assets_guardian.plugins.dolibarr.collector

Classes

DolibarrCollector(client, instance_config)

Dolibarr Collector.

class assets_guardian.plugins.dolibarr.collector.DolibarrCollector(client: Any, instance_config: dict[str, Any])

Bases: Collector

Dolibarr Collector.

ARCH-LIMIT: The Collector base class assumes that collect_identities(), collect_assets() and collect_accesses() are independent. For Dolibarr, accesses (groups and permissions) require N+1 calls per user. Therefore, we completely override these three methods and share an assets cache to avoid redundant calls.

Initializes the collector with a client and its configuration.

Subclasses must initialize self._repository and self._mapper in their own __init__ (or via properties).

collect_accesses() → list[Access]

Returns all accesses extracted from identities and groups.

Accesses include: - Group memberships (access_type=”group”) - Direct/effective user permissions (access_type=”module_permission”) - Permissions granted by groups (access_type=”group_permission”)

Returns:

Consolidated list of all Dolibarr accesses.

Return type:

list[Access]

collect_assets() → list[Asset]

Collects all Dolibarr groups and critical modules as assets.

Returns:

List of collected assets (groups and virtual modules).

Return type:

list[Asset]

collect_identities() → list[Identity]

Collects all Dolibarr users with their groups and critical permissions.

Each user requires two additional calls: - /users/{id}?includepermissions=1 → module-level permissions - /users/{id}/groups → group memberships

ARCH-LIMIT: This N+1 pattern is not supported by the base class nor by the IRepository interface, which assumes a flat list of accesses.

Returns:

List of collected identities with their accesses.

Return type:

list[Identity]

property instance_id: str

Unique identifier of the audited instance (e.g., ‘gitlab.company.com’).

property source_name: str

Name of the source (e.g., ‘gitlab’, ‘microsoft365’, ‘dolibarr’).