@j-schreiber/sf-cli-security-audit 0.22.0 → 0.24.0

package/lib/salesforce/repositories/object-definitions/object-definitions.types.d.ts

@@ -0,0 +1,60 @@
+export declare function formatEntityDefinitionQuery(objectNames: string[]): string;
+export declare const CUSTOM_OBJECT_BASE_QUERY = "SELECT Id,DeveloperName,SharingModel FROM CustomObject";
+export type ObjectDefinition = {
+    /**
+     * Qualified API name of the object, with type suffix (__c, __e, etc)
+     */
+    developerName: string;
+    /**
+     * Indicates if the object has a sharing rules table.
+     */
+    isSharingControllable: boolean;
+    /**
+     * If its a custom object, the Id in CustomObject table
+     */
+    customObjectId?: string;
+    label: string | undefined;
+    externalSharing: GlobalSharingModelEnum;
+    internalSharing: GlobalSharingModelEnum;
+    /**
+     * Set by query on CustomObject (SfCustomObject.SharingModel). The value
+     * indicates if the object can have individual sharing, or if it inherits
+     * the visibility from its parent.
+     */
+    sharingModel: CustomObjSharingModelEnum;
+    /**
+     * Derived type of the object.
+     */
+    type: 'SObject' | 'CustomSetting' | 'CustomMetadata' | 'PlatformEvent' | 'KnowledgeArticle' | 'Unknown';
+    /**
+     * Indicates if this is a custom object (i.e. entry in CustomObjects table)
+     */
+    isCustom: boolean;
+    /**
+     * Indicates, if the object exists in the EntityDefinition table
+     */
+    hasEntityDefinition: boolean;
+    /**
+     * Indicates, if the object exists as a CustomObject metadata (this
+     * type has all regular sobjects, not only custom objects).
+     */
+    hasCustomObjectMetadata: boolean;
+};
+export type SfEntityDefinition = {
+    DurableId: string;
+    QualifiedApiName: string;
+    MasterLabel: string;
+    ExternalSharingModel: GlobalSharingModelEnum;
+    InternalSharingModel: GlobalSharingModelEnum;
+    IsRetrieveable: boolean;
+    IsCustomizeable: boolean;
+    IsCustomSetting: boolean;
+    KeyPrefix: string;
+};
+export type SfCustomObject = {
+    Id: string;
+    DeveloperName: string;
+    SharingModel: CustomObjSharingModelEnum;
+};
+export type GlobalSharingModelEnum = 'Private' | 'ControlledByParent' | 'ReadWrite' | 'Read' | 'ReadWriteTransfer' | 'ControlledByCampaign' | 'ReadSelect' | 'FullAccess' | 'Unknown';
+export type CustomObjSharingModelEnum = 'Unknown' | 'Edit' | 'Read' | 'ControlledByParent' | 'None';

package/lib/salesforce/repositories/object-definitions/object-definitions.types.js

@@ -0,0 +1,9 @@
+const ENTITY_DEFINITION_BASE_QUERY = 'SELECT DurableId,MasterLabel,QualifiedApiName,ExternalSharingModel,InternalSharingModel,KeyPrefix,IsRetrieveable,IsCustomizable,IsCustomSetting FROM EntityDefinition';
+export function formatEntityDefinitionQuery(objectNames) {
+    return `${ENTITY_DEFINITION_BASE_QUERY} WHERE QualifiedApiName IN (${formatObjectNames(objectNames)})`;
+}
+export const CUSTOM_OBJECT_BASE_QUERY = 'SELECT Id,DeveloperName,SharingModel FROM CustomObject';
+function formatObjectNames(objectNames) {
+    return `${objectNames.map((objName) => `'${objName}'`).join(',')}`;
+}
+//# sourceMappingURL=object-definitions.types.js.map

package/lib/salesforce/repositories/object-definitions/object-definitions.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-definitions.types.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/object-definitions/object-definitions.types.ts"],"names":[],"mappings":"AAAA,MAAM,4BAA4B,GAChC,uKAAuK,CAAC;AAE1K,MAAM,UAAU,2BAA2B,CAAC,WAAqB;IAC/D,OAAO,GAAG,4BAA4B,+BAA+B,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,wDAAwD,CAAC;AA0EjG,SAAS,iBAAiB,CAAC,WAAqB;IAC9C,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACrE,CAAC"}

