ownerlens 0.1.5 → 0.1.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +25 -26
- package/bin/ownerlens.js +10 -4
- package/contracts/azure/snapshot.v0.4.schema.json +715 -0
- package/contracts/entra/snapshot.v0.4.schema.json +703 -0
- package/dist/assets/index-BGYxOSO4.css +1 -0
- package/dist/assets/index-D7COTwVU.js +11 -0
- package/dist/index.html +2 -2
- package/migrations/001_initial.sql +325 -0
- package/package.json +11 -2
- package/src/components/azure/AzureComponent.test.tsx +286 -8
- package/src/components/azure/AzureComponent.tsx +117 -17
- package/src/components/azure/AzureRbacComponent.tsx +16 -4
- package/src/components/azure/ClosableAzureTab.tsx +1 -1
- package/src/components/azure/CsvSelectionActionBar.tsx +4 -1
- package/src/components/azure/EntraPermissionsComponent.tsx +1 -8
- package/src/components/azure/ManagedIdentityComponent.test.tsx +1 -1
- package/src/components/azure/ManagedIdentityComponent.tsx +17 -24
- package/src/components/azure/OwnershipEvidenceComponent.tsx +343 -0
- package/src/components/azure/RemediationPackageComponent.tsx +19 -9
- package/src/components/azure/ResourceGroupComponent.tsx +124 -65
- package/src/components/azure/ServicePrincipalComponent.test.tsx +1 -1
- package/src/components/azure/ServicePrincipalComponent.tsx +17 -24
- package/src/components/azure/ServicePrincipalFieldRenderers.tsx +84 -17
- package/src/components/azure/api.ts +84 -10
- package/src/components/azure/azureReportConfig.ts +11 -3
- package/src/components/azure/ztaRelatedObjects.tsx +2 -2
- package/src/core/azure/azureRbac.ts +3 -2
- package/src/core/azure/entra/managedIdentity.ts +2 -1
- package/src/core/azure/entra/servicePrincipal.ts +10 -2
- package/src/core/azure/entra/types.ts +3 -5
- package/src/core/azure/resources.ts +10 -28
- package/src/core/collectionControls.ts +1 -1
- package/src/core/config.ts +7 -1
- package/src/core/ownership/OwnershipTarget.ts +2 -2
- package/src/core/ownership/ownerCandidateRanking.ts +40 -0
- package/src/core/ownership/types.ts +68 -0
- package/src/core/runtime/localSnapshotFiles.ts +1 -3
- package/src/core/runtime/remediation.ts +2 -2
- package/src/core/runtime/rest.ts +1 -1
- package/src/core/runtime/snapshotContractValidator.test.ts +232 -0
- package/src/core/runtime/snapshotContractValidator.ts +70 -0
- package/src/core/runtime/snapshotImportRegistry.ts +1 -16
- package/src/db/migrate.test.ts +59 -0
- package/src/db/migrate.ts +105 -0
- package/src/lib/utils.ts +0 -17
- package/src/providers/azure/inputTransferObject/generated/AzureSnapshot.ts +131 -0
- package/src/providers/azure/inputTransferObject/generated/EntraSnapshot.ts +139 -0
- package/src/providers/azure/ownership/azureActivityOwnershipEvidence.test.ts +24 -0
- package/src/providers/azure/ownership/azureActivityOwnershipEvidence.ts +2 -2
- package/src/providers/azure/ownership/azureOwnershipTypes.ts +4 -5
- package/src/providers/azure/ownership/buildAzureOwnershipReport.test.ts +4 -4
- package/src/providers/azure/ownership/buildAzureOwnershipReport.ts +2 -2
- package/src/providers/azure/ownership/buildAzureOwnershipTargets.test.ts +1 -1
- package/src/providers/azure/ownership/buildAzureOwnershipTargets.ts +1 -1
- package/src/providers/azure/ownership/principalOwnerProjection.test.ts +243 -0
- package/src/providers/azure/ownership/principalOwnerProjection.ts +260 -0
- package/src/providers/azure/runtime/ExportService.ts +66 -0
- package/src/providers/azure/runtime/LocalReportRuntime.duckdb.test.ts +166 -33
- package/src/providers/azure/runtime/LocalReportRuntime.test.ts +185 -68
- package/src/providers/azure/runtime/LocalReportRuntime.ts +198 -19
- package/src/providers/azure/runtime/enrichment/azureIdentityEnrichment.ts +114 -28
- package/src/providers/azure/runtime/entra/EntraCollectionQueryService.ts +18 -199
- package/src/providers/azure/runtime/entra/LocalEntraReportRuntime.ts +16 -11
- package/src/providers/azure/runtime/entra/appRoleAssignmentsTable.ts +1 -1
- package/src/providers/azure/runtime/entra/applicationsTable.ts +1 -1
- package/src/providers/azure/runtime/entra/entraServicePrincipalMapper.ts +5 -7
