@j-schreiber/sf-cli-security-audit 0.19.0 → 0.19.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/lib/libs/audit-engine/registry/rules/allUsedAppsUnderManagement.js +20 -1
- package/lib/libs/audit-engine/registry/rules/allUsedAppsUnderManagement.js.map +1 -1
- package/lib/salesforce/repositories/connected-apps/connected-app.types.d.ts +18 -1
- package/lib/salesforce/repositories/connected-apps/connected-app.types.js.map +1 -1
- package/lib/salesforce/repositories/connected-apps/connected-apps.d.ts +1 -0
- package/lib/salesforce/repositories/connected-apps/connected-apps.js +58 -15
- package/lib/salesforce/repositories/connected-apps/connected-apps.js.map +1 -1
- package/lib/salesforce/repositories/connected-apps/queries.d.ts +1 -1
- package/lib/salesforce/repositories/connected-apps/queries.js +1 -1
- package/lib/salesforce/repositories/connected-apps/queries.js.map +1 -1
- package/lib/salesforce/utils.d.ts +1 -0
- package/lib/salesforce/utils.js +10 -0
- package/lib/salesforce/utils.js.map +1 -1
- package/messages/rules.connectedApps.md +8 -0
- package/messages/rules.users.md +1 -1
- package/oclif.manifest.json +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -89,7 +89,7 @@ FLAG DESCRIPTIONS
|
|
|
89
89
|
essentially control, if a permission is allowed in a certain profile / permission set.
|
|
90
90
|
```
|
|
91
91
|
|
|
92
|
-
_See code: [src/commands/org/audit/init.ts](https://github.com/j-schreiber/js-sf-cli-security-audit/blob/v0.19.
|
|
92
|
+
_See code: [src/commands/org/audit/init.ts](https://github.com/j-schreiber/js-sf-cli-security-audit/blob/v0.19.2/src/commands/org/audit/init.ts)_
|
|
93
93
|
|
|
94
94
|
## `sf org audit run`
|
|
95
95
|
|
|
@@ -134,7 +134,7 @@ FLAG DESCRIPTIONS
|
|
|
134
134
|
never truncated.
|
|
135
135
|
```
|
|
136
136
|
|
|
137
|
-
_See code: [src/commands/org/audit/run.ts](https://github.com/j-schreiber/js-sf-cli-security-audit/blob/v0.19.
|
|
137
|
+
_See code: [src/commands/org/audit/run.ts](https://github.com/j-schreiber/js-sf-cli-security-audit/blob/v0.19.2/src/commands/org/audit/run.ts)_
|
|
138
138
|
|
|
139
139
|
## `sf org scan user-perms`
|
|
140
140
|
|
|
@@ -183,7 +183,7 @@ FLAG DESCRIPTIONS
|
|
|
183
183
|
userPermissions.yml.
|
|
184
184
|
```
|
|
185
185
|
|
|
186
|
-
_See code: [src/commands/org/scan/user-perms.ts](https://github.com/j-schreiber/js-sf-cli-security-audit/blob/v0.19.
