@j-schreiber/sf-cli-security-audit 0.8.2 → 0.8.4

package/lib/libs/core/mdapi/metadataRegistryEntry.js

@@ -0,0 +1,46 @@
+import { readFileSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { XMLParser } from 'fast-xml-parser';
+import { RETRIEVE_CACHE } from '../constants.js';
+export default class MetadataRegistryEntry {
+    opts;
+    parser;
+    retrieveType;
+    rootNodeName;
+    constructor(opts) {
+        this.opts = opts;
+        this.retrieveType = this.opts.retrieveType;
+        this.parser = this.opts.parser ?? new XMLParser();
+        this.rootNodeName = this.opts.rootNodeName;
+    }
+    parse(fullFilePath) {
+        const fileContent = readFileSync(fullFilePath, 'utf-8');
+        const parsedContent = this.parser.parse(fileContent);
+        if (this.opts.parsePostProcessor) {
+            return this.opts.parsePostProcessor(parsedContent[this.rootNodeName]);
+        }
+        return parsedContent[this.rootNodeName];
+    }
+}
+export async function retrieve(compSet, con) {
+    const retrieveRequest = await compSet.retrieve({
+        usernameOrConnection: con,
+        output: RETRIEVE_CACHE,
+    });
+    const retrieveResult = await retrieveRequest.pollStatus();
+    return retrieveResult;
+}
+export function cleanRetrieveDir(files) {
+    const dirNames = new Set();
+    files.forEach((file) => {
+        if (file.filePath) {
+            const dirName = path.dirname(path.normalize(file.filePath));
+            const parts = dirName.split(path.sep).filter((dirPart) => dirPart.startsWith('metadataPackage_'));
+            parts.forEach((mdPart) => dirNames.add(mdPart));
+        }
+    });
+    dirNames.forEach((dir) => {
+        rmSync(path.join(RETRIEVE_CACHE, dir), { recursive: true });
+    });
+}
+//# sourceMappingURL=metadataRegistryEntry.js.map

package/lib/libs/core/mdapi/metadataRegistryEntry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadataRegistryEntry.js","sourceRoot":"","sources":["../../../../src/libs/core/mdapi/metadataRegistryEntry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA8BjD,MAAM,CAAC,OAAO,OAAgB,qBAAqB;IAKtB;IAJpB,MAAM,CAAY;IAClB,YAAY,CAAS;IACrB,YAAY,CAAM;IAEzB,YAA2B,IAA0C;QAA1C,SAAI,GAAJ,IAAI,CAAsC;QACnE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,YAAsB;QACjC,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAS,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB,EAAE,GAAe;IACnE,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;QAC7C,oBAAoB,EAAE,GAAG;QACzB,MAAM,EAAE,cAAc;KACvB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;IAC1D,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAClG,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACvB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/libs/core/mdapi/namedMetadataToolingQueryable.d.ts

@@ -0,0 +1,33 @@
+import { Connection } from '@salesforce/core';
+import { NamedMetadataResolver } from './metadataRegistryEntry.js';
+export type NamedMetadataQueryableOpts<Type> = {
+    /**
+     * Object API name to retrieve. Must be available in tooling API
+     */
+    objectName: string;
+    /**
+     * Unique name field that is used to retrieve the object
+     */
+    nameField: string;
+    /**
+     * Post processor function that sanitises the XML parse result
+     */
+    parsePostProcessor?: (parseResult: Type) => Type;
+};
+/**
+ * The entry is a typical named metadata that is organized in a dedicated source folder
+ * where all entities have the same format. The components are queried from tooling API
+ * and organized by their developer name.
+ */
+export default class NamedMetadataQueryable<Type, Key extends keyof Type> implements NamedMetadataResolver<Type[Key]> {
+    private opts;
+    constructor(opts: NamedMetadataQueryableOpts<Type[Key]>);
+    /**
+     * Resolves a set of component names by querying "Metadata" property from tooling API
+     *
+     * @param con
+     * @param componentNames
+     * @returns
+     */
+    resolve(con: Connection, componentNames: string[]): Promise<Record<string, Type[Key]>>;
+}

