@j-schreiber/sf-cli-security-audit 0.20.1 → 0.21.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/lib/libs/audit-engine/index.d.ts +8 -0
- package/lib/libs/audit-engine/registry/definitions.d.ts +8 -0
- package/lib/libs/audit-engine/registry/definitions.js +2 -0
- package/lib/libs/audit-engine/registry/definitions.js.map +1 -1
- package/lib/libs/audit-engine/registry/policies/permissionSets.d.ts +4 -3
- package/lib/libs/audit-engine/registry/policies/permissionSets.js +1 -0
- package/lib/libs/audit-engine/registry/policies/permissionSets.js.map +1 -1
- package/lib/libs/audit-engine/registry/policies/profiles.d.ts +3 -1
- package/lib/libs/audit-engine/registry/policies/profiles.js +1 -0
- package/lib/libs/audit-engine/registry/policies/profiles.js.map +1 -1
- package/lib/libs/audit-engine/registry/policies/users.js +1 -1
- package/lib/libs/audit-engine/registry/policies/users.js.map +1 -1
- package/lib/libs/audit-engine/registry/policy.js +2 -6
- package/lib/libs/audit-engine/registry/policy.js.map +1 -1
- package/lib/libs/audit-engine/registry/roles/roleManager.d.ts +15 -5
- package/lib/libs/audit-engine/registry/roles/roleManager.js +92 -14
- package/lib/libs/audit-engine/registry/roles/roleManager.js.map +1 -1
- package/lib/libs/audit-engine/registry/roles/roleManager.types.d.ts +24 -5
- package/lib/libs/audit-engine/registry/roles/roleManager.types.js +3 -1
- package/lib/libs/audit-engine/registry/roles/roleManager.types.js.map +1 -1
- package/lib/libs/audit-engine/registry/roles/userRole.d.ts +47 -6
- package/lib/libs/audit-engine/registry/roles/userRole.js +126 -32
- package/lib/libs/audit-engine/registry/roles/userRole.js.map +1 -1
- package/lib/libs/audit-engine/registry/rules/enforceObjectAccessOnUser.d.ts +8 -0
- package/lib/libs/audit-engine/registry/rules/enforceObjectAccessOnUser.js +39 -0
- package/lib/libs/audit-engine/registry/rules/enforceObjectAccessOnUser.js.map +1 -0
- package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.js +4 -16
- package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.js.map +1 -1
- package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.d.ts +0 -1
- package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.js +17 -31
- package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.js.map +1 -1
- package/lib/libs/audit-engine/registry/shape/auditConfigShape.d.ts +8 -0
- package/lib/libs/audit-engine/registry/shape/schema.d.ts +33 -0
- package/lib/libs/audit-engine/registry/shape/schema.js +24 -3
- package/lib/libs/audit-engine/registry/shape/schema.js.map +1 -1
- package/lib/libs/audit-engine/registry/shape/shapeValidation.js +15 -4
- package/lib/libs/audit-engine/registry/shape/shapeValidation.js.map +1 -1
- package/lib/salesforce/describes/orgDescribe.d.ts +6 -0
- package/lib/salesforce/describes/orgDescribe.js +10 -1
- package/lib/salesforce/describes/orgDescribe.js.map +1 -1
- package/lib/salesforce/mdapi/metadataRegistry.js +3 -1
- package/lib/salesforce/mdapi/metadataRegistry.js.map +1 -1
- package/messages/auditShapeValidation.md +4 -0
- package/messages/rules.enforceClassificationPresets.md +14 -2
- package/oclif.manifest.json +1 -1
- package/package.json +1 -1
|
@@ -14,6 +14,14 @@ export const validator = (parseResult) => {
|
|
|
14
14
|
if (parseResult.inventory.users) {
|
|
15
15
|
errors.push(...validateRoledEntity(parseResult.controls.roles, parseResult.inventory.users, 'users'));
|
|
16
16
|
}
|
|
17
|
+
const defaultRole = parseResult.policies.users?.options.defaultRoleForMissingUsers;
|
|
18
|
+
const defaultRoleExistsAndIsValid = defaultRole !== undefined && parseResult.controls.roles[defaultRole] !== undefined;
|
|
19
|
+
if (defaultRole && !defaultRoleExistsAndIsValid) {
|
|
20
|
+
errors.push({
|
|
21
|
+
message: messages.getMessage('DefaultRoleForMissingUsersDoesNotExist', [defaultRole]),
|
|
22
|
+
path: ['policies', 'users', 'options', 'defaultRoleForMissingUsers'],
|
|
23
|
+
});
|
|
24
|
+
}
|
|
17
25
|
}
|
|
18
26
|
if (!parseResult.policies || Object.keys(parseResult.policies).length === 0) {
|
|
19
27
|
errors.push({
|
|
