@sagentix-inc/evidence-collector 0.3.1 → 0.3.3

package/apps/sos-app/src/data/checks/prowler_okta.json

@@ -21,5 +21,209 @@
   "url": "https://github.com/prowler-cloud/prowler"
  },
  "provider": "okta",
- "checks": []
+ "checks": [
+  {
+   "id": "prowler.okta.apitoken_not_super_admin",
+   "title": "Okta API tokens are not owned by Super Admin users",
+   "scope": "Prowler 5.47.0 check apitoken_not_super_admin (Okta apitoken, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.apitoken_restricted_to_network_zone",
+   "title": "Okta API tokens are restricted to known Network Zones",
+   "scope": "Prowler 5.47.0 check apitoken_restricted_to_network_zone (Okta apitoken, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.application_admin_console_mfa_required",
+   "title": "Okta Admin Console authentication policy enforces multifactor authentication",
+   "scope": "Prowler 5.47.0 check application_admin_console_mfa_required (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.okta.application_admin_console_phishing_resistant_authentication",
+   "title": "Okta Admin Console authentication policy enforces phishing-resistant factors",
+   "scope": "Prowler 5.47.0 check application_admin_console_phishing_resistant_authentication (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.application_admin_console_session_idle_timeout_15min",
+   "title": "Okta Admin Console app session idle timeout is 15 minutes or less",
+   "scope": "Prowler 5.47.0 check application_admin_console_session_idle_timeout_15min (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.application_authentication_policy_network_zone_enforced",
+   "title": "Okta application authentication policies enforce Network Zones",
+   "scope": "Prowler 5.47.0 check application_authentication_policy_network_zone_enforced (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.application_dashboard_mfa_required",
+   "title": "Okta Dashboard authentication policy enforces multifactor authentication",
+   "scope": "Prowler 5.47.0 check application_dashboard_mfa_required (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.okta.application_dashboard_phishing_resistant_authentication",
+   "title": "Okta Dashboard authentication policy enforces phishing-resistant factors",
+   "scope": "Prowler 5.47.0 check application_dashboard_phishing_resistant_authentication (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_okta_verify_fips_compliant",
+   "title": "Okta Verify authenticator is active and restricts enrollment to FIPS-compliant devices",
+   "scope": "Prowler 5.47.0 check authenticator_okta_verify_fips_compliant (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_common_password_check",
+   "title": "Every active Okta Password Policy rejects common passwords",
+   "scope": "Prowler 5.47.0 check authenticator_password_common_password_check (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_complexity_lowercase",
+   "title": "Every active Okta Password Policy requires at least one lowercase character",
+   "scope": "Prowler 5.47.0 check authenticator_password_complexity_lowercase (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_complexity_number",
+   "title": "Every active Okta Password Policy requires at least one numeric character",
+   "scope": "Prowler 5.47.0 check authenticator_password_complexity_number (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_complexity_symbol",
+   "title": "Every active Okta Password Policy requires at least one symbol character",
+   "scope": "Prowler 5.47.0 check authenticator_password_complexity_symbol (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_complexity_uppercase",
+   "title": "Every active Okta Password Policy requires at least one uppercase character",
+   "scope": "Prowler 5.47.0 check authenticator_password_complexity_uppercase (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_history_5",
