application-inventory-service 1.6.0__py3-none-any.whl

ado_mobile_scanner.py

@@ -0,0 +1,5 @@
+from appsec_scan_router import *
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

application_inventory_service/__init__.py

@@ -0,0 +1 @@
+from appsec_scan_router import *

application_inventory_service/__main__.py

@@ -0,0 +1,5 @@
+from appsec_scan_router.cli import main
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

application_inventory_service-1.6.0.dist-info/METADATA

@@ -0,0 +1,272 @@
+Metadata-Version: 2.4
+Name: application-inventory-service
+Version: 1.6.0
+Summary: SDK, CLI, UI, and scanner target manifests for application inventory across Azure DevOps and GitHub Enterprise
+Author: Application Inventory Service contributors
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/h0p3sf4ll/application-inventory-service
+Project-URL: Repository, https://github.com/h0p3sf4ll/application-inventory-service
+Project-URL: Issues, https://github.com/h0p3sf4ll/application-inventory-service/issues
+Keywords: appsec,sdk,azure-devops,github-enterprise,mobile,web-applications,microservices,middleware,ai,llm,machine-learning,inventory,semgrep,sonarqube,android,ios,app-store,google-play
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Version Control :: Git
+Classifier: Topic :: Utilities
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=42.0.0
+Requires-Dist: openpyxl>=3.1.0
+Requires-Dist: psycopg[binary]>=3.2.0
+Requires-Dist: requests>=2.31.0
+Dynamic: license-file
+
+# Application Inventory Service
+
+Application Inventory Service discovers software assets across Azure DevOps and GitHub Enterprise without cloning repositories. It identifies mobile apps, web apps, API services, microservices, middleware, serverless workloads, infrastructure code, AI-enabled apps, and ML-enabled apps, then emits reports and scanner-ready target manifests.
+
+The project is published as `application-inventory-service`. The original `appsec-*`, `ado-mobile-scanner`, and `mobile-app-inventory-tracer` commands remain available as compatibility aliases.
+
+## What It Does
+
+- Scans one or more Azure DevOps organizations, each with its own PAT.
+- Scans GitHub Enterprise owners and repositories.
+- Pulls Azure DevOps projects and GitHub repositories into the UI for targeted scans.
+- Scans default branches, with production-like fallback branch resolution when no default branch exists.
+- Captures inventory name, version, type, language, mobile identifiers, contributors, last activity, and evidence.
+- Optionally validates detected mobile identifiers against Apple App Store and Google Play.
+- Writes CSV, JSON, XLSX, Semgrep target lists, SonarQube project manifests, and generic scanner target manifests.
+- Streams results into a normalized PostgreSQL schema, scoped by signed-in user when run from the UI.
+
+## Documentation
+
+- [Application Intent](docs/APP_INTENT.md)
+- [AWS Deployment Guide](docs/AWS_DEPLOYMENT.md)
+- [Architecture](docs/ARCHITECTURE.md)
+- [SBOM Summary](docs/SBOM.md)
+- [CycloneDX SBOM](docs/SBOM.cdx.json)
+
+## Install
+
+```bash
+python -m pip install application-inventory-service
+```
+
+```bash
+application-inventory-service --help
+application-inventory-service-ui --help
+```
+
+For local development:
+
+```bash
+git clone https://github.com/h0p3sf4ll/application-inventory-service.git
+cd application-inventory-service
+python3 -m venv .venv
+source .venv/bin/activate
+python -m pip install -r requirements.txt
+python -m pip install -e .
+```
+
+## Quick Start: UI
+
+```bash
+APPLICATION_INVENTORY_SERVICE_TEST_LOGIN_ENABLED=true \
+application-inventory-service-ui \
+  --host 127.0.0.1 \
+  --port 48731 \
+  --reports-dir reports
+```
+
+Open `http://127.0.0.1:48731`.
+
+Use the test login only for local development. For shared environments, configure GitHub SSO or Google SSO and disable the test login.
+
+## Quick Start: Docker
+
+```bash
+docker build -t application-inventory-service .
+mkdir -p reports
+cp .env.example .env
+docker run --rm \
+  -p 48731:48731 \
+  --env-file .env \
+  -v "$PWD/reports:/reports" \
+  application-inventory-service \
+  ui \
+  --host 0.0.0.0 \
+  --port 48731 \
+  --reports-dir /reports
+```
+
+## Azure DevOps
+
+Scan one organization:
+
+```bash
+export ADO_PAT="your-token"
+
+application-inventory-service \
+  --provider azure-devops \
+  --org FabrikamCloud \
+  --out-dir reports
+```
+
+Scan selected projects:
+
+```bash
+application-inventory-service \
+  --provider azure-devops \
+  --org FabrikamCloud \
+  --project Go_To_Market \
+  --project Payments \
+  --out-dir reports
+```
+
+Scan multiple organizations with separate PATs:
+
+```bash
+application-inventory-service \
