@j-schreiber/sf-cli-security-audit 0.20.2 → 0.22.0

package/lib/libs/audit-engine/registry/roles/roleManager.types.d.ts

@@ -1,10 +1,11 @@
-import { Profile } from '@jsforce/jsforce-node/lib/api/metadata.js';
+import { Profile, ProfileObjectPermissions } from '@jsforce/jsforce-node/lib/api/metadata.js';
 import { PolicyRuleViolation, RuleComponentMessage } from '../result.types.js';
-import { ComposableRolesControl, PermissionClassifications, ResolvedRoleDefinition, PermissionControls } from '../shape/schema.js';
+import { ComposableRolesControl, PermissionClassifications, ResolvedRoleDefinition, PermissionControls, ObjectAccessControls, ObjectAccessControl } from '../shape/schema.js';
 export type RoleManagerConfig = {
     controls: {
         roles?: ComposableRolesControl;
         permissions?: PermissionControls;
+        objectAccess?: ObjectAccessControls;
     };
     shape: {
         userPermissions?: PermissionClassifications;
@@ -15,14 +16,24 @@ export type OrgAuditShape = RoleManagerConfig['shape'];
 export type OrgAuditControls = RoleManagerConfig['controls'];
 export type ComposableRoleDefinition = ComposableRolesControl['string'];
 export type DefinitiveRoleDefinition = Required<ResolvedRoleDefinition>;
-export type ResolvedProfileLike = {
+export type DefinitiveObjectAccessDef = Required<ObjectAccessControl['string']>;
+export type ProfileLike = {
     name: string;
-    role: string;
+    type: 'Profile' | 'PermissionSet';
+    metadata?: PartialProfileLike;
+};
+export type RefinedProfileLike = {
+    name: string;
+    type: 'Profile' | 'PermissionSet';
     metadata: PartialProfileLike;
 };
+export type ResolvedProfileLike = ProfileLike & {
+    role: string;
+};
 export type ScanResult = {
     violations: PolicyRuleViolation[];
     warnings: RuleComponentMessage[];
+    errors: RuleComponentMessage[];
 };
 export type UserRoleCompareResult = {
     /**
@@ -47,11 +58,18 @@ export type IUserRole = {
     isAllowed(perm: Partial<NamedPermissionClassification>): boolean;
     compareWith(otherRole: IUserRole): UserRoleCompareResult;
 };
-export type PartialProfileLike = Pick<Profile, PermissionsListKey>;
+export type PartialProfileLike = Pick<Profile, PermissionsListKey | 'objectPermissions'>;
 export type TypedPermission = {
     type: PermissionsListKey;
     name: string;
 };
+/**
+ * JsForce does not yet expose "viewAllFields" property. This override augments
+ * the standard export to be able to audit for it.
+ */
+export type ExtendedObjectAccessPermissions = ProfileObjectPermissions & {
+    viewAllFields?: boolean | null | undefined;
+};
 /**
  * Moves the "name" from the classifications map to object prop
  */
@@ -59,3 +77,4 @@ export type NamedPermissionClassification = PermissionClassifications['string']
     name: string;
 };
 export type PermissionsListKey = 'userPermissions' | 'customPermissions';
+export declare function isRefinedProfileLike(p: ProfileLike): p is RefinedProfileLike;

package/lib/libs/audit-engine/registry/roles/roleManager.types.js

@@ -1,2 +1,4 @@
-export {};
+export function isRefinedProfileLike(p) {
+    return p.metadata !== undefined;
+}
 //# sourceMappingURL=roleManager.types.js.map

package/lib/libs/audit-engine/registry/roles/roleManager.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"roleManager.types.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/roles/roleManager.types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"roleManager.types.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/roles/roleManager.types.ts"],"names":[],"mappings":"AAoGA,MAAM,UAAU,oBAAoB,CAAC,CAAc;IACjD,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;AAClC,CAAC"}

