@j-schreiber/sf-cli-security-audit 0.6.0 → 0.7.0

package/lib/libs/core/policies/userPolicy.js

@@ -0,0 +1,104 @@
+import { Messages } from '@salesforce/core';
+import { ACTIVE_USERS_DETAILS_QUERY, buildLoginHistoryQuery } from '../constants.js';
+import { UsersRegistry } from '../registries/users.js';
+import { ProfilesRiskPreset } from '../policy-types.js';
+import Policy, { getTotal } from './policy.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'policies.general');
+export default class UserPolicy extends Policy {
+    config;
+    auditConfig;
+    totalEntities;
+    constructor(config, auditConfig, registry = UsersRegistry) {
+        super(config, auditConfig, registry);
+        this.config = config;
+        this.auditConfig = auditConfig;
+        this.totalEntities = this.config.users ? Object.keys(this.config.users).length : 0;
+    }
+    async resolveEntities(context) {
+        this.emit('entityresolve', {
+            total: this.totalEntities,
+            resolved: 0,
+        });
+        const usersById = {};
+        const ignoredEntities = {};
+        const configuredUsers = this.config.users ?? {};
+        const classifiedUsers = [];
+        const userIds = [];
+        Object.entries(configuredUsers).forEach(([userName, userDef]) => {
+            if (userDef.role === ProfilesRiskPreset.UNKNOWN) {
+                ignoredEntities[userName] = {
+                    name: userName,
+                    message: messages.getMessage('user-with-role-unknown'),
+                };
+            }
+            else {
+                classifiedUsers.push(userName);
+            }
+        });
+        // fetch all users from org and merge with configured users
+        const allUsersOnOrg = await context.targetOrgConnection.query(ACTIVE_USERS_DETAILS_QUERY);
+        allUsersOnOrg.records.forEach((user) => {
+            if (ignoredEntities[user.Username] === undefined) {
+                usersById[user.Id] = {
+                    userId: user.Id,
+                    username: user.Username,
+                    lastLogin: user.LastLoginDate ? Date.parse(user.LastLoginDate) : undefined,
+                    createdDate: Date.parse(user.CreatedDate),
+                    assignedProfile: user.Profile.Name,
+                    assignedPermissionSets: [],
+                    logins: [],
+                    role: configuredUsers[user.Username]?.role ?? this.config.options.defaultRoleForMissingUsers,
+                };
+                userIds.push(user.Id);
+            }
+        });
+        this.totalEntities = allUsersOnOrg.totalSize;
+        this.emit('entityresolve', {
+            total: this.totalEntities,
+            resolved: 0,
+        });
+        const userLogins = await resolveLogins(context, this.config.options.analyseLastNDaysOfLoginHistory);
+        Object.entries(userLogins).forEach(([userId, user]) => {
+            if (usersById[userId] !== undefined) {
+                usersById[userId].logins = user.logins;
+            }
+        });
+        // resolve perm set assignments per user
+        // const assignments = await context.targetOrgConnection.query<PermissionSetAssignment>(
+        //   buildPermsetAssignmentsQuery(userIds)
+        // );
+        // assignments.records.forEach(assignment => {
+        // })
+        const result = { resolvedEntities: organizeByUsername(usersById), ignoredEntities: Object.values(ignoredEntities) };
+        this.emit('entityresolve', {
+            total: this.totalEntities,
+            resolved: getTotal(result),
+        });
+        return result;
+    }
+}
+async function resolveLogins(context, daysToAnalyse) {
+    const loginHistory = await context.targetOrgConnection.query(buildLoginHistoryQuery(daysToAnalyse));
+    const partialUsers = {};
+    loginHistory.records.forEach((loginHistoryRow) => {
+        if (!partialUsers[loginHistoryRow.UserId]) {
+            partialUsers[loginHistoryRow.UserId] = { logins: [] };
+        }
+        partialUsers[loginHistoryRow.UserId].logins.push({
+            loginType: loginHistoryRow.LoginType,
+            loginCount: loginHistoryRow.LoginCount,
+            application: loginHistoryRow.Application,
+            lastLogin: Date.parse(loginHistoryRow.LastLogin),
+        });
+    });
+    return partialUsers;
+}
+function organizeByUsername(partial) {
+    const full = {};
+    Object.values(partial).forEach((resolved) => {
+        full[resolved.username] = resolved;
+    });
+    return full;
+}
+//# sourceMappingURL=userPolicy.js.map