+  --ado-org-pat "FabrikamCloud=$FABRIKAM_PAT" \
+  --ado-org-pat "ContosoApps=$CONTOSO_PAT" \
+  --target-filter "FabrikamCloud=Go_To_Market" \
+  --target-filter "ContosoApps=Payments" \
+  --out-dir reports
+```
+
+## GitHub Enterprise
+
+```bash
+export GITHUB_TOKEN="your-token"
+
+application-inventory-service \
+  --provider github-enterprise \
+  --base-url https://github.fabrikam.example/api/v3 \
+  --org FabrikamCloud \
+  --repo payments-api \
+  --out-dir reports
+```
+
+Omit `--repo` to scan all accessible repositories for the owner. Repeat `--repo` for a selected repository set.
+
+## PostgreSQL
+
+PostgreSQL sync is enabled by default in the UI. For CLI scans:
+
+```bash
+export APPLICATION_INVENTORY_POSTGRES_DSN="postgresql://postgres:postgres@localhost:5432/postgres"
+
+application-inventory-service \
+  --provider azure-devops \
+  --org FabrikamCloud \
+  --postgres-schema application_inventory \
+  --postgres-table application_inventory_assets \
+  --out-dir reports
+```
+
+Local development database:
+
+```bash
+docker run --name application-inventory-postgres \
+  -e POSTGRES_USER=postgres \
+  -e POSTGRES_PASSWORD=postgres \
+  -e POSTGRES_DB=postgres \
+  -p 5432:5432 \
+  -d postgres:16-alpine
+```
+
+## Environment Variables
+
+| Variable | Purpose |
+| --- | --- |
+| `APPLICATION_INVENTORY_SERVICE_UI_HOST` | UI bind host |
+| `APPLICATION_INVENTORY_SERVICE_UI_PORT` | UI bind port |
+| `APPLICATION_INVENTORY_SERVICE_REPORTS_DIR` | UI report/state directory |
+| `APPLICATION_INVENTORY_SERVICE_GITHUB_CLIENT_ID` | GitHub OAuth client ID |
+| `APPLICATION_INVENTORY_SERVICE_GITHUB_CLIENT_SECRET` | GitHub OAuth client secret |
+| `APPLICATION_INVENTORY_SERVICE_GOOGLE_CLIENT_ID` | Google OAuth client ID |
+| `APPLICATION_INVENTORY_SERVICE_GOOGLE_CLIENT_SECRET` | Google OAuth client secret |
+| `APPLICATION_INVENTORY_SERVICE_SECRET_KEY` | Fernet key for encrypted token storage |
+| `APPLICATION_INVENTORY_SERVICE_STATE_DIR` | Secure state directory |
+| `APPLICATION_INVENTORY_ADO_ORG_PATS` | JSON or `ORG=PAT` list for Azure DevOps multi-org scans |
+| `APPLICATION_INVENTORY_TARGET_FILTERS` | JSON or repeated `[ORG=]PROJECT_OR_REPO` filters |
+| `APPLICATION_INVENTORY_POSTGRES_DSN` | PostgreSQL DSN |
+| `APPLICATION_INVENTORY_POSTGRES_SCHEMA` | PostgreSQL schema |
+| `APPLICATION_INVENTORY_POSTGRES_TABLE` | Flat compatibility table |
+
+Legacy `APPSEC_INVENTORY_*` and `APPSEC_INVENTORY_SERVICE_*` variables remain supported.
+
+## Outputs
+
+With the default prefix, the service writes:
+
+- `application_inventory_service.csv`
+- `application_inventory_service.json`
+- `application_inventory_service.xlsx`
+- `application_inventory_service_scanner_targets.csv`
+- `application_inventory_service_scanner_targets.json`
+- `application_inventory_service_semgrep_targets.txt`
+- `application_inventory_service_sonarqube_projects.csv`
+
+The scanner target files are intended for downstream orchestration with Semgrep, SonarQube, SCA tools, custom security scanners, or pipeline automation.
+
+## SDK
+
+```python
+from pathlib import Path
+
+from application_inventory_service import ScanConfig, SourceTargetFilter, scan_to_reports
+
+config = ScanConfig(
+    provider="github-enterprise",
+    base_url="https://github.fabrikam.example/api/v3",
+    org="FabrikamCloud",
+    pat="your-token",
+    project=None,
+    target_filters=(SourceTargetFilter("", "payments-api"),),
+    out_dir=Path("reports"),
+    out_prefix="application_inventory_service",
+    max_workers=8,
+    branch_workers=16,
+    content_workers=16,
+    max_commits_per_repo=0,
+    timeout_seconds=30,
+    min_confidence="medium",
+)
+
+results, csv_path, json_path, xlsx_path = scan_to_reports(config)
+```
+
+## Release
+
+Build and validate:
+
+```bash
+python -m unittest discover -s tests
+python -m build
+python -m twine check dist/*
+```
+
+Publish with the `Publish` GitHub Actions workflow. The workflow uses the `pypi` environment and supports two release paths:
+
+- Preferred: configure PyPI Trusted Publishing for repository `h0p3sf4ll/application-inventory-service`, workflow `.github/workflows/publish.yml`, environment `pypi`.
+- Fallback: add a GitHub Actions secret named `PYPI_API_TOKEN` with a PyPI API token.
+
+## Security Notes
+
+- Use read-only source provider tokens.
+- Store shared deployment secrets in AWS Secrets Manager, GitHub Actions secrets, or another approved secret manager.
+- Do not commit generated reports if they contain internal repository names, URLs, identifiers, or contributor emails.
+- The service does not clone repositories; it reads repository trees and selected manifest/configuration files through provider APIs.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

