entrascope 0.1.0__tar.gz

entrascope-0.1.0/.gitignore

@@ -0,0 +1,218 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml

entrascope-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dejan Gregor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

entrascope-0.1.0/PKG-INFO

@@ -0,0 +1,271 @@
+Metadata-Version: 2.5
+Name: entrascope
+Version: 0.1.0
+Summary: Observability over Microsoft Entra ID and Azure Monitor logs for diagnosing application authentication and authorisation failures.
+Project-URL: Homepage, https://github.com/SCGIS-Wales/entrascope
+Project-URL: Repository, https://github.com/SCGIS-Wales/entrascope
+Project-URL: Issues, https://github.com/SCGIS-Wales/entrascope/issues
+Author: Dejan Gregor
+License-Expression: MIT
+License-File: LICENSE
+Keywords: azure,entra,mcp,oauth,observability
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.14
+Requires-Dist: azure-identity>=1.25.3
+Requires-Dist: azure-monitor-query>=2.0.0
+Requires-Dist: click>=8.4.0
+Requires-Dist: fastmcp>=3.4.7
+Requires-Dist: pydantic>=2.13.0
+Requires-Dist: pyjwt[crypto]>=2.13.0
+Requires-Dist: pyyaml>=6.0.2
+Requires-Dist: requests>=2.32.0
+Requires-Dist: rich>=14.0.0
+Requires-Dist: urllib3>=2.0.0
+Provides-Extra: dev
+Requires-Dist: mypy>=1.14.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24.0; extra == 'dev'
+Requires-Dist: pytest-cov>=6.0.0; extra == 'dev'
+Requires-Dist: pytest-timeout>=2.3.0; extra == 'dev'
+Requires-Dist: pytest>=8.3.0; extra == 'dev'
+Requires-Dist: responses>=0.26.0; extra == 'dev'
+Requires-Dist: ruff>=0.9.0; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0.12; extra == 'dev'
+Requires-Dist: types-requests>=2.32.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# entrascope
+
+Observability and diagnostics for Microsoft Entra ID and Azure Monitor, helping
+engineers troubleshoot authentication and authorisation failures.
+
+> Entra directory operations do not appear in the Azure subscription activity
+> log. They are recorded in the Entra audit logs, under the category
+> ApplicationManagement. entrascope reads them through Microsoft Graph and
+> through Azure Monitor.
+
+[![CI](https://github.com/SCGIS-Wales/entrascope/actions/workflows/ci.yml/badge.svg)](https://github.com/SCGIS-Wales/entrascope/actions/workflows/ci.yml)
+[![Python](https://img.shields.io/badge/python-3.14-blue)](https://www.python.org/downloads/)
+[![Licence](https://img.shields.io/badge/licence-MIT-green)](LICENSE)
+
+## What it does
+
+- **Discovery.** Enumerate application registrations and enterprise
+  applications of every type, and project sign in audience, redirect URIs,
+  requested and granted permissions, owners, credentials and their expiry,
+  federated identity credentials, SAML configuration and the assignment
+  requirement.
+- **Log interrogation.** Read Entra audit logs, interactive and non interactive
+  user sign ins, service principal and managed identity sign ins, Microsoft
+  Graph activity and provisioning logs.
+- **Capability detection.** Report when the logging you need is not enabled,
+  which licence tier it requires and how to switch it on.
+- **Error explanation.** Map AADSTS and Microsoft Graph error codes to meaning,
+  likely cause and remediation.
+
+## Three surfaces, one core
+
+| Surface | Transport | Authentication |
+| --- | --- | --- |
+| Command line | local | credential file, environment, Azure CLI or DefaultAzureCredential |
+| Local MCP server | stdio | the same, no OAuth |
+| Remote MCP server | Streamable HTTP | OAuth 2.1 resource server validating Entra tokens |
+
+## Installation
+
+```bash
+pip install entrascope
+```
+
+From a clone, for development:
+
+```bash
+python3.14 -m venv .venv && .venv/bin/pip install -e ".[dev]"
+```
+
+## Authentication
+
+The quickest route needs nothing but an Azure CLI session:
+
+```bash
+az login
+entrascope doctor --auth azure-cli
+```
+
+For unattended use, place client credentials at
+`~/.entra/provisioner-credentials.json` with the keys `ClientID`, `Secret` and
+`TenantID`. The file must be mode 0600 inside a directory of mode 0700, and
+entrascope refuses to run otherwise.
+
+## Using it
+
+Run `entrascope` with no arguments and it tells you what it can do. Every group
+and every command carries its own help and worked examples, so `--help` is
+always the next step.
+
+### Terminology, used the same way throughout
+
+| Term | Meaning |
+| --- | --- |
+| application registration | what you register in Entra, the definition |
+| enterprise application | the service principal, the instance in a tenant |
+| delegated permission | acts as a signed in person, a `scp` claim |
+| application permission | acts as itself, a `roles` claim |
+
+### Diagnosing a failure
+
+Start wide, then narrow. `investigate` gathers credentials, directory changes
+and sign in failures, applies a set of rules and ranks what it finds worst
+first, with the remediation for each.
+
+```bash
+entrascope doctor                          # can entrascope see what it needs
+entrascope investigate                     # what is wrong in this tenant
+entrascope investigate --severity error    # only what is already broken
+entrascope investigate my-api              # narrow to one application
+entrascope investigate my-api --full       # and show the evidence behind it
+```
+
+The argument to `investigate` is an application id, an object id or part of a
+display name, whichever the error message gave you. The same value works as
+`--app` on every other command. Findings are ranked **error** for something
