@j-schreiber/sf-cli-security-audit 0.19.2 → 0.20.0

package/lib/libs/audit-engine/registry/rules/noInactiveUsers.js.map

@@ -1 +1 @@
-{"version":3,"file":"noInactiveUsers.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/noInactiveUsers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,UAAuC,MAAM,iBAAiB,CAAC;AAEtE,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;AAE5F,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,UAAwB;IAClD,UAAU,CAAC;IAE5B,YAAmB,SAA0D;QAC3E,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChE,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;oBACzD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,kCAAkC,EAAE;4BAC/D,UAAU;4BACV,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;yBACvC,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACvE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,gCAAgC,EAAE;wBAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;wBACxC,eAAe;qBAChB,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,SAAmB;IAC3C,MAAM,WAAW,GAAG,4BAA4B,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,WAAW,CAAC,IAAI,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}
+{"version":3,"file":"noInactiveUsers.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/noInactiveUsers.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;AAE5F,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,UAAwB;IAClD,OAAO,CAAC;IAEzB,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC/F,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChE,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;oBACtD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,kCAAkC,EAAE;4BAC/D,UAAU;4BACV,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;yBACvC,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACvE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,gCAAgC,EAAE;wBAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;wBACxC,eAAe;qBAChB,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}

package/lib/libs/audit-engine/registry/rules/noOtherApexApiLogins.d.ts

@@ -2,6 +2,7 @@ import { PartialPolicyRuleResult, RuleAuditContext } from '../context.types.js';
 import { ResolvedUser } from '../policies/users.js';
 import PolicyRule, { RuleOptions } from './policyRule.js';
 export default class NoOtherApexApiLogins extends PolicyRule<ResolvedUser> {
+    private readonly options;
     constructor(opts: RuleOptions);
     run(context: RuleAuditContext<ResolvedUser>): Promise<PartialPolicyRuleResult>;
 }

package/lib/libs/audit-engine/registry/rules/noOtherApexApiLogins.js

@@ -1,10 +1,16 @@
+import z from 'zod';
 import { Messages } from '@salesforce/core';
 import PolicyRule from './policyRule.js';
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.users');
+const NoOtherApexApiLoginsOptionsSchema = z.strictObject({
+    includeAllLoginAttempts: z.boolean().default(true),
+});
 export default class NoOtherApexApiLogins extends PolicyRule {
+    options;
     constructor(opts) {
         super(opts);
+        this.options = this.parseOptions(NoOtherApexApiLoginsOptionsSchema, opts.ruleConfig, 'users.yml');
     }
     run(context) {
         const result = this.initResult();
@@ -12,19 +18,42 @@ export default class NoOtherApexApiLogins extends PolicyRule {
             if (!user.logins) {
                 continue;
             }
-            for (const loginSummary of user.logins) {
-                if (loginSummary.loginType === 'Other Apex API') {
-                    result.violations.push({
-                        identifier: [user.username, new Date(loginSummary.lastLogin).toISOString()],
-                        message: messages.getMessage('violations.no-other-apex-api-logins', [
-                            loginSummary.loginCount,
-                            this.opts.auditConfig.policies.users?.options.analyseLastNDaysOfLoginHistory,
-                        ]),
-                    });
-                }
+            const logins = filterLoginAggregate(this.options.includeAllLoginAttempts, user.logins);
+            for (const loginSummary of logins) {
+                result.violations.push({
+                    identifier: [user.username, new Date(loginSummary.lastLogin).toISOString()],
+                    message: messages.getMessage(loginSummary.includesAttempts
+                        ? 'violations.no-attempted-other-apex-api-logins'
+                        : 'violations.no-successful-other-apex-api-logins', [loginSummary.loginCount, this.opts.auditConfig.policies.users?.options.analyseLastNDaysOfLoginHistory]),
+                });
             }
         }
         return Promise.resolve(result);
     }
 }
+function filterLoginAggregate(includeAll, userLogins) {
+    if (!userLogins) {
+        return [];
+    }
+    const apexApiLogins = userLogins.filter((login) => login.loginType === 'Other Apex API');
+    const filteredLogins = includeAll ? apexApiLogins : apexApiLogins.filter((login) => login.status === 'Success');
+    const map = filteredLogins.reduce((acc, login) => {
+        const key = `${login.loginType}::${login.application}`;
+        const existing = acc.get(key);
+        if (existing) {
+            existing.loginCount += login.loginCount;
+            existing.lastLogin = Math.max(existing.lastLogin, login.lastLogin);
+            existing.includesAttempts = existing.includesAttempts || login.status !== 'Success';
+        }
+        else {
+            acc.set(key, {
+                loginCount: login.loginCount,
+                lastLogin: login.lastLogin,
+                includesAttempts: login.status !== 'Success',
+            });
+        }
+        return acc;
+    }, new Map());
+    return Array.from(map.values());
+}
 //# sourceMappingURL=noOtherApexApiLogins.js.map

