qualys-cli 0.1.1__py3-none-any.whl

qualys_cli/commands/scanauth.py

@@ -0,0 +1,291 @@
+# Hand-edited — do NOT regenerate from api-model.json (codegen will skip this file).
+# Scan Authentication API  (Basic auth, XML responses)
+# Originally generated from api-model.json; corrections:
+#   - record list: added --type to route per-type queries to /api/2.0/fo/auth/<type>/
+#     (without --type uses the generic /api/2.0/fo/auth/ that returns all types)
+#   - vault create: exposed common type-specific fields (--appid, --safe, --url,
+#     --username, --password, --token, --namespace, --role, --secret-id) plus a
+#     repeatable --field key=value escape hatch for any other type-specific param
+from __future__ import annotations
+
+import typer
+
+from .. import client as _c
+from ..formatters import DEFAULT_LIMIT, output
+
+app = typer.Typer(name="scanauth", help="Scan Authentication APIs (Basic auth)")
+
+# ── record ────────────────────────────────────────────────────────────────────
+_record = typer.Typer(help="Authentication record operations")
+app.add_typer(_record, name="record")
+
+
+_RECORD_TYPES = (
+    "unix", "windows", "oracle", "oracle_listener", "ms_sql", "mysql", "db2",
+    "snmp", "http", "postgresql", "vmware", "ibm_was", "tomcat", "jboss",
+    "mongodb", "cisco", "checkpoint_firewall", "palo_alto_firewall",
+    "ad_workspace", "azure", "aws", "gcp", "kubernetes", "docker",
+    "nginx", "neo4j", "sybase", "mariadb", "informix", "as400",
+)
+
+
+@_record.command("list")
+def record_list(
+    ctx: typer.Context,
+    type_: str | None = typer.Option(
+        None, "--type",
+        help=f"Auth record type — selects the per-type endpoint. One of: {', '.join(_RECORD_TYPES)}",
+    ),
+    ids: str | None = typer.Option(None, "--ids", help="Filter by record IDs (comma-separated)"),
+    title: str | None = typer.Option(None, "--title", help="Filter by title substring"),
+    id_min: int | None = typer.Option(None, "--id-min"),
+    id_max: int | None = typer.Option(None, "--id-max"),
+    limit: int = typer.Option(DEFAULT_LIMIT, "--limit", "-n"),
+    format: str = typer.Option("table", "--format", "-f"),
+    output_file: str | None = typer.Option(None, "--output-file", "-o"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+):
+    """List authentication records.
+
+    Without --type, lists records across all types (/api/2.0/fo/auth/).
+    With --type, queries the per-type endpoint (e.g. /api/2.0/fo/auth/unix/).
+
+    Source: https://docs.qualys.com/en/vm/api/scanauth/record_list/list_records.htm
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    params: dict = {"action": "list"}
+    if ids:
+        params["ids"] = ids
+    if title:
+        params["title"] = title
+    if id_min is not None:
+        params["id_min"] = id_min
+    if id_max is not None:
+        params["id_max"] = id_max
+    path = f"/api/2.0/fo/auth/{type_}/" if type_ else "/api/2.0/fo/auth/"
+    data = client.post_xml(path, data=params)
+    output(data, format=format, limit=limit, output_file=output_file)
+
+
+# ── vault ─────────────────────────────────────────────────────────────────────
+_vault = typer.Typer(help="Authentication vault operations")
+app.add_typer(_vault, name="vault")
+
+
+@_vault.command("list")
+def vault_list(
+    ctx: typer.Context,
+    title: str | None = typer.Option(None, "--title"),
+    type_: str | None = typer.Option(None, "--type", help="Vault type (e.g. CyberArk AIM)"),
+    modified: str | None = typer.Option(None, "--modified", help="Modified on/after YYYY-MM-DD"),
+    orderby: str | None = typer.Option(None, "--orderby", help="id|title|system_name|last_modified"),
+    sortorder: str | None = typer.Option(None, "--sortorder", help="asc|desc"),
+    limit: int = typer.Option(DEFAULT_LIMIT, "--limit", "-n"),
+    format: str = typer.Option("table", "--format", "-f"),
+    output_file: str | None = typer.Option(None, "--output-file", "-o"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+):
+    """List authentication vaults.
