--- policy: /ce/ca/azure/microsoft-entra-id/guest-invite-settings-only-admins-can-invite logic: /ce/ca/azure/microsoft-entra-id/guest-invite-settings-only-admins-can-invite/prod.logic.yaml executionTime: 2026-06-06T12:03:38.366188419Z generationMs: 49 executionMs: 1072 rows: - id: test1 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 199 actual: 199 conditionText: expected: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT) actual: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT) runtimeError: {} - id: test2 match: true status: expected: INCOMPLIANT actual: INCOMPLIANT conditionIndex: expected: 199 actual: 199 conditionText: expected: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT) actual: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT) runtimeError: {} - id: test3 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT) actual: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT) runtimeError: {} - id: test4 match: true status: expected: COMPLIANT actual: COMPLIANT conditionIndex: expected: 299 actual: 299 conditionText: expected: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT) actual: CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT) runtimeError: {} - id: test5 match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 400 actual: 400 conditionText: expected: otherwise actual: otherwise runtimeError: {} - id: test6 match: true status: expected: UNDETERMINED actual: UNDETERMINED conditionIndex: expected: 400 actual: 400 conditionText: expected: otherwise actual: otherwise runtimeError: {} usedFiles: - path: /ce/ca/azure/microsoft-entra-id/guest-invite-settings-only-admins-can-invite/policy.yaml md5Hash: 7D5F97B7B820F4FB0E3D909CEB85B858 content: | --- names: full: Microsoft Entra ID Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users contextual: Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users description: Restrict invitations to users with specific administrative roles only. type: COMPLIANCE_POLICY categories: - SECURITY frameworkMappings: - "/frameworks/cis-azure-v5.0.0/05/16" - "/frameworks/cloudaware/identity-and-access-governance/general-access-controls" similarPolicies: cloudConformity: - url: https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActiveDirectory/guests-can-invite.html name: Guests Can Invite - path: /ce/ca/azure/microsoft-entra-id/guest-invite-settings-only-admins-can-invite/prod.logic.yaml md5Hash: 82F77F7A21375B34BCECE208B9744D37 content: | --- inputType: "CA10__CaAzureActiveDirectory__c" testData: - file: "test-data.json" conditions: - status: "INCOMPLIANT" currentStateMessage: "Users outside the Global Administrator, User Administrator, and Guest Inviter roles can invite guests." remediationMessage: "Restrict guest invitations to approved roles." check: RELATED_LIST_HAS: status: "INCOMPLIANT" relationshipName: "CA10Z1__Azure_Active_Directory_Auth_Policies__r" - status: "COMPLIANT" currentStateMessage: "Guest invitations are restricted to approved roles." check: RELATED_LIST_HAS: status: "COMPLIANT" relationshipName: "CA10Z1__Azure_Active_Directory_Auth_Policies__r" - status: "UNDETERMINED" currentStateMessage: "Unable to determine Guest invite settings." check: RELATED_LIST_HAS: status: "UNDETERMINED" relationshipName: "CA10Z1__Azure_Active_Directory_Auth_Policies__r" otherwise: status: "UNDETERMINED" currentStateMessage: "The Authorization Policy for Microsoft Entra is not present in the CMDB." relatedLists: - relationshipName: "CA10Z1__Azure_Active_Directory_Auth_Policies__r" importExtracts: - file: "/types/CA10Z1__CaAzureActiveDirectoryAuthPolicy__c/object.extracts.yaml" conditions: - status: "INCOMPLIANT" currentStateMessage: "Everyone in the organization, including guests, can invite guests." remediationMessage: "Restrict guest invitations to approved roles." check: IS_EQUAL: left: EXTRACT: "CA10Z1__invitesFromState__c" right: TEXT: "everyone" - status: "INCOMPLIANT" currentStateMessage: "All User role members are allowed to invite guests." remediationMessage: "Restrict guest invitations to approved roles." check: IS_EQUAL: left: EXTRACT: "CA10Z1__invitesFromState__c" right: TEXT: "adminsGuestInvitersAndAllMembers" - status: "COMPLIANT" currentStateMessage: "Only Global Administrator, User Administrator, and Guest Inviter roles can invite guests." check: IS_EQUAL: left: EXTRACT: "CA10Z1__invitesFromState__c" right: TEXT: "adminsAndGuestInviters" - status: "COMPLIANT" currentStateMessage: "Guest invitations are disabled for all users, including administrators." check: IS_EQUAL: left: EXTRACT: "CA10Z1__invitesFromState__c" right: TEXT: "None" otherwise: status: "UNDETERMINED" currentStateMessage: "Unexpected