+   "title": "Every active Okta Password Policy remembers at least 5 previous passwords",
+   "scope": "Prowler 5.47.0 check authenticator_password_history_5 (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_lockout_threshold_3",
+   "title": "Every active Okta Password Policy locks accounts after 3 or fewer failed attempts",
+   "scope": "Prowler 5.47.0 check authenticator_password_lockout_threshold_3 (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_maximum_age_60d",
+   "title": "Every active Okta Password Policy enforces a maximum password age of 60 days or less",
+   "scope": "Prowler 5.47.0 check authenticator_password_maximum_age_60d (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_minimum_age_24h",
+   "title": "Every active Okta Password Policy enforces a minimum password age of 24 hours",
+   "scope": "Prowler 5.47.0 check authenticator_password_minimum_age_24h (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_minimum_length_15",
+   "title": "Every active Okta Password Policy enforces a minimum length of 15 characters",
+   "scope": "Prowler 5.47.0 check authenticator_password_minimum_length_15 (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_smart_card_active",
+   "title": "Okta Smart Card IdP authenticator is configured and active",
+   "scope": "Prowler 5.47.0 check authenticator_smart_card_active (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.idp_smart_card_dod_approved_ca",
+   "title": "Okta Smart Card (X509) Identity Provider uses a DOD-approved certificate authority",
+   "scope": "Prowler 5.47.0 check idp_smart_card_dod_approved_ca (Okta idp, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.network_zone_block_anonymized_proxies",
+   "title": "Okta uses active Network Zone blocklists for anonymized proxy sources",
+   "scope": "Prowler 5.47.0 check network_zone_block_anonymized_proxies (Okta network, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.signon_dod_warning_banner_configured",
+   "title": "Okta sign-in page displays the Standard Mandatory DOD Notice and Consent Banner",
+   "scope": "Prowler 5.47.0 check signon_dod_warning_banner_configured (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "informational"
+  },
+  {
+   "id": "prowler.okta.signon_global_session_cookies_not_persistent",
+   "title": "Default Global Session Policy has a Priority 1 non-default rule disabling persistent global session cookies",
+   "scope": "Prowler 5.47.0 check signon_global_session_cookies_not_persistent (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.signon_global_session_idle_timeout_15min",
+   "title": "Default Global Session Policy has a Priority 1 non-default rule enforcing 15-minute idle timeout",
+   "scope": "Prowler 5.47.0 check signon_global_session_idle_timeout_15min (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.signon_global_session_lifetime_18h",
+   "title": "Default Global Session Policy has a Priority 1 non-default rule limiting session lifetime to 18 hours",
+   "scope": "Prowler 5.47.0 check signon_global_session_lifetime_18h (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.signon_global_session_policy_network_zone_enforced",
+   "title": "Default Global Session Policy applies a Network Zone condition aligned with the Access Control Policy",
+   "scope": "Prowler 5.47.0 check signon_global_session_policy_network_zone_enforced (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.systemlog_streaming_enabled",
+   "title": "Okta off-loads audit records to a central log server via Log Streaming",
+   "scope": "Prowler 5.47.0 check systemlog_streaming_enabled (Okta systemlog, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.okta.user_inactivity_automation_35d_enabled",
+   "title": "Okta automation suspends or deactivates users after 35 days of inactivity",
+   "scope": "Prowler 5.47.0 check user_inactivity_automation_35d_enabled (Okta user, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  }
+ ]
 }