package/lib/libs/core/mdapi/namedMetadataToolingQueryable.js

@@ -0,0 +1,41 @@
+import { isNullish } from '../utils.js';
+/**
+ * The entry is a typical named metadata that is organized in a dedicated source folder
+ * where all entities have the same format. The components are queried from tooling API
+ * and organized by their developer name.
+ */
+export default class NamedMetadataQueryable {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /**
+     * Resolves a set of component names by querying "Metadata" property from tooling API
+     *
+     * @param con
+     * @param componentNames
+     * @returns
+     */
+    async resolve(con, componentNames) {
+        const pendingQueries = new Array();
+        componentNames.forEach((cname) => {
+            const qr = Promise.resolve(con.tooling.query(`SELECT ${this.opts.nameField},Metadata FROM ${this.opts.objectName} WHERE ${this.opts.nameField} = '${cname}'`));
+            pendingQueries.push(qr);
+        });
+        const queryResults = await Promise.all(pendingQueries);
+        const resultMap = {};
+        queryResults.forEach((qr) => {
+            if (qr.totalSize > 0) {
+                const record = qr.records[0];
+                const identifier = record[this.opts.nameField];
+                if (identifier && !isNullish(record.Metadata)) {
+                    resultMap[identifier] = this.opts.parsePostProcessor
+                        ? this.opts.parsePostProcessor(record.Metadata)
+                        : record.Metadata;
+                }
+            }
+        });
+        return resultMap;
+    }
+}
+//# sourceMappingURL=namedMetadataToolingQueryable.js.map

package/lib/libs/core/mdapi/namedMetadataToolingQueryable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedMetadataToolingQueryable.js","sourceRoot":"","sources":["../../../../src/libs/core/mdapi/namedMetadataToolingQueryable.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAoBxC;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,sBAAsB;IACd;IAA3B,YAA2B,IAA2C;QAA3C,SAAI,GAAJ,IAAI,CAAuC;IAAG,CAAC;IAC1E;;;;;;OAMG;IACI,KAAK,CAAC,OAAO,CAAC,GAAe,EAAE,cAAwB;QAC5D,MAAM,cAAc,GAAG,IAAI,KAAK,EAAmD,CAAC;QACpF,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CACxB,GAAG,CAAC,OAAO,CAAC,KAAK,CACf,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,kBAAkB,IAAI,CAAC,IAAI,CAAC,UAAU,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,KAAK,GAAG,CAChH,CACF,CAAC;YACF,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,SAAS,GAA8B,EAAE,CAAC;QAChD,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YAC1B,IAAI,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAW,CAAC;gBACzD,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9C,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB;wBAClD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;wBAC/C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/lib/libs/core/mdapi/namedMetadataType.d.ts

@@ -0,0 +1,20 @@
+import { Connection } from '@salesforce/core';
+import MetadataRegistryEntry, { MetadataRegistryEntryOpts } from './metadataRegistryEntry.js';
+/**
+ * The entry is a typical named metadata that is organized in a dedicated source folder
+ * where all entities have the same format. The components are retrieved and organized
+ * by their developer name.
+ */
+export default class NamedMetadata<Type, Key extends keyof Type> extends MetadataRegistryEntry<Type, Key> {
+    constructor(opts: MetadataRegistryEntryOpts<Type, Key>);
+    /**
+     * Resolves component names, retrieves the metadata and returns
+     * as a strongly typed result.
+     *
+     * @param con
+     * @param componentNames
+     * @returns
+     */
+    resolve(con: Connection, componentNames: string[]): Promise<Record<string, Type[Key]>>;
+    private parseSourceFiles;
+}

