@j-schreiber/sf-cli-security-audit 0.18.2 → 0.19.0

package/lib/libs/audit-engine/registry/roles/roleManager.js

@@ -0,0 +1,168 @@
+import { EventEmitter } from 'node:events';
+import { Messages } from '@salesforce/core';
+import { PermissionRiskLevel, UserPrivilegeLevel, } from '../shape/schema.js';
+import { AuditRunLifecycleBus } from '../../auditRunLifecycle.js';
+import { newRoleFromDefinition, newRoleFromOrdinals } from './userRole.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.enforceClassificationPresets');
+export default class RoleManager extends EventEmitter {
+    definitions;
+    classifications;
+    roles = {};
+    constructor(definitions, classifications) {
+        super();
+        this.definitions = definitions;
+        this.classifications = classifications;
+        if (this.definitions) {
+            for (const [roleName, roleDef] of Object.entries(this.definitions)) {
+                const normalizedName = normalize(roleName);
+                if (this.roles[normalizedName]) {
+                    AuditRunLifecycleBus.emitResolveWarn(messages.getMessage('DuplicateRoleAfterNormalization', [
+                        this.roles[normalizedName].roleName,
+                        normalizedName,
+                    ]));
+                }
+                else {
+                    this.roles[normalizedName] = newRoleFromDefinition(roleName, roleDef, this.classifications?.userPermissions);
+                }
+            }
+        }
+        else {
+            for (const legacyRole of Object.values(UserPrivilegeLevel)) {
+                this.roles[normalize(legacyRole)] = newRoleFromOrdinals(legacyRole, this.classifications?.userPermissions);
+            }
+        }
+    }
+    /**
+     * Scan userPermissions and customPermissions of a profile or permission set and
+     * get a unified scan result with violations (risk level not allowed) and warnings
+     * (risk level not classified)
+     *
+     * @param profileLike
+     * @param auditRun
+     * @param rootIdentifier Optional root identifier for messages to prepend.
+     * @returns
+     */
+    scanProfileLike(profileLike, rootIdentifier) {
+        if (!profileLike.metadata) {
+            return { violations: [], warnings: [] };
+        }
+        const userPermsResult = this.scanPermissions(profileLike, 'userPermissions', rootIdentifier);
+        const customPermsResult = this.scanPermissions(profileLike, 'customPermissions', rootIdentifier);
+        userPermsResult.violations.push(...customPermsResult.violations);
+        userPermsResult.warnings.push(...customPermsResult.warnings);
+        return userPermsResult;
+    }
+    /**
+     * Checks if a role allows a certain classifcation level. If the role is
+     * not configured or unknown, always returns false.
+     *
+     * @param roleName
+     * @param permission
+     * @returns
+     */
+    allowsPermission(roleName, permission) {
+        return this.getRole(roleName).isAllowed(permission);
+    }
+    /**
+     * Checks if a given role name is a valid role for the context
+     * of the current audit run.
+     *
+     * @param roleName
+     * @returns
+     */
+    isValidRole(roleName) {
+        const normalisedRoleName = normalize(roleName);
+        return Boolean(this.roles[normalisedRoleName]);
+    }
+    /**
+     * Compares two roles (both must exist)
+     *
+     * @param baseRoleName
+     * @param compareWithName
+     * @returns
+     */
+    compare(baseRoleName, compareWithName) {
+        const baseRole = this.getRole(baseRoleName);
+        const otherRole = this.getRole(compareWithName);
+        return baseRole.compareWith(otherRole);
+    }
+    /**
+     * Returns the role or throws an error, if role name is invalid.
+     *
+     * @param roleName
+     * @returns
+     */
+    getRole(roleName) {
+        const normalisedRoleName = normalize(roleName);
+        if (this.roles[normalisedRoleName]) {
+            return this.roles[normalisedRoleName];
+        }
+        throw messages.createError('TriedToAccessRoleThatDoesNotExist', [roleName]);
+    }
+    //          PRIVATE ZONE
+    scanPermissions(profile, permissionListName, rootIdentifier) {
+        const result = { warnings: [], violations: [] };
+        for (const perm of profile.metadata[permissionListName]) {
+            const identifier = rootIdentifier ? [...rootIdentifier, profile.name, perm.name] : [profile.name, perm.name];
+            const permClassification = this.resolvePerm(perm.name, permissionListName);
+            if (permClassification) {
+                if (permClassification.classification === PermissionRiskLevel.BLOCKED) {
+                    result.violations.push({
+                        identifier,
+                        message: messages.getMessage('violations.permission-is-blocked'),
+                    });
+                }
+                else if (!this.allowsPermission(profile.role, permClassification.name)) {
+                    result.violations.push({
+                        identifier,
+                        message: messages.getMessage('violations.classification-preset-mismatch', [
+                            permClassification.classification,
+                            profile.role,
+                        ]),
+                    });
+                }
+                else if (permClassification.classification === PermissionRiskLevel.UNKNOWN) {
+                    result.warnings.push({
+                        identifier,
+                        message: messages.getMessage('warnings.permission-unknown'),
+                    });
+                }
+            }
+            else {
+                result.warnings.push({
+                    identifier,
+                    message: messages.getMessage('warnings.permission-not-classified'),
+                });
+            }
+        }
+        return result;
+    }
+    resolvePerm(permName, listName) {
+        if (listName === 'userPermissions') {
+            return this.resolveUserPerm(permName);
+        }
+        else if (listName === 'customPermissions') {
+            return this.resolveCustomPerm(permName);
+        }
+    }
+    resolveUserPerm(permName) {
+        if (this.classifications?.userPermissions) {
+            return nameClassification(permName, this.classifications.userPermissions[permName]);
+        }
+        return undefined;
+    }
+    resolveCustomPerm(permName) {
+        if (this.classifications?.customPermissions) {
+            return nameClassification(permName, this.classifications.customPermissions[permName]);
+        }
+        return undefined;
+    }
+}
+function nameClassification(permName, perm) {
+    return perm ? { name: permName, ...perm } : undefined;
+}
+function normalize(roleName) {
+    return roleName.toUpperCase().replaceAll(' ', '_');
+}
+//# sourceMappingURL=roleManager.js.map

