@grc-claw/integration-marketplace 0.8.0

package/dist/connectors/AzureADConnector.js

@@ -0,0 +1,115 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "aad-conditional-access",
+        name: "Conditional Access Policies",
+        description: "Fetch Azure AD conditional access policies",
+        evidenceCategories: ["access_control"],
+    },
+    {
+        id: "aad-mfa-enrollment",
+        name: "MFA Enrollment",
+        description: "Fetch MFA enrollment statistics and per-user MFA status",
+        evidenceCategories: ["authentication"],
+    },
+    {
+        id: "aad-app-registrations",
+        name: "App Registrations",
+        description: "Fetch app registrations and service principals",
+        evidenceCategories: ["access_control", "application_security"],
+    },
+];
+export class AzureADConnector {
+    id = "azure-ad";
+    name = "Azure Active Directory";
+    category = "identity";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "HIPAA",
+    ];
+    async getAccessToken(config) {
+        const resp = await fetch(`https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+                scope: "https://graph.microsoft.com/.default",
+            }),
+        });
+        if (!resp.ok)
+            throw new Error(`Azure AD token ${resp.status}`);
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getAccessToken(config);
+            const resp = await fetch("https://graph.microsoft.com/v1.0/$metadata", {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getAccessToken(config);
+        const headers = { Authorization: `Bearer ${token}` };
+        const policies = await fetch("https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies", { headers }).then((r) => r.json());
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "aad-conditional-access",
+            timestamp: now,
+            hash: hashEvidence(policies),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "azure-ad/conditionalAccess/policies",
+            status: (policies.value || []).length > 0 ? "compliant" : "non_compliant",
+            data: { policyCount: (policies.value || []).length, policies: policies.value },
+            metadata: { tenantId: config.tenantId || "" },
+        });
+        const mfaReport = await fetch("https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails?$select=isMfaRegistered,isMfaCapable", { headers }).then((r) => r.json());
+        const users = (mfaReport.value || []);
+        const mfaRegistered = users.filter((u) => u.isMfaRegistered === true).length;
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "aad-mfa-enrollment",
+            timestamp: now,
+            hash: hashEvidence(mfaReport),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "azure-ad/authenticationMethods/userRegistrationDetails",
+            status: users.length > 0 && mfaRegistered / users.length > 0.9 ? "compliant" : "partial",
+            data: { totalUsers: users.length, mfaRegistered, mfaCapable: users.filter((u) => u.isMfaCapable === true).length },
+            metadata: { tenantId: config.tenantId || "" },
+        });
+        const apps = await fetch("https://graph.microsoft.com/v1.0/applicationRegistrations", {
+            headers,
+        }).then((r) => r.json());
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "aad-app-registrations",
+            timestamp: now,
+            hash: hashEvidence(apps),
+            framework: "ISO27001",
+            controlId: "A.14.2.5",
+            source: "azure-ad/applicationRegistrations",
+            status: "unknown",
+            data: { appCount: (apps.value || []).length, apps: apps.value },
+            metadata: { tenantId: config.tenantId || "" },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/AzureDevOpsConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class AzureDevOpsConnector implements IntegrationConnector {
+    readonly id = "azure_devops";
+    readonly name = "Azure DevOps";
+    readonly category: "ci_cd";
+    readonly authType: "bearer_token";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/AzureDevOpsConnector.js

@@ -0,0 +1,130 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "ado-pipelines",
+        name: "Pipeline Definitions",
+        description: "Fetch Azure DevOps pipeline definitions and run history",
+        evidenceCategories: ["ci_cd", "change_management"],
+    },
+    {
+        id: "ado-repos",
+        name: "Repository Settings",
+        description: "Fetch repo branch policies and access control lists",
+        evidenceCategories: ["version_control", "access_control"],
+    },
+    {
+        id: "ado-builds",
+        name: "Build Artifacts",
+        description: "Fetch build artifact integrity and retention policies",
+        evidenceCategories: ["ci_cd", "data_protection"],
+    },
+    {
+        id: "ado-pr",
+        name: "Pull Request Policies",
+        description: "Fetch PR merge policies and required reviewers",
