openhound-github 0.7.0__tar.gz → 0.7.2__tar.gz

{openhound_github-0.7.0 → openhound_github-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.7.0
+Version: 0.7.2
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md

{openhound_github-0.7.0 → openhound_github-0.7.2}/docs/og-docs.json

@@ -1,6 +1,7 @@
 {
     "extensionSchemaPath": "extension/schema.json",
     "extensionShortName": "GitHub",
+    "collectorName": "github",
     "gitHubBaseUrl": "https://github.com/SpecterOps/openhound-github",
     "stripTitlePrefix": "GitHub: ",
     "savedSearchesDir": "extension/saved_searches",

{openhound_github-0.7.0 → openhound_github-0.7.2}/src/openhound_github/graphql.py

@@ -98,7 +98,7 @@ ENTERPRISE_ADMINS_QUERY = """
 query EnterpriseAdmins($slug: String!, $count: Int = 100, $after: String = null) {
     enterprise(slug: $slug) {
         ownerInfo {
-            admins(first: $count, after: $after) {
+            admins(first: $count, after: $after, role: OWNER) {
                 edges {
                     node {
                         id
@@ -115,6 +115,23 @@ query EnterpriseAdmins($slug: String!, $count: Int = 100, $after: String = null)
 }
 """
 
+ORGANIZATION_ENTERPRISE_OWNERS_QUERY = """
+query OrganizationEnterpriseOwners($login: String!, $count: Int = 100, $after: String = null) {
+    organization(login: $login) {
+        enterpriseOwners(first: $count, after: $after) {
+            nodes {
+                id
+                login
+            }
+            pageInfo {
+                endCursor
+                hasNextPage
+            }
+        }
+    }
+}
+"""
+
 ENTERPRISE_SAML_QUERY = """
 query EnterpriseSAML($slug: String!, $count: Int = 100, $after: String = null) {
     enterprise(slug: $slug) {

{openhound_github-0.7.0 → openhound_github-0.7.2}/src/openhound_github/models/enterprise_admin.py

@@ -18,4 +18,4 @@ from openhound_github.models.enterprise_role_user import EnterpriseRoleUser
     ],
 )
 class EnterpriseAdmin(EnterpriseRoleUser):
-    pass
+    role_id: str

{openhound_github-0.7.0 → openhound_github-0.7.2}/src/openhound_github/models/enterprise_role.py

@@ -118,16 +118,167 @@ class GHEnterpriseRoleProperties(GHNodeProperties):
             description="Enterprise contains role",
             traversable=False,
         ),
-        *[
-            EdgeDef(
-                start=nk.ENTERPRISE_ROLE,
-                end=nk.ENTERPRISE,
-                kind=edge_kind,
-                description=f"Enterprise role has {permission} capability",
-                traversable=traversable,
-            )
-            for permission, (edge_kind, traversable) in ENTERPRISE_PERMISSION_EDGES.items()
-        ],
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.CREATE_ENTERPRISE_ORGANIZATIONS,
+            description="Enterprise role has create_enterprise_organizations capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.EDIT_ENTERPRISE_CUSTOM_PROPERTIES_FOR_ORGANIZATIONS,
+            description="Enterprise role has edit_enterprise_custom_properties_for_organizations capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.MANAGE_ENTERPRISE_ADMINS,
+            description="Enterprise role has manage_enterprise_admins capability",
+            traversable=True,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.MANAGE_ENTERPRISE_IDENTITY_PROVIDER,
+            description="Enterprise role has manage_enterprise_identity_provider capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.MANAGE_ENTERPRISE_MEMBERS,
+            description="Enterprise role has manage_enterprise_members capability",
+            traversable=True,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.MANAGE_ENTERPRISE_ORGANIZATION_ADMINS,
+            description="Enterprise role has manage_enterprise_organization_admins capability",
+            traversable=True,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.MANAGE_ENTERPRISE_ORGANIZATIONS,
+            description="Enterprise role has manage_enterprise_organizations capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.MANAGE_ENTERPRISE_REFERRALS,
+            description="Enterprise role has manage_enterprise_referrals capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.MANAGE_ENTERPRISE_TEAMS,
+            description="Enterprise role has manage_enterprise_teams capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.READ_ENTERPRISE_AUDIT_LOG,
+            description="Enterprise role has read_enterprise_audit_log capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.READ_ENTERPRISE_DOMAIN_VERIFICATION,
+            description="Enterprise role has read_enterprise_domain_verification capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.READ_ENTERPRISE_MEMBERS,
+            description="Enterprise role has read_enterprise_members capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.READ_ENTERPRISE_ORG_PROJECTS,
+            description="Enterprise role has read_enterprise_org_projects capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.READ_ENTERPRISE_ORGANIZATION_ADMIN,
+            description="Enterprise role has read_enterprise_organization_admin capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.SET_ENTERPRISE_INTERACTION_LIMITS,
+            description="Enterprise role has set_enterprise_interaction_limits capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.VIEW_ENTERPRISE_ACTIONS_USAGE_METRICS,
+            description="Enterprise role has view_enterprise_actions_usage_metrics capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.VIEW_ENTERPRISE_BILLING,
+            description="Enterprise role has view_enterprise_billing capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.VIEW_ENTERPRISE_SECRET_SCANNING_ALERTS,
+            description="Enterprise role has view_enterprise_secret_scanning_alerts capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.WRITE_ENTERPRISE_ACTIONS_POLICIES,
+            description="Enterprise role has write_enterprise_actions_policies capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.WRITE_ENTERPRISE_BILLING,
+            description="Enterprise role has write_enterprise_billing capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.WRITE_ENTERPRISE_PERSONAL_ACCESS_TOKEN_POLICIES,
+            description="Enterprise role has write_enterprise_personal_access_token_policies capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.WRITE_ENTERPRISE_SSO,
+            description="Enterprise role has write_enterprise_sso capability",
+            traversable=False,
+        ),
+        EdgeDef(
+            start=nk.ENTERPRISE_ROLE,
+            end=nk.ENTERPRISE,
+            kind=ek.WRITE_ENTERPRISE_TEAM_MEMBERS,
+            description="Enterprise role has write_enterprise_team_members capability",
+            traversable=False,
+        ),
     ],
 )
 class EnterpriseRole(BaseAsset):

