openhound-github 0.6.5__tar.gz → 0.6.7__tar.gz

{openhound_github-0.6.5 → openhound_github-0.6.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.6.5
+Version: 0.6.7
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -51,6 +51,21 @@ Enterprise GitHub App credentials accept either `client_id` or `app_id` as the
 JWT issuer. When both are configured, `client_id` is preferred. At least one
 identifier must be supplied together with `key_path` and `enterprise_name`.
 
+### GitHub Enterprise Server endpoints
+
+GitHub.com is the default deployment and does not require endpoint configuration.
+To collect from GitHub Enterprise Server, set both API endpoints in `config.toml`:
+
+```toml
+[sources.github]
+rest_api_url = "https://ghe.example/api/v3"
+graphql_url = "https://ghe.example/api/graphql"
+```
+
+Both values must be provided together when overriding the GitHub.com defaults.
+Endpoint URLs must use HTTPS and share the same origin. GitHub App
+`credentials.api_uri` may override only the path on that same origin.
+
 ### Enterprise SCIM and hybrid correlations
 
 A token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.

{openhound_github-0.6.5 → openhound_github-0.6.7}/README.md

@@ -40,6 +40,21 @@ Enterprise GitHub App credentials accept either `client_id` or `app_id` as the
 JWT issuer. When both are configured, `client_id` is preferred. At least one
 identifier must be supplied together with `key_path` and `enterprise_name`.
 
+### GitHub Enterprise Server endpoints
+
+GitHub.com is the default deployment and does not require endpoint configuration.
+To collect from GitHub Enterprise Server, set both API endpoints in `config.toml`:
+
+```toml
+[sources.github]
+rest_api_url = "https://ghe.example/api/v3"
+graphql_url = "https://ghe.example/api/graphql"
+```
+
+Both values must be provided together when overriding the GitHub.com defaults.
+Endpoint URLs must use HTTPS and share the same origin. GitHub App
+`credentials.api_uri` may override only the path on that same origin.
+
 ### Enterprise SCIM and hybrid correlations
 
 A token with enterprise SCIM access is used to collect both `/scim/v2/enterprises/{enterprise}/Users` and `/scim/v2/enterprises/{enterprise}/Groups`. The collector emits normalized `SCIM_Organization`, `SCIM_User`, and `SCIM_Group` nodes plus `SCIM_Contains`, `SCIM_MemberOf`, and `SCIM_Provisioned` relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.

{openhound_github-0.6.5 → openhound_github-0.6.7}/src/openhound_github/auth.py

@@ -293,6 +293,16 @@ class GitHubAppInstallationAuth(AuthConfigBase):
         return True
 
     def __call__(self, request: requests.PreparedRequest) -> requests.PreparedRequest:
+        try:
+            request_origin = _normalized_http_origin(
+                request.url or "", allow_query=True
+            )
+        except ValueError:
+            return request
+
+        if request_origin != self._api_origin:
+            return request
+
         request.headers["Authorization"] = f"Bearer {self.token()}"
         return request
 

{openhound_github-0.6.5 → openhound_github-0.6.7}/src/openhound_github/helpers.py

@@ -1,11 +1,13 @@
 import logging
 import time
-from typing import Optional
+from collections.abc import Iterator
+from typing import Any, Optional, overload
 from urllib.parse import urlparse
 
 from dlt.common import jsonpath
 from dlt.sources.helpers import requests
 from dlt.sources.helpers.rest_client.auth import AuthConfigBase
+from dlt.sources.helpers.rest_client.client import RESTClient
 from dlt.sources.helpers.rest_client.paginators import (
     JSONResponseCursorPaginator,
 )
@@ -15,11 +17,54 @@ from openhound_github.auth import GitHubAppInstallationAuth
 
 logger = logging.getLogger(__name__)
 