+        evidenceCategories: ["change_management", "access_control"],
+    },
+];
+export class AzureDevOpsConnector {
+    id = "azure_devops";
+    name = "Azure DevOps";
+    category = "ci_cd";
+    authType = "bearer_token";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "PCI_DSS",
+    ];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://dev.azure.com";
+        const org = config.extra?.org || "default";
+        const resp = await fetch(`${base}/${org}/_apis${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                Accept: "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Azure DevOps API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            const org = config.extra?.org || "default";
+            await this.fetchApi(config, "/core/teams?api-version=7.0");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const org = config.extra?.org || "default";
+        const project = config.extra?.project || "default";
+        const pipelines = await this.fetchApi(config, `/build/definitions?api-version=7.0&searchFilter=owner&path=/`).catch(() => ({ count: 0, value: [] }));
+        const pipelineList = Array.isArray(pipelines.value) ? pipelines.value : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "ado-pipelines",
+            timestamp: now,
+            hash: hashEvidence({ count: pipelineList.length }),
+            framework: "SOC2",
+            controlId: "CC8.1",
+            source: `azure-devops/${org}/${project}/pipelines`,
+            status: pipelineList.length > 0 ? "compliant" : "partial",
+            data: { pipelineCount: pipelineList.length },
+            metadata: { org, project },
+        });
+        const repos = await this.fetchApi(config, `/git/repositories?api-version=7.0`).catch(() => ({ count: 0, value: [] }));
+        const repoList = Array.isArray(repos.value) ? repos.value : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "ado-repos",
+            timestamp: now,
+            hash: hashEvidence({ count: repoList.length }),
+            framework: "ISO27001",
+            controlId: "A.12.1.1",
+            source: `azure-devops/${org}/${project}/repos`,
+            status: repoList.length > 0 ? "compliant" : "partial",
+            data: { repositoryCount: repoList.length },
+            metadata: { org, project },
+        });
+        const builds = await this.fetchApi(config, `/build/builds?api-version=7.0&top=10&resultFilter=succeeded,failed`).catch(() => ({ count: 0, value: [] }));
+        const buildList = Array.isArray(builds.value) ? builds.value : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "ado-builds",
+            timestamp: now,
+            hash: hashEvidence({ count: buildList.length }),
+            framework: "NIST_CSF",
+            controlId: "PR.DS",
+            source: `azure-devops/${org}/${project}/builds`,
+            status: buildList.length > 0 ? "compliant" : "partial",
+            data: { recentBuilds: buildList.length },
+            metadata: { org, project },
+        });
+        const prPolicies = await this.fetchApi(config, `/git/policies/configurations?api-version=7.0`).catch(() => ({ count: 0, value: [] }));
+        const prList = Array.isArray(prPolicies.value) ? prPolicies.value : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "ado-pr",
+            timestamp: now,
+            hash: hashEvidence({ count: prList.length }),
+            framework: "PCI_DSS",
+            controlId: "6.5.2",
+            source: `azure-devops/${org}/${project}/pr-policies`,
+            status: prList.length > 0 ? "compliant" : "partial",
+            data: { policyCount: prList.length },
+            metadata: { org, project },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/AzureDevOpsPipelinesConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class AzureDevOpsPipelinesConnector implements IntegrationConnector {
+    readonly id = "azuredevops-pipelines";
+    readonly name = "Azure DevOps Pipelines";
+    readonly category: "ci_cd";
+    readonly authType: "bearer_token";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/AzureDevOpsPipelinesConnector.js

@@ -0,0 +1,72 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "azuredevops-pipelines",
+        name: "Build Pipelines",
+        description: "Fetch Azure DevOps pipeline definitions and run history",
+        evidenceCategories: ["ci_cd", "change_management"],
+    },
+    {
+        id: "azuredevops-releases",
+        name: "Release Pipelines",
+        description: "Fetch release pipeline configurations and deployment approvals",
+        evidenceCategories: ["ci_cd", "access_control"],
+    },
+    {
+        id: "azuredevops-security",
+        name: "Pipeline Security",
+        description: "Fetch pipeline permissions, service connections, and variable groups",
+        evidenceCategories: ["access_control", "secret_management"],
+    },
+];
