pptb-standard-sample-tool 1.1.2 → 1.1.5

package/README.md

@@ -56,7 +56,10 @@ This compiles the TypeScript source in `src/` to JavaScript in `dist/`.
 ```
 html-sample/
 ├── src/
-│   └── app.ts           # Main application logic (TypeScript)
+│   ├── app.ts           # Main application logic (TypeScript)
+│   ├── features/        # UI feature modules (terminal, filesystem, etc.)
+│   ├── security/        # Security policy + test suites
+│   └── utils/           # Small reusable helpers
 ├── index.html           # Main HTML file (entry point)
 ├── styles.css           # Stylesheet
 ├── package.json         # Package configuration
@@ -94,6 +97,8 @@ html-sample/
 **Terminal:**
 - Create isolated terminal instances
 - Execute shell commands
+- Run a safe terminal security probe (non-destructive)
+- Run API-specific security test suites with pass/fail JSON reports
 - View command output
 - Close terminal when done
 
@@ -150,6 +155,42 @@ const dataverse: typeof window.dataverseAPI = window.dataverseAPI;
 3. **Rebuild:** Run `npm run build`
 4. **Reload Tool:** In Power Platform Tool Box, close and reopen the tool
 
+## Security Testing Guidance
+
+Use the built-in **Run Security Probe** button in the Terminal section to validate terminal exposure with safe commands only.
+
+What it checks:
+- Terminal can be created and receives command output
+- Basic command execution works
+- Command chaining is possible (risk signal if unrestricted)
+
+What it does not do:
+- No destructive commands
+- No credential, SSH, or private file access attempts
+- No process memory dumping attempts
+
+If the probe succeeds, treat that as a signal to enforce stricter host-side controls in Power Platform Tool Box:
+- Command allow-listing
+- Path allow-listing for filesystem APIs
+- Auditing/logging for terminal command execution
+
+This sample now includes policy guards in [src/security/policy.ts](src/security/policy.ts):
+- `getBlockedCommandReason(...)` / `getBlockedPathReason(...)`: policy decisions
+- `executeCommandWithPolicyGuard(...)` / `readTextWithPolicyGuard(...)`: central enforcement wrappers
+
+Security suites and report formatting live in:
+- [src/security/suites.ts](src/security/suites.ts)
+- [src/security/reporting.ts](src/security/reporting.ts)
+
+It also includes **API-specific Security Suite** buttons plus an **All Suites** runner. Each suite emits a JSON report with per-test `severity` and a rolled-up `highestSeverity`:
+- **Terminal suite:** command allow-list enforcement, multiline/control-character blocking, overlong command blocking, local-data-to-network exfil pattern blocking, burst handling
+- **FileSystem suite:** absolute-path enforcement, traversal blocking, sensitive path blocking, guarded read rejection checks, API surface checks
+- **Events suite:** event API presence and malformed payload resilience checks
+- **Settings suite:** API surface checks, set/get roundtrip checks, optional setAll/getAll validation
+- **Dataverse suite:** method surface checks and read-only runtime checks (WhoAmI/query) when connected
+
+For production PPTB host hardening, apply equivalent checks in the host process (server-side / main-process boundary), not only in tool UI code.