package/lib/libs/core/mdapi/namedMetadataType.js

@@ -0,0 +1,41 @@
+import { ComponentSet } from '@salesforce/source-deploy-retrieve';
+import MetadataRegistryEntry, { cleanRetrieveDir, retrieve, } from './metadataRegistryEntry.js';
+/**
+ * The entry is a typical named metadata that is organized in a dedicated source folder
+ * where all entities have the same format. The components are retrieved and organized
+ * by their developer name.
+ */
+export default class NamedMetadata extends MetadataRegistryEntry {
+    constructor(opts) {
+        super(opts);
+    }
+    /**
+     * Resolves component names, retrieves the metadata and returns
+     * as a strongly typed result.
+     *
+     * @param con
+     * @param componentNames
+     * @returns
+     */
+    async resolve(con, componentNames) {
+        const cmpSet = new ComponentSet(componentNames.map((cname) => ({ type: this.retrieveType, fullName: cname })));
+        const retrieveResult = await retrieve(cmpSet, con);
+        const resolvedFiles = this.parseSourceFiles(retrieveResult.components, componentNames);
+        cleanRetrieveDir(retrieveResult.getFileResponses());
+        return resolvedFiles;
+    }
+    parseSourceFiles(componentSet, retrievedNames) {
+        const cmps = componentSet.getSourceComponents().toArray();
+        const result = {};
+        cmps.forEach((sourceComponent) => {
+            if (sourceComponent.xml && retrievedNames.includes(sourceComponent.name)) {
+                // the available method parseXmlSync on source component does not
+                // resolve the "rootNodeProblem" from XML. Therefore, we implement
+                // our own method to parse and return the "inner xml".
+                result[sourceComponent.name] = this.parse(sourceComponent.xml);
+            }
+        });
+        return result;
+    }
+}
+//# sourceMappingURL=namedMetadataType.js.map

package/lib/libs/core/mdapi/namedMetadataType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namedMetadataType.js","sourceRoot":"","sources":["../../../../src/libs/core/mdapi/namedMetadataType.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,qBAAqB,EAAE,EAC5B,gBAAgB,EAEhB,QAAQ,GACT,MAAM,4BAA4B,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,aAA4C,SAAQ,qBAAgC;IACvG,YAAmB,IAA0C;QAC3D,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IACD;;;;;;;OAOG;IACI,KAAK,CAAC,OAAO,CAAC,GAAe,EAAE,cAAwB;QAC5D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACvF,gBAAgB,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACpD,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,gBAAgB,CAAC,YAA0B,EAAE,cAAwB;QAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,MAAM,GAA8B,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE;YAC/B,IAAI,eAAe,CAAC,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzE,iEAAiE;gBACjE,kEAAkE;gBAClE,sDAAsD;gBACtD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/lib/libs/core/mdapi/singletonMetadataType.d.ts

@@ -0,0 +1,21 @@
+import { Connection } from '@salesforce/core';
+import MetadataRegistryEntry, { MetadataRegistryEntryOpts } from './metadataRegistryEntry.js';
+/**
+ * The entry is a type that only has one single instance on the org, such as
+ * a Setting. The component is typically retrieved by a more generic name and
+ * organized & cached by the explicit name.
+ */
+export default class SingletonMetadata<Type, Key extends keyof Type> extends MetadataRegistryEntry<Type, Key> {
+    retrieveName: string;
+    constructor(opts: MetadataRegistryEntryOpts<Type, Key>);
+    /**
+     * Resolves component names, retrieves the metadata and returns
+     * as a strongly typed result.
+     *
+     * @param con
+     * @param componentNames
+     * @returns
+     */
+    resolve(con: Connection): Promise<Type[Key]>;
+    private parseSourceFile;
+}