package/lib/libs/audit-engine/registry/roles/userRole.d.ts

@@ -1,15 +1,21 @@
-import { PermissionClassifications, UserPrivilegeLevel } from '../shape/schema.js';
-import { RoleManagerConfig, TypedPermission, UserRoleCompareResult } from './roleManager.types.js';
+import { PermissionClassifications, UserPrivilegeLevel, ObjectAccessControl } from '../shape/schema.js';
+import { RoleManagerConfig, TypedPermission, UserRoleCompareResult, DefinitiveObjectAccessDef } from './roleManager.types.js';
 type UserRolePermissions = {
     allowed: Set<string>;
     denied: Set<string>;
 };
+type UserRoleConfig = {
+    userPermissions: UserRolePermissions;
+    customPermissions: UserRolePermissions;
+    objectAccess: ObjectAccessControl;
+    roleOrdinalValue?: number;
+    isStrict: boolean;
+};
 export default class UserRole {
     roleName: string;
-    private userPermissions;
-    private customPermissions;
-    private roleOrdinalValue?;
-    constructor(roleName: string, userPermissions: UserRolePermissions, customPermissions: UserRolePermissions, roleOrdinalValue?: number | undefined);
+    private config;
+    private objectAccess;
+    constructor(roleName: string, config: Partial<UserRoleConfig>);
     /**
      * Evaluates if a permission is explicitly denied
      *
@@ -25,7 +31,23 @@ export default class UserRole {
      * @returns
      */
     isAllowed(permission: TypedPermission): boolean;
+    /**
+     * Runs a deep analysis of all access controls (permissions, object access, etc)
+     * of the role and determins which role is more permissive (or if they are intersecting)
+     *
+     * @param otherRole
+     * @returns
+     */
     compareWith(otherRole: UserRole): UserRoleCompareResult;
+    /**
+     * Returns coerced object access for the role. If the object is
+     * not explicitly defined, the "strict" flag determins if the role
+     * allows access or not.
+     *
+     * @param objName
+     * @returns
+     */
+    getObjectAccess(objName: string): DefinitiveObjectAccessDef;
 }
 export declare function newRoleFromDefinition(roleName: string, config: RoleManagerConfig): UserRole;
 export declare function newRoleFromOrdinals(roleName: UserPrivilegeLevel, perms?: PermissionClassifications): UserRole;

