Scanning Process

// Simplified initialization logic
const scanId = crypto.randomUUID();

await supabase.from('tenant_scans').insert({
  scan_id: scanId,
  tenant_id: tenantId,
  organization_id: organizationId,
  status: 'running',
  started_at: new Date().toISOString()
});

// Decrypt and refresh access token
const accessToken = await refreshMicrosoftToken(tenantId);
const client = Client.init({ authProvider: ... });

// Parallel data fetching with error handling
const [usersData, rolesData, groupsData, caPoliciesData] = await Promise.all([
  client.api('/users')
    .select('id,userPrincipalName,displayName,accountEnabled,userType')
    .top(999)
    .get(),

  client.api('/directoryRoles').get(),
  client.api('/groups').get(),
  client.api('/identity/conditionalAccess/policies').get()
]);

// Pagination handling for large result sets
let allUsers = usersData.value;
while (usersData['@odata.nextLink']) {
  usersData = await client.api(usersData['@odata.nextLink']).get();
  allUsers = allUsers.concat(usersData.value);
}

// Bulk insert with conflict resolution
const userRows = allUsers.map(u => ({
  tenant_id: tenantDbId,
  scan_id: scanId,
  user_id: u.id,
  user_principal_name: u.userPrincipalName,
  display_name: u.displayName,
  account_enabled: u.accountEnabled ?? true,
  user_type: u.userType?.toLowerCase() || 'member',
  created_date_time: u.createdDateTime,
  is_deleted: false
}));

// Upsert with composite key (tenant_id, scan_id, user_id)
await supabase
  .from('tenant_users')
  .upsert(userRows, { onConflict: 'tenant_id,scan_id,user_id' });

-- Mark users as privileged if they have any role assignment
UPDATE tenant_users u
SET is_privileged = true
WHERE (tenant_id, scan_id, user_id) IN (
  SELECT tenant_id, scan_id, principal_id
  FROM tenant_role_assignments
  WHERE tenant_id = u.tenant_id
    AND scan_id = u.scan_id
    AND principal_type = 'User'
);

-- Calculate MFA status from authentication methods
UPDATE tenant_users
SET
  is_mfa_enabled = (
    SELECT COUNT(*) > 0
    FROM tenant_mfa_registrations m
    WHERE m.tenant_id = tenant_users.tenant_id
      AND m.scan_id = tenant_users.scan_id
      AND m.user_id = tenant_users.user_id
      AND m.method_type IN ('microsoftAuthenticator', 'phoneAppNotification')
  )
WHERE tenant_id = $1 AND scan_id = $2;

// Create snapshot JSONB
const snapshot = {
  conditionalAccessPolicies: caPolicies.map(p => ({
    id: p.policy_id,
    displayName: p.display_name,
    state: p.state,
    conditions: p.conditions,
    grantControls: p.grant_controls
  })),
  roleAssignments: roleAssignments.map(ra => ({
    id: ra.assignment_id,
    roleId: ra.role_definition_id,
    principalId: ra.principal_id,
    assignedVia: ra.assigned_via
  })),
  // ... other security-critical configuration
};

await supabase.from('snapshots').insert({
  tenant_id: tenantDbId,
  scan_id: scanId,
  snapshot_type: 'security_state',
  snapshot_data: snapshot
});

// Simplified drift detection logic
const { data: previousSnapshot } = await supabase
  .from('snapshots')
  .select('snapshot_data')
  .eq('tenant_id', tenantDbId)
  .lt('created_at', currentScanStartTime)
  .order('created_at', { ascending: false })
  .limit(1)
  .maybeSingle();

if (!previousSnapshot) {
  console.log('[drift] No previous snapshot, skipping drift detection');
  return;
}

const currentPolicies = currentSnapshot.conditionalAccessPolicies;
const previousPolicies = previousSnapshot.snapshot_data.conditionalAccessPolicies;

// Detect new policies
const newPolicies = currentPolicies.filter(c =>
  !previousPolicies.find(p => p.id === c.id)
);

