gl users enum and gluna users enum (#629)

* Add GitLab users enum commands

Author: Copilot

.github/copilot-instructions.md

@@ -191,40 +191,56 @@ make serve-docs  # Installs dependencies if needed, generates and serves docs
 
 ### Configuration Loading Pattern (MANDATORY)
 
-**ALWAYS use `config.AutoBindFlags` for configuration loading in ALL commands:**
+**Use `config.NewCommandSetup` as the canonical command configuration pattern.**
 
 ```go
 func CommandRun(cmd *cobra.Command, args []string) {
-    // 1. Bind flags to config keys
-    if err := config.AutoBindFlags(cmd, map[string]string{
-        "platform-flag": "platform.url",
-        "token":         "platform.token",
-        "threads":       "common.threads",
-    }); err != nil {
-        log.Fatal().Err(err).Msg("Failed to bind command flags to configuration keys")
-    }
-
-    // 2. Validate required keys
-    if err := config.RequireConfigKeys("platform.url", "platform.token"); err != nil {
-        log.Fatal().Err(err).Msg("required configuration missing")
-    }
-
-    // 3. Get values from unified config (supports flags/env/file)
+    config.NewCommandSetup(cmd).
+        WithFlagBindings(map[string]string{
+            "url":     "platform.url",
+            "token":   "platform.token",
+            "threads": "common.threads",
+        }).
+        RequireKeys("platform.url", "platform.token").
+        AddValidator(func() error { return config.ValidateURL(config.GetString("platform.url"), "Platform URL") }).
+        AddValidator(func() error { return config.ValidateToken(config.GetString("platform.token"), "Platform API Token") }).
+        MustBind()
+
+    // Read values from unified config (supports flags/env/file)
     url := config.GetString("platform.url")
     token := config.GetString("platform.token")
     threads := config.GetInt("common.threads")
 }
 ```
 
+**Migration policy (mandatory):**
+- When modifying an existing command, migrate that touched command to `config.NewCommandSetup`.
+- Do not leave mixed setup styles in the same command implementation.
+- `config.AutoBindFlags` is still an internal building block, but command code should use `NewCommandSetup`.
+
 **Key naming convention:**
 - Platform settings: `<platform>.<key>` (e.g., `github.url`, `gitlab.token`)
 - Subcommand settings: `<platform>.<subcommand>.<key>` (e.g., `github.renovate.enum.owned`)
 - Common settings: `common.<key>` (e.g., `common.threads`)
 
+### Command Coverage Policy (MANDATORY)
+
+- When asked to update "all commands" for a platform, enumerate command files recursively under `internal/cmd/<platform>/` before editing.
+- Apply the requested change to scan and non-scan child commands, including nested children.
+- Do not stop after updating only `scan` commands.
+- Include grouped or nested command trees when applicable (for example, runners/list, runners/exploit, cicd/yaml, users/enum).
+
+**Checklist for broad command updates:**
+1. Discover command tree under `internal/cmd/<platform>/` recursively.
+2. Identify every command Run entrypoint impacted by the request.
+3. Apply updates across all applicable child commands (scan + non-scan + nested).
+4. Verify no command directory in scope was skipped.
+5. Confirm touched commands follow `config.NewCommandSetup` migration policy.
+
 **DO NOT:**
 - Read flags directly with `cmd.Flags().GetString()` - always use config system
-- Use `config.BindCommandFlags` - it's deprecated in favor of `AutoBindFlags`
-- Skip `RequireConfigKeys` validation for required flags
+- Use `config.BindCommandFlags` - it's deprecated
+- Skip required key validation for mandatory config values
 
 ### Package Organization
 

internal/cmd/gitlab/gitlab.go

@@ -12,6 +12,7 @@ import (
 	securefiles "github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/secureFiles"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/snippets"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/tf"
+	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/users"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/variables"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/vuln"
 	"github.com/spf13/cobra"
@@ -55,6 +56,7 @@ For SOCKS5 proxy:
 	glCmd.AddCommand(schedule.NewScheduleCmd())
 	glCmd.AddCommand(snippets.NewSnippetsRootCmd())
 	glCmd.AddCommand(tf.NewTFCmd())
+	glCmd.AddCommand(users.NewUsersRootCmd())
 
 	glCmd.PersistentFlags().StringVarP(&gitlabUrl, "url", "u", "", "GitLab instance URL")
 	glCmd.PersistentFlags().StringVarP(&gitlabApiToken, "token", "t", "", "GitLab API Token")

internal/cmd/gitlab/gitlab_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/scanpublic"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/shodan"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/snippets"
+	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/users"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/variables"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/vuln"
 	"github.com/stretchr/testify/assert"
@@ -39,6 +40,11 @@ func TestNewGitLabRootCmd(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, snippetsCmd)
 	assert.Equal(t, "snippets", snippetsCmd.Name())
+
+	usersCmd, _, err := cmd.Find([]string{"users"})
+	require.NoError(t, err)
+	require.NotNil(t, usersCmd)
+	assert.Equal(t, "users", usersCmd.Name())
 }
 
 func TestNewVulnCmd(t *testing.T) {
@@ -82,6 +88,32 @@ func TestNewRegisterCmd(t *testing.T) {
 	assert.NotNil(t, flags.Lookup("url"), "'url' flag should be registered")
 }
 
