126 lines
5.0 KiB
TypeScript
126 lines
5.0 KiB
TypeScript
import type { GpoPolicyIdentityResolution } from '../../src/domain/gpo-policy-identity';
|
|
import type { ImportResourcePolicy } from '../../src/importers/resource-policy';
|
|
import {
|
|
inventoryGpoContainer,
|
|
recognizeGpoContainer,
|
|
type GpoContainerInventoryResult,
|
|
type GpoContainerRecognitionResult
|
|
} from './gpo-container-inventory';
|
|
import { ingestGpoBackupContainer, type GpoBackupIngestionOptions } from './gpo-backup-ingestion';
|
|
import type { GpoBackupInstance } from '../../src/domain/gpo-ingestion';
|
|
import { resolvePolicyTarget } from './policy-target-resolver';
|
|
import {
|
|
analyzeMicrosoftSecurityBaselinePackage,
|
|
type MicrosoftSecurityBaselineAnalysisOptions
|
|
} from './microsoft-security-baseline-parser';
|
|
import type { MicrosoftSecurityBaselineAnalysis } from '../../src/domain/microsoft-security-baseline-analysis';
|
|
|
|
export interface GpoInventoryExecutionRequest {
|
|
bytes: Uint8Array;
|
|
resourcePolicy?: Partial<ImportResourcePolicy>;
|
|
}
|
|
|
|
export interface GpoRecognitionExecutionRequest extends GpoInventoryExecutionRequest {
|
|
operation: 'recognition';
|
|
}
|
|
|
|
export interface GpoBackupWorkerExecutionRequest {
|
|
bytes: Uint8Array;
|
|
options: GpoBackupIngestionOptions;
|
|
}
|
|
|
|
export interface GpoWorkerIdentityResolution {
|
|
backupInstanceId: string;
|
|
observationId: string;
|
|
resolution: GpoPolicyIdentityResolution;
|
|
}
|
|
|
|
export interface GpoBackupWorkerResult {
|
|
version: 1;
|
|
diagnosticCodes: string[];
|
|
backupInstances: GpoBackupInstance[];
|
|
identityResolutions: GpoWorkerIdentityResolution[];
|
|
}
|
|
|
|
export interface MicrosoftBaselineWorkerExecutionRequest {
|
|
operation: 'microsoft-baseline';
|
|
bytes: Uint8Array;
|
|
options: MicrosoftSecurityBaselineAnalysisOptions;
|
|
}
|
|
|
|
export interface GpoBackupWorkerExecutor {
|
|
executeBackup(request: GpoBackupWorkerExecutionRequest): Promise<GpoBackupWorkerResult>;
|
|
}
|
|
|
|
export interface MicrosoftBaselineWorkerExecutor {
|
|
executeMicrosoftBaseline(request: Omit<MicrosoftBaselineWorkerExecutionRequest, 'operation'>): Promise<MicrosoftSecurityBaselineAnalysis>;
|
|
}
|
|
|
|
export interface GpoInventoryExecutor {
|
|
execute(request: GpoInventoryExecutionRequest): Promise<GpoContainerInventoryResult>;
|
|
recognize(request: GpoInventoryExecutionRequest): Promise<GpoContainerRecognitionResult>;
|
|
close?(): Promise<void>;
|
|
}
|
|
|
|
export type GpoWorkerExecutionRequest =
|
|
| GpoInventoryExecutionRequest
|
|
| GpoRecognitionExecutionRequest
|
|
| GpoBackupWorkerExecutionRequest
|
|
| MicrosoftBaselineWorkerExecutionRequest;
|
|
|
|
export type GpoWorkerOperationResult =
|
|
| { operation: 'inventory'; value: GpoContainerInventoryResult }
|
|
| { operation: 'recognition'; value: GpoContainerRecognitionResult }
|
|
| { operation: 'backup'; value: GpoBackupWorkerResult }
|
|
| { operation: 'microsoft-baseline'; value: MicrosoftSecurityBaselineAnalysis };
|
|
|
|
export const directGpoInventoryExecutor: GpoInventoryExecutor = {
|
|
recognize(request) {
|
|
return Promise.resolve(recognizeGpoContainer(request.bytes, request.resourcePolicy));
|
|
},
|
|
execute(request) {
|
|
return Promise.resolve(inventoryGpoContainer(request.bytes, request.resourcePolicy));
|
|
}
|
|
};
|
|
|
|
export function analyzeGpoBackupForPersistence(request: GpoBackupWorkerExecutionRequest): GpoBackupWorkerResult {
|
|
const analysis = ingestGpoBackupContainer(request.bytes, { ...request.options, retainIntermediateDocuments: false });
|
|
const identityResolutions = analysis.backupInstances.flatMap(instance => (instance.policyObservations ?? []).map(observation => ({
|
|
backupInstanceId: instance.id,
|
|
observationId: observation.id,
|
|
resolution: resolvePolicyTarget(observation)
|
|
})));
|
|
return {
|
|
version: 1,
|
|
diagnosticCodes: [...new Set([
|
|
...analysis.container.inventory.diagnosticCodes,
|
|
...analysis.backupInstances.flatMap(instance => instance.inventory.diagnosticCodes),
|
|
...identityResolutions.flatMap(item => item.resolution.status === 'unresolved' ? [item.resolution.reasonCode] : [])
|
|
])].sort(),
|
|
backupInstances: analysis.backupInstances,
|
|
identityResolutions
|
|
};
|
|
}
|
|
|
|
export function executeGpoWorkerOperation(request: GpoWorkerExecutionRequest): Promise<GpoWorkerOperationResult> {
|
|
return Promise.resolve().then(() => {
|
|
if ('operation' in request && request.operation === 'microsoft-baseline') {
|
|
return { operation: 'microsoft-baseline', value: analyzeMicrosoftSecurityBaselinePackage(request.bytes, request.options) };
|
|
}
|
|
if ('options' in request) return { operation: 'backup', value: analyzeGpoBackupForPersistence(request) };
|
|
if ('operation' in request && request.operation === 'recognition') {
|
|
return { operation: 'recognition', value: recognizeGpoContainer(request.bytes, request.resourcePolicy) };
|
|
}
|
|
return { operation: 'inventory', value: inventoryGpoContainer(request.bytes, request.resourcePolicy) };
|
|
});
|
|
}
|
|
|
|
export const directGpoBackupWorkerExecutor: GpoBackupWorkerExecutor & MicrosoftBaselineWorkerExecutor = {
|
|
executeBackup(request) {
|
|
return Promise.resolve(analyzeGpoBackupForPersistence(request));
|
|
},
|
|
executeMicrosoftBaseline(request) {
|
|
return Promise.resolve(analyzeMicrosoftSecurityBaselinePackage(request.bytes, request.options));
|
|
}
|
|
};
|