openhound-github 0.6.7__tar.gz → 0.7.0__tar.gz

{openhound_github-0.6.7 → openhound_github-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.6.7
+Version: 0.7.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md
@@ -74,10 +74,23 @@ A token with enterprise SCIM access is used to collect both `/scim/v2/enterprise
 
 Enterprise roles, including the built-in `members` role, are emitted through `GH_HasRole` and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as `GH_WriteEnterpriseSso` remain non-traversable.
 
+### Optional privileged collection
+
+The collector runs successfully with the documented read-only permission set. Some higher-fidelity relationships require optional non-read-only permissions because GitHub exposes the supporting read APIs behind privileged permission names:
+
+- Organization `Members: write` enables external group mapping collection for IdP-synced teams, which allows the converter to emit `SCIM_Provisioned` edges from `SCIM_Group` to `GH_Team`. This is useful when the organization uses team synchronization with an external identity provider; if no GitHub teams are linked to external groups, this permission does not add graph data.
+- Classic PAT scope `manage_runners:enterprise` enables enterprise self-hosted runner group and runner collection. This is useful when the enterprise has enterprise-scoped runner groups or runners, especially runner groups shared into organizations; if all runners are organization- or repository-scoped, this scope does not add graph data.
+
+If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
+
 [![Python Version](https://img.shields.io/badge/Python-3.13-brightgreen.svg)](#about)
 
 ## Getting Started
 
-Follow the OpenHound docs to get started:
+Follow the OpenHound GitHub collector docs to get started:
 
-- [OpenHound Documentation](https://bloodhound.specterops.io/openhound/overview)
+- [GitHub collector overview](https://bloodhound.specterops.io/openhound/collectors/github/overview)
+- [Configure the collector](https://bloodhound.specterops.io/openhound/collectors/github/collect-data)
+- [Configure an organization GitHub App](https://bloodhound.specterops.io/openhound/collectors/github/configure-app)
+- [Configure an enterprise GitHub App](https://bloodhound.specterops.io/openhound/collectors/github/configure-enterprise-app)
+- [Configure a personal access token](https://bloodhound.specterops.io/openhound/collectors/github/configure-pat)

{openhound_github-0.6.7 → openhound_github-0.7.0}/README.md

@@ -63,10 +63,23 @@ A token with enterprise SCIM access is used to collect both `/scim/v2/enterprise
 
 Enterprise roles, including the built-in `members` role, are emitted through `GH_HasRole` and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as `GH_WriteEnterpriseSso` remain non-traversable.
 
+### Optional privileged collection
+
+The collector runs successfully with the documented read-only permission set. Some higher-fidelity relationships require optional non-read-only permissions because GitHub exposes the supporting read APIs behind privileged permission names:
+
+- Organization `Members: write` enables external group mapping collection for IdP-synced teams, which allows the converter to emit `SCIM_Provisioned` edges from `SCIM_Group` to `GH_Team`. This is useful when the organization uses team synchronization with an external identity provider; if no GitHub teams are linked to external groups, this permission does not add graph data.
+- Classic PAT scope `manage_runners:enterprise` enables enterprise self-hosted runner group and runner collection. This is useful when the enterprise has enterprise-scoped runner groups or runners, especially runner groups shared into organizations; if all runners are organization- or repository-scoped, this scope does not add graph data.
+
+If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
+
 [![Python Version](https://img.shields.io/badge/Python-3.13-brightgreen.svg)](#about)
 
 ## Getting Started
 
-Follow the OpenHound docs to get started:
+Follow the OpenHound GitHub collector docs to get started:
 
