Confirm changes automatically from the client that made them

A change made over the network answers with a one-time confirm_token
and closes its connection (HTTP/2: a GOAWAY). The web UI and hc send the
token straight back to /confirm, which accepts it only for the newest
change, from the same user and API token, the same address, and over a
new connection: proof that the client can still reach the API through
the new ruleset (an established connection would get through anyway). A
change that cuts its client off can't be confirmed so, and rolls back by
itself. The setting manual_confirm (hc settings set --auto-confirm off)
and hc --no-confirm leave confirming to a person. Changes through the
local socket still need no confirmation. e2e: 136 checks, among them a
lockout change rolled back without anyone confirming.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/hc/main.go

@@ -37,14 +37,18 @@ func main() {
 
 // Global flags.
 var (
-	flagServer   string
-	flagToken    string
-	flagConfig   string
-	flagDryRun   bool
-	flagOutput   string
-	flagInsecure bool
-	flagCACert   string
-	flagQuiet    bool
+	flagServer    string
+	flagToken     string
+	flagConfig    string
+	flagDryRun    bool
+	flagOutput    string
+	flagInsecure  bool
+	flagCACert    string
+	flagQuiet     bool
+	flagNoConfirm bool
+	// lastClient is the client the command made (to confirm a change by
+	// itself after it).
+	lastClient *client.Client
 )
 
 // DefaultSocket is housecarld's local socket.
@@ -135,6 +139,7 @@ func newClient() (*client.Client, error) {
 	if err := setupChangeset(c); err != nil {
 		return nil, err
 	}
+	lastClient = c
 	return c, nil
 }
 
@@ -151,9 +156,10 @@ Changes are made at once; to review several and apply them together,
 stage them in a changeset ('hc changeset --help', -C ID or
 HOUSECARL_CHANGESET).
 
-A change made over the network is on probation: confirm it with 'hc
-confirm' (within 2 minutes by default) or it is rolled back by itself, so a
-change that cuts you off undoes itself. On the firewall itself, root uses
+A change made over the network is on probation: hc confirms it by itself
+once it reaches Housecarl again over a new connection, and a change that
+cuts you off can't be confirmed, so it is rolled back by itself (within 2
+minutes by default). --no-confirm leaves it to 'hc confirm'. On the firewall itself, root uses
 housecarld's local socket: no token, no probation. From elsewhere, set the
 server and an API token once:
 
@@ -175,6 +181,7 @@ Exit codes: 0 ok, 1 error, 3 not authenticated or not allowed, 4 not found,
 	pf.BoolVar(&flagInsecure, "insecure", false, "don't verify the server's TLS certificate")
 	pf.StringVar(&flagCACert, "ca-cert", "", "PEM file with a CA to trust for the server's certificate")
 	pf.BoolVarP(&flagQuiet, "quiet", "q", false, "print only errors (and IDs of new objects)")
+	pf.BoolVar(&flagNoConfirm, "no-confirm", false, "leave a change on probation instead of confirming it once this client reaches Housecarl again")
 	pf.Int64VarP(&flagChangeset, "changeset", "C", 0, "stage configuration changes in this changeset instead of applying them (env HOUSECARL_CHANGESET)")
 	root.AddGroup(&cobra.Group{ID: "fw", Title: "Firewall:"}, &cobra.Group{ID: "changes", Title: "Changes:"}, &cobra.Group{ID: "admin", Title: "Administration:"})
 	add := func(group string, cmds ...*cobra.Command) {
@@ -299,6 +306,19 @@ func exitCode(err error) int {
 	return 1
 }
 
+// autoConfirm confirms a change with its token: the request goes over a
+// new connection (the server closed the change's), so it gets through
+// only if the new ruleset still lets this client reach Housecarl.
+func autoConfirm(token string) error {
+	if lastClient == nil {
+		return errors.New("no client")
+	}
+	c, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	var out map[string]int
+	return lastClient.Do(c, "POST", "/confirm", nil, api.ConfirmInput{Token: token}, &out)
+}
+
 // report prints the outcome of a change.
 func report(resp *api.MutationResponse) error {
 	switch flagOutput {
@@ -343,6 +363,13 @@ func report(resp *api.MutationResponse) error {
 			fmt.Fprintln(w)
 		}
 		fmt.Fprintln(w, "dry run: nothing was changed")
+	case resp.Applied && resp.ConfirmBy != nil && resp.ConfirmToken != "" && !flagNoConfirm:
+		if err := autoConfirm(resp.ConfirmToken); err != nil {
+			fmt.Fprintf(w, "applied on probation (history %d), but couldn't confirm it: %v\nIt is rolled back within %s unless confirmed ('hc confirm')\n",
+				resp.HistoryID, err, time.Until(*resp.ConfirmBy).Round(time.Second))
+		} else if !flagQuiet {
+			fmt.Fprintf(w, "applied and confirmed (history %d): this client reached Housecarl again over a new connection\n", resp.HistoryID)
+		}
 	case resp.Applied && resp.ConfirmBy != nil:
 		fmt.Fprintf(w, "applied on probation (history %d): confirm with 'hc confirm' within %s, or it is rolled back\n",
 			resp.HistoryID, time.Until(*resp.ConfirmBy).Round(time.Second))