@j-schreiber/sf-cli-security-audit 0.7.1 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +26 -22
- package/messages/rules.enforceClassificationPresets.md +4 -0
- package/messages/rules.users.md +12 -0
- package/oclif.lock +365 -71
- package/oclif.manifest.json +2 -253
- package/package.json +1 -1
- package/lib/commands/org/audit/init.d.ts +0 -19
- package/lib/commands/org/audit/init.js +0 -72
- package/lib/commands/org/audit/init.js.map +0 -1
- package/lib/commands/org/audit/run.d.ts +0 -22
- package/lib/commands/org/audit/run.js +0 -119
- package/lib/commands/org/audit/run.js.map +0 -1
- package/lib/commands/org/scan/user-perms.d.ts +0 -20
- package/lib/commands/org/scan/user-perms.js +0 -87
- package/lib/commands/org/scan/user-perms.js.map +0 -1
- package/lib/libs/conf-init/auditConfig.d.ts +0 -35
- package/lib/libs/conf-init/auditConfig.js +0 -41
- package/lib/libs/conf-init/auditConfig.js.map +0 -1
- package/lib/libs/conf-init/permissionsClassification.d.ts +0 -17
- package/lib/libs/conf-init/permissionsClassification.js +0 -80
- package/lib/libs/conf-init/permissionsClassification.js.map +0 -1
- package/lib/libs/conf-init/policyConfigs.d.ts +0 -31
- package/lib/libs/conf-init/policyConfigs.js +0 -91
- package/lib/libs/conf-init/policyConfigs.js.map +0 -1
- package/lib/libs/conf-init/presets/loose.d.ts +0 -6
- package/lib/libs/conf-init/presets/loose.js +0 -51
- package/lib/libs/conf-init/presets/loose.js.map +0 -1
- package/lib/libs/conf-init/presets/none.d.ts +0 -30
- package/lib/libs/conf-init/presets/none.js +0 -54
- package/lib/libs/conf-init/presets/none.js.map +0 -1
- package/lib/libs/conf-init/presets/strict.d.ts +0 -4
- package/lib/libs/conf-init/presets/strict.js +0 -45
- package/lib/libs/conf-init/presets/strict.js.map +0 -1
- package/lib/libs/conf-init/presets.d.ts +0 -7
- package/lib/libs/conf-init/presets.js +0 -20
- package/lib/libs/conf-init/presets.js.map +0 -1
- package/lib/libs/core/auditRun.d.ts +0 -36
- package/lib/libs/core/auditRun.js +0 -86
- package/lib/libs/core/auditRun.js.map +0 -1
- package/lib/libs/core/classification-types.d.ts +0 -20
- package/lib/libs/core/classification-types.js +0 -23
- package/lib/libs/core/classification-types.js.map +0 -1
- package/lib/libs/core/constants.d.ts +0 -11
- package/lib/libs/core/constants.js +0 -20
- package/lib/libs/core/constants.js.map +0 -1
- package/lib/libs/core/file-mgmt/auditConfigFileManager.d.ts +0 -48
- package/lib/libs/core/file-mgmt/auditConfigFileManager.js +0 -145
- package/lib/libs/core/file-mgmt/auditConfigFileManager.js.map +0 -1
- package/lib/libs/core/file-mgmt/schema.d.ts +0 -123
- package/lib/libs/core/file-mgmt/schema.js +0 -69
- package/lib/libs/core/file-mgmt/schema.js.map +0 -1
- package/lib/libs/core/mdapi/mdapiRetriever.d.ts +0 -54
- package/lib/libs/core/mdapi/mdapiRetriever.js +0 -123
- package/lib/libs/core/mdapi/mdapiRetriever.js.map +0 -1
- package/lib/libs/core/mdapi/metadataRegistryEntry.d.ts +0 -40
- package/lib/libs/core/mdapi/metadataRegistryEntry.js +0 -46
- package/lib/libs/core/mdapi/metadataRegistryEntry.js.map +0 -1
- package/lib/libs/core/mdapi/namedMetadataToolingQueryable.d.ts +0 -33
- package/lib/libs/core/mdapi/namedMetadataToolingQueryable.js +0 -41
- package/lib/libs/core/mdapi/namedMetadataToolingQueryable.js.map +0 -1
- package/lib/libs/core/mdapi/namedMetadataType.d.ts +0 -20
- package/lib/libs/core/mdapi/namedMetadataType.js +0 -41
- package/lib/libs/core/mdapi/namedMetadataType.js.map +0 -1
- package/lib/libs/core/mdapi/singletonMetadataType.d.ts +0 -21
- package/lib/libs/core/mdapi/singletonMetadataType.js +0 -37
- package/lib/libs/core/mdapi/singletonMetadataType.js.map +0 -1
- package/lib/libs/core/policies/connectedAppPolicy.d.ts +0 -10
- package/lib/libs/core/policies/connectedAppPolicy.js +0 -78
- package/lib/libs/core/policies/connectedAppPolicy.js.map +0 -1
- package/lib/libs/core/policies/permissionSetPolicy.d.ts +0 -11
- package/lib/libs/core/policies/permissionSetPolicy.js +0 -62
- package/lib/libs/core/policies/permissionSetPolicy.js.map +0 -1
- package/lib/libs/core/policies/policy.d.ts +0 -31
- package/lib/libs/core/policies/policy.js +0 -100
- package/lib/libs/core/policies/policy.js.map +0 -1
- package/lib/libs/core/policies/profilePolicy.d.ts +0 -11
- package/lib/libs/core/policies/profilePolicy.js +0 -64
- package/lib/libs/core/policies/profilePolicy.js.map +0 -1
- package/lib/libs/core/policies/salesforceStandardTypes.d.ts +0 -53
- package/lib/libs/core/policies/salesforceStandardTypes.js +0 -2
- package/lib/libs/core/policies/salesforceStandardTypes.js.map +0 -1
- package/lib/libs/core/policies/userPolicy.d.ts +0 -11
- package/lib/libs/core/policies/userPolicy.js +0 -104
- package/lib/libs/core/policies/userPolicy.js.map +0 -1
- package/lib/libs/core/policy-types.d.ts +0 -18
- package/lib/libs/core/policy-types.js +0 -28
- package/lib/libs/core/policy-types.js.map +0 -1
- package/lib/libs/core/policyRegistry.d.ts +0 -23
- package/lib/libs/core/policyRegistry.js +0 -38
- package/lib/libs/core/policyRegistry.js.map +0 -1
- package/lib/libs/core/registries/connectedApps.d.ts +0 -13
- package/lib/libs/core/registries/connectedApps.js +0 -13
- package/lib/libs/core/registries/connectedApps.js.map +0 -1
- package/lib/libs/core/registries/permissionSets.d.ts +0 -11
- package/lib/libs/core/registries/permissionSets.js +0 -11
- package/lib/libs/core/registries/permissionSets.js.map +0 -1