package/lib/libs/audit-engine/registry/rules/noOtherApexApiLogins.js.map

@@ -1 +1 @@
-{"version":3,"file":"noOtherApexApiLogins.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/noOtherApexApiLogins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;AAE5F,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,UAAwB;IACxE,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,YAAY,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;oBAChD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;wBAC3E,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,qCAAqC,EAAE;4BAClE,YAAY,CAAC,UAAU;4BACvB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,8BAA8B;yBAC7E,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"noOtherApexApiLogins.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/noOtherApexApiLogins.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;AAE5F,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,UAAwB;IACvD,OAAO,CAAC;IAEzB,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,iCAAiC,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACpG,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACvF,KAAK,MAAM,YAAY,IAAI,MAAM,EAAE,CAAC;gBAClC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC3E,OAAO,EAAE,QAAQ,CAAC,UAAU,CAC1B,YAAY,CAAC,gBAAgB;wBAC3B,CAAC,CAAC,+CAA+C;wBACjD,CAAC,CAAC,gDAAgD,EACpD,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,8BAA8B,CAAC,CACxG;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,UAAmB,EAAE,UAAkC;IACnF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;IACzF,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAChH,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;YACxC,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACnE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;gBACX,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,IAAI,GAAG,EAAiC,CAAC,CAAC;IAE7C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAClC,CAAC"}

package/lib/libs/audit-engine/registry/rules/policyRule.d.ts

@@ -1,8 +1,10 @@
+import z from 'zod';
 import { PartialPolicyRuleResult, RowLevelPolicyRule, RuleAuditContext } from '../context.types.js';
 import { AuditRunConfig } from '../definitions.js';
 export type RuleOptions = {
     auditConfig: AuditRunConfig;
     ruleDisplayName: string;
+    ruleConfig?: unknown;
 };
 export type ConfigurableRuleOptions<T> = RuleOptions & {
     ruleConfig: T;
@@ -13,5 +15,6 @@ export default abstract class PolicyRule<EntityType> implements RowLevelPolicyRu
     ruleDisplayName: string;
     constructor(opts: RuleOptions);
     protected initResult(): PartialPolicyRuleResult;
+    protected parseOptions<T>(schema: z.ZodType<T>, ruleConfig: unknown, policyFile: string): T;
     abstract run(context: RuleAuditContext<EntityType>): Promise<PartialPolicyRuleResult>;
 }

package/lib/libs/audit-engine/registry/rules/policyRule.js

@@ -1,4 +1,5 @@
 import { Messages } from '@salesforce/core';
+import { throwAsSfError } from '../schema.js';
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 export default class PolicyRule {
     opts;
@@ -18,5 +19,14 @@ export default class PolicyRule {
             errors: new Array(),
         };
     }
+    parseOptions(schema, ruleConfig, policyFile) {
+        const parseResult = schema.safeParse(ruleConfig ?? {});
+        if (parseResult.success) {
+            return parseResult.data; // typed as T
+        }
+        else {
+            throwAsSfError(policyFile, parseResult.error, ['rules', this.ruleDisplayName, 'options']);
+        }
+    }
 }
 //# sourceMappingURL=policyRule.js.map

