openhound-github 0.22.0__tar.gz → 0.23.0__tar.gz

{openhound_github-0.22.0 → openhound_github-0.23.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.22.0
+Version: 0.23.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -45,6 +45,12 @@ The openhound-github extension collects resources from Github organizations and
 edges for
 BloodHound.
 
+### Version 0.23.0
+
+This release adds enterprise OIDC providers and external identities, collects the
+authenticating GitHub App's enterprise installation metadata, and corrects Tier
+Zero role matching and expired-token filtering.
+
 ### GitHub App JWT issuer
 
 Enterprise GitHub App credentials accept either `client_id` or `app_id` as the
@@ -66,14 +72,59 @@ Both values must be provided together when overriding the GitHub.com defaults.
 Endpoint URLs must use HTTPS and share the same origin. GitHub App
 `credentials.api_uri` may override only the path on that same origin.
 
+### Request timeouts and retries
+
+REST and GraphQL collection requests use a 10-second connection timeout and a
+30-second read timeout. Transient HTTP 5xx errors, connection failures, and
+timeouts share a limit of three attempts (the initial attempt plus two retries).
+Adaptive GraphQL pagination shares that limit across page sizes: HTTP 502/504
+responses trigger smaller-page attempts instead of a new retry budget.
+
+After retries are exhausted, existing resource handlers log the failure and
+continue with unaffected scopes. Already emitted records are retained, but the
+affected scope may be incomplete. Resources that require all pages before
+emitting records retain that behavior.
+
+Workflow collection skips `dynamic/` paths. Missing workflow files are logged
+and skipped without passing failed items to job or step parsing.
+
+Rate-limit responses and GitHub App token refresh retain their existing retry
+handling and do not consume the transient-failure budget. These timeouts are
+not an overall request deadline. App authentication requests and credential
+inventory CSV downloads retain their separate timeout settings.
+
 ### Enterprise SCIM and hybrid correlations
 
 A token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
 
 `SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true` temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
 
+In enterprise app authentication mode, the collector separately retrieves its own enterprise installation for configuration troubleshooting, including granted permissions, timestamps, and suspension status. It also retrieves the parent app's requested permissions and owner metadata using the enterprise installation token. This does not enumerate other enterprise-target app installations or imply organization/repository access. App and installation records use `environment_slug` for the organization login or enterprise slug. Installations also retain `target_type` to distinguish targets; older collected records remain compatible. Existing DLT app schemas are migrated to allow empty legacy `org_login` fields and absent `repository_selection`. A load already stuck in normalization retains its saved schema and needs recovery or restart; do not delete the pipeline or collected output to apply this change.
+
 Enterprise roles, including the built-in `members` role, are emitted through `GH_HasRole` and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as `GH_WriteEnterpriseSso` remain non-traversable.
 
+### Enterprise OIDC collection
+
+A supplemental classic PAT owned by an enterprise owner with `read:enterprise`
+enables discovery of `enterprise.ownerInfo.oidcProvider`. The collector stores
+provider metadata in `oidc_provider` and emits `GH_OidcIdentityProvider` with
+`provider_type` and `tenant_id`, linked to the enterprise through the
+non-traversable `GH_HasOidcIdentityProvider` relationship.
+
+SAML and OIDC providers both carry the secondary kind `GH_IdentityProvider`.
+Provider queries run independently, so an unavailable OIDC field or denied
+request does not prevent existing SAML collection. An absent OIDC provider is
+logged separately from query failures.
+
+External identities from both enterprise provider types are paginated into the
+existing `external_identities` table. Conversion resolves their provider through
+the SAML and OIDC metadata tables and emits `GH_HasExternalIdentity` and, when a
+linked user exists, `GH_MapsToUser`. These edges remain non-traversable. Nullable
+identity attributes and unlinked identities are retained. OIDC identities do not
+produce SAML account relationships. If provider lookup is missing or ambiguous,
+conversion omits the provider edge while preserving the identity and user mapping;
+ambiguous matches are logged.
+
 ### Optional privileged collection
 
 The collector runs successfully with the documented read-only permission set. Some higher-fidelity relationships require optional non-read-only permissions because GitHub exposes the supporting read APIs behind privileged permission names:

{openhound_github-0.22.0 → openhound_github-0.23.0}/README.md

@@ -34,6 +34,12 @@ The openhound-github extension collects resources from Github organizations and
 edges for
 BloodHound.
 