-- [OpenHound Documentation](https://bloodhound.specterops.io/openhound/overview)
+- [GitHub collector overview](https://bloodhound.specterops.io/openhound/collectors/github/overview)
+- [Configure the collector](https://bloodhound.specterops.io/openhound/collectors/github/collect-data)
+- [Configure an organization GitHub App](https://bloodhound.specterops.io/openhound/collectors/github/configure-app)
+- [Configure an enterprise GitHub App](https://bloodhound.specterops.io/openhound/collectors/github/configure-enterprise-app)
+- [Configure a personal access token](https://bloodhound.specterops.io/openhound/collectors/github/configure-pat)

openhound_github-0.7.0/descriptions/edges/GH_MemberOf.md

@@ -0,0 +1,3 @@
+## General Information
+
+The traversable GH_MemberOf edge represents team membership and projection relationships, linking a team role to its parent team, a child team to a parent team in nested team hierarchies, or a GH_EnterpriseTeam to its projected GH_Team in an organization. This edge is traversable because these relationships carry effective team membership context through the graph: a user who holds a role in a child team inherits the repository permissions of ancestor teams, and enterprise-managed team membership flows into the projected organization team.

{openhound_github-0.6.7 → openhound_github-0.7.0}/extension/schema.json

@@ -467,7 +467,7 @@
     },
     {
       "name": "GH_MemberOf",
-      "description": "Team role is a member of a team, or team is a nested member of a parent team",
+      "description": "Team role is a member of a team, team is nested under a parent team, or enterprise team maps to its projected organization team",
       "is_traversable": true
     },
     {

openhound_github-0.7.0/src/openhound_github/github_rest_client.py

@@ -0,0 +1,3 @@
+from openhound_github.github_retry import should_retry_github_response
+
+__all__ = ["should_retry_github_response"]

openhound_github-0.7.0/src/openhound_github/github_retry.py

@@ -0,0 +1,48 @@
+from typing import Optional
+
+from requests import Response
+
+
+def _response_message(response: Response) -> str:
+    try:
+        response_data = response.json()
+    except ValueError:
+        return getattr(response, "text", "")
+    if isinstance(response_data, dict):
+        return str(response_data.get("message", ""))
+    return ""
+
+
+def is_primary_rate_limit_response(response: Response) -> bool:
+    if response.status_code not in (403, 429):
+        return False
+
+    message = _response_message(response).lower()
+    return (
+        response.headers.get("x-ratelimit-remaining") == "0"
+        or "api rate limit exceeded" in message
+    )
+
+
+def is_secondary_rate_limit_response(response: Response) -> bool:
+    if response.status_code not in (403, 429):
+        return False
+
+    message = _response_message(response).lower()
+    return "secondary rate limit" in message or "abuse detection" in message
+
+
+def should_retry_github_response(
+    response: Optional[Response], exception: Optional[BaseException]
+) -> bool:
+    if response is None:
+        return False
+
+    return (
+        is_primary_rate_limit_response(response)
+        or is_secondary_rate_limit_response(response)
+        or (
+            response.status_code in (403, 429)
+            and bool(response.headers.get("Retry-After"))
+        )
+    )

{openhound_github-0.6.7 → openhound_github-0.7.0}/src/openhound_github/helpers.py

@@ -14,6 +14,10 @@ from dlt.sources.helpers.rest_client.paginators import (
 from requests import Request
 
 from openhound_github.auth import GitHubAppInstallationAuth
+from openhound_github.github_retry import (
+    is_primary_rate_limit_response,
+    is_secondary_rate_limit_response,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -439,18 +443,14 @@ def github_retry_policy(auth: AuthConfigBase):
         if response.status_code not in (403, 429):
             return False
 
-        message = _response_message(response).lower()
-        if (
-            headers.get("x-ratelimit-remaining") == "0"
-            or "api rate limit exceeded" in message
-        ):
+        if is_primary_rate_limit_response(response):
             reset_at = headers.get("x-ratelimit-reset")
             delay = int(reset_at) - now if reset_at else 0
             headers["Retry-After"] = str(delay)
             logger.warning("Primary rate limit reached, retrying in %s seconds", delay)
             return True
 
-        if "secondary rate limit" in message or "abuse detection" in message:
+        if is_secondary_rate_limit_response(response):
             logger.warning("Secondary rate limit reached, retrying in 60 seconds")
             headers["Retry-After"] = "60"
             return True

{openhound_github-0.6.7 → openhound_github-0.7.0}/src/openhound_github/lookup.py

@@ -205,6 +205,42 @@ class GithubLookup(LookupManager):
             [org_login, slug],
         )
 
