Npm access list update script

#!/usr/bin/env bash
set -euo pipefail

### ─── CONFIGURATION ────────────────────────────────────────────────────────
NPM_HOST="servers_local_ip"
NPM_PORT="port_its_on"

# your NPM admin credentials
ADMIN_EMAIL="npm_username"
ADMIN_PASS="npmpassword"

# the exact name of the ACL in NPM
ACL_NAME="accesslistname"

# service to fetch your current public IP
IP_SERVICE="https://api.ipify.org"

# API endpoints
LOGIN_URL="http://${NPM_HOST}:${NPM_PORT}/api/tokens"
ACL_LIST_URL="http://${NPM_HOST}:${NPM_PORT}/api/nginx/access-lists"
ACL_BASE_URL="${ACL_LIST_URL}"
### ──────────────────────────────────────────────────────────────────────────

echo
echo "---- STEP 1: Fetch current public IP from ${IP_SERVICE} ----"
CURRENT_IP=$(curl -fsS "${IP_SERVICE}")
if [[ ! $CURRENT_IP =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  echo "ERROR: could not parse a valid IPv4 from '${CURRENT_IP}'."
  exit 1
fi
echo "✔ Current WAN IP = ${CURRENT_IP}"
echo

echo "---- STEP 2: Log in to NPM to obtain JWT ----"
JWT_JSON=$(curl -fsS -X POST "${LOGIN_URL}" \
             -H "Content-Type: application/json" \
             -d "{\"identity\":\"${ADMIN_EMAIL}\",\"secret\":\"${ADMIN_PASS}\"}")
JWT_TOKEN=$(echo "$JWT_JSON" | jq -r '.token // empty')
if [[ -z "$JWT_TOKEN" ]]; then
  echo "ERROR: failed to retrieve JWT. Response was:"
  echo "$JWT_JSON" | jq .
  exit 2
fi
echo "✔ Obtained JWT"
echo

echo "---- STEP 3: List all Access Lists → find ID of '${ACL_NAME}' ----"
ACL_LIST_JSON=$(curl -fsS \
    -H "Authorization: Bearer ${JWT_TOKEN}" \
    "${ACL_LIST_URL}")
ACL_ID=$(echo "$ACL_LIST_JSON" | jq -r --arg NAME "$ACL_NAME" \
            '.[] | select(.name == $NAME) | .id')
if [[ -z "$ACL_ID" ]]; then
  echo "ERROR: could not locate an Access List named '${ACL_NAME}'."
  exit 3
fi
echo "✔ Found ACL '${ACL_NAME}' → ID = ${ACL_ID}"
echo

echo "---- STEP 4: GET full ACL details (to get satisfy_any & pass_auth) ----"
ACL_DETAIL_JSON=$(curl -fsS \
    -H "Authorization: Bearer ${JWT_TOKEN}" \
    "${ACL_BASE_URL}/${ACL_ID}")
EXISTING_SATISFY_ANY=$(echo "$ACL_DETAIL_JSON" | jq -r '.satisfy_any')
EXISTING_PASS_AUTH=$(echo "$ACL_DETAIL_JSON" | jq -r '.pass_auth')
echo "✔ Current ACL flags: satisfy_any = ${EXISTING_SATISFY_ANY}, pass_auth = ${EXISTING_PASS_AUTH}"
echo

echo "---- STEP 5: Build JSON payload (with your real WAN IP!) ----"
UPDATE_PAYLOAD=$(
  jq -c -n \
    --arg name   "$ACL_NAME" \
    --argjson sat "$EXISTING_SATISFY_ANY" \
    --argjson auth "$EXISTING_PASS_AUTH" \
    --arg    ip  "${CURRENT_IP}/32" \
    '{
      name:        $name,
      satisfy_any: $sat,
      pass_auth:   $auth,
      clients: [ { address: $ip, directive: "allow" } ]
    }'
)
echo "$UPDATE_PAYLOAD" | jq '.'   # for logging/verification
echo

echo "---- STEP 6: PUT /api/nginx/access-lists/${ACL_ID} with new clients ----"
UPDATE_RESPONSE=$(curl -fsS -X PUT "${ACL_BASE_URL}/${ACL_ID}" \
                    -H "Content-Type: application/json" \
                    -H "Authorization: Bearer ${JWT_TOKEN}" \
                    -d "$UPDATE_PAYLOAD")

if echo "$UPDATE_RESPONSE" | jq -e 'has("error")' >/dev/null; then
  echo "ERROR: API returned an error when updating. See response:"
  echo "$UPDATE_RESPONSE" | jq .
  exit 4
else
  echo "✅ Access List updated successfully: now allowing ${CURRENT_IP}/32"
fi

exit 0