package/lib/libs/audit-engine/registry/rules/policyRule.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyRule.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/policyRule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAW7D,MAAM,CAAC,OAAO,OAAgB,UAAU;IAIT;IAHtB,WAAW,CAAiB;IAC5B,eAAe,CAAS;IAE/B,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC9C,CAAC;IAES,UAAU;QAClB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,UAAU,EAAE,IAAI,KAAK,EAAuB;YAC5C,eAAe,EAAE,IAAI,KAAK,EAA2B;YACrD,QAAQ,EAAE,IAAI,KAAK,EAAwB;YAC3C,MAAM,EAAE,IAAI,KAAK,EAAwB;SAC1C,CAAC;IACJ,CAAC;CAGF"}
+{"version":3,"file":"policyRule.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/policyRule.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAY7D,MAAM,CAAC,OAAO,OAAgB,UAAU;IAIT;IAHtB,WAAW,CAAiB;IAC5B,eAAe,CAAS;IAE/B,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC9C,CAAC;IAES,UAAU;QAClB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,UAAU,EAAE,IAAI,KAAK,EAAuB;YAC5C,eAAe,EAAE,IAAI,KAAK,EAA2B;YACrD,QAAQ,EAAE,IAAI,KAAK,EAAwB;YAC3C,MAAM,EAAE,IAAI,KAAK,EAAwB;SAC1C,CAAC;IACJ,CAAC;IAES,YAAY,CAAI,MAAoB,EAAE,UAAmB,EAAE,UAAkB;QACrF,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa;QACxC,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,UAAU,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;CAGF"}

package/lib/libs/audit-engine/registry/shape/auditConfigShape.d.ts

@@ -4,66 +4,85 @@
  * the audit config that is used by rules and policies.
  */
 export declare const BaseAuditConfigShape: {
-    definitions: {
+    controls: {
         files: {
             roles: {
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    permissions: import("zod").ZodOptional<import("zod").ZodXor<readonly [import("zod").ZodArray<import("zod").ZodString>, import("zod").ZodObject<{
+                        allowedClassifications: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>>>;
+                        userPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
+                            allowed: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                            denied: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                            required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        }, import("zod/v4/core").$strip>>;
+                        customPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
+                            allowed: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                            denied: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                            required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        }, import("zod/v4/core").$strip>>;
+                    }, import("zod/v4/core").$strip>]>>;
+                }, import("zod/v4/core").$strict>>;
+            };
+            permissions: {
                 schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
                     allowedClassifications: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>>>;
-                    allowedPermissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    deniedPermissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    userPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
+                        allowed: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        denied: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    }, import("zod/v4/core").$strip>>;
+                    customPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
+                        allowed: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        denied: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    }, import("zod/v4/core").$strip>>;
                 }, import("zod/v4/core").$strip>>;
             };
         };
     };
-    classifications: {
+    shape: {
         files: {
             userPermissions: {
-                schema: import("zod").ZodObject<{
-                    permissions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        label: import("zod").ZodOptional<import("zod").ZodString>;
-                        reason: import("zod").ZodOptional<import("zod").ZodString>;
-                        classification: import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>;
-                    }, import("zod/v4/core").$strip>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    label: import("zod").ZodOptional<import("zod").ZodString>;
+                    reason: import("zod").ZodOptional<import("zod").ZodString>;
+                    classification: import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>;
+                }, import("zod/v4/core").$strip>>;
+                isCountable: boolean;
             };
             customPermissions: {
-                schema: import("zod").ZodObject<{
-                    permissions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        label: import("zod").ZodOptional<import("zod").ZodString>;
-                        reason: import("zod").ZodOptional<import("zod").ZodString>;
-                        classification: import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>;
-                    }, import("zod/v4/core").$strip>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    label: import("zod").ZodOptional<import("zod").ZodString>;
+                    reason: import("zod").ZodOptional<import("zod").ZodString>;
+                    classification: import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>;
+                }, import("zod/v4/core").$strip>>;
+                isCountable: boolean;
             };
+        };
+    };
+    inventory: {
+        files: {
             profiles: {
-                schema: import("zod").ZodObject<{
-                    profiles: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodString;
-                        allowedLoginIps: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
-                            from: import("zod").ZodString;
-                            to: import("zod").ZodString;
-                        }, import("zod/v4/core").$strip>>>;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    role: import("zod").ZodString;
+                    allowedLoginIps: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+                        from: import("zod").ZodString;
+                        to: import("zod").ZodString;
+                    }, import("zod/v4/core").$strip>>>;
+                }, import("zod/v4/core").$strict>>;
+                isCountable: boolean;
             };
             permissionSets: {
-                schema: import("zod").ZodObject<{
-                    permissionSets: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    role: import("zod").ZodString;
+                }, import("zod/v4/core").$strict>>;
+                isCountable: boolean;
             };
             users: {
-                schema: import("zod").ZodObject<{
-                    users: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodString;
-                    }, import("zod/v4/core").$strip>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    role: import("zod").ZodString;
+                }, import("zod/v4/core").$strip>>;
+                isCountable: boolean;
             };
         };
     };
@@ -82,6 +101,8 @@ export declare const BaseAuditConfigShape: {
                     path: string[];
                     errorName: string;
                 }[];
+                isCountable: boolean;
+                entities: string;
             };
             permissionSets: {
                 schema: import("zod").ZodObject<{
@@ -96,6 +117,8 @@ export declare const BaseAuditConfigShape: {
                     path: string[];
                     errorName: string;
                 }[];
+                isCountable: boolean;
+                entities: string;
             };
             connectedApps: {
                 schema: import("zod").ZodObject<{
@@ -106,6 +129,8 @@ export declare const BaseAuditConfigShape: {
                     }, import("zod/v4/core").$strip>>>;
                     options: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
                 }, import("zod/v4/core").$strip>;
+                isCountable: boolean;
+                entities: string;
             };
             users: {
                 schema: import("zod").ZodObject<{
@@ -119,6 +144,8 @@ export declare const BaseAuditConfigShape: {
                         analyseLastNDaysOfLoginHistory: import("zod").ZodOptional<import("zod").ZodNumber>;
                     }, import("zod/v4/core").$strict>;
                 }, import("zod/v4/core").$strip>;
+                isCountable: boolean;
+                entities: string;
             };
             settings: {
                 schema: import("zod").ZodObject<{
@@ -129,6 +156,8 @@ export declare const BaseAuditConfigShape: {
                     }, import("zod/v4/core").$strip>>>;
                     options: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
                 }, import("zod/v4/core").$strip>;
+                isCountable: boolean;
+                entities: string;
             };
         };
     };