+### Version 0.23.0
+
+This release adds enterprise OIDC providers and external identities, collects the
+authenticating GitHub App's enterprise installation metadata, and corrects Tier
+Zero role matching and expired-token filtering.
+
 ### GitHub App JWT issuer
 
 Enterprise GitHub App credentials accept either `client_id` or `app_id` as the
@@ -55,14 +61,59 @@ Both values must be provided together when overriding the GitHub.com defaults.
 Endpoint URLs must use HTTPS and share the same origin. GitHub App
 `credentials.api_uri` may override only the path on that same origin.
 
+### Request timeouts and retries
+
+REST and GraphQL collection requests use a 10-second connection timeout and a
+30-second read timeout. Transient HTTP 5xx errors, connection failures, and
+timeouts share a limit of three attempts (the initial attempt plus two retries).
+Adaptive GraphQL pagination shares that limit across page sizes: HTTP 502/504
+responses trigger smaller-page attempts instead of a new retry budget.
+
+After retries are exhausted, existing resource handlers log the failure and
+continue with unaffected scopes. Already emitted records are retained, but the
+affected scope may be incomplete. Resources that require all pages before
+emitting records retain that behavior.
+
+Workflow collection skips `dynamic/` paths. Missing workflow files are logged
+and skipped without passing failed items to job or step parsing.
+
+Rate-limit responses and GitHub App token refresh retain their existing retry
+handling and do not consume the transient-failure budget. These timeouts are
+not an overall request deadline. App authentication requests and credential
+inventory CSV downloads retain their separate timeout settings.
+
 ### Enterprise SCIM and hybrid correlations
 
 A token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
 
 `SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true` temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
 
+In enterprise app authentication mode, the collector separately retrieves its own enterprise installation for configuration troubleshooting, including granted permissions, timestamps, and suspension status. It also retrieves the parent app's requested permissions and owner metadata using the enterprise installation token. This does not enumerate other enterprise-target app installations or imply organization/repository access. App and installation records use `environment_slug` for the organization login or enterprise slug. Installations also retain `target_type` to distinguish targets; older collected records remain compatible. Existing DLT app schemas are migrated to allow empty legacy `org_login` fields and absent `repository_selection`. A load already stuck in normalization retains its saved schema and needs recovery or restart; do not delete the pipeline or collected output to apply this change.
+
 Enterprise roles, including the built-in `members` role, are emitted through `GH_HasRole` and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as `GH_WriteEnterpriseSso` remain non-traversable.
 
+### Enterprise OIDC collection
+
+A supplemental classic PAT owned by an enterprise owner with `read:enterprise`
+enables discovery of `enterprise.ownerInfo.oidcProvider`. The collector stores
+provider metadata in `oidc_provider` and emits `GH_OidcIdentityProvider` with
+`provider_type` and `tenant_id`, linked to the enterprise through the
+non-traversable `GH_HasOidcIdentityProvider` relationship.
+
+SAML and OIDC providers both carry the secondary kind `GH_IdentityProvider`.
+Provider queries run independently, so an unavailable OIDC field or denied
+request does not prevent existing SAML collection. An absent OIDC provider is
+logged separately from query failures.
+
+External identities from both enterprise provider types are paginated into the
+existing `external_identities` table. Conversion resolves their provider through
+the SAML and OIDC metadata tables and emits `GH_HasExternalIdentity` and, when a
+linked user exists, `GH_MapsToUser`. These edges remain non-traversable. Nullable
+identity attributes and unlinked identities are retained. OIDC identities do not
+produce SAML account relationships. If provider lookup is missing or ambiguous,
+conversion omits the provider edge while preserving the identity and user mapping;
+ambiguous matches are logged.
+
 ### Optional privileged collection
 
 The collector runs successfully with the documented read-only permission set. Some higher-fidelity relationships require optional non-read-only permissions because GitHub exposes the supporting read APIs behind privileged permission names:

{openhound_github-0.22.0 → openhound_github-0.23.0}/descriptions/edges/GH_Contains.md

