hanzo_client/apis/
security_api.rs

1/*
2 * Hanzo Cloud API
3 *
4 * The Hanzo Cloud API as a customer calls it: every operation under /v1/ except the operator's admin product, relay routes, legacy spellings and capabilities still reached by flag. Tagged by product: the first path segment after /v1/.
5 *
6 * The version of the OpenAPI document: v1
7 * 
8 * Generated by: https://openapi-generator.tech
9 */
10
11
12use reqwest;
13use serde::{Deserialize, Serialize, de::Error as _};
14use crate::{apis::ResponseContent, models};
15use super::{Error, configuration, ContentType};
16
17
18/// struct for typed errors of method [`get_security_findings`]
19#[derive(Debug, Clone, Serialize, Deserialize)]
20#[serde(untagged)]
21pub enum GetSecurityFindingsError {
22    UnknownValue(serde_json::Value),
23}
24
25/// struct for typed errors of method [`get_security_findings_by_id`]
26#[derive(Debug, Clone, Serialize, Deserialize)]
27#[serde(untagged)]
28pub enum GetSecurityFindingsByIdError {
29    UnknownValue(serde_json::Value),
30}
31
32/// struct for typed errors of method [`get_security_health`]
33#[derive(Debug, Clone, Serialize, Deserialize)]
34#[serde(untagged)]
35pub enum GetSecurityHealthError {
36    UnknownValue(serde_json::Value),
37}
38
39/// struct for typed errors of method [`get_security_rules`]
40#[derive(Debug, Clone, Serialize, Deserialize)]
41#[serde(untagged)]
42pub enum GetSecurityRulesError {
43    UnknownValue(serde_json::Value),
44}
45
46/// struct for typed errors of method [`get_security_scans`]
47#[derive(Debug, Clone, Serialize, Deserialize)]
48#[serde(untagged)]
49pub enum GetSecurityScansError {
50    UnknownValue(serde_json::Value),
51}
52
53/// struct for typed errors of method [`get_security_scans_by_id`]
54#[derive(Debug, Clone, Serialize, Deserialize)]
55#[serde(untagged)]
56pub enum GetSecurityScansByIdError {
57    UnknownValue(serde_json::Value),
58}
59
60/// struct for typed errors of method [`post_security_scans`]
61#[derive(Debug, Clone, Serialize, Deserialize)]
62#[serde(untagged)]
63pub enum PostSecurityScansError {
64    UnknownValue(serde_json::Value),
65}
66
67
68/// Is the org's findings — rule, severity, path, line, masked preview and fingerprint — newest first, across scans or within one.  A minSeverity outside critical|high|medium|low is refused rather than quietly ignored, so a filter typo cannot read as \"no findings\". Strictly org-scoped, and a caller with no validated org is refused.
69pub async fn get_security_findings(configuration: &configuration::Configuration, scan_id: Option<&str>, min_severity: Option<&str>, limit: Option<i32>) -> Result<models::FindingList, Error<GetSecurityFindingsError>> {
70    // add a prefix to parameters to efficiently prevent name collisions
71    let p_scan_id = scan_id;
72    let p_min_severity = min_severity;
73    let p_limit = limit;
74
75    let uri_str = format!("{}/v1/security/findings", configuration.base_path);
76    let mut req_builder = configuration.client.request(reqwest::Method::GET, &uri_str);
77
78    if let Some(ref param_value) = p_scan_id {
79        req_builder = req_builder.query(&[("scanId", &param_value.to_string())]);
80    }
81    if let Some(ref param_value) = p_min_severity {
82        req_builder = req_builder.query(&[("minSeverity", &param_value.to_string())]);
83    }
84    if let Some(ref param_value) = p_limit {
85        req_builder = req_builder.query(&[("limit", &param_value.to_string())]);
86    }
87    if let Some(ref user_agent) = configuration.user_agent {
88        req_builder = req_builder.header(reqwest::header::USER_AGENT, user_agent.clone());
89    }
90    if let Some(ref token) = configuration.bearer_access_token {
91        req_builder = req_builder.bearer_auth(token.to_owned());
92    };
93
94    let req = req_builder.build()?;
95    let resp = configuration.client.execute(req).await?;
96
97    let status = resp.status();
98    let content_type = resp
99        .headers()
100        .get("content-type")
101        .and_then(|v| v.to_str().ok())
102        .unwrap_or("application/octet-stream");
103    let content_type = super::ContentType::from(content_type);
104
105    if !status.is_client_error() && !status.is_server_error() {
106        let content = resp.text().await?;
107        match content_type {
108            ContentType::Json => serde_json::from_str(&content).map_err(Error::from),
109            ContentType::Text => return Err(Error::from(serde_json::Error::custom("Received `text/plain` content type response that cannot be converted to `models::FindingList`"))),
110            ContentType::Unsupported(unknown_type) => return Err(Error::from(serde_json::Error::custom(format!("Received `{unknown_type}` content type response that cannot be converted to `models::FindingList`")))),
111        }
112    } else {
113        let content = resp.text().await?;
114        let entity: Option<GetSecurityFindingsError> = serde_json::from_str(&content).ok();
115        Err(Error::ResponseError(ResponseContent { status, content, entity }))
116    }
117}
118
119/// Returns a single finding: which rule fired, where (path and line), the masked preview and the SHA-256 fingerprint of the secret — the raw secret is not stored and cannot be read back.  Scoped to the caller's org, and a finding belonging to another org is the same 404 as one that never existed.
