@j-schreiber/sf-cli-security-audit 0.19.3 → 0.20.1

package/lib/libs/audit-engine/registry/shape/auditConfigShape.d.ts

@@ -4,66 +4,85 @@
  * the audit config that is used by rules and policies.
  */
 export declare const BaseAuditConfigShape: {
-    definitions: {
+    controls: {
         files: {
             roles: {
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    permissions: import("zod").ZodOptional<import("zod").ZodXor<readonly [import("zod").ZodArray<import("zod").ZodString>, import("zod").ZodObject<{
+                        allowedClassifications: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>>>;
+                        userPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
+                            allowed: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                            denied: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                            required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        }, import("zod/v4/core").$strip>>;
+                        customPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
+                            allowed: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                            denied: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                            required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        }, import("zod/v4/core").$strip>>;
+                    }, import("zod/v4/core").$strip>]>>;
+                }, import("zod/v4/core").$strict>>;
+            };
+            permissions: {
                 schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
                     allowedClassifications: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>>>;
-                    allowedPermissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                    deniedPermissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    userPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
+                        allowed: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        denied: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    }, import("zod/v4/core").$strip>>;
+                    customPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
+                        allowed: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        denied: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                        required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    }, import("zod/v4/core").$strip>>;
                 }, import("zod/v4/core").$strip>>;
             };
         };
     };
-    classifications: {
+    shape: {
         files: {
             userPermissions: {
-                schema: import("zod").ZodObject<{
-                    permissions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        label: import("zod").ZodOptional<import("zod").ZodString>;
-                        reason: import("zod").ZodOptional<import("zod").ZodString>;
-                        classification: import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>;
-                    }, import("zod/v4/core").$strip>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    label: import("zod").ZodOptional<import("zod").ZodString>;
+                    reason: import("zod").ZodOptional<import("zod").ZodString>;
+                    classification: import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>;
+                }, import("zod/v4/core").$strip>>;
+                isCountable: boolean;
             };
             customPermissions: {
-                schema: import("zod").ZodObject<{
-                    permissions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        label: import("zod").ZodOptional<import("zod").ZodString>;
-                        reason: import("zod").ZodOptional<import("zod").ZodString>;
-                        classification: import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>;
-                    }, import("zod/v4/core").$strip>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    label: import("zod").ZodOptional<import("zod").ZodString>;
+                    reason: import("zod").ZodOptional<import("zod").ZodString>;
+                    classification: import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>;
+                }, import("zod/v4/core").$strip>>;
+                isCountable: boolean;
             };
+        };
+    };
+    inventory: {
+        files: {
             profiles: {
-                schema: import("zod").ZodObject<{
-                    profiles: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodString;
-                        allowedLoginIps: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
-                            from: import("zod").ZodString;
-                            to: import("zod").ZodString;
-                        }, import("zod/v4/core").$strip>>>;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    role: import("zod").ZodString;
+                    allowedLoginIps: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
+                        from: import("zod").ZodString;
+                        to: import("zod").ZodString;
+                    }, import("zod/v4/core").$strip>>>;
+                }, import("zod/v4/core").$strict>>;
+                isCountable: boolean;
             };
             permissionSets: {
-                schema: import("zod").ZodObject<{
-                    permissionSets: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    role: import("zod").ZodString;
+                }, import("zod/v4/core").$strict>>;
+                isCountable: boolean;
             };
             users: {
-                schema: import("zod").ZodObject<{
-                    users: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
-                        role: import("zod").ZodString;
-                    }, import("zod/v4/core").$strip>>;
-                }, import("zod/v4/core").$strip>;
-                entities: string;
+                schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    role: import("zod").ZodString;
+                }, import("zod/v4/core").$strip>>;
+                isCountable: boolean;
             };
         };
     };
@@ -82,6 +101,8 @@ export declare const BaseAuditConfigShape: {
                     path: string[];
                     errorName: string;
                 }[];
+                isCountable: boolean;
+                entities: string;
             };
             permissionSets: {
                 schema: import("zod").ZodObject<{
@@ -96,6 +117,8 @@ export declare const BaseAuditConfigShape: {
                     path: string[];
                     errorName: string;
                 }[];
+                isCountable: boolean;
+                entities: string;
             };
             connectedApps: {
                 schema: import("zod").ZodObject<{
@@ -106,6 +129,8 @@ export declare const BaseAuditConfigShape: {
                     }, import("zod/v4/core").$strip>>>;
                     options: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
                 }, import("zod/v4/core").$strip>;
+                isCountable: boolean;
+                entities: string;
             };
             users: {
                 schema: import("zod").ZodObject<{
@@ -119,6 +144,8 @@ export declare const BaseAuditConfigShape: {
                         analyseLastNDaysOfLoginHistory: import("zod").ZodOptional<import("zod").ZodNumber>;
                     }, import("zod/v4/core").$strict>;
                 }, import("zod/v4/core").$strip>;
+                isCountable: boolean;
+                entities: string;
             };
             settings: {
                 schema: import("zod").ZodObject<{
@@ -129,6 +156,8 @@ export declare const BaseAuditConfigShape: {
                     }, import("zod/v4/core").$strip>>>;
                     options: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
                 }, import("zod/v4/core").$strip>;
+                isCountable: boolean;
+                entities: string;
             };
         };
     };