package/lib/libs/core/mdapi/singletonMetadataType.js

@@ -0,0 +1,37 @@
+import { ComponentSet } from '@salesforce/source-deploy-retrieve';
+import MetadataRegistryEntry, { cleanRetrieveDir, retrieve, } from './metadataRegistryEntry.js';
+/**
+ * The entry is a type that only has one single instance on the org, such as
+ * a Setting. The component is typically retrieved by a more generic name and
+ * organized & cached by the explicit name.
+ */
+export default class SingletonMetadata extends MetadataRegistryEntry {
+    retrieveName;
+    constructor(opts) {
+        super(opts);
+        this.retrieveName = opts.retrieveName ?? String(this.rootNodeName);
+    }
+    /**
+     * Resolves component names, retrieves the metadata and returns
+     * as a strongly typed result.
+     *
+     * @param con
+     * @param componentNames
+     * @returns
+     */
+    async resolve(con) {
+        const cmpSet = new ComponentSet([{ type: this.retrieveType, fullName: this.retrieveName }]);
+        const retrieveResult = await retrieve(cmpSet, con);
+        const resolvedCmp = this.parseSourceFile(retrieveResult.components);
+        cleanRetrieveDir(retrieveResult.getFileResponses());
+        return resolvedCmp;
+    }
+    parseSourceFile(componentSet) {
+        const cmps = componentSet.getSourceComponents({ type: this.retrieveType, fullName: this.retrieveName }).toArray();
+        if (cmps.length > 0 && cmps[0].xml) {
+            return this.parse(cmps[0].xml);
+        }
+        throw new Error('Failed to resolve settings for: ' + this.retrieveName);
+    }
+}
+//# sourceMappingURL=singletonMetadataType.js.map

package/lib/libs/core/mdapi/singletonMetadataType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"singletonMetadataType.js","sourceRoot":"","sources":["../../../../src/libs/core/mdapi/singletonMetadataType.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,qBAAqB,EAAE,EAC5B,gBAAgB,EAEhB,QAAQ,GACT,MAAM,4BAA4B,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAgD,SAAQ,qBAAgC;IACpG,YAAY,CAAS;IAC5B,YAAmB,IAA0C;QAC3D,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,OAAO,CAAC,GAAe;QAClC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAC5F,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACpE,gBAAgB,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,eAAe,CAAC,YAA0B;QAChD,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAClH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/lib/libs/core/mdapi/usersRepository.d.ts

@@ -0,0 +1,85 @@
+import { Connection } from '@salesforce/core';
+import { PermissionSet, Profile } from '@jsforce/jsforce-node/lib/api/metadata.js';
+export type User = {
+    userId: string;
+    username: string;
+    profileName: string;
+    createdDate: number;
+    lastLogin?: number;
+    logins?: UserLogins[];
+};
+export type UserPermissions = {
+    profileMetadata?: Profile;
+    assignedPermissionsets: PermissionSetAssignment[];
+};
+export type UserLogins = {
+    loginType: string;
+    application: string;
+    loginCount: number;
+    lastLogin: number;
+};
+export type PermissionSetAssignment = {
+    /**
+     * Developer name of the permission set
+     */
+    permissionSetIdentifier: string;
+    /**
+     * How user got this permission set assigned
+     */
+    permissionSetSource: 'direct' | 'group';
+    /**
+     * Metadata of the permission set
+     */
+    metadata?: PermissionSet;
+    /**
+     * If permission set is assigned through a group,
+     * this is the name of the group.
+     */
+    groupName?: string;
+};
+export type ResolveUsersOptions = {
+    /**
+     * Include aggregated login history
+     */
+    withLoginHistory: boolean;
+    /**
+     * When login history is set, the number of days that is searched
+     */
+    loginHistoryDaysToAnalyse?: number;
+};
+export type ResolvePermissionsOptions = {
+    /**
+     * Resolve permission set and profile metadata
+     */
+    withMetadata: boolean;
+};
+export default class UsersRepository {
+    private readonly connection;
+    private readonly mdapiRepo;
+    constructor(connection: Connection);
+    /**
+     * Resolves all users from the target org of this repository
+     *
+     * @param opts
+     * @returns
+     */
+    resolveAllUsers(opts?: ResolveUsersOptions): Promise<Map<string, User>>;
+    /**
+     * Resolves permission-granting entities (profiles and permission sets)
+     * for a list of users.
+     *
+     * @param userIds Users to be resolved
+     * @returns Map of permissions organized by user id
+     */
+    resolveUserPermissions(users: User[], opts?: ResolvePermissionsOptions): Promise<Map<string, UserPermissions>>;
+    /**
+     * Resolves all permission set assignments for the user with metadata of the
+     * permission set. If the user has no assignments, an empty list is returned.
+     *
+     * @param userIds
+     * @returns
+     */
+    resolvePermissionSetAssignments(userIds: string[], opts?: ResolvePermissionsOptions): Promise<Map<string, PermissionSetAssignment[]>>;
+    private resolveLogins;
+    private fetchAssignments;
+}