+
 ## API Usage Examples
 
 ### Advanced Utilities

package/dist/app.js

@@ -1,5 +1,7 @@
-"use strict";
 /// <reference types="@pptb/types" />
+import { createFileSystemFeature } from "./features/filesystem.js";
+import { createTerminalFeature } from "./features/terminal.js";
+import { createSecuritySuites } from "./security/suites.js";
 /**
  * HTML Sample Tool for Power Platform Tool Box
  *
@@ -18,6 +20,9 @@ let currentConnection = null;
 let secondaryConnection = null;
 let currentTerminal = null;
 let createdId = null;
+let securitySuites = null;
+let terminalFeature = null;
+let fileSystemFeature = null;
 /**
  * Initialize the application
  */
@@ -28,6 +33,33 @@ async function initialize() {
         await refreshConnection();
         // Subscribe to events
         subscribeToEvents();
+        terminalFeature = createTerminalFeature({
+            toolbox,
+            showNotification,
+            log,
+            getCurrentTerminal: () => currentTerminal,
+            setCurrentTerminal: (t) => {
+                currentTerminal = t;
+            },
+        });
+        fileSystemFeature = createFileSystemFeature({
+            toolbox,
+            showNotification,
+            log,
+            getCurrentConnection: () => currentConnection,
+        });
+        // Initialize security suites (used by UI buttons)
+        securitySuites = createSecuritySuites({
+            toolbox,
+            dataverse,
+            getCurrentConnection: () => currentConnection,
+            getCurrentTerminal: () => currentTerminal,
+            createTerminal,
+            handleTerminalOutput,
+            handleCommandCompleted,
+            showNotification,
+            log,
+        });
         // Setup UI event handlers
         setupEventHandlers();
         // Apply theme
@@ -77,8 +109,7 @@ async function refreshConnection() {
         }
         else {
             connectionInfo.className = "info-box warning";
-            connectionInfo.innerHTML =
-                "<p><strong>⚠️ No active connection</strong><br>Please connect to a Dataverse environment to use this tool.</p>";
+            connectionInfo.innerHTML = "<p><strong>⚠️ No active connection</strong><br>Please connect to a Dataverse environment to use this tool.</p>";
             log("No active connection found", "warning");
         }
         if (secondaryConnection) {
@@ -114,8 +145,7 @@ async function refreshConnection() {
             if (!secondaryInfo)
                 return;
             secondaryInfo.className = "info-box warning";
-            secondaryInfo.innerHTML =
-                "<p><strong>⚠️ No secondary connection</strong><br>Please connect to a secondary Dataverse environment to use this tool.</p>";
+            secondaryInfo.innerHTML = "<p><strong>⚠️ No secondary connection</strong><br>Please connect to a secondary Dataverse environment to use this tool.</p>";
             log("No secondary connection found", "warning");
         }
     }
@@ -155,18 +185,10 @@ function subscribeToEvents() {
  */
 function setupEventHandlers() {
     // Notification buttons
-    document
-        .getElementById("show-success-btn")
-        ?.addEventListener("click", () => showNotification("Success!", "Operation completed successfully", "success"));
-    document
-        .getElementById("show-info-btn")
-        ?.addEventListener("click", () => showNotification("Information", "This is an informational message", "info"));
-    document
-        .getElementById("show-warning-btn")
-        ?.addEventListener("click", () => showNotification("Warning", "Please review this warning", "warning"));
-    document
-        .getElementById("show-error-btn")
-        ?.addEventListener("click", () => showNotification("Error", "An error has occurred", "error"));
+    document.getElementById("show-success-btn")?.addEventListener("click", () => showNotification("Success!", "Operation completed successfully", "success"));
+    document.getElementById("show-info-btn")?.addEventListener("click", () => showNotification("Information", "This is an informational message", "info"));
+    document.getElementById("show-warning-btn")?.addEventListener("click", () => showNotification("Warning", "Please review this warning", "warning"));
+    document.getElementById("show-error-btn")?.addEventListener("click", () => showNotification("Error", "An error has occurred", "error"));
     document.getElementById("show-loading-btn")?.addEventListener("click", showLoading);
     // Utility buttons
     document.getElementById("copy-clipboard-btn")?.addEventListener("click", copyToClipboard);
@@ -182,6 +204,13 @@ function setupEventHandlers() {
     // Terminal buttons
     document.getElementById("create-terminal-btn")?.addEventListener("click", createTerminal);
     document.getElementById("execute-command-btn")?.addEventListener("click", executeTerminalCommand);
+    document.getElementById("run-security-probe-btn")?.addEventListener("click", runTerminalSecurityProbe);
