# Create a virtual environment (optional but recommended)
python -m venv papercut-patch-env
source papercut-patch-env/bin/activate   # Windows: papercut-patch-env\Scripts\activate

# Install the HTTP client and a tiny version‑parsing helper
pip install requests packaging

# Initialize a new Node project (if you don’t have one)
npm init -y

# Install axios (HTTP client) and semver (version compare)
npm install axios semver
# For TypeScript you also need the type definitions
npm install --save-dev @types/node @types/axios @types/semver ts-node typescript
# Create a basic tsconfig.json if needed
npx tsc --init --rootDir . --outDir dist --esModuleInterop

#!/usr/bin/env python3
"""
PaperCut Zero‑Day Patch Verifier & Applier
-----------------------------------------
- Retrieves the current PaperCut NG/MF version via REST API.
- Compares it to the minimum patched version (hard‑coded or env var).
- If outdated, attempts to apply the emergency patch via the API.
- Exits with code 0 on success, non‑zero on failure.
"""

import os
import sys
import logging
from packaging import version
import requests

# -------------------------- Configuration --------------------------
# These can also be overridden by environment variables (see Step 4)
BASE_URL = os.getenv("PAPERCUT_BASE_URL", "https://paper-cut.example.com:9191")
API_KEY = os.getenv("PAPERCUT_API_KEY", "")  # Must be set!
# Minimum version that includes the emergency fix (adjust if vendor changes)
MIN_PATCHED_VERSION = os.getenv("PAPERCUT_MIN_PATCHED", "20.2.5")
# Optional: disable TLS verification for self‑signed certs (NOT for prod)
VERIFY_TLS = os.getenv("PAPERCUT_VERIFY_TLS", "true").lower() != "false"

# -------------------------- Logging Setup --------------------------
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s %(levelname)s %(message)s",
    handlers=[logging.StreamHandler(sys.stdout)],
)
log = logging.getLogger(__name__)

# -------------------------- Helper Functions --------------------------
def _api_headers() -> dict:
    """Return headers required for PaperCut REST API calls."""
    return {
        "Accept": "application/json",
        "X-Api-Key": API_KEY,
    }

def get_server_version() -> str:
    """Query PaperCut for its current version."""
    url = f"https://icarax.com/api/v1/server/status"
    log.info(f"Fetching server version from {url}")
    try:
        resp = requests.get(url, headers=_api_headers(), timeout=10, verify=VERIFY_TLS)
        resp.raise_for_status()
    except requests.RequestException as exc:
        log.error(f"Failed to contact PaperCut API: {exc}")
        sys.exit(1)

    data = resp.json()
    # Expected shape: {"version": "20.2.4", "build": "12345", ...}
    version_str = data.get("version")
    if not version_str:
        log.error("API response missing 'version' field")
        sys.exit(1)
    log.info(f"PaperCut reports version: {version_str}")
    return version_str

def is_patched(current: str, minimum: str) -> bool:
    """Semantic version check: current >= minimum."""
    return version.parse(current) >= version.parse(minimum)

def apply_patch() -> bool:
    """Trigger the emergency patch installation via API."""
    url = f"{BASE_URL}/api/v1/server/apply-patch"
    log.info(f"Requesting patch application at {url}")
    try:
        resp = requests.post(
            url,
            headers=_api_headers(),
            json={"force": False},  # let PaperCut decide if reboot needed
            timeout=30,
            verify=VERIFY_TLS,
        )
        resp.raise_for_status()
    except requests.RequestException as exc:
        log.error(f"Patch request failed: {exc}")
        return False

    # Some installations return a job ID; we just check for 2xx.
    log.info("Patch request accepted by PaperCut.")
    return True