@@ -2,12 +2,13 @@
 
 ## General Information
 
-The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The enterprise contains enterprise teams, roles, managed users, classic personal access tokens, runner groups, and enterprise runners through their groups. The organization serves as a top-level container for users, teams, repositories, roles, scopes, secrets, app installations, fine-grained personal access tokens, and organization runner groups. Native organization runner groups contain organization runners. Repositories contain branches, workflows, branch protection rules, environments, repo-level secrets and variables, and repository-scoped runners. Environments contain environment branch policies, environment-scoped secrets, and environment-scoped variables. This edge is created by the collector to establish the resource hierarchy and is not traversable because containment alone does not imply privilege escalation.
+The non-traversable GH_Contains edge represents structural containment within the GitHub resource hierarchy. The enterprise contains enterprise teams, roles, managed users, classic personal access tokens, the collector app installation, runner groups, and enterprise runners through their groups. The organization serves as a top-level container for users, teams, repositories, roles, scopes, secrets, app installations, fine-grained personal access tokens, and organization runner groups. Native organization runner groups contain organization runners. Repositories contain branches, workflows, branch protection rules, environments, repo-level secrets and variables, and repository-scoped runners. Environments contain environment branch policies, environment-scoped secrets, and environment-scoped variables. This edge is created by the collector to establish the resource hierarchy and is not traversable because containment alone does not imply privilege escalation.
 
 ## Edge Schema
 
 | Source | Destination | Traversable |
 | --- | --- | --- |
+| `GH_Enterprise` | `GH_AppInstallation` | `false` |
 | `GH_Enterprise` | `GH_ClassicPersonalAccessToken` | `false` |
 | `GH_Enterprise` | `GH_EnterpriseRole` | `false` |
 | `GH_Enterprise` | `GH_EnterpriseRunnerGroup` | `false` |
@@ -75,6 +76,7 @@ graph LR
     n29["GH_WorkflowJob"]
     n30["GH_WorkflowStep"]
     n0 -.->|GH_Contains| n1
+    n0 -.->|GH_Contains| n13
     n0 -.->|GH_Contains| n2
     n0 -.->|GH_Contains| n3
     n0 -.->|GH_Contains| n4

openhound_github-0.23.0/descriptions/edges/GH_HasExternalIdentity.md

@@ -0,0 +1,22 @@
+# GH_HasExternalIdentity
+
+## General Information
+
+The non-traversable GH_HasExternalIdentity edge represents the relationship between a SAML or OIDC identity provider and the external identities (SSO users) it manages. This edge links each external identity to its identity provider. External identities are a key component in cross-platform attack path analysis because they bridge the gap between corporate identity providers and GitHub user accounts via the GH_MapsToUser edge. Enumerating external identities reveals which corporate users have linked GitHub accounts and enables mapping from IdP compromise to GitHub access.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_IdentityProvider` | `GH_ExternalIdentity` | `false` |
+
+## Diagram
+
+```mermaid
+graph LR
+    n0["GH_IdentityProvider"]
+    n1["GH_ExternalIdentity"]
+    n0 -.->|GH_HasExternalIdentity| n1
+```
+
+`GH_IdentityProvider` is a shared secondary kind on SAML and OIDC providers. Provider association is resolved from collected provider metadata, without duplicating provider properties on external identity nodes.

openhound_github-0.23.0/descriptions/edges/GH_HasOidcIdentityProvider.md

@@ -0,0 +1,20 @@
+# GH_HasOidcIdentityProvider
+
+## General Information
+
+Links a GitHub Enterprise account to its configured OIDC identity provider.
+
+## Edge Schema
+
+| Source | Destination | Traversable |
+| --- | --- | --- |
+| `GH_Enterprise` | `GH_OidcIdentityProvider` | `false` |
+
+This relationship provides configuration context and does not itself represent an attack path.
+
+## Diagram
+
+```mermaid
+graph LR
+    enterprise["GH_Enterprise"] -.->|GH_HasOidcIdentityProvider| provider["GH_OidcIdentityProvider"]
+```

{openhound_github-0.22.0 → openhound_github-0.23.0}/descriptions/nodes/GH_App.md

@@ -2,9 +2,9 @@
 
 ## General Information
 
-Represents a GitHub App definition — the registered application entity. The app owner holds the private key that can generate installation access tokens for **every** GH_AppInstallation of this app. If the private key is compromised, all installations across all organizations are affected.
+Represents a GitHub App definition — the registered application entity. The app owner holds the private key that can generate installation access tokens for **every** GH_AppInstallation of this app. If the private key is compromised, all installations across all organizations and enterprises are affected.
 