@@ -29,8 +37,11 @@ export function verifyRoleDefinitions(roles, orgDescribe) {
|
|
|
29
37
|
if (!isPermissionControl(roleDef.permissions) || !roleDef.permissions) {
|
|
30
38
|
continue;
|
|
31
39
|
}
|
|
32
|
-
for (const permissionBlockName of [
|
|
33
|
-
|
|
40
|
+
for (const permissionBlockName of [
|
|
41
|
+
{ listName: 'userPermissions', isValid: (permName) => orgDescribe.isValid(permName) },
|
|
42
|
+
{ listName: 'customPermissions', isValid: (permName) => orgDescribe.isValidCustomPerm(permName) },
|
|
43
|
+
]) {
|
|
44
|
+
const permBlock = roleDef.permissions[permissionBlockName.listName];
|
|
34
45
|
if (!permBlock) {
|
|
35
46
|
continue;
|
|
36
47
|
}
|
|
@@ -38,9 +49,9 @@ export function verifyRoleDefinitions(roles, orgDescribe) {
|
|
|
38
49
|
const namedPerms = permBlock[permProp];
|
|
39
50
|
if (namedPerms) {
|
|
40
51
|
for (const permName of namedPerms) {
|
|
41
|
-
if (!
|
|
52
|
+
if (!permissionBlockName.isValid(permName)) {
|
|
42
53
|
warnings.push({
|
|
43
|
-
path: ['Controls', 'Roles', roleName, permissionBlockName, permProp, permName],
|
|
54
|
+
path: ['Controls', 'Roles', roleName, permissionBlockName.listName, permProp, permName],
|
|
44
55
|
message: messages.getMessage('PermissionDoesNotExistOnOrg'),
|
|
45
56
|
});
|
|
46
57
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"shapeValidation.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/shapeValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EAA0B,mBAAmB,EAAgC,MAAM,aAAa,CAAC;AAExG,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,sBAAsB,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,WAAiE,EAAiB,EAAE;IAC5G,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,KAA6B,EAAE,WAAwB;IAC3F,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAe,CAAC;IAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACtE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,mBAAmB,IAAI,
|
|
1
|
+
{"version":3,"file":"shapeValidation.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/shape/shapeValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EAA0B,mBAAmB,EAAgC,MAAM,aAAa,CAAC;AAExG,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,sBAAsB,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,WAAiE,EAAiB,EAAE;IAC5G,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,0BAA0B,CAAC;QACnF,MAAM,2BAA2B,GAC/B,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC;QACrF,IAAI,WAAW,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,wCAAwC,EAAE,CAAC,WAAW,CAAC,CAAC;gBACrF,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,4BAA4B,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,IAAI,EAAE,CAAC,UAAU,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,KAA6B,EAAE,WAAwB;IAC3F,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAe,CAAC;IAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACtE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,mBAAmB,IAAI;YAChC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC7F,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE;SACjG,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACpE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAU,EAAE,CAAC;gBAClE,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,UAAU,EAAE,CAAC;oBACf,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;wBAClC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAC3C,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;gCACvF,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,6BAA6B,CAAC;6BAC5D,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA6B,EAC7B,OAAqC,EACrC,UAAkB;IAElB,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
|
@@ -37,6 +37,12 @@ export default class OrgDescribe {
|
|
|
37
37
|
* @param permissionName
|
|
38
38
|
*/
|
|
39
39
|
isValid(permissionName: string): boolean;
|
|
40
|
+
/**
|
|
41
|
+
* Checks if the permission is valid custom permission for the org
|
|
42
|
+
*
|
|
43
|
+
* @param permissionName
|
|
44
|
+
*/
|
|
45
|
+
isValidCustomPerm(permissionName: string): boolean;
|
|
40
46
|
/**
|
|
41
47
|
* Finds all custom permissions that exist on the target org.