package/lib/libs/audit-engine/registry/roles/userRole.js

@@ -1,18 +1,32 @@
 import { merge } from '@salesforce/kit';
 import { Messages } from '@salesforce/core';
-import { PermissionRiskLevel, UserPrivilegeLevel, isPermissionControl, } from '../shape/schema.js';
+import { PermissionRiskLevel, UserPrivilegeLevel, } from '../shape/schema.js';
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.enforceClassificationPresets');
 export default class UserRole {
     roleName;
-    userPermissions;
-    customPermissions;
-    roleOrdinalValue;
-    constructor(roleName, userPermissions, customPermissions, roleOrdinalValue) {
+    config;
+    objectAccess;
+    constructor(roleName, config) {
         this.roleName = roleName;
-        this.userPermissions = userPermissions;
-        this.customPermissions = customPermissions;
-        this.roleOrdinalValue = roleOrdinalValue;
+        this.config = {
+            userPermissions: { allowed: new Set(), denied: new Set() },
+            customPermissions: { allowed: new Set(), denied: new Set() },
+            objectAccess: {},
+            isStrict: false,
+            ...config,
+        };
+        this.objectAccess = {};
+        for (const [objName, objDef] of Object.entries(config.objectAccess ?? {})) {
+            this.objectAccess[objName] = {
+                allowRead: false,
+                allowCreate: false,
+                allowDelete: false,
+                allowEdit: false,
+                viewAllFields: false,
+                ...objDef,
+            };
+        }
     }
     /**
      * Evaluates if a permission is explicitly denied
@@ -22,10 +36,10 @@ export default class UserRole {
      */
     isDenied(permission) {
         if (permission.type === 'customPermissions') {
-            return this.customPermissions.denied.has(permission.name.toLowerCase());
+            return this.config.customPermissions.denied.has(permission.name.toLowerCase());
         }
         else {
-            return this.userPermissions.denied.has(permission.name.toLowerCase());
+            return this.config.userPermissions.denied.has(permission.name.toLowerCase());
         }
     }
     /**
@@ -37,22 +51,31 @@ export default class UserRole {
      */
     isAllowed(permission) {
         if (permission.type === 'customPermissions') {
-            return this.customPermissions.allowed.has(permission.name);
+            return this.config.customPermissions.allowed.has(permission.name);
         }
         else {
-            return this.userPermissions.allowed.has(permission.name);
+            return this.config.userPermissions.allowed.has(permission.name);
         }
     }
+    /**
+     * Runs a deep analysis of all access controls (permissions, object access, etc)
+     * of the role and determins which role is more permissive (or if they are intersecting)
+     *
+     * @param otherRole
+     * @returns
+     */
     compareWith(otherRole) {
         const missingPermsInOther = new Array();
         const missingPermsInThis = new Array();
-        const isOrdinallyHigher = this.roleOrdinalValue && otherRole.roleOrdinalValue ? this.roleOrdinalValue >= otherRole.roleOrdinalValue : true;
-        const merged = new Set([...this.userPermissions.allowed, ...otherRole.userPermissions.allowed]);
+        const isOrdinallyHigher = this.config.roleOrdinalValue && otherRole.config.roleOrdinalValue
+            ? this.config.roleOrdinalValue >= otherRole.config.roleOrdinalValue
+            : true;
+        const merged = new Set([...this.config.userPermissions.allowed, ...otherRole.config.userPermissions.allowed]);
         for (const perm of merged) {
-            if (!this.userPermissions.allowed.has(perm)) {
+            if (!this.config.userPermissions.allowed.has(perm)) {
                 missingPermsInThis.push(perm);
             }
-            if (!otherRole.userPermissions.allowed.has(perm)) {
+            if (!otherRole.config.userPermissions.allowed.has(perm)) {
                 missingPermsInOther.push(perm);
             }
         }
@@ -62,17 +85,44 @@ export default class UserRole {
             missingPermsInOther,
         };
     }
+    /**
+     * Returns coerced object access for the role. If the object is
+     * not explicitly defined, the "strict" flag determins if the role
+     * allows access or not.
+     *
+     * @param objName
+     * @returns
+     */
+    getObjectAccess(objName) {
+        const allowedObjectAccess = this.objectAccess[objName];
+        // if object is not explicitly defined, we allow access for roles that are "not strict"
+        if (!allowedObjectAccess) {
+            return {
