openhound-github 0.2.0__tar.gz → 0.3.0__tar.gz

{openhound_github-0.2.0 → openhound_github-0.3.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: openhound-github
-Version: 0.2.0
+Version: 0.3.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
 Requires-Python: >=3.13
-Requires-Dist: cryptography>=46.0.6
+Requires-Dist: joserfc>=1.6.5
 Requires-Dist: requests>=2.33.0
 Description-Content-Type: text/markdown
 

{openhound_github-0.2.0 → openhound_github-0.3.0}/extension/schema.json

@@ -6,6 +6,38 @@
     "namespace": "GH"
   },
   "node_kinds": [
+    {
+      "name": "GH_Enterprise",
+      "display_name": "GitHub Enterprise",
+      "description": "A GitHub Enterprise account that contains organizations, enterprise teams, roles, and managed users",
+      "is_display_kind": true,
+      "icon": "globe",
+      "color": "#6EA8FE"
+    },
+    {
+      "name": "GH_EnterpriseTeam",
+      "display_name": "GitHub Enterprise Team",
+      "description": "A team managed at the GitHub Enterprise level and assignable across organizations",
+      "is_display_kind": true,
+      "icon": "users-between-lines",
+      "color": "#9B8CFF"
+    },
+    {
+      "name": "GH_EnterpriseRole",
+      "display_name": "GitHub Enterprise Role",
+      "description": "The role a user or team has at the GitHub Enterprise level",
+      "is_display_kind": true,
+      "icon": "user-tie",
+      "color": "#B8D7FF"
+    },
+    {
+      "name": "GH_EnterpriseManagedUser",
+      "display_name": "GitHub Enterprise Managed User",
+      "description": "A GitHub Enterprise managed user account linked to an enterprise identity provider",
+      "is_display_kind": true,
+      "icon": "user-lock",
+      "color": "#7DD3FC"
+    },
     {
       "name": "GH_Organization",
       "display_name": "GitHub Organization",
@@ -150,6 +182,30 @@
       "icon": "lock-open",
       "color": "#E89B5C"
     },
+    {
+      "name": "GH_RunnerGroup",
+      "display_name": "GitHub Runner Group",
+      "description": "A GitHub self-hosted runner group that controls runner access and visibility",
+      "is_display_kind": true,
+      "icon": "server",
+      "color": "#94A3B8"
+    },
+    {
+      "name": "GH_OrgRunner",
+      "display_name": "GitHub Org Runner",
+      "description": "An organization-scoped GitHub self-hosted runner available to selected repositories or workflows",
+      "is_display_kind": true,
+      "icon": "microchip",
+      "color": "#22C55E"
+    },
+    {
+      "name": "GH_RepoRunner",
+      "display_name": "GitHub Repo Runner",
+      "description": "A repository-scoped GitHub self-hosted runner available to jobs in a single repository",
+      "is_display_kind": true,
+      "icon": "microchip",
+      "color": "#38BDF8"
+    },
     {
       "name": "GH_EnvironmentVariable",
       "display_name": "GitHub Environment Variable",

openhound_github-0.3.0/justfile

@@ -0,0 +1,17 @@
+set dotenv-load := true
+
+collect +args='github /tmp/output/raw/':
+    @echo "Collecting data"
+    uv run src/main.py collect {{args}}
+
+preprocess +args='github /tmp/output/raw/github':
+    @echo "Preprocessing data"
+    uv run openhound preprocess {{args}}
+
+convert +args='github /tmp/output/raw/github /tmp/output/graph/github':
+    @echo "Converting data"
+    uv run openhound convert {{args}}
+
+sync:
+    @echo "Syncing dependencies"
+    uv sync --group dev

{openhound_github-0.2.0 → openhound_github-0.3.0}/pyproject.toml

@@ -5,7 +5,7 @@ description = "Github collector for OpenHound"
 readme = "README.md"
 requires-python = ">=3.13"
 dependencies = [
-    "cryptography>=46.0.6",
+    "joserfc>=1.6.5",
     "requests>=2.33.0",
 ]
 authors = [
@@ -28,7 +28,7 @@ local_scheme = "no-local-version"
 
 [dependency-groups]
 dev = [
-    "openhound",
+    "openhound==0.1.4",
     "pre-commit>=4.5.1",
     "pytest>=9.0.1",
     "ruff>=0.15.5",