- package/src/providers/azure/runtime/entra/groupMembersTable.ts +65 -0
- package/src/providers/azure/runtime/entra/normalizeEntraSnapshot.ts +14 -0
- package/src/providers/azure/runtime/entra/oauth2PermissionGrantsTable.ts +2 -2
- package/src/providers/azure/runtime/entra/servicePrincipalsTable.ts +1 -11
- package/src/providers/azure/runtime/entra/snapshotMetadataTable.ts +3 -2
- package/src/providers/azure/runtime/entra/snapshotStore.ts +11 -5
- package/src/providers/azure/runtime/localReportRuntimeRest.ts +31 -1
- package/src/providers/azure/runtime/ownership/OwnershipEvidenceQueryService.test.ts +407 -0
- package/src/providers/azure/runtime/ownership/OwnershipEvidenceQueryService.ts +211 -0
- package/src/providers/azure/runtime/ownership/localReportRuntimeRest.ts +71 -0
- package/src/providers/azure/runtime/resources/AzureResourcesCollectionQueryService.ts +117 -33
- package/src/providers/azure/runtime/resources/LocalAzureResourcesReportRuntime.ts +12 -12
- package/src/providers/azure/runtime/resources/localReportRuntimeRest.ts +16 -42
- package/src/providers/azure/runtime/resources/normalizeAzureSnapshot.ts +11 -0
- package/src/providers/azure/runtime/resources/resourceGroupOwnership.test.ts +138 -0
- package/src/providers/azure/runtime/resources/resourceGroupOwnership.ts +168 -4
- package/src/providers/azure/runtime/resources/snapshotMetadataTable.ts +1 -1
- package/src/providers/azure/runtime/resources/snapshotStore.ts +4 -4
- package/src/providers/azure/runtime/resources/tables.ts +22 -20
- package/src/providers/azure/runtime/runtimeSqlSchema.ts +2 -357
- package/src/providers/azure/runtime/zta/ZeroTrustAssessmentQueryService.ts +0 -2
- package/src/report/applyCollectionControls.ts +4 -4
- package/src/report/components/SelectionActionBar.tsx +1 -1
- package/src/report/components/reportTableControls.tsx +1 -7
- package/src/report/components/ui/card.tsx +0 -16
- package/src/report/ownerManualPrecheck.ts +2 -2
- package/src/report/reportTypes.ts +1 -1
- package/src/report/reportValueRenderers.tsx +1 -1
- package/src/report/types.ts +1 -1
- package/tools/README.md +5 -3
- package/tools/collect-scripts.test.ts +1 -0
- package/tools/prepare-entra-snapshot.Tests.ps1 +125 -0
- package/tools/prepare-entra-snapshot.ps1 +219 -217
- package/tools/prepare-entra-snapshot.test.ts +39 -2
- package/tools/prepare-resource-snapshot.ps1 +1 -0
- package/tools/run-pester-tests.ps1 +30 -0
- package/tools/utils.ps1 +270 -0
- package/vite.config.ts +1 -1
- package/dist/assets/index-BafY0w2M.js +0 -12
- package/dist/assets/index-nEsiXqy-.css +0 -1
- package/src/core/runtime/remediationSqlSchema.ts +0 -26
- package/src/providers/azure/inputTransferObject/entra/EntraApplication.ts +0 -27
- package/src/providers/azure/inputTransferObject/entra/EntraOAuth2PermissionGrant.ts +0 -8
- package/src/providers/azure/inputTransferObject/entra/EntraServicePrincipal.ts +0 -43
- package/src/providers/azure/inputTransferObject/entra/EntraSnapshot.ts +0 -13
- package/src/providers/azure/inputTransferObject/entra/EntraSnapshotMeta.ts +0 -12
- package/src/providers/azure/inputTransferObject/entra/InputEntraAppRoleAssignment.ts +0 -10
- package/src/providers/azure/inputTransferObject/resources/AzureActivityLog.ts +0 -1
- package/src/providers/azure/inputTransferObject/resources/AzureResource.ts +0 -1
- package/src/providers/azure/inputTransferObject/resources/AzureResourceGroup.ts +0 -1
- package/src/providers/azure/inputTransferObject/resources/AzureRoleAssignment.ts +0 -1
- package/src/providers/azure/inputTransferObject/resources/AzureSnapshot.ts +0 -1
- package/src/providers/azure/inputTransferObject/resources/AzureSnapshotMeta.ts +0 -1
- package/src/providers/azure/inputTransferObject/resources/AzureSubscription.ts +0 -1
- package/src/providers/azure/inputTransferObject/resources/AzureUserAssignedManagedIdentity.ts +0 -1
package/README.md
CHANGED
|
@@ -12,14 +12,12 @@ The application is intended to:
|
|
|
12
12
|
|
|
13
13
|
👉 export the resolved ownership results for Identity and Access Management (IAM) systems,
|
|
14
14
|
|
|
15
|
-
👉 support remediation ownership for Zero TrustAssessment (ZTA) findings.