package/lib/libs/core/mdapi/usersRepository.js

@@ -0,0 +1,126 @@
+import { ACTIVE_USERS_DETAILS_QUERY, buildLoginHistoryQuery, buildPermsetAssignmentsQuery } from '../constants.js';
+import { isNullish } from '../utils.js';
+import MDAPI from './mdapiRetriever.js';
+export default class UsersRepository {
+    connection;
+    mdapiRepo;
+    constructor(connection) {
+        this.connection = connection;
+        this.mdapiRepo = MDAPI.create(this.connection);
+    }
+    /**
+     * Resolves all users from the target org of this repository
+     *
+     * @param opts
+     * @returns
+     */
+    async resolveAllUsers(opts) {
+        const result = new Map();
+        const allUsersOnOrg = await this.connection.query(ACTIVE_USERS_DETAILS_QUERY);
+        for (const user of allUsersOnOrg.records) {
+            const usr = {
+                userId: user.Id,
+                username: user.Username,
+                lastLogin: user.LastLoginDate ? Date.parse(user.LastLoginDate) : undefined,
+                createdDate: Date.parse(user.CreatedDate),
+                profileName: user.Profile.Name,
+            };
+            result.set(user.Username, usr);
+        }
+        if (opts?.withLoginHistory) {
+            const userLogins = await this.resolveLogins(opts.loginHistoryDaysToAnalyse);
+            for (const user of result.values()) {
+                if (userLogins.has(user.userId)) {
+                    user.logins = userLogins.get(user.userId);
+                }
+                else {
+                    user.logins = [];
+                }
+            }
+        }
+        return result;
+    }
+    /**
+     * Resolves permission-granting entities (profiles and permission sets)
+     * for a list of users.
+     *
+     * @param userIds Users to be resolved
+     * @returns Map of permissions organized by user id
+     */
+    async resolveUserPermissions(users, opts) {
+        const result = new Map();
+        const permsets = await this.resolvePermissionSetAssignments(users.map((usr) => usr.userId), opts);
+        const profiles = opts?.withMetadata
+            ? await this.mdapiRepo.resolve('Profile', uniqueProfileNames(Object.values(users)))
+            : {};
+        for (const user of users) {
+            result.set(user.userId, {
+                assignedPermissionsets: permsets.get(user.userId) ?? [],
+                profileMetadata: profiles[user.profileName],
+            });
+        }
+        return result;
+    }
+    /**
+     * Resolves all permission set assignments for the user with metadata of the
+     * permission set. If the user has no assignments, an empty list is returned.
+     *
+     * @param userIds
+     * @returns
+     */
+    async resolvePermissionSetAssignments(userIds, opts) {
+        const result = new Map();
+        const { assignments, permSetNames } = await this.fetchAssignments(userIds);
+        const permsets = opts?.withMetadata ? await this.mdapiRepo.resolve('PermissionSet', permSetNames) : {};
+        for (const userId of userIds) {
+            result.set(userId, assignments.get(userId)
+                ? assignments.get(userId).map((ass) => ({
+                    ...ass,
+                    metadata: permsets[ass.permissionSetIdentifier],
+                }))
+                : []);
+        }
+        return result;
+    }
+    async resolveLogins(daysToAnalyse) {
+        const loginHistory = await this.connection.query(buildLoginHistoryQuery(daysToAnalyse));
+        const partialUsers = new Map();
+        for (const loginHistoryRow of loginHistory.records) {
+            if (!partialUsers.has(loginHistoryRow.UserId)) {
+                partialUsers.set(loginHistoryRow.UserId, []);
+            }
+            partialUsers.get(loginHistoryRow.UserId).push({
+                loginType: loginHistoryRow.LoginType,
+                loginCount: loginHistoryRow.LoginCount,
+                application: loginHistoryRow.Application,
+                lastLogin: Date.parse(loginHistoryRow.LastLogin),
+            });
+        }
+        return partialUsers;
+    }
+    async fetchAssignments(userIds) {
+        const assignments = new Map();
+        const uniquePermSets = new Set();
+        const rawAssignment = await this.connection.query(buildPermsetAssignmentsQuery(userIds));
+        for (const assignment of rawAssignment.records) {
+            if (isNullish(assignments.get(assignment.AssigneeId))) {
+                assignments.set(assignment.AssigneeId, []);
+            }
+            assignments.get(assignment.AssigneeId).push({
+                permissionSetIdentifier: assignment.PermissionSet.Name,
+                permissionSetSource: assignment.PermissionSetGroupId ? 'group' : 'direct',
+                groupName: assignment.PermissionSetGroup?.DeveloperName,
+            });
+            uniquePermSets.add(assignment.PermissionSet.Name);
+        }
+        return { assignments, permSetNames: Array.from(uniquePermSets) };
+    }
+}
+function uniqueProfileNames(users) {
+    const uniqueProfiles = new Set();
+    for (const usr of users) {
+        uniqueProfiles.add(usr.profileName);
+    }
+    return Array.from(uniqueProfiles);
+}
+//# sourceMappingURL=usersRepository.js.map