{openhound_github-0.7.0 → openhound_github-0.7.2}/src/openhound_github/models/runner.py

@@ -29,7 +29,7 @@ _PRIVATE_REPOSITORY_CREATION_EDGE_KINDS = (
 @dataclass
 class GHRunnerGroupProperties(GHNodeProperties):
     """Properties for GHRunnerGroupProperties.
-    
+
     Attributes:
         scope: Whether the runner group is enterprise or organization scoped.
         group_id: The GitHub runner group ID.
@@ -272,7 +272,9 @@ class EnterpriseRunnerGroup(BaseAsset):
         )
 
 
-@app.asset()
+@app.asset(
+    description="Maps an enterprise runner group to an organization without emitting a node."
+)
 class EnterpriseRunnerGroupOrganization(BaseAsset):
     node_id: str
     login: str | None = None
@@ -296,7 +298,7 @@ class EnterpriseRunnerGroupOrganization(BaseAsset):
 @dataclass
 class GHRunnerProperties(GHNodeProperties):
     """Properties for GHRunnerProperties.
-    
+
     Attributes:
         scope: Whether the runner is enterprise, organization, or repository scoped.
         runner_id: The GitHub runner ID.
@@ -579,7 +581,9 @@ class OrgRunnerGroupAccess(BaseAsset):
 
         actions_enabled_repository_node_ids = {
             repository_node_id
-            for (repository_node_id,) in self._lookup.actions_enabled_repository_node_ids_for_org(
+            for (
+                repository_node_id,
+            ) in self._lookup.actions_enabled_repository_node_ids_for_org(
                 self.org_login
             )
         }

{openhound_github-0.7.0 → openhound_github-0.7.2}/src/openhound_github/models/scim_user.py

@@ -137,7 +137,7 @@ class ScimOrganization(ScimScopeAsset):
         return []
 
 
-@app.asset()
+@app.asset(description="Represents enterprise-scoped SCIM organization input data.")
 class EnterpriseScimOrganization(ScimOrganization):
     """Enterprise-scoped SCIM organization input model.
 
@@ -241,7 +241,7 @@ class ScimUser(ScimScopeAsset):
             )
 
 
-@app.asset()
+@app.asset(description="Represents enterprise-scoped SCIM user input data.")
 class EnterpriseScimUser(ScimUser):
     """Enterprise-scoped SCIM user input model."""
 

{openhound_github-0.7.0 → openhound_github-0.7.2}/src/openhound_github/resources/enterprise.py

@@ -1,5 +1,6 @@
 import logging
-from dataclasses import dataclass
+from dataclasses import dataclass, field
+from typing import Any
 
 from dlt.sources.helpers.rest_client.client import RESTClient
 from dlt.sources.helpers.rest_client.paginators import OffsetPaginator
@@ -7,6 +8,7 @@ from dlt.sources.helpers.rest_client.paginators import OffsetPaginator
 from openhound_github.graphql import (
     ENTERPRISE_ADMINS_QUERY,
     ENTERPRISE_MEMBERS_QUERY,
+    ORGANIZATION_ENTERPRISE_OWNERS_QUERY,
     ENTERPRISE_SAML_PROVIDER_QUERY,
     ENTERPRISE_QUERY,
     ENTERPRISE_SAML_QUERY,
@@ -65,6 +67,7 @@ class SourceContext:
     emit_legacy_scim_correlations: bool = False
     github_deployment_id: str = DEFAULT_GITHUB_DEPLOYMENT_ID
     github_web_origin: str = DEFAULT_GITHUB_WEB_ORIGIN
+    organizations: list[Any] = field(default_factory=list)
 
 
 def _graphql_client(ctx: SourceContext) -> tuple[RESTClient, str]:
@@ -641,6 +644,60 @@ def enterprise_role_users(role: EnterpriseRole, ctx: SourceContext):
 