application_inventory_service-1.6.0.dist-info/RECORD

@@ -0,0 +1,41 @@
+ado_mobile_scanner.py,sha256=1RwiZlcxlyRZsVFkinuqYoqe0CRQrgNC-QBjY_T3uDc,91
+mobile_app_inventory_tracer.py,sha256=1RwiZlcxlyRZsVFkinuqYoqe0CRQrgNC-QBjY_T3uDc,91
+application_inventory_service/__init__.py,sha256=QavCijPQffyOWJ8nPo-zC-okRm1cyqELBdl7I8WpMVc,33
+application_inventory_service/__main__.py,sha256=wMIYWJ_BOtX85WNsYDA_NfKtXVBwzNn3TP9eUiYN5SA,98
+application_inventory_service-1.6.0.dist-info/licenses/LICENSE,sha256=UTa6aTNT6-wcTUb-is0ZLUmXBlYnNDtJNPSBkaXnD_0,1094
+appsec_scan_router/__init__.py,sha256=4Oix5QbRVA9K-iC6Rw2spXxCa8c0EtP9YHmsLI6YWwg,10613
+appsec_scan_router/__main__.py,sha256=PSQ4rpL0dG6f-qH4N7H-gD9igQkdHzH4yVZDcW8lfZo,80
+appsec_scan_router/activity.py,sha256=gn561tHJrcf2xW-JecYZsWx9Y6DFCcxDtCfsVJyGzfo,2172
+appsec_scan_router/auth.py,sha256=x0iAW_Uc2mxWi5g8P2ylSM11AkEd37fvRuKXQk70k1g,22948
+appsec_scan_router/azure.py,sha256=1f3YH9AbPyYqLY3dGfSjy4ywG8etlUJn5_r9wcOgwZU,10749
+appsec_scan_router/cli.py,sha256=7ws-UmaCCaU25kn5w9cdCKjlm_Yk58hSLjcoDb6Iys8,14848
+appsec_scan_router/constants.py,sha256=xSMSfSHiIzlOGVQz-5Q71kYWJnz9W3xjlRPuLqu-UeY,6138
+appsec_scan_router/detection.py,sha256=jwS1Y7Lw19EWEFP0uP2-NVTuNz_K8CjKjLqPKLbLPBA,39083
+appsec_scan_router/entrypoint.py,sha256=tFiK4vMF4Zi7so0tnRSN1CERbuZ9AsYBomiSe0tYN-0,849
+appsec_scan_router/github.py,sha256=J2bHaYX9V3B08ccTC9ubNMqy9rs4FQLJ7gm54yAlj58,12208
+appsec_scan_router/metadata.py,sha256=um65V9EzeX90_89f3Q_Rt8venfu5mnn5YGgShs3Uz1A,16877
+appsec_scan_router/models.py,sha256=62XpGQ9r3qrjdWqk0Up2iUODXXcyc6OiAKAic9rak-c,2747
+appsec_scan_router/org_tokens.py,sha256=NZ8AFOQHcr8OsBGkdZzKi6tRO0s-pVJgT1jNdeR9WDk,3683
+appsec_scan_router/postgres.py,sha256=RDsWn9pP4szOQB39P_ta_PFSpq1CI-IPkbj8EQ7Q8lY,46398
+appsec_scan_router/reports.py,sha256=cxuFdx-8MX-uah3Gbr8lO_gWR9qfhdPzpTT3Qyfn5tQ,10823
+appsec_scan_router/scanner.py,sha256=-t43sdTCFFg1SXAB885wbAvxsBl6f8IKQCt7oG3-WAE,41607
+appsec_scan_router/sdk.py,sha256=h9HLwl5SUbr4628yrczA3btF1l0rfEDN0q3C8wZCVN4,699
+appsec_scan_router/store_lookup.py,sha256=zfI4t1yt4YsVUyk47d-4BWKwpFi2RJjFJ3rLMIN9bNA,16029
+appsec_scan_router/target_filters.py,sha256=NGdocf94R2vnKVXb-07jEF-cRTyvthtvYze7QCmmam0,4836
+appsec_scan_router/ui.py,sha256=KKCmHK2mTOI4FCanMFHvD4UA7UQwhzFY0wJ4jYNFdiQ,51962
+appsec_scan_router/utils.py,sha256=FxDxn8J48RjGxUMgEJWChlnZZipq79zA80JP3IcmJZM,3310
+appsec_scan_router/ui_static/__init__.py,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
+appsec_scan_router/ui_static/app.js,sha256=SHIDZ7fnF8jlCLkojYd_53k4MaBdnLk-4eTfMaJnpOI,47356