package/lib/libs/audit-engine/registry/shape/auditConfigShape.js

@@ -1,61 +1,57 @@
-import { PermissionsClassificationFileSchema, PermissionSetsClassificationFileSchema, PolicyFileSchema, ProfilesClassificationFileSchema, RoleDefinitionsFileSchema, UserClassificationFileSchema, UserPolicyFileSchema, } from './schema.js';
+import { ComposableRolesFileSchema, PermissionControlsFileSchema, PermissionsClassificationFileSchema, PermissionSetsClassificationFileSchema, PolicyFileSchema, ProfilesClassificationFileSchema, UserClassificationFileSchema, UserPolicyFileSchema, } from './schema.js';
 /**
  * The shape defines the directory structure and schema files to
  * parse YAML files. It is the foundation to derive the runtime type of
  * the audit config that is used by rules and policies.
  */
 export const BaseAuditConfigShape = {
-    definitions: {
+    controls: {
         files: {
-            roles: { schema: RoleDefinitionsFileSchema },
+            roles: { schema: ComposableRolesFileSchema },
+            permissions: { schema: PermissionControlsFileSchema },
         },
     },
-    classifications: {
+    shape: {
         files: {
-            userPermissions: {
-                schema: PermissionsClassificationFileSchema,
-                entities: 'permissions',
-            },
-            customPermissions: {
-                schema: PermissionsClassificationFileSchema,
-                entities: 'permissions',
-            },
-            profiles: {
-                schema: ProfilesClassificationFileSchema,
-                entities: 'profiles',
-            },
-            permissionSets: {
-                schema: PermissionSetsClassificationFileSchema,
-                entities: 'permissionSets',
-            },
-            users: {
-                schema: UserClassificationFileSchema,
-                entities: 'users',
-            },
+            userPermissions: { schema: PermissionsClassificationFileSchema, isCountable: true },
+            customPermissions: { schema: PermissionsClassificationFileSchema, isCountable: true },
+        },
+    },
+    inventory: {
+        files: {
+            profiles: { schema: ProfilesClassificationFileSchema, isCountable: true },
+            permissionSets: { schema: PermissionSetsClassificationFileSchema, isCountable: true },
+            users: { schema: UserClassificationFileSchema, isCountable: true },
         },
     },
     policies: {
         files: {
             profiles: {
                 schema: PolicyFileSchema,
-                dependencies: [
-                    { path: ['classifications', 'userPermissions'], errorName: 'UserPermClassificationRequiredForProfiles' },
-                ],
+                dependencies: [{ path: ['shape', 'userPermissions'], errorName: 'UserPermClassificationRequiredForProfiles' }],
+                isCountable: true,
+                entities: 'rules',
             },
             permissionSets: {
                 schema: PolicyFileSchema,
-                dependencies: [
-                    { path: ['classifications', 'userPermissions'], errorName: 'UserPermClassificationRequiredForPermSets' },
-                ],
+                dependencies: [{ path: ['shape', 'userPermissions'], errorName: 'UserPermClassificationRequiredForPermSets' }],
+                isCountable: true,
+                entities: 'rules',
             },
             connectedApps: {
                 schema: PolicyFileSchema,
+                isCountable: true,
+                entities: 'rules',
             },
             users: {
                 schema: UserPolicyFileSchema,
+                isCountable: true,
+                entities: 'rules',
             },
             settings: {
                 schema: PolicyFileSchema,
+                isCountable: true,
+                entities: 'rules',
             },
         },
     },