package/lib/libs/audit-engine/registry/roles/roleManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleManager.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/roles/roleManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAEL,mBAAmB,EAEnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAQlE,OAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAErF,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,oCAAoC,CAAC,CAAC;AAOnH,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,YAAY;IAGxB;IAAuC;IAF1D,KAAK,GAA6B,EAAE,CAAC;IAE7C,YAA2B,WAA6B,EAAU,eAA0C;QAC1G,KAAK,EAAE,CAAC;QADiB,gBAAW,GAAX,WAAW,CAAkB;QAAU,oBAAe,GAAf,eAAe,CAA2B;QAE1G,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnE,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC/B,oBAAoB,CAAC,eAAe,CAClC,QAAQ,CAAC,UAAU,CAAC,iCAAiC,EAAE;wBACrD,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ;wBACnC,cAAc;qBACf,CAAC,CACH,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;YAC7G,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACI,eAAe,CAAC,WAAgC,EAAE,cAAyB;QAChF,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;QAC7F,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC;QACjG,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACjE,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACI,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACI,WAAW,CAAC,QAAgB;QACjC,MAAM,kBAAkB,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACI,OAAO,CAAC,YAAoB,EAAE,eAAuB;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACI,OAAO,CAAC,QAAgB;QAC7B,MAAM,kBAAkB,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,QAAQ,CAAC,WAAW,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,wBAAwB;IAEhB,eAAe,CACrB,OAA4B,EAC5B,kBAAsC,EACtC,cAAyB;QAEzB,MAAM,MAAM,GAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7G,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;YAC3E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,kBAAkB,CAAC,cAAc,KAAK,mBAAmB,CAAC,OAAO,EAAE,CAAC;oBACtE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrB,UAAU;wBACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,kCAAkC,CAAC;qBACjE,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrB,UAAU;wBACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,2CAA2C,EAAE;4BACxE,kBAAkB,CAAC,cAAc;4BACjC,OAAO,CAAC,IAAI;yBACb,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,kBAAkB,CAAC,cAAc,KAAK,mBAAmB,CAAC,OAAO,EAAE,CAAC;oBAC7E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACnB,UAAU;wBACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,6BAA6B,CAAC;qBAC5D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACnB,UAAU;oBACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oCAAoC,CAAC;iBACnE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,QAAgB,EAAE,QAA4B;QAChE,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,QAAgB;QACtC,IAAI,IAAI,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC;YAC1C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB,CAAC,QAAgB;QACxC,IAAI,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,CAAC;YAC5C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,SAAS,kBAAkB,CACzB,QAAgB,EAChB,IAA0C;IAE1C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC"}

