dhis2w-security 1.19.0__py3-none-any.whl

dhis2w_security/__init__.py

@@ -0,0 +1 @@
+"""The dhis2w-security plugin pack: `d2w security` and the read-only `security_*` MCP tools."""

dhis2w_security/core/__init__.py

@@ -0,0 +1,336 @@
+"""Version-invariant security domain logic shared by every security plugin tree.
+
+The authority taxonomy, severity model, guardrail contract, audit orchestration,
+and report rendering are security opinions, not version concerns: they live once
+here and are consumed by the thin per-tree plugin shims under
+`dhis2w_security.v{41,42,43}`. Only genuinely version-divergent wire
+extraction lives per tree.
+"""
+
+from __future__ import annotations
+
+from dhis2w_security.core.apps import HubApp, InstalledApp, evaluate_apps
+from dhis2w_security.core.audit_config import evaluate_audit_config
+from dhis2w_security.core.auth_methods import LoginProviderView, OAuth2ClientView, evaluate_auth_methods
+from dhis2w_security.core.authorities import (
+    AUTHORITY_CATEGORIES,
+    AuthorityCategory,
+    build_account_authorities,
+    categorise_authorities,
+    evaluate_account_authorities,
+)
+from dhis2w_security.core.controls import (
+    CONTROL_CATALOG,
+    CheckOutcome,
+    ControlLog,
+    ControlOutcome,
+    ControlSpec,
+    ControlStatus,
+)
+from dhis2w_security.core.credentials import (
+    CredentialProbeResult,
+    ProbeOutcome,
+    classify_probe_status,
+    evaluate_credential_probe,
+)
+from dhis2w_security.core.csp import CspDirectives, grade_csp, parse_csp
+from dhis2w_security.core.dhisconf import (
+    AuditPosture,
+    AuditScopeMatrix,
+    RedactedSecret,
+    parse_dhis_conf,
+)
+from dhis2w_security.core.findings import (
+    HIGH_RISK_ROLE_CATEGORIES,
+    SEVERITY_ORDER,
+    AuditFinding,
+    Severity,
+    finding_sort_key,
+    role_severity,
+    severity_rank,
+)
+from dhis2w_security.core.guardrails import (
+    CONNECT_PATHS,
+    CREDENTIAL_PROBE_PATHS,
+    DEFAULT_PROBE_PASSWORD,
+    DEFAULT_PROBE_USERNAME,
+    GET_ALLOWLIST,
+    MAX_PROBE_ATTEMPTS,
+    REPORT_GUARDRAIL_NOTE,
+    GuardrailViolation,
+    guardrail_request_hook,
+    probe_client,
+)
+from dhis2w_security.core.guest import (
+    ANONYMOUS_PROBE_TARGETS,
+    AnonymousResult,
+    GuestProbeTarget,
+    evaluate_guest,
+)
+from dhis2w_security.core.hygiene import (
+    SEED_USERNAME,
+    TwoFactorSource,
+    TwoFactorSummary,
+    UserHygiene,
+    build_user_hygiene,
+    evaluate_hygiene,
+    evaluate_two_factor_from_endpoint,
+    evaluate_two_factor_from_user_field,
+)
+from dhis2w_security.core.models import AccountAuthorities, CategoryMatch
+from dhis2w_security.core.options import AuditOptions
+from dhis2w_security.core.orchestrator import run_audit
+from dhis2w_security.core.registry import (
+    CANONICAL_CHECKS,
+    BoundCheck,
+    CheckSpec,
+    canonical_keys,
+    label_for,
+    resolve_check_keys,
+    select_keys,
+)
+from dhis2w_security.core.releases import RELEASES_FEED_URL, ReleaseFeed, ReleaseLine, fetch_release_feed
+from dhis2w_security.core.report.base import ProgressReporter, ReportRenderer, StreamingRenderer