package/lib/libs/audit-engine/registry/shape/auditConfigShape.js

@@ -1,61 +1,57 @@
-import { PermissionsClassificationFileSchema, PermissionSetsClassificationFileSchema, PolicyFileSchema, ProfilesClassificationFileSchema, RoleDefinitionsFileSchema, UserClassificationFileSchema, UserPolicyFileSchema, } from './schema.js';
+import { ComposableRolesFileSchema, PermissionControlsFileSchema, PermissionsClassificationFileSchema, PermissionSetsClassificationFileSchema, PolicyFileSchema, ProfilesClassificationFileSchema, UserClassificationFileSchema, UserPolicyFileSchema, } from './schema.js';
 /**
  * The shape defines the directory structure and schema files to
  * parse YAML files. It is the foundation to derive the runtime type of
  * the audit config that is used by rules and policies.
  */
 export const BaseAuditConfigShape = {
-    definitions: {
+    controls: {
         files: {
-            roles: { schema: RoleDefinitionsFileSchema },
+            roles: { schema: ComposableRolesFileSchema },
+            permissions: { schema: PermissionControlsFileSchema },
         },
     },
-    classifications: {
+    shape: {
         files: {
-            userPermissions: {
-                schema: PermissionsClassificationFileSchema,
-                entities: 'permissions',
-            },
-            customPermissions: {
-                schema: PermissionsClassificationFileSchema,
-                entities: 'permissions',
-            },
-            profiles: {
-                schema: ProfilesClassificationFileSchema,
-                entities: 'profiles',
-            },
-            permissionSets: {
-                schema: PermissionSetsClassificationFileSchema,
-                entities: 'permissionSets',
-            },
-            users: {
-                schema: UserClassificationFileSchema,
-                entities: 'users',
-            },
+            userPermissions: { schema: PermissionsClassificationFileSchema, isCountable: true },
+            customPermissions: { schema: PermissionsClassificationFileSchema, isCountable: true },
+        },
+    },
+    inventory: {
+        files: {
+            profiles: { schema: ProfilesClassificationFileSchema, isCountable: true },
+            permissionSets: { schema: PermissionSetsClassificationFileSchema, isCountable: true },
+            users: { schema: UserClassificationFileSchema, isCountable: true },
         },
     },
     policies: {
         files: {
             profiles: {
                 schema: PolicyFileSchema,
-                dependencies: [
-                    { path: ['classifications', 'userPermissions'], errorName: 'UserPermClassificationRequiredForProfiles' },
-                ],
+                dependencies: [{ path: ['shape', 'userPermissions'], errorName: 'UserPermClassificationRequiredForProfiles' }],
+                isCountable: true,
+                entities: 'rules',
             },
             permissionSets: {
                 schema: PolicyFileSchema,
-                dependencies: [
-                    { path: ['classifications', 'userPermissions'], errorName: 'UserPermClassificationRequiredForPermSets' },
-                ],
+                dependencies: [{ path: ['shape', 'userPermissions'], errorName: 'UserPermClassificationRequiredForPermSets' }],
+                isCountable: true,
+                entities: 'rules',
             },
             connectedApps: {
                 schema: PolicyFileSchema,
+                isCountable: true,
+                entities: 'rules',
             },
             users: {
                 schema: UserPolicyFileSchema,
+                isCountable: true,
+                entities: 'rules',
             },
             settings: {
                 schema: PolicyFileSchema,
+                isCountable: true,
+                entities: 'rules',
             },
         },
     },