// Detect modified policies
const modifiedPolicies = currentPolicies.filter(c => {
  const prev = previousPolicies.find(p => p.id === c.id);
  return prev && JSON.stringify(c) !== JSON.stringify(prev);
});

// Create drift events
for (const policy of newPolicies) {
  await createDriftEvent({
    drift_type: 'ca_policy_created',
    resource_id: policy.id,
    resource_name: policy.displayName,
    severity: policy.state === 'enabled' ? 'high' : 'medium',
    change_description: `Conditional Access policy "${policy.displayName}" was created`
  });
}

// Example: Evaluate PA-01 (Limit Global Administrators)
async function evaluatePA01(context: EvalContext, data: ScanData): Promise<EvalResult> {
  // Find Global Administrator role
  const globalAdminRole = data.roles.find(r =>
    r.role_template_id === '62e90394-69f5-4237-9190-012177145e10'
  );

  // Count direct assignments (exclude PIM eligible)
  const assignments = data.roleAssignments.filter(ra =>
    ra.role_definition_id === globalAdminRole.role_id &&
    ra.assignment_state === 'active' &&
    ra.assigned_via === 'direct'
  );

  const count = assignments.length;
  const status = (count >= 2 && count <= 4) ? 'pass' : 'fail';

  return {
    status,
    severity: status === 'pass' ? 'info' : 'critical',
    title: 'Limit Global Administrators to 2-4',
    summary: count < 2
      ? `Only ${count} Global Admins (minimum 2 required)`
      : count > 4
      ? `${count} Global Admins exceed recommended maximum of 4`
      : `${count} Global Admins (within recommended range)`,
    evidence: { assignments: assignments.map(a => a.principal_id) },
    resourcesEvaluated: assignments.length,
    resourcesCompliant: status === 'pass' ? count : 0,
    resourcesNonCompliant: status === 'fail' ? count : 0
  };
}

// Aggregate stats from Phase 7
const stats = {
  controlsRun: evaluations.length,
  passed: evaluations.filter(e => e.status === 'pass').length,
  critical: evaluations.filter(e => e.status === 'fail' && e.severity === 'critical').length,
  high: evaluations.filter(e => e.status === 'fail' && e.severity === 'high').length,
  medium: evaluations.filter(e => e.status === 'fail' && e.severity === 'medium').length,
  low: evaluations.filter(e => e.status === 'fail' && e.severity === 'low').length
};

// Update scan record
await supabase
  .from('tenant_scans')
  .update({
    status: 'completed',
    completed_at: new Date().toISOString(),
    stats: stats
  })
  .eq('scan_id', scanId);

// Update tenant last_scan metadata
await supabase
  .from('tenants')
  .update({
    last_scan_at: new Date().toISOString(),
    last_scan_status: 'completed'
  })
  .eq('id', tenantDbId);

// Send notifications if critical findings
if (stats.critical > 0) {
  await sendNotification({
    type: 'critical_findings',
    tenant: tenantName,
    count: stats.critical,
    scanId: scanId
  });
}

-- Daily scan cron job (runs at 2:00 AM UTC)
SELECT cron.schedule(
  'daily-tenant-scans',
  '0 2 * * *',
  $$
  SELECT net.http_post(
    url := 'https://[project-ref].supabase.co/functions/v1/sync-tenant',
    headers := '{"Authorization": "Bearer [service-role-key]"}'::jsonb,
    body := jsonb_build_object('tenant_id', id)
  )
  FROM tenants
  WHERE status = 'active'
    AND (last_scan_at IS NULL OR last_scan_at < now() - interval '24 hours');
  $$
);

// Exponential backoff for Graph API calls
async function fetchWithRetry(url: string, maxRetries = 3): Promise<any> {
  for (let attempt = 1; attempt <= maxRetries; attempt++) {
    try {
      return await client.api(url).get();
    } catch (error) {
      if (error.statusCode === 429) {
        // Rate limited - wait and retry
        const delay = Math.pow(2, attempt) * 1000; // 2s, 4s, 8s
        await new Promise(resolve => setTimeout(resolve, delay));
        continue;
      }
      if (attempt === maxRetries) throw error;
    }
  }
}