KC-1416: Add Tenable CNAPP integration support

[jpkeepersecurity]

Summary

This change extends the CNAPP command set with Tenable support and the Encrypter settings needed to protect provider-specific identifiers before they are queued.

It also makes queue payload decryption provider-aware, allowing mixed Wiz and Tenable queue results to resolve the correct configuration automatically.

Changes

• add CNAPP_PROVIDER_TENABLE support to the generated CNAPP protobuf bindings
• accept Tenable in configuration, queue, and remediation commands
• add --url-base-encrypter and --api-token-encrypter configuration options
• allow empty or omitted client credentials for Tenable while preserving Wiz validation requirements
• reject smart-quote placeholders that could otherwise be mistaken for credentials
• mask the Encrypter API token in table and JSON configuration output
• resolve queue decryption keys per provider, with explicit provider and configuration-record overrides
• add focused coverage for Tenable configuration, secret masking, queue listing, and remediation

Security considerations

The Encrypter API token is sent to the router when configuring or testing the integration, but it is never emitted by config read. JSON output exposes only apiTokenEncrypterSet: true when a token is configured.

Automated tests

python -m pytest unit-tests/pam/test_cnapp.py -q
88 passed in 1.16s

Usage and manual verification

Test Encrypter connectivity:

pam cnapp config test-encrypter \
  --url "$ENCRYPTER_URL"

Test Tenable configuration without saving:

pam cnapp config test \
  --network-uid "$NETWORK_UID" \
  --provider tenable \
  --api-endpoint "$API_ENDPOINT" \
  --auth-endpoint "$AUTH_ENDPOINT" \
  --url-base-encrypter "$ENCRYPTER_URL" \
  --api-token-encrypter "$ENCRYPTER_TOKEN" \
  --client-id="" \
  --client-secret=""

Save Tenable configuration:

pam cnapp config set \
  --network-uid "$NETWORK_UID" \
  --provider tenable \
  --api-endpoint "$API_ENDPOINT" \
  --auth-endpoint "$AUTH_ENDPOINT" \
  --url-base-encrypter "$ENCRYPTER_URL" \
  --api-token-encrypter "$ENCRYPTER_TOKEN" \
  --config-record "$CONFIG_RECORD_UID" \
  --client-id="" \
  --client-secret=""

Read configuration as a table:

pam cnapp config read \
  --network-uid "$NETWORK_UID" \
  --provider tenable \
  --format table

Read configuration as JSON:

pam cnapp config read \
  --network-uid "$NETWORK_UID" \
  --provider tenable \
  --format json

The JSON output should contain apiTokenEncrypterSet: true, never the token itself.

List all queue items with automatic provider detection and decryption:

pam cnapp queue list \
  --network-uid "$NETWORK_UID" \
  --format table

List Tenable items using an explicit configuration lookup:

pam cnapp queue list \
  --network-uid "$NETWORK_UID" \
  --provider tenable \
  --format table

List pending items as JSON:

pam cnapp queue list \
  --network-uid "$NETWORK_UID" \
  --status pending \
  --format json

List using an explicit Encrypter record:

pam cnapp queue list \
  --network-uid "$NETWORK_UID" \
  --config-record "$CONFIG_RECORD_UID" \
  --format table

List without attempting payload decryption:

pam cnapp queue list \
  --network-uid "$NETWORK_UID" \
  --no-decrypt \
  --format table

For the following commands, obtain the IDs from queue list:

QUEUE_ID="REPLACE_WITH_QUEUE_ID"
RECORD_UID="REPLACE_WITH_VAULT_RECORD_UID"

Associate a vault record:

pam cnapp queue associate \
  --queue-id "$QUEUE_ID" \
  --record-uid "$RECORD_UID"

Dispatch credential rotation:

pam cnapp queue remediate \
  --queue-id "$QUEUE_ID" \
  --action rotate_credentials \
  --provider tenable \
  --config-record "$CONFIG_RECORD_UID"

Update queue status:

pam cnapp queue set-status \
  --queue-id "$QUEUE_ID" \
  --status resolved \
  --reason "Resolved during Tenable integration testing"

Delete a queue item:

pam cnapp queue delete \
  --queue-id "$QUEUE_ID"

Delete the saved CNAPP configuration last:

pam cnapp config delete \
  --network-uid "$NETWORK_UID"