package/lib/libs/core/policies/userPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userPolicy.js","sourceRoot":"","sources":["../../../../src/libs/core/policies/userPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAgB,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,MAAM,EAAE,EAAE,QAAQ,EAAuB,MAAM,aAAa,CAAC;AAGpE,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,kBAAkB,CAAC,CAAC;AAEjG,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,MAAoB;IAGjD;IACA;IAHD,aAAa,CAAS;IAC9B,YACS,MAA8B,EAC9B,WAA2B,EAClC,QAAQ,GAAG,aAAa;QAExB,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAJ9B,WAAM,GAAN,MAAM,CAAwB;QAC9B,gBAAW,GAAX,WAAW,CAAgB;QAIlC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,OAAqB;QACnD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,aAAa;YACzB,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,MAAM,SAAS,GAAiC,EAAE,CAAC;QACnD,MAAM,eAAe,GAAuC,EAAE,CAAC;QAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,eAAe,GAAG,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE;YAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;gBAChD,eAAe,CAAC,QAAQ,CAAC,GAAG;oBAC1B,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,wBAAwB,CAAC;iBACvD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,2DAA2D;QAC3D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAO,0BAA0B,CAAC,CAAC;QAChG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACrC,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjD,SAAS,CAAC,IAAI,CAAC,EAAG,CAAC,GAAG;oBACpB,MAAM,EAAE,IAAI,CAAC,EAAG;oBAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC1E,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;oBACzC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBAClC,sBAAsB,EAAE,EAAE;oBAC1B,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0BAA0B;iBAC7F,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,aAAa;YACzB,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;QACpG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;YACpD,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,wCAAwC;QACxC,wFAAwF;QACxF,0CAA0C;QAC1C,KAAK;QACL,8CAA8C;QAE9C,KAAK;QACL,MAAM,MAAM,GAAG,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACpH,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,aAAa;YACzB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,KAAK,UAAU,aAAa,CAAC,OAAqB,EAAE,aAAsB;IACxE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAC1D,sBAAsB,CAAC,aAAa,CAAC,CACtC,CAAC;IACF,MAAM,YAAY,GAA8C,EAAE,CAAC;IACnE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE;QAC/C,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxD,CAAC;QACD,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/C,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC;SACjD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC;AAID,SAAS,kBAAkB,CAAC,OAAqC;IAC/D,MAAM,IAAI,GAAiC,EAAE,CAAC;IAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/libs/core/policyRegistry.d.ts

@@ -0,0 +1,23 @@
+import z from 'zod';
+import { AuditRunConfigClassifications, AuditRunConfigPolicies } from './file-mgmt/schema.js';
+import { Constructor } from './registries/types.js';
+import Policy from './policies/policy.js';
+export declare const classificationDefs: ClassificationRegistry;
+export type PolicyNames = keyof AuditRunConfigPolicies;
+export type ClassificationNames = keyof AuditRunConfigClassifications;
+export type PolicyRegistry = Record<PolicyNames, PolicyRegistryEntry>;
+export declare const policyDefs: PolicyRegistry;
+type PolicyRegistryEntry = ConfigFileDefinition & {
+    dependencies?: ConfigFileDependency[];
+    handler: Constructor<Policy<unknown>>;
+};
+type ConfigFileDefinition = {
+    fileName?: string;
+    schema: z.ZodObject;
+};
+type ConfigFileDependency = {
+    errorName: string;
+    path: string[];
+};
+type ClassificationRegistry = Record<keyof AuditRunConfigClassifications, ConfigFileDefinition>;
+export {};

package/lib/libs/core/policyRegistry.js

@@ -0,0 +1,38 @@
+import { PermissionsConfigFileSchema, PermSetsPolicyFileSchema, PolicyFileSchema, ProfilesPolicyFileSchema, UsersPolicyFileSchema, } from './file-mgmt/schema.js';
+import ConnectedAppPolicy from './policies/connectedAppPolicy.js';
+import PermissionSetPolicy from './policies/permissionSetPolicy.js';
+import ProfilePolicy from './policies/profilePolicy.js';
+import UserPolicy from './policies/userPolicy.js';
+export const classificationDefs = {
+    userPermissions: {
+        schema: PermissionsConfigFileSchema,
+    },
+    customPermissions: {
+        schema: PermissionsConfigFileSchema,
+    },
+};
+export const policyDefs = {
+    profiles: {
+        handler: ProfilePolicy,
+        schema: ProfilesPolicyFileSchema,
+        dependencies: [
+            { path: ['classifications', 'userPermissions'], errorName: 'UserPermClassificationRequiredForProfiles' },
+        ],
+    },
+    permissionSets: {
+        handler: PermissionSetPolicy,
+        schema: PermSetsPolicyFileSchema,
+        dependencies: [
+            { path: ['classifications', 'userPermissions'], errorName: 'UserPermClassificationRequiredForPermSets' },
+        ],
+    },
+    connectedApps: {
+        handler: ConnectedAppPolicy,
+        schema: PolicyFileSchema,
+    },
+    users: {
+        handler: UserPolicy,
+        schema: UsersPolicyFileSchema,
+    },
+};
+//# sourceMappingURL=policyRegistry.js.map