+export class AzureDevOpsPipelinesConnector {
+    id = "azuredevops-pipelines";
+    name = "Azure DevOps Pipelines";
+    category = "ci_cd";
+    authType = "bearer_token";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async fetchApi(config, endpoint) {
+        const org = config.extra?.org || "default";
+        const base = config.baseUrl || `https://dev.azure.com/${org}`;
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Azure DevOps API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/_apis/projects?api-version=7.0&$top=1");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const project = config.extra?.project || "default";
+        const pipelines = await this.fetchApi(config, `/${project}/_apis/pipelines?api-version=7.0`).catch(() => ({ value: [] }));
+        const pipelineList = (pipelines.value || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "azuredevops-pipelines",
+            timestamp: now,
+            hash: hashEvidence({ pipelineCount: pipelineList.length }),
+            framework: "SOC2",
+            controlId: "CC8.1",
+            source: "azuredevops/pipelines",
+            status: pipelineList.length > 0 ? "compliant" : "unknown",
+            data: { pipelineCount: pipelineList.length },
+            metadata: { project },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/AzurePipelinesConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class AzurePipelinesConnector implements IntegrationConnector {
+    readonly id = "azure-pipelines";
+    readonly name = "Azure Pipelines";
+    readonly category: "ci_cd";
+    readonly authType: "bearer_token";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/AzurePipelinesConnector.js

@@ -0,0 +1,72 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "azurepipelines-builds",
+        name: "Build Pipelines",
+        description: "Fetch Azure Pipelines build definitions and execution history",
+        evidenceCategories: ["ci_cd", "change_management"],
+    },
+    {
+        id: "azurepipelines-releases",
+        name: "Release Pipelines",
+        description: "Fetch release pipeline configurations and approval gates",
+        evidenceCategories: ["ci_cd", "access_control"],
+    },
+    {
+        id: "azurepipelines-service-connections",
+        name: "Service Connections",
+        description: "Fetch service connection authorizations and shared variables",
+        evidenceCategories: ["access_control", "secret_management"],
+    },
+];
+export class AzurePipelinesConnector {
+    id = "azure-pipelines";
+    name = "Azure Pipelines";
+    category = "ci_cd";
+    authType = "bearer_token";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async fetchApi(config, endpoint) {
+        const org = config.extra?.org || "default";
+        const project = config.extra?.project || "default";
+        const base = config.baseUrl || `https://dev.azure.com/${org}/${project}/_apis`;
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Azure Pipelines API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/build/builds?api-version=7.0&$top=1");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const builds = await this.fetchApi(config, "/build/builds?api-version=7.0&$top=100").catch(() => ({ value: [] }));
+        const buildList = (builds.value || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "azurepipelines-builds",
+            timestamp: now,
+            hash: hashEvidence({ buildCount: buildList.length }),
+            framework: "SOC2",
+            controlId: "CC8.1",
+            source: "azure-pipelines/builds",
+            status: "unknown",
+            data: { buildCount: buildList.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/AzurePolicyConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class AzurePolicyConnector implements IntegrationConnector {
+    readonly id = "azure_policy";
+    readonly name = "Azure Policy";
+    readonly category: "cloud_provider";
+    readonly authType: "oauth2";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private getToken;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/AzurePolicyConnector.js

@@ -0,0 +1,141 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "az-policy-compliance",
+        name: "Policy Compliance State",
+        description: "Fetch Azure Policy compliance state per scope",
+        evidenceCategories: ["compliance", "configuration"],
+    },
+    {
+        id: "az-policy-assignments",
+        name: "Policy Assignments",
+        description: "Fetch assigned policies and initiatives across management groups",
+        evidenceCategories: ["configuration", "access_control"],
+    },
+    {
+        id: "az-policy-remediation",
+        name: "Remediation Tasks",
+        description: "Fetch policy remediation task status and non-compliant resources",
+        evidenceCategories: ["change_management", "compliance"],
+    },
+    {
+        id: "az-policy-deny",
