cloudsec: fleet overview, provider manifests, CSV exports, inventory provider filter#312
Merged
Conversation
…provider filter
Catch the CLI/SDK up to the current /cloudsec gateway surface:
- 'cloudsec fleet overview' / CloudSec.get_fleet_overview(): the multi-org
fleet posture board (GET /cloudsec/fleet/overview), with --oid/--group
narrowing. User-scoped credentials mint a temporary multi-org JWT
(refresh_jwt(oid_override="")) so the fleet spans every accessible org,
restoring the client's own token afterwards.
- 'cloudsec provider manifest [--type]' / get_provider_manifests(): the
per-provider coverage manifests (GET /cloudsec/{oid}/providers/manifest).
- 'cloudsec export {findings,inventory,compliance,query} [-o file]' /
export_*_csv(): the ?format=csv streaming exports. Client.request grows
raw_response=True to return non-JSON bodies as text.
- 'cloudsec inventory list --provider' / list_inventory(provider=...): the
new provider sweep filter.
- Help-text refresh: valid sort keys (lc_risk/severity/first_seen), current
provider examples, group/explain coverage for the new commands.
- doc/: new CLI Cloud Security page + CloudSec SDK section; CHANGELOG entry.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lcbill
previously approved these changes
Jul 14, 2026
Adversarial review of the first cut found the JWT-swap approach was at the wrong depth: request()'s internal 401-retry re-minted an ORG-scoped token and could silently collapse the fleet to one org, refresh_jwt's side effects (_on_refresh_auth, shared _jwt mutation, cache) leaked the more-privileged multi-org token beyond the call, and the swap window was not concurrency-safe on a shared Client. Redesign: - Client.mint_jwt(oid=..., expiry=...): a pure mint — returns a token without setting the client JWT, firing the refresh callback, or writing the JWT cache. OAuth id_token refresh extracted to _refreshed_oauth_id_token() (shared with _refresh_jwt_oauth). - get_fleet_overview sends the multi-org token as a request-local Authorization header (is_no_auth bypasses the client's own token and its 401 downgrade path), caches it across paginated calls, re-mints it once on a 401, and never touches client state. - refresh_jwt reverted to exactly its master behavior (the '' override is no longer needed). - CLI: inventory list/export share one _inventory_filter_options decorator. Unit suite: 3619 passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
Post-review hardening pushed ( Fixed
Reviewed, accepted as-is
Unit suite after redesign: 3619 passed, 5 skipped. |
lcbill
approved these changes
Jul 14, 2026
maximelb
marked this pull request as ready for review
July 14, 2026 21:40
maximelb
added a commit
that referenced
this pull request
Jul 19, 2026
…tity, policy, simulate, finding classes) (#315) Catches `limacharlie cloudsec` up to the Cloud Security gateway surface added since PR #312 (2026-07-14). Seven new routes plus one new inventory selector were live on the gateway with no CLI/SDK coverage; this adds all of them, giving full 44/44 route coverage. New SDK methods (limacharlie/sdk/cloudsec.py) + CLI commands: - get_identity(urn) -> GET /ciem/identity -> `ciem identity <urn>` - get_finding_classes() -> GET /findings/classes-> `finding classes` - get_topology() -> GET /topology -> `topology` - get_policy_vocabulary() -> GET /policy/vocabulary-> `policy vocabulary` - suggest_policy_values(...) -> POST /policy/suggest -> `policy suggest` - simulate_resource_match(...) -> POST /simulate/resources-> `simulate resources` - simulate_finding_match(...) -> POST /simulate/findings -> `simulate findings` Plus the inventory `account_unscoped` escape hatch, exposed as `inventory list --all-accounts` and `export inventory --all-accounts` (honored on both the JSON and CSV paths), and the new `device_posture` finding class added to the finding-list help text. The `policy` (vocabulary + autocomplete) and `simulate` (matcher preview) groups are the CLI companions to the classification-policy authoring UI: they read the server-driven vocabulary and preview an in-edit cloudsec_policy matcher against the estate before it is saved. Nothing is persisted by either. Field names, HTTP methods, boolean forwarding, and the target/dimension enums were verified against the lc_api-go gateway route whitelists and the legion_graph RPC handlers. Full unit suite green (3654 passed). Claude-Session: https://claude.ai/code/session_01C5xJgttYUj7hEWPduBHvm2 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Catches the
limacharlie cloudsecCLI + SDK up to the current/cloudsecgateway surface (which grew fleet, manifests, CSV export, and inventory-provider routes over the last week).New
cloudsec fleet overview/CloudSec.get_fleet_overview()— the multi-org fleet posture board (GET /cloudsec/fleet/overview): one row per authorized org + first-page cross-tenant rollups, narrowable with repeatable--oidand/or an org--group. With user-scoped credentials the CLI mints a temporary multi-org JWT (refresh_jwt(oid_override=""), new) so the fleet is not collapsed to the single configured org; the client's own JWT is restored afterwards. Org API keys just use their org-scoped claims.cloudsec provider manifest [--type gcp]/get_provider_manifests()— per-provider coverage manifests (collectors, posture checks, support levels, known gaps, org scan freshness).cloudsec export {findings,inventory,compliance,query} [-o file.csv]/export_*_csv()— the?format=csvstreaming exports (server walks the full filtered set, 100k-row cap, trailing#comment on truncation).Client.request()growsraw_response=Trueto return non-JSON bodies as text.cloudsec inventory list --provider/list_inventory(provider=...)— the new inventory provider-sweep filter.Polish
lc_riskdefault /severity/first_seen), refreshed provider examples (entra, auth0, github, openai, anthropic, limacharlie...), new commands in the group help and--ai-helpregistry.doc/cli/cloud-security.md(new page, linked from the doc index) + a CloudSec section indoc/sdk/other-classes.md; CHANGELOG entry.Tests
raw_responseplumbing, inventory provider filter, CLI export-to-file/stdout,export queryarg validation, and the clientraw_responsetext path.No backward-compat concerns per Maxime — the cloudsec CLI surface is pre-GA.
🤖 Generated with Claude Code