+from dhis2w_security.core.report.csv import CsvRenderer
+from dhis2w_security.core.report.html import HtmlRenderer
+from dhis2w_security.core.report.markdown import MarkdownRenderer
+from dhis2w_security.core.report.model import (
+    AuditReport,
+    AuditSummary,
+    CheckResult,
+    CheckStatus,
+    RunManifest,
+)
+from dhis2w_security.core.report.progress import PlainLogReporter, RichProgressReporter, make_reporter
+from dhis2w_security.core.report.text import TextRenderer
+from dhis2w_security.core.report.view import (
+    ControlView,
+    GroupView,
+    ItemView,
+    ReportMeta,
+    ReportView,
+    Scorecard,
+    SectionView,
+    build_report_view,
+)
+from dhis2w_security.core.roles import RoleAudit, build_role_audit, evaluate_roles
+from dhis2w_security.core.routes import RouteTarget, evaluate_routes
+from dhis2w_security.core.settings_audit import (
+    MIN_RECOMMENDED_PASSWORD_LENGTH,
+    CorsWhitelist,
+    SettingsLike,
+    evaluate_settings,
+)
+from dhis2w_security.core.sharing import (
+    SHARING_CAVEATS,
+    SHARING_FOCUS_TYPES,
+    SHARING_SCHEMA_VERSION,
+    AccessBits,
+    EffectiveAccess,
+    EffectiveGrant,
+    ExplorerRenderer,
+    FetchedGroup,
+    FetchedObject,
+    FetchedRole,
+    FetchedShare,
+    FetchedUser,
+    FocusTypeScan,
+    ManageEdge,
+    MembershipEdge,
+    ObjectNode,
+    PrincipalKind,
+    ProvenanceKind,
+    ResolvedFocusType,
+    RoleGrantEdge,
+    RoleNode,
+    SchemaShareability,
+    ShareEdge,
+    SharingExplorerMeta,
+    SharingFocusType,
+    SharingGraph,
+    SharingView,
+    TypeInventory,
+    TypeSummary,
+    UserGroupNode,
+    UserNode,
+    build_sharing_graph,
+    build_sharing_view,
+    compute_effective_access,
+    evaluate_sharing,
+    resolve_focus_types,
+)
+from dhis2w_security.core.streaming import ReportWriter
+from dhis2w_security.core.tokens import TokenAllowlists, TokensInventory, TokenView, evaluate_tokens
+from dhis2w_security.core.transport import CORS_PROBE_ORIGIN, TransportHeaders, evaluate_transport
+from dhis2w_security.core.versions import (
+    ADVISORY_PATCH_FLOOR,
+    ADVISORY_PATCH_FLOOR_REVIEWED,
+    MIN_SUPPORTED_LINE,
+    AdvisoryFloor,
+    ParsedVersion,
+    VersionPosture,
+    build_version_posture,
+    evaluate_version,
+    parse_dhis2_version,
+)
+
+__all__ = [
+    "ADVISORY_PATCH_FLOOR",
+    "ADVISORY_PATCH_FLOOR_REVIEWED",
+    "ANONYMOUS_PROBE_TARGETS",
+    "AUTHORITY_CATEGORIES",
+    "CANONICAL_CHECKS",
+    "CONTROL_CATALOG",
+    "CONNECT_PATHS",
+    "CORS_PROBE_ORIGIN",
+    "CREDENTIAL_PROBE_PATHS",
+    "DEFAULT_PROBE_PASSWORD",
+    "DEFAULT_PROBE_USERNAME",
+    "GET_ALLOWLIST",
+    "HIGH_RISK_ROLE_CATEGORIES",
+    "MAX_PROBE_ATTEMPTS",
+    "MIN_RECOMMENDED_PASSWORD_LENGTH",
+    "MIN_SUPPORTED_LINE",
+    "RELEASES_FEED_URL",
+    "REPORT_GUARDRAIL_NOTE",
+    "SEED_USERNAME",
+    "SEVERITY_ORDER",
+    "SHARING_CAVEATS",
+    "SHARING_FOCUS_TYPES",
+    "SHARING_SCHEMA_VERSION",
+    "AccessBits",
+    "AccountAuthorities",
+    "AdvisoryFloor",
+    "AnonymousResult",
+    "AuditFinding",
+    "AuditOptions",
+    "AuditPosture",