120pub async fn get_security_findings_by_id(configuration: &configuration::Configuration, id: &str) -> Result<models::FindingView, Error<GetSecurityFindingsByIdError>> {
121    // add a prefix to parameters to efficiently prevent name collisions
122    let p_id = id;
123
124    let uri_str = format!("{}/v1/security/findings/{id}", configuration.base_path, id=crate::apis::urlencode(p_id));
125    let mut req_builder = configuration.client.request(reqwest::Method::GET, &uri_str);
126
127    if let Some(ref user_agent) = configuration.user_agent {
128        req_builder = req_builder.header(reqwest::header::USER_AGENT, user_agent.clone());
129    }
130    if let Some(ref token) = configuration.bearer_access_token {
131        req_builder = req_builder.bearer_auth(token.to_owned());
132    };
133
134    let req = req_builder.build()?;
135    let resp = configuration.client.execute(req).await?;
136
137    let status = resp.status();
138    let content_type = resp
139        .headers()
140        .get("content-type")
141        .and_then(|v| v.to_str().ok())
142        .unwrap_or("application/octet-stream");
143    let content_type = super::ContentType::from(content_type);
144
145    if !status.is_client_error() && !status.is_server_error() {
146        let content = resp.text().await?;
147        match content_type {
148            ContentType::Json => serde_json::from_str(&content).map_err(Error::from),
149            ContentType::Text => return Err(Error::from(serde_json::Error::custom("Received `text/plain` content type response that cannot be converted to `models::FindingView`"))),
150            ContentType::Unsupported(unknown_type) => return Err(Error::from(serde_json::Error::custom(format!("Received `{unknown_type}` content type response that cannot be converted to `models::FindingView`")))),
151        }
152    } else {
153        let content = resp.text().await?;
154        let entity: Option<GetSecurityFindingsByIdError> = serde_json::from_str(&content).ok();
155        Err(Error::ResponseError(ResponseContent { status, content, entity }))
156    }
157}
158
159/// Reports that the scanning subsystem is serving and how many secret-detection rules the engine holds.  It has no external dependency — the answer is ok whenever the findings store opened — so it measures this process rather than anything downstream. It reads no tenant: a prober that sends no principal is answered, not refused.
160pub async fn get_security_health(configuration: &configuration::Configuration, ) -> Result<models::Ruleset, Error<GetSecurityHealthError>> {
161
162    let uri_str = format!("{}/v1/security/health", configuration.base_path);
163    let mut req_builder = configuration.client.request(reqwest::Method::GET, &uri_str);
164
165    if let Some(ref user_agent) = configuration.user_agent {
166        req_builder = req_builder.header(reqwest::header::USER_AGENT, user_agent.clone());
167    }
168    if let Some(ref token) = configuration.bearer_access_token {
169        req_builder = req_builder.bearer_auth(token.to_owned());
170    };
171
172    let req = req_builder.build()?;
173    let resp = configuration.client.execute(req).await?;
174
175    let status = resp.status();
176    let content_type = resp
177        .headers()
178        .get("content-type")
179        .and_then(|v| v.to_str().ok())
180        .unwrap_or("application/octet-stream");
181    let content_type = super::ContentType::from(content_type);
182
183    if !status.is_client_error() && !status.is_server_error() {
184        let content = resp.text().await?;
185        match content_type {
186            ContentType::Json => serde_json::from_str(&content).map_err(Error::from),
187            ContentType::Text => return Err(Error::from(serde_json::Error::custom("Received `text/plain` content type response that cannot be converted to `models::Ruleset`"))),
188            ContentType::Unsupported(unknown_type) => return Err(Error::from(serde_json::Error::custom(format!("Received `{unknown_type}` content type response that cannot be converted to `models::Ruleset`")))),
189        }
190    } else {
191        let content = resp.text().await?;
192        let entity: Option<GetSecurityHealthError> = serde_json::from_str(&content).ok();
193        Err(Error::ResponseError(ResponseContent { status, content, entity }))
194    }
195}
196
197/// Is the secret-detection catalog the engine scans with.  It returns every rule a scan can fire — the id, name and severity a finding cites — so a caller can render or triage results without hard-coding the catalog. It is the same for everyone and discloses nothing tenant-specific, so it carries no org scope.