- package/lib/libs/core/registries/profiles.d.ts +0 -11
- package/lib/libs/core/registries/profiles.js +0 -13
- package/lib/libs/core/registries/profiles.js.map +0 -1
- package/lib/libs/core/registries/ruleRegistry.d.ts +0 -37
- package/lib/libs/core/registries/ruleRegistry.js +0 -48
- package/lib/libs/core/registries/ruleRegistry.js.map +0 -1
- package/lib/libs/core/registries/rules/allUsedAppsUnderManagement.d.ts +0 -7
- package/lib/libs/core/registries/rules/allUsedAppsUnderManagement.js +0 -23
- package/lib/libs/core/registries/rules/allUsedAppsUnderManagement.js.map +0 -1
- package/lib/libs/core/registries/rules/enforceCustomPermsClassificationOnProfiles.d.ts +0 -7
- package/lib/libs/core/registries/rules/enforceCustomPermsClassificationOnProfiles.js +0 -52
- package/lib/libs/core/registries/rules/enforceCustomPermsClassificationOnProfiles.js.map +0 -1
- package/lib/libs/core/registries/rules/enforceUserPermsClassificationOnPermSets.d.ts +0 -7
- package/lib/libs/core/registries/rules/enforceUserPermsClassificationOnPermSets.js +0 -52
- package/lib/libs/core/registries/rules/enforceUserPermsClassificationOnPermSets.js.map +0 -1
- package/lib/libs/core/registries/rules/enforceUserPermsClassificationOnProfiles.d.ts +0 -7
- package/lib/libs/core/registries/rules/enforceUserPermsClassificationOnProfiles.js +0 -54
- package/lib/libs/core/registries/rules/enforceUserPermsClassificationOnProfiles.js.map +0 -1
- package/lib/libs/core/registries/rules/noInactiveUsers.d.ts +0 -9
- package/lib/libs/core/registries/rules/noInactiveUsers.js +0 -44
- package/lib/libs/core/registries/rules/noInactiveUsers.js.map +0 -1
- package/lib/libs/core/registries/rules/noOtherApexApiLogins.d.ts +0 -7
- package/lib/libs/core/registries/rules/noOtherApexApiLogins.js +0 -24
- package/lib/libs/core/registries/rules/noOtherApexApiLogins.js.map +0 -1
- package/lib/libs/core/registries/rules/noUserCanSelfAuthorize.d.ts +0 -7
- package/lib/libs/core/registries/rules/noUserCanSelfAuthorize.js +0 -31
- package/lib/libs/core/registries/rules/noUserCanSelfAuthorize.js.map +0 -1
- package/lib/libs/core/registries/rules/policyRule.d.ts +0 -21
- package/lib/libs/core/registries/rules/policyRule.js +0 -41
- package/lib/libs/core/registries/rules/policyRule.js.map +0 -1
- package/lib/libs/core/registries/types.d.ts +0 -37
- package/lib/libs/core/registries/types.js +0 -11
- package/lib/libs/core/registries/types.js.map +0 -1
- package/lib/libs/core/registries/users.d.ts +0 -26
- package/lib/libs/core/registries/users.js +0 -10
- package/lib/libs/core/registries/users.js.map +0 -1
- package/lib/libs/core/result-types.d.ts +0 -172
- package/lib/libs/core/result-types.js +0 -2
- package/lib/libs/core/result-types.js.map +0 -1
- package/lib/libs/core/utils.d.ts +0 -12
- package/lib/libs/core/utils.js +0 -31
- package/lib/libs/core/utils.js.map +0 -1
- package/lib/libs/quick-scan/types.d.ts +0 -17
- package/lib/libs/quick-scan/types.js +0 -2
- package/lib/libs/quick-scan/types.js.map +0 -1
- package/lib/libs/quick-scan/userPermissionScanner.d.ts +0 -22
- package/lib/libs/quick-scan/userPermissionScanner.js +0 -75
- package/lib/libs/quick-scan/userPermissionScanner.js.map +0 -1
- package/lib/ux/auditRunMultiStage.d.ts +0 -65
- package/lib/ux/auditRunMultiStage.js +0 -120
- package/lib/ux/auditRunMultiStage.js.map +0 -1
|
@@ -1,35 +0,0 @@
|
|
|
1
|
-
import { Connection } from '@salesforce/core';
|
|
2
|
-
import { AuditRunConfig } from '../core/file-mgmt/schema.js';
|
|
3
|
-
import { AuditInitPresets } from './presets.js';
|
|
4
|
-
/**
|
|
5
|
-
* Additional options how the config should be initialised.
|
|
6
|
-
*/
|
|
7
|
-
export type AuditInitOptions = {
|
|
8
|
-
/**
|
|
9
|
-
* When set, config files are created at the target location.
|
|
10
|
-
*/
|
|
11
|
-
targetDir?: string;
|
|
12
|
-
/**
|
|
13
|
-
* An optional preset to initialise classifications and policies.
|
|
14
|
-
*/
|
|
15
|
-
preset?: AuditInitPresets;
|
|
16
|
-
};
|
|
17
|
-
/**
|
|
18
|
-
* Exposes key functionality to load an audit config as static methods. This makes
|
|
19
|
-
* it easy to mock the results during tests.
|
|
20
|
-
*/
|
|
21
|
-
export default class AuditConfig {
|
|
22
|
-
/**
|
|
23
|
-
* Initialise a new audit config from target org and writes
|
|
24
|
-
* files to the destination directory.
|
|
25
|
-
*
|
|
26
|
-
* @param con
|
|
27
|
-
*/
|
|
28
|
-
static init(targetCon: Connection, opts?: AuditInitOptions): Promise<AuditRunConfig>;
|
|
29
|
-
/**
|
|
30
|
-
* Loads an existing audit config from a source directory
|
|
31
|
-
*
|
|
32
|
-
* @param sourceDir
|
|
33
|
-
*/
|
|
34
|
-
static load(sourceDir: string): AuditRunConfig;
|
|
35
|
-
}
|
|
@@ -1,41 +0,0 @@
|
|
|
1
|
-
import { DefaultFileManager } from '../core/file-mgmt/auditConfigFileManager.js';
|
|
2
|
-
import { initCustomPermissions, initUserPermissions } from './permissionsClassification.js';
|
|
3
|
-
import { initConnectedApps, initPermissionSets, initProfiles, initUsers } from './policyConfigs.js';
|
|
4
|
-
/**
|
|
5
|
-
* Exposes key functionality to load an audit config as static methods. This makes
|
|
6
|
-
* it easy to mock the results during tests.
|
|
7
|
-
*/
|
|
8
|
-
export default class AuditConfig {
|
|
9
|
-
/**
|
|
10
|
-
* Initialise a new audit config from target org and writes
|
|
11
|
-
* files to the destination directory.