package/collector/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@sagentix-inc/evidence-collector",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "type": "module"
 }

package/collector/src/agent.js

@@ -11,6 +11,8 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { CONNECT_PATH, EXIT_UPDATE, MODE_ENV, checkin, collectorInfo, detectRunner } from "./channel.js";
 import { loadConfig } from "./config.js";
+import { vaultBridge } from "./deliveries.js";
+import { keyHolderFor } from "./vault.js";
 import { signBody } from "./keys.js";
 export const PING_MS = 50_000;
 export const CHECKIN_MS = 6 * 3600_000;
@@ -111,6 +113,38 @@ export class AgentSession {
     /** Stops a run in progress (the agent is exiting). */
     stop() { this.busy?.child.kill(); }
 }
+export const TEST_TIMEOUT_MS = 5 * 60_000;
+/** A connector test asked from sos-app: this file's own cli.ts, `run --dry-run` of its sources, no check-in, no report. */
+export function testRun(configPath, env, sources) {
+    return new Promise((done) => {
+        const child = spawn(process.execPath, [...process.execArgv, CLI_PATH, "run", "--config", configPath, "--dry-run", ...sources.flatMap((x) => ["--source", x])], { cwd: dirname(configPath), env: { ...env, SAGENTIX_CONNECTOR_TEST: "1" }, stdio: ["ignore", "pipe", "pipe"] });
+        let out = "", err = "", timedOut = false;
+        child.stdout.on("data", (d) => { if (out.length < 32 * 1024 * 1024)
+            out += d; });
+        child.stderr.on("data", (d) => { if (err.length < 256 * 1024)
+            err += d; });
+        const timer = setTimeout(() => { timedOut = true; child.kill("SIGTERM"); }, TEST_TIMEOUT_MS);
+        child.once("error", (e) => { clearTimeout(timer); done({ exit: null, passed: 0, failed: 0, skipped: 0, errors: [String(e.message)] }); });
+        child.once("exit", (code) => {
+            clearTimeout(timer);
+            done({ ...summaryOf(out), exit: code, errors: err.split(/\r?\n/).filter((l) => /^error in source |^collector error|vault/.test(l)), ...(timedOut ? { timedOut } : {}) });
+        });
+    });
+}
+/** The pass, fail and skipped counts a dry run prints (one push, or several). */
+export function summaryOf(stdout) {
+    const z = { passed: 0, failed: 0, skipped: 0 };
+    try {
+        const j = JSON.parse(stdout);
+        for (const sm of j.summary ? [j.summary] : (j.pushes ?? []).map((x) => x.summary)) {
+            z.passed += sm?.passed ?? 0;
+            z.failed += sm?.failed ?? 0;
+            z.skipped += sm?.skipped ?? 0;
+        }
+    }
+    catch { /* nothing printed: the errors say why */ }
+    return z;
+}
 /** What a run started from sos-app executes (exported for the tests). */
 export function runCommand(configPath, exists, platform = process.platform) {
     const dir = dirname(resolve(configPath));
@@ -201,9 +235,12 @@ export async function agent(argv, deps, io = realAgentIo()) {
     // A signed update written by a check-in ends the agent with 75 once no run is going: Docker's wrapper loop restarts
     // the container on the new digest, a service manager restarts the script, which checks out the ref on start.
     let restartPending = false;
+    const dir = dirname(configPath);
+    const vault = vaultBridge({ configPath, keyId, now: deps.now, log, test: (sources) => testRun(configPath, deps.env, sources),
+        holder: deps.vaultKey?.(dir, keyId) ?? keyHolderFor(dir, keyId, { env: deps.env, platform: process.platform, runner: detectRunner(deps.env) }) });
     const doCheckin = async () => {
         try {
-            const out = await checkin(channel, { write: true, log });
+            const out = await checkin(channel, { write: true, log, vault });
             if (out.wrote && !restartPending) {
                 restartPending = true;
                 log(`agent: exiting with ${EXIT_UPDATE} to restart on the update${session.running ? ` once run ${session.running} ends` : ""}`);

