praetorian-cli 2.4.1__tar.gz → 2.4.2__tar.gz

{praetorian_cli-2.4.1/praetorian_cli.egg-info → praetorian_cli-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: praetorian-cli
-Version: 2.4.1
+Version: 2.4.2
 Summary: For interacting with the Guard API
 Home-page: https://github.com/praetorian-inc/praetorian-cli
 Author: Praetorian

praetorian_cli-2.4.2/praetorian_cli/handlers/access.py

@@ -0,0 +1,209 @@
+import os
+
+import click
+
+from praetorian_cli.handlers.chariot import chariot
+from praetorian_cli.handlers.cli_decorators import cli_handler
+
+
+def extract_prefix(email):
+    """Extract the profile prefix from a Guard account email.
+
+    Takes the portion after '+' and before '@'.
+    If no '+' exists, uses the full local part (before '@').
+
+    Examples:
+        chariot+proceptbiorobotics@praetorian.com -> proceptbiorobotics
+        chariot+grant_street_group-ztw@praetorian.com -> grant_street_group-ztw
+        user@example.com -> user
+    """
+    local_part = email.split('@')[0]
+    if '+' in local_part:
+        return local_part.split('+', 1)[1]
+    return local_part
+
+
+def extract_account_id(credential_key):
+    """Extract the AWS account ID from a credential key.
+
+    Keys look like: #account#chariot+client@praetorian.com#amazon#325281727610
+    The account ID is the last segment.
+    """
+    return credential_key.rstrip('#').split('#')[-1]
+
+
+def build_aws_config_profiles(account_email, prefix, credential_id, root_account_id, sub_accounts, category='env-integration'):
+    """Build a list of (profile_name, profile_dict) tuples for AWS config.
+
+    Args:
+        account_email: The Guard account email (used in credential_process command)
+        prefix: The profile name prefix
+        credential_id: The credential UUID
+        root_account_id: The root AWS account ID
+        sub_accounts: List of dicts with 'Id' key from Organizations list_accounts,
+                      or empty list if not an org.
+        category: The credential category (e.g., 'env-integration', 'cloud')
+    Returns:
+        List of (profile_name, dict) where dict has credential_process, region, output keys.
+    """
+    profiles = []
+
+    # Collect all account IDs (root + sub-accounts), deduplicated
+    all_account_ids = [root_account_id]
+    for acct in sub_accounts:
+        if acct['Id'] != root_account_id:
+            all_account_ids.append(acct['Id'])
+
+    for account_id in all_account_ids:
+        profile_name = f'{prefix}-{account_id}'
+        credential_process = (
+            f'guard --account {account_email} get credential {credential_id} '
+            f'--category {category} --type aws --format credential-process '
+            f'--parameters accountId {account_id}'
+        )
+        profiles.append((profile_name, {
+            'credential_process': credential_process,
+            'region': 'us-east-1',
+            'output': 'json',
+        }))
+
+    return profiles
+
+
+def write_aws_config(profiles, config_path=None):
+    """Write AWS config profiles, preserving existing unrelated profiles.
+
+    Args:
+        profiles: List of (profile_name, profile_dict) tuples.
+        config_path: Path to AWS config file. Defaults to ~/.aws/config.
+    """
+    from configparser import ConfigParser
+    from pathlib import Path
+
+    if config_path is None:
+        config_path = os.path.join(Path.home(), '.aws', 'config')
+
+    config = ConfigParser()
+    if os.path.exists(config_path):
+        config.read(config_path)
+
+    for profile_name, profile_data in profiles:
+        section = f'profile {profile_name}'
+        if not config.has_section(section):
+            config.add_section(section)
+        for key, value in profile_data.items():
+            config.set(section, key, value)
+
+    parent_dir = os.path.dirname(config_path)
+    if parent_dir:
+        os.makedirs(parent_dir, exist_ok=True)
+    with open(config_path, 'w') as f:
+        config.write(f)
+
+
+@chariot.group()
+def access():