package/lib/libs/audit-engine/registry/shape/auditConfigShape.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditConfigShape.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/auditConfigShape.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,gBAAgB,EAChB,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,WAAW,EAAE;QACX,KAAK,EAAE;YACL,KAAK,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;SAC7C;KACF;IACD,eAAe,EAAE;QACf,KAAK,EAAE;YACL,eAAe,EAAE;gBACf,MAAM,EAAE,mCAAmC;gBAC3C,QAAQ,EAAE,aAAa;aACxB;YACD,iBAAiB,EAAE;gBACjB,MAAM,EAAE,mCAAmC;gBAC3C,QAAQ,EAAE,aAAa;aACxB;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,gCAAgC;gBACxC,QAAQ,EAAE,UAAU;aACrB;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,sCAAsC;gBAC9C,QAAQ,EAAE,gBAAgB;aAC3B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,4BAA4B;gBACpC,QAAQ,EAAE,OAAO;aAClB;SACF;KACF;IACD,QAAQ,EAAE;QACR,KAAK,EAAE;YACL,QAAQ,EAAE;gBACR,MAAM,EAAE,gBAAgB;gBACxB,YAAY,EAAE;oBACZ,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE;iBACzG;aACF;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,gBAAgB;gBACxB,YAAY,EAAE;oBACZ,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE;iBACzG;aACF;YACD,aAAa,EAAE;gBACb,MAAM,EAAE,gBAAgB;aACzB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,oBAAoB;aAC7B;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,gBAAgB;aACzB;SACF;KACF;CACF,CAAC"}
+{"version":3,"file":"auditConfigShape.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/auditConfigShape.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,mCAAmC,EACnC,sCAAsC,EACtC,gBAAgB,EAChB,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE;QACR,KAAK,EAAE;YACL,KAAK,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;YAC5C,WAAW,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;SACtD;KACF;IACD,KAAK,EAAE;QACL,KAAK,EAAE;YACL,eAAe,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,WAAW,EAAE,IAAI,EAAE;YACnF,iBAAiB,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,WAAW,EAAE,IAAI,EAAE;SACtF;KACF;IACD,SAAS,EAAE;QACT,KAAK,EAAE;YACL,QAAQ,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,WAAW,EAAE,IAAI,EAAE;YACzE,cAAc,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE,WAAW,EAAE,IAAI,EAAE;YACrF,KAAK,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,WAAW,EAAE,IAAI,EAAE;SACnE;KACF;IACD,QAAQ,EAAE;QACR,KAAK,EAAE;YACL,QAAQ,EAAE;gBACR,MAAM,EAAE,gBAAgB;gBACxB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE,CAAC;gBAC9G,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,gBAAgB;gBACxB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE,CAAC;gBAC9G,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;YACD,aAAa,EAAE;gBACb,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;SACF;KACF;CACF,CAAC"}

