fix: enforce box scoping for alarm list queries

cli/src/commands/alarms.js

@@ -1,5 +1,10 @@
 const { getClient, getClientV1, resolveBoxGid } = require('../api/client');
 
+const buildAlarmQuery = (gid, query) => {
+  const boxQuery = `box.id:${gid}`;
+  return query ? `${boxQuery} ${query}` : boxQuery;
+};
+
 const Alarms = {
   archive: async (aid, options) => {
     const gid = await resolveBoxGid(options.box, options);
@@ -28,13 +33,12 @@ const Alarms = {
   list: async (options) => {
     const gid = await resolveBoxGid(options.box, options);
     const client = getClient(options);
-    
-    let apiParams = { gid };
-    
+
+    const apiParams = {};
+
     // Only pass through supported API parameters
     if (options.params) {
       const parsedParams = JSON.parse(options.params);
-      // Filter to only supported parameters (limit, cursor, etc.)
       const supportedParams = ['limit', 'cursor', 'query', 'groupBy', 'sortBy'];
       supportedParams.forEach(param => {
         if (parsedParams[param] !== undefined) {
@@ -43,6 +47,11 @@ const Alarms = {
       });
     }
 
+    // GET /v2/alarms is MSP-wide. Enforce the selected box using the
+    // documented alarm search qualifier instead of an unsupported `gid`
+    // collection parameter.
+    apiParams.query = buildAlarmQuery(gid, apiParams.query);
+
     try {
       const { data } = await client.get('/alarms', { params: apiParams });
       console.log(JSON.stringify(data, null, 2));
@@ -53,3 +62,4 @@ const Alarms = {
 };
 
 module.exports = Alarms;
+module.exports.buildAlarmQuery = buildAlarmQuery;

package.json

@@ -7,7 +7,7 @@
     "fw": "./src/index.js"
   },
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "node --test"
   },
   "dependencies": {
     "axios": "^1.6.0",

test/alarms.test.js

@@ -0,0 +1,25 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const { buildAlarmQuery } = require('../cli/src/commands/alarms');
+
+test('scopes an alarm list query to the selected box', () => {
+  assert.equal(
+    buildAlarmQuery('box-a', undefined),
+    'box.id:box-a'
+  );
+});
+
+test('preserves additional alarm filters while enforcing the selected box', () => {
+  assert.equal(
+    buildAlarmQuery('box-a', 'status:active type:1'),
+    'box.id:box-a status:active type:1'
+  );
+});
+
+test('does not allow a caller-supplied box qualifier to replace the selected box', () => {
+  assert.equal(
+    buildAlarmQuery('box-a', 'box.id:box-b'),
+    'box.id:box-a box.id:box-b'
+  );
+});