source-package.json — Users and Apps Audit

{
  "schema_version": 1,
  "runtimes": [
    {
      "name": "python",
      "versions": [
        "3.10"
      ]
    }
  ],
  "dependencies": [],
  "operations": [
    {
      "kind": "read",
      "description": "Read selected Microsoft Graph inventory queries; users, licenses or guests each fetch all paginated users with the shared selected field set.",
      "target_restrictions": [
        "Only the selected read-only report sections on graph.microsoft.com"
      ]
    },
    {
      "kind": "create",
      "description": "Create a local report file only when --out is supplied with a matching approval digest.",
      "target_restrictions": [
        "The approval digest binds the selected and fully resolved file path, exact report content, and device/inode identities of the existing destination directory and its parent. Live creation walks the resolved path with no-follow",
        "directory descriptors, verifies identities and the selected path resolution, and creates the file relative to the directory descriptor with exclusive/no-follow flags at mode 0600. A swapped parent is refused before writing. All",
        "output directories must already exist; no folders are created."
      ]
    },
    {
      "kind": "read",
      "description": "Test-only read of the synthetic response fixture named by GRAPH_AUDIT_FAKE_RESPONSES.",
      "target_restrictions": [
        "Only when GRAPH_AUDIT_FAKE_TRANSPORT_TEST_ACK=1 is also set",
        "Missing fixture fails before any network request",
        "Each JSON fixture and HTTP response body is limited to 8 MiB before parsing; oversized or malformed input fails with a clear error. Pagination is limited to 1000 pages per query. No stdin is read. Invalid nested Graph fields or",
        "timestamps produce explicit incomplete-section errors; missing optional values are not evidence of inactivity."
      ]
    }
  ],
  "authorization": {
    "mode": "oauth_application",
    "scopes": [
      "User.Read.All",
      "Directory.Read.All",
      "Application.Read.All",
      "AuditLog.Read.All (optional)"
    ],
    "credential_requirements": [
      "GRAPH_TENANT_ID",
      "GRAPH_CLIENT_ID",
      "GRAPH_CLIENT_SECRET"
    ]
  },
  "network": {
    "domains": [
      "login.microsoftonline.com",
      "graph.microsoft.com"
    ],
    "destinations": [
      "login.microsoftonline.com receives tenant URL, client ID/secret, scope and grant type.",
      "graph.microsoft.com receives bearer token, selected paths, fetched role IDs and all fetched pagination URL path/query contents.",
      "Display-name and UPN fields are not explicitly resent. Reports are not uploaded.",
      "Configured system resolver or proxy receives destination hostnames; no DNS lookup of fetched user names.",
      "urllib honors HTTPS_PROXY, https_proxy, NO_PROXY, no_proxy and macOS system proxy settings; TLS terminates at declared hosts"
    ]
  },
  "safety": {
    "read_only_by_default": true,
    "dry_run_supported": true,
    "consequential_writes_require_authorization": true,
    "validation_controls": [
      "Every request and redirect is limited to HTTPS and the declared host; nextLink stays on graph.microsoft.com",
      "Read throttling and server errors have bounded retries; token POST is never retried",
      "Text output escapes control and separator characters on one line; JSON stays JSON",
      "Missing test fixture or missing second fake-transport variable fails before network access",
      "Required section failures are marked incomplete and exit 2 unless --allow-partial",
      "The approval digest binds the selected and fully resolved file path, exact report content, and device/inode identities of the existing destination directory and its parent. Live creation walks the resolved path with no-follow",
      "directory descriptors, verifies identities and the selected path resolution, and creates the file relative to the directory descriptor with exclusive/no-follow flags at mode 0600. A swapped parent is refused before writing. All",
      "output directories must already exist; no folders are created.",
      "Supported platforms: macOS and Linux with POSIX directory-descriptor and no-follow APIs; Windows is unsupported and fails before file or network I/O.",
      "Each JSON fixture and HTTP response body is limited to 8 MiB before parsing; oversized or malformed input fails with a clear error. Pagination is limited to 1000 pages per query. No stdin is read. Invalid nested Graph fields or",
      "timestamps produce explicit incomplete-section errors; missing optional values are not evidence of inactivity.",
      "Remote path traversal, unsafe role identifiers and dot-only tenant identifiers are refused before requests.",
      "Remote paths reject dot segments, controls and encoded slash or backslash within a segment before requests."
    ],
    "target_restrictions": [
      "Only the selected Microsoft Graph read endpoints",
      "Only the exact user-selected --out path, new file only",
      "Test transport reads only its named fixture"
    ]
  },
  "tests": {
    "files": [
      "tests/test_users_and_apps_audit.py",
      "tests/test_hygiene.py"
    ],
    "fixtures": "synthetic_only",
    "provenance": "creator",
    "evidence": [
      "Subprocess CLI tests use synthetic fake responses for pagination, permission errors and output escaping",
      "Expiry boundary and package hygiene tests run offline"
    ]
  }
}

License: MIT (read it).

Back to the listing