package/lib/libs/core/policyRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyRegistry.js","sourceRoot":"","sources":["../../../src/libs/core/policyRegistry.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,2BAA2B,EAC3B,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,kBAAkB,MAAM,kCAAkC,CAAC;AAClE,OAAO,mBAAmB,MAAM,mCAAmC,CAAC;AAEpE,OAAO,aAAa,MAAM,6BAA6B,CAAC;AACxD,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAElD,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,eAAe,EAAE;QACf,MAAM,EAAE,2BAA2B;KACpC;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE,2BAA2B;KACpC;CACF,CAAC;AAOF,MAAM,CAAC,MAAM,UAAU,GAAmB;IACxC,QAAQ,EAAE;QACR,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,wBAAwB;QAChC,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE;SACzG;KACF;IACD,cAAc,EAAE;QACd,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,wBAAwB;QAChC,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,SAAS,EAAE,2CAA2C,EAAE;SACzG;KACF;IACD,aAAa,EAAE;QACb,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE,gBAAgB;KACzB;IACD,KAAK,EAAE;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,qBAAqB;KAC9B;CACF,CAAC"}

package/lib/libs/core/registries/ruleRegistry.d.ts

@@ -1,7 +1,6 @@
 import { EntityResolveError, PolicyRuleSkipResult } from '../result-types.js';
 import { AuditRunConfig, RuleMap } from '../../core/file-mgmt/schema.js';
-import { RowLevelPolicyRule } from './types.js';
-type Constructor<T, Args extends any[] = any[]> = new (...args: Args) => T;
+import { Constructor, RowLevelPolicyRule } from './types.js';
 /**
  * Result contains the actually available and enabled rules
  * from the raw config file. Rules that are not present in the
@@ -36,4 +35,3 @@ export default class RuleRegistry {
      */
     resolveRules(ruleObjs: RuleMap, auditContext: AuditRunConfig): RegistryRuleResolveResult;
 }
-export {};

package/lib/libs/core/registries/ruleRegistry.js

@@ -33,7 +33,7 @@ export default class RuleRegistry {
         const resolveErrors = new Array();
         Object.entries(ruleObjs).forEach(([ruleName, ruleConfig]) => {
             if (this.rules[ruleName] && ruleConfig.enabled) {
-                enabledRules.push(new this.rules[ruleName]({ auditContext, ruleDisplayName: ruleName, ruleConfig: ruleConfig.config }));
+                enabledRules.push(new this.rules[ruleName]({ auditContext, ruleDisplayName: ruleName, ruleConfig: ruleConfig.options }));
             }
             else if (!ruleConfig.enabled) {
                 skippedRules.push({ name: ruleName, skipReason: messages.getMessage('skip-reason.rule-not-enabled') });

package/lib/libs/core/registries/ruleRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"ruleRegistry.js","sourceRoot":"","sources":["../../../../src/libs/core/registries/ruleRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,kBAAkB,CAAC,CAAC;AAgBjG;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,YAAY;IACL;IAA1B,YAA0B,KAA+D;QAA/D,UAAK,GAAL,KAAK,CAA0D;IAAG,CAAC;IAE7F;;;;OAIG;IACI,eAAe;QACpB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACI,YAAY,CAAC,QAAiB,EAAE,YAA4B;QACjE,MAAM,YAAY,GAAG,IAAI,KAAK,EAA+B,CAAC;QAC9D,MAAM,YAAY,GAAG,IAAI,KAAK,EAAwB,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,KAAK,EAAsB,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE;YAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC/C,YAAY,CAAC,IAAI,CACf,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CACrG,CAAC;YACJ,CAAC;iBAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC/B,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC;YACzG,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;YAC5G,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"ruleRegistry.js","sourceRoot":"","sources":["../../../../src/libs/core/registries/ruleRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,kBAAkB,CAAC,CAAC;AAajG;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,YAAY;IACL;IAA1B,YAA0B,KAA+D;QAA/D,UAAK,GAAL,KAAK,CAA0D;IAAG,CAAC;IAE7F;;;;OAIG;IACI,eAAe;QACpB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACI,YAAY,CAAC,QAAiB,EAAE,YAA4B;QACjE,MAAM,YAAY,GAAG,IAAI,KAAK,EAA+B,CAAC;QAC9D,MAAM,YAAY,GAAG,IAAI,KAAK,EAAwB,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,KAAK,EAAsB,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE;YAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC/C,YAAY,CAAC,IAAI,CACf,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CACtG,CAAC;YACJ,CAAC;iBAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC/B,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC;YACzG,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC,CAAC;YAC5G,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IACvD,CAAC;CACF"}