+func TestNewUsersRootCmd(t *testing.T) {
+	cmd := users.NewUsersRootCmd()
+
+	require.NotNil(t, cmd)
+	assert.Equal(t, "users", cmd.Use)
+	assert.NotEmpty(t, cmd.Short)
+
+	enumCmd, _, err := cmd.Find([]string{"enum"})
+	require.NoError(t, err)
+	assert.NotNil(t, enumCmd)
+	assert.NotNil(t, enumCmd.Flags().Lookup("token"))
+}
+
+func TestNewUnauthenticatedUsersRootCmd(t *testing.T) {
+	cmd := users.NewUnauthenticatedUsersRootCmd()
+
+	require.NotNil(t, cmd)
+	assert.Equal(t, "users", cmd.Use)
+	assert.NotEmpty(t, cmd.Short)
+
+	enumCmd, _, err := cmd.Find([]string{"enum"})
+	require.NoError(t, err)
+	assert.NotNil(t, enumCmd)
+	assert.Nil(t, enumCmd.Flags().Lookup("token"))
+}
+
 func TestNewShodanCmd(t *testing.T) {
 	cmd := shodan.NewShodanCmd()
 
@@ -126,6 +158,10 @@ func TestNewGitLabRootUnauthenticatedCmd(t *testing.T) {
 	publicScanCmd, _, err := cmd.Find([]string{"scan"})
 	require.NoError(t, err)
 	assert.NotNil(t, publicScanCmd)
+
+	usersCmd, _, err := cmd.Find([]string{"users"})
+	require.NoError(t, err)
+	assert.NotNil(t, usersCmd)
 }
 
 func TestNewScanPublicCmd(t *testing.T) {

internal/cmd/gitlab/gitlab_unauth.go

@@ -4,6 +4,7 @@ import (
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/register"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/scanpublic"
 	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/shodan"
+	"github.com/CompassSecurity/pipeleek/internal/cmd/gitlab/users"
 	"github.com/spf13/cobra"
 )
 
@@ -18,6 +19,7 @@ func NewGitLabRootUnauthenticatedCmd() *cobra.Command {
 	glunaCmd.AddCommand(shodan.NewShodanCmd())
 	glunaCmd.AddCommand(register.NewRegisterCmd())
 	glunaCmd.AddCommand(scanpublic.NewScanPublicCmd())
+	glunaCmd.AddCommand(users.NewUnauthenticatedUsersRootCmd())
 
 	return glunaCmd
 }

internal/cmd/gitlab/users/enum.go

@@ -0,0 +1,83 @@
+package users
+
+import (
+	"strings"
+
+	"github.com/CompassSecurity/pipeleek/pkg/config"
+	pkgusers "github.com/CompassSecurity/pipeleek/pkg/gitlab/users"
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
+)
+
+var flagBindings = map[string]string{
+	"url":   "gitlab.url",
+	"token": "gitlab.token",
+}
+
+func NewEnumCmd() *cobra.Command {
+	return newEnumCmd(true)
+}
+
+func NewUnauthenticatedEnumCmd() *cobra.Command {
+	return newEnumCmd(false)
+}
+
+func newEnumCmd(includeTokenFlag bool) *cobra.Command {
+	enumCmd := &cobra.Command{
+		Use:     "enum",
+		Short:   "Enumerate GitLab users",
+		Long:    "Enumerate GitLab users visible via the GitLab users API.",
+		Example: unauthenticatedEnumExample(includeTokenFlag),
+		Run:     Enum,
+	}
+	enumCmd.Flags().StringP("url", "u", "", "GitLab instance URL")
+	if includeTokenFlag {
+		enumCmd.Flags().StringP("token", "t", "", "GitLab API Token")
+	}
+
+	return enumCmd
+}
+
+func unauthenticatedEnumExample(includeTokenFlag bool) string {
+	if includeTokenFlag {
+		return `pipeleek gl users enum --url https://gitlab.example.com --token glpat-xxxxxxxxxxx`
+	}
+
+	return `pipeleek gluna users enum --url https://gitlab.example.com`
+}
+
+func Enum(cmd *cobra.Command, args []string) {
+	config.NewCommandSetup(cmd).
+		WithFlagBindings(flagBindings).
+		RequireKeys("gitlab.url").
+		AddValidator(func() error { return config.ValidateURL(config.GetString("gitlab.url"), "GitLab URL") }).
+		MustBind()
+
+	gitlabURL := config.GetString("gitlab.url")
+	gitlabAPIToken := config.GetString("gitlab.token")
+
+	// gluna commands are intentionally unauthenticated for users enum.
+	if isSubcommandOf(cmd, "gluna") {
+		if strings.TrimSpace(gitlabAPIToken) != "" {
+			log.Warn().Msg("Ignoring provided GitLab API token for gluna users enum; command runs unauthenticated")
+		}
+		gitlabAPIToken = ""
+	}
+
+	if gitlabAPIToken != "" {
+		if err := config.ValidateToken(gitlabAPIToken, "GitLab API Token"); err != nil {
+			log.Fatal().Err(err).Msg("Invalid GitLab API Token")
+		}
+	}
+
+	pkgusers.RunEnum(gitlabURL, gitlabAPIToken)
+}
+
+func isSubcommandOf(cmd *cobra.Command, rootName string) bool {
+	for current := cmd; current != nil; current = current.Parent() {
+		if current.Name() == rootName {
+			return true
+		}
+	}
+	return false
+}