|
|
12
|
-
*
|
|
13
|
-
* @param con
|
|
14
|
-
*/
|
|
15
|
-
static async init(targetCon, opts) {
|
|
16
|
-
const conf = { classifications: {}, policies: {} };
|
|
17
|
-
conf.classifications.userPermissions = { content: await initUserPermissions(targetCon, opts?.preset) };
|
|
18
|
-
const customPerms = await initCustomPermissions(targetCon);
|
|
19
|
-
if (customPerms) {
|
|
20
|
-
conf.classifications.customPermissions = { content: customPerms };
|
|
21
|
-
}
|
|
22
|
-
conf.policies.profiles = { content: await initProfiles(targetCon) };
|
|
23
|
-
conf.policies.permissionSets = { content: await initPermissionSets(targetCon) };
|
|
24
|
-
conf.policies.users = { content: await initUsers(targetCon) };
|
|
25
|
-
conf.policies.connectedApps = { content: initConnectedApps() };
|
|
26
|
-
// eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
|
|
27
|
-
if (opts?.targetDir || opts?.targetDir === '') {
|
|
28
|
-
DefaultFileManager.save(opts.targetDir, conf);
|
|
29
|
-
}
|
|
30
|
-
return conf;
|
|
31
|
-
}
|
|
32
|
-
/**
|
|
33
|
-
* Loads an existing audit config from a source directory
|
|
34
|
-
*
|
|
35
|
-
* @param sourceDir
|
|
36
|
-
*/
|
|
37
|
-
static load(sourceDir) {
|
|
38
|
-
return DefaultFileManager.parse(sourceDir);
|
|
39
|
-
}
|
|
40
|
-
}
|
|
41
|
-
//# sourceMappingURL=auditConfig.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"auditConfig.js","sourceRoot":"","sources":["../../../src/libs/conf-init/auditConfig.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAiBpG;;;GAGG;AACH,MAAM,CAAC,OAAO,OAAO,WAAW;IAC9B;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAqB,EAAE,IAAuB;QACrE,MAAM,IAAI,GAAmB,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnE,IAAI,CAAC,eAAe,CAAC,eAAe,GAAG,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvG,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,eAAe,CAAC,iBAAiB,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,cAAc,GAAG,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,aAAa,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC;QAC/D,wEAAwE;QACxE,IAAI,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,KAAK,EAAE,EAAE,CAAC;YAC9C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,IAAI,CAAC,SAAiB;QAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;CACF"}
|
|
@@ -1,17 +0,0 @@
|
|
|
1
|
-
import { Connection } from '@salesforce/core';
|
|
2
|
-
import { PermissionsConfig } from '../core/file-mgmt/schema.js';
|
|
3
|
-
import { AuditInitPresets } from './presets.js';
|
|
4
|
-
/**
|
|
5
|
-
* Initialises a fresh set of user permissions from target org connection.
|
|
6
|
-
*
|
|
7
|
-
* @param con
|
|
8
|
-
* @returns
|
|
9
|
-
*/
|
|
10
|
-
export declare function initUserPermissions(con: Connection, preset?: AuditInitPresets): Promise<PermissionsConfig>;
|
|
11
|
-
/**
|
|
12
|
-
* Initialises a fresh set of custom permissions from the target org
|
|
13
|
-
*
|
|
14
|
-
* @param con
|
|
15
|
-
* @returns
|
|
16
|
-
*/
|
|
17
|
-
export declare function initCustomPermissions(con: Connection): Promise<PermissionsConfig | undefined>;
|
|
@@ -1,80 +0,0 @@
|
|
|
1
|
-
import { CUSTOM_PERMS_QUERY, PROFILES_QUERY } from '../core/constants.js';
|
|
2
|
-
import MDAPI from '../core/mdapi/mdapiRetriever.js';
|
|
3
|
-
import { classificationSorter, PermissionRiskLevel } from '../core/classification-types.js';
|
|
4
|
-
import { loadPreset } from './presets.js';
|
|
5
|
-
/**
|
|
6
|
-
* Initialises a fresh set of user permissions from target org connection.
|
|
7
|
-
*
|
|
8
|
-
* @param con
|
|
9
|
-
* @returns
|
|
10
|
-
*/
|
|
11
|
-
export async function initUserPermissions(con, preset) {
|
|
12
|
-
const describePerms = await parsePermsFromDescribe(con);
|
|
13
|
-
const assignedPerms = await findAssignedPerms(con);
|
|
14
|
-
const allPerms = { ...describePerms, ...assignedPerms };
|
|
15
|
-
const presConfig = loadPreset(preset);
|
|
16
|
-
const perms = presConfig.classifyUserPermissions(Object.values(allPerms));
|
|
17
|
-
perms.sort(classificationSorter);
|
|
18
|
-
const result = { permissions: {} };
|
|
19
|
-
perms.forEach((perm) => (result.permissions[perm.name] = {
|
|
20
|
-
label: sanitiseLabel(perm.label),
|
|
21
|
-
classification: perm.classification,
|
|
22
|
-
reason: perm.reason,
|
|
23
|
-
}));
|
|
24
|
-
return result;
|
|
25
|
-
}
|
|
26
|
-
/**
|
|
27
|
-
* Initialises a fresh set of custom permissions from the target org
|
|
28
|
-
*
|
|
29
|
-
* @param con
|
|
30
|
-
* @returns
|
|
31
|
-
*/
|
|
32
|
-
export async function initCustomPermissions(con) {
|
|
33
|
-
const result = { permissions: {} };
|
|
34
|
-
const customPerms = await con.query(CUSTOM_PERMS_QUERY);
|
|
35
|
-
if (customPerms.records.length === 0) {
|
|
36
|
-
return undefined;
|
|
37
|
-
}
|
|
38
|
-
const perms = customPerms.records.map((cp) => ({
|
|
39
|
-
name: cp.DeveloperName,
|
|
40
|
-
label: cp.MasterLabel,
|
|
41
|
-
classification: PermissionRiskLevel.UNKNOWN,
|
|
42
|
-
}));
|
|
43
|
-
perms.forEach((perm) => (result.permissions[perm.name] = {
|
|
44
|
-
label: perm.label,
|
|
45
|
-
classification: perm.classification,
|
|
46
|
-
}));
|
|
47
|
-
return result;
|
|
48
|
-
}
|
|
49
|
-
async function parsePermsFromDescribe(con) {
|
|
50
|
-
const permSet = await con.describe('PermissionSet');
|
|
51
|
-
const describeAvailablePerms = {};
|
|
52
|
-
permSet.fields
|
|
53
|
-
.filter((field) => field.name.startsWith('Permissions'))
|
|
54
|
-
.forEach((field) => {
|
|
55
|
-
const permName = field.name.replace('Permissions', '');
|
|
56
|
-
describeAvailablePerms[permName] = {
|
|
57
|
-
label: field.label,
|
|
58
|
-