package/lib/libs/audit-engine/registry/shape/auditConfigShape.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditConfigShape.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/auditConfigShape.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,gBAAgB,EAChB,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,WAAW,EAAE;QACX,KAAK,EAAE;YACL,KAAK,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;SAC7C;KACF;IACD,eAAe,EAAE;QACf,KAAK,EAAE;YACL,eAAe,EAAE;gBACf,MAAM,EAAE,mCAAmC;gBAC3C,QAAQ,EAAE,aAAa;aACxB;YACD,iBAAiB,EAAE;gBACjB,MAAM,EAAE,mCAAmC;gBAC3C,QAAQ,EAAE,aAAa;aACxB;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,gCAAgC;gBACxC,QAAQ,EAAE,UAAU;aACrB;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,sCAAsC;gBAC9C,QAAQ,EAAE,gBAAgB;aAC3B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,4BAA4B;gBACpC,QAAQ,EAAE,OAAO;aAClB;SACF;KACF;IACD,QAAQ,EAAE;QACR,KAAK,EAAE;YACL,QAAQ,EAAE;gBACR,MAAM,EAAE,gBAAgB;gBACxB,YAAY,EAAE;oBACZ,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE;iBACzG;aACF;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,gBAAgB;gBACxB,YAAY,EAAE;oBACZ,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE;iBACzG;aACF;YACD,aAAa,EAAE;gBACb,MAAM,EAAE,gBAAgB;aACzB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,oBAAoB;aAC7B;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,gBAAgB;aACzB;SACF;KACF;CACF,CAAC"}
+{"version":3,"file":"auditConfigShape.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/auditConfigShape.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,mCAAmC,EACnC,sCAAsC,EACtC,gBAAgB,EAChB,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ,EAAE;QACR,KAAK,EAAE;YACL,KAAK,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;YAC5C,WAAW,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;SACtD;KACF;IACD,KAAK,EAAE;QACL,KAAK,EAAE;YACL,eAAe,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,WAAW,EAAE,IAAI,EAAE;YACnF,iBAAiB,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,WAAW,EAAE,IAAI,EAAE;SACtF;KACF;IACD,SAAS,EAAE;QACT,KAAK,EAAE;YACL,QAAQ,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,WAAW,EAAE,IAAI,EAAE;YACzE,cAAc,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE,WAAW,EAAE,IAAI,EAAE;YACrF,KAAK,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,WAAW,EAAE,IAAI,EAAE;SACnE;KACF;IACD,QAAQ,EAAE;QACR,KAAK,EAAE;YACL,QAAQ,EAAE;gBACR,MAAM,EAAE,gBAAgB;gBACxB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE,CAAC;gBAC9G,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,gBAAgB;gBACxB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE,CAAC;gBAC9G,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;YACD,aAAa,EAAE;gBACb,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,OAAO;aAClB;SACF;KACF;CACF,CAAC"}