package/lib/libs/core/mdapi/usersRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usersRepository.js","sourceRoot":"","sources":["../../../../src/libs/core/mdapi/usersRepository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAMnH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,MAAM,qBAAqB,CAAC;AAoExC,MAAM,CAAC,OAAO,OAAO,eAAe;IAGE;IAFnB,SAAS,CAAC;IAE3B,YAAoC,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;QACxD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,eAAe,CAAC,IAA0B;QACrD,MAAM,MAAM,GAAsB,IAAI,GAAG,EAAgB,CAAC;QAC1D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAa,0BAA0B,CAAC,CAAC;QAC1F,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG;gBACV,MAAM,EAAE,IAAI,CAAC,EAAG;gBAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1E,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;gBACzC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;aAC/B,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAC5E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5C,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,sBAAsB,CACjC,KAAa,EACb,IAAgC;QAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,+BAA+B,CACzD,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAC9B,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,EAAE,YAAY;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnF,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;gBACtB,sBAAsB,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;gBACvD,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,+BAA+B,CAC1C,OAAiB,EACjB,IAAgC;QAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqC,CAAC;QAC5D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CACR,MAAM,EACN,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;gBACrB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACrC,GAAG,GAAG;oBACN,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC;iBAChD,CAAC,CAAC;gBACL,CAAC,CAAC,EAAE,CACP,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,aAAsB;QAChD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAsB,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7G,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;QACrD,KAAK,MAAM,eAAe,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACnD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/C,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC;gBAC7C,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,UAAU,EAAE,eAAe,CAAC,UAAU;gBACtC,WAAW,EAAE,eAAe,CAAC,WAAW;gBACxC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAAiB;QAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;QAC1D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC/C,4BAA4B,CAAC,OAAO,CAAC,CACtC,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBACtD,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC;gBAC3C,uBAAuB,EAAE,UAAU,CAAC,aAAa,CAAC,IAAI;gBACtD,mBAAmB,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;gBACzE,SAAS,EAAE,UAAU,CAAC,kBAAkB,EAAE,aAAa;aACxD,CAAC,CAAC;YACH,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;IACnE,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC"}