+
+    Source: https://docs.qualys.com/en/vm/api/scanauth/vaults/list_vaults.htm
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    params: dict = {"action": "list"}
+    if title:
+        params["title"] = title
+    if type_:
+        params["type"] = type_
+    if modified:
+        params["modified"] = modified
+    if orderby:
+        params["orderby"] = orderby
+    if sortorder:
+        params["sortorder"] = sortorder
+    data = client.post_xml("/api/2.0/fo/vault/", data=params)
+    output(data, format=format, limit=limit, output_file=output_file)
+
+
+@_vault.command("create")
+def vault_create(
+    ctx: typer.Context,
+    title: str = typer.Option(..., "--title"),
+    type_: str = typer.Option(..., "--type", help="Vault type (e.g. CyberArk AIM)"),
+    comments: str | None = typer.Option(None, "--comments"),
+    # ── Type-specific fields ───────────────────────────────────────────────
+    # CyberArk AIM: appid + safe + url (required by the API for that type)
+    # Thycotic Secret Server: api_url + token + secret_id
+    # HashiCorp KV: url + namespace + role
+    # Other types: pass arbitrary fields with repeated --field key=value.
+    appid: str | None = typer.Option(
+        None, "--appid", help="CyberArk AIM: application ID (required for that type)"
+    ),
+    safe: str | None = typer.Option(
+        None, "--safe", help="CyberArk AIM / PIM: safe name (required for those types)"
+    ),
+    url: str | None = typer.Option(
+        None, "--url", help="Vault server URL (required for most types)"
+    ),
+    username: str | None = typer.Option(None, "--username", help="Vault auth username"),
+    password: str | None = typer.Option(None, "--password", help="Vault auth password"),
+    token: str | None = typer.Option(None, "--token", help="API token (Thycotic, HashiCorp, etc.)"),
+    namespace: str | None = typer.Option(None, "--namespace", help="HashiCorp namespace"),
+    role: str | None = typer.Option(None, "--role", help="HashiCorp role"),
+    secret_id: str | None = typer.Option(None, "--secret-id", help="HashiCorp / Thycotic secret ID"),
+    field: list[str] | None = typer.Option(
+        None, "--field",
+        help="Arbitrary type-specific field as key=value (repeatable). "
+             "Use for any param not exposed as a dedicated flag.",
+    ),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+):
+    """Create an authentication vault.
+
+    Each vault type has its own required fields. Common ones are exposed as
+    dedicated flags; for any type-specific param not listed here, use
+    `--field key=value` (repeat as needed).
+
+    Examples:
+      vault create --title "PROD CA"  --type "CyberArk AIM" \\
+                   --appid MyApp --safe MySafe --url https://cyberark.example.com
+
+      vault create --title "PROD KV" --type "HashiCorp KV" \\
+                   --url https://vault.example.com --namespace prod --role qualys
+
+      vault create --title "Custom" --type "Some Vault" \\
+                   --field foo=bar --field baz=qux
+
+    Source: https://docs.qualys.com/en/vm/api/scanauth/vaults/create_vault.htm
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    params: dict = {"action": "create", "title": title, "type": type_}
+    if comments:
+        params["comments"] = comments
+    # Type-specific fields — only sent when the user passes them.
+    for k, v in (
+        ("appid", appid),
+        ("safe", safe),
+        ("url", url),
+        ("username", username),
+        ("password", password),
+        ("token", token),
+        ("namespace", namespace),
+        ("role", role),
+        ("secret_id", secret_id),
+    ):
+        if v is not None:
+            params[k] = v
+    # Arbitrary --field key=value passthrough
+    for entry in (field or []):
+        if "=" not in entry:
+            raise typer.BadParameter(
+                f"--field expects key=value, got {entry!r}",
+            )
+        k, _, v = entry.partition("=")
+        k = k.strip()
+        if not k:
+            raise typer.BadParameter(f"--field has empty key: {entry!r}")
+        if k in params:
+            raise typer.BadParameter(
+                f"--field {k}=… conflicts with the dedicated --{k.replace('_','-')} flag",
+            )
+        params[k] = v
+    data = client.post_xml("/api/2.0/fo/vault/index.php", data=params)
+    output(data)
+
+
+# ── neo4j ─────────────────────────────────────────────────────────────────────
+_neo4j = typer.Typer(help="Neo4j authentication record operations")
+app.add_typer(_neo4j, name="neo4j")
+
+
+@_neo4j.command("list")
+def neo4j_list(
+    ctx: typer.Context,
+    limit: int = typer.Option(DEFAULT_LIMIT, "--limit", "-n"),
+    format: str = typer.Option("table", "--format", "-f"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+):
+    """List Neo4j authentication records.
