diff --git a/prowler/providers/github/exceptions/exceptions.py b/prowler/providers/github/exceptions/exceptions.py index b5e08c780e..afb0f4fc3a 100644 --- a/prowler/providers/github/exceptions/exceptions.py +++ b/prowler/providers/github/exceptions/exceptions.py @@ -1,47 +1,35 @@ from prowler.exceptions.exceptions import ProwlerException -# Exceptions codes from 5000 to 5999 are reserved for GitHub exceptions -class GitHubBaseException(ProwlerException): - """Base class for GitHub Errors.""" +# Exceptions codes from 5000 to 5999 are reserved for Github exceptions +class GithubBaseException(ProwlerException): + """Base class for Github Errors.""" GITHUB_ERROR_CODES = { - (2000, "GitHubEnvironmentVariableError"): { - "message": "GitHub environment variable error", - "remediation": "Check the GitHub environment variables and ensure they are properly set.", + (5000, "GithubEnvironmentVariableError"): { + "message": "Github environment variable error", + "remediation": "Check the Github environment variables and ensure they are properly set.", }, - (2001, "GitHubInvalidTokenError"): { - "message": "GitHub token provided is not valid", - "remediation": "Check the GitHub token and ensure it is valid.", + (5001, "GithubNonExistentTokenError"): { + "message": "A Github token is required to authenticate against Github", + "remediation": "Check the Github token and ensure it is properly set up.", }, - (2002, "GitHubSetUpIdentityError"): { - "message": "GitHub identity setup error related with credentials", - "remediation": "Check credentials and ensure they are properly set up for GitHub and the identity provider.", + (5002, "GithubInvalidTokenError"): { + "message": "Github token provided is not valid", + "remediation": "Check the Github token and ensure it is valid.", }, - (2003, "GitHubNoAuthenticationMethodError"): { - "message": "No GitHub authentication method found", - "remediation": "Check that any authentication method is properly set up for GitHub.", - }, - (2006, "GitHubArgumentTypeValidationError"): { - "message": "GitHub argument type validation error", - "remediation": "Check the provided argument types specific to GitHub and ensure they meet the required format.", - }, - (2010, "GitHubHTTPResponseError"): { - "message": "Error in HTTP response from GitHub", - "remediation": "", - }, - (2014, "GitHubClientAuthenticationError"): { - "message": "Error in client authentication", - "remediation": "Check the client authentication and ensure it is properly set up.", - }, - (2015, "GitHubSetUpSessionError"): { + (5003, "GithubSetUpSessionError"): { "message": "Error setting up session", "remediation": "Check the session setup and ensure it is properly set up.", }, + (5004, "GithubSetUpIdentityError"): { + "message": "Github identity setup error due to bad credentials", + "remediation": "Check credentials and ensure they are properly set up for Github and the identity provider.", + }, } def __init__(self, code, file=None, original_exception=None, message=None): - provider = "GitHub" + provider = "Github" error_info = self.GITHUB_ERROR_CODES.get((code, self.__class__.__name__)) if message: error_info["message"] = message @@ -54,64 +42,43 @@ class GitHubBaseException(ProwlerException): ) -class GitHubCredentialsError(GitHubBaseException): - """Base class for GitHub credentials errors.""" +class GithubCredentialsError(GithubBaseException): + """Base class for Github credentials errors.""" def __init__(self, code, file=None, original_exception=None, message=None): super().__init__(code, file, original_exception, message) -class GitHubEnvironmentVariableError(GitHubCredentialsError): +class GithubEnvironmentVariableError(GithubCredentialsError): def __init__(self, file=None, original_exception=None, message=None): super().__init__( - 2000, file=file, original_exception=original_exception, message=message + 5000, file=file, original_exception=original_exception, message=message ) -class GitHubInvalidTokenError(GitHubCredentialsError): +class GithubNonExistentTokenError(GithubCredentialsError): def __init__(self, file=None, original_exception=None, message=None): super().__init__( - 2001, file=file, original_exception=original_exception, message=message + 5001, file=file, original_exception=original_exception, message=message ) -class GitHubSetUpIdentityError(GitHubCredentialsError): +class GithubInvalidTokenError(GithubCredentialsError): def __init__(self, file=None, original_exception=None, message=None): super().__init__( - 2002, file=file, original_exception=original_exception, message=message + 5002, file=file, original_exception=original_exception, message=message ) -class GitHubNoAuthenticationMethodError(GitHubCredentialsError): +class GithubSetUpSessionError(GithubCredentialsError): def __init__(self, file=None, original_exception=None, message=None): super().__init__( - 2003, file=file, original_exception=original_exception, message=message + 5003, file=file, original_exception=original_exception, message=message ) -class GitHubArgumentTypeValidationError(GitHubBaseException): +class GithubSetUpIdentityError(GithubCredentialsError): def __init__(self, file=None, original_exception=None, message=None): super().__init__( - 2006, file=file, original_exception=original_exception, message=message - ) - - -class GitHubHTTPResponseError(GitHubBaseException): - def __init__(self, file=None, original_exception=None, message=None): - super().