|
|
186
|
+
_See code: [src/commands/org/scan/user-perms.ts](https://github.com/j-schreiber/js-sf-cli-security-audit/blob/v0.19.2/src/commands/org/scan/user-perms.ts)_
|
|
187
187
|
|
|
188
188
|
<!-- commandsstop -->
|
|
189
189
|
|
|
@@ -14,11 +14,30 @@ export default class AllUsedAppsUnderManagement extends PolicyRule {
|
|
|
14
14
|
result.violations.push({
|
|
15
15
|
identifier: [app.name],
|
|
16
16
|
message: messages.getMessage('violations.app-used-but-not-registered', [app.users.length, app.useCount]),
|
|
17
|
-
details: app.users,
|
|
17
|
+
details: formatUserDetails(app.users),
|
|
18
18
|
});
|
|
19
19
|
}
|
|
20
20
|
});
|
|
21
21
|
return Promise.resolve(result);
|
|
22
22
|
}
|
|
23
23
|
}
|
|
24
|
+
function formatUserDetails(users) {
|
|
25
|
+
return users.map((user) => {
|
|
26
|
+
if (user.lastUsed) {
|
|
27
|
+
return messages.getMessage('violations.app-used-details-with-last-access', [
|
|
28
|
+
user.username,
|
|
29
|
+
user.tokenCount,
|
|
30
|
+
user.useCount,
|
|
31
|
+
user.lastUsed,
|
|
32
|
+
]);
|
|
33
|
+
}
|
|
34
|
+
else {
|
|
35
|
+
return messages.getMessage('violations.app-used-details-without-last-access', [
|
|
36
|
+
user.username,
|
|
37
|
+
user.tokenCount,
|
|
38
|
+
user.useCount,
|
|
39
|
+
]);
|
|
40
|
+
}
|
|
41
|
+
});
|
|
42
|
+
}
|
|
24
43
|
//# sourceMappingURL=allUsedAppsUnderManagement.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"allUsedAppsUnderManagement.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/allUsedAppsUnderManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,qBAAqB,CAAC,CAAC;AAEpG,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,UAAwB;IAC9E,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACnD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtB,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,wCAAwC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACxG,OAAO,EAAE,GAAG,CAAC,KAAK;
|
|
1
|
+
{"version":3,"file":"allUsedAppsUnderManagement.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/allUsedAppsUnderManagement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,qBAAqB,CAAC,CAAC;AAEpG,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,UAAwB;IAC9E,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACnD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtB,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,wCAAwC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACxG,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,KAA4B;IACrD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,UAAU,CAAC,8CAA8C,EAAE;gBACzE,IAAI,CAAC,QAAQ;gBACb,IAAI,CAAC,UAAU;gBACf,IAAI,CAAC,QAAQ;gBACb,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,QAAQ,CAAC,UAAU,CAAC,iDAAiD,EAAE;gBAC5E,IAAI,CAAC,QAAQ;gBACb,IAAI,CAAC,UAAU;gBACf,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -27,6 +27,7 @@ export type SfOauthToken = Record & {
|
|
|
27
27
|
ApplicationId: string;
|
|
28
28
|
};
|
|
29
29
|
UseCount: number;
|
|
30
|
+
LastUsedDate?: string;
|
|
30
31
|
};
|
|
31
32
|
export type SfMinimalUser = Record & {
|
|
32
33
|
Id: string;
|
|
@@ -39,11 +40,27 @@ export type ConnectedApp = {
|
|
|
39
40
|
onlyAdminApprovedUsersAllowed: boolean;
|
|
40
41
|
overrideByApiSecurityAccess: boolean;
|
|
41
42
|
useCount: number;
|
|
42
|
-
users:
|
|
43
|
+
users: ConnectedAppUser[];
|
|
43
44
|
};
|
|
44
45
|
export declare const ResolveAppsOptionsSchema: z.ZodObject<{
|
|
45
46
|