+    document.getElementById("run-terminal-suite-btn")?.addEventListener("click", () => securitySuites?.runTerminalSuite());
+    document.getElementById("run-filesystem-suite-btn")?.addEventListener("click", () => securitySuites?.runFileSystemSuite());
+    document.getElementById("run-events-suite-btn")?.addEventListener("click", () => securitySuites?.runEventsSuite());
+    document.getElementById("run-settings-suite-btn")?.addEventListener("click", () => securitySuites?.runSettingsSuite());
+    document.getElementById("run-dataverse-suite-btn")?.addEventListener("click", () => securitySuites?.runDataverseSuite());
+    document.getElementById("run-security-suite-btn")?.addEventListener("click", () => securitySuites?.runAllSuites());
     document.getElementById("close-terminal-btn")?.addEventListener("click", closeTerminal);
     // Dataverse query button
     document.getElementById("query-accounts-btn")?.addEventListener("click", queryAccounts);
@@ -264,406 +293,99 @@ async function showCurrentTheme() {
         log(`Error getting theme: ${error.message}`, "error");
     }
 }
+function requireTerminalFeature() {
+    if (!terminalFeature) {
+        throw new Error("Terminal feature not initialized");
+    }
+    return terminalFeature;
+}
+function requireFileSystemFeature() {
+    if (!fileSystemFeature) {
+        throw new Error("FileSystem feature not initialized");
+    }
+    return fileSystemFeature;
+}
 /**
  * Save data to file
  */
 async function saveDataToFile() {
-    try {
-        const data = {
-            timestamp: new Date().toISOString(),
-            connection: currentConnection
-                ? {
-                    name: currentConnection.name,
-                    url: currentConnection.url,
-                    environment: currentConnection.environment,
-                }
-                : null,
-            message: "Export from HTML Sample Tool",
-        };
-        const filePath = await toolbox.fileSystem.saveFile("sample-export.json", JSON.stringify(data, null, 2));
-        if (filePath) {
-            await showNotification("File Saved", `File saved to: ${filePath}`, "success");
-            log(`File saved to: ${filePath}`, "success");
-        }
-        else {
-            log("File save cancelled", "info");
-        }
-    }
-    catch (error) {
-        log(`Error saving file: ${error.message}`, "error");
-    }
+    await requireFileSystemFeature().saveDataToFile();
 }
 /**
  * Read text file
  */
 async function readText() {
-    try {
-        const output = document.getElementById("filesystem-output");
-        if (output)
-            output.textContent = "Selecting text file...\n";
-        const filePath = await toolbox.fileSystem.selectPath({
-            type: "file",
-            title: "Select a Text File",
-            filters: [
-                { name: "Text Files", extensions: ["txt", "json", "xml", "csv", "md"] },
-                { name: "All Files", extensions: ["*"] },
-            ],
-        });
-        if (!filePath) {
-            if (output)
-                output.textContent = "File selection cancelled.";
-            log("File selection cancelled", "info");
-            return;
-        }
-        if (output)
-            output.textContent = `Reading file: ${filePath}\n\n`;
-        const content = await toolbox.fileSystem.readText(filePath);
-        if (output) {
-            output.textContent += `File Size: ${content.length} characters\n\n`;
-            output.textContent += "Content:\n";
-            output.textContent += "─".repeat(50) + "\n";
-            output.textContent += content;
-        }
-        await showNotification("Success", `File read successfully (${content.length} characters)`, "success");
-        log(`Read text file: ${filePath} (${content.length} chars)`, "success");
-    }
-    catch (error) {
-        const output = document.getElementById("filesystem-output");
-        if (output)
-            output.textContent = `Error: ${error.message}`;
-        log(`Error reading text file: ${error.message}`, "error");
-    }
+    await requireFileSystemFeature().readText();
 }
 /**
  * Read directory contents
  */
 async function readDirectory() {
-    try {
-        const output = document.getElementById("filesystem-output");
-        if (output)
-            output.textContent = "Selecting directory...\n";
-        const dirPath = await toolbox.fileSystem.selectPath({
-            type: "folder",
-            title: "Select a Directory",
-        });
-        if (!dirPath) {
-            if (output)
-                output.textContent = "Directory selection cancelled.";
-            log("Directory selection cancelled", "info");
-            return;
-        }
-        if (output)
-            output.textContent = `Reading directory: ${dirPath}\n\n`;
-        const entries = await toolbox.fileSystem.readDirectory(dirPath);
-        // Separate files and directories
-        const directories = entries.filter((e) => e.type === "directory");
-        const files = entries.filter((e) => e.type === "file");