package/lib/libs/core/registries/rules/noInactiveUsers.d.ts

@@ -0,0 +1,9 @@
+import { NoInactiveUsersOptions } from '../../file-mgmt/schema.js';
+import { PartialPolicyRuleResult, RuleAuditContext } from '../types.js';
+import { ResolvedUser } from '../users.js';
+import PolicyRule, { ConfigurableRuleOptions } from './policyRule.js';
+export default class NoInactiveUsers extends PolicyRule<ResolvedUser> {
+    private ruleConfig;
+    constructor(localOpts: ConfigurableRuleOptions<NoInactiveUsersOptions>);
+    run(context: RuleAuditContext<ResolvedUser>): Promise<PartialPolicyRuleResult>;
+}

package/lib/libs/core/registries/rules/noInactiveUsers.js

@@ -0,0 +1,44 @@
+import { Messages } from '@salesforce/core';
+import { NoInactiveUsersOptionsSchema } from '../../file-mgmt/schema.js';
+import { differenceInDays } from '../../utils.js';
+import PolicyRule from './policyRule.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.users');
+export default class NoInactiveUsers extends PolicyRule {
+    ruleConfig;
+    constructor(localOpts) {
+        super(localOpts);
+        this.ruleConfig = NoInactiveUsersOptionsSchema.parse(localOpts.ruleConfig ?? {});
+    }
+    run(context) {
+        const result = this.initResult();
+        Object.values(context.resolvedEntities).forEach((user) => {
+            if (user.lastLogin) {
+                const diffInDays = differenceInDays(Date.now(), user.lastLogin);
+                if (diffInDays > this.ruleConfig.daysAfterUserIsInactive) {
+                    result.violations.push({
+                        identifier: [user.username],
+                        message: messages.getMessage('violations.inactive-since-n-days', [
+                            diffInDays,
+                            new Date(user.lastLogin).toISOString(),
+                        ]),
+                    });
+                }
+            }
+        });
+        Object.values(context.resolvedEntities).forEach((user) => {
+            if (!user.lastLogin) {
+                const createdNDaysAgo = differenceInDays(Date.now(), user.createdDate);
+                result.violations.push({
+                    identifier: [user.username],
+                    message: messages.getMessage('violations.has-never-logged-in', [
+                        new Date(user.createdDate).toISOString(),
+                        createdNDaysAgo,
+                    ]),
+                });
+            }
+        });
+        return Promise.resolve(result);
+    }
+}
+//# sourceMappingURL=noInactiveUsers.js.map

package/lib/libs/core/registries/rules/noInactiveUsers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"noInactiveUsers.js","sourceRoot":"","sources":["../../../../../src/libs/core/registries/rules/noInactiveUsers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAA0B,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,UAAuC,MAAM,iBAAiB,CAAC;AAEtE,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;AAE5F,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,UAAwB;IAC3D,UAAU,CAAyB;IAE3C,YAAmB,SAA0D;QAC3E,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChE,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;oBACzD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,kCAAkC,EAAE;4BAC/D,UAAU;4BACV,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;yBACvC,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACvE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,gCAAgC,EAAE;wBAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;wBACxC,eAAe;qBAChB,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}

package/lib/libs/core/registries/rules/noOtherApexApiLogins.d.ts

@@ -0,0 +1,7 @@
+import { PartialPolicyRuleResult, RuleAuditContext } from '../types.js';
+import { ResolvedUser } from '../users.js';
+import PolicyRule, { RuleOptions } from './policyRule.js';
+export default class NoOtherApexApiLogins extends PolicyRule<ResolvedUser> {
+    constructor(opts: RuleOptions);
+    run(context: RuleAuditContext<ResolvedUser>): Promise<PartialPolicyRuleResult>;
+}

package/lib/libs/core/registries/rules/noOtherApexApiLogins.js

@@ -0,0 +1,24 @@
+import { Messages } from '@salesforce/core';
+import PolicyRule from './policyRule.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'rules.users');
+export default class NoOtherApexApiLogins extends PolicyRule {
+    constructor(opts) {
+        super(opts);
+    }
+    run(context) {
+        const result = this.initResult();
+        Object.values(context.resolvedEntities).forEach((user) => {
+            user.logins.forEach((loginSummary) => {
+                if (loginSummary.loginType === 'Other Apex API') {
+                    result.violations.push({
+                        identifier: [user.username],
+                        message: messages.getMessage('violations.no-other-apex-api-logins', [loginSummary.loginCount]),
+                    });
+                }
+            });
+        });
+        return Promise.resolve(result);
+    }
+}
+//# sourceMappingURL=noOtherApexApiLogins.js.map