 @app.transformer(name="enterprise_admins", columns=EnterpriseAdmin, parallelized=True)
 def enterprise_admins(enterprise_data: Enterprise, ctx: SourceContext):
+    seen_node_ids: set[str] = set()
+    owner_info_completed = False
+    client, graphql_path = _sso_graphql_client(ctx)
+    if not client:
+        client, graphql_path = _graphql_client(ctx)
+
+    try:
+        for row in _enterprise_admins_from_owner_info(
+            enterprise_data, ctx, client, graphql_path
+        ):
+            seen_node_ids.add(row["node_id"])
+            yield row
+        owner_info_completed = True
+    except Exception as e:
+        logger.warning(
+            "Unable to collect enterprise owners from ownerInfo.admins for "
+            "enterprise '%s'; trying organization.enterpriseOwners fallback: %s",
+            ctx.enterprise_name,
+            e,
+            extra={"resource": "enterprise_admins", "phase": "resource_iteration"},
+        )
+
+    if owner_info_completed and seen_node_ids:
+        return
+
+    for row in _enterprise_admins_from_organizations(enterprise_data, ctx):
+        if row["node_id"] in seen_node_ids:
+            continue
+        seen_node_ids.add(row["node_id"])
+        yield row
+
+
+def _enterprise_admin_row(
+    node: dict[str, Any], enterprise_data: Enterprise, ctx: SourceContext
+) -> dict[str, Any] | None:
+    node_id = node.get("id")
+    if not node_id:
+        return None
+    return {
+        "node_id": node_id,
+        "login": node.get("login"),
+        "assignment": "direct",
+        "role_id": "owners",
+        "enterprise_node_id": enterprise_data.id,
+        "enterprise_slug": ctx.enterprise_name,
+    }
+
+
+def _enterprise_admins_from_owner_info(
+    enterprise_data: Enterprise,
+    ctx: SourceContext,
+    client: RESTClient,
+    graphql_path: str,
+):
     paginator = GraphQLCursorPaginator(
         page_info_path="data.enterprise.ownerInfo.admins.pageInfo",
         cursor_variable="after",
@@ -652,7 +709,6 @@ def enterprise_admins(enterprise_data: Enterprise, ctx: SourceContext):
         "query": ENTERPRISE_ADMINS_QUERY,
         "variables": {"slug": ctx.enterprise_name, "count": 100, "after": None},
     }
-    client, graphql_path = _graphql_client(ctx)
     for page_data in client.paginate(
         graphql_path,
         method="POST",
@@ -664,16 +720,60 @@ def enterprise_admins(enterprise_data: Enterprise, ctx: SourceContext):
             es_data = enterprise_object.get("enterprise", {})
             owner_info = es_data.get("ownerInfo") or {}
             for edge in (owner_info.get("admins") or {}).get("edges") or []:
-                node = edge.get("node")
-                if node and node.get("id"):
-                    yield {
-                        "node_id": node["id"],
-                        "login": node.get("login"),
-                        "assignment": "direct",
-                        "role_id": "owners",
-                        "enterprise_node_id": enterprise_data.id,
-                        "enterprise_slug": ctx.enterprise_name,
-                    }
+                row = _enterprise_admin_row(edge.get("node") or {}, enterprise_data, ctx)
+                if row:
+                    yield row
+
+
+def _enterprise_admins_from_organizations(
+    enterprise_data: Enterprise, ctx: SourceContext
+):
+    for org in getattr(ctx, "organizations", None) or []:
+        paginator = GraphQLCursorPaginator(
+            page_info_path="data.organization.enterpriseOwners.pageInfo",
+            cursor_variable="after",
+            cursor_field="endCursor",
+            has_next_field="hasNextPage",
+            allow_missing_page_info=True,
+        )
+        data = {
+            "query": ORGANIZATION_ENTERPRISE_OWNERS_QUERY,
+            "variables": {"login": org.org_name, "count": 100, "after": None},
+        }
+        client, graphql_path = graphql_client_and_path(
+            org.client, getattr(org, "graphql_client", None)
+        )
+        found_owner = False
+        try:
+            for page_data in client.paginate(
+                graphql_path,
+                method="POST",
+                json=data,
+                paginator=paginator,
+                data_selector="data",
+            ):
+                for organization_object in page_data:
+                    organization = organization_object.get("organization", {})
+                    for node in (organization.get("enterpriseOwners") or {}).get(
+                        "nodes"
+                    ) or []:
+                        row = _enterprise_admin_row(node, enterprise_data, ctx)
+                        if row:
+                            found_owner = True
+                            yield row
+        except Exception as e:
+            logger.warning(
+                "Unable to collect enterprise owners through organization '%s' "
+                "for enterprise '%s': %s",
+                org.org_name,
+                ctx.enterprise_name,
+                e,
+                extra={"resource": "enterprise_admins", "phase": "resource_iteration"},
+            )
+            continue
+
+        if found_owner:
+            return
 
 
 @app.transformer(