+                allowCreate: !this.config.isStrict,
+                allowEdit: !this.config.isStrict,
+                allowRead: !this.config.isStrict,
+                allowDelete: !this.config.isStrict,
+                viewAllFields: !this.config.isStrict,
+            };
+        }
+        return allowedObjectAccess;
+    }
 }
 export function newRoleFromDefinition(roleName, config) {
-    const { permissions } = resolveRole(roleName, config.controls);
-    const userPerms = buildAllowedPerms(permissions?.userPermissions, config.shape.userPermissions, permissions?.allowedClassifications);
-    const customPerms = buildAllowedPerms(permissions?.customPermissions, config.shape.customPermissions, permissions?.allowedClassifications);
-    return new UserRole(roleName, userPerms, customPerms);
+    const { permissions, objectAccess, strict } = resolveRole(roleName, config.controls);
+    const userPermissions = buildAllowedPerms(permissions?.userPermissions, config.shape.userPermissions, permissions?.allowedClassifications);
+    const customPermissions = buildAllowedPerms(permissions?.customPermissions, config.shape.customPermissions, permissions?.allowedClassifications);
+    return new UserRole(roleName, { userPermissions, customPermissions, objectAccess, isStrict: strict });
 }
 export function newRoleFromOrdinals(roleName, perms) {
     const roleOrdinalValue = resolvePresetOrdinalValue(roleName);
     if (!perms || roleName === UserPrivilegeLevel.UNKNOWN) {
-        return new UserRole(roleName, { allowed: new Set(), denied: new Set() }, { allowed: new Set(), denied: new Set() }, roleOrdinalValue);
+        return new UserRole(roleName, {
+            userPermissions: { allowed: new Set(), denied: new Set() },
+            customPermissions: { allowed: new Set(), denied: new Set() },
+            roleOrdinalValue,
+            objectAccess: {},
+        });
     }
     const allAllowed = new Set();
     for (const [permName, permDef] of Object.entries(perms)) {
@@ -80,7 +130,12 @@ export function newRoleFromOrdinals(roleName, perms) {
             allAllowed.add(permName);
         }
     }
-    return new UserRole(roleName, { allowed: allAllowed, denied: new Set() }, { allowed: new Set(), denied: new Set() }, roleOrdinalValue);
+    return new UserRole(roleName, {
+        userPermissions: { allowed: allAllowed, denied: new Set() },
+        customPermissions: { allowed: new Set(), denied: new Set() },
+        roleOrdinalValue,
+        objectAccess: {},
+    });
 }
 function resolvePresetOrdinalValue(value) {
     const indexOfValue = Object.values(UserPrivilegeLevel).indexOf(value);
@@ -94,22 +149,37 @@ function resolveRole(roleName, controls) {
     if (!rawRoleDef) {
         throw messages.createError('TriedToAccessRoleThatDoesNotExist', [roleName]);
     }
-    const permissions = {};
-    if (isPermissionControl(rawRoleDef.permissions)) {
-        merge(permissions, rawRoleDef.permissions);
+    const aggregatedRoleDef = { strict: rawRoleDef.strict ?? false };
+    for (const controlType of ['permissions', 'objectAccess']) {
+        try {
+            aggregatedRoleDef[controlType] = resolveReferences(rawRoleDef[controlType], controls[controlType]);
+        }
+        catch (err) {
+            const errorDetails = err instanceof Error ? err.message : 'Unknown';
+            throw messages.createError('RoleReferencesControlThatDoesNotExist', [roleName, controlType, errorDetails]);
+        }
     }
-    else {
-        for (const permRef of rawRoleDef.permissions ?? []) {
-            const referencedPerm = controls.permissions?.[permRef];
-            if (referencedPerm) {
-                merge(permissions, referencedPerm);
+    return aggregatedRoleDef;
+}
+function resolveReferences(roleDef, controls) {
+    const mergedControl = {};
+    const definitiveControls = controls ?? {};
+    const definitiveRoleDef = roleDef ?? {};
+    if (Array.isArray(definitiveRoleDef)) {
+        for (const controlRef of definitiveRoleDef) {
+            const referencedControl = definitiveControls[controlRef];
+            if (referencedControl) {
+                merge(mergedControl, referencedControl);
             }
             else {
-                throw messages.createError('RoleReferencesPermissionThatDoesNotExist', [roleName, permRef]);
+                throw new Error(controlRef);
             }
         }
     }
-    return { permissions };
+    else {
+        merge(mergedControl, definitiveRoleDef);
+    }
+    return mergedControl;
 }
 function buildAllowedPerms(rolePermDef, permClassifications, allowedClassifications) {
     const allowedPerms = new Set();

