ownerlens 0.1.5 → 0.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (121) hide show
  1. package/README.md +25 -26
  2. package/bin/ownerlens.js +10 -4
  3. package/contracts/azure/snapshot.v0.4.schema.json +715 -0
  4. package/contracts/entra/snapshot.v0.4.schema.json +703 -0
  5. package/dist/assets/index-BGYxOSO4.css +1 -0
  6. package/dist/assets/index-D7COTwVU.js +11 -0
  7. package/dist/index.html +2 -2
  8. package/migrations/001_initial.sql +325 -0
  9. package/package.json +11 -2
  10. package/src/components/azure/AzureComponent.test.tsx +286 -8
  11. package/src/components/azure/AzureComponent.tsx +117 -17
  12. package/src/components/azure/AzureRbacComponent.tsx +16 -4
  13. package/src/components/azure/ClosableAzureTab.tsx +1 -1
  14. package/src/components/azure/CsvSelectionActionBar.tsx +4 -1
  15. package/src/components/azure/EntraPermissionsComponent.tsx +1 -8
  16. package/src/components/azure/ManagedIdentityComponent.test.tsx +1 -1
  17. package/src/components/azure/ManagedIdentityComponent.tsx +17 -24
  18. package/src/components/azure/OwnershipEvidenceComponent.tsx +343 -0
  19. package/src/components/azure/RemediationPackageComponent.tsx +19 -9
  20. package/src/components/azure/ResourceGroupComponent.tsx +124 -65
  21. package/src/components/azure/ServicePrincipalComponent.test.tsx +1 -1
  22. package/src/components/azure/ServicePrincipalComponent.tsx +17 -24
  23. package/src/components/azure/ServicePrincipalFieldRenderers.tsx +84 -17
  24. package/src/components/azure/api.ts +84 -10
  25. package/src/components/azure/azureReportConfig.ts +11 -3
  26. package/src/components/azure/ztaRelatedObjects.tsx +2 -2
  27. package/src/core/azure/azureRbac.ts +3 -2
  28. package/src/core/azure/entra/managedIdentity.ts +2 -1
  29. package/src/core/azure/entra/servicePrincipal.ts +10 -2
  30. package/src/core/azure/entra/types.ts +3 -5
  31. package/src/core/azure/resources.ts +10 -28
  32. package/src/core/collectionControls.ts +1 -1
  33. package/src/core/config.ts +7 -1
  34. package/src/core/ownership/OwnershipTarget.ts +2 -2
  35. package/src/core/ownership/ownerCandidateRanking.ts +40 -0
  36. package/src/core/ownership/types.ts +68 -0
  37. package/src/core/runtime/localSnapshotFiles.ts +1 -3
  38. package/src/core/runtime/remediation.ts +2 -2
  39. package/src/core/runtime/rest.ts +1 -1
  40. package/src/core/runtime/snapshotContractValidator.test.ts +232 -0
  41. package/src/core/runtime/snapshotContractValidator.ts +70 -0
  42. package/src/core/runtime/snapshotImportRegistry.ts +1 -16
  43. package/src/db/migrate.test.ts +59 -0
  44. package/src/db/migrate.ts +105 -0
  45. package/src/lib/utils.ts +0 -17
  46. package/src/providers/azure/inputTransferObject/generated/AzureSnapshot.ts +131 -0
  47. package/src/providers/azure/inputTransferObject/generated/EntraSnapshot.ts +139 -0
  48. package/src/providers/azure/ownership/azureActivityOwnershipEvidence.test.ts +24 -0
  49. package/src/providers/azure/ownership/azureActivityOwnershipEvidence.ts +2 -2
  50. package/src/providers/azure/ownership/azureOwnershipTypes.ts +4 -5
  51. package/src/providers/azure/ownership/buildAzureOwnershipReport.test.ts +4 -4
  52. package/src/providers/azure/ownership/buildAzureOwnershipReport.ts +2 -2
  53. package/src/providers/azure/ownership/buildAzureOwnershipTargets.test.ts +1 -1
  54. package/src/providers/azure/ownership/buildAzureOwnershipTargets.ts +1 -1
  55. package/src/providers/azure/ownership/principalOwnerProjection.test.ts +243 -0
  56. package/src/providers/azure/ownership/principalOwnerProjection.ts +260 -0
  57. package/src/providers/azure/runtime/ExportService.ts +66 -0
  58. package/src/providers/azure/runtime/LocalReportRuntime.duckdb.test.ts +166 -33
  59. package/src/providers/azure/runtime/LocalReportRuntime.test.ts +185 -68
  60. package/src/providers/azure/runtime/LocalReportRuntime.ts +198 -19
  61. package/src/providers/azure/runtime/enrichment/azureIdentityEnrichment.ts +114 -28
  62. package/src/providers/azure/runtime/entra/EntraCollectionQueryService.ts +18 -199
  63. package/src/providers/azure/runtime/entra/LocalEntraReportRuntime.ts +16 -11
  64. package/src/providers/azure/runtime/entra/appRoleAssignmentsTable.ts +1 -1
  65. package/src/providers/azure/runtime/entra/applicationsTable.ts +1 -1