|
|
42
48
|
*
|
|
@@ -69,6 +69,15 @@ export default class OrgDescribe {
|
|
|
69
69
|
return (this.userPermissions.has(permissionName.toLowerCase()) &&
|
|
70
70
|
this.userPermissions.get(permissionName.toLowerCase())?.name === permissionName);
|
|
71
71
|
}
|
|
72
|
+
/**
|
|
73
|
+
* Checks if the permission is valid custom permission for the org
|
|
74
|
+
*
|
|
75
|
+
* @param permissionName
|
|
76
|
+
*/
|
|
77
|
+
isValidCustomPerm(permissionName) {
|
|
78
|
+
return (this.customPermissions.has(permissionName.toLowerCase()) &&
|
|
79
|
+
this.customPermissions.get(permissionName.toLowerCase())?.name === permissionName);
|
|
80
|
+
}
|
|
72
81
|
/**
|
|
73
82
|
* Finds all custom permissions that exist on the target org.
|
|
74
83
|
*
|
|
@@ -88,7 +97,7 @@ async function fetchCustomPermissions(con) {
|
|
|
88
97
|
const customPerms = await con.query(CUSTOM_PERMS_QUERY);
|
|
89
98
|
if (customPerms.records.length > 0) {
|
|
90
99
|
for (const cp of customPerms.records) {
|
|
91
|
-
result.set(cp.DeveloperName, {
|
|
100
|
+
result.set(cp.DeveloperName.toLowerCase(), {
|
|
92
101
|
name: cp.DeveloperName,
|
|
93
102
|
label: cp.MasterLabel,
|
|
94
103
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"orgDescribe.js","sourceRoot":"","sources":["../../../src/salesforce/describes/orgDescribe.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAE5D,OAAO,EAAE,kBAAkB,EAAkC,MAAM,wBAAwB,CAAC;AAE5F,4DAA4D;AAC5D,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,OAAO,OAAO,WAAW;IAC9B;;OAEG;IACI,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,iBAAiB,CAA2B;IAC5C,eAAe,CAA2B;IAElD,gBAAuB,CAAC;IAExB;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAiB;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACI,kBAAkB,CAAC,cAAsB;QAC9C,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzE,IACE,cAAc,KAAK,aAAa;gBAChC,CAAC,aAAa,CAAC,MAAM,IAAI,sBAAsB,IAAI,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAC5F,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,kBAAkB;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACI,OAAO,CAAC,cAAsB;QACnC,OAAO,CACL,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,KAAK,cAAc,CAChF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,oBAAoB;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;;AAGH,KAAK,UAAU,oBAAoB,CAAC,GAAiB;IACnD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAiB;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,KAAK,CAAqB,kBAAkB,CAAC,CAAC;IAC5E,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE;
|
|
1
|
+
{"version":3,"file":"orgDescribe.js","sourceRoot":"","sources":["../../../src/salesforce/describes/orgDescribe.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAE5D,OAAO,EAAE,kBAAkB,EAAkC,MAAM,wBAAwB,CAAC;AAE5F,4DAA4D;AAC5D,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,OAAO,OAAO,WAAW;IAC9B;;OAEG;IACI,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,iBAAiB,CAA2B;IAC5C,eAAe,CAA2B;IAElD,gBAAuB,CAAC;IAExB;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAiB;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACI,kBAAkB,CAAC,cAAsB;QAC9C,MAAM,aAAa,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzE,IACE,cAAc,KAAK,aAAa;gBAChC,CAAC,aAAa,CAAC,MAAM,IAAI,sBAAsB,IAAI,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAC5F,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,kBAAkB;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACI,OAAO,CAAC,cAAsB;QACnC,OAAO,CACL,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,KAAK,cAAc,CAChF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,cAAsB;QAC7C,OAAO,CACL,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YACxD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,KAAK,cAAc,CAClF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,oBAAoB;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;;AAGH,KAAK,UAAU,oBAAoB,CAAC,GAAiB;IACnD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAiB;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,KAAK,CAAqB,kBAAkB,CAAC,CAAC;IAC5E,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE;gBACzC,IAAI,EAAE,EAAE,CAAC,aAAa;gBACtB,KAAK,EAAE,EAAE,CAAC,WAAW;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAG,QAAwC;IAC5D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAiB;IACrD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7D,OAAO,CAAC,MAAM;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;SACvD,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACvD,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE;YACjD,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACL,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,GAAiB;IACvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACpD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChG,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB;IACtC,OAAO,QAAQ,EAAE,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC"}
|
|
@@ -8,13 +8,14 @@ const NamedTypesRegistry = {
|
|
|
8
8
|
retrieveType: 'PermissionSet',
|
|
9
9
|
rootNodeName: 'PermissionSet',
|
|
10
10
|
parser: new XMLParser({
|
|
11
|
-
isArray: (jpath) => ['userPermissions', 'fieldPermissions', 'customPermissions', 'classAccesses'].includes(jpath),
|
|
11
|
+
isArray: (jpath) => ['userPermissions', 'fieldPermissions', 'customPermissions', 'classAccesses', 'objectPermissions'].includes(jpath),
|
|
12
12
|
}),
|
|
13
13
|
parsePostProcessor: (parseResult) => ({
|
|
14
14
|
...parseResult,
|
|
15
15
|
userPermissions: parseResult.userPermissions ?? [],
|
|
16
16
|
customPermissions: parseResult.customPermissions ?? [],
|
|
17
17
|
classAccesses: parseResult.classAccesses ?? [],
|
|
18
|
+
objectPermissions: parseResult.objectPermissions ?? [],
|
|
18
19
|
}),
|
|
19
20
|
}),
|
|
20
21
|
Profile: new NamedMetadataQueryable({
|
|
@@ -25,6 +26,7 @@ const NamedTypesRegistry = {
|
|
|
25
26
|
userPermissions: parseResult.userPermissions ?? [],
|
|
26
27
|
customPermissions: parseResult.customPermissions ?? [],
|
|
27
28
|
classAccesses: parseResult.classAccesses ?? [],
|
|
29
|
+
objectPermissions: parseResult.objectPermissions ?? [],
|
|
28
30
|
}),
|
|
29
31
|
}),
|
|
30
32
|
Settings: new GenericSettingsMetadata(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"metadataRegistry.js","sourceRoot":"","sources":["../../../src/salesforce/mdapi/metadataRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAM5C,OAAO,aAAa,MAAM,wBAAwB,CAAC;AACnD,OAAO,iBAAiB,MAAM,4BAA4B,CAAC;AAC3D,OAAO,sBAAsB,MAAM,oCAAoC,CAAC;AACxE,OAAO,uBAAuB,MAAM,8BAA8B,CAAC;AAEnE,MAAM,kBAAkB,GAAG;IACzB,aAAa,EAAE,IAAI,aAAa,CAAoC;QAClE,YAAY,EAAE,eAAe;QAC7B,YAAY,EAAE,eAAe;QAC7B,MAAM,EAAE,IAAI,SAAS,CAAC;YACpB,OAAO,EAAE,CAAC,KAAK,EAAW,EAAE,CAC1B,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC,QAAQ,
|
|
1
|
+