withTokenUsage: z.ZodDefault<z.ZodBoolean>;
|
|
46
47
|
withOrgOwned: z.ZodDefault<z.ZodBoolean>;
|
|
47
48
|
}, z.z.core.$strip>;
|
|
48
49
|
export type ResolveAppsOptions = z.infer<typeof ResolveAppsOptionsSchema>;
|
|
50
|
+
export type ConnectedAppUser = {
|
|
51
|
+
username: string;
|
|
52
|
+
/** Aggregated usage of all tokens from this user */
|
|
53
|
+
useCount: number;
|
|
54
|
+
tokenCount: number;
|
|
55
|
+
/** ISO Code timestamp of last use date from tokens of this user */
|
|
56
|
+
lastUsed?: string;
|
|
57
|
+
};
|
|
58
|
+
export type OAuthUsageStats = {
|
|
59
|
+
/** ISO Code timestamp of last use date from all tokens for this app */
|
|
60
|
+
lastUsed?: string;
|
|
61
|
+
appId?: string;
|
|
62
|
+
/** Aggregated usage of all tokens from this app */
|
|
63
|
+
useCount: number;
|
|
64
|
+
users: Map<string, ConnectedAppUser>;
|
|
65
|
+
};
|
|
49
66
|
export {};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connected-app.types.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/connected-apps/connected-app.types.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"connected-app.types.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/connected-apps/connected-app.types.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAC;AAiDpB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACzC,CAAC,CAAC"}
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import EventEmitter from 'node:events';
|
|
2
2
|
import MDAPI from '../../mdapi/mdapi.js';
|
|
3
|
+
import { maxDate } from '../../utils.js';
|
|
3
4
|
import { ResolveAppsOptionsSchema, } from './connected-app.types.js';
|
|
4
5
|
import { CONNECTED_APPS_QUERY, EXTERNAL_APPS_OAUTH_POLICY, EXTERNAL_CLIENT_APPS_QUERY } from './queries.js';
|
|
5
6
|
import OAuthTokens from './oauth-tokens.js';
|
|
@@ -34,26 +35,22 @@ export default class ConnectedApps extends EventEmitter {
|
|
|
34
35
|
resolved: 0,
|
|
35
36
|
});
|
|
36
37
|
if (definitiveOpts.withTokenUsage) {
|
|
37
|
-
const
|
|
38
|
-
for (const
|
|
39
|
-
const appRef =
|
|
40
|
-
? appIndex.get(sfToken.AppMenuItem.ApplicationId)
|
|
41
|
-
: apps.get(sfToken.AppName);
|
|
38
|
+
const oauthUsage = await this.fetchOauthUsage();
|
|
39
|
+
for (const [appName, appDef] of oauthUsage.entries()) {
|
|
40
|
+
const appRef = appDef.appId && appIndex.get(appDef.appId) ? appIndex.get(appDef.appId) : apps.get(appName);
|
|
42
41
|
if (appRef) {
|
|
43
|
-
appRef.useCount +=
|
|
44
|
-
|
|
45
|
-
appRef.users.push(sfToken.User.Username);
|
|
46
|
-
}
|
|
42
|
+
appRef.useCount += appDef.useCount;
|
|
43
|
+
appRef.users = [...appDef.users.values()];
|
|
47
44
|
}
|
|
48
45
|
else {
|
|
49
|
-
apps.set(
|
|
50
|
-
name:
|
|
46
|
+
apps.set(appName, {
|
|
47
|
+
name: appName,
|
|
51
48
|
origin: 'OauthToken',
|
|
52
49
|
type: 'Unknown',
|
|
53
50
|
onlyAdminApprovedUsersAllowed: false,
|
|
54
51
|
overrideByApiSecurityAccess: false,
|
|
55
|
-
useCount:
|
|
56
|
-
users: [
|
|
52
|
+
useCount: appDef.useCount,
|
|
53
|
+
users: [...appDef.users.values()],
|
|
57
54
|
});
|
|
58
55
|
}
|
|
59
56
|
}
|
|
@@ -70,19 +67,65 @@ export default class ConnectedApps extends EventEmitter {
|
|
|
70
67
|
return apps;
|
|
71
68
|
}
|
|
72
69
|
async setOverrideByApiAccess(apps) {
|
|
70
|
+
const nonExternalClientApps = apps.filter((app) => app.type !== 'ExternalClientApp');
|
|
73
71
|
this.emit('entityresolve', {
|
|
74
72
|
total: apps.length,
|
|
75
|
-
resolved: apps.