  66. package/src/providers/azure/runtime/entra/entraServicePrincipalMapper.ts +5 -7
  67. package/src/providers/azure/runtime/entra/groupMembersTable.ts +65 -0
  68. package/src/providers/azure/runtime/entra/normalizeEntraSnapshot.ts +14 -0
  69. package/src/providers/azure/runtime/entra/oauth2PermissionGrantsTable.ts +2 -2
  70. package/src/providers/azure/runtime/entra/servicePrincipalsTable.ts +1 -11
  71. package/src/providers/azure/runtime/entra/snapshotMetadataTable.ts +3 -2
  72. package/src/providers/azure/runtime/entra/snapshotStore.ts +11 -5
  73. package/src/providers/azure/runtime/localReportRuntimeRest.ts +31 -1
  74. package/src/providers/azure/runtime/ownership/OwnershipEvidenceQueryService.test.ts +407 -0
  75. package/src/providers/azure/runtime/ownership/OwnershipEvidenceQueryService.ts +211 -0
  76. package/src/providers/azure/runtime/ownership/localReportRuntimeRest.ts +71 -0
  77. package/src/providers/azure/runtime/resources/AzureResourcesCollectionQueryService.ts +117 -33
  78. package/src/providers/azure/runtime/resources/LocalAzureResourcesReportRuntime.ts +12 -12
  79. package/src/providers/azure/runtime/resources/localReportRuntimeRest.ts +16 -42
  80. package/src/providers/azure/runtime/resources/normalizeAzureSnapshot.ts +11 -0
  81. package/src/providers/azure/runtime/resources/resourceGroupOwnership.test.ts +138 -0
  82. package/src/providers/azure/runtime/resources/resourceGroupOwnership.ts +168 -4
  83. package/src/providers/azure/runtime/resources/snapshotMetadataTable.ts +1 -1
  84. package/src/providers/azure/runtime/resources/snapshotStore.ts +4 -4
  85. package/src/providers/azure/runtime/resources/tables.ts +22 -20
  86. package/src/providers/azure/runtime/runtimeSqlSchema.ts +2 -357
  87. package/src/providers/azure/runtime/zta/ZeroTrustAssessmentQueryService.ts +0 -2
  88. package/src/report/applyCollectionControls.ts +4 -4
  89. package/src/report/components/SelectionActionBar.tsx +1 -1
  90. package/src/report/components/reportTableControls.tsx +1 -7
  91. package/src/report/components/ui/card.tsx +0 -16
  92. package/src/report/ownerManualPrecheck.ts +2 -2
  93. package/src/report/reportTypes.ts +1 -1
  94. package/src/report/reportValueRenderers.tsx +1 -1
  95. package/src/report/types.ts +1 -1
  96. package/tools/README.md +5 -3
  97. package/tools/collect-scripts.test.ts +1 -0
  98. package/tools/prepare-entra-snapshot.Tests.ps1 +125 -0
  99. package/tools/prepare-entra-snapshot.ps1 +219 -217
  100. package/tools/prepare-entra-snapshot.test.ts +39 -2
  101. package/tools/prepare-resource-snapshot.ps1 +1 -0
  102. package/tools/run-pester-tests.ps1 +30 -0
  103. package/tools/utils.ps1 +270 -0
  104. package/vite.config.ts +1 -1
  105. package/dist/assets/index-BafY0w2M.js +0 -12
  106. package/dist/assets/index-nEsiXqy-.css +0 -1
  107. package/src/core/runtime/remediationSqlSchema.ts +0 -26
  108. package/src/providers/azure/inputTransferObject/entra/EntraApplication.ts +0 -27
  109. package/src/providers/azure/inputTransferObject/entra/EntraOAuth2PermissionGrant.ts +0 -8
  110. package/src/providers/azure/inputTransferObject/entra/EntraServicePrincipal.ts +0 -43
  111. package/src/providers/azure/inputTransferObject/entra/EntraSnapshot.ts +0 -13
  112. package/src/providers/azure/inputTransferObject/entra/EntraSnapshotMeta.ts +0 -12
  113. package/src/providers/azure/inputTransferObject/entra/InputEntraAppRoleAssignment.ts +0 -10
  114. package/src/providers/azure/inputTransferObject/resources/AzureActivityLog.ts +0 -1
  115. package/src/providers/azure/inputTransferObject/resources/AzureResource.ts +0 -1
  116. package/src/providers/azure/inputTransferObject/resources/AzureResourceGroup.ts +0 -1
  117. package/src/providers/azure/inputTransferObject/resources/AzureRoleAssignment.ts +0 -1
  118. package/src/providers/azure/inputTransferObject/resources/AzureSnapshot.ts +0 -1
  119. package/src/providers/azure/inputTransferObject/resources/AzureSnapshotMeta.ts +0 -1
  120. package/src/providers/azure/inputTransferObject/resources/AzureSubscription.ts +0 -1
  121. package/src/providers/azure/inputTransferObject/resources/AzureUserAssignedManagedIdentity.ts +0 -1
package/README.md CHANGED
@@ -12,14 +12,12 @@ The application is intended to:
12
12
 