+        name: "Deny Effect Evaluations",
+        description: "Fetch deny-effect policy evaluation results",
+        evidenceCategories: ["access_control", "configuration"],
+    },
+];
+export class AzurePolicyConnector {
+    id = "azure_policy";
+    name = "Azure Policy";
+    category = "cloud_provider";
+    authType = "oauth2";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "HIPAA",
+        "CIS",
+    ];
+    async getToken(config) {
+        if (config.apiToken)
+            return config.apiToken;
+        const resp = await fetch(`https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: config.clientId || "",
+                client_secret: config.clientSecret || "",
+                scope: "https://management.azure.com/.default",
+            }),
+        });
+        const data = (await resp.json());
+        return data.access_token;
+    }
+    async testConnection(config) {
+        try {
+            const token = await this.getToken(config);
+            const resp = await fetch("https://management.azure.com/subscriptions?api-version=2020-01-01", { headers: { Authorization: `Bearer ${token}` } });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const token = await this.getToken(config);
+        const subscriptionId = config.extra?.subscriptionId || "default";
+        const scope = `/subscriptions/${subscriptionId}`;
+        const complianceState = await fetch(`https://management.azure.com${scope}/providers/Microsoft.PolicyInsights/policyStates/latest/summarizeByPolicyGroup?api-version=2021-10-01`, { headers: { Authorization: `Bearer ${token}` } })
+            .then((r) => r.json())
+            .catch(() => ({ value: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "az-policy-compliance",
+            timestamp: now,
+            hash: hashEvidence(complianceState),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: `azure/policy/${subscriptionId}/compliance`,
+            status: "compliant",
+            data: { policyGroups: Array.isArray(complianceState.value) ? complianceState.value.length : 0 },
+            metadata: { subscriptionId },
+        });
+        const assignments = await fetch(`https://management.azure.com${scope}/providers/Microsoft.Authorization/policyAssignments?api-version=2021-06-01`, { headers: { Authorization: `Bearer ${token}` } })
+            .then((r) => r.json())
+            .catch(() => ({ value: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "az-policy-assignments",
+            timestamp: now,
+            hash: hashEvidence(assignments),
+            framework: "ISO27001",
+            controlId: "A.12.1.1",
+            source: `azure/policy/${subscriptionId}/assignments`,
+            status: Array.isArray(assignments.value) && assignments.value.length > 0
+                ? "compliant"
+                : "partial",
+            data: { assignmentCount: Array.isArray(assignments.value) ? assignments.value.length : 0 },
+            metadata: { subscriptionId },
+        });
+        const remediations = await fetch(`https://management.azure.com${scope}/providers/Microsoft.PolicyInsights/remediations?api-version=2021-10-01`, { headers: { Authorization: `Bearer ${token}` } })
+            .then((r) => r.json())
+            .catch(() => ({ value: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "az-policy-remediation",
+            timestamp: now,
+            hash: hashEvidence(remediations),
+            framework: "NIST_CSF",
+            controlId: "ID.RA",
+            source: `azure/policy/${subscriptionId}/remediations`,
+            status: "compliant",
+            data: { remediationCount: Array.isArray(remediations.value) ? remediations.value.length : 0 },
+            metadata: { subscriptionId },
+        });
+        const denyEvaluations = await fetch(`https://management.azure.com${scope}/providers/Microsoft.PolicyInsights/policyStates/latest/summarize?api-version=2021-10-01&$filter=PolicyDefinitionAction%20eq%20'deny'`, { headers: { Authorization: `Bearer ${token}` } })
+            .then((r) => r.json())
+            .catch(() => ({ value: [] }));
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "az-policy-deny",
+            timestamp: now,
+            hash: hashEvidence(denyEvaluations),
+            framework: "CIS",
+            controlId: "2.1",
+            source: `azure/policy/${subscriptionId}/deny-evaluations`,
+            status: "compliant",
+            data: { evaluationCount: Array.isArray(denyEvaluations.value) ? denyEvaluations.value.length : 0 },
+            metadata: { subscriptionId },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/AzureReposConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class AzureReposConnector implements IntegrationConnector {
+    readonly id = "azure-repos";
+    readonly name = "Azure Repos";
+    readonly category: "version_control";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}