value in the field." - path: /ce/ca/azure/microsoft-entra-id/guest-invite-settings-only-admins-can-invite/test-data.json md5Hash: BCD972430CB02F332071237CEFBDEA0A content: |- [ { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "199", "conditionText": "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test1", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [ { "Id": "test1_1", "CA10Z1__disappearanceTime__c": null, "CA10Z1__invitesFromState__c": "everyone", "CA10Z1__activeDirectory__c": "test1" } ] }, { "expectedResult": { "status": "INCOMPLIANT", "conditionIndex": "199", "conditionText": "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test2", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [ { "Id": "test2_1", "CA10Z1__disappearanceTime__c": null, "CA10Z1__invitesFromState__c": "adminsGuestInvitersAndAllMembers", "CA10Z1__activeDirectory__c": "test2" } ] }, { "expectedResult": { "status": "COMPLIANT", "conditionIndex": "299", "conditionText": "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test3", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [ { "Id": "test3_1", "CA10Z1__disappearanceTime__c": null, "CA10Z1__invitesFromState__c": "adminsAndGuestInviters", "CA10Z1__activeDirectory__c": "test3" } ] }, { "expectedResult": { "status": "COMPLIANT", "conditionIndex": "299", "conditionText": "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT)", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test4", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [ { "Id": "test4_1", "CA10Z1__disappearanceTime__c": null, "CA10Z1__invitesFromState__c": "None", "CA10Z1__activeDirectory__c": "test4" } ] }, { "expectedResult": { "status": "UNDETERMINED", "conditionIndex": "400", "conditionText": "otherwise", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test5", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [] }, { "expectedResult": { "status": "UNDETERMINED", "conditionIndex": "400", "conditionText": "otherwise", "runtimeError": null }, "context": { "snapshotTime": "2024-11-11T19:24:25Z" }, "Id": "test6", "CA10Z1__Azure_Active_Directory_Auth_Policies__r": [ { "Id": "test6_1", "CA10Z1__disappearanceTime__c": "2024-11-11T19:24:25Z", "CA10Z1__invitesFromState__c": "None", "CA10Z1__activeDirectory__c": "test6" } ] } ] - path: /types/CA10Z1__CaAzureActiveDirectoryAuthPolicy__c/object.extracts.yaml md5Hash: 0D0D0A881B5C2BBE41D5A8A7C629F5FD content: "---\nextracts:\n# Values: none, adminsAndGuestInviters, adminsGuestInvitersAndAllMembers,\ \ everyone. Not Nullable. Can't have no access, retrieved via policies/authorizationPolicy\n\ \ - name: \"CA10Z1__invitesFromState__c\"\n value: \n FIELD:\n \ \ path: \"CA10Z1__invitesFromState__c\"\n undeterminedIf:\n \ \ isEmpty: \"Corrupted data. The Allow Invites authorization setting cannot\ \ be empty.\"\n# Values: \n# User (a0b1b346-4d3e-4e8b-98f8-753987be4970)\n#\ \ Guest User (10dae51f-b6af-4016-8d66-8c2a99b929b3)\n# Restricted Guest User\ \ (2af84b1e-32c8-42b7-82bc-daa82404023b).\n# Can't have no access, retrieved\ \ via policies/authorizationPolicy\n - name: \"CA10Z1__guestUserRoleId__c\"\ \n value: \n FIELD:\n path: \"CA10Z1__guestUserRoleId__c\"\n\ \ undeterminedIf:\n isEmpty: \"Corrupted data. The Guest User\ \ Role Id cannot be empty.\"\n# Values: Enabled, Disabled. Not Nullable. Can't\ \ have no access, retrieved via policies/authorizationPolicy\n - name: \"CA10Z1__defaultPermissionCreateTenants__c\"\ \n value: \n FIELD:\n path: \"CA10Z1__defaultPermissionCreateTenants__c\"\ \n undeterminedIf:\n isEmpty: \"Corrupted data. The Allowed\ \ To Create Tenants default setting cannot be empty.\"\n# Values: Enabled, Disabled.\ \ Not Nullable. Can't have no access, retrieved via policies/authorizationPolicy\n\ \ - name: \"CA10Z1__defaultPermissionCreateApps__c\"\n value: \n FIELD:\n\ \ path: \"CA10Z1__defaultPermissionCreateApps__c\"\n undeterminedIf:\n\ \ isEmpty: \"Corrupted data. The Allowed To Create Apps default setting\ \ cannot be empty.\"\n\n" script: |- CREATE TEMP FUNCTION mock_ExpectedResult() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "Id" : "test1", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "199", "conditionText" : "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT)", "runtimeError" : null } }, { "Id" : "test2", "expectedResult" : { "status" : "INCOMPLIANT", "conditionIndex" : "199", "conditionText" : "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT)", "runtimeError" : null } }, { "Id" : "test3", "expectedResult" : { "status" : "COMPLIANT", "conditionIndex" : "299", "conditionText" : "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT)", "runtimeError" : null } }, { "Id" : "test4", "expectedResult" : { "status" : "COMPLIANT", "conditionIndex" : "299", "conditionText" : "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT)", "runtimeError" : null } }, { "Id" : "test5", "expectedResult" : { "status" : "UNDETERMINED", "conditionIndex" : "400", "conditionText" : "otherwise", "runtimeError" : null } }, { "Id" : "test6", "expectedResult" : { "status" : "UNDETERMINED", "conditionIndex" : "400", "conditionText" : "otherwise", "runtimeError" : null } } ]; """; CREATE TEMP FUNCTION mock_CA10Z1__CaAzureActiveDirectoryAuthPolicy__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "CA10Z1__invitesFromState__c" : "everyone", "CA10Z1__activeDirectory__c" : "test1", "Id" : "test1_1" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "CA10Z1__invitesFromState__c" : "adminsGuestInvitersAndAllMembers", "CA10Z1__activeDirectory__c" : "test2", "Id" : "test2_1" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "CA10Z1__invitesFromState__c" : "adminsAndGuestInviters", "CA10Z1__activeDirectory__c" : "test3", "Id" : "test3_1" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "CA10Z1__invitesFromState__c" : "None", "CA10Z1__activeDirectory__c" : "test4", "Id" : "test4_1" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "CA10Z1__disappearanceTime__c" : new Date("2024-11-11T19:24:25Z"), "CA10Z1__invitesFromState__c" : "None", "CA10Z1__activeDirectory__c" : "test6", "Id" : "test6_1" } ]; """; CREATE TEMP FUNCTION mock_CA10__CaAzureActiveDirectory__c() RETURNS ARRAY >> DETERMINISTIC LANGUAGE js AS r""" return [ { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test1" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test2" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test3" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test4" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test5" }, { "context" : { "snapshotTime" : new Date("2024-11-11T19:24:25Z") }, "Id" : "test6" } ]; """; CREATE TEMP FUNCTION process_CA10__CaAzureActiveDirectory__c( obj STRUCT< CA10Z1__Azure_Active_Directory_Auth_Policies__r ARRAY >>, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var references1 = []; // condition[0], conditionIndex:[0..99] if (false) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared()", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } var count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 = 0; if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r != null) { for (var i3 = 0; i3 < obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r.length; i3++) { if (typeof(obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i3].status) !== 'undefined') { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i3].status == 'INCOMPLIANT') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 += obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i3].count; } } else { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i3].result.status == 'INCOMPLIANT') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 += 1; } } } } // condition[1], conditionIndex:[100..199] references1.push('Related list [CA10Z1__Azure_Active_Directory_Auth_Policies__r] ' + (count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 > 0 ? 'has' : 'does not have') + ' objects in INCOMPLIANT status'); if (count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_INCOMPLIANT2 > 0) { return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(INCOMPLIANT)", currentStateMessage: "Users outside the Global Administrator, User Administrator, and Guest Inviter roles can invite guests.", currentStateReferences: references1.join('\n'), remediation: "Restrict guest invitations to approved roles.", runtimeError: null}; } var count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_COMPLIANT4 = 0; if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r != null) { for (var i5 = 0; i5 < obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r.length; i5++) { if (typeof(obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i5].status) !== 'undefined') { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i5].status == 'COMPLIANT') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_COMPLIANT4 += obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i5].count; } } else { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i5].result.status == 'COMPLIANT') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_COMPLIANT4 += 1; } } } } // condition[2], conditionIndex:[200..299] if (count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_COMPLIANT4 > 0) { return {status: 'COMPLIANT', conditionIndex: 299, conditionText: "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(COMPLIANT)", currentStateMessage: "Guest invitations are restricted to approved roles.