package/lib/libs/audit-engine/registry/roles/roleManager.types.d.ts

@@ -0,0 +1,43 @@
+import { Profile } from '@jsforce/jsforce-node/lib/api/metadata.js';
+import { PolicyRuleViolation, RuleComponentMessage } from '../result.types.js';
+import { PermissionClassifications } from '../shape/schema.js';
+export type ResolvedProfileLike = {
+    name: string;
+    role: string;
+    metadata: PartialProfileLike;
+};
+export type ScanResult = {
+    violations: PolicyRuleViolation[];
+    warnings: RuleComponentMessage[];
+};
+export type UserRoleCompareResult = {
+    /**
+     * True if the given role is a superset of the other compared role.
+     * This means, it contains at least all allowed permissions and
+     * fewer denied permissions as the "other role".
+     */
+    isSuperset: boolean;
+    /**
+     * List of permissions that are present in "this" role and
+     * missing in the compared "other" role.
+     */
+    missingPermsInOther: string[];
+    /**
+     * List of permissions that are present in compared "other"
+     * role and missing in this role.
+     */
+    missingPermsInThis: string[];
+};
+export type IUserRole = {
+    roleName: string;
+    isAllowed(perm: Partial<NamedPermissionClassification>): boolean;
+    compareWith(otherRole: IUserRole): UserRoleCompareResult;
+};
+export type PartialProfileLike = Pick<Profile, 'userPermissions' | 'customPermissions'>;
+/**
+ * Moves the "name" from the classifications map to object prop
+ */
+export type NamedPermissionClassification = PermissionClassifications['string'] & {
+    name: string;
+};
+export type PermissionsListKey = keyof PartialProfileLike;

package/lib/libs/audit-engine/registry/roles/roleManager.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=roleManager.types.js.map

package/lib/libs/audit-engine/registry/roles/roleManager.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleManager.types.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/roles/roleManager.types.ts"],"names":[],"mappings":""}

package/lib/libs/audit-engine/registry/roles/userRole.d.ts

@@ -0,0 +1,12 @@
+import { PermissionClassifications, RoleDefinitions, UserPrivilegeLevel } from '../shape/schema.js';
+import { UserRoleCompareResult } from './roleManager.types.js';
+export default class UserRole {
+    roleName: string;
+    private allowedPermissions;
+    private roleOrdinalValue?;
+    constructor(roleName: string, allowedPermissions: Set<string>, roleOrdinalValue?: number | undefined);
+    isAllowed(permissionName: string): boolean;
+    compareWith(otherRole: UserRole): UserRoleCompareResult;
+}
+export declare function newRoleFromDefinition(roleName: string, roleDef: RoleDefinitions['string'], perms?: PermissionClassifications): UserRole;
+export declare function newRoleFromOrdinals(roleName: UserPrivilegeLevel, perms?: PermissionClassifications): UserRole;