name: permName,
|
|
59
|
-
};
|
|
60
|
-
});
|
|
61
|
-
return describeAvailablePerms;
|
|
62
|
-
}
|
|
63
|
-
async function findAssignedPerms(con) {
|
|
64
|
-
const assignedPerms = {};
|
|
65
|
-
const profiles = await con.query(PROFILES_QUERY);
|
|
66
|
-
if (profiles.records?.length > 0) {
|
|
67
|
-
const mdapi = new MDAPI(con);
|
|
68
|
-
const resolvedProfiles = await mdapi.resolve('Profile', profiles.records.map((p) => p.Profile.Name));
|
|
69
|
-
Object.values(resolvedProfiles).forEach((profile) => {
|
|
70
|
-
profile.userPermissions.forEach((userPerm) => {
|
|
71
|
-
assignedPerms[userPerm.name] = { name: userPerm.name };
|
|
72
|
-
});
|
|
73
|
-
});
|
|
74
|
-
}
|
|
75
|
-
return assignedPerms;
|
|
76
|
-
}
|
|
77
|
-
function sanitiseLabel(rawLabel) {
|
|
78
|
-
return rawLabel?.replace(/[ \t]+$|[\r\n]+/g, '');
|
|
79
|
-
}
|
|
80
|
-
//# sourceMappingURL=permissionsClassification.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"permissionsClassification.js","sourceRoot":"","sources":["../../../src/libs/conf-init/permissionsClassification.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,MAAM,iCAAiC,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,EAAoB,UAAU,EAAE,MAAM,cAAc,CAAC;AAG5D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAe,EAAE,MAAyB;IAClF,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,aAAa,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,MAAM,MAAM,GAAsB,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACtD,KAAK,CAAC,OAAO,CACX,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC/B,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CACL,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAe;IACzD,MAAM,MAAM,GAAsB,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,KAAK,CAAmB,kBAAkB,CAAC,CAAC;IAC1E,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE,EAAE,CAAC,aAAa;QACtB,KAAK,EAAE,EAAE,CAAC,WAAW;QACrB,cAAc,EAAE,mBAAmB,CAAC,OAAO;KAC5C,CAAC,CAAC,CAAC;IACJ,KAAK,CAAC,OAAO,CACX,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CACL,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAe;IACnD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,sBAAsB,GAAqC,EAAE,CAAC;IACpE,OAAO,CAAC,MAAM;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;SACvD,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACvD,sBAAsB,CAAC,QAAQ,CAAC,GAAG;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAe;IAC9C,MAAM,aAAa,GAAqC,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAgB,cAAc,CAAC,CAAC;IAChE,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,OAAO,CAC1C,SAAS,EACT,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAC5C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAClD,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC3C,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB;IACtC,OAAO,QAAQ,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC"}
|
|
@@ -1,31 +0,0 @@
|
|
|
1
|
-
import { Connection } from '@salesforce/core';
|
|
2
|
-
import { BasePolicyFileContent, PermSetsPolicyFileContent, ProfilesPolicyFileContent, UsersPolicyFileContent } from '../core/file-mgmt/schema.js';
|
|
3
|
-
/**
|
|
4
|
-
* Initialises a new profiles policy with the local org's
|
|
5
|
-
* profiles and all default rules enabled.
|
|
6
|
-
*
|
|
7
|
-
* @param targetOrgCon
|
|
8
|
-
* @param targetDir
|
|
9
|
-
* @returns
|
|
10
|
-
*/
|
|
11
|
-
export declare function initProfiles(targetOrgCon: Connection): Promise<ProfilesPolicyFileContent>;
|
|
12
|
-
/**
|
|
13
|
-
* Initialises a new permission sets policy with the local org's custom
|
|
14
|
-
* permissions and all default rules enabled.
|
|
15
|
-
*
|
|
16
|
-
* @param targetOrgCon
|
|
17
|
-
* @returns
|
|
18
|
-
*/
|
|
19
|
-
export declare function initPermissionSets(targetOrgCon: Connection): Promise<PermSetsPolicyFileContent>;
|
|
20
|
-
/**
|
|
21
|
-
* Initialises a new connected apps policy with default rules enabled.
|
|
22
|
-
*
|
|
23
|
-
* @returns
|
|
24
|
-
*/
|
|
25
|
-
export declare function initConnectedApps(): BasePolicyFileContent;
|
|
26
|
-
/**
|
|
27
|
-
* Initialises a users policy with all users flagged as standard user
|
|
28
|
-
*
|
|
29
|
-
* @param targetOrgCon
|
|
30
|
-
*/
|
|
31
|
-
export declare function initUsers(targetOrgCon: Connection): Promise<UsersPolicyFileContent>;
|
|
@@ -1,91 +0,0 @@
|
|
|
1
|
-
import { ACTIVE_USERS_QUERY, PERMISSION_SETS_QUERY, PROFILES_QUERY } from '../core/constants.js';
|
|
2
|
-
import { UsersPolicyConfig, } from '../core/file-mgmt/schema.js';
|
|
3
|
-
import { RuleRegistries } from '../core/registries/types.js';
|
|
4
|
-
import { ProfilesRiskPreset } from '../core/policy-types.js';
|
|
5
|
-
/**
|
|
6
|
-
* Initialises a new profiles policy with the local org's
|
|
7
|
-
* profiles and all default rules enabled.
|
|
8
|
-
*
|
|
9
|
-
* @param targetOrgCon
|
|
10
|
-
* @param targetDir
|
|
11
|
-
* @returns
|
|
12
|
-
*/
|
|
13
|
-
export async function initProfiles(targetOrgCon) {
|
|
14
|
-
const profiles = await targetOrgCon.query(PROFILES_QUERY);
|
|
15
|
-
const content = { enabled: true, rules: {}, profiles: {} };
|
|
16
|
-
profiles.records.forEach((permsetRecord) => {
|
|
17
|
-
content.profiles[permsetRecord.Profile.Name] = { preset: ProfilesRiskPreset.UNKNOWN };
|
|
18
|
-
});
|
|
19
|
-
RuleRegistries.Profiles.registeredRules().forEach((ruleName) => {
|
|
20
|
-
content.rules[ruleName] = {
|
|
21
|
-
enabled: true,
|
|
22
|
-
};
|
|
23
|
-
});
|
|
24
|
-
return content;
|
|
25
|
-
}
|
|
26
|
-
/**
|
|
27
|
-
* Initialises a new permission sets policy with the local org's custom
|
|
28
|
-
* permissions and all default rules enabled.
|
|
29
|
-
*
|
|
30
|
-
* @param targetOrgCon
|
|
31
|
-
* @returns
|
|
32
|
-
*/
|
|
33
|
-
export async function initPermissionSets(targetOrgCon) {
|
|
34
|
-
const permSets = await targetOrgCon.query(PERMISSION_SETS_QUERY);
|
|
35
|
-
const content = {
|
|
36
|
-
enabled: true,
|
|
37
|
-
rules: {},
|
|
38
|
-
permissionSets: {},
|
|
39
|
-
};
|
|
40
|
-
permSets.records
|
|
41
|
-
.filter((permsetRecord) => permsetRecord.IsCustom)
|
|
42
|
-
.forEach((permsetRecord) => {
|
|
43
|
-
content.permissionSets[permsetRecord.Name] = { preset: ProfilesRiskPreset.UNKNOWN };
|
|
44
|
-
});
|
|
45
|
-
RuleRegistries.PermissionSets.registeredRules().forEach((ruleName) => {
|
|
46
|
-
content.rules[ruleName] = {
|
|
47
|
-
enabled: true,
|
|
48
|
-
};
|
|
49
|
-
});
|
|
50
|
-
return content;
|
|
51
|
-
}
|
|
52
|
-
/**
|
|
53
|
-
* Initialises a new connected apps policy with default rules enabled.
|
|
54
|
-
*
|
|
55
|
-
* @returns
|
|
56
|
-
*/
|
|
57
|
-
export function initConnectedApps() {
|
|
58
|
-
const content = { enabled: true, rules: {} };
|
|
59
|
-
RuleRegistries.ConnectedApps.registeredRules().forEach((ruleName) => {
|
|
60
|
-
content.rules[ruleName] = {
|
|
61
|
-
enabled: true,
|
|
62
|
-
};
|
|
63
|
-
});
|
|
64
|
-
return content;
|
|
65
|
-
}
|
|
66
|
-
/**
|
|
67
|
-
* Initialises a users policy with all users flagged as standard user
|
|
68
|
-
*
|
|
69
|
-
* @param targetOrgCon
|
|
70
|
-
*/
|
|
71
|
-
export async function initUsers(targetOrgCon) {
|
|
72
|
-
const users = await targetOrgCon.query(ACTIVE_USERS_QUERY);
|
|
73
|
-
const content = {
|
|
74
|
-
enabled: true,
|
|
75
|
-
options: UsersPolicyConfig.parse({}),
|
|
76
|
-
rules: {},
|
|
77
|
-
users: {},
|
|
78
|
-
};
|
|
79
|
-
// dont parse all configs with default of 30 - but initialise a new config likle this
|
|
80
|
-
content.options.analyseLastNDaysOfLoginHistory = 30;
|
|
81
|
-
users.records.forEach((userRecord) => {
|
|
82
|
-
content.users[userRecord.Username] = { role: ProfilesRiskPreset.STANDARD_USER };
|
|
83
|
-
});
|
|
84
|
-
RuleRegistries.Users.registeredRules().forEach((ruleName) => {
|
|
85
|
-
content.rules[ruleName] = {
|
|
86
|
-
enabled: true,
|
|
87
|
-
};
|
|
88
|
-
});
|
|
89
|
-
return content;
|
|
90
|
-
}
|
|
91
|
-
//# sourceMappingURL=policyConfigs.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"policyConfigs.js","sourceRoot":"","sources":["../../../src/libs/conf-init/policyConfigs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEjG,OAAO,EAIL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAwB;IACzD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAgB,cAAc,CAAC,CAAC;IACzE,MAAM,OAAO,GAA8B,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACtF,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;QACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7D,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG;YACxB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAwB;IAC/D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAgB,qBAAqB,CAAC,CAAC;IAChF,MAAM,OAAO,GAA8B;QACzC,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE;QACT,cAAc,EAAE,EAAE;KACnB,CAAC;IACF,QAAQ,CAAC,OAAO;SACb,MAAM,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC;SACjD,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;QACzB,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,OAAO,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;IACL,cAAc,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG;YACxB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,OAAO,GAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACpE,cAAc,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAClE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG;YACxB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,YAAwB;IACtD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,CAAO,kBAAkB,CAAC,CAAC;IACjE,MAAM,OAAO,GAA2B;QACtC,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV,CAAC;IACF,qFAAqF;IACrF,OAAO,CAAC,OAAO,CAAC,8BAA8B,GAAG,EAAE,CAAC;IACpD,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;QACnC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC1D,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG;YACxB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
|
@@ -1,51 +0,0 @@
|
|
|
1
|
-
import { PermissionRiskLevel } from '../../core/classification-types.js';
|
|
2
|
-
import NonePreset from './none.js';
|
|
3
|
-
export default class LoosePreset extends NonePreset {
|
|
4
|
-
constructor() {
|
|
5
|
-
super({
|
|
6
|
-
UseAnyApiClient: PermissionRiskLevel.HIGH,
|
|
7
|
-
ExternalClientAppAdmin: PermissionRiskLevel.HIGH,
|
|
8
|
-
ManageSandboxes: PermissionRiskLevel.HIGH,
|
|
9
|
-
ManageDevSandboxes: PermissionRiskLevel.HIGH,
|
|
10
|
-
CustomizeApplication: PermissionRiskLevel.HIGH,
|
|
11
|
-
ModifyMetadata: PermissionRiskLevel.HIGH,
|
|
12
|
-
AuthorApex: PermissionRiskLevel.HIGH,
|
|
13
|
-
DebugApex: PermissionRiskLevel.HIGH,
|
|
14