package/lib/libs/audit-engine/registry/roles/userRole.js.map

@@ -1 +1 @@
-{"version":3,"file":"userRole.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/roles/userRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAEL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAS5B,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,oCAAoC,CAAC,CAAC;AAOnH,MAAM,CAAC,OAAO,OAAO,QAAQ;IAElB;IACC;IACA;IACA;IAJV,YACS,QAAgB,EACf,eAAoC,EACpC,iBAAsC,EACtC,gBAAyB;QAH1B,aAAQ,GAAR,QAAQ,CAAQ;QACf,oBAAe,GAAf,eAAe,CAAqB;QACpC,sBAAiB,GAAjB,iBAAiB,CAAqB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAS;IAChC,CAAC;IAEJ;;;;;OAKG;IACI,QAAQ,CAAC,UAA2B;QACzC,IAAI,UAAU,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,UAA2B;QAC1C,IAAI,UAAU,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEM,WAAW,CAAC,SAAmB;QACpC,MAAM,mBAAmB,GAAG,IAAI,KAAK,EAAU,CAAC;QAChD,MAAM,kBAAkB,GAAG,IAAI,KAAK,EAAU,CAAC;QAC/C,MAAM,iBAAiB,GACrB,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;QACnH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAChG,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,OAAO;YACL,UAAU,EAAE,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB;YAChE,kBAAkB;YAClB,mBAAmB;SACpB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAyB;IAC/E,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,iBAAiB,CACjC,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,KAAK,CAAC,eAAe,EAC5B,WAAW,EAAE,sBAAsB,CACpC,CAAC;IACF,MAAM,WAAW,GAAG,iBAAiB,CACnC,WAAW,EAAE,iBAAiB,EAC9B,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAC9B,WAAW,EAAE,sBAAsB,CACpC,CAAC;IAEF,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAA4B,EAAE,KAAiC;IACjG,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACtD,OAAO,IAAI,QAAQ,CACjB,QAAQ,EACR,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,EACzD,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,EACzD,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,gBAAgB,IAAI,4BAA4B,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,QAAQ,CACjB,QAAQ,EACR,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,EAClD,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,EACzD,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,YAAY,CAAC;AAC/D,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,QAA0B;IAC/D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC,WAAW,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,IAAI,mBAAmB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACnD,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,cAAc,EAAE,CAAC;gBACnB,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,CAAC,WAAW,CAAC,0CAA0C,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAsC,EACtC,mBAA+C,EAC/C,sBAAiC;IAEjC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,sBAAsB,IAAI,mBAAmB,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtE,IAAI,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5D,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YAC3C,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5C,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YAC1C,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,IAAI,GAAG,CAAS,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"userRole.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/roles/userRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAEL,mBAAmB,EACnB,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAU5B,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,oCAAoC,CAAC,CAAC;AAenH,MAAM,CAAC,OAAO,OAAO,QAAQ;IAID;IAHlB,MAAM,CAAiB;IACvB,YAAY,CAA4C;IAEhE,YAA0B,QAAgB,EAAE,MAA+B;QAAjD,aAAQ,GAAR,QAAQ,CAAQ;QACxC,IAAI,CAAC,MAAM,GAAG;YACZ,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE;YAC1E,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE;YAC5E,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,KAAK;YACf,GAAG,MAAM;SACV,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG;gBAC3B,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,KAAK;gBAClB,WAAW,EAAE,KAAK;gBAClB,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,KAAK;gBACpB,GAAG,MAAM;aACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,QAAQ,CAAC,UAA2B;QACzC,IAAI,UAAU,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,UAA2B;QAC1C,IAAI,UAAU,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,WAAW,CAAC,SAAmB;QACpC,MAAM,mBAAmB,GAAG,IAAI,KAAK,EAAU,CAAC;QAChD,MAAM,kBAAkB,GAAG,IAAI,KAAK,EAAU,CAAC;QAC/C,MAAM,iBAAiB,GACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,SAAS,CAAC,MAAM,CAAC,gBAAgB;YAC/D,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,SAAS,CAAC,MAAM,CAAC,gBAAgB;YACnE,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9G,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,OAAO;YACL,UAAU,EAAE,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB;YAChE,kBAAkB;YAClB,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,eAAe,CAAC,OAAe;QACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACvD,uFAAuF;QACvF,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO;gBACL,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAClC,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAChC,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAChC,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAClC,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;aACrC,CAAC;QACJ,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAyB;IAC/E,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,iBAAiB,CACvC,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,KAAK,CAAC,eAAe,EAC5B,WAAW,EAAE,sBAAsB,CACpC,CAAC;IACF,MAAM,iBAAiB,GAAG,iBAAiB,CACzC,WAAW,EAAE,iBAAiB,EAC9B,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAC9B,WAAW,EAAE,sBAAsB,CACpC,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAA4B,EAAE,KAAiC;IACjG,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACtD,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE;YAC5B,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE;YAC1E,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE;YAC5E,gBAAgB;YAChB,YAAY,EAAE,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,gBAAgB,IAAI,4BAA4B,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE;QAC5B,eAAe,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE;QACnE,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE;QAC5E,gBAAgB;QAChB,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,YAAY,CAAC;AAC/D,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,QAA0B;IAC/D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC,WAAW,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,iBAAiB,GAAsC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;IACpG,KAAK,MAAM,WAAW,IAAI,CAAC,aAAa,EAAE,cAAc,CAAU,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,iBAAiB,CAAC,WAAW,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,QAAQ,CAAC,WAAW,CAAC,uCAAuC,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,OAAO,iBAA6C,CAAC;AACvD,CAAC;AAMD,SAAS,iBAAiB,CACxB,OAA0B,EAC1B,QAAiC;IAEjC,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,MAAM,kBAAkB,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC1C,MAAM,iBAAiB,GAAsB,OAAO,IAAI,EAAE,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;YAC3C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;YACzD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,KAAK,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAsC,EACtC,mBAA+C,EAC/C,sBAAiC;IAEjC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,sBAAsB,IAAI,mBAAmB,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtE,IAAI,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5D,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YAC3C,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5C,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YAC1C,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,IAAI,GAAG,CAAS,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClG,CAAC;AACJ,CAAC"}