-App definitions are retrieved via the public `GET /apps/{app_slug}` endpoint (no authentication required) after discovering unique app slugs from the organization's app installations.
+App definitions are retrieved via `GET /apps/{app_slug}` after discovering app slugs from organization installations or the collector app's enterprise installation. Authenticated lookup can also retrieve private/internal apps where GitHub permits access. The `permissions` property records requested app permissions; each installation separately records its granted permissions.
 
 ## Properties
 
@@ -12,6 +12,7 @@ App definitions are retrieved via the public `GET /apps/{app_slug}` endpoint (no
 | --- | --- | --- |
 | `name` | `string` | The node name used for matching and display. |
 | `displayname` | `string` | The human-readable display name. |
+| `environment_slug` | `string` | The organization login or enterprise slug where the app was collected. |
 | `environmentid` | `string` | The identifier of the GitHub environment where this node was collected. |
 | `last_seen` | `datetime` | The timestamp when this node was last observed during collection. |
 | `node_id` | `string` | The stable identifier used as the OpenGraph node ID; this is the native GitHub node ID where available. |
@@ -24,6 +25,7 @@ App definitions are retrieved via the public `GET /apps/{app_slug}` endpoint (no
 | `owner_login` | `string` | The login of the user or organization that owns the app. |
 | `owner_node_id` | `string` | The node_id of the user or organization that owns the app. |
 | `owner_type` | `string` | The type of the owner (e.g., `User`, `Organization`). |
+| `permissions` | `list[string]` | Requested app permissions in `scope:access` form. |
 | `registration_origin` | `string` | Whether the app is tenant-owned, third-party, or unknown. |
 | `events` | `list[string]` | JSON string of the default webhook events the app subscribes to. |
 | `installations_count` | `integer` | The total number of installations of this app across all organizations. |

{openhound_github-0.22.0 → openhound_github-0.23.0}/descriptions/nodes/GH_AppInstallation.md

@@ -2,11 +2,15 @@
 
 ## General Information
 
-Represents a GitHub App installed on an organization. App installations have specific permissions and can be scoped to all repositories or a selection of repositories. The permissions granted to the installation are stored as `scope:access` values such as `contents:write` in the `permissions` property.
+Represents a GitHub App installed on an organization or enterprise. Organization app installations have specific permissions and can be scoped to all repositories or a selection of repositories. The permissions granted to the installation are stored as `scope:access` values such as `contents:write` in the `permissions` property.
 
 Unlike fine-grained personal access tokens, GitHub does not expose separate organization and repository permission buckets for app installations, so this property remains a single flat permission list.
 
-Each installation is linked to its parent GH_App via a GH_InstalledAs edge. Installations with `repository_selection` set to `all` use one GH_CanAccess edge to the organization's repository/all GH_Scope; GH_ScopedTo edges enumerate the repositories in that reusable scope. For installations with `repository_selection` set to `selected`, the collector uses the enterprise organization-installation repositories API to enumerate the granted repositories when the enterprise installation has `Enterprise organization installations: read` or `Enterprise organization installation repositories: read`. If that permission is unavailable, selected repository edges are skipped.
+Each installation is linked to its parent GH_App via a GH_InstalledAs edge. Organization installations with `repository_selection` set to `all` use one GH_CanAccess edge to the organization's repository/all GH_Scope; GH_ScopedTo edges enumerate the repositories in that reusable scope. For installations with `repository_selection` set to `selected`, the collector uses the enterprise organization-installation repositories API to enumerate the granted repositories when the enterprise installation has `Enterprise organization installations: read` or `Enterprise organization installation repositories: read`. If that permission is unavailable, selected repository edges are skipped.
+
+Enterprise collection includes the authenticating collector app's installation, fetched independently of authentication discovery with `GET /enterprises/{enterprise}/installation`. It records granted enterprise permissions, timestamps, and suspension status, and is contained by `GH_Enterprise`. This is not a complete inventory of apps installed on the enterprise. Enterprise installations do not produce repository access edges. Parent app enrichment failures do not discard the installation.
+
+`environment_slug` identifies the target account for both installation types. `target_type` distinguishes organization and enterprise targets. Older records using `org_login` or `enterprise_name` remain readable; these fields are no longer used for new installation context. Organization repository access is evaluated only for organization targets.
 
