assets_guardian.plugins.gitlab.matrix

Classes

`GitlabGroupProjectAccessRule`(**kwargs)	Verifies that GitLab group and project roles are authorized by the matrix.
`InstanceAdminRule`(**kwargs)	Verifies that GitLab instance administrators are authorized by the matrix.

class assets_guardian.plugins.gitlab.matrix.GitlabGroupProjectAccessRule(**kwargs: Any)[source]

Bases: IMatrixRule

Verifies that GitLab group and project roles are authorized by the matrix.

Retrieves the rule configuration from YAML.

evaluate(accesses: Iterable[Access], matrix: dict[tuple[str, str], str], profiles: dict[str, list[str]]) → Iterable[Finding][source]

Verifies GitLab group and project accesses against the authorization matrix.

Parameters:

accesses – List of accesses to evaluate.
matrix – Authorization matrix (profile, resource) -> role.
profiles – Dictionary of profiles associated with each user by their email.

Yields:

Finding – Anomalies for each detected unauthorized or excessive access.

property description: str: Description of the rule.

property name: str: Name of the rule.

property rule_category: RuleCategory

MATRIX (matrix rules).

Type:: Rule category

property severity: SeverityType: Severity level of the rule.

property target_entity: str: Entity targeted by the rule.

class assets_guardian.plugins.gitlab.matrix.InstanceAdminRule(**kwargs: Any)[source]

Bases: IMatrixRule

Verifies that GitLab instance administrators are authorized by the matrix.

Retrieves the rule configuration from YAML.

evaluate(accesses: Iterable[Access], matrix: dict[tuple[str, str], str], profiles: dict[str, list[str]]) → Iterable[Finding][source]

Verifies that each instance administrator is authorized by the matrix.

Parameters:

accesses – List of accesses to evaluate.
matrix – Authorization matrix (profile, resource) -> role.
profiles – Dictionary of profiles associated with each user by their email.

Yields:

Finding – Anomalies for each detected unauthorized access.

property description: str: Description of the rule.

property name: str: Name of the rule.

property rule_category: RuleCategory

MATRIX (matrix rules).

Type:: Rule category

property severity: SeverityType: Severity level of the rule.

property target_entity: str: Entity targeted by the rule.