package/lib/libs/audit-engine/registry/rules/enforceObjectAccessOnUser.d.ts

@@ -0,0 +1,8 @@
+import { PartialPolicyRuleResult, RuleAuditContext } from '../context.types.js';
+import { ResolvedUser } from '../policies/users.js';
+import PolicyRule, { RuleOptions } from './policyRule.js';
+export default class EnforceObjectAccessOnUser extends PolicyRule<ResolvedUser> {
+    private readonly roleManager;
+    constructor(opts: RuleOptions);
+    run(context: RuleAuditContext<ResolvedUser>): Promise<PartialPolicyRuleResult>;
+}

package/lib/libs/audit-engine/registry/rules/enforceObjectAccessOnUser.js

@@ -0,0 +1,39 @@
+import RoleManager from '../roles/roleManager.js';
+import PolicyRule from './policyRule.js';
+export default class EnforceObjectAccessOnUser extends PolicyRule {
+    roleManager;
+    constructor(opts) {
+        super(opts);
+        this.roleManager = new RoleManager({
+            controls: opts.auditConfig.controls,
+            shape: opts.auditConfig.shape,
+        });
+    }
+    run(context) {
+        const result = this.initResult();
+        const users = context.resolvedEntities;
+        for (const user of Object.values(users)) {
+            const profileLikes = buildProfileLikes(user);
+            const { violations, warnings, errors } = this.roleManager.scanObjectAccess(user.role, profileLikes, [
+                user.username,
+            ]);
+            result.errors.push(...errors);
+            result.warnings.push(...warnings);
+            result.violations.push(...violations);
+        }
+        return Promise.resolve(result);
+    }
+}
+function buildProfileLikes(user) {
+    const profileLikes = [];
+    profileLikes.push({ metadata: user.profileMetadata, name: user.profileName, type: 'Profile' });
+    for (const permSetAssignment of user.assignments ?? []) {
+        profileLikes.push({
+            metadata: permSetAssignment.metadata,
+            name: permSetAssignment.permissionSetIdentifier,
+            type: 'PermissionSet',
+        });
+    }
+    return profileLikes;
+}
+//# sourceMappingURL=enforceObjectAccessOnUser.js.map

package/lib/libs/audit-engine/registry/rules/enforceObjectAccessOnUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforceObjectAccessOnUser.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforceObjectAccessOnUser.ts"],"names":[],"mappings":"AACA,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAGlD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,yBAA0B,SAAQ,UAAwB;IAC5D,WAAW,CAAC;IAE7B,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE;gBAClG,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,IAAkB;IAC3C,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/F,KAAK,MAAM,iBAAiB,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACvD,YAAY,CAAC,IAAI,CAAC;YAChB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;YACpC,IAAI,EAAE,iBAAiB,CAAC,uBAAuB;YAC/C,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.js