package/lib/libs/core/policies/connectedAppPolicy.d.ts

@@ -0,0 +1,10 @@
+import { AuditRunConfig, BasePolicyFileContent } from '../file-mgmt/schema.js';
+import { AuditContext } from '../registries/types.js';
+import { ResolvedConnectedApp } from '../registries/connectedApps.js';
+import Policy, { ResolveEntityResult } from './policy.js';
+export default class ConnectedAppPolicy extends Policy<ResolvedConnectedApp> {
+    config: BasePolicyFileContent;
+    auditConfig: AuditRunConfig;
+    constructor(config: BasePolicyFileContent, auditConfig: AuditRunConfig, registry?: import("../registries/connectedApps.js").default);
+    protected resolveEntities(context: AuditContext): Promise<ResolveEntityResult<ResolvedConnectedApp>>;
+}

package/lib/libs/core/policies/connectedAppPolicy.js

@@ -0,0 +1,78 @@
+import { CONNECTED_APPS_QUERY, OAUTH_TOKEN_QUERY } from '../constants.js';
+import { ConnectedAppsRegistry } from '../registries/connectedApps.js';
+import MDAPI from '../mdapi/mdapiRetriever.js';
+import Policy, { getTotal } from './policy.js';
+export default class ConnectedAppPolicy extends Policy {
+    config;
+    auditConfig;
+    constructor(config, auditConfig, registry = ConnectedAppsRegistry) {
+        super(config, auditConfig, registry);
+        this.config = config;
+        this.auditConfig = auditConfig;
+    }
+    // eslint-disable-next-line class-methods-use-this
+    async resolveEntities(context) {
+        const successfullyResolved = {};
+        const ignoredEntities = {};
+        const metadataApi = new MDAPI(context.targetOrgConnection);
+        this.emit('entityresolve', {
+            total: 0,
+            resolved: 0,
+        });
+        const installedApps = await context.targetOrgConnection.query(CONNECTED_APPS_QUERY);
+        this.emit('entityresolve', {
+            total: installedApps.totalSize,
+            resolved: 0,
+        });
+        installedApps.records.forEach((installedApp) => {
+            successfullyResolved[installedApp.Name] = {
+                name: installedApp.Name,
+                origin: 'Installed',
+                onlyAdminApprovedUsersAllowed: installedApp.OptionsAllowAdminApprovedUsersOnly,
+                overrideByApiSecurityAccess: false,
+                useCount: 0,
+                users: [],
+            };
+        });
+        const usersOAuthToken = await context.targetOrgConnection.query(OAUTH_TOKEN_QUERY);
+        usersOAuthToken.records.forEach((token) => {
+            if (successfullyResolved[token.AppName] === undefined) {
+                successfullyResolved[token.AppName] = {
+                    name: token.AppName,
+                    origin: 'OauthToken',
+                    onlyAdminApprovedUsersAllowed: false,
+                    overrideByApiSecurityAccess: false,
+                    useCount: token.UseCount,
+                    users: [token.User.Username],
+                };
+            }
+            else {
+                successfullyResolved[token.AppName].useCount += token.UseCount;
+                if (!successfullyResolved[token.AppName].users.includes(token.User.Username)) {
+                    successfullyResolved[token.AppName].users.push(token.User.Username);
+                }
+            }
+        });
+        this.emit('entityresolve', {
+            total: Object.keys(successfullyResolved).length,
+            resolved: 0,
+        });
+        let overrideByApiSecurityAccess = false;
+        const apiSecurityAccessSetting = await metadataApi.resolveSingleton('ConnectedAppSettings');
+        if (apiSecurityAccessSetting && apiSecurityAccessSetting.enableAdminApprovedAppsOnly) {
+            overrideByApiSecurityAccess = true;
+        }
+        Object.values(successfullyResolved).forEach((conApp) => {
+            // eslint-disable-next-line no-param-reassign
+            conApp.overrideByApiSecurityAccess = overrideByApiSecurityAccess;
+        });
+        const result = { resolvedEntities: successfullyResolved, ignoredEntities: Object.values(ignoredEntities) };
+        this.emit('entityresolve', {
+            total: getTotal(result),
+            resolved: getTotal(result),
+        });
+        // also query from tooling, to get additional information info
+        return result;
+    }
+}
+//# sourceMappingURL=connectedAppPolicy.js.map