 ## Properties
 
@@ -14,6 +18,7 @@ Each installation is linked to its parent GH_App via a GH_InstalledAs edge. Inst
 | --- | --- | --- |
 | `name` | `string` | The node name used for matching and display. |
 | `displayname` | `string` | The human-readable display name. |
+| `environment_slug` | `string` | The organization login or enterprise slug of the installation target. |
 | `environmentid` | `string` | The identifier of the GitHub environment where this node was collected. |
 | `last_seen` | `datetime` | The timestamp when this node was last observed during collection. |
 | `node_id` | `string` | The stable identifier used as the OpenGraph node ID; this is the native GitHub node ID where available. |
@@ -25,13 +30,13 @@ Each installation is linked to its parent GH_App via a GH_InstalledAs edge. Inst
 | `access_tokens_url` | `string` | API URL to create installation access tokens. |
 | `repositories_url` | `string` | API URL to list repositories accessible to this installation. |
 | `repository_selection` | `string` | Whether the app has access to `all` repositories or `selected` repositories. |
-| `target_type` | `string` | The target type of the installation (e.g., `Organization`). |
+| `target_type` | `string` | The target type of the installation (e.g., `Organization` or `Enterprise`). |
 | `permissions` | `list[string]` | Permissions granted to the installation in `scope:access` form. |
 | `events` | `string` | JSON string of the webhook events the app subscribes to. |
 | `created_at` | `datetime` | When the app was installed. |
 | `updated_at` | `datetime` | When the installation was last updated. |
 | `suspended_at` | `datetime` | When the installation was suspended, if applicable. |
-| `environment_name` | `string` | The name of the environment (GitHub organization) where the app is installed. |
+| `environment_name` | `string` | The name of the environment (GitHub organization or enterprise) where the app is installed. |
 | `query_repositories` | `string` | Query for repositories. |
 | `query_app` | `string` | Query for app. |
 
@@ -48,4 +53,6 @@ graph LR
     n1 -.->|GH_CanAccess| n2
     n1 -.->|GH_CanAccess| n3
     n4 -.->|GH_Contains| n1
+    n5["GH_Enterprise"]
+    n5 -.->|GH_Contains| n1
 ```

{openhound_github-0.22.0 → openhound_github-0.23.0}/descriptions/nodes/GH_ExternalIdentity.md

@@ -2,7 +2,7 @@
 
 ## General Information
 
-Represents an external identity from a SAML or SCIM identity provider that is linked to a GitHub user. External identities map corporate user accounts (from providers like Okta, Azure AD, etc.) to GitHub user accounts, enabling single sign-on authentication. Each external identity can have both SAML and SCIM identity attributes.
+Represents an external identity collected through a SAML or OIDC provider, with a linked GitHub user when available. External identities map corporate user accounts (from providers like Okta, Azure AD, etc.) to GitHub user accounts, enabling single sign-on authentication. SAML attributes, SCIM attributes, and the linked user may be absent.
 
 ## Properties
 

openhound_github-0.23.0/descriptions/nodes/GH_IdentityProvider.md

@@ -0,0 +1,24 @@
+# GH_IdentityProvider
+
+## General Information
+
+A shared, non-display secondary kind on `GH_SamlIdentityProvider` and `GH_OidcIdentityProvider` nodes. Provider-specific kinds retain their display settings and protocol-specific properties.
+
+Use this kind to query providers across both federation strategies:
+
+```cypher
+MATCH (provider:GH_IdentityProvider)
+RETURN provider
+```
+
+## Properties
+
+This secondary kind adds no properties. Nodes retain the properties defined by their provider-specific kind.
+
+## Diagram
+
+```mermaid
+graph LR
+    provider["GH_IdentityProvider"] -.->|GH_HasExternalIdentity| identity["GH_ExternalIdentity"]
+    identity -.->|GH_MapsToUser| user["GH_User"]
+```

openhound_github-0.23.0/descriptions/nodes/GH_OidcIdentityProvider.md

@@ -0,0 +1,34 @@
+# GH_OidcIdentityProvider
+
+## General Information
+
+Represents an OIDC identity provider configured for a GitHub Enterprise account. Collection queries `enterprise.ownerInfo.oidcProvider` using the supplemental classic PAT. The PAT must belong to an enterprise owner and have `read:enterprise` access.
+
+The node carries `GH_OidcIdentityProvider`, the shared secondary kind `GH_IdentityProvider`, and the source kind `GitHub`.
+
+## Properties
+
+| Property | Description |
+| --- | --- |
+| `node_id` | GitHub's native GraphQL provider ID. |
+| `provider_type` | The OIDC provider type returned by GitHub. |
+| `tenant_id` | The identity provider's tenant ID. |
+| `environmentid` | The GitHub Enterprise node ID. |
+| `environment_name` | The enterprise name. |
+| `github_deployment_id` | The GitHub deployment identifier. |
+| `github_web_origin` | The GitHub web origin. |
+
+## Relationships
+
+`GH_Enterprise` connects to this node through the non-traversable `GH_HasOidcIdentityProvider` relationship. Provider collection does not emit SAML service provider or SAML account relationships.
+
+The provider connects to its `GH_ExternalIdentity` nodes through non-traversable `GH_HasExternalIdentity` edges. Those identities map to linked `GH_User` nodes through `GH_MapsToUser` when available.
+
+## Diagram
+
+```mermaid
+graph LR
+    enterprise["GH_Enterprise"] -.->|GH_HasOidcIdentityProvider| provider["GH_OidcIdentityProvider"]
+    provider -.->|GH_HasExternalIdentity| identity["GH_ExternalIdentity"]
+    identity -.->|GH_MapsToUser| user["GH_User"]
+```

{openhound_github-0.22.0 → openhound_github-0.23.0}/descriptions/nodes/GH_SamlIdentityProvider.md

@@ -37,3 +37,5 @@ graph LR
     n2 -.->|GH_HasSamlIdentityProvider| n1
     n1 -.->|GH_HasExternalIdentity| n3
 ```
+
+This node also carries the non-display secondary kind `GH_IdentityProvider`, shared with enterprise OIDC providers.