-        if (output) {
-            output.textContent += `Found ${entries.length} entries:\n`;
-            output.textContent += "─".repeat(50) + "\n";
-            if (directories.length > 0) {
-                output.textContent += `\nDirectories (${directories.length}):\n`;
-                directories.forEach((entry) => {
-                    output.textContent += `  📁 ${entry.name}\n`;
-                });
-            }
-            if (files.length > 0) {
-                output.textContent += `\nFiles (${files.length}):\n`;
-                files.forEach((entry) => {
-                    output.textContent += `  📄 ${entry.name}\n`;
-                });
-            }
-        }
-        await showNotification("Success", `Directory read successfully (${entries.length} entries)`, "success");
-        log(`Read directory: ${dirPath} (${entries.length} entries: ${directories.length} dirs, ${files.length} files)`, "success");
-    }
-    catch (error) {
-        const output = document.getElementById("filesystem-output");
-        if (output)
-            output.textContent = `Error: ${error.message}`;
-        log(`Error reading directory: ${error.message}`, "error");
-    }
+    await requireFileSystemFeature().readDirectory();
 }
 /**
  * Create directory
  */
 async function createDirectory() {
-    try {
-        const output = document.getElementById("filesystem-output");
-        if (output)
-            output.textContent = "Selecting parent directory...\n";
-        const parentPath = await toolbox.fileSystem.selectPath({
-            type: "folder",
-            title: "Select Parent Directory",
-        });
-        if (!parentPath) {
-            if (output)
-                output.textContent = "Directory selection cancelled.";
-            log("Directory selection cancelled", "info");
-            return;
-        }
-        // Use built-in prompt for directory name (workaround since browser prompt may not be available)
-        // For better UX, you could add an input field to the UI
-        const dirName = prompt("Enter new directory name:", "new-folder");
-        if (!dirName || dirName.trim() === "") {
-            if (output)
-                output.textContent = "Directory creation cancelled.";
-            log("Directory creation cancelled", "info");
-            return;
-        }
-        const newDirPath = `${parentPath}/${dirName.trim()}`;
-        if (output)
-            output.textContent = `Creating directory: ${newDirPath}\n`;
-        await toolbox.fileSystem.createDirectory(newDirPath);
-        if (output) {
-            output.textContent += `✓ Directory created successfully!\n`;
-            output.textContent += `Path: ${newDirPath}`;
-        }
-        await showNotification("Success", `Directory created: ${newDirPath}`, "success");
-        log(`Created directory: ${newDirPath}`, "success");
-    }
-    catch (error) {
-        const output = document.getElementById("filesystem-output");
-        if (output)
-            output.textContent = `Error: ${error.message}`;
-        log(`Error creating directory: ${error.message}`, "error");
-    }
+    await requireFileSystemFeature().createDirectory();
 }
 /**
  * Read system file (hardcoded macOS path for testing)
  * This tests error handling when accessing restricted files
  */
 async function readSystemFile() {
-    try {
-        const output = document.getElementById("filesystem-output");
-        const systemFilePath = "/var/log/system.log";
-        if (output)
-            output.textContent = `Attempting to read system file: ${systemFilePath}\n\n`;
-        log(`Attempting to read system file: ${systemFilePath}`, "info");
-        const content = await toolbox.fileSystem.readText(systemFilePath);
-        if (output) {
-            output.textContent += `File Size: ${content.length} characters\n\n`;
-            output.textContent += "Content (first 1000 chars):\n";
-            output.textContent += "─".repeat(50) + "\n";
-            output.textContent += content.substring(0, 1000);
-            if (content.length > 1000) {
-                output.textContent += "\n\n... (truncated)";
-            }
-        }
-        await showNotification("Success", `System file read (${content.length} characters)`, "success");
-        log(`Successfully read system file: ${systemFilePath}`, "success");
-    }
-    catch (error) {
-        const output = document.getElementById("filesystem-output");
-        const errorMsg = error.message;
-        if (output) {
-            output.textContent = `❌ Error Reading System File\n`;
-            output.textContent += `Path: /var/log/system.log\n\n`;
-            output.textContent += `Error: ${errorMsg}\n\n`;
-            output.textContent += "This is expected - system files are typically restricted due to:\n";
-            output.textContent += "- File permissions (insufficient access)\n";
-            output.textContent += "- Security restrictions\n";
-            output.textContent += "- Sandbox limitations";
-        }