package/lib/libs/audit-engine/registry/shape/schema.d.ts

@@ -32,55 +32,85 @@ export declare enum UserPrivilegeLevel {
     /** Disables the profile for audit */
     UNKNOWN = "Unknown"
 }
-declare const PermissionClassifications: z.ZodRecord<z.ZodString, z.ZodObject<{
+declare const IndividualPermissionControlSchema: z.ZodObject<{
+    allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.z.core.$strip>;
+export declare const PermissionControlSchema: z.ZodObject<{
+    allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
+    userPermissions: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.z.core.$strip>>;
+    customPermissions: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.z.core.$strip>>;
+}, z.z.core.$strip>;
+export declare const PermissionControlsFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
+    userPermissions: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.z.core.$strip>>;
+    customPermissions: z.ZodOptional<z.ZodObject<{
+        allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.z.core.$strip>>;
+}, z.z.core.$strip>>;
+export declare const ResolvedRoleDefinitionSchema: z.ZodObject<{
+    permissions: z.ZodOptional<z.ZodObject<{
+        allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
+        userPermissions: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.z.core.$strip>>;
+        customPermissions: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.z.core.$strip>>;
+    }, z.z.core.$strip>>;
+}, z.z.core.$strip>;
+export declare const ComposableRolesFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    permissions: z.ZodOptional<z.ZodXor<readonly [z.ZodArray<z.ZodString>, z.ZodObject<{
+        allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
+        userPermissions: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.z.core.$strip>>;
+        customPermissions: z.ZodOptional<z.ZodObject<{
+            allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denied: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.z.core.$strip>>;
+    }, z.z.core.$strip>]>>;
+}, z.z.core.$strict>>;
+export declare const PermissionsClassificationFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     label: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
     classification: z.ZodEnum<typeof PermissionRiskLevel>;
 }, z.z.core.$strip>>;
-declare const PermSetMap: z.ZodRecord<z.ZodString, z.ZodObject<{
-    role: z.ZodString;
-}, z.z.core.$strict>>;
-declare const ProfilesMap: z.ZodRecord<z.ZodString, z.ZodObject<{
+export declare const ProfilesClassificationFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     role: z.ZodString;
     allowedLoginIps: z.ZodOptional<z.ZodArray<z.ZodObject<{
         from: z.ZodString;
         to: z.ZodString;
     }, z.z.core.$strip>>>;
 }, z.z.core.$strict>>;
-declare const UsersMap: z.ZodRecord<z.ZodString, z.ZodObject<{
+export declare const PermissionSetsClassificationFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    role: z.ZodString;
+}, z.z.core.$strict>>;
+export declare const UserClassificationFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     role: z.ZodString;
 }, z.z.core.$strip>>;
-export declare const RoleDefinitionsFileSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
-    allowedClassifications: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof PermissionRiskLevel>>>;
-    allowedPermissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deniedPermissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.z.core.$strip>>;
-export declare const PermissionsClassificationFileSchema: z.ZodObject<{
-    permissions: z.ZodRecord<z.ZodString, z.ZodObject<{
-        label: z.ZodOptional<z.ZodString>;
-        reason: z.ZodOptional<z.ZodString>;
-        classification: z.ZodEnum<typeof PermissionRiskLevel>;
-    }, z.z.core.$strip>>;
-}, z.z.core.$strip>;
-export declare const ProfilesClassificationFileSchema: z.ZodObject<{
-    profiles: z.ZodRecord<z.ZodString, z.ZodObject<{
-        role: z.ZodString;
-        allowedLoginIps: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            from: z.ZodString;
-            to: z.ZodString;
-        }, z.z.core.$strip>>>;
-    }, z.z.core.$strict>>;
-}, z.z.core.$strip>;
-export declare const PermissionSetsClassificationFileSchema: z.ZodObject<{
-    permissionSets: z.ZodRecord<z.ZodString, z.ZodObject<{
-        role: z.ZodString;
-    }, z.z.core.$strict>>;
-}, z.z.core.$strip>;
-export declare const UserClassificationFileSchema: z.ZodObject<{
-    users: z.ZodRecord<z.ZodString, z.ZodObject<{
-        role: z.ZodString;
-    }, z.z.core.$strip>>;
-}, z.z.core.$strip>;
 export declare const PolicyFileSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -110,13 +140,17 @@ export type NestedStructure = {
  * risk or a structure of nested identifiers.
  */
 export declare const AcceptedRisksSchema: z.ZodType<NestedStructure>;
-export type PermissionClassifications = z.infer<typeof PermissionClassifications>;
-export type PermissionSetClassifications = z.infer<typeof PermSetMap>;
-export type ProfileClassifications = z.infer<typeof ProfilesMap>;
-export type UserClassifications = z.infer<typeof UsersMap>;
+export type PermissionClassifications = z.infer<typeof PermissionsClassificationFileSchema>;
+export type PermissionSetClassifications = z.infer<typeof PermissionSetsClassificationFileSchema>;
+export type ProfileClassifications = z.infer<typeof ProfilesClassificationFileSchema>;
+export type UserClassifications = z.infer<typeof UserClassificationFileSchema>;
 export type PolicyConfig = z.infer<typeof PolicyFileSchema>;
 export type UserPolicyConfig = z.infer<typeof UserPolicyFileSchema>;
 export type AcceptedRuleRisks = z.infer<typeof AcceptedRisksSchema>;
-export type RoleDefinitions = z.infer<typeof RoleDefinitionsFileSchema>;
-export type RoledEntityMap = z.infer<typeof PermSetMap>;
+export type PermissionControlSection = z.infer<typeof IndividualPermissionControlSchema>;
+export type ResolvedRoleDefinition = z.infer<typeof ResolvedRoleDefinitionSchema>;
+export type ComposableRolesControl = z.infer<typeof ComposableRolesFileSchema>;
+export type PermissionControl = z.infer<typeof PermissionControlSchema>;
+export type PermissionControls = z.infer<typeof PermissionControlsFileSchema>;
+export declare function isPermissionControl(maybeRoleDef: unknown): maybeRoleDef is PermissionControl;
 export {};