+DEFAULT_GITHUB_REST_API_URL = "https://api.github.com"
+DEFAULT_GITHUB_GRAPHQL_URL = "https://api.github.com/graphql"
+
 
 class GraphQLPaginationError(RuntimeError):
     pass
 
 
+@overload
+def graphql_client_and_path(
+    rest_client: RESTClient,
+    graphql_client: RESTClient | None,
+) -> tuple[RESTClient, str]: ...
+
+
+@overload
+def graphql_client_and_path(
+    rest_client: RESTClient | None,
+    graphql_client: RESTClient | None,
+) -> tuple[RESTClient | None, str]: ...
+
+
+def graphql_client_and_path(
+    rest_client: RESTClient | None,
+    graphql_client: RESTClient | None,
+) -> tuple[RESTClient | None, str]:
+    """Return the configured GraphQL client and its request path."""
+    if graphql_client:
+        return graphql_client, ""
+    return rest_client, "/graphql"
+
+
+class AdaptiveGraphQLPageError(RuntimeError):
+    """A terminal GraphQL page failure with adaptive pagination context."""
+
+    def __init__(
+        self,
+        *,
+        cursor: str | None,
+        page_size: int,
+        error: BaseException,
+    ) -> None:
+        super().__init__(str(error))
+        self.cursor = cursor
+        self.page_size = page_size
+        self.error = error
+
+
 def scim_skip_reason(exception: BaseException) -> str | None:
     """Return a user-facing reason for expected SCIM API unavailability."""
     if not isinstance(exception, requests.HTTPError) or exception.response is None:
@@ -56,6 +101,10 @@ class GraphQLCursorPaginator(JSONResponseCursorPaginator):
         self.has_next_field = has_next_field
         self.allow_missing_page_info = allow_missing_page_info
 
+    @property
+    def next_cursor(self) -> str | None:
+        return self._next_reference
+
     def init_request(self, request: "Request") -> None:
         self._next_reference = None
         self._has_next_page = True
@@ -149,6 +198,157 @@ class GraphQLCursorPaginator(JSONResponseCursorPaginator):
         variables[self.cursor_variable] = self._next_reference
 
 
+def _graphql_gateway_status(exception: BaseException) -> int | None:
+    if not isinstance(exception, requests.HTTPError) or exception.response is None:
+        return None
+
+    status_code = exception.response.status_code
+    if status_code in (502, 504):
+        return status_code
+    return None
+
+
+def adaptive_graphql_paginate(
+    client: RESTClient,
+    *,
+    graphql_path: str = "/graphql",
+    query: str,
+    variables: dict[str, Any],
+    page_info_path: str,
+    cursor_variable: str = "after",
+    page_size_variable: str = "count",
+    page_sizes: tuple[int, ...] = (100, 50, 25),
+    allow_missing_page_info: bool = False,
+    resource_name: str = "graphql",
+    scope_name: str | None = None,
+    scope_value: str | None = None,
+    log: logging.Logger | None = None,
+) -> Iterator[dict[str, Any]]:
+    """Yield GraphQL pages while adapting connection size after gateway failures.
+
+    The underlying HTTP session still owns ordinary request retries. This helper
+    handles the remaining terminal 502/504 case by retrying the same cursor with
+    progressively smaller connection sizes.
+    """
+    if not page_sizes or any(page_size <= 0 for page_size in page_sizes):
+        raise ValueError("page_sizes must contain positive integers")
+    if tuple(sorted(set(page_sizes), reverse=True)) != page_sizes:
+        raise ValueError("page_sizes must be unique and in descending order")
+
+    logger_instance = log or logger
+    base_page_size = page_sizes[0]
+    cursor = variables.get(cursor_variable)
+    if cursor is not None and not isinstance(cursor, str):
+        raise ValueError(f"{cursor_variable} must be a string or None")
+
+    stable_page_size = base_page_size
+    probe_base_page_size = False
+
+    while True:
+        if stable_page_size == base_page_size:
+            candidate_sizes = page_sizes
+            probing_base_page_size = False
+        elif probe_base_page_size:
+            candidate_sizes = (base_page_size,) + tuple(
+                page_size
+                for page_size in page_sizes
+                if page_size <= stable_page_size
+            )
+            probing_base_page_size = True
+        else:
+            candidate_sizes = tuple(
+                page_size
+                for page_size in page_sizes
+                if page_size <= stable_page_size
+            )
+            probing_base_page_size = False
+
+        page_data: dict[str, Any] | None = None
+        paginator: GraphQLCursorPaginator | None = None
+        successful_page_size: int | None = None
+
+        for index, page_size in enumerate(candidate_sizes):
+            request_variables = {
+                **variables,
+                cursor_variable: cursor,
+                page_size_variable: page_size,
+            }
+            try:
+                response = client.post(
+                    graphql_path,
+                    json={"query": query, "variables": request_variables},
+                )
+                response.raise_for_status()
+                response_json = response.json()
+                paginator = GraphQLCursorPaginator(
+                    page_info_path=page_info_path,
+                    cursor_variable=cursor_variable,
+                    cursor_field="endCursor",
+                    has_next_field="hasNextPage",
+                    allow_missing_page_info=allow_missing_page_info,
+                )
+                paginator.update_state(response)
+                page_data = response_json.get("data")
+                if not isinstance(page_data, dict):
+                    raise GraphQLPaginationError(
+                        "GraphQL response data must be an object"
+                    )
+                successful_page_size = page_size
+                break
+            except Exception as error:
+                status_code = _graphql_gateway_status(error)
+                next_page_size = (
+                    candidate_sizes[index + 1]
+                    if status_code is not None and index + 1 < len(candidate_sizes)
+                    else None
+                )
+                if next_page_size is not None:
+                    scope = (
+                        f" {scope_name} '{scope_value}'"
+                        if scope_name and scope_value
+                        else ""
+                    )
+                    logger_instance.warning(
+                        "Adaptive GraphQL pagination for resource '%s'%s retrying "
+                        "cursor %r with page size %d after HTTP %d at page size %d",
+                        resource_name,
+                        scope,
+                        cursor,
+                        next_page_size,
+                        status_code,
+                        page_size,
+                    )
+                    continue
+                raise AdaptiveGraphQLPageError(
+                    cursor=cursor,
+                    page_size=page_size,
+                    error=error,
+                ) from error
+
+        if page_data is None or paginator is None or successful_page_size is None:
+            raise GraphQLPaginationError("GraphQL page did not produce data")
+
+        yield page_data
+
+        if successful_page_size == base_page_size:
+            stable_page_size = base_page_size
+            probe_base_page_size = False
+        elif stable_page_size == base_page_size:
+            stable_page_size = successful_page_size
+            probe_base_page_size = True
+        elif probing_base_page_size:
+            stable_page_size = successful_page_size
+            probe_base_page_size = False
+        elif successful_page_size < stable_page_size:
+            stable_page_size = successful_page_size
+            probe_base_page_size = False
+
+        if not paginator.has_next_page:
+            break
+
+        cursor = paginator.next_cursor
+
+
 def _response_message(response: requests.Response) -> str:
     try:
         response_data = response.json()