{"version":3,"file":"metadataRegistry.js","sourceRoot":"","sources":["../../../src/salesforce/mdapi/metadataRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAM5C,OAAO,aAAa,MAAM,wBAAwB,CAAC;AACnD,OAAO,iBAAiB,MAAM,4BAA4B,CAAC;AAC3D,OAAO,sBAAsB,MAAM,oCAAoC,CAAC;AACxE,OAAO,uBAAuB,MAAM,8BAA8B,CAAC;AAEnE,MAAM,kBAAkB,GAAG;IACzB,aAAa,EAAE,IAAI,aAAa,CAAoC;QAClE,YAAY,EAAE,eAAe;QAC7B,YAAY,EAAE,eAAe;QAC7B,MAAM,EAAE,IAAI,SAAS,CAAC;YACpB,OAAO,EAAE,CAAC,KAAK,EAAW,EAAE,CAC1B,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CACzG,KAAK,CACN;SACJ,CAAC;QACF,kBAAkB,EAAE,CAAC,WAAW,EAAiB,EAAE,CAAC,CAAC;YACnD,GAAG,WAAW;YACd,eAAe,EAAE,WAAW,CAAC,eAAe,IAAI,EAAE;YAClD,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,IAAI,EAAE;YACtD,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI,EAAE;YAC9C,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,IAAI,EAAE;SACvD,CAAC;KACH,CAAC;IACF,OAAO,EAAE,IAAI,sBAAsB,CAAwB;QACzD,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,MAAM;QACjB,kBAAkB,EAAE,CAAC,WAAW,EAAmB,EAAE,CAAC,CAAC;YACrD,GAAG,WAAW;YACd,eAAe,EAAE,WAAW,CAAC,eAAe,IAAI,EAAE;YAClD,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,IAAI,EAAE;YACtD,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI,EAAE;YAC9C,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,IAAI,EAAE;SACvD,CAAC;KACH,CAAC;IACF,QAAQ,EAAE,IAAI,uBAAuB,EAAE;CACxC,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACxB,oBAAoB,EAAE,IAAI,iBAAiB,CAAkD;QAC3F,YAAY,EAAE,sBAAsB;QACpC,YAAY,EAAE,cAAc;QAC5B,YAAY,EAAE,UAAU;KACzB,CAAC;CACH,CAAC;AAgBF,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,UAAU,EAAE,kBAAkB;IAC9B,cAAc,EAAE,iBAAiB;CAClC,CAAC"}
|
|
@@ -6,9 +6,9 @@ Duplicate role identifier after normalization found: %s was already defined, %s
|
|
|
6
6
|
|
|
7
7
|
Tried to access a role that does not exist: %s.
|
|
8
8
|
|
|
9
|
-
#
|
|
9
|
+
# RoleReferencesControlThatDoesNotExist
|
|
10
10
|
|
|
11
|
-
Role %s references
|
|
11
|
+
Role "%s" references a %s control that does not exist: %s
|
|
12
12
|
|
|
13
13
|
# violations.classification-preset-mismatch
|
|
14
14
|
|
|
@@ -18,6 +18,14 @@ Permission is classified as "%s" and not allowed in role "%s".
|
|
|
18
18
|
|
|
19
19
|
Permission is BLOCKED and not allowed for any role.
|
|
20
20
|
|
|
21
|
+
# violations.permission-is-denied
|
|
22
|
+
|
|
23
|
+
Permission is denied by role "%s".
|
|
24
|
+
|
|
25
|
+
# violations.object-access-denied
|
|
26
|
+
|
|
27
|
+
Assigned role "%s" does not allow granted permission.
|
|
28
|
+
|
|
21
29
|
# warnings.permission-unknown
|
|
22
30
|
|
|
23
31
|
Permission classified as UNKNOWN. Update classification to LOW or higher to resolve.
|
|
@@ -29,3 +37,7 @@ Permission is assigned, but was not found in classification. Refresh or add manu
|
|
|
29
37
|
# error.failed-to-resolve-role
|
|
30
38
|
|
|
31
39
|
The assigned role "%s" was not valid for this audit. Check your role definitions.
|
|
40
|
+
|
|
41
|
+
# errors.profile-like-has-no-metadata
|
|
42
|
+
|
|
43
|
+
%s has no metadata and cannot be audited.
|
package/oclif.manifest.json
CHANGED
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@j-schreiber/sf-cli-security-audit",
|
|
3
3
|
"description": "Salesforce CLI plugin to automate highly configurable security audits",
|
|
4
|
-
"version": "0.
|
|
4
|
+
"version": "0.21.0",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
7
7
|
"url": "git+https://github.com/j-schreiber/js-sf-cli-security-audit"
|