package/collector/src/channel.js

@@ -2,7 +2,8 @@
 // collector is (version, commit, runner), the signed POST every message uses, and the check-in that may name a
 // signed update. Every connection goes out; nothing here listens, and nothing the server answers can make the
 // collector run a command or change a configuration. The most it can do is have `sagentix-collector.ref` (or
-// `.image`) written beside the config, which the generated script reads on its next start.
+// `.image`) written beside the config, which the generated script reads on its next start, and deliver values to
+// the vault for the names the config already lists (src/deliveries.ts: a secret only sealed for this collector).
 import { spawnSync } from "node:child_process";
 import { chmodSync, existsSync, writeFileSync } from "node:fs";
 import { arch, platform, release } from "node:os";
@@ -12,6 +13,7 @@ import { fileURLToPath } from "node:url";
 import { signBody } from "./keys.js";
 import { COLLECTOR_VERSION } from "./payload.js";
 import { RELEASE_PUBLIC_KEYS } from "./release_keys.js";
+import { ack } from "./deliveries.js";
 export const CHECKIN_PATH = "/api/collect/checkin";
 export const REPORT_PATH = "/api/collect/report";
 export const CONNECT_PATH = "/api/collect/connect";
@@ -133,9 +135,17 @@ function targetOf(v) {
 export async function checkin(c, o) {
     const warnings = [];
     const warn = (s) => { warnings.push(s); o.log(`warning: check-in: ${s}`); };
+    // The vault's names, kinds, dates and sealing key (section 8): never a value.
+    let vault;
+    try {
+        vault = o.vault?.summary();
+    }
+    catch (e) {
+        warn(`the vault summary failed: ${String(e?.message ?? e)}`);
+    }
     const body = new TextEncoder().encode(JSON.stringify({
         format: "sagentix-checkin/1", issuedAt: c.now().toISOString(), collector: collectorInfo(c.env),
-        runner: c.runner, mode: c.mode, os: osInfo(), node: process.version,
+        runner: c.runner, mode: c.mode, os: osInfo(), node: process.version, ...(vault ? { vault } : {}),
     }));
     let res;
     try {
@@ -157,6 +167,17 @@ export async function checkin(c, o) {
         warn("the answer is not JSON");
         return { action: "failed", warnings };
     }
+    // Values sent to the vault from sos-app (section 8), whatever the update answer. A dry run applies nothing.
+    if (o.vault && o.write && Array.isArray(a.deliveries) && a.deliveries.length) {
+        try {
+            const results = await o.vault.apply(a.deliveries, { agent: c.mode === "agent" });
+            if (results.length)
+                await ack(c, results, o.vault.summary(), o.log);
+        }
+        catch (e) {
+            warn(`the deliveries failed: ${String(e?.message ?? e)}`);
+        }
+    }
     const reason = typeof a.reason === "string" ? a.reason.slice(0, 500) : "";
     switch (a.action) {
         case "none": return { action: "none", warnings };

