assets_guardian.plugins.dolibarr.matrix

Classes

DolibarrCriticalModuleAccessRule(**kwargs)	Verifies that rights on Dolibarr critical modules are authorized.
DolibarrSuperadminRule(**kwargs)	Verifies that Dolibarr superadmins are authorized by the authorization matrix.

class assets_guardian.plugins.dolibarr.matrix.DolibarrCriticalModuleAccessRule(**kwargs: Any)

Bases: IMatrixRule

Verifies that rights on Dolibarr critical modules are authorized.

This rule inspects accesses of type module_permission on modules declared in CRITICAL_MODULES and verifies that the user’s profile authorizes this right in the matrix.

The matrix key used is (profile, module) -> permission_level. Example: (“Direction”, “banque”) -> “modifier”

Dolibarr permissions are modeled as virtual Assets representing critical modules, which respects the asset-centric structure of Assets Guardian.

evaluate(accesses: Iterable[Access], matrix: dict[tuple[str, str], str], profiles: dict[str, list[str]]) → Iterable[Finding]

Verifies that each right on a critical module is authorized by the matrix.

The matrix must contain entries of the form: (profile, module) -> permission_key (e.g., (“Direction”, “banque”) -> “modifier”).

A right is considered authorized if at least one of the user’s profiles has a matrix entry covering this module.

Parameters:

• accesses – All collected accesses for Dolibarr.

• matrix – Authorization matrix (profile, module) -> authorized permission.

• profiles – Mapping email -> list of profiles.

Yields:

Finding – One Finding per unauthorized right on a critical module.

property description: str

Description of the rule.

property name: str

Name of the rule.

property rule_category: RuleCategory

MATRIX (matrix rules).

Type:

Rule category

property severity: SeverityType

Severity level of the rule.

property target_entity: str

Entity targeted by the rule.

class assets_guardian.plugins.dolibarr.matrix.DolibarrSuperadminRule(**kwargs: Any)

Bases: IMatrixRule

Verifies that Dolibarr superadmins are authorized by the authorization matrix.

A user is superadmin if their admin field is 1 in Dolibarr. The matrix is queried with the key (profile, “Dolibarr”) to determine if the profile authorizes superadmin access.

evaluate(accesses: Iterable[Access], matrix: dict[tuple[str, str], str], profiles: dict[str, list[str]]) → Iterable[Finding]

Verifies each access of type group where the user is superadmin.

For each group access carrying the is_admin flag, we verify that the user’s profile authorizes the superadmin role in the matrix.

ARCH-LIMIT: The is_admin flag (Dolibarr admin) is duplicated in Access.metadata because IMatrixRule only receives accesses, not identities. See DolibarrCollector.__build_accesses_for_user().

Parameters:

• accesses – All collected accesses for Dolibarr.

• matrix – Authorization matrix (profile, role) -> authorized permission.

• profiles – Mapping email -> list of profiles.

Yields:

Finding – One Finding per unauthorized superadmin according to the matrix.

property description: str

Description of the rule.

property name: str

Name of the rule.

property rule_category: RuleCategory

MATRIX (matrix rules).

Type:

Rule category

property severity: SeverityType

Severity level of the rule.

property target_entity: str

Entity targeted by the rule.