{openhound_github-0.6.5 → openhound_github-0.6.7}/src/openhound_github/resources/enterprise.py

@@ -11,7 +11,11 @@ from openhound_github.graphql import (
     ENTERPRISE_QUERY,
     ENTERPRISE_SAML_QUERY,
 )
-from openhound_github.helpers import GraphQLCursorPaginator, scim_skip_reason
+from openhound_github.helpers import (
+    GraphQLCursorPaginator,
+    graphql_client_and_path,
+    scim_skip_reason,
+)
 from openhound_github.main import app
 from openhound_github.models import (
     BaseUser,
@@ -53,7 +57,9 @@ class SourceContext:
     """Shared context for GitHub API access."""
 
     client: RESTClient
+    graphql_client: RESTClient | None = None
     sso_client: RESTClient | None = None
+    sso_graphql_client: RESTClient | None = None
     org_name: str | None = None
     enterprise_name: str | None = None
     emit_legacy_scim_correlations: bool = False
@@ -61,6 +67,14 @@ class SourceContext:
     github_web_origin: str = DEFAULT_GITHUB_WEB_ORIGIN
 
 
+def _graphql_client(ctx: SourceContext) -> tuple[RESTClient, str]:
+    return graphql_client_and_path(ctx.client, ctx.graphql_client)
+
+
+def _sso_graphql_client(ctx: SourceContext) -> tuple[RESTClient | None, str]:
+    return graphql_client_and_path(ctx.sso_client, ctx.sso_graphql_client)
+
+
 def iter_enterprise_scim_resources(
     client: RESTClient,
     enterprise_slug: str,
@@ -111,8 +125,9 @@ def enterprise(ctx: SourceContext):
         "variables": {"slug": ctx.enterprise_name, "after": None},
     }
 
+    client, graphql_path = _graphql_client(ctx)
     try:
-        response = ctx.client.post("/graphql", json=data).json()
+        response = client.post(graphql_path, json=data).json()
         page_enterprise = (response.get("data") or {}).get("enterprise")
         if page_enterprise:
             yield page_enterprise
@@ -139,9 +154,10 @@ def enterprise_organizations(enterprise_data: Enterprise, ctx: SourceContext):
         "variables": {"slug": ctx.enterprise_name, "after": None},
     }
 