package/collector/src/cli.js

@@ -31,8 +31,12 @@ import { CLASSES } from "./v1/rules.js";
 import { EXIT_UPDATE, checkin, detectRunner, modeOf } from "./channel.js";
 import { RunRecorder, buildReport, deliverReport } from "./report.js";
 import { agent } from "./agent.js";
+import { VAULT_FILE, keyHolderFor, runEnv } from "./vault.js";
+import { credentialsIn, settingsOf, vaultBridge } from "./deliveries.js";
 export const COLLECT_PATH = "/api/collect";
 export const KEY_ENV = "SAGENTIX_COLLECTOR_KEY";
+/** Set by the agent on a connector test asked from sos-app (a dry run of one connector). */
+export const TEST_ENV = "SAGENTIX_CONNECTOR_TEST";
 /** `update` (75) is the agent's only: it wrote a signed update and exits so it is restarted on it. */
 export const EXIT = { ok: 0, error: 1, usage: 2, nothing: 3, refused: 4, update: EXIT_UPDATE };
 export function defaultDeps() {
@@ -215,10 +219,39 @@ export async function run(argv, deps) {
     const channel = pem && keyId
         ? { origin: new URL(url).origin, keyId, pem, fetch: deps.channel ?? deps.fetch, dir, runner, mode, env: deps.env, now: deps.now }
         : undefined;
-    if (channel)
-        rec.note("checkin", (await checkin(channel, { write: !dry, log: deps.err })).warnings);
+    // A connector test asked from sos-app runs that connector dry: no check-in, and no run report, so the last real run's
+    // report beside the config stays what sos-app shows.
+    const connectorTest = dry && deps.env[TEST_ENV] === "1";
+    if (connectorTest) { /* neither */ }
+    else if (channel) {
+        const vault = configPath && keyId ? vaultBridge({ configPath: resolve(configPath), keyId, now: deps.now, log: deps.err,
+            holder: deps.vaultKey?.(dir, keyId) ?? keyHolderFor(dir, keyId, { env: deps.env, platform: process.platform, runner }) }) : undefined;
+        rec.note("checkin", (await checkin(channel, { write: !dry, log: deps.err, vault })).warnings);
+    }
     else
         deps.err("check-in skipped: a dry run without a key cannot sign one.");
+    // The connectors' secrets and settings, set in sos-app and sealed for this collector (src/vault.ts), when the run has a config and a key id.
+    // A vault that cannot be opened is a warning: the sources that need its values fail on their own, the run goes on.
+    let env = deps.env, cleanup = () => { }, vaultSecrets = [];
+    if (configPath && keyId) {
+        try {
+            const creds = credentialsIn(resolve(configPath));
+            const r = runEnv(dir, deps.vaultKey?.(dir, keyId) ?? keyHolderFor(dir, keyId, { env: deps.env, platform: process.platform, runner }), deps.env, (name) => settingsOf(creds, name));
+            ({ env, cleanup } = r);
+            vaultSecrets = r.secrets;
+            if (r.used.length)
+                deps.err(`vault: ${r.used.length} value(s) from ${VAULT_FILE}`);
+            for (const w of r.warnings)
+                deps.err(`warning: vault: ${w}`);
+            if (r.warnings.length)
+                rec.note("vault", r.warnings);
+        }
+        catch (e) {
+            const w = `the vault could not be opened: ${String(e?.message ?? e)}`;
+            deps.err(w);
+            rec.note("vault", [w]);
+        }
+    }
     let code;
     try {
         code = await collect();
@@ -227,7 +260,13 @@ export async function run(argv, deps) {
         deps.err(`collector error: ${String(e?.message ?? e)}`);
         code = EXIT.error;
     }
-    await deliverReport(buildReport(rec, { now: deps.now(), exitCode: code, runner, mode, env: deps.env }), { dry, channel, dir, log: deps.err });
+    finally {
+        cleanup();
+    }
+    // The report is scrubbed of every value in the run's environment, the vault's included.
+    if (connectorTest)
+        return code;
+    await deliverReport(buildReport(rec, { now: deps.now(), exitCode: code, runner, mode, env, secrets: vaultSecrets }), { dry, channel, dir, log: deps.err });
     return code;
     async function collect() {
         // Run every chosen source inside a guard, then keep only what the server will accept. A source that throws gives
@@ -236,7 +275,7 @@ export async function run(argv, deps) {
         const raw = [];
         const failed = [];
         for (const s of chosen) {
-            const { value, error, report } = await rec.source(s.name, () => s.run({ opts: values, env: deps.env, clients: deps.clients, now, warn: deps.err }));
+            const { value, error, report } = await rec.source(s.name, () => s.run({ opts: values, env, clients: deps.clients, now, warn: deps.err }));
             let got;
             if (error !== undefined || !Array.isArray(value)) {
                 const message = error !== undefined ? String(error?.message ?? error) : "the source returned no list of results";

package/collector/src/config.js

@@ -28,6 +28,24 @@ export const CONFIG_SCHEMA = {
         out: { type: "string", minLength: 1, description: "Also write the signed payload to this file." },
         dryRun: { type: "boolean", description: "Print the payload and send nothing." },
         catalog: { type: "string", minLength: 1, description: "The check catalogue directory." },
+        credentials: {
+            type: "object",
+            description: "Per connector, the names of what it reads (sos-app writes them; sos-app sends a sealed value only for a name listed here). Names only, never a value.",
+            additionalProperties: {
+                type: "object",
+                additionalProperties: false,
+                required: ["sources"],
+                properties: {
+                    sources: { type: "array", items: { type: "string" } },
+                    secrets: { type: "array", items: { type: "string", pattern: "^[A-Z][A-Z0-9_]{0,99}$" } },
+                    files: { type: "array", items: { type: "string", pattern: "^[A-Z][A-Z0-9_]{0,99}$" } },
+                    settings: { type: "array", items: { type: "string", pattern: "^[A-Z][A-Z0-9_]{0,99}$" } },
+                    optional: { type: "object", additionalProperties: { type: "string" } },
+                    instead: { type: "object", additionalProperties: { type: "string" } },
+                    signIn: { type: "boolean" },
+                },
+            },
+        },
         sources: {
             type: "object",
             minProperties: 1,