
+```
+
+Current tool names:
+
+- `ctdsg-fw__ctdsg-fw-test__block_domain`
+- `ctdsg-fw__ctdsg-fw-test__block_i_p`
+- `ctdsg-fw__ctdsg-fw-test__unblock_domain`
+- `ctdsg-fw__ctdsg-fw-test__unblock_i_p`
+
+Call `BlockIP` through MCP:
+
+```bash
+curl -X POST http://127.0.0.1:9000/capsets/dev/mcp \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"ctdsg-fw__ctdsg-fw-test__block_i_p","arguments":{"ips":["43.143.110.163"],"permanent":false,"punish_time":1,"time_unit":1}}}'
+```
+
+## What Is Already Verified
+
+Already verified against the real gateway + device path:
+
+- `BlockIP` ✅
+- `UnblockIP` ✅
+- `BlockDomain` ✅
+- `UnblockDomain` ✅
+
+Verified instance / capset used during testing:
+
+- capset: `dev`
+- instance: `ctdsg-fw-test`
+
+## Test Notes
+
+- For self-signed devices, set `skipTlsVerify: true` in the instance config.
+- `appId` and `secretKey` must match the device’s real configuration.
+- Preserve the following when collecting evidence for PRs:
+  - request body
+  - response body
+  - HTTP status
+  - `effectiveUrl`
+
+## Local Checks
+
+```bash
+cd services
+npm run validate -- --service-dir ctdsg__fw
+npm test -- --service-dir ctdsg__fw
+npm run pack:check
+```

services/ctdsg__fw/bin/ctdsg-fw.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { runServiceMain } from '@chaitin-ai/octobus-sdk';
+
+import { service } from '../src/service.js';
+
+runServiceMain(service);

services/ctdsg__fw/config.schema.json

@@ -0,0 +1,78 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "required": ["host", "appId"],
+  "properties": {
+    "host": {
+      "type": "string",
+      "description": "CTDSG management base URL with http(s) scheme and port, for example https://198.51.100.10:9090."
+    },
+    "restBaseUrl": {
+      "type": "string",
+      "description": "Alias for host."
+    },
+    "baseUrl": {
+      "type": "string",
+      "description": "Alias for host."
+    },
+    "rest_base_url": {
+      "type": "string",
+      "description": "Alias for host."
+    },
+    "base_url": {
+      "type": "string",
+      "description": "Alias for host."
+    },
+    "appId": {
+      "type": "string",
+      "description": "CTDSG signature app id. Must match the device configuration."
+    },
+    "app_id": {
+      "type": "string",
+      "description": "Alias for appId."
+    },
+    "apiPath": {
+      "type": "string",
+      "default": "/api.php/inter/Inter",
+      "description": "Management API path prefix."
+    },
+    "api_path": {
+      "type": "string",
+      "description": "Alias for apiPath."
+    },
+    "timeoutMs": {
+      "type": "integer",
+      "minimum": 1,
+      "default": 5000,
+      "description": "HTTP timeout in milliseconds."
+    },
+    "timeout_ms": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Alias for timeoutMs."
+    },
+    "skipTlsVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip TLS certificate verification for private deployments."
+    },
+    "tlsInsecureSkipVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Legacy alias for skipTlsVerify."
+    },
+    "insecureSkipVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Alias for skipTlsVerify."
+    },
+    "headers": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      },
+      "description": "Optional additional HTTP headers."
+    }
+  }
+}

services/ctdsg__fw/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "ctdsg-fw",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "bin": {
+    "ctdsg-fw": "bin/ctdsg-fw.js"
+  },
+  "dependencies": {
+    "@chaitin-ai/octobus-sdk": "^0.5.0"
+  }
+}

services/ctdsg__fw/proto/ctdsg_fw.proto

@@ -0,0 +1,50 @@
+syntax = "proto3";
+
+package CTDSG_FW;
+
+import "google/protobuf/struct.proto";
+import "google/protobuf/wrappers.proto";
+
+option go_package = "miner/grpc-service/CTDSG_FW";
+
+service CTDSG_FW {
+  rpc BlockIP(BlockIPRequest) returns (DeviceHttpResponse) {}
+  rpc UnblockIP(UnblockIPRequest) returns (DeviceHttpResponse) {}
+  rpc BlockDomain(BlockDomainRequest) returns (DeviceHttpResponse) {}
+  rpc UnblockDomain(UnblockDomainRequest) returns (DeviceHttpResponse) {}
+}
+
+message BlockIPRequest {
+  repeated string ips = 1;
+  google.protobuf.BoolValue permanent = 2;
+  google.protobuf.UInt32Value punish_time = 3;
+  google.protobuf.UInt32Value time_unit = 4;
+}
+
+message UnblockIPRequest {
+  repeated string ips = 1;
+}
+
+message BlockDomainRequest {
+  repeated string domains = 1;
+  google.protobuf.BoolValue permanent = 2;
+  google.protobuf.UInt32Value punish_time = 3;
+  google.protobuf.UInt32Value time_unit = 4;
+}
+
+message UnblockDomainRequest {
+  repeated string domains = 1;
+}
+
+message DeviceHttpResponse {
+  int32 status_code = 1;
+  repeated HttpHeader headers = 2;
+  string raw_body = 3;
+  google.protobuf.Struct body_json = 4;
+  string effective_url = 5;
+}
+
+message HttpHeader {
+  string key = 1;
+  repeated string values = 2;
+}

services/ctdsg__fw/secret.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "secretKey": {
+      "type": "string",
+      "description": "CTDSG HMAC-MD5 signing secret key."
+    },
+    "secret_key": {
+      "type": "string",
+      "description": "Alias for secretKey."
+    }
+  }
+}

services/ctdsg__fw/service.json

@@ -0,0 +1,41 @@
+{
+  "schema": "chaitin.octobus.service.v1",
+  "name": "ctdsg-fw",
+  "displayName": "CTDSG FW",
+  "description": "OctoBus package for CTDSG blacklist IP and domain block or unblock APIs.",
+  "runtime": {
+    "mode": "long-running"
+  },
+  "proto": {
+    "roots": [
+      "proto"
+    ],
+    "files": [
+      "proto/ctdsg_fw.proto"
+    ]
+  },
+  "configSchema": "config.schema.json",
+  "secretSchema": "secret.schema.json",
+  "sdk": {
+    "cli": {
+      "commands": {
+        "CTDSG_FW.CTDSG_FW/BlockIP": {
+          "name": "block-ip",
+          "description": "Add one or more IPs into the CTDSG blacklist."
+        },
+        "CTDSG_FW.CTDSG_FW/UnblockIP": {
+          "name": "unblock-ip",
+          "description": "Remove one or more IPs from the CTDSG blacklist."
+        },
+        "CTDSG_FW.CTDSG_FW/BlockDomain": {
+          "name": "block-domain",
+          "description": "Add one or more domains into the CTDSG blacklist."
+        },
+        "CTDSG_FW.CTDSG_FW/UnblockDomain": {
+          "name": "unblock-domain",
+          "description": "Remove one or more domains from the CTDSG blacklist."
+        }
+      }
+    }
+  }
+}