package/lib/libs/audit-engine/registry/shape/schema.d.ts

@@ -32,55 +32,85 @@ export declare enum UserPrivilegeLevel {
     /** Disables the profile for audit */
     UNKNOWN = "Unknown"
 }
-declare const PermissionClassifications: z.ZodRecord<z.ZodString, z.ZodObject<{
+declare const IndividualPermissionControlSchema: z.ZodObject<{
+    allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.z.core.$strip>;
+export declare const PermissionControlSchema: z.ZodObject<{
+    allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
+    userPermissions: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.z.core.$strip>>;
+    customPermissions: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.z.core.$strip>>;
+}, z.z.core.$strip>;
+export declare const PermissionControlsFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
+    userPermissions: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.z.core.$strip>>;
+    customPermissions: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.z.core.$strip>>;
+}, z.z.core.$strip>>;
+export declare const ResolvedRoleDefinitionSchema: z.ZodObject<{
+    permissions: z.ZodOptional<z.ZodObject<{
+        allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
+        userPermissions: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.z.core.$strip>>;
+        customPermissions: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.z.core.$strip>>;
+    }, z.z.core.$strip>>;
+}, z.z.core.$strip>;
+export declare const ComposableRolesFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    permissions: z.ZodOptional<z.ZodXor<readonly [z.ZodArray<z.ZodString>, z.ZodObject<{
+        allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
+        userPermissions: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.z.core.$strip>>;
+        customPermissions: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.z.core.$strip>>;
+    }, z.z.core.$strip>]>>;
+}, z.z.core.$strict>>;
+export declare const PermissionsClassificationFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     label: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
     classification: z.ZodEnum<typeof PermissionRiskLevel>;
 }, z.z.core.$strip>>;
-declare const PermSetMap: z.ZodRecord<z.ZodString, z.ZodObject<{
-    role: z.ZodString;
-}, z.z.core.$strict>>;
-declare const ProfilesMap: z.ZodRecord<z.ZodString, z.ZodObject<{
+export declare const ProfilesClassificationFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     role: z.ZodString;
     allowedLoginIps: z.ZodOptional<z.ZodArray<z.ZodObject<{
         from: z.ZodString;
         to: z.ZodString;
     }, z.z.core.$strip>>>;
 }, z.z.core.$strict>>;
-declare const UsersMap: z.ZodRecord<z.ZodString, z.ZodObject<{
+export declare const PermissionSetsClassificationFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    role: z.ZodString;
+}, z.z.core.$strict>>;
+export declare const UserClassificationFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     role: z.ZodString;
 }, z.z.core.$strip>>;
-export declare const RoleDefinitionsFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
-    allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
-    allowedPermissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deniedPermissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.z.core.$strip>>;
-export declare const PermissionsClassificationFileSchema: z.ZodObject<{
-    permissions: z.ZodRecord<z.ZodString, z.ZodObject<{
-        label: z.ZodOptional<z.ZodString>;
-        reason: z.ZodOptional<z.ZodString>;
-        classification: z.ZodEnum<typeof PermissionRiskLevel>;
-    }, z.z.core.$strip>>;
-}, z.z.core.$strip>;
-export declare const ProfilesClassificationFileSchema: z.ZodObject<{
-    profiles: z.ZodRecord<z.ZodString, z.ZodObject<{
-        role: z.ZodString;
-        allowedLoginIps: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            from: z.ZodString;
-            to: z.ZodString;
-        }, z.z.core.$strip>>>;
-    }, z.z.core.$strict>>;
-}, z.z.core.$strip>;
-export declare const PermissionSetsClassificationFileSchema: z.ZodObject<{
-    permissionSets: z.ZodRecord<z.ZodString, z.ZodObject<{
-        role: z.ZodString;
-    }, z.z.core.$strict>>;
-}, z.z.core.$strip>;
-export declare const UserClassificationFileSchema: z.ZodObject<{
-    users: z.ZodRecord<z.ZodString, z.ZodObject<{
-        role: z.ZodString;
-    }, z.z.core.$strip>>;
-}, z.z.core.$strip>;
 export declare const PolicyFileSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -110,13 +140,17 @@ export type NestedStructure = {
  * risk or a structure of nested identifiers.
  */
 export declare const AcceptedRisksSchema: z.ZodType<NestedStructure>;
-export type PermissionClassifications = z.infer<typeof PermissionClassifications>;
-export type PermissionSetClassifications = z.infer<typeof PermSetMap>;
-export type ProfileClassifications = z.infer<typeof ProfilesMap>;
-export type UserClassifications = z.infer<typeof UsersMap>;
+export type PermissionClassifications = z.infer<typeof PermissionsClassificationFileSchema>;
+export type PermissionSetClassifications = z.infer<typeof PermissionSetsClassificationFileSchema>;
+export type ProfileClassifications = z.infer<typeof ProfilesClassificationFileSchema>;
+export type UserClassifications = z.infer<typeof UserClassificationFileSchema>;
 export type PolicyConfig = z.infer<typeof PolicyFileSchema>;
 export type UserPolicyConfig = z.infer<typeof UserPolicyFileSchema>;
 export type AcceptedRuleRisks = z.infer<typeof AcceptedRisksSchema>;
-export type RoleDefinitions = z.infer<typeof RoleDefinitionsFileSchema>;
-export type RoledEntityMap = z.infer<typeof PermSetMap>;
+export type PermissionControlSection = z.infer<typeof IndividualPermissionControlSchema>;
+export type ResolvedRoleDefinition = z.infer<typeof ResolvedRoleDefinitionSchema>;
+export type ComposableRolesControl = z.infer<typeof ComposableRolesFileSchema>;
+export type PermissionControl = z.infer<typeof PermissionControlSchema>;
+export type PermissionControls = z.infer<typeof PermissionControlsFileSchema>;
+export declare function isPermissionControl(maybeRoleDef: unknown): maybeRoleDef is PermissionControl;
 export {};