package/lib/libs/audit-engine/registry/shape/schema.js

@@ -55,34 +55,31 @@ const PermSetConfig = z.strictObject({
 const ProfileConfig = PermSetConfig.extend({
     allowedLoginIps: z.array(z.object({ from: z.string().regex(IP4RegExp), to: z.string().regex(IP4RegExp) })).optional(),
 });
-const PermSetMap = z.record(z.string(), PermSetConfig);
-const ProfilesMap = z.record(z.string(), ProfileConfig);
 const UserConfig = z.object({ role: z.string() });
-const UsersMap = z.record(z.string(), UserConfig);
 const UsersPolicyOptions = z.strictObject({
     defaultRoleForMissingUsers: z.string().default(UserPrivilegeLevel.STANDARD_USER),
     analyseLastNDaysOfLoginHistory: z.number().optional(),
 });
-const RoleDefinition = z.object({
+const IndividualPermissionControlSchema = z.object({
+    allowed: z.array(z.string()).optional(),
+    denied: z.array(z.string()).optional(),
+    required: z.array(z.string()).optional(),
+});
+// Controls File Schema
+export const PermissionControlSchema = z.object({
     allowedClassifications: z.array(z.enum(PermissionRiskLevel)).optional(),
-    allowedPermissions: z.array(z.string()).optional(),
-    deniedPermissions: z.array(z.string()).optional(),
+    userPermissions: IndividualPermissionControlSchema.optional(),
+    customPermissions: IndividualPermissionControlSchema.optional(),
 });
-// Definition File Schemata
-export const RoleDefinitionsFileSchema = z.record(z.string(), RoleDefinition);
+export const PermissionControlsFileSchema = z.record(z.string(), PermissionControlSchema);
+// new, V2
+export const ResolvedRoleDefinitionSchema = z.object({ permissions: PermissionControlSchema.optional() });
+export const ComposableRolesFileSchema = z.record(z.string(), z.object({ permissions: z.xor([z.array(z.string()), PermissionControlSchema]).optional() }).strict());
 // Classification File Schemata
-export const PermissionsClassificationFileSchema = z.object({
-    permissions: PermissionClassifications,
-});
-export const ProfilesClassificationFileSchema = z.object({
-    profiles: ProfilesMap,
-});
-export const PermissionSetsClassificationFileSchema = z.object({
-    permissionSets: PermSetMap,
-});
-export const UserClassificationFileSchema = z.object({
-    users: UsersMap,
-});
+export const PermissionsClassificationFileSchema = z.record(z.string(), PermClassification);
+export const ProfilesClassificationFileSchema = z.record(z.string(), ProfileConfig);
+export const PermissionSetsClassificationFileSchema = z.record(z.string(), PermSetConfig);
+export const UserClassificationFileSchema = z.record(z.string(), UserConfig);
 // Policy File Schemata
 export const PolicyFileSchema = z.object({
     enabled: z.boolean().default(true),
@@ -98,4 +95,9 @@ const allowedRiskSchema = z.object({ reason: z.string() });
  * risk or a structure of nested identifiers.
  */
 export const AcceptedRisksSchema = z.lazy(() => z.record(z.string(), z.union([allowedRiskSchema, AcceptedRisksSchema])));
+// Guard Functions
+export function isPermissionControl(maybeRoleDef) {
+    const parseResult = PermissionControlSchema.safeParse(maybeRoleDef);
+    return maybeRoleDef !== undefined && parseResult.success === true;
+}
 //# sourceMappingURL=schema.js.map