+
+    Source: https://docs.qualys.com/en/vm/api/scanauth/record_types/neo4j.htm
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    data = client.get_xml("/api/2.0/fo/auth/neo4j/", {"action": "list"})
+    output(data, format=format, limit=limit)
+
+
+@_neo4j.command("create")
+def neo4j_create(
+    ctx: typer.Context,
+    title: str = typer.Option(..., "--title"),
+    username: str = typer.Option(..., "--username"),
+    password: str = typer.Option(..., "--password"),
+    ips: str = typer.Option(..., "--ips"),
+    port: int = typer.Option(..., "--port"),
+    database: str | None = typer.Option(None, "--database"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+):
+    """Create a Neo4j authentication record.
+
+    Source: https://docs.qualys.com/en/vm/api/scanauth/record_types/neo4j.htm
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    params: dict = {
+        "action": "create",
+        "title": title,
+        "username": username,
+        "password": password,
+        "ips": ips,
+        "port": port,
+    }
+    if database:
+        params["database"] = database
+    data = client.post_xml("/api/2.0/fo/auth/neo4j/", data=params)
+    output(data)
+
+
+# ── nginx ─────────────────────────────────────────────────────────────────────
+_nginx = typer.Typer(help="Nginx authentication record operations")
+app.add_typer(_nginx, name="nginx")
+
+
+@_nginx.command("list")
+def nginx_list(
+    ctx: typer.Context,
+    limit: int = typer.Option(DEFAULT_LIMIT, "--limit", "-n"),
+    format: str = typer.Option("table", "--format", "-f"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+):
+    """List Nginx authentication records.
+
+    Source: https://docs.qualys.com/en/vm/api/scanauth/record_types/nginx_record.htm
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    data = client.get_xml("/api/2.0/fo/auth/nginx/", {"action": "list"})
+    output(data, format=format, limit=limit)
+
+
+@_nginx.command("create")
+def nginx_create(
+    ctx: typer.Context,
+    title: str = typer.Option(..., "--title"),
+    ips: str = typer.Option(..., "--ips"),
+    unix_base_path: str | None = typer.Option(None, "--unix-base-path"),
+    unix_conf_path: str | None = typer.Option(None, "--unix-conf-path"),
+    unix_prefix_path: str | None = typer.Option(None, "--unix-prefix-path"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+):
+    """Create an Nginx authentication record.
+
+    Source: https://docs.qualys.com/en/vm/api/scanauth/record_types/nginx_record.htm
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    params: dict = {"action": "create", "title": title, "ips": ips}
+    if unix_base_path:
+        params["unix_base_path"] = unix_base_path
+    if unix_conf_path:
+        params["unix_conf_path"] = unix_conf_path
+    if unix_prefix_path:
+        params["unix_prefix_path"] = unix_prefix_path
+    data = client.post_xml("/api/2.0/fo/auth/nginx/", data=params)
+    output(data)

qualys_cli/commands/sub.py

@@ -0,0 +1,163 @@
+"""
+Subscription Management APIs (Basic auth, XML responses).
+
+Covers subscription info retrieval, full config export/import, and user
+preference export/import.
+
+Hand-edited corrections:
+  - user-prefs export: switched POST → GET (API rejects POST with HTTP 400
+    "Request method POST is incompatible with action=export").
+  - user-prefs export: --user-id is now a required option mapped to the
+    `user_id` query param (was --user → `user_login`, both wrong: the API
+    requires the numeric user_id, not username, with HTTP 400 otherwise).
+
+Source: https://www.qualys.com/docs/qualys-subscription-api-user-guide.pdf
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import typer
+
+from .. import client as _c
+from ..formatters import guard_output_file, output, output_success
+
+app = typer.Typer(
+    name="sub",
+    help="Subscription Management APIs — info, config export/import, user preferences",
+)
+
+_user_prefs = typer.Typer(help="User preference export/import operations")
+app.add_typer(_user_prefs, name="user-prefs")
+
+_BASE = "/api/2.0/fo/subscription/index.php"
+_PREFS = "/api/2.0/fo/user_prefs/"
+
+
+# ---------------------------------------------------------------------------
+# Subscription info
+# ---------------------------------------------------------------------------
+
+@app.command("info")
+def sub_info(
+    ctx: typer.Context,
+    format: str = typer.Option("table", "--format", "-f"),
+    output_file: str | None = typer.Option(None, "--output-file", "-o"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+) -> None:
+    """Show subscription details: product entitlements, user counts, scanner info.