+    "AuditReport",
+    "AuditScopeMatrix",
+    "AuditSummary",
+    "AuthorityCategory",
+    "BoundCheck",
+    "CategoryMatch",
+    "CheckOutcome",
+    "CheckResult",
+    "CheckSpec",
+    "CheckStatus",
+    "ControlLog",
+    "ControlOutcome",
+    "ControlSpec",
+    "ControlStatus",
+    "ControlView",
+    "CorsWhitelist",
+    "CredentialProbeResult",
+    "CspDirectives",
+    "CsvRenderer",
+    "EffectiveAccess",
+    "EffectiveGrant",
+    "ExplorerRenderer",
+    "FetchedGroup",
+    "FetchedObject",
+    "FetchedRole",
+    "FetchedShare",
+    "FetchedUser",
+    "FocusTypeScan",
+    "GroupView",
+    "GuardrailViolation",
+    "GuestProbeTarget",
+    "HtmlRenderer",
+    "HubApp",
+    "InstalledApp",
+    "ItemView",
+    "LoginProviderView",
+    "ManageEdge",
+    "MarkdownRenderer",
+    "MembershipEdge",
+    "OAuth2ClientView",
+    "ObjectNode",
+    "ParsedVersion",
+    "PlainLogReporter",
+    "PrincipalKind",
+    "ProbeOutcome",
+    "ProgressReporter",
+    "ProvenanceKind",
+    "RedactedSecret",
+    "ReleaseFeed",
+    "ReleaseLine",
+    "ReportMeta",
+    "ReportRenderer",
+    "ReportView",
+    "ReportWriter",
+    "ResolvedFocusType",
+    "RichProgressReporter",
+    "RoleAudit",
+    "RoleGrantEdge",
+    "RoleNode",
+    "RouteTarget",
+    "RunManifest",
+    "SchemaShareability",
+    "Scorecard",
+    "SectionView",
+    "SettingsLike",
+    "Severity",
+    "ShareEdge",
+    "SharingExplorerMeta",
+    "SharingFocusType",
+    "SharingGraph",
+    "SharingView",
+    "StreamingRenderer",
+    "TextRenderer",
+    "TokenAllowlists",
+    "TokenView",
+    "TokensInventory",
+    "TransportHeaders",
+    "TwoFactorSource",
+    "TwoFactorSummary",
+    "TypeInventory",
+    "TypeSummary",
+    "UserGroupNode",
+    "UserHygiene",
+    "UserNode",
+    "VersionPosture",
+    "build_account_authorities",
+    "build_report_view",
+    "build_role_audit",
+    "build_sharing_graph",
+    "build_sharing_view",
+    "build_user_hygiene",
+    "build_version_posture",
+    "canonical_keys",
+    "categorise_authorities",
+    "classify_probe_status",
+    "compute_effective_access",
+    "evaluate_account_authorities",
+    "evaluate_apps",
+    "evaluate_audit_config",
+    "evaluate_auth_methods",
+    "evaluate_credential_probe",
+    "evaluate_guest",
+    "evaluate_hygiene",
+    "evaluate_roles",
+    "evaluate_routes",
+    "evaluate_settings",
+    "evaluate_sharing",
+    "evaluate_tokens",
+    "evaluate_transport",
+    "evaluate_two_factor_from_endpoint",
+    "evaluate_two_factor_from_user_field",
+    "evaluate_version",
+    "fetch_release_feed",
+    "finding_sort_key",
+    "grade_csp",
+    "guardrail_request_hook",
+    "label_for",
+    "make_reporter",
+    "parse_csp",
+    "parse_dhis2_version",
+    "parse_dhis_conf",
+    "probe_client",
+    "resolve_check_keys",
+    "resolve_focus_types",
+    "role_severity",
+    "run_audit",
+    "select_keys",
+    "severity_rank",
+]

dhis2w_security/core/apps.py

@@ -0,0 +1,196 @@
+"""Installed-apps audit: side-loaded frontend code, App Hub update currency, and custom JS/CSS.
