Error running rules

[paulmccrady]

I have set up a pipeline variable containing a PAT that has Read access to most features. Some I have not enabled as the option is "Read and Manage". I keep getting the following error running Export-AzDevOpsRuleData

2023-10-12T20:06:46.5563006Z [31;1mException: [0m/home/vsts/.local/share/powershell/Modules/PSRule.Rules.AzureDevOps/0.1.1/Functions/DevOps.Repos.ps1:360

2023-10-12T20:06:46.5563419Z [36;1mLine |

2023-10-12T20:06:46.5563647Z [36;1m 360 | [0m [36;1mthrow $_.Exception.Message[0m

2023-10-12T20:06:46.5563966Z [36;1m | [31;1m ~~~~~~~~~~~~~~~~~~~~~~~~~~

2023-10-12T20:06:46.5564862Z [31;1m[36;1m | [31;1mResponse status code does not indicate success: 401 (Unauthorized).

[webtonize]

Thanks so much for your detailed feedback. Due to the way PAT permissions are managed, it is currently not possible to use Export-AzDevOpsRuleData with anything less then a full access token. This is, like you mentioned, because some permissions can not be set as only Read without also setting Manage or similar.

I am looking in to the possibilities for adding other authentication methods to the module in future so permissions can be managed on a more granular and read-only level.

[paulmccrady]

Many thanks for the reply. Do you have any idea of when a Read only token feature may be available ?

[webtonize]

I'm not sure about any timelines as at the moment I am the only developer on this project and this is done in my spare time. But I am receiving the same kind of signals on requirements for other means of authentication/authorization from other sources. So I do want to give it some priority as a new feature to work on. Any contributions are always welcome ofc ;-)

[paulmccrady]

Thanks for a swift reply. I've tried to look at each function and api used and map the permission scope to each. I've attached as a screenshot. Looks like the apis the UI calls require a full access PAT but the others could use reduced scope permissions. Could you clarify if possible? I'd love to recommend using the rule set with some clients, but internal security teams will likely ask why a full pat is required so want to try and head that off beforehand. If this looks correct I think I'll post an discussion idea.

[webtonize]

Thanks so much for putting in the effort for such a detailed report. This really helps me to improve on what we already have. I have been calling those Contribution/HierarchyQuery endpoints as a result of some reverse engineering of an abandoned MSFT project and my own research after that for the new GHAS feature. The UI data retrieved here is uses in the Azure.DevOps.Pipelines.Settings.* set of rules and additionaly the set of rules on GitHub Advanced security on repositories.

I've done some research for alternatives. Mainly because I fully agree that for enterprise use, this module should use minimum privileges possible and read-only as I have no ambition to let the module do any automatic fixes. For the Azure.DevOps.Pipelines.Settings.* rules I have found a proper supported REST API endpoint requiring vso.project permissions for reading project settings as documented here. I'm aiming to start work on using this endpoint over current the ugly UI based solution probably in the upcoming weekend.

I have not yet been able to find a REST API endpoint that delivers information on the projects GitHub Advanced Security feature. I feel it would be shame to dump the feature completly, but again, I agree with a proper way of running PSRule.Rules.AzureDevOps without full access and no errors. I propose to introduce a switch parameter to indicate a token is fullaccess or fine-grained with or without manage permissions. Is that a workable solution for your clients?

[paulmccrady]

yes - many thanks. Have raised an idea