|
|
16
|
-
|
|
17
15
|
OwnerLens helps split actionable remediations by the
|
|
18
16
|
most likely accountable owners and provides traceable evidence for why each
|
|
19
17
|
remediation was assigned.
|
|
20
18
|
|
|
21
|
-
The app runs locally with Vite. Snapshot
|
|
22
|
-
from the
|
|
19
|
+
The app runs locally with Vite. Snapshot files exported by OwnerLens collector
|
|
20
|
+
commands stay on your machine and are read from the local `data` directory.
|
|
23
21
|
```mermaid
|
|
24
22
|
|
|
25
23
|
flowchart TD
|
|
@@ -29,11 +27,8 @@ flowchart TD
|
|
|
29
27
|
|
|
30
28
|
C["3. Export to IAM / Recertification<br/><br/>CSV / JSON<br/>Owner mapping<br/>Gap report<br/>Input for SailPoint / Saviynt / Omada / Entra Governance"]
|
|
31
29
|
|
|
32
|
-
D["4. Information Enrichment with ZTA Report<br/>"]
|
|
33
|
-
E["5. Actionable remediations<br/>"]
|
|
34
30
|
|
|
35
31
|
A --> B --> C
|
|
36
|
-
B --> D --> E
|
|
37
32
|
```
|
|
38
33
|
## Features
|
|
39
34
|
|
|
@@ -49,10 +44,6 @@ flowchart TD
|
|
|
49
44
|
|
|
50
45
|
➡️ Export resolved ownership results to CSV and JSON files for resource groups, service principals, and managed identities.
|
|
51
46
|
|
|
52
|
-
➡️ Enrich ZTA Assessment findings with ownership context, split actionable
|
|
53
|
-
remediations across accountable teams, and trace remediation assignments back
|
|
54
|
-
to ownership evidence.
|
|
55
|
-
|
|
56
47
|
➡️ Switch between snapshot files found in `./data`.
|
|
57
48
|
|
|
58
49
|
## Requirements
|
|
@@ -62,12 +53,17 @@ flowchart TD
|
|
|
62
53
|
- PowerShell 7 or Windows PowerShell for snapshot export scripts
|
|
63
54
|
- Azure PowerShell and Microsoft Graph PowerShell modules when exporting data
|
|
64
55
|
|
|
65
|
-
##
|
|
56
|
+
## Run With npx
|
|
66
57
|
|
|
67
58
|
```bash
|
|
68
59
|
npx ownerlens start
|
|
69
60
|
```
|
|
70
61
|
|
|
62
|
+
`npx ownerlens start` builds the app, starts Vite preview on `127.0.0.1`,
|
|
63
|
+
creates `./data` in the directory where you run the command, and reads snapshot
|
|
64
|
+
files from that directory. Open the Vite URL printed by the command, usually
|
|
65
|
+
`http://127.0.0.1:4173`.
|
|
66
|
+
|
|
71
67
|
## Create Snapshot Files
|
|
72
68
|
|
|
73
69
|
OwnerLens expects these files by default:
|
|
@@ -90,43 +86,46 @@ Connect-MgGraph -TenantId "<tenant-id>" -Scopes "Application.Read.All","Group.Re
|
|
|
90
86
|
|
|
91
87
|
Create the resource snapshot:
|
|
92
88
|
|
|
93
|
-
```
|
|
94
|
-
|
|
89
|
+
```bash
|
|
90
|
+
npx ownerlens collect:azure -SubscriptionIds "sub-id-1,sub-id-2"
|
|
95
91
|
```
|
|
96
92
|
|
|
97
93
|
Create the Entra snapshot:
|
|
98
94
|
|
|
99
|
-
```
|
|
100
|
-
|
|
95
|
+
```bash
|
|
96
|
+
npx ownerlens collect:entra -TenantId "<tenant-id>"
|
|
101
97
|
```
|
|
102
98
|
|
|
103
99
|
More script options are documented in [tools/README.md](tools/README.md).
