entitlements-github-plugin 0.6.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c8e5d4e8e883e7e4eb58cc3a8617ce223c6213ead611893bef473b5c95f509f
-  data.tar.gz: 45f3ca22502cffb65002c5bd651f60bab30e98c14c4f9588dfae0d43565abe73
+  metadata.gz: 693affbe3d5a82f2de418c8d892e3348543de2b11ade01021c5d70e1604e7737
+  data.tar.gz: a1275a50c6e8c02b9394b4198f88aeb8a2fe5916182e02784c32ea81ef095a97
 SHA512:
-  metadata.gz: d1ae84a3fa11c39758e813f6ce8ab1c7d4309ca3b3133ac05d324cfbb9a82161dc075892ff8970ef18c5b141e0b94fa3466cd6f2735c4cd57e5ac62f1df519e5
-  data.tar.gz: ea80b29e5bac4d316549ead1d04baaa3e8111f5baa69c97530c50089dbbafcdd86db1f1558976d4681199217ccc82c8411581f02e8f03d1d324a5956d5ca0540
+  metadata.gz: 1a1da49e107045a502174d53e751fba158fe76712d2f777027b12648f9587cdfef265fcfef65228a03f7ce426d0ceaa6d10b58d74628ed2f2f7f9b07f6cdf483
+  data.tar.gz: 98bf9fbf07473e4cf09da1a2d44433ff7801a52fd7073e8e5042a33fb15438f11a88647d1c71fbb4c893a0219ae209d4089d621e48619d4839562057af9ba0de

data/lib/entitlements/backend/github_team/service.rb

@@ -32,7 +32,7 @@ module Entitlements
           ou: String,
           ignore_not_found: C::Maybe[C::Bool],
         ] => C::Any
-        def initialize(addr: nil, org:, token:, ou:, ignore_not_found: false)
+        def initialize(org:, token:, ou:, addr: nil, ignore_not_found: false)
           super
           Entitlements.cache[:github_team_members] ||= {}
           Entitlements.cache[:github_team_members][org_signature] ||= {}
@@ -107,8 +107,8 @@ module Entitlements
                 end
 
                 maintainers = teamdata[:members].select { |u| teamdata[:roles][u] == "maintainer" }
-                team_metadata = team_metadata || {}
-                team_metadata = team_metadata.merge({"team_maintainers" => maintainers.any? ? maintainers.join(",") : nil})
+                team_metadata ||= {}
+                team_metadata = team_metadata.merge({ "team_maintainers" => maintainers.any? ? maintainers.join(",") : nil })
 
                 team = Entitlements::Backend::GitHubTeam::Models::Team.new(
                   team_id: teamdata[:team_id],
@@ -139,7 +139,7 @@ module Entitlements
         def from_predictive_cache?(entitlement_group)
           team_identifier = entitlement_group.cn.downcase
           read_team(entitlement_group) unless @team_cache[team_identifier]
-          (@team_cache[team_identifier] && @team_cache[team_identifier][:cache]) ? true : false
+          @team_cache[team_identifier] && @team_cache[team_identifier][:cache] ? true : false
         end
 
         # Declare the entry to be invalid for a specific team, and if the prior knowledge
@@ -192,7 +192,7 @@ module Entitlements
             if desired_metadata["parent_team_name"].nil?
               Entitlements.logger.debug "sync_team(team=#{current_state.team_name}): IGNORING GitHub Parent Team DELETE"
             else
-            # :nocov:
+              # :nocov:
               Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Parent team change found - From #{current_metadata["parent_team_name"] || "No Parent Team"} to #{desired_metadata["parent_team_name"]}"
               desired_parent_team_id = team_by_name(org_name: org, team_name: desired_metadata["parent_team_name"])[:id]
               unless desired_parent_team_id.nil?
@@ -240,17 +240,20 @@ module Entitlements
                 Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Textual change but no semantic change in maintainers. It is remains: #{current_maintainers.to_a}."
               else
                 Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Maintainer members change found - From #{current_maintainers.to_a} to #{desired_maintainers.to_a}"
-                added_maintainers.select! { |username| add_user_to_team(user: username, team: current_state, role: "maintainer") }
+                added_maintainers.select! do |username|
+                  add_user_to_team(user: username, team: current_state, role: "maintainer")
+                end
 