+    """Configure credential access for cloud providers."""
+    pass
+
+
+@access.command()
+@cli_handler
+@click.option('--account', default=None, help='Guard account email to discover AWS credentials for (also inherited from guard --account)')
+@click.option('--prefix', default=None, help='Override the profile name prefix (default: derived from email)')
+def aws(sdk, account, prefix):
+    """Generate AWS CLI config profiles from Guard credentials.
+
+    Discovers AWS credentials for the given account, enumerates sub-accounts
+    via Organizations (if applicable), and writes ~/.aws/config profiles that
+    use guard as the credential_process.
+
+    The --account can be provided here or as the top-level guard --account flag.
+
+    \b
+    Example usages:
+        - guard --account chariot+client@praetorian.com access aws
+        - guard access aws --account chariot+client@praetorian.com
+        - guard access aws --account chariot+client@praetorian.com --prefix myclient
+    """
+    import boto3
+
+    # Resolve account: explicit --account on this command, or inherited from guard --account
+    if account is None:
+        account = sdk.keychain.account
+    if account is None:
+        raise click.ClickException('--account is required. Provide it here or as guard --account.')
+
+    sdk.keychain.assume_role(account)
+
+    if prefix is None:
+        prefix = extract_prefix(account)
+
+    # List credentials and filter to AWS type
+    creds_response = sdk.credentials.list()
+    credentials_list = creds_response[0] if isinstance(creds_response, tuple) else []
+
+    aws_credentials = [c for c in credentials_list if c.get('type', '') == 'aws']
+
+    if not aws_credentials:
+        click.echo(f'No AWS credentials found for account {account}')
+        return
+
+    all_profiles = []
+
+    for cred in aws_credentials:
+        credential_id = cred.get('credentialId', '')
+        account_key = cred.get('accountKey', '')
+        category = cred.get('category', 'env-integration')
+        root_account_id = extract_account_id(account_key)
+
+        # Fetch the root credential to get temp AWS creds
+        try:
+            result = sdk.credentials.get(credential_id, category, 'aws', ['token'])
+        except Exception as e:
+            click.echo(f'Warning: failed to get credential {credential_id}: {e}')
+            continue
+
+        access_key = result.get('credentialValue', {}).get('accessKeyId')
+        secret_key = result.get('credentialValue', {}).get('secretAccessKey')
+        session_token = result.get('credentialValue', {}).get('sessionToken')
+
+        if not access_key:
+            click.echo(f'Warning: credential {credential_id} returned no access key')
+            continue
+
+        # Try Organizations to discover sub-accounts
+        sub_accounts = []
+        try:
+            org_client = boto3.client(
+                'organizations',
+                aws_access_key_id=access_key,
+                aws_secret_access_key=secret_key,
+                aws_session_token=session_token,
+                region_name='us-east-1'
+            )
+            paginator = org_client.get_paginator('list_accounts')
+            for page in paginator.paginate():
+                sub_accounts.extend(page['Accounts'])
+        except Exception:
+            # Not an org account — that's fine, just use the root
+            pass
+
+        profiles = build_aws_config_profiles(
+            account_email=account,
+            prefix=prefix,
+            credential_id=credential_id,
+            root_account_id=root_account_id,
+            sub_accounts=sub_accounts,
+            category=category,
+        )
+        all_profiles.extend(profiles)
+
+    if not all_profiles:
+        click.echo(f'No AWS profiles could be generated for account {account}')
+        return
+
+    write_aws_config(all_profiles)
+    click.echo(f'Wrote {len(all_profiles)} AWS profile(s) to ~/.aws/config:')
+    for profile_name, _ in all_profiles:
+        click.echo(f'  {profile_name}')