13
13
  👉 export the resolved ownership results for Identity and Access Management (IAM) systems,
14
14
 
15
- 👉 support remediation ownership for Zero TrustAssessment (ZTA) findings.
16
-
17
15
  OwnerLens helps split actionable remediations by the
18
16
  most likely accountable owners and provides traceable evidence for why each
19
17
  remediation was assigned.
20
18
 
21
- The app runs locally with Vite. Snapshot file (exported by ./tools/* scripts) stay on your machine and are read
22
- from the repository `data` directory by the development server.
19
+ The app runs locally with Vite. Snapshot files exported by OwnerLens collector
20
+ commands stay on your machine and are read from the local `data` directory.
23
21
  ```mermaid
24
22
 
25
23
  flowchart TD
@@ -29,11 +27,8 @@ flowchart TD
29
27
 
30
28
  C["3. Export to IAM / Recertification<br/><br/>CSV / JSON<br/>Owner mapping<br/>Gap report<br/>Input for SailPoint / Saviynt / Omada / Entra Governance"]
31
29
 
32
- D["4. Information Enrichment with ZTA Report<br/>"]
33
- E["5. Actionable remediations<br/>"]
34
30
 
35
31
  A --> B --> C
36
- B --> D --> E
37
32
  ```
38
33
  ## Features
39
34
 
@@ -49,10 +44,6 @@ flowchart TD
49
44
 
50
45
  ➡️ Export resolved ownership results to CSV and JSON files for resource groups, service principals, and managed identities.
51
46
 
52
- ➡️ Enrich ZTA Assessment findings with ownership context, split actionable
53
- remediations across accountable teams, and trace remediation assignments back
54
- to ownership evidence.
55
-
56
47
  ➡️ Switch between snapshot files found in `./data`.
57
48
 
58
49
  ## Requirements
@@ -62,12 +53,17 @@ flowchart TD
62
53
  - PowerShell 7 or Windows PowerShell for snapshot export scripts
63
54
  - Azure PowerShell and Microsoft Graph PowerShell modules when exporting data
64
55
 
65
- ## Install
56
+ ## Run With npx
66
57
 
67
58
  ```bash
68
59
  npx ownerlens start
69
60
  ```
70
61
 
62
+ `npx ownerlens start` builds the app, starts Vite preview on `127.0.0.1`,
63
+ creates `./data` in the directory where you run the command, and reads snapshot
64
+ files from that directory. Open the Vite URL printed by the command, usually
65
+ `http://127.0.0.1:4173`.
66
+
71
67
  ## Create Snapshot Files
72
68
 
73
69
  OwnerLens expects these files by default:
@@ -90,43 +86,46 @@ Connect-MgGraph -TenantId "<tenant-id>" -Scopes "Application.Read.All","Group.Re
90
86
 