package/lib/libs/core/registries/rules/noOtherApexApiLogins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"noOtherApexApiLogins.js","sourceRoot":"","sources":["../../../../../src/libs/core/registries/rules/noOtherApexApiLogins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,UAA2B,MAAM,iBAAiB,CAAC;AAE1D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;AAE5F,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,UAAwB;IACxE,YAAmB,IAAiB;QAClC,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,OAAuC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACvD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;gBACnC,IAAI,YAAY,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;oBAChD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC3B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,qCAAqC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;qBAC/F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}

package/lib/libs/core/registries/rules/policyRule.d.ts

@@ -3,9 +3,12 @@ import { AuditRunConfig, NamedPermissionsClassification } from '../../file-mgmt/
 export type RuleOptions = {
     auditContext: AuditRunConfig;
     ruleDisplayName: string;
-    ruleConfig?: unknown;
+};
+export type ConfigurableRuleOptions<T> = RuleOptions & {
+    ruleConfig: T;
 };
 export default abstract class PolicyRule<EntityType> implements RowLevelPolicyRule<EntityType> {
+    protected opts: RuleOptions;
     auditContext: AuditRunConfig;
     ruleDisplayName: string;
     constructor(opts: RuleOptions);

package/lib/libs/core/registries/rules/policyRule.js

@@ -1,9 +1,11 @@
 import { Messages } from '@salesforce/core';
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 export default class PolicyRule {
+    opts;
     auditContext;
     ruleDisplayName;
     constructor(opts) {
+        this.opts = opts;
         this.auditContext = opts.auditContext;
         this.ruleDisplayName = opts.ruleDisplayName;
     }

package/lib/libs/core/registries/rules/policyRule.js.map

@@ -1 +1 @@
-{"version":3,"file":"policyRule.js","sourceRoot":"","sources":["../../../../../src/libs/core/registries/rules/policyRule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAQ7D,MAAM,CAAC,OAAO,OAAgB,UAAU;IAC/B,YAAY,CAAiB;IAC7B,eAAe,CAAS;IAE/B,YAAmB,IAAiB;QAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC9C,CAAC;IAES,UAAU;QAClB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,UAAU,EAAE,IAAI,KAAK,EAAuB;YAC5C,eAAe,EAAE,IAAI,KAAK,EAA2B;YACrD,QAAQ,EAAE,IAAI,KAAK,EAAwB;YAC3C,MAAM,EAAE,IAAI,KAAK,EAAwB;SAC1C,CAAC;IACJ,CAAC;IAES,qBAAqB,CAAC,QAAgB;QAC9C,OAAO,kBAAkB,CACvB,QAAQ,EACR,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CACjF,CAAC;IACJ,CAAC;IAES,uBAAuB,CAAC,QAAgB;QAChD,OAAO,kBAAkB,CACvB,QAAQ,EACR,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CACnF,CAAC;IACJ,CAAC;CAGF;AAED,SAAS,kBAAkB,CACzB,QAAgB,EAChB,IAAgC;IAEhC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC"}
+{"version":3,"file":"policyRule.js","sourceRoot":"","sources":["../../../../../src/libs/core/registries/rules/policyRule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK5C,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAW7D,MAAM,CAAC,OAAO,OAAgB,UAAU;IAIT;IAHtB,YAAY,CAAiB;IAC7B,eAAe,CAAS;IAE/B,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC9C,CAAC;IAES,UAAU;QAClB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,UAAU,EAAE,IAAI,KAAK,EAAuB;YAC5C,eAAe,EAAE,IAAI,KAAK,EAA2B;YACrD,QAAQ,EAAE,IAAI,KAAK,EAAwB;YAC3C,MAAM,EAAE,IAAI,KAAK,EAAwB;SAC1C,CAAC;IACJ,CAAC;IAES,qBAAqB,CAAC,QAAgB;QAC9C,OAAO,kBAAkB,CACvB,QAAQ,EACR,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CACjF,CAAC;IACJ,CAAC;IAES,uBAAuB,CAAC,QAAgB;QAChD,OAAO,kBAAkB,CACvB,QAAQ,EACR,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CACnF,CAAC;IACJ,CAAC;CAGF;AAED,SAAS,kBAAkB,CACzB,QAAgB,EAChB,IAAgC;IAEhC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC"}

package/lib/libs/core/registries/types.d.ts

@@ -5,7 +5,9 @@ export declare const RuleRegistries: {
     ConnectedApps: import("./connectedApps.js").default;
     Profiles: import("./profiles.js").default;
     PermissionSets: import("./permissionSets.js").default;
+    Users: import("./users.js").default;
 };
+export type Constructor<T, Args extends any[] = any[]> = new (...args: Args) => T;
 /**
  * A rule must only implement a subset of the rule result. All optional
  * properties are completed by the policy.