+    client, graphql_path = _graphql_client(ctx)
     try:
-        for page_data in ctx.client.paginate(
-            "/graphql",
+        for page_data in client.paginate(
+            graphql_path,
             method="POST",
             json=data,
             paginator=paginator,
@@ -263,8 +279,9 @@ def enterprise_members(enterprise_data: Enterprise, ctx: SourceContext):
         "query": ENTERPRISE_MEMBERS_QUERY,
         "variables": {"slug": ctx.enterprise_name, "count": 100, "after": None},
     }
-    for page_data in ctx.client.paginate(
-        "/graphql",
+    client, graphql_path = _graphql_client(ctx)
+    for page_data in client.paginate(
+        graphql_path,
         method="POST",
         json=data,
         paginator=paginator,
@@ -635,8 +652,9 @@ def enterprise_admins(enterprise_data: Enterprise, ctx: SourceContext):
         "query": ENTERPRISE_ADMINS_QUERY,
         "variables": {"slug": ctx.enterprise_name, "count": 100, "after": None},
     }
-    for page_data in ctx.client.paginate(
-        "/graphql",
+    client, graphql_path = _graphql_client(ctx)
+    for page_data in client.paginate(
+        graphql_path,
         method="POST",
         json=data,
         paginator=paginator,
@@ -665,7 +683,7 @@ def enterprise_admins(enterprise_data: Enterprise, ctx: SourceContext):
     parallelized=True
 )
 def enterprise_saml_provider(enterprise_data: Enterprise, ctx: SourceContext):
-    client = ctx.sso_client
+    client, graphql_path = _sso_graphql_client(ctx)
     if not client:
         logger.info(
             "Skipping enterprise_saml_provider for enterprise '%s': no SSO client configured",
@@ -679,7 +697,7 @@ def enterprise_saml_provider(enterprise_data: Enterprise, ctx: SourceContext):
     }
 
     try:
-        response = client.post("/graphql", json=data).json()
+        response = client.post(graphql_path, json=data).json()
     except Exception as e:
         logger.error(
             f"Error in resource 'enterprise_saml_provider' processing enterprise '{ctx.enterprise_name}': {e}",
@@ -779,7 +797,7 @@ def enterprise_saml_issuer(saml_provider: SamlProvider, ctx: SourceContext):
 def enterprise_external_identity(
     saml_provider: SamlProvider, ctx: SourceContext
 ):
-    client = ctx.sso_client
+    client, graphql_path = _sso_graphql_client(ctx)
     if not client:
         logger.info(
             "Skipping enterprise_external_identity for enterprise '%s': no SSO client configured",
@@ -801,7 +819,7 @@ def enterprise_external_identity(
 
     try:
         for page_data in client.paginate(
-            "/graphql",
+            graphql_path,
             method="POST",
             json=data,
             paginator=paginator,

{openhound_github-0.6.5 → openhound_github-0.6.7}/src/openhound_github/resources/organization.py

@@ -22,7 +22,14 @@ from openhound_github.graphql import (
     TEAM_MEMBERS_OVERFLOW_QUERY,
     TEAMS_QUERY,
 )
-from openhound_github.helpers import GraphQLCursorPaginator, scim_skip_reason
+from openhound_github.helpers import (
+    AdaptiveGraphQLPageError,
+    DEFAULT_GITHUB_REST_API_URL,
+    GraphQLCursorPaginator,
+    adaptive_graphql_paginate,
+    graphql_client_and_path,
+    scim_skip_reason,
+)
 from openhound_github.main import app
 from openhound_github.models import (
     ActionPermission,
@@ -83,11 +90,11 @@ from openhound_github.models.saml_helpers import (
 
 logger = logging.getLogger(__name__)
 
-
 @dataclass
 class OrgContext:
     client: RESTClient
     org_name: str
+    graphql_client: RESTClient | None = None
     enterprise_name: str | None = None
     github_deployment_id: str = DEFAULT_GITHUB_DEPLOYMENT_ID
     github_web_origin: str = DEFAULT_GITHUB_WEB_ORIGIN
@@ -97,6 +104,7 @@ class OrgContext:
 class SourceContext:
     client: RESTClient
     organizations: list[OrgContext] = field(default_factory=list)
+    graphql_client: RESTClient | None = None
     enterprise_name: str | None = None
     github_deployment_id: str = DEFAULT_GITHUB_DEPLOYMENT_ID
     github_web_origin: str = DEFAULT_GITHUB_WEB_ORIGIN
@@ -133,6 +141,20 @@ def _client_for_org(ctx: SourceContext, org_login: str) -> RESTClient:
     return ctx.client
 