+already broken, **warning** for something that will break, and **note** for the
+context that explains a result.
+
+### Looking at one thing at a time
+
+```bash
+entrascope discover applications --expiring          # credentials about to expire
+entrascope discover applications --type single-page-application
+entrascope discover enterprise-apps --type managed-identity
+entrascope discover applications --app my-api --output json
+
+entrascope logs audit --failures-only                # failed directory changes
+entrascope logs audit --app my-api
+entrascope logs signins --kind service-principal --failures-only
+entrascope logs signins --app my-api --hours 6
+entrascope logs graph-activity --workspace <workspace-id>
+entrascope logs kinds                                # which sign in kinds exist
+
+entrascope errors explain AADSTS7000215
+entrascope errors explain "AADSTS50011: The redirect URI does not match"
+entrascope errors search consent
+entrascope errors list
+```
+
+`discover apps` and `discover sps` still work as short forms.
+
+### Reading the same data two ways
+
+Audit events and sign ins can be answered by Microsoft Graph or by Azure
+Monitor, and both return the same fields.
+
+```bash
+entrascope logs audit --route graph                        # any tenant
+entrascope logs audit --route monitor --workspace <id>     # longer retention
+```
+
+The Graph route needs only the right permission. The Monitor route needs a
+diagnostic setting and the Log Analytics Reader role, and gives longer
+retention. Microsoft Graph activity exists only through Azure Monitor. Sign in
+logs of any kind need an Entra ID P1 or P2 licence; audit logs do not.
+
+### Output and identity
+
+`--output json` and `--output yaml` work on every command and are quiet, so the
+output can be piped straight into another tool. `--auth` chooses the identity:
+`file`, `env`, `azure-cli` or `default`. `errors explain`, `errors list` and
+`errors search` need no credentials at all, because the mapping is
+configuration.
+
+## As an MCP server
+
+```bash
+entrascope serve stdio
+```
+
+Register it with an assistant that speaks the Model Context Protocol. stdio has
+no OAuth, so credentials come from the environment or the credential file
+exactly as they do for every other command, and the server runs with your
+privileges. Every tool reads. None of them changes the directory.
+
+The tool surface mirrors the commands: `doctor`, `discover_applications`,
+`discover_service_principals`, `audit_events`, `sign_ins`, `graph_activity`,
+`explain_error`, `list_error_codes` and `sign_in_kinds`. A tool result and the
+corresponding `--output json` payload are the same bytes, which a test
+enforces.
+
+### As a remote server
+
+```bash
+entrascope serve http --host 0.0.0.0 --port 8000
+```
+
+An OAuth 2.1 protected resource validating Entra issued bearer tokens.
+Terminate TLS at a reverse proxy and set `ENTRASCOPE_BASE_URL` to the canonical
+https URI, which appears in the protected resource metadata and which clients
+bind their tokens to. Set `ENTRASCOPE_TENANT_ID` and `ENTRASCOPE_CLIENT_ID` for
+the application registration this server presents.
+
+The audience must equal the application id URI, a token issued for anything
+else is refused, and the caller's token is never forwarded to Microsoft Graph:
+Graph is called with the server's own credentials, because the data is tenant
+scoped rather than caller scoped.
+
+A container image is built from the `Dockerfile`, running as a non root user on
+`python:3.14-slim`.
+
+## Corporate networks
+
+entrascope honours a forward web proxy from `HTTPS_PROXY`, `HTTP_PROXY`,
+`ALL_PROXY` and `NO_PROXY`, and verifies TLS against a private certificate
+authority named in `ENTRASCOPE_CA_BUNDLE`, `REQUESTS_CA_BUNDLE`,
+`SSL_CERT_FILE`, `CURL_CA_BUNDLE` or the `SSL_CERT_DIR` directory. The same
+trust reaches the token endpoint and Azure Monitor. Run `entrascope doctor` to
+see exactly which proxy and which certificate authority are in force.
+
+## Documentation
+
+Steering documents live in [docs/steering](docs/steering):
+[product](docs/steering/product.md),
+[technology stack](docs/steering/tech-stack.md),
+[repository structure](docs/steering/repo-structure.md),
+[coding standards](docs/steering/coding-standards.md),
+[configuration](docs/steering/configuration.md),
+[credentials and security](docs/steering/credentials-and-security.md),
+[Graph and Monitor](docs/steering/graph-and-monitor.md),
+[MCP server](docs/steering/mcp-server.md),
+[testing strategy](docs/steering/testing-strategy.md),
+[release and publishing](docs/steering/release-and-publishing.md) and the
+[phased task plan](docs/steering/tasks.md).
+
+## Contributing
+
+One change is one pull request, and every check must pass before it merges. The
+gate is `ruff check`, `ruff format --check`, `mypy --strict src` and `pytest`,
+plus five structural guards: no endpoint or table name written into code, no
+class without a framework contract comment, no secret in any output, one HTTP
+stack, one logger.
+
+```bash
+python3.14 -m venv .venv
+.venv/bin/pip install -e ".[dev]"
+.venv/bin/ruff check src/ tests/ && .venv/bin/mypy --strict src && .venv/bin/pytest
+```
+
+The rules the code follows, and why, are in
+[docs/steering](docs/steering). Read
+[coding-standards.md](docs/steering/coding-standards.md) first.
+
+## Security
+
+Reporting a vulnerability, what entrascope does with credentials, and the rules
+the remote server holds to: [SECURITY.md](SECURITY.md).
+
+## Licence
+
+MIT. See [LICENSE](LICENSE).