{praetorian_cli-2.4.1 → praetorian_cli-2.4.2}/praetorian_cli/handlers/configure.py

@@ -6,7 +6,7 @@ from praetorian_cli.sdk.keychain import Keychain, DEFAULT_API, DEFAULT_CLIENT_ID
 @click.pass_context
 def configure(click_context):
     """Configure the CLI with API key authentication."""
-    
+
     api_key_id = click.prompt("Enter your API Key ID")
     api_key_secret = click.prompt("Enter your API Key secret", hide_input=True)
 

{praetorian_cli-2.4.1 → praetorian_cli-2.4.2}/praetorian_cli/handlers/engagement.py

@@ -18,16 +18,17 @@ from praetorian_cli.handlers.add import add
 @click.option('--type', 'customer_type', type=click.Choice(['ENGAGEMENT', 'MANAGED', 'SAAS', 'PILOT', 'FREEMIUM']),
               default='ENGAGEMENT', show_default=True, help='Customer type')
 @click.option('--collaborator', multiple=True, help='Additional collaborator emails (format: email:role)')
-def create_customer(sdk, email, display_name, scan_level, customer_type, collaborator):
+@click.option('--allowed-domain', multiple=True, help='Allowed email domains for collaborators (e.g., acme.com)')
+def create_customer(sdk, email, display_name, scan_level, customer_type, collaborator, allowed_domain):
     """ Create a new customer account on the Guard platform
 
     Creates a Cognito user, Guard account, and adds default collaborators.
 
     \b
     Example usages:
-        - guard add customer --email ops@acme.com --name "ACME Corp"
-        - guard add customer --email ops@acme.com --name "ACME Corp" --type MANAGED
-        - guard add customer --email ops@acme.com --name "ACME Corp" --collaborator "analyst@praetorian.com:admin"
+        - guard add customer --email ops@acme.com --name "ACME Corp" --allowed-domain acme.com
+        - guard add customer --email ops@acme.com --name "ACME Corp" --type MANAGED --allowed-domain acme.com
+        - guard add customer --email ops@acme.com --name "ACME Corp" --allowed-domain acme.com --collaborator "analyst@praetorian.com:admin"
     """
     body = {
         'username': email,
@@ -47,6 +48,8 @@ def create_customer(sdk, email, display_name, scan_level, customer_type, collabo
                 collabs.append({'email': c, 'role': 'admin'})
         body['collaborators'] = collabs
 
+    body['allowed_domains'] = [d.lower().strip() for d in allowed_domain]
+
     result = sdk.post('customer/onboard', body)
     click.echo(f'Customer created: {email} ({display_name})')
     print_json(result)

{praetorian_cli-2.4.1 → praetorian_cli-2.4.2}/praetorian_cli/handlers/list.py

@@ -99,7 +99,12 @@ def integrations(chariot, filter, details, offset, page):
 
 @list.command()
 @list_params('group of the job asset')
-def jobs(chariot, filter, details, offset, page):
+@click.option('-c', '--capability', default=None, help='Filter by capability name (e.g., nuclei, portscan, diana-agent)')
+@click.option('-s', '--status', type=click.Choice(['JQ', 'JR', 'JP', 'JF']),
+              default=None, help='Filter by job status (JQ=queued, JR=running, JP=passed, JF=failed)')
+@click.option('-t', '--target', default=None, help='Filter by target DNS or hostname')
+@click.option('--summary', is_flag=True, default=False, help='Show job count summary by capability and status')
+def jobs(chariot, capability, status, target, summary, filter, details, offset, page):
     """
     List jobs
 
@@ -110,10 +115,24 @@ def jobs(chariot, filter, details, offset, page):
     Example usages:
         - guard list jobs
         - guard list jobs --filter www.example.com
+        - guard list jobs --capability nuclei
+        - guard list jobs --capability diana-agent --details
+        - guard list jobs --status JR
+        - guard list jobs --target api.example.com
+        - guard list jobs --summary
         - guard list jobs --details
         - guard list jobs --page all
     """
-    render_list_results(chariot.jobs.list(filter, offset, pagination_size(page)), details)
+    if summary:
+        print_json(chariot.jobs.summary(pagination_size(page)))
+    elif capability:
+        render_list_results(chariot.jobs.list_by_capability(capability, offset, pagination_size(page)), details)
+    elif status:
+        render_list_results(chariot.jobs.list_by_status(status, offset, pagination_size(page)), details)
+    elif target:
+        render_list_results(chariot.jobs.list_by_target(target, offset, pagination_size(page)), details)
+    else:
+        render_list_results(chariot.jobs.list(filter, offset, pagination_size(page)), details)
 
 
 @list.command()

{praetorian_cli-2.4.1 → praetorian_cli-2.4.2}/praetorian_cli/main.py

@@ -1,5 +1,6 @@
 import click
 
+import praetorian_cli.handlers.access
 import praetorian_cli.handlers.add
 import praetorian_cli.handlers.aegis
 import praetorian_cli.handlers.agent