package/lib/libs/core/registries/types.js

@@ -1,9 +1,11 @@
 import { ConnectedAppsRegistry } from './connectedApps.js';
 import { PermissionSetsRegistry } from './permissionSets.js';
 import { ProfilesRegistry } from './profiles.js';
+import { UsersRegistry } from './users.js';
 export const RuleRegistries = {
     ConnectedApps: ConnectedAppsRegistry,
     Profiles: ProfilesRegistry,
     PermissionSets: PermissionSetsRegistry,
+    Users: UsersRegistry,
 };
 //# sourceMappingURL=types.js.map

package/lib/libs/core/registries/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/libs/core/registries/types.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,aAAa,EAAE,qBAAqB;IACpC,QAAQ,EAAE,gBAAgB;IAC1B,cAAc,EAAE,sBAAsB;CACvC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/libs/core/registries/types.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,aAAa,EAAE,qBAAqB;IACpC,QAAQ,EAAE,gBAAgB;IAC1B,cAAc,EAAE,sBAAsB;IACtC,KAAK,EAAE,aAAa;CACrB,CAAC"}

package/lib/libs/core/registries/users.d.ts

@@ -0,0 +1,26 @@
+import { ProfilesRiskPreset } from '../policy-types.js';
+import RuleRegistry from './ruleRegistry.js';
+export type ResolvedUser = {
+    userId: string;
+    username: string;
+    role: ProfilesRiskPreset;
+    assignedPermissionSets: UserPermissionSetAssignment[];
+    logins: UserLogins[];
+    assignedProfile: string;
+    createdDate: number;
+    lastLogin?: number;
+};
+type UserLogins = {
+    loginType: string;
+    application: string;
+    loginCount: number;
+    lastLogin: number;
+};
+type UserPermissionSetAssignment = {
+    permissionSetIdentifier: string;
+};
+export default class UsersRuleRegistry extends RuleRegistry {
+    constructor();
+}
+export declare const UsersRegistry: UsersRuleRegistry;
+export {};

package/lib/libs/core/registries/users.js

@@ -0,0 +1,10 @@
+import RuleRegistry from './ruleRegistry.js';
+import NoInactiveUsers from './rules/noInactiveUsers.js';
+import NoOtherApexApiLogins from './rules/noOtherApexApiLogins.js';
+export default class UsersRuleRegistry extends RuleRegistry {
+    constructor() {
+        super({ NoOtherApexApiLogins, NoInactiveUsers });
+    }
+}
+export const UsersRegistry = new UsersRuleRegistry();
+//# sourceMappingURL=users.js.map

package/lib/libs/core/registries/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../../src/libs/core/registries/users.ts"],"names":[],"mappings":"AACA,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,eAAe,MAAM,4BAA4B,CAAC;AACzD,OAAO,oBAAoB,MAAM,iCAAiC,CAAC;AAwBnE,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,YAAY;IACzD;QACE,KAAK,CAAC,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC,CAAC;IACnD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,iBAAiB,EAAE,CAAC"}

package/lib/libs/core/result-types.d.ts

@@ -1,3 +1,4 @@
+import { AuditRunConfigPolicies } from './file-mgmt/schema.js';
 /**
  * A single violation from a policy rule execution.
  */
@@ -166,6 +167,6 @@ export type AuditResult = {
      * Record map of all modules (policies) that were run.
      */
     policies: {
-        [moduleName: string]: AuditPolicyResult;
+        [P in keyof AuditRunConfigPolicies]: AuditPolicyResult;
     };
 };

package/lib/libs/core/utils.d.ts

@@ -2,4 +2,11 @@ export declare function isEmpty(anything?: unknown): boolean;
 export declare function isNullish(anything: unknown): boolean;
 export declare function capitalize(anyString: string): string;
 export declare function uncapitalize(anyString: string): string;
+/**
+ * Both dates have to be UNIX timestamps
+ *
+ * @param date1
+ * @param date2
+ */
+export declare function differenceInDays(date1: number | string, date2: number | string): number;
 export type Optional<T, K extends keyof T> = Pick<Partial<T>, K> & Omit<T, K>;

package/lib/libs/core/utils.js

@@ -16,4 +16,16 @@ export function capitalize(anyString) {
 export function uncapitalize(anyString) {
     return `${anyString[0].toLowerCase()}${anyString.slice(1)}`;
 }
+/**
+ * Both dates have to be UNIX timestamps
+ *
+ * @param date1
+ * @param date2
+ */
+export function differenceInDays(date1, date2) {
+    const convertedDate1 = typeof date1 === 'number' ? date1 : Date.parse(date1);
+    const convertedDate2 = typeof date2 === 'number' ? date2 : Date.parse(date2);
+    const diff = Math.abs(convertedDate2 - convertedDate1);
+    return Math.floor(diff / (1000 * 60 * 60 * 24));
+}
 //# sourceMappingURL=utils.js.map

package/lib/libs/core/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/libs/core/utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,OAAO,CAAC,QAAkB;IACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAiB;IACzC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/libs/core/utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,OAAO,CAAC,QAAkB;IACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAiB;IACzC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAsB,EAAE,KAAsB;IAC7E,MAAM,cAAc,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,GAAG,cAAc,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/lib/ux/auditRunMultiStage.d.ts