|
|
104
100
|
|
|
105
|
-
You can also run the collectors through npm, which is the same entrypoint that
|
|
106
|
-
will be used after publishing the package:
|
|
107
|
-
|
|
108
|
-
```bash
|
|
109
|
-
npm run collect:azure -- -SubscriptionIds "sub-id-1,sub-id-2"
|
|
110
|
-
npm run collect:entra -- -TenantId "<tenant-id>"
|
|
111
|
-
```
|
|
112
|
-
|
|
113
101
|
Snapshot files can contain tenant, subscription, resource, identity, group, and
|
|
114
102
|
activity-log metadata. Review them before sharing. Files matching
|
|
115
103
|
`data/*snapshot.json` are ignored by git.
|
|
116
104
|
|
|
117
|
-
##
|
|
105
|
+
## Local Development
|
|
106
|
+
|
|
107
|
+
Clone the repository, install dependencies, then run the development server:
|
|
118
108
|
|
|
119
109
|
```bash
|
|
110
|
+
npm install
|
|
120
111
|
npm run dev
|
|
121
112
|
```
|
|
122
113
|
|
|
123
114
|
Open the Vite URL printed by the command, usually `http://127.0.0.1:5173`.
|
|
124
115
|
|
|
116
|
+
You can also exercise the published CLI entrypoint from a repository checkout:
|
|
117
|
+
|
|
118
|
+
```bash
|
|
119
|
+
npm run start
|
|
120
|
+
npm run preview
|
|
121
|
+
npm run collect:azure -- -SubscriptionIds "sub-id-1,sub-id-2"
|
|
122
|
+
npm run collect:entra -- -TenantId "<tenant-id>"
|
|
123
|
+
```
|
|
124
|
+
|
|
125
125
|
For a production build:
|
|
126
126
|
|
|
127
127
|
```bash
|
|
128
128
|
npm run build
|
|
129
|
-
npm run preview
|
|
130
129
|
```
|
|
131
130
|
|
|
132
131
|
## Configure Ownership Rules
|
package/bin/ownerlens.js
CHANGED
|
@@ -7,10 +7,11 @@ import { dirname, join } from "node:path";
|
|
|
7
7
|
import { fileURLToPath } from "node:url";
|
|
8
8
|
|
|
9
9
|
const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
|
|
10
|
+
const invocationRoot = process.cwd();
|
|
10
11
|
const require = createRequire(import.meta.url);
|
|
11
12
|
const [, , command = "help", ...args] = process.argv;
|
|
12
13
|
|
|
13
|
-
const dataDir = ensureDataDirectory();
|
|
14
|
+
const dataDir = ensureDataDirectory(invocationRoot);
|
|
14
15
|
printDataDirectorySummary(dataDir);
|
|
15
16
|
|
|
16
17
|
const commands = new Map([
|
|
@@ -86,6 +87,7 @@ function runVite(args) {
|
|
|
86
87
|
function runViteSync(args) {
|
|
87
88
|
return spawnSync(process.execPath, [resolveViteScript(), ...args], {
|
|
88
89
|
cwd: packageRoot,
|
|
90
|
+
env: viteEnv(),
|
|
89
91
|
stdio: "inherit"
|
|
90
92
|
});
|
|
91
93
|
}
|
|
@@ -95,7 +97,7 @@ function resolveViteScript() {
|
|
|
95
97
|
}
|
|
96
98
|
|
|
97
99
|
function runNodeScript(args) {
|
|
98
|
-
const child = spawn(process.execPath, args, { cwd: packageRoot, stdio: "inherit" });
|
|
100
|
+
const child = spawn(process.execPath, args, { cwd: packageRoot, env: viteEnv(), stdio: "inherit" });
|
|
99
101
|
child.on("exit", (code, signal) => {
|
|
100
102
|
if (signal) {
|
|
101
103
|
process.kill(process.pid, signal);
|
|
@@ -108,6 +110,10 @@ function runNodeScript(args) {
|
|
|
108
110
|
return child;
|
|
109
111
|
}
|
|
110
112
|
|
|
113
|
+
function viteEnv() {
|
|
114
|
+
return { ...process.env, OWNERLENS_DATA_DIR: dataDir };
|
|
115
|
+
}
|
|
116
|
+
|
|
111
117
|
function resolvePowerShell() {
|
|
112
118
|
if (commandExists("pwsh")) {
|
|
113
119
|
return "pwsh";
|
|
@@ -129,8 +135,8 @@ function commandExists(name) {
|
|
|
129
135
|
return result.status === 0;
|
|
130
136
|
}
|
|
131
137
|
|
|
132
|
-
function ensureDataDirectory() {
|
|
133
|
-
const dataDir = join(
|
|
138
|
+
function ensureDataDirectory(rootDir) {
|
|
139
|
+
const dataDir = join(rootDir, "data");
|
|
134
140
|
|
|
135
141
|
try {
|
|
136
142
|
if (statSync(dataDir, { throwIfNoEntry: false })?.isDirectory()) {
|