|
|
73
|
+
resolved: apps.length - nonExternalClientApps.length,
|
|
76
74
|
});
|
|
77
75
|
let overrideByApiSecurityAccess = false;
|
|
78
76
|
const apiSecurityAccessSetting = await this.mdapi.resolveSingleton('ConnectedAppSettings');
|
|
79
77
|
if (apiSecurityAccessSetting?.enableAdminApprovedAppsOnly) {
|
|
80
78
|
overrideByApiSecurityAccess = true;
|
|
81
79
|
}
|
|
82
|
-
for (const app of
|
|
80
|
+
for (const app of nonExternalClientApps) {
|
|
83
81
|
app.overrideByApiSecurityAccess = overrideByApiSecurityAccess;
|
|
84
82
|
}
|
|
85
83
|
}
|
|
84
|
+
async fetchOauthUsage() {
|
|
85
|
+
const usersOAuthToken = await this.oauthTokenRepo.queryAll();
|
|
86
|
+
const stats = new Map();
|
|
87
|
+
for (const sfToken of usersOAuthToken) {
|
|
88
|
+
let appStats = stats.get(sfToken.AppName);
|
|
89
|
+
if (!appStats) {
|
|
90
|
+
appStats = {
|
|
91
|
+
appId: sfToken.AppMenuItem?.ApplicationId,
|
|
92
|
+
useCount: sfToken.UseCount,
|
|
93
|
+
users: new Map(),
|
|
94
|
+
};
|
|
95
|
+
stats.set(sfToken.AppName, appStats);
|
|
96
|
+
}
|
|
97
|
+
else {
|
|
98
|
+
appStats.useCount += sfToken.UseCount;
|
|
99
|
+
// appStats.lastUsed += ...
|
|
100
|
+
}
|
|
101
|
+
const userStats = appStats.users.get(sfToken.User.Username);
|
|
102
|
+
if (userStats) {
|
|
103
|
+
userStats.tokenCount++;
|
|
104
|
+
userStats.useCount += sfToken.UseCount;
|
|
105
|
+
userStats.lastUsed = maxDate(userStats.lastUsed, sfToken.LastUsedDate);
|
|
106
|
+
}
|
|
107
|
+
else {
|
|
108
|
+
appStats.users.set(sfToken.User.Username, {
|
|
109
|
+
username: sfToken.User.Username,
|
|
110
|
+
useCount: sfToken.UseCount,
|
|
111
|
+
lastUsed: sfToken.LastUsedDate,
|
|
112
|
+
tokenCount: 1,
|
|
113
|
+
});
|
|
114
|
+
}
|
|
115
|
+
}
|
|
116
|
+
// clean optional properties that were initialised with nullish
|
|
117
|
+
for (const app of stats.values()) {
|
|
118
|
+
if (!app.lastUsed) {
|
|
119
|
+
delete app.lastUsed;
|
|
120
|
+
}
|
|
121
|
+
for (const user of app.users.values()) {
|
|
122
|
+
if (!user.lastUsed) {
|
|
123
|
+
delete user.lastUsed;
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
}
|
|
127
|
+
return stats;
|
|
128
|
+
}
|
|
86
129
|
}
|
|
87
130
|
async function fetchAllInstalledApps(con) {
|
|
88
131
|
const resultPromises = [
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connected-apps.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/connected-apps/connected-apps.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,MAAM,sBAAsB,CAAC;AACzC,OAAO,
|
|
1
|
+
{"version":3,"file":"connected-apps.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/connected-apps/connected-apps.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,MAAM,sBAAsB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAIL,wBAAwB,GAIzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC5G,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAQ5C,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,YAAY;IAIjB;IAHnB,KAAK,CAAQ;IACb,cAAc,CAAc;IAE7C,YAAoC,GAAe;QACjD,KAAK,EAAE,CAAC;QAD0B,QAAG,GAAH,GAAG,CAAY;QAEjD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,OAAO,CAAC,IAAkC;QACrD,MAAM,cAAc,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,IAAI,cAAc,CAAC,cAAc,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC3G,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;oBACnC,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5C,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE;wBAChB,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,YAAY;wBACpB,IAAI,EAAE,SAAS;wBACf,6BAA6B,EAAE,KAAK;wBACpC,2BAA2B,EAAE,KAAK;wBAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;gBACzB,KAAK,EAAE,IAAI,CAAC,IAAI;gBAChB,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,QAAQ,EAAE,IAAI,CAAC,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,IAAoB;QACvD,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM;SACrD,CAAC,CAAC;QACH,IAAI,2BAA2B,GAAG,KAAK,CAAC;QACxC,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QAC3F,IAAI,wBAAwB,EAAE,2BAA2B,EAAE,CAAC;YAC1D,2BAA2B,GAAG,IAAI,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,GAAG,CAAC,2BAA2B,GAAG,2BAA2B,CAAC;QAChE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;QACjD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG;oBACT,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa;oBACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,KAAK,EAAE,IAAI,GAAG,EAAE;iBACjB,CAAC;gBACF,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;gBACtC,2BAA2B;YAC7B,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,CAAC,UAAU,EAAE,CAAC;gBACvB,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;gBACvC,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;oBACxC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;oBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,YAAY;oBAC9B,UAAU,EAAE,CAAC;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,+DAA+D;QAC/D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO,GAAG,CAAC,QAAQ,CAAC;YACtB,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnB,OAAO,IAAI,CAAC,QAAQ,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,KAAK,UAAU,qBAAqB,CAAC,GAAe;IAClD,MAAM,cAAc,GAAG;QACrB,GAAG,CAAC,KAAK,CAAiB,oBAAoB,CAAC;QAC/C,GAAG,CAAC,KAAK,CAAsB,0BAA0B,CAAC;QAC1D,GAAG,CAAC,KAAK,CAA2B,0BAA0B,CAAC;KAChE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAA2B;QACrD,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAgC;QAC/D,wBAAwB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAqC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;YACtB,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,cAAc;YACpB,6BAA6B,EAAE,QAAQ,CAAC,kCAAkC;YAC1E,2BAA2B,EAAE,KAAK;YAClC,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE;YAC7B,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,IAAI,EAAE,QAAQ,CAAC,WAAW;YAC1B,MAAM,EAAE,QAAQ,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;YACtE,IAAI,EAAE,mBAAmB;YACzB,6BAA6B,EAC3B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,wBAAwB,KAAK,4BAA4B;YACtF,2BAA2B,EAAE,KAAK;YAClC,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAA+B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -2,7 +2,7 @@ export declare const CONNECTED_APPS_QUERY = "SELECT Id,Name,OptionsAllowAdminApp
|
|
|
2
2
|
export declare const ALL_EXISTING_USER_IDS = "SELECT Id FROM User";
|
|
3
3
|
export declare const EXTERNAL_CLIENT_APPS_QUERY = "SELECT Id,MasterLabel,DeveloperName,DistributionState FROM ExternalClientApplication";
|
|
4
4
|
export declare const EXTERNAL_APPS_OAUTH_POLICY = "SELECT ExternalClientApplicationId,PermittedUsersPolicyType FROM ExtlClntAppOauthPlcyCnfg";
|
|
5
|
-
export declare const OAUTH_TOKEN_QUERY = "SELECT User.Username,UseCount,AppName,AppMenuItem.ApplicationId FROM OauthToken";
|
|
5
|
+
export declare const OAUTH_TOKEN_QUERY = "SELECT User.Username,UseCount,LastUsedDate,AppName,AppMenuItem.ApplicationId FROM OauthToken";
|
|
6
6
|
export declare const COUNT_TOKEN_QUERY = "SELECT COUNT() FROM OauthToken";
|
|
7
7
|
export declare function formatCountSoql(userIds: string[]): string;
|
|
8
8
|
export declare function formatTokenSoql(userIds: string[]): string;
|
|
@@ -3,7 +3,7 @@ export const CONNECTED_APPS_QUERY = 'SELECT Id,Name,OptionsAllowAdminApprovedUse
|
|
|
3
3
|
export const ALL_EXISTING_USER_IDS = 'SELECT Id FROM User';
|
|
4
4
|
export const EXTERNAL_CLIENT_APPS_QUERY = 'SELECT Id,MasterLabel,DeveloperName,DistributionState FROM ExternalClientApplication';
|
|
5
5
|
export const EXTERNAL_APPS_OAUTH_POLICY = 'SELECT ExternalClientApplicationId,PermittedUsersPolicyType FROM ExtlClntAppOauthPlcyCnfg';
|
|
6
|
-
export const OAUTH_TOKEN_QUERY = 'SELECT User.Username,UseCount,AppName,AppMenuItem.ApplicationId FROM OauthToken';