                 ## We only touch previous maintainers who are actually still going to be members of the team
                 removed_maintainers = removed_maintainers.intersection(desired_team_members)
                 ## Downgrade membership to default (role: "member")
-                removed_maintainers.select! { |username| add_user_to_team(user: username, team: current_state, role: "member") }
+                removed_maintainers.select! do |username|
+                  add_user_to_team(user: username, team: current_state, role: "member")
+                end
               end
             end
           end
 
-
           Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Added #{added_members.count}, removed #{removed_members.count}"
           added_members.any? || removed_members.any? || added_maintainers.any? || removed_maintainers.any? || changed_parent_team
         end
@@ -264,28 +267,41 @@ module Entitlements
                    entitlement_group: Entitlements::Models::Group,
                  ] => C::Bool
         def create_team(entitlement_group:)
+          team_name = entitlement_group.cn.downcase
+          team_options = { name: team_name, repo_names: [], privacy: "closed" }
+
           begin
-            team_name = entitlement_group.cn.downcase
-            team_options = { name: team_name, repo_names: [], privacy: "closed" }
+            entitlement_metadata = entitlement_group.metadata
+            unless entitlement_metadata["parent_team_name"].nil?
 
-            begin
-              entitlement_metadata = entitlement_group.metadata
-              unless entitlement_metadata["parent_team_name"].nil?
+              begin
                 parent_team_data = graphql_team_data(entitlement_metadata["parent_team_name"])
                 team_options[:parent_team_id] = parent_team_data[:team_id]
-                Entitlements.logger.debug "create_team(team=#{team_name}) Parent team #{entitlement_metadata["parent_team_name"]} with id #{parent_team_data[:team_id]} found"
+              rescue TeamNotFound
+                # if the parent team does not exist, create it (think `mkdir -p` logic here)
+                result = octokit.create_team(
+                  org,
+                  { name: entitlement_metadata["parent_team_name"], repo_names: [], privacy: "closed" }
+                )
+
+                Entitlements.logger.debug "created parent team #{entitlement_metadata["parent_team_name"]} with id #{result[:id]}"
+
+                team_options[:parent_team_id] = result[:id]
               end
-            rescue Entitlements::Models::Group::NoMetadata
-              Entitlements.logger.debug "create_team(team=#{team_name}) No metadata found"
-            end
 
-            Entitlements.logger.debug "create_team(team=#{team_name})"
-            octokit.create_team(org, team_options)
-            true
-          rescue Octokit::UnprocessableEntity => e
-            Entitlements.logger.debug "create_team(team=#{team_name}) ERROR - #{e.message}"
-            false
+              Entitlements.logger.debug "create_team(team=#{team_name}) Parent team #{entitlement_metadata["parent_team_name"]} with id #{team_options[:parent_team_id]} found"
+            end
+          rescue Entitlements::Models::Group::NoMetadata
+            Entitlements.logger.debug "create_team(team=#{team_name}) No metadata found"
           end
+
+          Entitlements.logger.debug "create_team(team=#{team_name})"
+          result = octokit.create_team(org, team_options)
+          Entitlements.logger.debug "created team #{team_name} with id #{result[:id]}"
+          true
+        rescue Octokit::UnprocessableEntity => e
+          Entitlements.logger.debug "create_team(team=#{team_name}) ERROR - #{e.message}"
+          false
         end
 
         # Update a team
@@ -298,15 +314,14 @@ module Entitlements
                    metadata: C::Or[Hash, nil]
                  ] => C::Bool
         def update_team(team:, metadata: {})
-          begin
-            Entitlements.logger.debug "update_team(team=#{team.team_name})"
-            options = { name: team.team_name, repo_names: [], privacy: "closed", parent_team_id: metadata[:parent_team_id] }
-            octokit.update_team(team.team_id, options)
-            true
-          rescue Octokit::UnprocessableEntity => e
-            Entitlements.logger.debug "update_team(team=#{team.team_name}) ERROR - #{e.message}"
-            false
-          end
+          Entitlements.logger.debug "update_team(team=#{team.team_name})"
+          options = { name: team.team_name, repo_names: [], privacy: "closed",
+                      parent_team_id: metadata[:parent_team_id] }
+          octokit.update_team(team.team_id, options)
+          true
+        rescue Octokit::UnprocessableEntity => e
+          Entitlements.logger.debug "update_team(team=#{team.team_name}) ERROR - #{e.message}"
+          false
         end
 