+
+Three independent signals. Side-loaded apps (installed outside the App Hub, so carrying no
+`app_hub_id`) run untrusted frontend code and are flagged without needing the hub. Update currency
+compares each hub-backed app against the App Hub catalog and is skipped entirely when the hub is
+unreachable, so an App Hub outage never reads as "every app is untrusted". Custom JavaScript or CSS
+configured through the `keyCustomJs` / `keyCustomCss` system settings injects code into every
+operator session and is persistent XSS in the hands of anyone who can write those settings.
+"""
+
+from __future__ import annotations
+
+from pydantic import BaseModel, ConfigDict
+
+from dhis2w_security.core.controls import CheckOutcome, ControlLog
+from dhis2w_security.core.findings import AuditFinding, Severity
+
+_CHECK = "apps"
+
+
+class InstalledApp(BaseModel):
+    """One installed DHIS2 app with the fields the apps audit reasons over."""
+
+    model_config = ConfigDict(frozen=True)
+
+    name: str
+    version: str | None = None
+    app_hub_id: str | None = None
+    bundled: bool = False
+    core_app: bool = False
+
+
+class HubApp(BaseModel):
+    """One App Hub catalog entry: its hub id and the version strings published for it."""
+
+    model_config = ConfigDict(frozen=True)
+
+    app_hub_id: str
+    versions: list[str] = []
+
+
+def evaluate_apps(
+    *,
+    installed: list[InstalledApp],
+    hub: list[HubApp] | None,
+    custom_js: bool,
+    custom_css: bool,
+) -> CheckOutcome:
+    """Record the app controls (side-loaded, hub update, custom JS/CSS), flagging each that trips.
+
+    `hub=None` means the App Hub was unreachable, so update currency is skipped this run; the
+    side-loaded and custom-code signals do not need the hub.
+    """
+    log = ControlLog(_CHECK)
+    log.mark_passed("apps-side-loaded", "apps-custom-js", "apps-custom-css")
+    if hub is None:
+        log.mark_skipped("apps-update-available", "App Hub unreachable")
+    else:
+        log.mark_passed("apps-update-available")
+    for finding in _side_loaded_findings(installed):
+        log.record(finding)
+    if hub is not None:
+        for finding in _update_findings(installed, hub):
+            log.record(finding)
+    for finding in _custom_code_findings(custom_js=custom_js, custom_css=custom_css):
+        log.record(finding)
+    return log.result()
+
+
+def _side_loaded_findings(installed: list[InstalledApp]) -> list[AuditFinding]:
+    """Flag each non-bundled app installed outside the App Hub as untrusted side-loaded code."""
+    findings: list[AuditFinding] = []
+    for app in installed:
+        if app.bundled or app.core_app or app.app_hub_id:
+            continue
+        findings.append(
+            AuditFinding(
+                check=_CHECK,
+                severity=Severity.HIGH,
+                title="Side-loaded app installed",
+                detail=(
+                    f"App '{app.name}' was installed outside the App Hub (no app hub id); side-loaded "
+                    "frontend code is untrusted and runs as every operator who opens it."
+                ),
+                subject=app.name,
+                group_key="side-loaded-app",
+                evidence={"app": app.name, "version": app.version or "unknown"},
+                control="apps-side-loaded",
+            )
+        )
+    return findings
+
+
+def _update_findings(installed: list[InstalledApp], hub: list[HubApp]) -> list[AuditFinding]:
+    """Flag each hub-backed app whose installed version is behind the App Hub's latest."""