+    @lru_cache
+    def external_group_for_team(
+        self, org_login: str, team_database_id: int
+    ) -> tuple[int, str] | None:
+        row = self._find_single_row(
+            f"""
+            SELECT external_group_id, external_group_name
+            FROM {self.schema}.team_external_groups
+            WHERE org_login = ?
+              AND team_database_id = ?
+            """,
+            [org_login, team_database_id],
+        )
+        if row is None:
+            return None
+        return int(row[0]), str(row[1])
+
+    @lru_cache
+    def scim_group_id_for_team_external_group(
+        self, org_login: str, external_group_name: str
+    ) -> str | None:
+        rows = self._find_all_objects(
+            f"""
+            SELECT DISTINCT esg.id
+            FROM {self.schema}.enterprise_scim_groups esg
+            JOIN {self.schema}.enterprise_organizations eo
+              ON eo.enterprise_node_id = esg.enterprise_node_id
+            WHERE eo.login = ?
+              AND esg.display_name = ?
+            """,
+            [org_login, external_group_name],
+        )
+        if not rows or len(rows) != 1:
+            return None
+        return str(rows[0][0])
+
     @lru_cache
     def external_identity_id_for_guid(
         self, guid: str, environment_slug: str

{openhound_github-0.6.7 → openhound_github-0.7.0}/src/openhound_github/main.py

@@ -61,12 +61,14 @@ def preproc(ctx: PreProcContext):
         "repo_roles": "repo_roles",
         "users": "users",
         "teams": "teams",
+        "team_external_groups": "team_external_groups",
         "team_members": "team_members",
         "saml_provider": "saml_provider",
         "external_identities": "external_identities",
         "applications": "applications",
         "enterprise": "enterprise",
         "enterprise_organizations": "enterprise_organizations",
+        "enterprise_scim_groups": "enterprise_scim_groups",
         "enterprise_runner_groups": "enterprise_runner_groups",
         "enterprise_runner_group_organizations": "enterprise_runner_group_organizations",
         "enterprise_runner_group_memberships": "enterprise_runner_group_memberships",

{openhound_github-0.6.7 → openhound_github-0.7.0}/src/openhound_github/models/__init__.py

@@ -62,7 +62,7 @@ from .scim_user import (
     ScimUser,
 )
 from .secret_scanning_alert import SecretScanningAlert
-from .team import Team
+from .team import Team, TeamExternalGroup
 from .team_member import TeamMember
 from .team_role import TeamRole
 from .user import User
@@ -78,6 +78,7 @@ __all__ = [
     "ActionPermission",
     "User",
     "Team",
+    "TeamExternalGroup",
     "TeamRole",
     "TeamMember",
     "Repository",

{openhound_github-0.6.7 → openhound_github-0.7.0}/src/openhound_github/models/team.py

@@ -15,7 +15,7 @@ from openhound_github.main import app
 @dataclass
 class GHTeamProperties(GHNodeProperties):
     """Team-specific properties and accordion panel queries.
-    
+
     Attributes:
         collected: Collected/generated by OpenHound
         github_team_id: The raw GitHub team node ID.
@@ -23,6 +23,8 @@ class GHTeamProperties(GHNodeProperties):
         description: The team's description.
         privacy: The team's privacy level (e.g., `visible`, `secret`).
         type: The team type, such as `enterprise` for projected enterprise teams.
+        external_group_id: GitHub's org-scoped external IdP group identifier.
+        external_group_name: The external IdP group name reported by GitHub.
         environment_name: The name of the environment (GitHub organization).
         query_first_degree_members: Query for first degree members.
         query_unrolled_members: Query for unrolled members.
@@ -40,6 +42,8 @@ class GHTeamProperties(GHNodeProperties):
     description: str | None = None
     privacy: str | None = None
     type: str | None = None
+    external_group_id: int | None = None
+    external_group_name: str | None = None
     environment_name: str | None = None
 
     query_first_degree_members: str | None = None
@@ -74,6 +78,16 @@ class ParentTeam(BaseModel):
     id: str
 
