From aa0d82f5003a5a9c3e5def53cae73e9459d64073 Mon Sep 17 00:00:00 2001 From: HugoPBrito Date: Mon, 25 Nov 2024 17:00:33 +0100 Subject: [PATCH] feat: pat and oauth authentication with and without flags --- prowler/providers/common/provider.py | 5 +- prowler/providers/github/github_provider.py | 102 ++++++++++++------ .../github/lib/arguments/arguments.py | 28 ++++- tests/providers/github/github_fixtures.py | 2 +- .../providers/github/github_provider_test.py | 4 +- 5 files changed, 99 insertions(+), 42 deletions(-) diff --git a/prowler/providers/common/provider.py b/prowler/providers/common/provider.py index 26b1653f50..86075bff37 100644 --- a/prowler/providers/common/provider.py +++ b/prowler/providers/common/provider.py @@ -213,9 +213,12 @@ class Provider(ABC): ) elif "github" in provider_class_name.lower(): provider_class( + personal_access=arguments.personal_access, + oauth_app=arguments.oauth_app, + github_app=arguments.github_app, personal_access_token=arguments.personal_access_token, oauth_app_token=arguments.oauth_app_token, - github_app=arguments.github_app, + github_app_token=arguments.github_app_token, user=arguments.user, password=arguments.password, config_path=arguments.config_file, diff --git a/prowler/providers/github/github_provider.py b/prowler/providers/github/github_provider.py index 73adc0cd44..aac271b9a1 100644 --- a/prowler/providers/github/github_provider.py +++ b/prowler/providers/github/github_provider.py @@ -34,11 +34,17 @@ class GithubProvider(Provider): def __init__( self, - personal_access_token: bool = False, - oauth_app_token: str = None, + # Authentication methods + personal_access: bool = False, + oauth_app: bool = False, github_app: bool = False, - user: str = None, - password: str = None, + # Authentication credentials + personal_access_token: str = "", + oauth_app_token: str = "", + github_app_token: str = "", + user: str = "", + password: str = "", + # Provider configuration config_path: str = None, config_content: dict = None, fixer_config: dict = {}, @@ -49,7 +55,7 @@ class GithubProvider(Provider): GitHub Provider constructor Args: - personal_access_token (str): GitHub token as authentication method + personal_access (str): GitHub token as authentication method github_app (bool): GitHub App as authentication method oauth_app (bool): OAuth App as authentication method config_content (dict): Configuration content @@ -58,17 +64,23 @@ class GithubProvider(Provider): logger.info("Instantiating GitHub Provider...") self._session = self.setup_session( + personal_access, + oauth_app, + github_app, personal_access_token, oauth_app_token, - github_app, + github_app_token, user, password, ) self._identity = self.setup_identity( + personal_access, + oauth_app, + github_app, personal_access_token, oauth_app_token, - github_app, + github_app_token, user, password, ) @@ -139,9 +151,12 @@ class GithubProvider(Provider): def setup_session( self, - personal_access_token: bool, - oauth_app_token: str = None, + personal_access: bool, + oauth_app: bool = False, github_app: bool = False, + personal_access_token: str = None, + oauth_app_token: str = None, + github_app_token: str = None, user: str = None, password: str = None, ) -> GithubSession: @@ -149,7 +164,7 @@ class GithubProvider(Provider): Returns the GitHub headers responsible authenticating API calls. Args: - personal_access_token (str): Flag indicating whether to use GitHub personal access token as authentication method. + personal_access (str): Flag indicating whether to use GitHub personal access token as authentication method. github_app (bool): Flag indicating whether to use GitHub App as authentication method. oauth_app (bool): Flag indicating whether to use OAuth App as authentication method. @@ -162,20 +177,27 @@ class GithubProvider(Provider): login_password = "" try: - # Ensure that at least one authentication method is selected. Default to environment variable PAT if none is provided. + # Ensure that at least one authentication method is selected. Default to environment variable for PAT if none is provided. if ( - not personal_access_token - and not oauth_app_token + not personal_access + and not oauth_app and not github_app + and not personal_access_token + and not oauth_app_token + and not github_app_token and not user and not password ): logger.error( "GitHub provider: No authentication method selected. Prowler will try to use GITHUB_PERSONAL_ACCESS_TOKEN enviroment variable to log in by default." ) - personal_access_token = True + personal_access = True if personal_access_token: + session_token = personal_access_token + self._auth_method = "Enviroment Variable for Personal Access Token" + + elif personal_access: if not getenv("GITHUB_PERSONAL_ACCESS_TOKEN"): logger.critical( "GitHub provider: Missing enviroment variable GITHUB_PERSONAL_ACCESS_TOKEN needed to authenticate against GitHub." @@ -185,10 +207,13 @@ class GithubProvider(Provider): message="Missing Github environment variable GITHUB_PERSONAL_ACCESS_TOKEN required to authenticate.", ) session_token = getenv("GITHUB_PERSONAL_ACCESS_TOKEN") - self._auth_method = "personal_access_token" + self._auth_method = "Personal Access Token" elif oauth_app_token: - """ + session_token = oauth_app_token + self._auth_method = "OAuth App token" + + elif oauth_app: if not getenv("GITHUB_OAUTH_APP_TOKEN"): logger.critical( "GitHub