+    latest_by_id = {entry.app_hub_id: _latest(entry.versions) for entry in hub}
+    findings: list[AuditFinding] = []
+    for app in installed:
+        if not app.app_hub_id:
+            continue
+        latest = latest_by_id.get(app.app_hub_id)
+        if latest is None or not _is_newer(latest, app.version):
+            continue
+        findings.append(
+            AuditFinding(
+                check=_CHECK,
+                severity=Severity.MEDIUM,
+                title="App update available",
+                detail=(
+                    f"App '{app.name}' is at {app.version or 'unknown'}; the App Hub has {latest}. "
+                    "App updates often carry security fixes."
+                ),
+                subject=app.name,
+                group_key="app-update",
+                evidence={"app": app.name, "installed": app.version or "unknown", "latest": latest},
+                control="apps-update-available",
+            )
+        )
+    return findings
+
+
+def _custom_code_findings(*, custom_js: bool, custom_css: bool) -> list[AuditFinding]:
+    """Flag configured custom JavaScript and CSS, each injected into every operator session."""
+    findings: list[AuditFinding] = []
+    if custom_js:
+        findings.append(
+            AuditFinding(
+                check=_CHECK,
+                severity=Severity.HIGH,
+                title="Custom JavaScript injected into every app",
+                detail=(
+                    "keyCustomJs is set; the configured JavaScript runs in every operator's session across "
+                    "all apps. Anyone who can write this setting holds persistent XSS over the instance."
+                ),
+                evidence={"setting": "keyCustomJs"},
+                control="apps-custom-js",
+            )
+        )
+    if custom_css:
+        findings.append(
+            AuditFinding(
+                check=_CHECK,
+                severity=Severity.HIGH,
+                title="Custom CSS injected into every app",
+                detail=(
+                    "keyCustomCss is set; the configured CSS loads in every operator's session and can "
+                    "deface the UI or exfiltrate data through crafted selectors."
+                ),
+                evidence={"setting": "keyCustomCss"},
+                control="apps-custom-css",
+            )
+        )
+    return findings
+
+
+def _latest(versions: list[str]) -> str | None:
+    """Return the highest-versioned string, or None when the list is empty."""
+    candidates = [version for version in versions if version]
+    if not candidates:
+        return None
+    return max(candidates, key=_version_key)
+
+
+def _is_newer(latest: str | None, current: str | None) -> bool:
+    """Return True when `latest` is a strictly higher version than `current`, ignoring trailing zeros."""
+    latest_key = _version_key(latest)
+    current_key = _version_key(current)
+    width = max(len(latest_key), len(current_key))
+    return _pad(latest_key, width) > _pad(current_key, width)
+
+
+def _pad(parts: tuple[int, ...], width: int) -> tuple[int, ...]:
+    """Right-pad a version tuple with zeros so 1.2 and 1.2.0 compare equal."""
+    return parts + (0,) * (width - len(parts))
+
+
+def _version_key(value: str | None) -> tuple[int, ...]:
+    """Parse a version into integer parts, ignoring a leading 'v' and any -prerelease / +build suffix.
+
+    '1.2.3' and 'v1.2.3-rc.1+build' both yield (1, 2, 3), so a hub pre-release like '1.2.4-SNAPSHOT'
+    still ranks above an installed '1.2.3'. A token with no leading digits contributes 0; a missing or
+    fully non-numeric version yields (0,). This is deliberately more tolerant than the strict-numeric
+    helper in the `apps` plugin, because the App Hub catalog carries free-form third-party versions.