openhound_github-0.3.0/src/openhound_github/auth.py

@@ -0,0 +1,182 @@
+import logging
+from datetime import datetime, timedelta, timezone
+from threading import Lock
+from typing import Iterator
+
+import requests
+from dlt.common.configuration import configspec
+from dlt.sources.helpers.rest_client.auth import AuthConfigBase
+from dlt.sources.helpers.rest_client.client import RESTClient
+from dlt.sources.helpers.rest_client.paginators import (
+    HeaderLinkPaginator,
+)
+from joserfc import jwt
+from joserfc.jwk import RSAKey
+from pydantic import BaseModel
+
+logger = logging.getLogger(__name__)
+
+
+class AccountConfig(BaseModel):
+    id: int
+    login: str | None = None
+    name: str | None = None
+    type: str | None = None
+    slug: str | None = None
+
+
+class InstallationResponse(BaseModel):
+    id: int
+    client_id: str
+    account: AccountConfig
+    target_type: str
+    app_id: int | None = None
+    app_slug: str | None = None
+
+
+class TokenResponse(BaseModel):
+    token: str
+    expires_at: datetime
+
+
+class GithubSession:
+    def __init__(
+        self,
+        client_id: str,
+        private_key_path: str,
+        api_uri: str = "https://api.github.com/",
+    ):
+        self.api_uri = api_uri
+        self.client_id = client_id
+        self.private_key_path = private_key_path
+        self.client = RESTClient(
+            base_url=self.api_uri,
+            paginator=HeaderLinkPaginator(),
+        )
+
+    @property
+    def jwt(self) -> str:
+        now_utc = datetime.now(timezone.utc).timestamp()
+        header = {"alg": "RS256", "typ": "JWT"}
+        claims = {
+            "iss": self.client_id,
+            "iat": int(now_utc - 10),  # Issued 10 seconds in the past
+            "exp": int(now_utc + 540),  # Expires in 9 minutes (GitHub max is 10, leaving room for clock drift)
+        }
+
+        try:
+            with open(self.private_key_path, "rb") as key_file:
+                key = RSAKey.import_key(key_file.read())
+                text = jwt.encode(header, claims, key)
+                return text
+
+        except Exception as e:
+            raise ValueError(f"Failed to load private key: {e}") from e
+
+    @property
+    def jwt_headers(self) -> dict:
+        return {
+            "Accept": "application/vnd.github+json",
+            "Authorization": f"Bearer {self.jwt}",
+            "X-GitHub-Api-Version": "2022-11-28",
+        }
+
+
+class GithubInstallation(GithubSession):
+    def __init__(
+        self,
+        installation_id: str,
+        client_id: str,
+        private_key_path: str,
+        api_uri: str = "https://api.github.com/",
+    ):
+        self.installation_id = installation_id
+        super().__init__(client_id, private_key_path, api_uri)
+
+    @property
+    def token(self) -> TokenResponse:
+        logger.info(f"Getting access token for {self.installation_id}")
+        response = self.client.post(
+            f"{self.api_uri}app/installations/{self.installation_id}/access_tokens",
+            timeout=10,
+            headers=self.jwt_headers,
+        )
+        response.raise_for_status()
+        return TokenResponse(**response.json())
+
+
+class GithubApp(GithubSession):
+    def __init__(
+        self,
+        client_id: str,
+        private_key_path: str,
+        api_uri: str = "https://api.github.com/",
+    ):
+        self.client_id = client_id
+        self.private_key_path = private_key_path
+        self.api_uri = api_uri
+        super().__init__(client_id, private_key_path, api_uri)
+
+    @property
+    def installations(self) -> Iterator[InstallationResponse]:
+        for page in self.client.paginate(
+            "/app/installations", params={"per_page": 100}, headers=self.jwt_headers
+        ):
+            for item in page:
+                yield InstallationResponse(**item)
+
+    def install_id_for_org(self, org_login: str) -> int:
+        logger.info(f"Getting app installation ID for org {org_login}")
+        response = self.client.get(
+            f"/orgs/{org_login}/installation", headers=self.jwt_headers
+        )
+        response.raise_for_status()
+        return int(response.json()["id"])
+
+
+@configspec
+class GitHubAppInstallationAuth(AuthConfigBase):
+    """Requests auth that refreshes GitHub App installation tokens as needed."""
+
+    def __init__(
+        self,
+        installation: GithubInstallation,
+        refresh_margin_seconds: int = 300,
+    ):
+        self.installation = installation
+        self.refresh_margin_seconds = refresh_margin_seconds
+        self.access_token: str | None = None
+        self.expires_at: datetime | None = None
+        self._token_lock = Lock()
+
+    def _should_refresh(self) -> bool:
+        if self.expires_at is None:
+            return True
+
+        refresh_at = self.expires_at - timedelta(seconds=self.refresh_margin_seconds)
+        return datetime.now(timezone.utc) >= refresh_at
+
+    def token(self, force_refresh: bool = False) -> str | None:
+        if (
+            not force_refresh
+            and self.access_token is not None
+            and not self._should_refresh()
+        ):
+            return self.access_token
+
+        with self._token_lock:
+            if (force_refresh or self._should_refresh()) or self.access_token is None:
+                logger.info(
+                    f"Refreshing access token for {self.installation.installation_id}"
+                )
+                get_token = self.installation.token
+                self.access_token = get_token.token
+                self.expires_at = get_token.expires_at
+
+        return self.access_token
+
+    def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        request.headers["Authorization"] = f"Bearer {self.token()}"
+        return request
+
+    #