Assessor_2.0/server/gpo/gpo-inventory-executor.ts

import type { GpoPolicyIdentityResolution } from '../../src/domain/gpo-policy-identity';
import type { ImportResourcePolicy } from '../../src/importers/resource-policy';
import {
  inventoryGpoContainer,
  recognizeGpoContainer,
  type GpoContainerInventoryResult,
  type GpoContainerRecognitionResult
} from './gpo-container-inventory';
import { ingestGpoBackupContainer, type GpoBackupIngestionOptions } from './gpo-backup-ingestion';
import type { GpoBackupInstance } from '../../src/domain/gpo-ingestion';
import { resolveRegistryPolicyIdentity } from './admx-policy-catalog';
import {
  analyzeMicrosoftSecurityBaselinePackage,
  type MicrosoftSecurityBaselineAnalysisOptions
} from './microsoft-security-baseline-parser';
import type { MicrosoftSecurityBaselineAnalysis } from '../../src/domain/microsoft-security-baseline-analysis';

export interface GpoInventoryExecutionRequest {
  bytes: Uint8Array;
  resourcePolicy?: Partial<ImportResourcePolicy>;
}

export interface GpoRecognitionExecutionRequest extends GpoInventoryExecutionRequest {
  operation: 'recognition';
}

export interface GpoBackupWorkerExecutionRequest {
  bytes: Uint8Array;
  options: GpoBackupIngestionOptions;
}

export interface GpoWorkerIdentityResolution {
  backupInstanceId: string;
  observationId: string;
  resolution: GpoPolicyIdentityResolution;
}

export interface GpoBackupWorkerResult {
  version: 1;
  diagnosticCodes: string[];
  backupInstances: GpoBackupInstance[];
  identityResolutions: GpoWorkerIdentityResolution[];
}

export interface MicrosoftBaselineWorkerExecutionRequest {
  operation: 'microsoft-baseline';
  bytes: Uint8Array;
  options: MicrosoftSecurityBaselineAnalysisOptions;
}

export interface GpoBackupWorkerExecutor {
  executeBackup(request: GpoBackupWorkerExecutionRequest): Promise<GpoBackupWorkerResult>;
}

export interface MicrosoftBaselineWorkerExecutor {
  executeMicrosoftBaseline(request: Omit<MicrosoftBaselineWorkerExecutionRequest, 'operation'>): Promise<MicrosoftSecurityBaselineAnalysis>;
}

export interface GpoInventoryExecutor {
  execute(request: GpoInventoryExecutionRequest): Promise<GpoContainerInventoryResult>;
  recognize(request: GpoInventoryExecutionRequest): Promise<GpoContainerRecognitionResult>;
  close?(): Promise<void>;
}

export type GpoWorkerExecutionRequest =
  | GpoInventoryExecutionRequest
  | GpoRecognitionExecutionRequest
  | GpoBackupWorkerExecutionRequest
  | MicrosoftBaselineWorkerExecutionRequest;

export type GpoWorkerOperationResult =
  | { operation: 'inventory'; value: GpoContainerInventoryResult }
  | { operation: 'recognition'; value: GpoContainerRecognitionResult }
  | { operation: 'backup'; value: GpoBackupWorkerResult }
  | { operation: 'microsoft-baseline'; value: MicrosoftSecurityBaselineAnalysis };

export const directGpoInventoryExecutor: GpoInventoryExecutor = {
  recognize(request) {
    return Promise.resolve(recognizeGpoContainer(request.bytes, request.resourcePolicy));
  },
  execute(request) {
    return Promise.resolve(inventoryGpoContainer(request.bytes, request.resourcePolicy));
  }
};

export function analyzeGpoBackupForPersistence(request: GpoBackupWorkerExecutionRequest): GpoBackupWorkerResult {
  const analysis = ingestGpoBackupContainer(request.bytes, { ...request.options, retainIntermediateDocuments: false });
  const identityResolutions = analysis.backupInstances.flatMap(instance => (instance.policyObservations ?? []).map(observation => ({
    backupInstanceId: instance.id,
    observationId: observation.id,
    resolution: observation.deliveryMechanism === 'registry-policy'
      ? resolveRegistryPolicyIdentity(observation)
      : { version: 1 as const, status: 'unresolved' as const, reasonCode: `identity-resolver-unsupported-${observation.deliveryMechanism}` }
  })));
  return {
    version: 1,
    diagnosticCodes: [...new Set([
      ...analysis.container.inventory.diagnosticCodes,
      ...analysis.backupInstances.flatMap(instance => instance.inventory.diagnosticCodes),
      ...identityResolutions.flatMap(item => item.resolution.status === 'unresolved' ? [item.resolution.reasonCode] : [])
    ])].sort(),
    backupInstances: analysis.backupInstances,
    identityResolutions
  };
}

export function executeGpoWorkerOperation(request: GpoWorkerExecutionRequest): Promise<GpoWorkerOperationResult> {
  return Promise.resolve().then(() => {
    if ('operation' in request && request.operation === 'microsoft-baseline') {
      return { operation: 'microsoft-baseline', value: analyzeMicrosoftSecurityBaselinePackage(request.bytes, request.options) };
    }
    if ('options' in request) return { operation: 'backup', value: analyzeGpoBackupForPersistence(request) };
    if ('operation' in request && request.operation === 'recognition') {
      return { operation: 'recognition', value: recognizeGpoContainer(request.bytes, request.resourcePolicy) };
    }
    return { operation: 'inventory', value: inventoryGpoContainer(request.bytes, request.resourcePolicy) };
  });
}

export const directGpoBackupWorkerExecutor: GpoBackupWorkerExecutor & MicrosoftBaselineWorkerExecutor = {
  executeBackup(request) {
    return Promise.resolve(analyzeGpoBackupForPersistence(request));
  },
  executeMicrosoftBaseline(request) {
    return Promise.resolve(analyzeMicrosoftSecurityBaselinePackage(request.bytes, request.options));
  }
};