package/lib/libs/audit-engine/registry/shape/schema.js

@@ -55,34 +55,31 @@ const PermSetConfig = z.strictObject({
 const ProfileConfig = PermSetConfig.extend({
     allowedLoginIps: z.array(z.object({ from: z.string().regex(IP4RegExp), to: z.string().regex(IP4RegExp) })).optional(),
 });
-const PermSetMap = z.record(z.string(), PermSetConfig);
-const ProfilesMap = z.record(z.string(), ProfileConfig);
 const UserConfig = z.object({ role: z.string() });
-const UsersMap = z.record(z.string(), UserConfig);
 const UsersPolicyOptions = z.strictObject({
     defaultRoleForMissingUsers: z.string().default(UserPrivilegeLevel.STANDARD_USER),
     analyseLastNDaysOfLoginHistory: z.number().optional(),
 });
-const RoleDefinition = z.object({
+const IndividualPermissionControlSchema = z.object({
+    allowed: z.array(z.string()).optional(),
+    denied: z.array(z.string()).optional(),
+    required: z.array(z.string()).optional(),
+});
+// Controls File Schema
+export const PermissionControlSchema = z.object({
     allowedClassifications: z.array(z.enum(PermissionRiskLevel)).optional(),
-    allowedPermissions: z.array(z.string()).optional(),
-    deniedPermissions: z.array(z.string()).optional(),
+    userPermissions: IndividualPermissionControlSchema.optional(),
+    customPermissions: IndividualPermissionControlSchema.optional(),
 });
-// Definition File Schemata
-export const RoleDefinitionsFileSchema = z.record(z.string(), RoleDefinition);
+export const PermissionControlsFileSchema = z.record(z.string(), PermissionControlSchema);
+// new, V2
+export const ResolvedRoleDefinitionSchema = z.object({ permissions: PermissionControlSchema.optional() });
+export const ComposableRolesFileSchema = z.record(z.string(), z.object({ permissions: z.xor([z.array(z.string()), PermissionControlSchema]).optional() }).strict());
 // Classification File Schemata
-export const PermissionsClassificationFileSchema = z.object({
-    permissions: PermissionClassifications,
-});
-export const ProfilesClassificationFileSchema = z.object({
-    profiles: ProfilesMap,
-});
-export const PermissionSetsClassificationFileSchema = z.object({
-    permissionSets: PermSetMap,
-});
-export const UserClassificationFileSchema = z.object({
-    users: UsersMap,
-});
+export const PermissionsClassificationFileSchema = z.record(z.string(), PermClassification);
+export const ProfilesClassificationFileSchema = z.record(z.string(), ProfileConfig);
+export const PermissionSetsClassificationFileSchema = z.record(z.string(), PermSetConfig);
+export const UserClassificationFileSchema = z.record(z.string(), UserConfig);
 // Policy File Schemata
 export const PolicyFileSchema = z.object({
     enabled: z.boolean().default(true),
@@ -98,4 +95,9 @@ const allowedRiskSchema = z.object({ reason: z.string() });
  * risk or a structure of nested identifiers.
  */
 export const AcceptedRisksSchema = z.lazy(() => z.record(z.string(), z.union([allowedRiskSchema, AcceptedRisksSchema])));
+// Guard Functions
+export function isPermissionControl(maybeRoleDef) {
+    const parseResult = PermissionControlSchema.safeParse(maybeRoleDef);
+    return maybeRoleDef !== undefined && parseResult.success === true;
+}
 //# sourceMappingURL=schema.js.map