audit-labs/audit-tools

 1"""
 2Collect the instance password policy from application settings.
 3
 4Requires an admin token on a self-hosted instance; not available on
 5GitLab.com. Returns an empty list with a warning on 403/404.
 6"""
 7
 8import sys
 9
10import requests
11
12PASSWORD_FIELDS = [
13    "minimum_password_length",
14    "password_number_required",
15    "password_symbol_required",
16    "password_uppercase_required",
17    "password_lowercase_required",
18]
19
20
21def password_policy(group, cfg):
22    """group is unused; application settings are instance-wide."""
23    url = f"{cfg['base_url']}/application/settings"
24    try:
25        resp = requests.get(url, headers=cfg["headers"], timeout=cfg["timeout"])
26        resp.raise_for_status()
27    except requests.HTTPError as e:
28        if e.response is not None and e.response.status_code in (403, 404):
29            print(
30                "Warning: application settings require an admin token on a "
31                "self-hosted instance -- skipping.",
32                file=sys.stderr,
33            )
34            return []
35        raise
36
37    settings = resp.json()
38    return [{field: settings.get(field, "Not set") for field in PASSWORD_FIELDS}]