@@ -1,5 +1,5 @@
 import { MultiStageOutput, MultiStageOutputOptions } from '@oclif/multi-stage-output';
-import AuditRun from '../libs/policies/auditRun.js';
+import AuditRun from '../libs/core/auditRun.js';
 export declare const LOAD_AUDIT_CONFIG = "Loading audit config";
 export declare const RESOLVE_POLICIES = "Resolving policies";
 export declare const EXECUTE_RULES = "Executing rules";

package/lib/ux/auditRunMultiStage.js

@@ -1,4 +1,5 @@
 import { MultiStageOutput } from '@oclif/multi-stage-output';
+import { capitalize } from '../libs/core/utils.js';
 export const LOAD_AUDIT_CONFIG = 'Loading audit config';
 export const RESOLVE_POLICIES = 'Resolving policies';
 export const EXECUTE_RULES = 'Executing rules';
@@ -61,27 +62,29 @@ export default class AuditRunMultiStageOutput {
     startPolicyResolve(runInstance) {
         this.mso.goto(RESOLVE_POLICIES, { currentStatus: 'Resolving' });
         Object.entries(runInstance.configs.policies).forEach(([policyName, policy]) => {
-            const policyDef = policy;
-            this.addPolicyStatsListener(policyName, runInstance);
-            this.stageSpecificBlocks.push({
-                stage: RESOLVE_POLICIES,
-                type: 'dynamic-key-value',
-                label: policyName,
-                get: (data) => {
-                    if (data?.policies?.[policyName]) {
-                        return `${data.policies[policyName].resolved ?? 0}/${data.policies[policyName].total ?? 0}`;
-                    }
-                    else {
-                        return '';
-                    }
-                },
-            });
-            if (policyDef.content.rules && Object.keys(policyDef.content.rules).length > 0) {
+            if (policy.content.enabled) {
+                this.addPolicyStatsListener(policyName, runInstance);
                 this.stageSpecificBlocks.push({
-                    stage: EXECUTE_RULES,
-                    type: 'message',
-                    get: () => `Execute ${Object.keys(policyDef.content.rules).length} rule(s) for ${policyName}`,
+                    stage: RESOLVE_POLICIES,
+                    type: 'dynamic-key-value',
+                    label: capitalize(policyName),
+                    get: (data) => {
+                        if (data?.policies?.[policyName]) {
+                            return `${data.policies[policyName].resolved ?? 0}/${data.policies[policyName].total ?? 0}`;
+                        }
+                        else {
+                            return '';
+                        }
+                    },
                 });
+                if (policy.content.rules && Object.keys(policy.content.rules).length > 0) {
+                    const enabledRules = Object.values(policy.content.rules).filter((ruleConfig) => ruleConfig.enabled).length;
+                    this.stageSpecificBlocks.push({
+                        stage: EXECUTE_RULES,
+                        type: 'message',
+                        get: () => `Execute ${enabledRules} rule(s) for ${policyName}`,
+                    });
+                }
             }
         });
         this.mso.updateData({});