|
-
ManageAuthProviders: PermissionRiskLevel.HIGH,
|
|
15
|
-
Packaging2: PermissionRiskLevel.HIGH,
|
|
16
|
-
Packaging2Delete: PermissionRiskLevel.HIGH,
|
|
17
|
-
Packaging2PromoteVersion: PermissionRiskLevel.HIGH,
|
|
18
|
-
InstallPackaging: PermissionRiskLevel.HIGH,
|
|
19
|
-
ViewClientSecret: PermissionRiskLevel.HIGH,
|
|
20
|
-
ManageTwoFactor: PermissionRiskLevel.HIGH,
|
|
21
|
-
ManageRemoteAccess: PermissionRiskLevel.HIGH,
|
|
22
|
-
CanApproveUninstalledApps: PermissionRiskLevel.HIGH,
|
|
23
|
-
AssignPermissionSets: PermissionRiskLevel.HIGH,
|
|
24
|
-
ManageIpAddresses: PermissionRiskLevel.HIGH,
|
|
25
|
-
ManageSharing: PermissionRiskLevel.HIGH,
|
|
26
|
-
ManageInternalUsers: PermissionRiskLevel.HIGH,
|
|
27
|
-
ManagePasswordPolicies: PermissionRiskLevel.HIGH,
|
|
28
|
-
ManageLoginAccessPolicies: PermissionRiskLevel.HIGH,
|
|
29
|
-
ManageCustomPermissions: PermissionRiskLevel.HIGH,
|
|
30
|
-
ManageCertificates: PermissionRiskLevel.HIGH,
|
|
31
|
-
FreezeUsers: PermissionRiskLevel.MEDIUM,
|
|
32
|
-
ManageRoles: PermissionRiskLevel.MEDIUM,
|
|
33
|
-
ViewSetup: PermissionRiskLevel.MEDIUM,
|
|
34
|
-
ViewAllData: PermissionRiskLevel.MEDIUM,
|
|
35
|
-
ModifyAllData: PermissionRiskLevel.MEDIUM,
|
|
36
|
-
ExportReport: PermissionRiskLevel.MEDIUM,
|
|
37
|
-
EmailMass: PermissionRiskLevel.MEDIUM,
|
|
38
|
-
AccessContentBuilder: PermissionRiskLevel.MEDIUM,
|
|
39
|
-
ApiEnabled: PermissionRiskLevel.LOW,
|
|
40
|
-
LightningExperienceUser: PermissionRiskLevel.LOW,
|
|
41
|
-
});
|
|
42
|
-
}
|
|
43
|
-
initDefault(permName) {
|
|
44
|
-
const basePerm = super.initDefault(permName);
|
|
45
|
-
if (basePerm.classification === PermissionRiskLevel.UNKNOWN) {
|
|
46
|
-
basePerm.classification = PermissionRiskLevel.LOW;
|
|
47
|
-
}
|
|
48
|
-
return basePerm;
|
|
49
|
-
}
|
|
50
|
-
}
|
|
51
|
-
//# sourceMappingURL=loose.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"loose.js","sourceRoot":"","sources":["../../../../src/libs/conf-init/presets/loose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,UAAU,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,UAAU;IACjD;QACE,KAAK,CAAC;YACJ,eAAe,EAAE,mBAAmB,CAAC,IAAI;YACzC,sBAAsB,EAAE,mBAAmB,CAAC,IAAI;YAChD,eAAe,EAAE,mBAAmB,CAAC,IAAI;YACzC,kBAAkB,EAAE,mBAAmB,CAAC,IAAI;YAC5C,oBAAoB,EAAE,mBAAmB,CAAC,IAAI;YAC9C,cAAc,EAAE,mBAAmB,CAAC,IAAI;YACxC,UAAU,EAAE,mBAAmB,CAAC,IAAI;YACpC,SAAS,EAAE,mBAAmB,CAAC,IAAI;YACnC,mBAAmB,EAAE,mBAAmB,CAAC,IAAI;YAC7C,UAAU,EAAE,mBAAmB,CAAC,IAAI;YACpC,gBAAgB,EAAE,mBAAmB,CAAC,IAAI;YAC1C,wBAAwB,EAAE,mBAAmB,CAAC,IAAI;YAClD,gBAAgB,EAAE,mBAAmB,CAAC,IAAI;YAC1C,gBAAgB,EAAE,mBAAmB,CAAC,IAAI;YAC1C,eAAe,EAAE,mBAAmB,CAAC,IAAI;YACzC,kBAAkB,EAAE,mBAAmB,CAAC,IAAI;YAC5C,yBAAyB,EAAE,mBAAmB,CAAC,IAAI;YACnD,oBAAoB,EAAE,mBAAmB,CAAC,IAAI;YAC9C,iBAAiB,EAAE,mBAAmB,CAAC,IAAI;YAC3C,aAAa,EAAE,mBAAmB,CAAC,IAAI;YACvC,mBAAmB,EAAE,mBAAmB,CAAC,IAAI;YAC7C,sBAAsB,EAAE,mBAAmB,CAAC,IAAI;YAChD,yBAAyB,EAAE,mBAAmB,CAAC,IAAI;YACnD,uBAAuB,EAAE,mBAAmB,CAAC,IAAI;YACjD,kBAAkB,EAAE,mBAAmB,CAAC,IAAI;YAC5C,WAAW,EAAE,mBAAmB,CAAC,MAAM;YACvC,WAAW,EAAE,mBAAmB,CAAC,MAAM;YACvC,SAAS,EAAE,mBAAmB,CAAC,MAAM;YACrC,WAAW,EAAE,mBAAmB,CAAC,MAAM;YACvC,aAAa,EAAE,mBAAmB,CAAC,MAAM;YACzC,YAAY,EAAE,mBAAmB,CAAC,MAAM;YACxC,SAAS,EAAE,mBAAmB,CAAC,MAAM;YACrC,oBAAoB,EAAE,mBAAmB,CAAC,MAAM;YAChD,UAAU,EAAE,mBAAmB,CAAC,GAAG;YACnC,uBAAuB,EAAE,mBAAmB,CAAC,GAAG;SACjD,CAAC,CAAC;IACL,CAAC;IAEe,WAAW,CAAC,QAAgB;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,cAAc,KAAK,mBAAmB,CAAC,OAAO,EAAE,CAAC;YAC5D,QAAQ,CAAC,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC;QACpD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
|
|
@@ -1,30 +0,0 @@
|
|
|
1
|
-
import { NamedPermissionsClassification } from '../../core/file-mgmt/schema.js';
|
|
2
|
-
import { PermissionRiskLevel } from '../../core/classification-types.js';
|
|
3
|
-
import { Optional } from '../../core/utils.js';
|
|
4
|
-
export type UnclassifiedPerm = Optional<NamedPermissionsClassification, 'classification'>;
|
|
5
|
-
export type Preset = {
|
|
6
|
-
classifyUserPermissions(rawPerms: UnclassifiedPerm[]): NamedPermissionsClassification[];
|
|
7
|
-
};
|
|
8
|
-
/**
|
|
9
|
-
* A "blank" preset that is extended by all other presets
|
|
10
|
-
* and initialises classification descriptions
|
|
11
|
-
*/
|
|
12
|
-
export default class NonePreset implements Preset {
|
|
13
|
-
protected userPermissions: Record<string, Partial<NamedPermissionsClassification>>;
|
|
14
|
-
constructor(userPerms?: Record<string, PermissionRiskLevel>);
|
|
15
|
-
/**
|
|
16
|
-
* Finalises permissions for all unclassified user perms that are set
|
|
17
|
-
* in this preset.
|
|
18
|
-
*
|
|
19
|
-
* @param perms
|
|
20
|
-
*/
|
|
21
|
-
classifyUserPermissions(rawPerms: UnclassifiedPerm[]): NamedPermissionsClassification[];
|
|
22
|
-
/**
|
|
23
|
-
* Initialises a default classification for a given permission name.
|
|
24
|
-
* This merges pre-configured defaults with available descriptions.