package/lib/libs/audit-engine/registry/roles/userRole.js

@@ -0,0 +1,75 @@
+import { PermissionRiskLevel, UserPrivilegeLevel, } from '../shape/schema.js';
+export default class UserRole {
+    roleName;
+    allowedPermissions;
+    roleOrdinalValue;
+    constructor(roleName, allowedPermissions, roleOrdinalValue) {
+        this.roleName = roleName;
+        this.allowedPermissions = allowedPermissions;
+        this.roleOrdinalValue = roleOrdinalValue;
+    }
+    isAllowed(permissionName) {
+        return this.allowedPermissions.has(permissionName);
+    }
+    compareWith(otherRole) {
+        const missingPermsInOther = new Array();
+        const missingPermsInThis = new Array();
+        const isOrdinallyHigher = this.roleOrdinalValue && otherRole.roleOrdinalValue ? this.roleOrdinalValue >= otherRole.roleOrdinalValue : true;
+        const merged = new Set([...this.allowedPermissions, ...otherRole.allowedPermissions]);
+        for (const perm of merged) {
+            if (!this.allowedPermissions.has(perm)) {
+                missingPermsInThis.push(perm);
+            }
+            if (!otherRole.allowedPermissions.has(perm)) {
+                missingPermsInOther.push(perm);
+            }
+        }
+        return {
+            isSuperset: missingPermsInThis.length === 0 && isOrdinallyHigher,
+            missingPermsInThis,
+            missingPermsInOther,
+        };
+    }
+}
+export function newRoleFromDefinition(roleName, roleDef, perms) {
+    const allAllowed = new Set();
+    if (roleDef.allowedPermissions) {
+        for (const permName of roleDef.allowedPermissions) {
+            allAllowed.add(permName);
+        }
+    }
+    if (perms) {
+        for (const [permName, permDef] of Object.entries(perms)) {
+            if (roleDef.allowedClassifications && roleDef.allowedClassifications.includes(permDef.classification)) {
+                allAllowed.add(permName);
+            }
+        }
+    }
+    if (roleDef.deniedPermissions) {
+        for (const permName of roleDef.deniedPermissions) {
+            allAllowed.delete(permName);
+        }
+    }
+    return new UserRole(roleName, allAllowed);
+}
+export function newRoleFromOrdinals(roleName, perms) {
+    const roleOrdinalValue = resolvePresetOrdinalValue(roleName);
+    if (!perms || roleName === UserPrivilegeLevel.UNKNOWN) {
+        return new UserRole(roleName, new Set(), roleOrdinalValue);
+    }
+    const allAllowed = new Set();
+    for (const [permName, permDef] of Object.entries(perms)) {
+        if (roleOrdinalValue >= resolveRiskLevelOrdinalValue(permDef.classification)) {
+            allAllowed.add(permName);
+        }
+    }
+    return new UserRole(roleName, allAllowed, roleOrdinalValue);
+}
+function resolvePresetOrdinalValue(value) {
+    const indexOfValue = Object.values(UserPrivilegeLevel).indexOf(value);
+    return Object.keys(UserPrivilegeLevel).length - indexOfValue;
+}
+function resolveRiskLevelOrdinalValue(value) {
+    return Object.keys(PermissionRiskLevel).length - Object.keys(PermissionRiskLevel).indexOf(value.toUpperCase());
+}
+//# sourceMappingURL=userRole.js.map

package/lib/libs/audit-engine/registry/roles/userRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRole.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/roles/userRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EAEnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,CAAC,OAAO,OAAO,QAAQ;IAElB;IACC;IACA;IAHV,YACS,QAAgB,EACf,kBAA+B,EAC/B,gBAAyB;QAF1B,aAAQ,GAAR,QAAQ,CAAQ;QACf,uBAAkB,GAAlB,kBAAkB,CAAa;QAC/B,qBAAgB,GAAhB,gBAAgB,CAAS;IAChC,CAAC;IAEG,SAAS,CAAC,cAAsB;QACrC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IAEM,WAAW,CAAC,SAAmB;QACpC,MAAM,mBAAmB,GAAG,IAAI,KAAK,EAAU,CAAC;QAChD,MAAM,kBAAkB,GAAG,IAAI,KAAK,EAAU,CAAC;QAC/C,MAAM,iBAAiB,GACrB,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;QACnH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACtF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,OAAO;YACL,UAAU,EAAE,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB;YAChE,kBAAkB;YAClB,mBAAmB;SACpB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,OAAkC,EAClC,KAAiC;IAEjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAClD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,IAAI,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACtG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACjD,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAA4B,EAAE,KAAiC;IACjG,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACtD,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAU,EAAE,gBAAgB,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,gBAAgB,IAAI,4BAA4B,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,YAAY,CAAC;AAC/D,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACjH,CAAC"}

package/lib/libs/audit-engine/registry/rules/enforcePermissionPresets.d.ts

@@ -2,8 +2,10 @@ import { PartialPolicyRuleResult, RuleAuditContext } from '../context.types.js';
 import { ResolvedUser } from '../policies/users.js';
 import PolicyRule, { RuleOptions } from './policyRule.js';
 export default class EnforcePermissionPresets extends PolicyRule<ResolvedUser> {
+    private readonly roleManager;
     constructor(opts: RuleOptions);
     run(context: RuleAuditContext<ResolvedUser>): Promise<PartialPolicyRuleResult>;
     private resolveProfileRole;
     private resolvePermissionSetRole;
+    private auditPermissionsEntity;
 }