+
+    Source: https://www.qualys.com/docs/qualys-subscription-api-user-guide.pdf
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    data = client.get_xml(_BASE, params={"action": "export"})
+    output(data, format=format, output_file=output_file)
+
+
+# ---------------------------------------------------------------------------
+# Subscription config export / import
+# ---------------------------------------------------------------------------
+
+@app.command("export")
+def sub_export(
+    ctx: typer.Context,
+    output_file: str | None = typer.Option(None, "--output-file", "-o"),
+    format: str = typer.Option("table", "--format", "-f"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+) -> None:
+    """Export full subscription configuration.
+
+    Without --output-file, prints parsed data to stdout (JSON when piped).
+    With --output-file, writes raw XML to the specified file.
+
+    Source: https://www.qualys.com/docs/qualys-subscription-api-user-guide.pdf
+    """
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    if output_file:
+        guard_output_file()
+        resp = client.request("GET", _BASE, params={"action": "export"})
+        Path(output_file).write_bytes(resp.content)
+        output_success(f"Subscription config exported to {output_file} ({len(resp.content):,} bytes)")
+    else:
+        data = client.get_xml(_BASE, params={"action": "export"})
+        output(data, format=format)
+
+
+@app.command("import")
+def sub_import(
+    ctx: typer.Context,
+    input_file: str = typer.Argument(..., help="XML file produced by 'sub export'"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+) -> None:
+    """Import subscription configuration from a previously exported XML file.
+
+    INFO-type settings are ignored by the API; only mutable settings are applied.
+
+    Source: https://www.qualys.com/docs/qualys-subscription-api-user-guide.pdf
+    """
+    if not yes:
+        typer.confirm(f"Import subscription config from '{input_file}'?", abort=True)
+    xml_bytes = Path(input_file).read_bytes()
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    client.request(
+        "POST", _BASE,
+        data={"action": "import"},
+        files={"file": ("export.xml", xml_bytes, "text/xml")},
+    )
+    output_success(f"Subscription config imported from '{input_file}'.")
+
+
+# ---------------------------------------------------------------------------
+# User preferences export / import
+# ---------------------------------------------------------------------------
+
+@_user_prefs.command("export")
+def user_prefs_export(
+    ctx: typer.Context,
+    user_id: str = typer.Option(
+        ..., "--user-id", help="Numeric Qualys user ID (required by the API)",
+    ),
+    output_file: str = typer.Option("user-prefs-export.xml", "--output-file", "-o"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+) -> None:
+    """Export user preferences to an XML file.
+
+    The /user_prefs/ endpoint requires GET for action=export — POST returns
+    HTTP 400 "Request method POST is incompatible with action=export". The
+    `user_id` query parameter (numeric, not username) is also required —
+    omitting it returns HTTP 400 "Missing required parameter(s): user_id".
+
+    Source: https://www.qualys.com/docs/qualys-subscription-api-user-guide.pdf
+    """
+    guard_output_file()
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    resp = client.request(
+        "GET", _PREFS,
+        params={"action": "export", "user_id": user_id},
+    )
+    Path(output_file).write_bytes(resp.content)
+    output_success(f"User preferences exported to {output_file} ({len(resp.content):,} bytes)")
+
+
+@_user_prefs.command("import")
+def user_prefs_import(
+    ctx: typer.Context,
+    input_file: str = typer.Argument(..., help="XML file produced by 'user-prefs export'"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation"),
+    verbose: int = typer.Option(0, "--verbose", "-v", count=True),
+) -> None:
+    """Import user preferences from a previously exported XML file.
+
+    Source: https://www.qualys.com/docs/qualys-subscription-api-user-guide.pdf
+    """
+    if not yes:
+        typer.confirm(f"Import user preferences from '{input_file}'?", abort=True)
+    xml_bytes = Path(input_file).read_bytes()
+    client = _c.make(ctx.obj, auth_type="basic", verbose=verbose)
+    client.request(
+        "POST", _PREFS,
+        data={"action": "import"},
+        files={"file": ("prefs.xml", xml_bytes, "text/xml")},
+    )
+    output_success(f"User preferences imported from '{input_file}'.")