{openhound_github-0.22.0 → openhound_github-0.23.0}/extension/privilege_zone_rules/t0-all-repo-admin-role.json

@@ -1,7 +1,7 @@
 {
   "name": "GitHub: Tier Zero All-Repo Admin Role",
   "description": "The synthetic all_repo_admin role grants admin access to every repository in the organization. This role is inherited by the owners role via GH_HasBaseRole and cascades admin permissions including branch protection editing, secret access, and deploy key management to all repositories.",
-  "cypher": "MATCH (n:GH_OrgRole)\nWHERE n.name CONTAINS 'ALL_REPO_ADMIN'\nRETURN n",
+  "cypher": "MATCH (n:GH_OrgRole)\nWHERE n.name CONTAINS 'all_repo_admin'\nRETURN n",
   "enabled": true,
   "zone": "Tier Zero",
   "allow_disable": true

{openhound_github-0.22.0 → openhound_github-0.23.0}/extension/privilege_zone_rules/t0-pats-all-repos.json

@@ -1,7 +1,7 @@
 {
   "name": "GitHub: Tier Zero PATs (All Repositories)",
   "description": "Fine-grained personal access tokens scoped to all repositories in the organization that have repository-control write permissions. A single compromised token may grant code, workflow, Actions, or administrative control across every repository. PATs with only read or lower-impact write permissions are excluded.",
-  "cypher": "MATCH (n:GH_PersonalAccessToken)-[:GH_CanAccess]->(:GH_Scope {scope_type:'repository', scope:'all'})\nWHERE ANY(permission IN n.repository_permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n",
+  "cypher": "MATCH (n:GH_PersonalAccessToken {token_expired:false})-[:GH_CanAccess]->(:GH_Scope {scope_type:'repository', scope:'all'})\nWHERE ANY(permission IN n.repository_permissions WHERE permission IN ['contents:write', 'administration:write', 'workflows:write', 'actions:write'])\nRETURN n",
   "enabled": true,
   "zone": "Tier Zero",
   "allow_disable": true