+    """
+    if not value:
+        return (0,)
+    core = value.strip().lstrip("vV").split("-", 1)[0].split("+", 1)[0]
+    parts: list[int] = []
+    for token in core.split("."):
+        leading = ""
+        for char in token:
+            if not char.isdigit():
+                break
+            leading += char
+        parts.append(int(leading) if leading else 0)
+    return tuple(parts) or (0,)

dhis2w_security/core/audit_config.py

@@ -0,0 +1,147 @@
+"""Verdicts over the DHIS2 auditing posture parsed from a `dhis.conf` copy.
+
+The audit posture (the instance-wide enable flag, the file logger, the database sink, and the four
+per-scope matrices) is not exposed over any DHIS2 API; it lives only in `dhis.conf`. The reducer therefore
+has two modes driven by `AuditPosture.parsed`: when `parsed` is False (no `--dhis-conf` supplied) it emits a
+single INFO stating the posture is not API-readable; never "auditing is off". When a `dhis.conf` copy was
+parsed it reports each weak channel: the master switch off, both sinks off, and an explicitly-configured
+matrix that is narrower than the DHIS2 default {CREATE, UPDATE, DELETE, SECURITY}.
+
+The DHIS2 default (absent or empty matrix key) gives every scope {CREATE, UPDATE, DELETE, SECURITY}, so a
+freshly-deployed instance with NO audit.* config is already audited on all change types. Only an EXPLICIT
+matrix that omits one or more forensic types relative to the default is flagged as narrowly scoped. A scope
+whose matrix is set to DISABLED (empty type set) is also flagged because it explicitly turns off a scope that
+would otherwise be audited by default. See BUGS.md #54 for the upstream behaviour reference.
+"""
+
+from __future__ import annotations
+
+from dhis2w_security.core.controls import CheckOutcome, ControlLog
+from dhis2w_security.core.dhisconf import _FORENSIC_AUDIT_TYPES, AuditPosture
+from dhis2w_security.core.findings import AuditFinding, Severity
+
+_CHECK = "audit-config"
+
+
+def evaluate_audit_config(posture: AuditPosture) -> CheckOutcome:
+    """Turn an audit posture into a CheckOutcome: the API-only INFO, or the parsed-posture weak-channel verdicts."""
+    log = ControlLog(_CHECK)
+    if not posture.parsed:
+        log.record(_api_only_finding())
+        log.mark_skipped("audit-config-system-disabled", "dhis.conf not provided")
+        log.mark_skipped("audit-config-both-sinks-off", "dhis.conf not provided")
+        log.mark_skipped("audit-config-narrow-scope", "dhis.conf not provided")
+        return log.result()
+    if posture.system_enabled is False:
+        log.record(_system_disabled_finding())
+        log.mark_skipped("audit-config-both-sinks-off", "auditing disabled instance-wide")
+        log.mark_skipped("audit-config-narrow-scope", "auditing disabled instance-wide")
+        return log.result()
+    log.mark_passed("audit-config-system-disabled")
+    if not posture.logger_enabled and not posture.database_enabled:
+        log.record(_both_sinks_off_finding())
+    else:
+        log.mark_passed("audit-config-both-sinks-off")
+    scope_findings = _scope_findings(posture)
+    for finding in scope_findings:
+        log.record(finding)
+    if not scope_findings:
+        log.mark_passed("audit-config-narrow-scope")
+    return log.result()
+
+
+def _scope_findings(posture: AuditPosture) -> list[AuditFinding]:
+    """Scope-coverage findings: only explicit matrices that are narrower than the DHIS2 forensic default are flagged.
+
+    An absent or blank matrix key receives the DHIS2 default {CREATE, UPDATE, DELETE, SECURITY} and is
+    healthy. Only scopes where the operator supplied an EXPLICIT matrix (explicit=True) that omits one or
+    more of the forensic types are reported, including a DISABLED scope (empty type set).
+    """
+    narrow = _narrowly_scoped(posture)
+    if narrow:
+        return [_narrowly_scoped_finding(narrow=narrow)]
+    return []
+
+
+def _narrowly_scoped(posture: AuditPosture) -> dict[str, tuple[str, ...]]:
+    """Map each EXPLICITLY-configured scope to the forensic audit types it omits vs. the DHIS2 default.