198pub async fn get_security_rules(configuration: &configuration::Configuration, ) -> Result<models::RuleList, Error<GetSecurityRulesError>> {
199
200    let uri_str = format!("{}/v1/security/rules", configuration.base_path);
201    let mut req_builder = configuration.client.request(reqwest::Method::GET, &uri_str);
202
203    if let Some(ref user_agent) = configuration.user_agent {
204        req_builder = req_builder.header(reqwest::header::USER_AGENT, user_agent.clone());
205    }
206    if let Some(ref token) = configuration.bearer_access_token {
207        req_builder = req_builder.bearer_auth(token.to_owned());
208    };
209
210    let req = req_builder.build()?;
211    let resp = configuration.client.execute(req).await?;
212
213    let status = resp.status();
214    let content_type = resp
215        .headers()
216        .get("content-type")
217        .and_then(|v| v.to_str().ok())
218        .unwrap_or("application/octet-stream");
219    let content_type = super::ContentType::from(content_type);
220
221    if !status.is_client_error() && !status.is_server_error() {
222        let content = resp.text().await?;
223        match content_type {
224            ContentType::Json => serde_json::from_str(&content).map_err(Error::from),
225            ContentType::Text => return Err(Error::from(serde_json::Error::custom("Received `text/plain` content type response that cannot be converted to `models::RuleList`"))),
226            ContentType::Unsupported(unknown_type) => return Err(Error::from(serde_json::Error::custom(format!("Received `{unknown_type}` content type response that cannot be converted to `models::RuleList`")))),
227        }
228    } else {
229        let content = resp.text().await?;
230        let entity: Option<GetSecurityRulesError> = serde_json::from_str(&content).ok();
231        Err(Error::ResponseError(ResponseContent { status, content, entity }))
232    }
233}
234
235/// Is the org's scan history, newest first, each as the same summary the submission answered — files read, findings fired, tally by severity.  Strictly org-scoped: a caller only ever sees its own scans, and one with no validated org is refused.
236pub async fn get_security_scans(configuration: &configuration::Configuration, limit: Option<i32>) -> Result<models::ScanList, Error<GetSecurityScansError>> {
237    // add a prefix to parameters to efficiently prevent name collisions
238    let p_limit = limit;
239
240    let uri_str = format!("{}/v1/security/scans", configuration.base_path);
241    let mut req_builder = configuration.client.request(reqwest::Method::GET, &uri_str);
242
243    if let Some(ref param_value) = p_limit {
244        req_builder = req_builder.query(&[("limit", &param_value.to_string())]);
245    }
246    if let Some(ref user_agent) = configuration.user_agent {
247        req_builder = req_builder.header(reqwest::header::USER_AGENT, user_agent.clone());
248    }
249    if let Some(ref token) = configuration.bearer_access_token {
250        req_builder = req_builder.bearer_auth(token.to_owned());
251    };
252
253    let req = req_builder.build()?;
254    let resp = configuration.client.execute(req).await?;
255
256    let status = resp.status();
257    let content_type = resp
258        .headers()
259        .get("content-type")
260        .and_then(|v| v.to_str().ok())
261        .unwrap_or("application/octet-stream");
262    let content_type = super::ContentType::from(content_type);
263
264    if !status.is_client_error() && !status.is_server_error() {
265        let content = resp.text().await?;
266        match content_type {
267            ContentType::Json => serde_json::from_str(&content).map_err(Error::from),
268            ContentType::Text => return Err(Error::from(serde_json::Error::custom("Received `text/plain` content type response that cannot be converted to `models::ScanList`"))),
269            ContentType::Unsupported(unknown_type) => return Err(Error::from(serde_json::Error::custom(format!("Received `{unknown_type}` content type response that cannot be converted to `models::ScanList`")))),
270        }
271    } else {
272        let content = resp.text().await?;
273        let entity: Option<GetSecurityScansError> = serde_json::from_str(&content).ok();
274        Err(Error::ResponseError(ResponseContent { status, content, entity }))
275    }
276}
277
278/// Returns one scan together with every finding on it, so the detail view is one round-trip rather than a list call per scan. The findings carry masked previews and fingerprints, never secrets.  Scoped to the caller's org: a scan id belonging to another org is the same 404 as an id that never existed, so a ruleset learns nothing about what exists elsewhere. No validated org is refused.