@@ -1,9 +1,5 @@
-import { Messages } from '@salesforce/core';
-import { isNullish } from '../../../../utils.js';
 import RoleManager from '../roles/roleManager.js';
 import PolicyRule from './policyRule.js';
-Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
-const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.enforceClassificationPresets');
 export default class EnforcePermissionsOnProfileLike extends PolicyRule {
     roleManager;
     constructor(opts) {
@@ -17,18 +13,10 @@ export default class EnforcePermissionsOnProfileLike extends PolicyRule {
         const result = this.initResult();
         const resolvedProfiles = context.resolvedEntities;
         for (const profile of Object.values(resolvedProfiles)) {
-            if (!this.roleManager.isValidRole(profile.role)) {
-                result.errors.push({
-                    identifier: [profile.name],
-                    message: messages.getMessage('error.failed-to-resolve-role', [profile.role]),
-                });
-                continue;
-            }
-            if (!isNullish(profile.metadata)) {
-                const profileScanResult = this.roleManager.scanProfileLike(profile);
-                result.violations.push(...profileScanResult.violations);
-                result.warnings.push(...profileScanResult.warnings);
-            }
+            const { errors, violations, warnings } = this.roleManager.scanPermissions(profile.role, profile);
+            result.errors.push(...errors);
+            result.warnings.push(...warnings);
+            result.violations.push(...violations);
         }
         return Promise.resolve(result);
     }

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcePermissionsOnProfileLike.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,oCAAoC,CAAC,CAAC;AAEnH,MAAM,CAAC,OAAO,OAAO,+BAAgC,SAAQ,UAA+B;IACzE,WAAW,CAAC;IAE7B,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;IAEM,GAAG,CAAC,OAA8C;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC1B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,8BAA8B,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;iBAC7E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACxD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"enforcePermissionsOnProfileLike.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionsOnProfileLike.ts"],"names":[],"mappings":"AACA,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,+BAAgC,SAAQ,UAA+B;IACzE,WAAW,CAAC;IAE7B,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;IAEM,GAAG,CAAC,OAA8C;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.d.ts

@@ -5,5 +5,4 @@ export default class EnforcePermissionsOnUser extends PolicyRule<ResolvedUser> {
     private readonly roleManager;
     constructor(opts: RuleOptions);
     run(context: RuleAuditContext<ResolvedUser>): Promise<PartialPolicyRuleResult>;
-    private scanAssignedPermissionSets;
 }