package/lib/libs/audit-engine/registry/rules/enforcePermissionPresets.js

@@ -1,24 +1,28 @@
 import { Messages } from '@salesforce/core';
 import { capitalize } from '../../../../utils.js';
-import { resolvePresetOrdinalValue } from '../helpers/permissionsScanning.js';
+import RoleManager from '../roles/roleManager.js';
 import { UserPrivilegeLevel } from '../shape/schema.js';
 import PolicyRule from './policyRule.js';
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.users');
 export default class EnforcePermissionPresets extends PolicyRule {
+    roleManager;
     constructor(opts) {
         super(opts);
+        this.roleManager = new RoleManager(opts.auditConfig.definitions.roles, {
+            userPermissions: opts.auditConfig.classifications.userPermissions?.permissions,
+        });
     }
     run(context) {
         const result = this.initResult();
         const users = context.resolvedEntities;
         for (const user of Object.values(users)) {
             const profileRole = this.resolveProfileRole(user.profileName);
-            auditPermissionsEntity(result, user, 'profile', user.profileName, profileRole);
+            this.auditPermissionsEntity(result, user, 'profile', user.profileName, profileRole);
             if (user.assignments) {
                 for (const assignment of user.assignments) {
                     const permsetRole = this.resolvePermissionSetRole(assignment.permissionSetIdentifier);
-                    auditPermissionsEntity(result, user, 'permission set', assignment.permissionSetIdentifier, permsetRole);
+                    this.auditPermissionsEntity(result, user, 'permission set', assignment.permissionSetIdentifier, permsetRole);
                 }
             }
         }
@@ -30,31 +34,40 @@ export default class EnforcePermissionPresets extends PolicyRule {
     resolvePermissionSetRole(permsetName) {
         return this.auditConfig.classifications.permissionSets?.permissionSets[permsetName]?.role;
     }
-}
-function auditPermissionsEntity(result, user, entityType, entityIdentifier, entityPreset) {
-    if (entityPreset) {
-        if (entityPreset === UserPrivilegeLevel.UNKNOWN) {
-            result.violations.push({
-                identifier: [user.username, entityIdentifier],
-                message: messages.getMessage('violations.entity-unknown-but-used', [capitalize(entityType)]),
-            });
+    auditPermissionsEntity(result, user, entityType, entityIdentifier, entityPreset) {
+        if (entityPreset) {
+            if (entityPreset === UserPrivilegeLevel.UNKNOWN.toString()) {
+                result.violations.push({
+                    identifier: [user.username, entityIdentifier],
+                    message: messages.getMessage('violations.entity-unknown-but-used', [capitalize(entityType)]),
+                });
+            }
+            else if (!this.roleManager.isValidRole(entityPreset)) {
+                result.violations.push({
+                    identifier: [user.username, entityIdentifier],
+                    message: messages.getMessage('violations.invalid-entity-role', [capitalize(entityType), entityPreset]),
+                });
+            }
+            else if (this.roleManager.isValidRole(entityPreset) && this.roleManager.isValidRole(user.role)) {
+                const compareResult = this.roleManager.compare(user.role, entityPreset);
+                if (!compareResult.isSuperset) {
+                    result.violations.push({
+                        identifier: [user.username, entityIdentifier],
+                        message: messages.getMessage('violations.entity-not-allowed-for-user-role', [
+                            user.role,
+                            entityType,
+                            entityPreset,
+                        ]),
+                    });
+                }
+            }
         }
-        else if (resolvePresetOrdinalValue(entityPreset) < resolvePresetOrdinalValue(user.role)) {
+        else {
             result.violations.push({
                 identifier: [user.username, entityIdentifier],
-                message: messages.getMessage('violations.entity-not-allowed-for-user-role', [
-                    user.role,
-                    entityType,
-                    entityPreset,
-                ]),
+                message: messages.getMessage('violations.entity-not-classified-but-used', [capitalize(entityType), entityType]),
             });
         }
     }
-    else {
-        result.violations.push({
-            identifier: [user.username, entityIdentifier],
-            message: messages.getMessage('violations.entity-not-classified-but-used', [capitalize(entityType), entityType]),
-        });
-    }
 }
 //# sourceMappingURL=enforcePermissionPresets.js.map