-        log(`Error reading system file: ${errorMsg}`, "error");
-        await showNotification("Error Reading System File", errorMsg, "error");
-    }
+    await requireFileSystemFeature().readSystemFile();
 }
 /**
  * Read file with selection dialog, but then hardcode a macOS path instead
  * This tests ignoring user selection and attempting to read a restricted path
  */
 async function readHardcodedFile() {
-    try {
-        const output = document.getElementById("filesystem-output");
-        if (output)
-            output.textContent = "Opening file selection dialog...\n";
-        log("Opening file selection dialog", "info");
-        // Open file picker dialog
-        const selectedPath = await toolbox.fileSystem.selectPath({
-            type: "file",
-            title: "Select a File (will be ignored)",
-            filters: [{ name: "All Files", extensions: ["*"] }],
-        });
-        if (!selectedPath) {
-            if (output)
-                output.textContent = "File selection cancelled.";
-            log("File selection cancelled", "info");
-            return;
-        }
-        // Show what was selected
-        if (output) {
-            output.textContent = `User selected: ${selectedPath}\n\n`;
-            output.textContent += "But we're ignoring that and attempting to read a hardcoded system path instead...\n\n";
-            output.textContent += "─".repeat(50) + "\n\n";
-        }
-        log(`User selected: ${selectedPath} (will be ignored)`, "info");
-        // Hardcode a macOS system path and ignore the selection
-        const hardcodedPath = "/etc/passwd";
-        if (output)
-            output.textContent += `Attempting to read hardcoded path: ${hardcodedPath}\n\n`;
-        log(`Attempting to read hardcoded path: ${hardcodedPath}`, "info");
-        const content = await toolbox.fileSystem.readText(hardcodedPath);
-        if (output) {
-            output.textContent += `✓ Success! File Size: ${content.length} characters\n\n`;
-            output.textContent += "Content:\n";
-            output.textContent += "─".repeat(50) + "\n";
-            output.textContent += content.substring(0, 1500);
-            if (content.length > 1500) {
-                output.textContent += "\n\n... (truncated)";
-            }
-        }
-        await showNotification("File Read Successfully", `Hardcoded file read: ${hardcodedPath} (${content.length} characters)`, "success");
-        log(`Successfully read hardcoded file: ${hardcodedPath}`, "success");
-    }
-    catch (error) {
-        const output = document.getElementById("filesystem-output");
-        const errorMsg = error.message;
-        if (output) {
-            output.textContent += `❌ Error Reading Hardcoded File\n`;
-            output.textContent += `Path: /etc/passwd\n\n`;
-            output.textContent += `Error: ${errorMsg}\n\n`;
-            output.textContent += "This demonstrates that hardcoded system paths are typically restricted:\n";
-            output.textContent += "- Permission denied (macOS sandbox restrictions)\n";
-            output.textContent += "- The file picker selected a different path, but we tried to read this one instead\n";
-            output.textContent += "- Real-world use case: don't hardcode paths, always use user selection";
-        }
-        log(`Error reading hardcoded file: ${errorMsg}`, "error");
-        await showNotification("Error Reading Hardcoded File", errorMsg, "error");
-    }
+    await requireFileSystemFeature().readHardcodedFile();
 }
 /**
  * Read a hardcoded macOS file path directly without using selectPath dialog
  * This tests reading a restricted file with no user interaction
  */
 async function readDirectFile() {
-    try {
-        const output = document.getElementById("filesystem-output");
-        const hardcodedPath = "/etc/hosts";
-        if (output)
-            output.textContent = `Reading hardcoded path directly (no dialog)...\n`;
-        if (output)
-            output.textContent += `Path: ${hardcodedPath}\n\n`;
-        log(`Attempting direct read of hardcoded path: ${hardcodedPath}`, "info");
-        const content = await toolbox.fileSystem.readText(hardcodedPath);
-        if (output) {
-            output.textContent += `✓ Success! File Size: ${content.length} characters\n\n`;
-            output.textContent += "Content:\n";
-            output.textContent += "─".repeat(50) + "\n";
-            output.textContent += content;
-        }
-        await showNotification("File Read Successfully", `Direct file read: ${hardcodedPath} (${content.length} characters)`, "success");
-        log(`Successfully read direct file: ${hardcodedPath}`, "success");
-    }
-    catch (error) {
-        const output = document.getElementById("filesystem-output");
-        const errorMsg = error.message;
-        if (output) {
-            output.textContent = `❌ Error Reading Hardcoded Path\n`;
-            output.textContent += `Path: /etc/hosts\n`;
-            output.textContent += `Method: Direct read (no selectPath dialog)\n\n`;