 
+def _graphql_client_for_org(
+    ctx: SourceContext, org_login: str
+) -> tuple[RESTClient, str]:
+    for org in ctx.organizations:
+        if org.org_name == org_login:
+            return graphql_client_and_path(org.client, org.graphql_client)
+    return graphql_client_and_path(ctx.client, ctx.graphql_client)
+
+
+def _rest_api_url(client: RESTClient) -> str:
+    base_url = getattr(client, "base_url", DEFAULT_GITHUB_REST_API_URL)
+    return str(base_url).strip().rstrip("/") or DEFAULT_GITHUB_REST_API_URL
+
+
 def _encode_path_segment(value: str) -> str:
     return quote(value, safe="")
 
@@ -459,7 +481,7 @@ def users(ctx: SourceContext) -> Iterator[dict[str, Any]]:
 
     for org in ctx.organizations:
         org_name = org.org_name
-        client = org.client
+        client, graphql_path = _graphql_client_for_org(ctx, org_name)
         try:
             paginator = GraphQLCursorPaginator(
                 page_info_path="data.organization.membersWithRole.pageInfo",
@@ -473,7 +495,7 @@ def users(ctx: SourceContext) -> Iterator[dict[str, Any]]:
             }
 
             for page_data in client.paginate(
-                "/graphql",
+                graphql_path,
                 method="POST",
                 json=data,
                 paginator=paginator,
@@ -510,7 +532,7 @@ def teams(ctx: SourceContext):
 
     for org in ctx.organizations:
         org_name = org.org_name
-        client = org.client
+        client, graphql_path = _graphql_client_for_org(ctx, org_name)
         try:
             paginator = GraphQLCursorPaginator(
                 page_info_path="data.organization.teams.pageInfo",
@@ -523,7 +545,7 @@ def teams(ctx: SourceContext):
                 "variables": {"login": org_name, "count": 100, "after": None},
             }
             for page_data in client.paginate(
-                "/graphql",
+                graphql_path,
                 method="POST",
                 json=data,
                 paginator=paginator,
@@ -621,7 +643,7 @@ def team_members(team: Team, ctx: SourceContext):
             raise RuntimeError(
                 f"GitHub team {team.org_login}/{team.slug} has more members but no endCursor"
             )
-        client = _client_for_org(ctx, team.org_login)
+        client, graphql_path = _graphql_client_for_org(ctx, team.org_login)
         data = {
             "query": TEAM_MEMBERS_OVERFLOW_QUERY,
             "variables": {
@@ -632,7 +654,7 @@ def team_members(team: Team, ctx: SourceContext):
             },
         }
         for page_data in client.paginate(
-            "/graphql",
+            graphql_path,
             method="POST",
             json=data,
             paginator=paginator,
@@ -922,29 +944,22 @@ def repositories_graphql(ctx: SourceContext):
     """
     for org in ctx.organizations:
         org_name = org.org_name
-        client = org.client
+        client, graphql_path = _graphql_client_for_org(ctx, org_name)
         repository_cursor: str | None = None
         emitted_repositories = 0
         try:
-            paginator = GraphQLCursorPaginator(
+            for page_data in adaptive_graphql_paginate(
+                client,
+                graphql_path=graphql_path,
+                query=REPO_REFS_QUERY,
+                variables={"login": org_name, "after": None},
                 page_info_path="data.organization.repositories.pageInfo",
-                cursor_variable="after",
-                cursor_field="endCursor",
-                has_next_field="hasNextPage",
-            )
-            data = {
-                "query": REPO_REFS_QUERY,
-                "variables": {"login": org_name, "count": 100, "after": None},
-            }
-
-            for page_data in client.paginate(
-                "/graphql",
-                method="POST",
-                json=data,
-                paginator=paginator,
-                data_selector="data",
+                resource_name="repositories_graphql",
+                scope_name="organization",
+                scope_value=org_name,
+                log=logger,
             ):
-                repos_page = page_data[0]["organization"]["repositories"]
+                repos_page = page_data["organization"]["repositories"]
                 for repo in repos_page["nodes"]:
                     repo_record = {**repo}
                     branch_rulesets = repo_record.pop("branchRulesets", None) or {}
@@ -959,22 +974,29 @@ def repositories_graphql(ctx: SourceContext):
                 if isinstance(page_info, dict):
                     repository_cursor = page_info.get("endCursor")
         except Exception as e:
+            failure = e.error if isinstance(e, AdaptiveGraphQLPageError) else e
+            failure_cursor = (
+                e.cursor if isinstance(e, AdaptiveGraphQLPageError) else repository_cursor
+            )
+            page_size = e.page_size if isinstance(e, AdaptiveGraphQLPageError) else None
             logger.error(
                 "Error in resource 'repositories_graphql' processing organization '%s' "
-                "at repository cursor %r after emitting %d repositories "
+                "at repository cursor %r with page size %r after emitting %d repositories "
                 "(%s): %s",
                 org_name,
-                repository_cursor,
+                failure_cursor,
+                page_size,
                 emitted_repositories,
-                type(e).__name__,
-                e,
+                type(failure).__name__,
+                failure,
                 extra={
                     "resource": "repositories_graphql",
                     "phase": "resource_iteration",
                     "org_name": org_name,
-                    "repository_cursor": repository_cursor,
+                    "repository_cursor": failure_cursor,
+                    "page_size": page_size,
                     "emitted_repositories": emitted_repositories,
-                    "error_type": type(e).__name__,
+                    "error_type": type(failure).__name__,
                 },
             )
             continue
@@ -1010,7 +1032,7 @@ def branches(repository: RepositoryQL, ctx: SourceContext):
         }
 