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.js

@@ -1,8 +1,5 @@
-import { Messages } from '@salesforce/core';
 import RoleManager from '../roles/roleManager.js';
 import PolicyRule from './policyRule.js';
-Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
-const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.enforceClassificationPresets');
 export default class EnforcePermissionsOnUser extends PolicyRule {
     roleManager;
     constructor(opts) {
@@ -16,38 +13,27 @@ export default class EnforcePermissionsOnUser extends PolicyRule {
         const result = this.initResult();
         const users = context.resolvedEntities;
         for (const user of Object.values(users)) {
-            if (!this.roleManager.isValidRole(user.role)) {
-                result.errors.push({
-                    identifier: [user.username, user.role],
-                    message: messages.getMessage('error.failed-to-resolve-role', [user.role]),
-                });
-                continue;
-            }
-            const { violations, warnings } = this.scanAssignedPermissionSets(user, user.assignments);
-            result.violations.push(...violations);
+            const profileLikes = buildProfileLikes(user);
+            const { violations, warnings, errors } = this.roleManager.scanPermissions(user.role, profileLikes, [
+                user.username,
+            ]);
+            result.errors.push(...errors);
             result.warnings.push(...warnings);
-            if (user.profileMetadata) {
-                const profileResult = this.roleManager.scanProfileLike({ role: user.role, metadata: user.profileMetadata, name: user.profileName }, [user.username]);
-                result.violations.push(...profileResult.violations);
-                result.warnings.push(...profileResult.warnings);
-            }
+            result.violations.push(...violations);
         }
         return Promise.resolve(result);
     }
-    scanAssignedPermissionSets(user, assignments) {
-        const result = { violations: [], warnings: [] };
-        if (!assignments) {
-            return result;
-        }
-        for (const assignedPermSet of assignments) {
-            if (!assignedPermSet.metadata) {
-                continue;
-            }
-            const permsetScan = this.roleManager.scanProfileLike({ role: user.role, metadata: assignedPermSet.metadata, name: assignedPermSet.permissionSetIdentifier }, [user.username]);
-            result.violations.push(...permsetScan.violations);
-            result.warnings.push(...permsetScan.warnings);
-        }
-        return result;
+}
+function buildProfileLikes(user) {
+    const profileLikes = [];
+    profileLikes.push({ metadata: user.profileMetadata, name: user.profileName, type: 'Profile' });
+    for (const permSetAssignment of user.assignments ?? []) {
+        profileLikes.push({
+            metadata: permSetAssignment.metadata,
+            name: permSetAssignment.permissionSetIdentifier,
+            type: 'PermissionSet',
+        });
     }
+    return profileLikes;
 }
 //# sourceMappingURL=enforcePermissionsOnUser.js.map

package/lib/libs/audit-engine/registry/rules/enforcePermissionsOnUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcePermissionsOnUser.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionsOnUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAGlD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,oCAAoC,CAAC,CAAC;AAEnH,MAAM,CAAC,OAAO,OAAO,wBAAyB,SAAQ,UAAwB;IAC3D,WAAW,CAAC;IAE7B,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC;oBACtC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,8BAA8B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC1E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CACpD,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAC3E,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChB,CAAC;gBACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gBACpD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAEO,0BAA0B,CAAC,IAAkB,EAAE,WAAwC;QAC7F,MAAM,MAAM,GAAe,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,MAAM,eAAe,IAAI,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAClD,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,uBAAuB,EAAE,EACtG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChB,CAAC;YACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"enforcePermissionsOnUser.js","sourceRoot":"","sources":["../../../../../src/libs/audit-engine/registry/rules/enforcePermissionsOnUser.ts"],"names":[],"mappings":"AACA,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAGlD,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,wBAAyB,SAAQ,UAAwB;IAC3D,WAAW,CAAC;IAE7B,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE;gBACjG,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,IAAkB;IAC3C,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/F,KAAK,MAAM,iBAAiB,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACvD,YAAY,CAAC,IAAI,CAAC;YAChB,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;YACpC,IAAI,EAAE,iBAAiB,CAAC,uBAAuB;YAC/C,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/lib/libs/audit-engine/registry/shape/auditConfigShape.d.ts

@@ -8,6 +8,7 @@ export declare const BaseAuditConfigShape: {
         files: {
             roles: {
                 schema: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                    strict: import("zod").ZodOptional<import("zod").ZodBoolean>;
                     permissions: import("zod").ZodOptional<import("zod").ZodXor<readonly [import("zod").ZodArray<import("zod").ZodString>, import("zod").ZodObject<{
                         allowedClassifications: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<typeof import("./schema.js").PermissionRiskLevel>>>;
                         userPermissions: import("zod").ZodOptional<import("zod").ZodObject<{
@@ -21,6 +22,13 @@ export declare const BaseAuditConfigShape: {
                             required: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
                         }, import("zod/v4/core").$strip>>;
                     }, import("zod/v4/core").$strip>]>>;
+                    objectAccess: import("zod").ZodOptional<import("zod").ZodXor<readonly [import("zod").ZodArray<import("zod").ZodString>, import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+                        allowRead: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                        allowCreate: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                        allowEdit: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                        allowDelete: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                        viewAllFields: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    }, import("zod/v4/core").$strip>>]>>;
                 }, import("zod/v4/core").$strict>>;
             };
             permissions: {