__init__( - 2010, file=file, original_exception=original_exception, message=message - ) - - -class GitHubClientAuthenticationError(GitHubCredentialsError): - def __init__(self, file=None, original_exception=None, message=None): - super().__init__( - 2014, file=file, original_exception=original_exception, message=message - ) - - -class GitHubSetUpSessionError(GitHubCredentialsError): - def __init__(self, file=None, original_exception=None, message=None): - super().__init__( - 2015, file=file, original_exception=original_exception, message=message + 5004, file=file, original_exception=original_exception, message=message ) diff --git a/prowler/providers/github/github_provider.py b/prowler/providers/github/github_provider.py index 9d614f39bc..72fdcf5032 100644 --- a/prowler/providers/github/github_provider.py +++ b/prowler/providers/github/github_provider.py @@ -1,3 +1,4 @@ +import os from os import getenv from github import Auth, Github @@ -11,6 +12,13 @@ from prowler.lib.logger import logger from prowler.lib.mutelist.mutelist import Mutelist from prowler.providers.common.models import Audit_Metadata from prowler.providers.common.provider import Provider +from prowler.providers.github.exceptions.exceptions import ( + GithubEnvironmentVariableError, + GithubInvalidTokenError, + GithubNonExistentTokenError, + GithubSetUpIdentityError, + GithubSetUpSessionError, +) from prowler.providers.github.lib.mutelist.mutelist import GithubMutelist from prowler.providers.github.models import GithubIdentityInfo, GithubSession @@ -46,11 +54,13 @@ class GithubProvider(Provider): config_path (str): Configuration path """ logger.info("Instantiating GitHub Provider...") + self._session = self.setup_session( personal_access_token, github_app, oauth_app, ) + self._identity = self.setup_identity( personal_access_token, github_app, @@ -133,24 +143,61 @@ class GithubProvider(Provider): Returns: GithubSession: Authenticated session token for API requests. """ + try: + if personal_access_token: + if not getenv("GITHUB_PERSONAL_ACCESS_TOKEN"): + logger.critical( + "GitHub provider: Missing enviroment variable GITHUB_PERSONAL_ACCESS_TOKEN needed to authenticate against GitHub." + ) + raise GithubEnvironmentVariableError( + file=os.path.basename(__file__), + message="Missing Github environment variable GITHUB_PERSONAL_ACCESS_TOKEN required to authenticate.", + ) + session_token = getenv("GITHUB_PERSONAL_ACCESS_TOKEN") + self._auth_method = "personal_access_token" + elif github_app: + if not getenv("GITHUB_APP_TOKEN"): + logger.critical( + "GitHub provider: Missing enviroment variable GITHUB_APP_TOKEN needed to authenticate against GitHub." + ) + raise GithubEnvironmentVariableError( + file=os.path.basename(__file__), + message="Missing Github environment variable GITHUB_APP_TOKEN required to authenticate.", + ) + session_token = getenv("GITHUB_APP_TOKEN") + self._auth_method = "github_app" + elif oauth_app: + if not getenv("GITHUB_OAUTH_APP_TOKEN"): + logger.critical( + "GitHub provider: Missing enviroment variable GITHUB_OAUTH_APP_TOKEN needed to authenticate against GitHub." + ) + raise GithubEnvironmentVariableError( + file=os.path.basename(__file__), + message="Missing Github environment variable GITHUB_OAUTH_APP_TOKEN required to authenticate.", + ) + session_token = getenv("GITHUB_OAUTH_APP_TOKEN") + self._auth_method = "oauth_app" + else: + logger.critical( + "GitHub provider: A Github token is required to authenticate against Github." + ) + raise GithubNonExistentTokenError( + file=os.path.basename(__file__), + message="A Github token is required to authenticate against Github.", + ) - if personal_access_token: - session_token = getenv("GITHUB_PERSONAL_ACCESS_TOKEN") - self._auth_method = "personal_access_token" - elif github_app: - session_token = getenv("GITHUB_APP_TOKEN") - self._auth_method = "github_app" - elif oauth_app: - session_token = getenv("GITHUB_OAUTH_TOKEN") - self._auth_method = "oauth_app" - else: - raise ValueError( - "A GitHub API token of some kind is required to initialize GitHub provider." + credentials = GithubSession(token=session_token) + + return credentials + + except Exception as error: + logger.critical("GitHub provider: Error setting up session.") + logger.critical( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" + ) + raise GithubSetUpSessionError( + original_exception=error, ) - - credentials = GithubSession(token=session_token) - - return credentials def setup_identity( self, @@ -171,17 +218,33 @@ class GithubProvider(Provider): """ credentials = self.session - if personal_access_token or github_app or oauth_app: - auth = Auth.Token(credentials.token) - g = Github(auth=auth) + try: + if personal_access_token or github_app or oauth_app: + auth = Auth.Token(credentials.token) + g = Github(auth=auth) - identity = GithubIdentityInfo( - account_name=g.get_user().login, - account_id=g.get_user().id, - account_url=g.get_user().url, + try: + identity = GithubIdentityInfo( + account_name=g.get_user().login, + account_id=g.get_user().id, + account_url=g.get_user().url, + ) + return identity + + except Exception as error: + logger.critical("GitHub provider: Given credentials are not valid.") + raise GithubInvalidTokenError( + original_exception=error, + ) + + except Exception as error: + logger.critical("GitHub provider: Error setting up identity.") + logger.critical( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}" + ) + raise GithubSetUpIdentityError( + original_exception=error, ) - - return identity def print_credentials(self): print(f"You are using a {self.auth_method} as authentication method.")