     if repository.refs.page_info.has_next_page:
-        client = _client_for_org(ctx, repository.org_login)
+        client, graphql_path = _graphql_client_for_org(ctx, repository.org_login)
         data = {
             "query": REF_OVERFLOW_QUERY,
             "variables": {
@@ -1022,7 +1044,7 @@ def branches(repository: RepositoryQL, ctx: SourceContext):
         }
 
         for page_data in client.paginate(
-            "/graphql",
+            graphql_path,
             method="POST",
             json=data,
             paginator=paginator,
@@ -1064,12 +1086,12 @@ def branch_protection_rules(repository: RepositoryQL, ctx: SourceContext):
                 rule_ids_seen.add(rule_id)
 
     rule_ids_list = list(rule_ids_seen)
-    client = _client_for_org(ctx, repository.org_login)
+    client, graphql_path = _graphql_client_for_org(ctx, repository.org_login)
     for i in range(0, len(rule_ids_list), 100):
         rules_chunk = rule_ids_list[i : i + 100]
         if rules_chunk:
             data = {"query": PROTECTION_RULES_QUERY, "variables": {"ids": rules_chunk}}
-            response = client.post("/graphql", json=data).json()
+            response = client.post(graphql_path, json=data).json()
             for rule in response["data"].get("nodes", []):
                 # GitHub can return null actors for deleted or inaccessible allowance actors.
                 for allowance_key in ("bypassPullRequestAllowances", "pushAllowances"):
@@ -1653,7 +1675,7 @@ def secret_scanning_alerts(ctx: SourceContext):
                     ):
                         try:
                             resp = requests.get(
-                                "https://api.github.com/user",
+                                f"{_rest_api_url(client)}/user",
                                 headers={"Authorization": f"Bearer {secret}"},
                                 timeout=10,
                             )
@@ -1789,14 +1811,14 @@ def saml_provider(ctx: SourceContext):
     """
     for org in ctx.organizations:
         org_name = org.org_name
-        client = org.client
+        client, graphql_path = _graphql_client_for_org(ctx, org_name)
         try:
             data = {
                 "query": SAML_QUERY,
                 "variables": {"login": org_name, "count": 100, "after": None},
             }
 
-            response = client.post("/graphql", json=data).json()
+            response = client.post(graphql_path, json=data).json()
             response_data = response.get("data", {})
             org_data = response_data.get("organization", {})
             if response_data and org_data:
@@ -1833,7 +1855,7 @@ def external_identities(ctx: SourceContext):
     """
     for org in ctx.organizations:
         org_name = org.org_name
-        client = org.client
+        client, graphql_path = _graphql_client_for_org(ctx, org_name)
         github_deployment_id = org.github_deployment_id
         try:
             paginator = GraphQLCursorPaginator(
@@ -1849,7 +1871,7 @@ def external_identities(ctx: SourceContext):
             }
 
             for page_data in client.paginate(
-                "/graphql",
+                graphql_path,
                 method="POST",
                 json=data,
                 paginator=paginator,