         # Gets a team by name
@@ -332,7 +347,8 @@ module Entitlements
         # team_slug - Identifier of the team to retrieve.
         #
         # Returns a data structure with team data.
-        Contract String => { members: C::ArrayOf[String], team_id: Integer, parent_team_name: C::Or[String, nil], roles: C::HashOf[String => String] }
+        Contract String => { members: C::ArrayOf[String], team_id: Integer, parent_team_name: C::Or[String, nil],
+                             roles: C::HashOf[String => String] }
         def graphql_team_data(team_slug)
           cursor = nil
           team_id = nil
@@ -370,9 +386,7 @@ module Entitlements
             end
 
             team = response[:data].fetch("data").fetch("organization").fetch("team")
-            if team.nil?
-              raise TeamNotFound, "Requested team #{team_slug} does not exist in #{org}!"
-            end
+            raise TeamNotFound, "Requested team #{team_slug} does not exist in #{org}!" if team.nil?
 
             team_id = team.fetch("databaseId")
             parent_team_name = team.dig("parentTeam", "slug")
@@ -390,6 +404,7 @@ module Entitlements
 
             cursor = edges.last.fetch("cursor")
             next if cursor && buffer.size == max_graphql_results
+
             break
           end
 
@@ -415,6 +430,7 @@ module Entitlements
             team_data[:slug]
           end
           return if @validation_cache[team_id] == team_slug
+
           raise "validate_team_id_and_slug! mismatch: team_id=#{team_id} expected=#{team_slug.inspect} got=#{@validation_cache[team_id].inspect}"
         end
 
@@ -432,10 +448,11 @@ module Entitlements
         ] => C::Bool
         def add_user_to_team(user:, team:, role: "member")
           return false unless org_members.include?(user.downcase)
-          unless role == "member" || role == "maintainer"
+          unless ["member", "maintainer"].include?(role)
             # :nocov:
             raise "add_user_to_team role mismatch: team_id=#{team.team_id} user=#{user} expected role=maintainer/member got=#{role}"
           end
+
           Entitlements.logger.debug "#{identifier} add_user_to_team(user=#{user}, org=#{org}, team_id=#{team.team_id}, role=#{role})"
           validate_team_id_and_slug!(team.team_id, team.team_name)
 
@@ -462,6 +479,7 @@ module Entitlements
         ] => C::Bool
         def remove_user_from_team(user:, team:)
           return false unless org_members.include?(user.downcase)
+
           Entitlements.logger.debug "#{identifier} remove_user_from_team(user=#{user}, org=#{org}, team_id=#{team.team_id})"
           validate_team_id_and_slug!(team.team_id, team.team_name)
           octokit.remove_team_membership(team.team_id, user)

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "0.6.0"
+    VERSION = "1.0.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-github-plugin
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 1.0.0
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-04-03 00:00:00.000000000 Z
+date: 2024-05-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: contracts
@@ -72,98 +72,104 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 13.0.6
+        version: '13.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 13.2.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 13.0.6
+        version: '13.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 13.2.1
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
         version: 3.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
         version: 3.8.0
 - !ruby/object:Gem::Dependency
-  name: rspec-core
+  name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.0
+        version: '1.64'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.0
+        version: '1.64'
 - !ruby/object:Gem::Dependency
-  name: rubocop
+  name: rubocop-github
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.62.1
+        version: '0.20'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.62.1
+        version: '0.20'
 - !ruby/object:Gem::Dependency
-  name: rubocop-github
+  name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.0
+        version: '1.21'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.0
+        version: '1.21'
 - !ruby/object:Gem::Dependency
-  name: rubocop-performance
+  name: ruby-lsp
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.20.2
+        version: 0.16.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.20.2
+        version: 0.16.7
 - !ruby/object:Gem::Dependency
   name: rugged
   requirement: !ruby/object:Gem::Requirement
@@ -188,28 +194,34 @@ dependencies:
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.16.1
+        version: 0.22.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.16.1
+        version: 0.22.0
 - !ruby/object:Gem::Dependency
   name: simplecov-erb
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.1
 - !ruby/object:Gem::Dependency
@@ -233,6 +245,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.23'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.23.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -240,6 +255,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.23'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.23.1
 description: Entitlements plugin to manage GitHub Orgs and Team memberships and access
 email: security@github.com
 executables: []
@@ -269,14 +287,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
+rubygems_version: 3.5.9
 signing_key: 
 specification_version: 4
 summary: GitHub dotcom provider for entitlements-app