package/lib/libs/audit-engine/registry/shape/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAE9D;;GAEG;AACH,MAAM,CAAN,IAAY,mBAaX;AAbD,WAAY,mBAAmB;IAC7B,+EAA+E;IAC/E,0CAAmB,CAAA;IACnB,6DAA6D;IAC7D,4CAAqB,CAAA;IACrB,sEAAsE;IACtE,oCAAa,CAAA;IACb,yDAAyD;IACzD,wCAAiB,CAAA;IACjB,qEAAqE;IACrE,kCAAW,CAAA;IACX,kFAAkF;IAClF,0CAAmB,CAAA;AACrB,CAAC,EAbW,mBAAmB,KAAnB,mBAAmB,QAa9B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,0CAA0C;IAC1C,6CAAuB,CAAA;IACvB,sCAAsC;IACtC,qCAAe,CAAA;IACf,wCAAwC;IACxC,+CAAyB,CAAA;IACzB,oCAAoC;IACpC,qDAA+B,CAAA;IAC/B,qCAAqC;IACrC,yCAAmB,CAAA;AACrB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,eAAe;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAE3E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAEnE,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtH,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;AAEvD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;AAExD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAElD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;AAElD,MAAM,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC;IACxC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC;IAChF,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,2BAA2B;AAE3B,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;AAE9E,+BAA+B;AAE/B,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,WAAW,EAAE,yBAAyB;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,cAAc,EAAE,UAAU;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,QAAQ;CAChB,CAAC,CAAC;AAEH,uBAAuB;AAEvB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AAUH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA+B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CACxE,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAE9D;;GAEG;AACH,MAAM,CAAN,IAAY,mBAaX;AAbD,WAAY,mBAAmB;IAC7B,+EAA+E;IAC/E,0CAAmB,CAAA;IACnB,6DAA6D;IAC7D,4CAAqB,CAAA;IACrB,sEAAsE;IACtE,oCAAa,CAAA;IACb,yDAAyD;IACzD,wCAAiB,CAAA;IACjB,qEAAqE;IACrE,kCAAW,CAAA;IACX,kFAAkF;IAClF,0CAAmB,CAAA;AACrB,CAAC,EAbW,mBAAmB,KAAnB,mBAAmB,QAa9B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,0CAA0C;IAC1C,6CAAuB,CAAA;IACvB,sCAAsC;IACtC,qCAAe,CAAA;IACf,wCAAwC;IACxC,+CAAyB,CAAA;IACzB,oCAAoC;IACpC,qDAA+B,CAAA;IAC/B,qCAAqC;IACrC,yCAAmB,CAAA;AACrB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,eAAe;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAE3E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAEnE,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtH,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAElD,MAAM,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC;IACxC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC;IAChF,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,uBAAuB;AAEvB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,eAAe,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAC7D,iBAAiB,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC;AAE1F,UAAU;AACV,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE1G,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAC/C,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CACrG,CAAC;AAEF,+BAA+B;AAE/B,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAE5F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;AAE1F,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;AAE7E,uBAAuB;AAEvB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AAUH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA+B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CACxE,CAAC;AAsBF,kBAAkB;AAElB,MAAM,UAAU,mBAAmB,CAAC,YAAqB;IACvD,MAAM,WAAW,GAAG,uBAAuB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,YAAY,KAAK,SAAS,IAAI,WAAW,CAAC,OAAO,KAAK,IAAI,CAAC;AACpE,CAAC"}

package/lib/libs/audit-engine/registry/shape/shapeValidation.d.ts

@@ -1,3 +1,6 @@
 import { ExtractAuditConfigTypes, RefineError } from '../../file-manager/fileManager.types.js';
+import { OrgDescribe } from '../../../../salesforce/index.js';
 import { BaseAuditConfigShape } from './auditConfigShape.js';
+import { ComposableRolesControl } from './schema.js';
 export declare const validator: (parseResult: ExtractAuditConfigTypes<typeof BaseAuditConfigShape>) => RefineError[];
+export declare function verifyRoleDefinitions(roles: ComposableRolesControl, orgDescribe: OrgDescribe): RefineError[];