-            output.textContent += `Error: ${errorMsg}\n\n`;
-            output.textContent += "This demonstrates:\n";
-            output.textContent += "- System files are protected even with hardcoded paths\n";
-            output.textContent += "- No file picker dialog was used\n";
-            output.textContent += "- Security restrictions apply to all file access attempts";
-        }
-        log(`Error reading direct file: ${errorMsg}`, "error");
-        await showNotification("Error Reading Direct File", errorMsg, "error");
-    }
+    await requireFileSystemFeature().readDirectFile();
 }
 /**
  * Create a terminal
  */
 async function createTerminal() {
-    try {
-        currentTerminal = await toolbox.terminal.create({
-            name: "HTML Sample Terminal",
-        });
-        log(`Terminal created: ${currentTerminal.name} (${currentTerminal.id})`, "success");
-        // Enable command buttons
-        const executeBtn = document.getElementById("execute-command-btn");
-        const closeBtn = document.getElementById("close-terminal-btn");
-        if (executeBtn)
-            executeBtn.disabled = false;
-        if (closeBtn)
-            closeBtn.disabled = false;
-        await showNotification("Terminal Created", `Terminal ${currentTerminal.name} is ready`, "success");
-    }
-    catch (error) {
-        log(`Error creating terminal: ${error.message}`, "error");
-    }
+    await requireTerminalFeature().createTerminal();
 }
 /**
  * Execute terminal command
  */
 async function executeTerminalCommand() {
-    if (!currentTerminal) {
-        await showNotification("No Terminal", "Please create a terminal first", "warning");
-        return;
-    }
-    try {
-        const isWindows = navigator.platform.toLowerCase().includes("win");
-        const command = isWindows ? "dir" : "ls -la";
-        const output = document.getElementById("terminal-output");
-        if (output) {
-            output.textContent = `> ${command}\n`;
-        }
-        log(`Executing command: ${command}`, "info");
-        await toolbox.terminal.execute(currentTerminal.id, command);
-    }
-    catch (error) {
-        log(`Error executing command: ${error.message}`, "error");
-    }
+    await requireTerminalFeature().executeTerminalCommand();
+}
+/**
+ * Run a safe terminal security probe.
+ * This validates terminal exposure and command chaining with non-malicious commands only.
+ */
+async function runTerminalSecurityProbe() {
+    await requireTerminalFeature().runTerminalSecurityProbe();
 }
 /**
  * Close terminal
  */
 async function closeTerminal() {
-    if (!currentTerminal)
-        return;
-    try {
-        await toolbox.terminal.close(currentTerminal.id);
-        log("Terminal closed", "info");
-        currentTerminal = null;
-        // Disable command buttons
-        const executeBtn = document.getElementById("execute-command-btn");
-        const closeBtn = document.getElementById("close-terminal-btn");
-        if (executeBtn)
-            executeBtn.disabled = true;
-        if (closeBtn)
-            closeBtn.disabled = true;
-        const output = document.getElementById("terminal-output");
-        if (output)
-            output.textContent = "";
-    }
-    catch (error) {
-        log(`Error closing terminal: ${error.message}`, "error");
-    }
+    await requireTerminalFeature().closeTerminal();
 }
 /**
  * Handle terminal output events
  */
 function handleTerminalOutput(data) {
-    if (!currentTerminal || data.terminalId !== currentTerminal.id)
-        return;
-    const output = document.getElementById("terminal-output");
-    if (output) {
-        output.textContent += data.data;
-        output.scrollTop = output.scrollHeight;
-    }
+    requireTerminalFeature().handleTerminalOutput(data);
 }
 /**
  * Handle command completed events
  */
 function handleCommandCompleted(data) {
-    if (!currentTerminal || data.terminalId !== currentTerminal.id)
-        return;
-    const output = document.getElementById("terminal-output");
-    if (output) {
-        output.textContent += `\n[Command completed with exit code: ${data.exitCode}]\n`;
-        output.scrollTop = output.scrollHeight;
-    }
+    requireTerminalFeature().handleCommandCompleted(data);
 }
 /**
  * Query accounts from Dataverse
@@ -946,11 +668,7 @@ async function getAccountAttributesMetadata() {
     try {
         if (output) {
             output.textContent = "Retrieving account attributes metadata...\n";
-            const metadata = await dataverse.getEntityRelatedMetadata("account", "Attributes", [
-                "LogicalName",
-                "DisplayName",
-                "AttributeType",
-            ]);
+            const metadata = await dataverse.getEntityRelatedMetadata("account", "Attributes", ["LogicalName", "DisplayName", "AttributeType"]);
             if (metadata) {
                 const metadataArray = metadata.value;
                 output.textContent += `Found ${metadataArray.length} attributes:\n\n`;