 
+class TeamExternalGroup(BaseModel):
+    """Raw mapping between an org team and its linked external IdP group."""
+
+    org_login: str
+    team_database_id: int
+    external_group_id: int
+    external_group_name: str
+    external_group_updated_at: str | None = None
+
+
 @app.asset(
     node=NodeDef(
         kind=nk.TEAM,
@@ -89,6 +103,13 @@ class ParentTeam(BaseModel):
             description="Team is a child of parent team",
             traversable=False,
         ),
+        EdgeDef(
+            start=nk.SCIM_GROUP,
+            end=nk.TEAM,
+            kind=ek.SCIM_PROVISIONED,
+            description="SCIM group is provisioned as team",
+            traversable=True,
+        ),
     ],
 )
 class Team(BaseAsset):
@@ -120,9 +141,16 @@ class Team(BaseAsset):
         """The ID from a GraphQL API response is the same as a regular node_id"""
         return self.id
 
+    @property
+    def external_group(self) -> tuple[int, str] | None:
+        if self.database_id is None:
+            return None
+        return self._lookup.external_group_for_team(self.org_login, self.database_id)
+
     @property
     def as_node(self) -> GHNode:
         tid = self.node_id
+        external_group = self.external_group
         return GHNode(
             kinds=[nk.TEAM],
             properties=GHTeamProperties(
@@ -132,6 +160,8 @@ class Team(BaseAsset):
                 slug=self.slug,
                 description=self.description,
                 privacy=self.privacy,
+                external_group_id=external_group[0] if external_group else None,
+                external_group_name=external_group[1] if external_group else None,
                 environment_name=self.org_login,
                 environmentid=self.org_node_id,
                 query_first_degree_members=f"MATCH p=(:GH_User)-[:GH_HasRole]->(t:GH_TeamRole)-[:GH_MemberOf]->(:GH_Team {{node_id:'{tid}'}}) RETURN p",
@@ -176,6 +206,19 @@ class Team(BaseAsset):
                 properties=EdgeProperties(traversable=True),
             )
 
+        external_group = self.external_group
+        if external_group:
+            scim_group_id = self._lookup.scim_group_id_for_team_external_group(
+                self.org_login, external_group[1]
+            )
+            if scim_group_id:
+                yield Edge(
+                    kind=ek.SCIM_PROVISIONED,
+                    start=EdgePath(value=scim_group_id, match_by="id"),
+                    end=EdgePath(value=self.node_id, match_by="id"),
+                    properties=EdgeProperties(traversable=True),
+                )
+
         # yield from self._branch_edges
         yield from self._bypass_pull_request_allowances_edges
         yield from self._bypass_push_allowances_edges

{openhound_github-0.6.7 → openhound_github-0.7.0}/src/openhound_github/resources/organization.py

@@ -74,6 +74,7 @@ from openhound_github.models import (
     SelectedOrgSecret,
     SelectedOrgVariable,
     Team,
+    TeamExternalGroup,
     TeamMember,
     TeamRole,
     User,
@@ -111,6 +112,7 @@ class SourceContext:
     cache_lock: Lock = field(default_factory=Lock)
     organizations_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     app_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
+    team_rest_cache: dict[str, list[dict[str, Any]]] = field(default_factory=dict)
     actions_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     runner_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     workflow_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
@@ -222,6 +224,183 @@ def _workflow_permissions(
     )
 