|
|
6
|
+
export const OAUTH_TOKEN_QUERY = 'SELECT User.Username,UseCount,LastUsedDate,AppName,AppMenuItem.ApplicationId FROM OauthToken';
|
|
7
7
|
export const COUNT_TOKEN_QUERY = 'SELECT COUNT() FROM OauthToken';
|
|
8
8
|
export function formatCountSoql(userIds) {
|
|
9
9
|
return `${COUNT_TOKEN_QUERY} WHERE UserId IN (${joinToSoqlIN(userIds)})`;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/connected-apps/queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,6EAA6E,CAAC;AAClH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,0BAA0B,GACrC,sFAAsF,CAAC;AACzF,MAAM,CAAC,MAAM,0BAA0B,GACrC,2FAA2F,CAAC;AAC9F,MAAM,CAAC,MAAM,iBAAiB,
|
|
1
|
+
{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/connected-apps/queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,6EAA6E,CAAC;AAClH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,0BAA0B,GACrC,sFAAsF,CAAC;AACzF,MAAM,CAAC,MAAM,0BAA0B,GACrC,2FAA2F,CAAC;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAC5B,8FAA8F,CAAC;AACjG,MAAM,CAAC,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAElE,MAAM,UAAU,eAAe,CAAC,OAAiB;IAC/C,OAAO,GAAG,iBAAiB,qBAAqB,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAiB;IAC/C,OAAO,GAAG,iBAAiB,qBAAqB,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;AAC3E,CAAC"}
|
package/lib/salesforce/utils.js
CHANGED
|
@@ -8,4 +8,14 @@ export function chunkArray(ids, chunkSize) {
|
|
|
8
8
|
export function joinToSoqlIN(ids) {
|
|
9
9
|
return ids.map((id) => `'${id}'`).join(',');
|
|
10
10
|
}
|
|
11
|
+
export function maxDate(date1Iso, date2iso) {
|
|
12
|
+
if (!date1Iso) {
|
|
13
|
+
return date2iso;
|
|
14
|
+
}
|
|
15
|
+
if (!date2iso) {
|
|
16
|
+
return date1Iso;
|
|
17
|
+
}
|
|
18
|
+
const highestDate = Math.max(Date.parse(date1Iso), Date.parse(date2iso));
|
|
19
|
+
return new Date(highestDate).toISOString();
|
|
20
|
+
}
|
|
11
21
|
//# sourceMappingURL=utils.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/salesforce/utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,UAAU,CAAC,GAAa,EAAE,SAAiB;IACzD,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAa;IACxC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC"}
|
|
1
|
+
{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/salesforce/utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,UAAU,CAAC,GAAa,EAAE,SAAiB;IACzD,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAa;IACxC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAiB,EAAE,QAAiB;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC"}
|
|
@@ -13,3 +13,11 @@ App is configured to allow users to self-authorize, but Api Security Access over
|
|
|
13
13
|
# violations.app-used-but-not-registered
|
|
14
14
|
|
|
15
15
|
App has %s users (total use count %s), but is not installed.
|
|
16
|
+
|
|
17
|
+
# violations.app-used-details-with-last-access
|
|
18
|
+
|
|
19
|
+
%s [%s token - %s uses - last access on %s]
|
|
20
|
+
|
|
21
|
+
# violations.app-used-details-without-last-access
|
|
22
|
+
|
|
23
|
+
%s [%s token - %s uses - unknown last access]
|
package/messages/rules.users.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# violations.no-other-apex-api-logins
|
|
2
2
|
|
|
3
|
-
%s logins with "Other Apex API" in the last %s days, which is a deprecated and
|
|
3
|
+
%s logins with "Other Apex API" in the last %s days, which is a deprecated and unsecure login type.
|
|
4
4
|
|
|
5
5
|
# violations.inactive-since-n-days
|
|
6
6
|
|
package/oclif.manifest.json
CHANGED
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@j-schreiber/sf-cli-security-audit",
|
|
3
3
|
"description": "Salesforce CLI plugin to automate highly configurable security audits",
|
|
4
|
-
"version": "0.19.
|
|
4
|
+
"version": "0.19.2",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
7
7
|
"url": "git+https://github.com/j-schreiber/js-sf-cli-security-audit"
|