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } var count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_UNDETERMINED6 = 0; if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r != null) { for (var i7 = 0; i7 < obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r.length; i7++) { if (typeof(obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i7].status) !== 'undefined') { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i7].status == 'UNDETERMINED') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_UNDETERMINED6 += obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i7].count; } } else { if (obj.CA10Z1__Azure_Active_Directory_Auth_Policies__r[i7].result.status == 'UNDETERMINED') { count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_UNDETERMINED6 += 1; } } } } // condition[3], conditionIndex:[300..399] if (count_CA10Z1__Azure_Active_Directory_Auth_Policies__r_UNDETERMINED6 > 0) { return {status: 'UNDETERMINED', conditionIndex: 399, conditionText: "CA10Z1__Azure_Active_Directory_Auth_Policies__r.has(UNDETERMINED)", currentStateMessage: "Unable to determine Guest invite settings.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } return {status: 'UNDETERMINED', conditionIndex: 400, conditionText: "otherwise", currentStateMessage: "The Authorization Policy for Microsoft Entra is not present in the CMDB.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; CREATE TEMP FUNCTION process_CA10Z1__Azure_Active_Directory_Auth_Policies__r( obj STRUCT< CA10Z1__disappearanceTime__c TIMESTAMP, CA10Z1__invitesFromState__c STRING, CA10Z1__activeDirectory__c STRING, Id STRING >, snapshotTime TIMESTAMP ) RETURNS STRUCT DETERMINISTIC LANGUAGE js AS r""" var TextLib = new function () { this.normalize = function(arg) { return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase(); }; this.isEmpty = function(arg) { return this.normalize(arg) == ''; }; this.isNotEmpty = function(arg) { return this.normalize(arg) != ''; }; this.equal = function(left, right) { return this.normalize(left) == this.normalize(right); }; this.notEqual = function(left, right) { return this.normalize(left) != this.normalize(right); }; this.startsWith = function(arg, substring) { return this.normalize(arg).startsWith(this.normalize(substring)); }; this.endsWith = function(arg, substring) { return this.normalize(arg).endsWith(this.normalize(substring)); }; this.contains = function(arg, substring) { return this.normalize(arg).includes(this.normalize(substring)); }; this.containsAll = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.every(sub => normalizedArg.includes(this.normalize(sub))); }; this.containsAny = function(arg, substrings) { if (substrings == null || substrings.length === 0) return false; let normalizedArg = this.normalize(arg); return substrings.some(sub => normalizedArg.includes(this.normalize(sub))); }; }(); var references1 = []; // condition[0], conditionIndex:[0..99] references1.push('Deleted From Azure [CA10Z1__disappearanceTime__c]: ' + obj.CA10Z1__disappearanceTime__c); if (obj.CA10Z1__disappearanceTime__c != null) { return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10Z1__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } // condition[1], conditionIndex:[100..199] function fieldChecked4() { if (TextLib.isEmpty(obj.CA10Z1__invitesFromState__c)) { throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "CA10Z1__invitesFromState__c.isEmpty()", currentStateMessage: "Corrupted data. The Allow Invites authorization setting cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } return obj.CA10Z1__invitesFromState__c; } function extract3() { if (!this.out) { this.out = fieldChecked4(); } return this.out; }; references1.push('Invites From State [obj.CA10Z1__invitesFromState__c]: ' + obj.CA10Z1__invitesFromState__c); try { if (TextLib.equal(extract3.call(extract3), 'everyone')) { return {status: 'INCOMPLIANT', conditionIndex: 199, conditionText: "extract('CA10Z1__invitesFromState__c') == 'everyone'", currentStateMessage: "Everyone in the organization, including guests, can invite guests.", currentStateReferences: references1.join('\n'), remediation: "Restrict guest invitations to approved roles.", runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } // condition[2], conditionIndex:[200..299] function fieldChecked7() { if (TextLib.isEmpty(obj.CA10Z1__invitesFromState__c)) { throw new Error("UNDETERMINED condition:201", {cause: {status: 'UNDETERMINED', conditionIndex: 201, conditionText: "CA10Z1__invitesFromState__c.isEmpty()", currentStateMessage: "Corrupted data. The Allow Invites authorization setting cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } return obj.CA10Z1__invitesFromState__c; } function extract6() { if (!this.out) { this.out = fieldChecked7(); } return this.out; }; try { if (TextLib.equal(extract6.call(extract6), 'adminsGuestInvitersAndAllMembers')) { return {status: 'INCOMPLIANT', conditionIndex: 299, conditionText: "extract('CA10Z1__invitesFromState__c') == 'adminsGuestInvitersAndAllMembers'", currentStateMessage: "All User role members are allowed to invite guests.", currentStateReferences: references1.join('\n'), remediation: "Restrict guest invitations to approved roles.", runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } // condition[3], conditionIndex:[300..399] function fieldChecked10() { if (TextLib.isEmpty(obj.CA10Z1__invitesFromState__c)) { throw new Error("UNDETERMINED condition:301", {cause: {status: 'UNDETERMINED', conditionIndex: 301, conditionText: "CA10Z1__invitesFromState__c.isEmpty()", currentStateMessage: "Corrupted data. The Allow Invites authorization setting cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } return obj.CA10Z1__invitesFromState__c; } function extract9() { if (!this.out) { this.out = fieldChecked10(); } return this.out; }; try { if (TextLib.equal(extract9.call(extract9), 'adminsAndGuestInviters')) { return {status: 'COMPLIANT', conditionIndex: 399, conditionText: "extract('CA10Z1__invitesFromState__c') == 'adminsAndGuestInviters'", currentStateMessage: "Only Global Administrator, User Administrator, and Guest Inviter roles can invite guests.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } // condition[4], conditionIndex:[400..499] function fieldChecked13() { if (TextLib.isEmpty(obj.CA10Z1__invitesFromState__c)) { throw new Error("UNDETERMINED condition:401", {cause: {status: 'UNDETERMINED', conditionIndex: 401, conditionText: "CA10Z1__invitesFromState__c.isEmpty()", currentStateMessage: "Corrupted data. The Allow Invites authorization setting cannot be empty.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}}); } return obj.CA10Z1__invitesFromState__c; } function extract12() { if (!this.out) { this.out = fieldChecked13(); } return this.out; }; try { if (TextLib.equal(extract12.call(extract12), 'None')) { return {status: 'COMPLIANT', conditionIndex: 499, conditionText: "extract('CA10Z1__invitesFromState__c') == 'None'", currentStateMessage: "Guest invitations are disabled for all users, including administrators.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; } } catch (err) { if (err.cause && err.cause.status) { return err.cause; } else { throw err; } } return {status: 'UNDETERMINED', conditionIndex: 500, conditionText: "otherwise", currentStateMessage: "Unexpected value in the field.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}; """; SELECT expectedResult.Id as Id, IF ( IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '') AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1) AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '') AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''), "MATCH", "FAIL" ) as match, expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus, expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex, expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText, expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError FROM UNNEST(mock_ExpectedResult()) expectedResult LEFT JOIN ( SELECT `CA10Z1__Azure_Active_Directory_Auth_Policies__r`.arr AS CA10Z1__Azure_Active_Directory_Auth_Policies__r, sObject.Id AS Id, process_CA10__CaAzureActiveDirectory__c( STRUCT( `CA10Z1__Azure_Active_Directory_Auth_Policies__r`.arr AS CA10Z1__Azure_Active_Directory_Auth_Policies__r, sObject.Id AS Id ), sObject.context.snapshotTime ) as result FROM UNNEST(mock_CA10__CaAzureActiveDirectory__c()) AS sObject LEFT JOIN ( SELECT sObject.CA10Z1__activeDirectory__c, ARRAY_AGG( STRUCT( sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c, sObject.CA10Z1__invitesFromState__c AS CA10Z1__invitesFromState__c, sObject.CA10Z1__activeDirectory__c AS CA10Z1__activeDirectory__c, sObject.Id AS Id, process_CA10Z1__Azure_Active_Directory_Auth_Policies__r( STRUCT( sObject.CA10Z1__disappearanceTime__c AS CA10Z1__disappearanceTime__c, sObject.CA10Z1__invitesFromState__c AS CA10Z1__invitesFromState__c, sObject.CA10Z1__activeDirectory__c AS CA10Z1__activeDirectory__c, sObject.Id AS Id ), sObject.context.snapshotTime ) as result ) ) AS arr FROM UNNEST(mock_CA10Z1__CaAzureActiveDirectoryAuthPolicy__c()) AS sObject GROUP BY sObject.CA10Z1__activeDirectory__c ) AS `CA10Z1__Azure_Active_Directory_Auth_Policies__r` ON sObject.Id = `CA10Z1__Azure_Active_Directory_Auth_Policies__r`.CA10Z1__activeDirectory__c ) sObject ON sObject.Id = expectedResult.Id;