package/lib/libs/audit-engine/registry/shape/shapeValidation.js

@@ -1,17 +1,18 @@
 import { Messages } from '@salesforce/core';
+import { isPermissionControl } from './schema.js';
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'auditShapeValidation');
 export const validator = (parseResult) => {
     const errors = [];
-    if (parseResult.definitions.roles) {
-        if (parseResult.classifications.profiles) {
-            errors.push(...validateRoledEntity(parseResult.definitions.roles, parseResult.classifications.profiles.profiles, 'profiles'));
+    if (parseResult.controls.roles) {
+        if (parseResult.inventory.profiles) {
+            errors.push(...validateRoledEntity(parseResult.controls.roles, parseResult.inventory.profiles, 'profiles'));
         }
-        if (parseResult.classifications.permissionSets) {
-            errors.push(...validateRoledEntity(parseResult.definitions.roles, parseResult.classifications.permissionSets.permissionSets, 'permissionSets'));
+        if (parseResult.inventory.permissionSets) {
+            errors.push(...validateRoledEntity(parseResult.controls.roles, parseResult.inventory.permissionSets, 'permissionSets'));
         }
-        if (parseResult.classifications.users) {
-            errors.push(...validateRoledEntity(parseResult.definitions.roles, parseResult.classifications.users.users, 'users'));
+        if (parseResult.inventory.users) {
+            errors.push(...validateRoledEntity(parseResult.controls.roles, parseResult.inventory.users, 'users'));
         }
     }
     if (!parseResult.policies || Object.keys(parseResult.policies).length === 0) {
@@ -22,6 +23,34 @@ export const validator = (parseResult) => {
     }
     return errors;
 };
+export function verifyRoleDefinitions(roles, orgDescribe) {
+    const warnings = new Array();
+    for (const [roleName, roleDef] of Object.entries(roles)) {
+        if (!isPermissionControl(roleDef.permissions) || !roleDef.permissions) {
+            continue;
+        }
+        for (const permissionBlockName of ['userPermissions', 'customPermissions']) {
+            const permBlock = roleDef.permissions[permissionBlockName];
+            if (!permBlock) {
+                continue;
+            }
+            for (const permProp of ['allowed', 'denied', 'required']) {
+                const namedPerms = permBlock[permProp];
+                if (namedPerms) {
+                    for (const permName of namedPerms) {
+                        if (!orgDescribe.isValid(permName)) {
+                            warnings.push({
+                                path: ['Controls', 'Roles', roleName, permissionBlockName, permProp, permName],
+                                message: messages.getMessage('PermissionDoesNotExistOnOrg'),
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return warnings;
+}
 function validateRoledEntity(roles, entries, entityName) {
     const errors = [];
     for (const [identifier, entity] of Object.entries(entries)) {

package/lib/libs/audit-engine/registry/shape/shapeValidation.js.map

@@ -1 +1 @@
-{"version":3,"file":"shapeValidation.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/shapeValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,sBAAsB,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,WAAiE,EAAiB,EAAE;IAC5G,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,WAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,GAAG,mBAAmB,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CACjH,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACT,GAAG,mBAAmB,CACpB,WAAW,CAAC,WAAW,CAAC,KAAK,EAC7B,WAAW,CAAC,eAAe,CAAC,cAAc,CAAC,cAAc,EACzD,gBAAgB,CACjB,CACF,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,GAAG,mBAAmB,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,SAAS,mBAAmB,CAAC,KAAsB,EAAE,OAAuB,EAAE,UAAkB;IAC9F,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"shapeValidation.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/shapeValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EAA0B,mBAAmB,EAAgC,MAAM,aAAa,CAAC;AAExG,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,sBAAsB,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,WAAiE,EAAiB,EAAE;IAC5G,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,KAA6B,EAAE,WAAwB;IAC3F,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAe,CAAC;IAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACtE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,mBAAmB,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CAAU,EAAE,CAAC;YACpF,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;YAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAU,EAAE,CAAC;gBAClE,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,UAAU,EAAE,CAAC;oBACf,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;wBAClC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACnC,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,CAAC;gCAC9E,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,6BAA6B,CAAC;6BAC5D,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA6B,EAC7B,OAAqC,EACrC,UAAkB;IAElB,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/lib/libs/conf-init/auditConfig.d.ts

@@ -22,5 +22,6 @@ export default class AuditConfig {
      * @param con
      */
     static init(targetCon: Connection, opts?: AuditInitOptions): Promise<AuditRunConfig>;
+    private static initSubtype;
 }
 export declare function initPolicyConfig<P extends Policies>(policyName: P): (typeof PolicyDefinitions)[P]['configType'];