WIP: Control 7.2.4 - implement SharePoint collector, fix registry and… - #325
Draft
Meetphoenix1309 wants to merge 1 commit into
Draft
WIP: Control 7.2.4 - implement SharePoint collector, fix registry and…#325Meetphoenix1309 wants to merge 1 commit into
Meetphoenix1309 wants to merge 1 commit into
Conversation
… test harness routing gaps; blocked on 401 from SharePoint REST API
Contributor
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
Contributor
CI: Engine
One or more checks failed. View logs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
… test harness routing gaps; blocked on 401 from SharePoint REST API
Summary
Implements the SharePoint REST API client and
spo_tenantdata collector for CIS Control 7.2.4 (OneDrive/SharePoint external sharing restriction), which previously had no working collector. Also fixes two shared infrastructure gaps discovered during implementation. Currently blocked on a live SharePoint authentication issue — not ready to merge.Type of Change
Affected Components
/backend-api/frontend/engine(collectors / policies)/security/infrastructure/.github/workflows/docsMotivation
Control 7.2.4 was unautomated — the collector stub raised
NotImplementedError. Picked up as part of assigned capstone control implementation work https://planner.cloud.microsoft/webui/v1/plan/lcHW9ElPMUK9pRly1LHeX8gABVGl/view/board/task/7vUmN4iZ7Ue7zWzNNif0pcgACdac?tid=d02378ec-1688-46d5-8540-1c28b5f470f6.Testing Done
Unit tests pass locally
[*] Tested manually — describe how: Ran the collector against the live shared test tenant via
scripts/test_collector.py -c sharepoint.spo_tenant. Confirmed the client correctly acquires an MSAL token and reaches the correct SharePoint endpoint (https://<tenant>-admin.sharepoint.com/_api/SPOTenant), but the API returns401 Unauthorized. No Rego policy or unit tests exist yet, since real evidence hasn't been successfully retrieved.No tests required — explain why:
Security Considerations
This PR adds a new authenticated client (
SharePointClient) using the existing client-secret/MSAL pattern already used elsewhere in the codebase — no new secret storage or handling introduced. The live 401 error is currently under investigation with the team lead to confirm whether it's a missing/unconsented API permission or a limitation of client-secret auth for this specific endpoint (a caveat already flagged in the original stub code).Breaking Changes
Rollback Plan
Checklist
Screenshots
N/A — backend/collector change only, no UI impact.