{openhound_github-0.22.0 → openhound_github-0.23.0}/extension/schema.json

@@ -2,7 +2,7 @@
   "schema": {
     "name": "SOGitHub",
     "display_name": "GitHub Extension (by SpecterOps)",
-    "version": "v1.4.0",
+    "version": "v1.4.3",
     "namespace": "GH"
   },
   "node_kinds": [
@@ -74,7 +74,7 @@
           "title": "Identity Provider",
           "position": 9,
           "markdown": {
-            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_Enterprise {objectid: '%s'})-[:GH_HasSamlIdentityProvider]->(idp:GH_SamlIdentityProvider)\\nOPTIONAL MATCH p1 = (idp)-[:GH_HasExternalIdentity]->(:GH_ExternalIdentity)-[:GH_MapsToUser]->(:GH_User)\\nRETURN p, p1\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the identity provider and mapped users for this enterprise in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_Enterprise {objectid: '%s'})-[:GH_HasSamlIdentityProvider|GH_HasOidcIdentityProvider]->(idp:GH_IdentityProvider)\\nOPTIONAL MATCH p1 = (idp)-[:GH_HasExternalIdentity]->(:GH_ExternalIdentity)-[:GH_MapsToUser]->(:GH_User)\\nRETURN p, p1\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the identity provider and mapped users for this enterprise in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
           }
         },
         "classic_personal_access_tokens": {
@@ -83,6 +83,13 @@
           "markdown": {
             "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_Enterprise {objectid: '%s'})-[:GH_Contains]->(:GH_ClassicPersonalAccessToken)\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View classic personal access tokens in this enterprise in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
           }
+        },
+        "collector_app_installation": {
+          "title": "Collector App Installation",
+          "position": 11,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_Enterprise {objectid: '%s'})-[:GH_Contains]->(:GH_AppInstallation)\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the collector app installation in this enterprise in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
         }
       }
     },
@@ -1631,10 +1638,62 @@
         }
       }
     },
+    {
+      "name": "GH_OidcIdentityProvider",
+      "display_name": "GitHub OIDC Identity Provider",
+      "description": "An OIDC identity provider configured for a GitHub Enterprise account",
+      "is_display_kind": true,
+      "icon": "id-badge",
+      "color": "#5A6C8F",
+      "info": {
+        "description": {
+          "title": "Description",
+          "position": 1,
+          "markdown": {
+            "content": "## Overview\n\nRepresents an enterprise OIDC identity provider. The provider_type and tenant_id properties identify the provider and its tenant."
+          }
+        },
+        "inbound_traversable_relationships": {
+          "title": "Inbound Traversable GH Relationships",
+          "position": 2,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_OidcIdentityProvider {objectid: '%s'})\\nWHERE false\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View direct inbound relationships in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        },
+        "outbound_traversable_relationships": {
+          "title": "Outbound Traversable GH Relationships",
+          "position": 3,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_OidcIdentityProvider {objectid: '%s'})\\nWHERE false\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View direct outbound relationships in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        },
+        "environment_context": {
+          "title": "Environment Context",
+          "position": 4,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (environment)-[:GH_HasOidcIdentityProvider]->(selected:GH_OidcIdentityProvider {objectid: '%s'})\\nWHERE environment:GH_Enterprise\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the enterprise using this identity provider in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        },
+        "external_identities": {
+          "title": "External Identities",
+          "position": 5,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_OidcIdentityProvider {objectid: '%s'})-[:GH_HasExternalIdentity]->(:GH_ExternalIdentity)\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View external identities from this provider in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        },
+        "mapped_users": {
+          "title": "Mapped Users",
+          "position": 6,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_OidcIdentityProvider {objectid: '%s'})-[:GH_HasExternalIdentity]->(:GH_ExternalIdentity)-[:GH_MapsToUser]->(:GH_User)\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View GitHub users mapped through this identity provider in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
+        }
+      }
+    },
     {
       "name": "GH_ExternalIdentity",
       "display_name": "GitHub External Identity",
-      "description": "An external identity from a SAML/SCIM provider linked to a GitHub user for SSO authentication",
+      "description": "An external identity from a SAML or OIDC provider with optional SCIM attributes and a linked GitHub user when available",
       "is_display_kind": true,
       "icon": "arrows-left-right",
       "color": "#8A8F98",
@@ -1643,7 +1702,7 @@
           "title": "Description",
           "position": 1,
           "markdown": {
-            "content": "## Overview\n\nRepresents an external identity from a SAML or SCIM identity provider that is linked to a GitHub user. This node preserves the identity-provider attributes used to understand how a corporate identity maps into GitHub."