 
+def _rest_teams_for_org(
+    ctx: SourceContext, client: RESTClient, org_name: str
+) -> list[dict[str, Any]]:
+    if org_name not in ctx.team_rest_cache:
+        with ctx.cache_lock:
+            if org_name not in ctx.team_rest_cache:
+                ctx.team_rest_cache[org_name] = [
+                    team
+                    for page in client.paginate(
+                        f"/orgs/{org_name}/teams", params={"per_page": 100}
+                    )
+                    for team in page
+                ]
+    return ctx.team_rest_cache[org_name]
+
+
+def _external_group_skip_reason(exception: BaseException) -> str | None:
+    if not isinstance(exception, requests.HTTPError) or exception.response is None:
+        return None
+
+    status_code = exception.response.status_code
+    if status_code in (401, 403):
+        return "the configured credentials do not have Members organization permission at write level"
+    if status_code == 404:
+        return "the GitHub scope does not expose external groups"
+    return None
+
+
+def _external_group_failure_is_terminal(exception: BaseException) -> bool:
+    if not isinstance(exception, requests.HTTPError) or exception.response is None:
+        return False
+    return exception.response.status_code in (401, 403)
+
+
+def _team_cannot_be_externally_managed(exception: BaseException) -> bool:
+    if not isinstance(exception, requests.HTTPError) or exception.response is None:
+        return False
+    if exception.response.status_code != 400:
+        return False
+
+    try:
+        message = str(exception.response.json().get("message", "")).casefold()
+    except ValueError:
+        return False
+    return "cannot be externally managed" in message and "explicit members" in message
+
+
+def _log_org_external_group_failure(
+    resource: str,
+    org_name: str,
+    exception: BaseException,
+    *,
+    group_id: int | str | None = None,
+) -> None:
+    skip_reason = _external_group_skip_reason(exception)
+    if skip_reason:
+        logger.warning(
+            "Skipping %s for organization '%s': %s",
+            resource,
+            org_name,
+            skip_reason,
+            extra={"resource": resource, "phase": "resource_iteration"},
+        )
+        return
+
+    group_context = f" external group '{group_id}'" if group_id is not None else ""
+    logger.error(
+        "Error in resource '%s' processing organization '%s'%s: %s",
+        resource,
+        org_name,
+        group_context,
+        exception,
+        extra={"resource": resource, "phase": "resource_iteration"},
+    )
+
+
+def _team_database_id(team_id: Any) -> int | None:
+    try:
+        return int(team_id)
+    except (TypeError, ValueError):
+        return None
+
+
+def _team_external_group_row(
+    org_name: str,
+    team_id: Any,
+    group_id: Any,
+    group_name: Any,
+    updated_at: Any,
+) -> dict[str, Any] | None:
+    team_database_id = _team_database_id(team_id)
+    if group_id is None or not group_name:
+        return None
+    if team_database_id is None:
+        return None
+    try:
+        return {
+            "org_login": org_name,
+            "team_database_id": team_database_id,
+            "external_group_id": int(group_id),
+            "external_group_name": str(group_name),
+            "external_group_updated_at": updated_at,
+        }
+    except (TypeError, ValueError):
+        return None
+
+
+def _team_external_groups_by_group(
+    client: RESTClient,
+    org_name: str,
+    groups: list[dict[str, Any]],
+    allowed_team_database_ids: set[int],
+) -> Iterator[dict[str, Any]]:
+    for group in groups:
+        group_id = group.get("group_id")
+        try:
+            response = client.get(f"/orgs/{org_name}/external-group/{group_id}")
+            response.raise_for_status()
+            group_details = response.json()
+        except Exception as e:
+            _log_org_external_group_failure(
+                "team_external_groups",
+                org_name,
+                e,
+                group_id=group_id,
+            )
+            if _external_group_failure_is_terminal(e):
+                return
+            continue
+
+        group_name = group_details.get("group_name") or group.get("group_name")
+        updated_at = group_details.get("updated_at") or group.get("updated_at")
+        for team in group_details.get("teams") or []:
+            team_database_id = _team_database_id(team.get("team_id"))
+            if team_database_id not in allowed_team_database_ids:
+                continue
+            row = _team_external_group_row(
+                org_name,
+                team_database_id,
+                group_id,
+                group_name,
+                updated_at,
+            )
+            if row:
+                yield row
+
+
+def _team_external_groups_by_team(
+    client: RESTClient, org_name: str, teams: list[dict[str, Any]]
+) -> Iterator[dict[str, Any]]:
+    for team in teams:
+        try:
+            response = client.get(
+                f"/orgs/{org_name}/teams/{_encode_path_segment(str(team['slug']))}/external-groups"
+            )
+            response.raise_for_status()
+            group_details = response.json()
+        except Exception as e:
+            if _team_cannot_be_externally_managed(e):
+                continue
+            _log_org_external_group_failure("team_external_groups", org_name, e)
+            if _external_group_failure_is_terminal(e):
+                return
+            continue
+
+        for group in group_details.get("groups") or []:
+            row = _team_external_group_row(
+                org_name,
+                team.get("id"),
+                group.get("group_id"),
+                group.get("group_name"),
+                group.get("updated_at"),
+            )
+            if row:
+                yield row
+
+
 def _repo_permission_role(repo: dict[str, Any]) -> str:
     role_name = repo.get("role_name")
     if role_name:
@@ -574,12 +753,9 @@ def projected_enterprise_teams(ctx: SourceContext):
         org_name = org.org_name
         client = org.client
         try:
-            for page in client.paginate(
-                f"/orgs/{org_name}/teams", params={"per_page": 100}
-            ):
-                for team in page:
-                    if str(team.get("slug", "")).startswith("ent:") and team.get("node_id"):
-                        yield {**team, "org_login": org_name}
+            for team in _rest_teams_for_org(ctx, client, org_name):
+                if str(team.get("slug", "")).startswith("ent:") and team.get("node_id"):
+                    yield {**team, "org_login": org_name}
         except Exception as e:
             logger.error(
                 f"Error in resource 'projected_enterprise_teams' processing organization '{org_name}': {e}",
@@ -588,6 +764,58 @@ def projected_enterprise_teams(ctx: SourceContext):
             continue
 