package/lib/libs/audit-engine/registry/rules/enforcePermissionPresets.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcePermissionPresets.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionPresets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;AAE5F,MAAM,CAAC,OAAO,OAAO,wBAAyB,SAAQ,UAAwB;IAC5E,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC9D,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAC/E,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;oBACtF,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;gBAC1G,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAEO,kBAAkB,CAAC,WAAmB;QAC5C,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAChF,CAAC;IAEO,wBAAwB,CAAC,WAAmB;QAClD,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5F,CAAC;CACF;AAED,SAAS,sBAAsB,CAC7B,MAA+B,EAC/B,IAAkB,EAClB,UAAkB,EAClB,gBAAwB,EACxB,YAAiC;IAEjC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,YAAY,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAChD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;gBAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oCAAoC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;aAC7F,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,yBAAyB,CAAC,YAAY,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;gBAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,6CAA6C,EAAE;oBAC1E,IAAI,CAAC,IAAI;oBACT,UAAU;oBACV,YAAY;iBACb,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;YACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,2CAA2C,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;SAChH,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"enforcePermissionPresets.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionPresets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;AAE5F,MAAM,CAAC,OAAO,OAAO,wBAAyB,SAAQ,UAAwB;IAC3D,WAAW,CAAC;IAE7B,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE;YACrE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,WAAW;SAC/E,CAAC,CAAC;IACL,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACpF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;oBACtF,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAEO,kBAAkB,CAAC,WAAmB;QAC5C,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAChF,CAAC;IAEO,wBAAwB,CAAC,WAAmB;QAClD,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5F,CAAC;IAEO,sBAAsB,CAC5B,MAA+B,EAC/B,IAAkB,EAClB,UAAkB,EAClB,gBAAwB,EACxB,YAAqB;QAErB,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,YAAY,KAAK,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC3D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;oBAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oCAAoC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;iBAC7F,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;oBAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,gCAAgC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;iBACvG,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjG,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACxE,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;oBAC9B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;wBAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,6CAA6C,EAAE;4BAC1E,IAAI,CAAC,IAAI;4BACT,UAAU;4BACV,YAAY;yBACb,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;gBAC7C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,2CAA2C,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;aAChH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.d.ts

@@ -1,7 +1,8 @@
 import { PartialPolicyRuleResult, RuleAuditContext } from '../context.types.js';
-import { ResolvedProfileLike } from '../helpers/permissionsScanning.js';
+import { ResolvedProfileLike } from '../roles/roleManager.types.js';
 import PolicyRule, { RuleOptions } from './policyRule.js';
 export default class EnforcePermissionsOnProfileLike extends PolicyRule<ResolvedProfileLike> {
+    private readonly roleManager;
     constructor(opts: RuleOptions);
     run(context: RuleAuditContext<ResolvedProfileLike>): Promise<PartialPolicyRuleResult>;
 }

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.js

@@ -1,23 +1,33 @@
+import { Messages } from '@salesforce/core';
 import { isNullish } from '../../../../utils.js';
-import { scanPermissions } from '../helpers/permissionsScanning.js';
+import RoleManager from '../roles/roleManager.js';
 import PolicyRule from './policyRule.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.enforceClassificationPresets');
 export default class EnforcePermissionsOnProfileLike extends PolicyRule {
+    roleManager;
     constructor(opts) {
         super(opts);
+        this.roleManager = new RoleManager(opts.auditConfig.definitions.roles, {
+            userPermissions: opts.auditConfig.classifications.userPermissions?.permissions,
+            customPermissions: opts.auditConfig.classifications.customPermissions?.permissions,
+        });
     }
     run(context) {
         const result = this.initResult();
         const resolvedProfiles = context.resolvedEntities;
         for (const profile of Object.values(resolvedProfiles)) {
-            if (!isNullish(profile.metadata.userPermissions)) {
-                const userPermsScan = scanPermissions(profile, 'userPermissions', this.auditConfig);
-                result.violations.push(...userPermsScan.violations);
-                result.warnings.push(...userPermsScan.warnings);
+            if (!this.roleManager.isValidRole(profile.role)) {
+                result.errors.push({
+                    identifier: [profile.name],
+                    message: messages.getMessage('error.failed-to-resolve-role', [profile.role]),
+                });
+                continue;
             }
-            if (!isNullish(profile.metadata.customPermissions)) {
-                const customPermsScan = scanPermissions(profile, 'customPermissions', this.auditConfig);
-                result.violations.push(...customPermsScan.violations);
-                result.warnings.push(...customPermsScan.warnings);
+            if (!isNullish(profile.metadata)) {
+                const profileScanResult = this.roleManager.scanProfileLike(profile);
+                result.violations.push(...profileScanResult.violations);
+                result.warnings.push(...profileScanResult.warnings);
             }
         }
         return Promise.resolve(result);