|
|
25
|
-
*
|
|
26
|
-
* @param permName
|
|
27
|
-
* @returns
|
|
28
|
-
*/
|
|
29
|
-
initDefault(permName: string): NamedPermissionsClassification;
|
|
30
|
-
}
|
|
@@ -1,54 +0,0 @@
|
|
|
1
|
-
import { Messages } from '@salesforce/core';
|
|
2
|
-
import { PermissionRiskLevel } from '../../core/classification-types.js';
|
|
3
|
-
Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
|
|
4
|
-
const descriptions = Messages.loadMessages('@j-schreiber/sf-cli-security-audit', 'policyclassifications');
|
|
5
|
-
/**
|
|
6
|
-
* A "blank" preset that is extended by all other presets
|
|
7
|
-
* and initialises classification descriptions
|
|
8
|
-
*/
|
|
9
|
-
export default class NonePreset {
|
|
10
|
-
userPermissions;
|
|
11
|
-
constructor(userPerms) {
|
|
12
|
-
this.userPermissions = {};
|
|
13
|
-
if (userPerms) {
|
|
14
|
-
Object.entries(userPerms).forEach(([name, classification]) => {
|
|
15
|
-
if (this.userPermissions[name]) {
|
|
16
|
-
this.userPermissions[name].classification = classification;
|
|
17
|
-
}
|
|
18
|
-
else {
|
|
19
|
-
this.userPermissions[name] = { classification };
|
|
20
|
-
}
|
|
21
|
-
});
|
|
22
|
-
}
|
|
23
|
-
}
|
|
24
|
-
/**
|
|
25
|
-
* Finalises permissions for all unclassified user perms that are set
|
|
26
|
-
* in this preset.
|
|
27
|
-
*
|
|
28
|
-
* @param perms
|
|
29
|
-
*/
|
|
30
|
-
classifyUserPermissions(rawPerms) {
|
|
31
|
-
return rawPerms.map((perm) => ({
|
|
32
|
-
...this.initDefault(perm.name),
|
|
33
|
-
...perm,
|
|
34
|
-
}));
|
|
35
|
-
}
|
|
36
|
-
/**
|
|
37
|
-
* Initialises a default classification for a given permission name.
|
|
38
|
-
* This merges pre-configured defaults with available descriptions.
|
|
39
|
-
*
|
|
40
|
-
* @param permName
|
|
41
|
-
* @returns
|
|
42
|
-
*/
|
|
43
|
-
initDefault(permName) {
|
|
44
|
-
const def = this.userPermissions[permName];
|
|
45
|
-
const hasDescription = descriptions.messages.has(permName);
|
|
46
|
-
return {
|
|
47
|
-
...def,
|
|
48
|
-
name: permName,
|
|
49
|
-
classification: def?.classification ?? PermissionRiskLevel.UNKNOWN,
|
|
50
|
-
reason: hasDescription ? descriptions.getMessage(permName) : undefined,
|
|
51
|
-
};
|
|
52
|
-
}
|
|
53
|
-
}
|
|
54
|
-
//# sourceMappingURL=none.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"none.js","sourceRoot":"","sources":["../../../../src/libs/conf-init/presets/none.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAGzE,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,oCAAoC,EAAE,uBAAuB,CAAC,CAAC;AAQ1G;;;GAGG;AACH,MAAM,CAAC,OAAO,OAAO,UAAU;IACnB,eAAe,CAA0D;IAEnF,YAAmB,SAA+C;QAChE,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE;gBAC3D,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,cAAc,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;gBAClD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,uBAAuB,CAAC,QAA4B;QACzD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,GAAG,IAAI;SACR,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACI,WAAW,CAAC,QAAgB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO;YACL,GAAG,GAAG;YACN,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,GAAG,EAAE,cAAc,IAAI,mBAAmB,CAAC,OAAO;YAClE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC;IACJ,CAAC;CACF"}
|
|
@@ -1,45 +0,0 @@
|
|
|
1
|
-
import { PermissionRiskLevel } from '../../core/classification-types.js';
|
|
2
|
-
import NonePreset from './none.js';
|
|
3
|
-
export default class StrictPreset extends NonePreset {
|
|
4
|
-
constructor() {
|
|
5
|
-
super({
|
|
6
|
-
UseAnyApiClient: PermissionRiskLevel.BLOCKED,
|
|
7
|
-
ImportCustomObjects: PermissionRiskLevel.CRITICAL,
|
|
8
|
-
ManageSandboxes: PermissionRiskLevel.CRITICAL,
|
|
9
|
-
ManageDevSandboxes: PermissionRiskLevel.CRITICAL,
|
|
10
|
-
CustomizeApplication: PermissionRiskLevel.CRITICAL,
|
|
11
|
-
ModifyMetadata: PermissionRiskLevel.CRITICAL,
|
|
12
|
-
AuthorApex: PermissionRiskLevel.CRITICAL,
|
|
13
|
-
DebugApex: PermissionRiskLevel.CRITICAL,
|
|
14
|
-
ManageAuthProviders: PermissionRiskLevel.CRITICAL,
|
|
15
|
-
Packaging2: PermissionRiskLevel.CRITICAL,
|
|
16
|
-
Packaging2Delete: PermissionRiskLevel.CRITICAL,
|
|
17
|
-
Packaging2PromoteVersion: PermissionRiskLevel.CRITICAL,
|
|
18
|
-
InstallPackaging: PermissionRiskLevel.CRITICAL,
|
|
19
|
-
ViewClientSecret: PermissionRiskLevel.CRITICAL,
|
|
20
|
-
ExternalClientAppAdmin: PermissionRiskLevel.CRITICAL,
|
|
21
|
-
ManageCertificates: PermissionRiskLevel.HIGH,
|
|
22
|
-
ExportReport: PermissionRiskLevel.HIGH,
|
|
23
|
-
ViewSetup: PermissionRiskLevel.HIGH,
|
|
24
|
-
ApiEnabled: PermissionRiskLevel.HIGH,
|
|
25
|
-
ViewAllData: PermissionRiskLevel.HIGH,
|
|
26
|
-
ModifyAllData: PermissionRiskLevel.HIGH,
|
|
27
|
-
ManageTwoFactor: PermissionRiskLevel.HIGH,
|
|
28
|
-
ManageRemoteAccess: PermissionRiskLevel.HIGH,
|
|
29
|
-
CanApproveUninstalledApps: PermissionRiskLevel.HIGH,
|
|
30
|
-
AssignPermissionSets: PermissionRiskLevel.HIGH,
|
|
31
|
-
ManageRoles: PermissionRiskLevel.HIGH,
|
|
32
|
-
ManageIpAddresses: PermissionRiskLevel.HIGH,
|
|
33
|
-
ManageSharing: PermissionRiskLevel.HIGH,
|
|
34
|
-