package/lib/ux/auditRunMultiStage.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditRunMultiStage.js","sourceRoot":"","sources":["../../src/ux/auditRunMultiStage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA2B,MAAM,2BAA2B,CAAC;AAItF,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAmB7C,MAAM,CAAC,OAAO,OAAO,wBAAwB;IACpC,GAAG,CAAiC;IACpC,mBAAmB,CAAsC;IACxD,QAAQ,CAAmB;IAEnC,YAAmB,IAA2C;QAC5D,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,kBAAyD,CAAC;QAC1F,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAM,CAAC,IAA2C;QAC9D,OAAO,IAAI,gBAAgB,CAAe,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,MAAM,CAAC,MAAM,CAAC,IAA0B;QAC7C,OAAO,IAAI,wBAAwB,CAAC;YAClC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,KAAK;YACtC,MAAM,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,CAAC;YACtE,KAAK,EAAE,cAAc;YACrB,cAAc,EAAE;gBACd;oBACE,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,IAAI,CAAC,SAAS,qBAAqB,IAAI,CAAC,iBAAiB,EAAE;iBACnF;aACF;YACD,eAAe,EAAE;gBACf;oBACE,IAAI,EAAE,kBAAkB;oBACxB,KAAK,EAAE,QAAQ;oBACf,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,aAAa;iBACnC;aACF;YACD,kBAAkB,EAAE,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;IAEM,kBAAkB,CAAC,WAAqB;QAC7C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE;YAC5E,MAAM,SAAS,GAAG,MAA2C,CAAC;YAC9D,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,UAAU;gBACjB,GAAG,EAAE,CAAC,IAAkB,EAAU,EAAE;oBAClC,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;oBAC9F,CAAC;yBAAM,CAAC;wBACN,OAAO,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/E,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE,aAAa;oBACpB,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,UAAU,EAAE;iBAC9F,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAEM,kBAAkB;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/D,CAAC;IAEM,MAAM;QACX,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAEO,sBAAsB,GAAG,CAAC,UAAkB,EAAE,WAAqB,EAAQ,EAAE;QACnF,2EAA2E;QAC3E,oEAAoE;QACpE,qFAAqF;QACrF,4DAA4D;QAC5D,WAAW,CAAC,WAAW,CAAC,iBAAiB,UAAU,EAAE,EAAE,CAAC,IAAwB,EAAE,EAAE;YAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACrD,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBAC/C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACvF,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH"}
+{"version":3,"file":"auditRunMultiStage.js","sourceRoot":"","sources":["../../src/ux/auditRunMultiStage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA2B,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAmB7C,MAAM,CAAC,OAAO,OAAO,wBAAwB;IACpC,GAAG,CAAiC;IACpC,mBAAmB,CAAsC;IACxD,QAAQ,CAAmB;IAEnC,YAAmB,IAA2C;QAC5D,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,kBAAyD,CAAC;QAC1F,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,MAAM,CAAC,IAA2C;QAC9D,OAAO,IAAI,gBAAgB,CAAe,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,MAAM,CAAC,MAAM,CAAC,IAA0B;QAC7C,OAAO,IAAI,wBAAwB,CAAC;YAClC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,KAAK;YACtC,MAAM,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,CAAC;YACtE,KAAK,EAAE,cAAc;YACrB,cAAc,EAAE;gBACd;oBACE,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,IAAI,CAAC,SAAS,qBAAqB,IAAI,CAAC,iBAAiB,EAAE;iBACnF;aACF;YACD,eAAe,EAAE;gBACf;oBACE,IAAI,EAAE,kBAAkB;oBACxB,KAAK,EAAE,QAAQ;oBACf,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,aAAa;iBACnC;aACF;YACD,kBAAkB,EAAE,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;IAEM,kBAAkB,CAAC,WAAqB;QAC7C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE;YAC5E,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE,gBAAgB;oBACvB,IAAI,EAAE,mBAAmB;oBACzB,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC;oBAC7B,GAAG,EAAE,CAAC,IAAkB,EAAU,EAAE;wBAClC,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;4BACjC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;wBAC9F,CAAC;6BAAM,CAAC;4BACN,OAAO,EAAE,CAAC;wBACZ,CAAC;oBACH,CAAC;iBACF,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;oBAC3G,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;wBAC5B,KAAK,EAAE,aAAa;wBACpB,IAAI,EAAE,SAAS;wBACf,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,YAAY,gBAAgB,UAAU,EAAE;qBAC/D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAEM,kBAAkB;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/D,CAAC;IAEM,MAAM;QACX,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAEO,sBAAsB,GAAG,CAAC,UAAkB,EAAE,WAAqB,EAAQ,EAAE;QACnF,2EAA2E;QAC3E,oEAAoE;QACpE,qFAAqF;QACrF,4DAA4D;QAC5D,WAAW,CAAC,WAAW,CAAC,iBAAiB,UAAU,EAAE,EAAE,CAAC,IAAwB,EAAE,EAAE;YAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACrD,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBAC/C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACvF,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACH"}

package/messages/org.scan.user-perms.md

@@ -22,10 +22,6 @@ The target org to scan.
 
 - <%= config.bin %> <%= command.id %>
 
-# success.profiles-count
+# success.scanned-entities-count
 
-Scanned %s profiles.
-
-# success.permissionsets-count
-
-Scanned %s permission sets.
+Scanned %s profiles and %s permission sets.

package/messages/policies.general.md

@@ -10,6 +10,10 @@ Org did not return valid metadata for the profile. Entity cannot be processed.
 
 %ss with preset UNKNOWN are ignored.
 
+# user-with-role-unknown
+
+Users with role UNKNOWN are ignored. To apply the default role, remove them from config.
+
 # skip-reason.rule-not-enabled
 
 Rule was disabled in policy config.

package/messages/rules.users.md

@@ -0,0 +1,11 @@
+# violations.no-other-apex-api-logins
+
+Has %s logins with "Other Apex API", which is a deprecated and insecure login type.
+
+# violations.inactive-since-n-days
+
+User is inactive for %s days (last login was %s).
+
+# violations.has-never-logged-in
+
+User was created %s (%s days ago), but never logged in.