+
+    Scopes without an explicit matrix (explicit=False) receive the DHIS2 default and are not reported.
+    An explicitly-DISABLED scope omits all four forensic types.
+    """
+    narrow: dict[str, tuple[str, ...]] = {}
+    for scope in posture.scopes:
+        if not scope.explicit:
+            # No explicit matrix: DHIS2 applies its default, not a narrowing.
+            continue
+        missing = tuple(audit_type for audit_type in _FORENSIC_AUDIT_TYPES if audit_type not in scope.audit_types)
+        if missing:
+            narrow[scope.scope] = missing
+    return narrow
+
+
+def _api_only_finding() -> AuditFinding:
+    """INFO: the audit posture is not API-readable; re-run with `--dhis-conf` on the server host."""
+    return AuditFinding(
+        check=_CHECK,
+        severity=Severity.INFO,
+        title="Audit configuration is not API-readable",
+        detail=(
+            "DHIS2 does not expose its audit configuration over the API; the audit.* keys live only in "
+            "dhis.conf. This check could not read the audit posture remotely; this is a property of DHIS2, "
+            "not a statement that auditing is off. Re-run with --dhis-conf <path> pointed at a copy of the "
+            "server's dhis.conf to evaluate the file logger, the database sink, and the per-scope matrices."
+        ),
+        group_key="audit-config-api-only",
+        evidence={"api_readable": "false"},
+    )
+
+
+def _system_disabled_finding() -> AuditFinding:
+    """MEDIUM: system.audit.enabled is off, so no audit events are recorded regardless of the matrices."""
+    return AuditFinding(
+        check=_CHECK,
+        severity=Severity.MEDIUM,
+        title="Auditing is disabled instance-wide",
+        detail=(
+            "system.audit.enabled is off, so auditing is disabled instance-wide regardless of the per-scope "
+            "matrices. No CREATE/UPDATE/DELETE/READ/SECURITY events are recorded; there is no forensic trail."
+        ),
+        group_key="audit-system-disabled",
+        evidence={"system.audit.enabled": "off"},
+        control="audit-config-system-disabled",
+    )
+
+
+def _both_sinks_off_finding() -> AuditFinding:
+    """MEDIUM: both the file logger and the database sink are off, so audit events have nowhere to land."""
+    return AuditFinding(
+        check=_CHECK,
+        severity=Severity.MEDIUM,
+        title="Both audit sinks are off",
+        detail=(
+            "audit.logger is off and audit.database is off, so audit events have nowhere to land. Enable at "
+            "least the file logger or the database sink."
+        ),
+        group_key="audit-logger-and-database-both-off",
+        evidence={"audit.logger": "off", "audit.database": "off"},
+        control="audit-config-both-sinks-off",
+    )
+
+
+def _narrowly_scoped_finding(*, narrow: dict[str, tuple[str, ...]]) -> AuditFinding:
+    """MEDIUM: an explicitly-configured matrix is narrower than the DHIS2 forensic default."""
+    narrow_text = "; ".join(f"{scope} omits {', '.join(missing)}" for scope, missing in narrow.items())
+    return AuditFinding(
+        check=_CHECK,
+        severity=Severity.MEDIUM,
+        title="Audit scope coverage is narrower than the DHIS2 default",
+        detail=(
+            "DHIS2 applies {CREATE, UPDATE, DELETE, SECURITY} to every scope by default. One or more "
+            "explicitly-configured matrices narrow below that baseline, reducing the forensic trail. "
+            f"Scopes with explicit narrowing: {narrow_text}."
+        ),
+        group_key="audit-scope-narrowly-scoped",
+        evidence={"narrow_matrices": narrow_text},
+        control="audit-config-narrow-scope",
+    )