ManageInternalUsers: PermissionRiskLevel.HIGH,
|
|
35
|
-
ManagePasswordPolicies: PermissionRiskLevel.HIGH,
|
|
36
|
-
ManageLoginAccessPolicies: PermissionRiskLevel.HIGH,
|
|
37
|
-
ManageCustomPermissions: PermissionRiskLevel.HIGH,
|
|
38
|
-
FreezeUsers: PermissionRiskLevel.HIGH,
|
|
39
|
-
AccessContentBuilder: PermissionRiskLevel.HIGH,
|
|
40
|
-
EmailMass: PermissionRiskLevel.MEDIUM,
|
|
41
|
-
LightningExperienceUser: PermissionRiskLevel.LOW,
|
|
42
|
-
});
|
|
43
|
-
}
|
|
44
|
-
}
|
|
45
|
-
//# sourceMappingURL=strict.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"strict.js","sourceRoot":"","sources":["../../../../src/libs/conf-init/presets/strict.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,UAAU,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,UAAU;IAClD;QACE,KAAK,CAAC;YACJ,eAAe,EAAE,mBAAmB,CAAC,OAAO;YAC5C,mBAAmB,EAAE,mBAAmB,CAAC,QAAQ;YACjD,eAAe,EAAE,mBAAmB,CAAC,QAAQ;YAC7C,kBAAkB,EAAE,mBAAmB,CAAC,QAAQ;YAChD,oBAAoB,EAAE,mBAAmB,CAAC,QAAQ;YAClD,cAAc,EAAE,mBAAmB,CAAC,QAAQ;YAC5C,UAAU,EAAE,mBAAmB,CAAC,QAAQ;YACxC,SAAS,EAAE,mBAAmB,CAAC,QAAQ;YACvC,mBAAmB,EAAE,mBAAmB,CAAC,QAAQ;YACjD,UAAU,EAAE,mBAAmB,CAAC,QAAQ;YACxC,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ;YAC9C,wBAAwB,EAAE,mBAAmB,CAAC,QAAQ;YACtD,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ;YAC9C,sBAAsB,EAAE,mBAAmB,CAAC,QAAQ;YACpD,kBAAkB,EAAE,mBAAmB,CAAC,IAAI;YAC5C,YAAY,EAAE,mBAAmB,CAAC,IAAI;YACtC,SAAS,EAAE,mBAAmB,CAAC,IAAI;YACnC,UAAU,EAAE,mBAAmB,CAAC,IAAI;YACpC,WAAW,EAAE,mBAAmB,CAAC,IAAI;YACrC,aAAa,EAAE,mBAAmB,CAAC,IAAI;YACvC,eAAe,EAAE,mBAAmB,CAAC,IAAI;YACzC,kBAAkB,EAAE,mBAAmB,CAAC,IAAI;YAC5C,yBAAyB,EAAE,mBAAmB,CAAC,IAAI;YACnD,oBAAoB,EAAE,mBAAmB,CAAC,IAAI;YAC9C,WAAW,EAAE,mBAAmB,CAAC,IAAI;YACrC,iBAAiB,EAAE,mBAAmB,CAAC,IAAI;YAC3C,aAAa,EAAE,mBAAmB,CAAC,IAAI;YACvC,mBAAmB,EAAE,mBAAmB,CAAC,IAAI;YAC7C,sBAAsB,EAAE,mBAAmB,CAAC,IAAI;YAChD,yBAAyB,EAAE,mBAAmB,CAAC,IAAI;YACnD,uBAAuB,EAAE,mBAAmB,CAAC,IAAI;YACjD,WAAW,EAAE,mBAAmB,CAAC,IAAI;YACrC,oBAAoB,EAAE,mBAAmB,CAAC,IAAI;YAC9C,SAAS,EAAE,mBAAmB,CAAC,MAAM;YACrC,uBAAuB,EAAE,mBAAmB,CAAC,GAAG;SACjD,CAAC,CAAC;IACL,CAAC;CACF"}
|
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
import LoosePreset from './presets/loose.js';
|
|
2
|
-
import NonePreset from './presets/none.js';
|
|
3
|
-
import StrictPreset from './presets/strict.js';
|
|
4
|
-
export var AuditInitPresets;
|
|
5
|
-
(function (AuditInitPresets) {
|
|
6
|
-
AuditInitPresets["strict"] = "strict";
|
|
7
|
-
AuditInitPresets["loose"] = "loose";
|
|
8
|
-
AuditInitPresets["none"] = "none";
|
|
9
|
-
})(AuditInitPresets || (AuditInitPresets = {}));
|
|
10
|
-
export function loadPreset(presetName) {
|
|
11
|
-
switch (presetName) {
|
|
12
|
-
case AuditInitPresets.loose:
|
|
13
|
-
return new LoosePreset();
|
|
14
|
-
case AuditInitPresets.strict:
|
|
15
|
-
return new StrictPreset();
|
|
16
|
-
default:
|
|
17
|
-
return new NonePreset();
|
|
18
|
-
}
|
|
19
|
-
}
|
|
20
|
-
//# sourceMappingURL=presets.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../../src/libs/conf-init/presets.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,oBAAoB,CAAC;AAC7C,OAAO,UAAsB,MAAM,mBAAmB,CAAC;AACvD,OAAO,YAAY,MAAM,qBAAqB,CAAC;AAE/C,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,qCAAiB,CAAA;IACjB,mCAAe,CAAA;IACf,iCAAa,CAAA;AACf,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAED,MAAM,UAAU,UAAU,CAAC,UAA6B;IACtD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,gBAAgB,CAAC,KAAK;YACzB,OAAO,IAAI,WAAW,EAAE,CAAC;QAC3B,KAAK,gBAAgB,CAAC,MAAM;YAC1B,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B;YACE,OAAO,IAAI,UAAU,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}
|
|
@@ -1,36 +0,0 @@
|
|
|
1
|
-
import EventEmitter from 'node:events';
|
|
2
|
-
import { Connection } from '@salesforce/core';
|
|
3
|
-
import { AuditResult } from './result-types.js';
|
|
4
|
-
import { AuditRunConfig } from './file-mgmt/schema.js';
|
|
5
|
-
import Policy from './policies/policy.js';
|
|
6
|
-
type PolicyMap = Record<string, Policy<unknown>>;
|
|
7
|
-
export declare function startAuditRun(directoryPath: string): AuditRun;
|
|
8
|
-
export type EntityResolveEvent = {
|
|
9
|
-
total: number;
|
|
10
|
-
resolved: number;
|
|
11
|
-
policyName: string;
|
|
12
|
-
};
|
|
13
|
-
/**
|
|
14
|
-
* Instance of an audit run that manages high-level operations
|
|
15
|
-
*/
|
|
16
|
-
export default class AuditRun extends EventEmitter {
|
|
17
|
-
configs: AuditRunConfig;
|
|
18
|
-
private executablePolicies?;
|
|
19
|
-
constructor(configs: AuditRunConfig);
|
|
20
|
-
/**
|
|
21
|
-
* Loads all policies, resolves entities and caches the results.
|
|
22
|
-
*
|
|
23
|
-
* @param targetOrgConnection
|
|
24
|
-
*/
|
|
25
|
-
resolve(targetOrgConnection: Connection): Promise<PolicyMap>;
|
|
26
|
-
/**
|
|
27
|
-
* Executes an initialised audit run. Resolves policies entities
|
|
28
|
-
* and executes all rules.
|
|
29
|
-
*
|
|
30
|
-
* @param targetOrgConnection
|
|
31
|
-
* @returns
|
|
32
|
-
*/
|
|
33
|
-
execute(targetCon: Connection): Promise<Omit<AuditResult, 'orgId'>>;
|
|
34
|
-
private loadPolicies;
|
|
35
|
-
}
|
|
36
|
-
export {};
|