package/lib/salesforce/repositories/perm-sets/permission-sets.d.ts

@@ -2,7 +2,12 @@ import EventEmitter from 'node:events';
 import { PermissionSet } from '../perm-sets/perm-sets.types.js';
 import SfConnection from '../../connection.js';
 import { ResolvePermSetOptions } from './perm-sets.types.js';
-export default class PermissionSets extends EventEmitter {
+export default class PermissionSets extends EventEmitter<{
+    entityresolve: [{
+        total: number;
+        resolved: number;
+    }];
+}> {
     private readonly con;
     private readonly mdapi;
     constructor(con: SfConnection);

package/lib/salesforce/repositories/perm-sets/permission-sets.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-sets.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/perm-sets/permission-sets.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,MAAM,sBAAsB,CAAC;AAGzC,OAAO,EAAyB,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,YAAY;IAGlB;IAFnB,KAAK,CAAQ;IAE9B,YAAoC,GAAiB;QACnD,KAAK,EAAE,CAAC;QAD0B,QAAG,GAAH,GAAG,CAAc;QAEnD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,IAAqC;QACxD,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACzD,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;QACjD,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;gBACpD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;gBACvB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,aAAa,CAAC,QAAQ,IAAI,IAAI;gBACxC,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAkB,qBAAqB,CAAC,CAAC;QAC9E,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"permission-sets.js","sourceRoot":"","sources":["../../../../src/salesforce/repositories/perm-sets/permission-sets.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,MAAM,sBAAsB,CAAC;AAGzC,OAAO,EAAyB,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,YAAsE;IAG5E;IAFnB,KAAK,CAAQ;IAE9B,YAAoC,GAAiB;QACnD,KAAK,EAAE,CAAC;QAD0B,QAAG,GAAH,GAAG,CAAc;QAEnD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,IAAqC;QACxD,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACzD,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;QACjD,KAAK,MAAM,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;gBACpD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;gBACvB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,aAAa,CAAC,QAAQ,IAAI,IAAI;gBACxC,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAkB,qBAAqB,CAAC,CAAC;QAC9E,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/lib/salesforce/resolve-entity-lifecycle-bus.d.ts

@@ -2,7 +2,9 @@ import { EventEmitter } from 'node:events';
 export type MessageEvent = {
     message: string;
 };
-export default class ResolveEntityLifecycle extends EventEmitter {
+export default class ResolveEntityLifecycle extends EventEmitter<{
+    resolvewarning: [MessageEvent];
+}> {
     constructor();
     emitWarn(message: string): void;
 }

package/lib/salesforce/resolve-entity-lifecycle-bus.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-entity-lifecycle-bus.js","sourceRoot":"","sources":["../../src/salesforce/resolve-entity-lifecycle-bus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,YAAY;IAC9D;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAEM,QAAQ,CAAC,OAAe;QAC7B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAC1B,OAAO;SACQ,CAAC,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"resolve-entity-lifecycle-bus.js","sourceRoot":"","sources":["../../src/salesforce/resolve-entity-lifecycle-bus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,YAAgD;IAClG;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAEM,QAAQ,CAAC,OAAe;QAC7B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAC1B,OAAO;SACQ,CAAC,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,EAAE,CAAC"}

package/messages/auditShapeValidation.md

@@ -10,6 +10,10 @@ User policy option defaultRoleForMissingUsers is invalid: "%s" does not exist.
 
 Permission does not exist on Org.
 
+# ObjectDoesNotExistOnOrg
+
+Object was not found on Org.
+
 # FailedToParseAuditConfig
 
 Failed to parse audit config at location %s: %s (%s).

package/messages/rules.enforceClassificationPresets.md

@@ -8,7 +8,7 @@ Tried to access a role that does not exist: %s.
 
 # RoleReferencesControlThatDoesNotExist
 
-Role "%s" references a %s control that does not exist: %s
+Role "%s" references %s control that does not exist: %s
 
 # violations.classification-preset-mismatch
 

package/messages/rules.objects.md

@@ -0,0 +1,3 @@
+# violation.external-sharing-model-not-private
+
+External access for "%s" is '%s'.