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcePermissionsOnProfileLike.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAuB,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,+BAAgC,SAAQ,UAA+B;IAC1F,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,OAA8C;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACpF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBACpD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACnD,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACxF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"enforcePermissionsOnProfileLike.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,oCAAoC,CAAC,CAAC;AAEnH,MAAM,CAAC,OAAO,OAAO,+BAAgC,SAAQ,UAA+B;IACzE,WAAW,CAAC;IAE7B,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE;YACrE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,WAAW;YAC9E,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,iBAAiB,EAAE,WAAW;SACnF,CAAC,CAAC;IACL,CAAC;IAEM,GAAG,CAAC,OAA8C;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC1B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,8BAA8B,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;iBAC7E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACxD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.d.ts

@@ -2,6 +2,7 @@ import { PartialPolicyRuleResult, RuleAuditContext } from '../context.types.js';
 import { ResolvedUser } from '../policies/users.js';
 import PolicyRule, { RuleOptions } from './policyRule.js';
 export default class EnforcePermissionsOnUser extends PolicyRule<ResolvedUser> {
+    private readonly roleManager;
     constructor(opts: RuleOptions);
     run(context: RuleAuditContext<ResolvedUser>): Promise<PartialPolicyRuleResult>;
     private scanAssignedPermissionSets;

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.js

@@ -1,18 +1,33 @@
-import { scanProfileLike } from '../helpers/permissionsScanning.js';
+import { Messages } from '@salesforce/core';
+import RoleManager from '../roles/roleManager.js';
 import PolicyRule from './policyRule.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.enforceClassificationPresets');
 export default class EnforcePermissionsOnUser extends PolicyRule {
+    roleManager;
     constructor(opts) {
         super(opts);
+        this.roleManager = new RoleManager(opts.auditConfig.definitions.roles, {
+            userPermissions: opts.auditConfig.classifications.userPermissions?.permissions,
+            customPermissions: opts.auditConfig.classifications.customPermissions?.permissions,
+        });
     }
     run(context) {
         const result = this.initResult();
         const users = context.resolvedEntities;
         for (const user of Object.values(users)) {
+            if (!this.roleManager.isValidRole(user.role)) {
+                result.errors.push({
+                    identifier: [user.username],
+                    message: messages.getMessage('error.failed-to-resolve-role', [user.role]),
+                });
+                continue;
+            }
             const { violations, warnings } = this.scanAssignedPermissionSets(user, user.assignments);
             result.violations.push(...violations);
             result.warnings.push(...warnings);
             if (user.profileMetadata) {
-                const profileResult = scanProfileLike({ role: user.role, metadata: user.profileMetadata, name: user.profileName }, this.auditConfig, [user.username]);
+                const profileResult = this.roleManager.scanProfileLike({ role: user.role, metadata: user.profileMetadata, name: user.profileName }, [user.username]);
                 result.violations.push(...profileResult.violations);
                 result.warnings.push(...profileResult.warnings);
             }
@@ -28,7 +43,7 @@ export default class EnforcePermissionsOnUser extends PolicyRule {
             if (!assignedPermSet.metadata) {
                 continue;
             }
-            const permsetScan = scanProfileLike({ role: user.role, metadata: assignedPermSet.metadata, name: assignedPermSet.permissionSetIdentifier }, this.auditConfig, [user.username]);
+            const permsetScan = this.roleManager.scanProfileLike({ role: user.role, metadata: assignedPermSet.metadata, name: assignedPermSet.permissionSetIdentifier }, [user.username]);
             result.violations.push(...permsetScan.violations);
             result.warnings.push(...permsetScan.warnings);
         }