91
87
  Create the resource snapshot:
92
88
 
93
- ```powershell
94
- .\tools\collect-azure.ps1
89
+ ```bash
90
+ npx ownerlens collect:azure -SubscriptionIds "sub-id-1,sub-id-2"
95
91
  ```
96
92
 
97
93
  Create the Entra snapshot:
98
94
 
99
- ```powershell
100
- .\tools\collect-entra.ps1
95
+ ```bash
96
+ npx ownerlens collect:entra -TenantId "<tenant-id>"
101
97
  ```
102
98
 
103
99
  More script options are documented in [tools/README.md](tools/README.md).
104
100
 
105
- You can also run the collectors through npm, which is the same entrypoint that
106
- will be used after publishing the package:
107
-
108
- ```bash
109
- npm run collect:azure -- -SubscriptionIds "sub-id-1,sub-id-2"
110
- npm run collect:entra -- -TenantId "<tenant-id>"
111
- ```
112
-
113
101
  Snapshot files can contain tenant, subscription, resource, identity, group, and
114
102
  activity-log metadata. Review them before sharing. Files matching
115
103
  `data/*snapshot.json` are ignored by git.
116
104
 
117
- ## Run The App
105
+ ## Local Development
106
+
107
+ Clone the repository, install dependencies, then run the development server:
118
108
 
119
109
  ```bash
110
+ npm install
120
111
  npm run dev
121
112
  ```
122
113
 
123
114
  Open the Vite URL printed by the command, usually `http://127.0.0.1:5173`.
124
115
 
116
+ You can also exercise the published CLI entrypoint from a repository checkout:
117
+
118
+ ```bash
119
+ npm run start
120
+ npm run preview
121
+ npm run collect:azure -- -SubscriptionIds "sub-id-1,sub-id-2"
122
+ npm run collect:entra -- -TenantId "<tenant-id>"
123
+ ```
124
+
125
125
  For a production build:
126
126
 
127
127
  ```bash
128
128
  npm run build
129
- npm run preview
130
129
  ```
131
130
 
132
131
  ## Configure Ownership Rules
package/bin/ownerlens.js CHANGED
@@ -7,10 +7,11 @@ import { dirname, join } from "node:path";
7
7
  import { fileURLToPath } from "node:url";
8
8
 
9
9
  const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
10
+ const invocationRoot = process.cwd();
10
11
  const require = createRequire(import.meta.url);
11
12
  const [, , command = "help", ...args] = process.argv;
12
13
 
13
- const dataDir = ensureDataDirectory();
14
+ const dataDir = ensureDataDirectory(invocationRoot);
14
15
  printDataDirectorySummary(dataDir);
15
16
 
16
17
  const commands = new Map([
@@ -86,6 +87,7 @@ function runVite(args) {
86
87
  function runViteSync(args) {
87
88
  return spawnSync(process.execPath, [resolveViteScript(), ...args], {
88
89
  cwd: packageRoot,
90
+ env: viteEnv(),
89
91
  stdio: "inherit"
90
92
  });
91
93
  }
@@ -95,7 +97,7 @@ function resolveViteScript() {
95
97
  }
96
98
 
97
99
  function runNodeScript(args) {
98
- const child = spawn(process.execPath, args, { cwd: packageRoot, stdio: "inherit" });
100
+ const child = spawn(process.execPath, args, { cwd: packageRoot, env: viteEnv(), stdio: "inherit" });
99
101
  child.on("exit", (code, signal) => {
100
102
  if (signal) {
101
103
  process.kill(process.pid, signal);
@@ -108,6 +110,10 @@ function runNodeScript(args) {
108
110
  return child;
109
111
  }
110
112
 
113
+ function viteEnv() {
114
+ return { ...process.env, OWNERLENS_DATA_DIR: dataDir };
115
+ }
116
+
111
117
  function resolvePowerShell() {
112
118
  if (commandExists("pwsh")) {
113
119
  return "pwsh";
@@ -129,8 +135,8 @@ function commandExists(name) {
129
135
  return result.status === 0;
130
136
  }
131
137
 
132
- function ensureDataDirectory() {
133
- const dataDir = join(packageRoot, "data");
138
+ function ensureDataDirectory(rootDir) {
139
+ const dataDir = join(rootDir, "data");
134
140
 
135
141
  try {
136
142
  if (statSync(dataDir, { throwIfNoEntry: false })?.isDirectory()) {