# -------------------------- Main Workflow --------------------------
def main() -> None:
    if not API_KEY:
        log.error("PAPERCUT_API_KEY environment variable is not set.")
        sys.exit(1)

    current_version = get_server_version()
    if is_patched(current_version, MIN_PATCHED_VERSION):
        log.info("Server is already patched. No action required.")
        sys.exit(0)

    log.warning(
        f"Version {current_version} is older than the required {MIN_PATCHED_VERSION}."
    )
    if apply_patch():
        log.info("Patch successfully applied. Consider rebooting the server.")
        sys.exit(0)
    else:
        log.error("Patch application failed. Check logs and apply manually.")
        sys.exit(1)


if __name__ == "__main__":
    main()

#!/usr/bin/env node
/**
 * PaperCut Zero‑Day Patch Verifier & Applier (Node/TS)
 * ---------------------------------------------------
 * Same logic as the Python version but using axios + semver.
 */

import axios from "axios";
import semver from "semver";
import { readFileSync } from "fs";
import { resolve } from "path";
import { config } from "dotenv";

// Load .env file (optional but convenient)
config();

/* -------------------------- Configuration -------------------------- */
const BASE_URL: string = process.env.PAPERCUT_BASE_URL ?? "https://paper-cut.example.com:9191";
const API_KEY: string = process.env.PAPERCUT_API_KEY ?? "";
const MIN_PATCHED_VERSION: string = process.env.PAPERCUT_MIN_PATCHED ?? "20.2.5";
const VERIFY_TLS: boolean = process.env.PAPERCUT_VERIFY_TLS?.toLowerCase() !== "false";

if (!API_KEY) {
  console.error("❌ PAPERCUT_API_KEY environment variable is required.");
  process.exit(1);
}

/* -------------------------- Axios Instance -------------------------- */
const api = axios.create({
  baseURL: BASE_URL,
  timeout: 10_000,
  headers: {
    Accept: "application/json",
    "X-Api-Key": API_KEY,
  },
  httpsAgent: undefined, // let Node decide; set to a custom agent if you need to ignore certs
});

/* -------------------------- Helper Functions -------------------------- */
async function getServerVersion(): Promise<string> {
  try {
    const { data } = await api.get("/api/v1/server/status");
    const versionStr = data.version as string;
    if (!versionStr) throw new Error("Missing 'version' in response");
    console.log(`🔎 PaperCut reports version: ${versionStr}`);
    return versionStr;
  } catch (err: any) {
    if (axios.isAxiosError(err)) {
      console.error(`❌ API request failed: ${err.message}`);
    } else {
      console.error(`❌ Unexpected error: ${err}`);
    }
    process.exit(1);
  }
}

function isPatched(current: string, minimum: string): boolean {
  return semver.gte(current, minimum);
}

async function applyPatch(): Promise<boolean> {
  try {
    const { data } = await api.post("/api/v1/server/apply-patch", { force: false });
    console.log("🛠️ Patch request accepted by PaperCut.", data);
    return true;
  } catch (err: any) {
    if (axios.isAxiosError(err)) {
      console.error(`❌ Patch request failed: ${err.response?.data ?? err.message}`);
    } else {
      console.error(`❌ Unexpected error: ${err}`);
    }
    return false;
  }
}

/* -------------------------- Main Workflow -------------------------- */
(async () => {
  const currentVersion = await getServerVersion();

  if (isPatched(currentVersion, MIN_PATCHED_VERSION)) {
    console.log(`✅ Server is already patched (≥ ${MIN_PATCHED_VERSION}).`);
    process.exit(0);
  }

  console.warn(
    `⚠️ Version ${currentVersion} is older than the required ${MIN_PATCHED_VERSION}.`
  );

  const patched = await applyPatch();
  if (patched) {
    console.log(
      `✅ Patch applied successfully. A server reboot may be required to complete the update.`
    );
    process.exit(0);
  } else {
    console.error("❌ Patch application failed. Please apply the patch manually via the admin console.");
    process.exit(1);
  }
})();

export PAPERCUT_BASE_URL="https://paper-cut.example.com:9191"
export PAPERCUT_API_KEY="your‑admin‑api‑key"
export PAPERCUT_MIN_PATCHED="20.2.5"
export PAPERCUT_VERIFY_TLS="true"