+appsec_scan_router/ui_static/appsec-login-background.png,sha256=or17dT_DxGxHX7_CC6FQd9rwTUhF8OPEROoFLkjSGsA,1799825
+appsec_scan_router/ui_static/github-mark.svg,sha256=JfWObVv23TK2Dsi1xgbra3c2yjs_8RKJExPJcY12ufc,705
+appsec_scan_router/ui_static/google-g.svg,sha256=TFQbcEHXTWf81vjZPCSdNT_pqyKa3VUSWGfA8YGjhVM,714
+appsec_scan_router/ui_static/index.html,sha256=WeH0VhmuYnUXPK0vM83T4s1UQ1a3WcOys7QEGoJXrLg,22380
+appsec_scan_router/ui_static/styles.css,sha256=m0nieuyeURZZdW7l-Q2e7C2zqUCzaRgIMfpBEqY9iLE,20929
+appsec_scan_router/ui_static/test-user.svg,sha256=Jq_Vu32kvAZAk3wqcaH5-OX2lRIswV4TXKnZOAq8KZg,295
+mobile_scanner/__init__.py,sha256=QavCijPQffyOWJ8nPo-zC-okRm1cyqELBdl7I8WpMVc,33
+mobile_scanner/__main__.py,sha256=wMIYWJ_BOtX85WNsYDA_NfKtXVBwzNn3TP9eUiYN5SA,98
+application_inventory_service-1.6.0.dist-info/METADATA,sha256=gWTG7VPWFnN35A9NtSt8TDrLKPzyLtR13G__zTZt_Jw,9266
+application_inventory_service-1.6.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+application_inventory_service-1.6.0.dist-info/entry_points.txt,sha256=-mzY116LbC-vbKVknwWxrj9ORycG6J2anh7Zfpub280,674
+application_inventory_service-1.6.0.dist-info/top_level.txt,sha256=oTIOTMeV5JX8SXNQwmS4Q2jT4j306AgcuV4RmgW0L9A,111
+application_inventory_service-1.6.0.dist-info/RECORD,,

application_inventory_service-1.6.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (83.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

application_inventory_service-1.6.0.dist-info/entry_points.txt

@@ -0,0 +1,12 @@
+[console_scripts]
+ado-mobile-scanner = appsec_scan_router.cli:main
+application-inventory-service = appsec_scan_router.cli:main
+application-inventory-service-container = appsec_scan_router.entrypoint:main
+application-inventory-service-ui = appsec_scan_router.ui:main
+appsec-inventory-service = appsec_scan_router.cli:main
+appsec-inventory-service-container = appsec_scan_router.entrypoint:main
+appsec-inventory-service-ui = appsec_scan_router.ui:main
+appsec-scan-router = appsec_scan_router.cli:main
+appsec-scan-router-container = appsec_scan_router.entrypoint:main
+appsec-scan-router-ui = appsec_scan_router.ui:main
+mobile-app-inventory-tracer = appsec_scan_router.cli:main

application_inventory_service-1.6.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AppSec Inventory Service contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

application_inventory_service-1.6.0.dist-info/top_level.txt

@@ -0,0 +1,5 @@
+ado_mobile_scanner
+application_inventory_service
+appsec_scan_router
+mobile_app_inventory_tracer
+mobile_scanner