package/lib/libs/core/policies/connectedAppPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectedAppPolicy.js","sourceRoot":"","sources":["../../../../src/libs/core/policies/connectedAppPolicy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,qBAAqB,EAAwB,MAAM,gCAAgC,CAAC;AAC7F,OAAO,KAAK,MAAM,4BAA4B,CAAC;AAC/C,OAAO,MAAM,EAAE,EAAE,QAAQ,EAAuB,MAAM,aAAa,CAAC;AAGpE,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,MAA4B;IAEjE;IACA;IAFT,YACS,MAA6B,EAC7B,WAA2B,EAClC,QAAQ,GAAG,qBAAqB;QAEhC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAJ9B,WAAM,GAAN,MAAM,CAAuB;QAC7B,gBAAW,GAAX,WAAW,CAAgB;IAIpC,CAAC;IAED,kDAAkD;IACxC,KAAK,CAAC,eAAe,CAAC,OAAqB;QACnD,MAAM,oBAAoB,GAAyC,EAAE,CAAC;QACtE,MAAM,eAAe,GAAuC,EAAE,CAAC;QAC/D,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAe,oBAAoB,CAAC,CAAC;QAClG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,aAAa,CAAC,SAAS;YAC9B,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;YAC7C,oBAAoB,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,MAAM,EAAE,WAAW;gBACnB,6BAA6B,EAAE,YAAY,CAAC,kCAAkC;gBAC9E,2BAA2B,EAAE,KAAK;gBAClC,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,EAAE;aACV,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAa,iBAAiB,CAAC,CAAC;QAC/F,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACxC,IAAI,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtD,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG;oBACpC,IAAI,EAAE,KAAK,CAAC,OAAO;oBACnB,MAAM,EAAE,YAAY;oBACpB,6BAA6B,EAAE,KAAK;oBACpC,2BAA2B,EAAE,KAAK;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;iBAC7B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;gBAC/D,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC7E,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM;YAC/C,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QACH,IAAI,2BAA2B,GAAG,KAAK,CAAC;QACxC,MAAM,wBAAwB,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QAC5F,IAAI,wBAAwB,IAAI,wBAAwB,CAAC,2BAA2B,EAAE,CAAC;YACrF,2BAA2B,GAAG,IAAI,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACrD,6CAA6C;YAC7C,MAAM,CAAC,2BAA2B,GAAG,2BAA2B,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3G,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;YACvB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;SAC3B,CAAC,CAAC;QACH,8DAA8D;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/lib/libs/core/policies/permissionSetPolicy.d.ts

@@ -0,0 +1,11 @@
+import { AuditRunConfig, PermSetsPolicyFileContent } from '../file-mgmt/schema.js';
+import { AuditContext } from '../registries/types.js';
+import { ResolvedPermissionSet } from '../registries/permissionSets.js';
+import Policy, { ResolveEntityResult } from './policy.js';
+export default class PermissionSetPolicy extends Policy<ResolvedPermissionSet> {
+    config: PermSetsPolicyFileContent;
+    auditContext: AuditRunConfig;
+    private totalEntities;
+    constructor(config: PermSetsPolicyFileContent, auditContext: AuditRunConfig, registry?: import("../registries/permissionSets.js").default);
+    protected resolveEntities(context: AuditContext): Promise<ResolveEntityResult<ResolvedPermissionSet>>;
+}