+            "content": "## Overview\n\nRepresents an external identity collected through a SAML or OIDC provider, with a linked GitHub user when available. This node preserves the identity-provider attributes used to understand how a corporate identity maps into GitHub."
           }
         },
         "inbound_traversable_relationships": {
@@ -1664,7 +1723,7 @@
           "title": "Identity Provider",
           "position": 4,
           "markdown": {
-            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (:GH_SamlIdentityProvider)-[:GH_HasExternalIdentity]->(selected:GH_ExternalIdentity {objectid: '%s'})\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the identity provider containing this external identity in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (:GH_IdentityProvider)-[:GH_HasExternalIdentity]->(selected:GH_ExternalIdentity {objectid: '%s'})\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the identity provider containing this external identity in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
           }
         },
         "mapped_user": {
@@ -1688,7 +1747,7 @@
           "title": "Description",
           "position": 1,
           "markdown": {
-            "content": "## Overview\n\nRepresents a GitHub App definition. The app owner controls the private key used to generate installation tokens for every installation of this app, so compromise of the app can affect every organization where it is installed."
+            "content": "## Overview\n\nRepresents a GitHub App definition. The `permissions` property records requested app permissions. Each installation records its own granted permissions. The app owner controls the private key used to generate installation tokens for its installations on organizations and enterprises.\n\n`environment_slug` records the organization login or enterprise slug for this collection context."
           }
         },
         "inbound_traversable_relationships": {
@@ -1769,7 +1828,7 @@
     {
       "name": "GH_AppInstallation",
       "display_name": "GitHub App Installation",
-      "description": "A GitHub App installed on the organization with specific permissions and repository access",
+      "description": "A GitHub App installed on an organization or enterprise with a specific set of granted permissions",
       "is_display_kind": true,
       "icon": "plug",
       "color": "#A8D8EA",
@@ -1778,7 +1837,7 @@
           "title": "Description",
           "position": 1,
           "markdown": {
-            "content": "## Overview\n\nRepresents a GitHub App installed on an organization. Installations have a permission set and repository scope, and are linked back to the parent `GH_App` that owns the private key used to mint installation tokens."
+            "content": "## Overview\n\nRepresents a GitHub App installed on an organization or enterprise. The `permissions` property records permissions granted to this installation; the parent `GH_App` records requested permissions.\n\nEnterprise collection currently includes only the authenticating collector app installation. Enterprise installations do not automatically grant access to organizations or repositories.\n\n`environment_slug` records the organization login or enterprise slug for this collection context."
           }
         },
         "inbound_traversable_relationships": {
@@ -1815,6 +1874,13 @@
           "markdown": {
             "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (selected:GH_AppInstallation {objectid: '%s'})-[:GH_CanAccess|GH_ScopedTo*1..2]->(:GH_Repository)\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View repositories accessible to this app installation in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
           }
+        },
+        "enterprise_context": {
+          "title": "Enterprise Context",
+          "position": 7,
+          "markdown": {
+            "content": "{{ $objectID := .Properties.objectid | default \"\" | trim }}\n{{ $escapedObjectID := $objectID | replace \"\\\\\" \"\\\\\\\\\" | replace \"'\" \"\\\\'\" }}\n{{ if ne $objectID \"\" }}\n{{ $query := printf \"MATCH p = (:GH_Enterprise)-[:GH_Contains]->(selected:GH_AppInstallation {objectid: '%s'})\\nRETURN p\\nLIMIT 500\" $escapedObjectID }}\n{{ $encodedQuery := $query | b64enc | urlquery }}\n[View the enterprise containing this app installation in Explore](/ui/explore?exploreSearchTab=cypher&searchType=cypher&cypherSearch={{ $encodedQuery }})\n{{ else }}\nExplore navigation is unavailable because this object has no stable identifier.\n{{ end }}"
+          }
         }
       }
     },
@@ -1966,6 +2032,12 @@
           }
         }
       }
+    },
+    {
+      "name": "GH_IdentityProvider",
+      "display_name": "GitHub Identity Provider",
+      "description": "Shared secondary kind for GitHub SAML and OIDC identity providers",
+      "is_display_kind": false
     }
   ],
   "relationship_kinds": [
@@ -2601,7 +2673,7 @@
     },
     {
       "name": "GH_HasExternalIdentity",
-      "description": "SAML identity provider has this external identity",
+      "description": "SAML or OIDC identity provider has this external identity",
       "is_traversable": false
     },
     {
@@ -2748,6 +2820,11 @@
       "name": "GH_ApprovesDeploymentTo",
       "description": "User or team is configured as a required reviewer for this environment",
       "is_traversable": false
+    },
+    {
+      "name": "GH_HasOidcIdentityProvider",
+      "description": "Enterprise has this OIDC identity provider configured",
+      "is_traversable": false
     }
   ],
   "environments": [