provider: Missing enviroment variable GITHUB_OAUTH_APP_TOKEN needed to authenticate against GitHub." @@ -197,9 +222,11 @@ class GithubProvider(Provider): file=os.path.basename(__file__), message="Missing Github environment variable GITHUB_OAUTH_APP_TOKEN required to authenticate.", ) - """ - session_token = oauth_app_token - self._auth_method = "oauth_app" + self._auth_method = "Enviroment Variable for OAuth App Token" + + elif github_app_token: + session_token = github_app_token + self._auth_method = "GitHub App Token" elif github_app: if not getenv("GITHUB_APP_TOKEN"): @@ -211,12 +238,12 @@ class GithubProvider(Provider): message="Missing Github environment variable GITHUB_APP_TOKEN required to authenticate.", ) session_token = getenv("GITHUB_APP_TOKEN") - self._auth_method = "github_app" + self._auth_method = "Enviroment Variable for GitHub App Token" elif user and password: login_user = user login_password = password - self._auth_method = "login_auth" + self._auth_method = "User-Password login" else: logger.critical( @@ -240,17 +267,20 @@ class GithubProvider(Provider): def setup_identity( self, - personal_access_token: bool, - oauth_app_token: str = None, - github_app: bool = False, - user: str = None, - password: str = None, + personal_access, + oauth_app, + github_app, + personal_access_token, + oauth_app_token, + github_app_token, + user, + password, ) -> GithubIdentityInfo: """ Returns the GitHub identity information Args: - personal_access_token (str): Flag indicating whether to use GitHub personal access token as authentication method. + personal_access (str): Flag indicating whether to use GitHub personal access token as authentication method. github_app (bool): Flag indicating whether to use GitHub App as authentication method. oauth_app (bool): Flag indicating whether to use OAuth App as authentication method. @@ -260,12 +290,18 @@ class GithubProvider(Provider): credentials = self.session try: - if (personal_access_token or github_app or oauth_app_token) or ( - not personal_access_token - and not oauth_app_token - and not github_app - and not user - and not password + if ( + (personal_access or personal_access_token) + or (oauth_app or oauth_app_token) + or ( + not personal_access + and not github_app + and not oauth_app + and not oauth_app_token + and not github_app_token + and not user + and not password + ) ): auth = Auth.Token(credentials.token) g = Github(auth=auth) diff --git a/prowler/providers/github/lib/arguments/arguments.py b/prowler/providers/github/lib/arguments/arguments.py index dbb552f145..6872a3dc13 100644 --- a/prowler/providers/github/lib/arguments/arguments.py +++ b/prowler/providers/github/lib/arguments/arguments.py @@ -7,9 +7,27 @@ def init_parser(self): github_auth_subparser = github_parser.add_argument_group("Authentication Modes") github_auth_modes_group = github_auth_subparser.add_mutually_exclusive_group() github_auth_modes_group.add_argument( + "--personal-access", + action="store_true", + help="Use enviroment variable for Personal Access Token to log in against GitHub", + default=False, + ) + github_auth_modes_group.add_argument( + "--oauth-app", + action="store_true", + default=False, + help="Use enviroment variable for Oauth App Token to log in against GitHub", + ), + github_auth_modes_group.add_argument( + "--github-app", + action="store_true", + help="Use enviroment variable for GitHub App Token to log in against GitHub", + default=False, + ), + github_auth_subparser.add_argument( "--personal-access-token", action="store_true", - help="Use Personal Access Token to log in against GitHub", + help="Personal Access Token to log in against GitHub", default=False, ) github_auth_subparser.add_argument( @@ -19,10 +37,10 @@ def init_parser(self): help="Oauth app token to log in against GitHub", ), github_auth_modes_group.add_argument( - "--github-app", - action="store_true", - help="Use GitHub app token to log in against GitHub", - default=False, + "--github-app-token", + nargs="?", + default=None, + help="GitHub app token to log in against GitHub", ), github_auth_subparser.add_argument( "--user", diff --git a/tests/providers/github/github_fixtures.py b/tests/providers/github/github_fixtures.py index e330d7dd8c..cd57c6f002 100644 --- a/tests/providers/github/github_fixtures.py +++ b/tests/providers/github/github_fixtures.py @@ -14,7 +14,7 @@ TOKEN = "github-token" # Mocked GitHub Provider def set_mocked_github_provider( - auth_method: str = "personal_access_token", + auth_method: str = "personal_access", credentials: GithubSession = GithubSession(token=TOKEN), identity: GithubIdentityInfo = GithubIdentityInfo( account_name=ACCOUNT_NAME, diff --git a/tests/providers/github/github_provider_test.py b/tests/providers/github/github_provider_test.py index dc8e9ecfe7..1f3ab192b9 100644 --- a/tests/providers/github/github_provider_test.py +++ b/tests/providers/github/github_provider_test.py @@ -17,7 +17,7 @@ from tests.providers.github.github_fixtures import ( class TestGitHubProvider: def test_github_provider(self): # We need to set exactly one auth method - personal_access_token = True + personal_access = True oauth_app = False github_app = False fixer_config = load_and_validate_config_file( @@ -36,7 +36,7 @@ class TestGitHubProvider: ), ): provider = GithubProvider( - personal_access_token, + personal_access, github_app, oauth_app, )