 
+@app.resource(
+    name="team_external_groups",
+    columns=TeamExternalGroup,
+    parallelized=True,
+)
+def team_external_groups(ctx: SourceContext):
+    """Collect external IdP group mappings for normal organization teams."""
+
+    for org in ctx.organizations:
+        org_name = org.org_name
+        client = org.client
+        try:
+            groups = [
+                group
+                for page in client.paginate(
+                    f"/orgs/{org_name}/external-groups",
+                    params={"per_page": 100},
+                    data_selector="groups",
+                )
+                for group in page
+                if group.get("group_id") is not None
+            ]
+            if not groups:
+                continue
+
+            teams = [
+                team
+                for team in _rest_teams_for_org(ctx, client, org_name)
+                if team.get("id") is not None
+                and team.get("slug")
+                and not str(team["slug"]).startswith("ent:")
+            ]
+            team_database_ids = {
+                team_database_id
+                for team in teams
+                if (team_database_id := _team_database_id(team["id"])) is not None
+            }
+
+            if len(groups) <= len(teams):
+                yield from _team_external_groups_by_group(
+                    client,
+                    org_name,
+                    groups,
+                    team_database_ids,
+                )
+            else:
+                yield from _team_external_groups_by_team(client, org_name, teams)
+        except Exception as e:
+            _log_org_external_group_failure("team_external_groups", org_name, e)
+            continue
+
+
 @app.transformer(name="team_roles", columns=TeamRole, parallelized=True)
 def team_roles(team: Team):
     """Yield the two built-in team roles (members and maintainers) for a team.
@@ -2061,6 +2289,7 @@ def organization_resources(ctx: SourceContext):
     personal_access_tokens_resource = personal_access_tokens(ctx)
 
     teams_resource = teams(ctx)
+    team_external_groups_resource = team_external_groups(ctx)
     repositories_graphql_resource = repositories_graphql(ctx)
     app_installs_resource = app_installations(ctx)
     runner_groups_resource = runner_groups(ctx)
@@ -2090,6 +2319,7 @@ def organization_resources(ctx: SourceContext):
         repos_resource | repository_secrets(ctx),
         repos_resource | repository_variables(ctx),
         teams_resource,
+        team_external_groups_resource,
         projected_enterprise_teams_resource,
         org_scim_organizations_resource,
         teams_resource | team_members(ctx),

{openhound_github-0.6.7 → openhound_github-0.7.0}/src/openhound_github/source.py

@@ -156,6 +156,7 @@ class SourceContext:
     cache_lock: Lock = field(default_factory=Lock)
     organizations_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     app_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
+    team_rest_cache: dict[str, list[dict[str, Any]]] = field(default_factory=dict)
     actions_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     runner_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     workflow_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)