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcePermissionsOnUser.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionsOnUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAc,MAAM,mCAAmC,CAAC;AAGhF,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,wBAAyB,SAAQ,UAAwB;IAC5E,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,MAAM,aAAa,GAAG,eAAe,CACnC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAC3E,IAAI,CAAC,WAAW,EAChB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChB,CAAC;gBACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBACpD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAEO,0BAA0B,CAAC,IAAkB,EAAE,WAAwC;QAC7F,MAAM,MAAM,GAAe,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,MAAM,eAAe,IAAI,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,eAAe,CACjC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,uBAAuB,EAAE,EACtG,IAAI,CAAC,WAAW,EAChB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChB,CAAC;YACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"enforcePermissionsOnUser.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionsOnUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAGlD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,oCAAoC,CAAC,CAAC;AAEnH,MAAM,CAAC,OAAO,OAAO,wBAAyB,SAAQ,UAAwB;IAC3D,WAAW,CAAC;IAE7B,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE;YACrE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,WAAW;YAC9E,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,iBAAiB,EAAE,WAAW;SACnF,CAAC,CAAC;IACL,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,8BAA8B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC1E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CACpD,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAC3E,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChB,CAAC;gBACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBACpD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAEO,0BAA0B,CAAC,IAAkB,EAAE,WAAwC;QAC7F,MAAM,MAAM,GAAe,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,MAAM,eAAe,IAAI,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAClD,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,uBAAuB,EAAE,EACtG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChB,CAAC;YACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/lib/libs/audit-engine/registry/shape/auditConfigShape.d.ts

@@ -4,6 +4,17 @@
  * the audit config that is used by rules and policies.
  */
 export declare const BaseAuditConfigShape: {
+    definitions: {
+        files: {
+            roles: {
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    allowedClassifications: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>>>;
+                    allowedPermissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    deniedPermissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                }, import("zod/v4/core").$strip>>;
+            };
+        };
+    };
     classifications: {
         files: {
             userPermissions: {
@@ -29,7 +40,7 @@ export declare const BaseAuditConfigShape: {
             profiles: {
                 schema: import("zod").ZodObject<{
                     profiles: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodEnum<typeof import("./schema.js").UserPrivilegeLevel>;
+                        role: import("zod").ZodString;
                         allowedLoginIps: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
                             from: import("zod").ZodString;
                             to: import("zod").ZodString;
@@ -41,7 +52,7 @@ export declare const BaseAuditConfigShape: {
             permissionSets: {
                 schema: import("zod").ZodObject<{
                     permissionSets: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodEnum<typeof import("./schema.js").UserPrivilegeLevel>;
+                        role: import("zod").ZodString;
                     }, import("zod/v4/core").$strict>>;
                 }, import("zod/v4/core").$strip>;
                 entities: string;
@@ -49,7 +60,7 @@ export declare const BaseAuditConfigShape: {
             users: {
                 schema: import("zod").ZodObject<{
                     users: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodEnum<typeof import("./schema.js").UserPrivilegeLevel>;
+                        role: import("zod").ZodString;
                     }, import("zod/v4/core").$strip>>;
                 }, import("zod/v4/core").$strip>;
                 entities: string;
@@ -104,7 +115,7 @@ export declare const BaseAuditConfigShape: {
                         options: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
                     }, import("zod/v4/core").$strip>>>;
                     options: import("zod").ZodObject<{
-                        defaultRoleForMissingUsers: import("zod").ZodDefault<import("zod").ZodEnum<typeof import("./schema.js").UserPrivilegeLevel>>;
+                        defaultRoleForMissingUsers: import("zod").ZodDefault<import("zod").ZodString>;
                         analyseLastNDaysOfLoginHistory: import("zod").ZodOptional<import("zod").ZodNumber>;
                     }, import("zod/v4/core").$strict>;
                 }, import("zod/v4/core").$strip>;