279pub async fn get_security_scans_by_id(configuration: &configuration::Configuration, id: &str) -> Result<models::ScanDetail, Error<GetSecurityScansByIdError>> {
280    // add a prefix to parameters to efficiently prevent name collisions
281    let p_id = id;
282
283    let uri_str = format!("{}/v1/security/scans/{id}", configuration.base_path, id=crate::apis::urlencode(p_id));
284    let mut req_builder = configuration.client.request(reqwest::Method::GET, &uri_str);
285
286    if let Some(ref user_agent) = configuration.user_agent {
287        req_builder = req_builder.header(reqwest::header::USER_AGENT, user_agent.clone());
288    }
289    if let Some(ref token) = configuration.bearer_access_token {
290        req_builder = req_builder.bearer_auth(token.to_owned());
291    };
292
293    let req = req_builder.build()?;
294    let resp = configuration.client.execute(req).await?;
295
296    let status = resp.status();
297    let content_type = resp
298        .headers()
299        .get("content-type")
300        .and_then(|v| v.to_str().ok())
301        .unwrap_or("application/octet-stream");
302    let content_type = super::ContentType::from(content_type);
303
304    if !status.is_client_error() && !status.is_server_error() {
305        let content = resp.text().await?;
306        match content_type {
307            ContentType::Json => serde_json::from_str(&content).map_err(Error::from),
308            ContentType::Text => return Err(Error::from(serde_json::Error::custom("Received `text/plain` content type response that cannot be converted to `models::ScanDetail`"))),
309            ContentType::Unsupported(unknown_type) => return Err(Error::from(serde_json::Error::custom(format!("Received `{unknown_type}` content type response that cannot be converted to `models::ScanDetail`")))),
310        }
311    } else {
312        let content = resp.text().await?;
313        let entity: Option<GetSecurityScansByIdError> = serde_json::from_str(&content).ok();
314        Err(Error::ResponseError(ResponseContent { status, content, entity }))
315    }
316}
317
318/// Runs the detection engine over a batch of files and answers 201 with the scan summary: how many files were read, how many findings fired, and the tally by severity.  THE SUBMITTED CONTENT IS NEVER STORED. It is scanned in memory; what persists is the finding — its rule, its path and line, a MASKED preview (first and last characters kept, the middle starred) and the SHA-256 fingerprint of the raw secret. The fingerprint is what makes the same secret recognisable across scans and after rotation without the secret ever being written down.  It requires a validated org, which scopes the stored scan and every finding on it; a caller with no org is refused. Bounded at 500 files and 8 MiB of total content per submission — split a larger tree across scans. One scan is one metered unit, and the scan is recorded in the audit log with its tally, never with its findings.
319pub async fn post_security_scans(configuration: &configuration::Configuration, submit_req: models::SubmitReq) -> Result<models::ScanView, Error<PostSecurityScansError>> {
320    // add a prefix to parameters to efficiently prevent name collisions
321    let p_submit_req = submit_req;
322
323    let uri_str = format!("{}/v1/security/scans", configuration.base_path);
324    let mut req_builder = configuration.client.request(reqwest::Method::POST, &uri_str);
325
326    if let Some(ref user_agent) = configuration.user_agent {
327        req_builder = req_builder.header(reqwest::header::USER_AGENT, user_agent.clone());
328    }
329    if let Some(ref token) = configuration.bearer_access_token {
330        req_builder = req_builder.bearer_auth(token.to_owned());
331    };
332    req_builder = req_builder.json(&p_submit_req);
333
334    let req = req_builder.build()?;
335    let resp = configuration.client.execute(req).await?;
336
337    let status = resp.status();
338    let content_type = resp
339        .headers()
340        .get("content-type")
341        .and_then(|v| v.to_str().ok())
342        .unwrap_or("application/octet-stream");
343    let content_type = super::ContentType::from(content_type);
344
345    if !status.is_client_error() && !status.is_server_error() {
346        let content = resp.text().await?;
347        match content_type {
348            ContentType::Json => serde_json::from_str(&content).map_err(Error::from),
349            ContentType::Text => return Err(Error::from(serde_json::Error::custom("Received `text/plain` content type response that cannot be converted to `models::ScanView`"))),
350            ContentType::Unsupported(unknown_type) => return Err(Error::from(serde_json::Error::custom(format!("Received `{unknown_type}` content type response that cannot be converted to `models::ScanView`")))),
351        }
352    } else {
353        let content = resp.text().await?;
354        let entity: Option<PostSecurityScansError> = serde_json::from_str(&content).ok();
355        Err(Error::ResponseError(ResponseContent { status, content, entity }))
356    }
357}
358
hanzo_client/apis/security_api.rs

hanzo_client/apis/
security_api.rs
