If the username is a UPN, email, netbios\\username, break it apart into user and domain/netbios.

Sync full or partial data down to the client

Create a pamUser record and return its UID. ``distinguished_name`` is required to rotate a directory (LDAP/AD) user - kdnrm modifies

Coerce the named sub-fields of a pamSettings / pamRemoteBrowserSettings entry to dicts, in place. Discovery and the Web Vault may publish ``c

Side-effect for record_management.add_record_to_folder (pb_only path). Appends the record to *captured* and returns a real RecordAdd whose

GET with automatic retry on HTTP 429 (rate limit). Redirects disabled.

Iterate *secrets* (list of dicts with at minimum 'name' and 'tags'), apply all filters, then create Keeper records via batched API ca

Get the Controller UID that has access to the configuration UID Retrieves a keeper.pam_controller record, from given configuration_uid provid

Remove CyberArk system/internal safes from the list. System safes (VaultInternal, PVWAConfig, etc.) don't contain user-managed accounts and s

Find an open port in the range [start_port, end_port]. The default range is from 49,152 to 65,535, which are the "ephemeral ports" or "dynami

Does this vertex have the passed in vertex? :return: True if request vertex belongs to this vertex. False if it doe

Minimal KeeperParams mock — these validator tests must not trigger vault/api lookups, so the configs avoid directory_uid / delivery.share_to.

Try to match a CyberArk user to a Keeper user. Returns the matched Keeper email or None if not found.

Mask sensitive record field values (password, secret, keyPair, private key passphrases, payment/bank data, security answers, ...) in a record-

Sanitize a CyberArk safe name for use as a Keeper folder name. - Strip/replace characters not allowed in folder names - Truncate to MAX_SAFE_

Validate email configuration completeness. Returns: List of validation error messages (empty if valid)

Format elements into a Guacamole instruction.

Generate secure random password using Commander's built-in generator. This is a critical security feature. Commander generates passw

Check if host is a local/private address (no SSL warning needed). Only trusts literal IP addresses and 'localhost'. Does NOT resolve

Return milliseconds. Raises CommandError on invalid/non-positive value. Delegates to WorkflowFormatter.parse_duration; adds a None -> default-

Rollback created records on critical failure. Cleans up partially-created resources when provisioning fails at a critical st

Send Guacamole data back to gateway via Rust. Uses send_handler_data() which routes through the WebRTC channel.

Build the pam project import JSON from mapped records.

Convert bytes to a URL-safe base64 encoded string. Args: b (bytes): The bytes to be encoded. Returns: str: The URL-safe

Resolve an SSO service provider by ID or name from enterprise data.

Format seconds as 'Xm Ys'. Handles negative, inf, nan.

Get a record dict from nested_share_records or record_cache.

Retrieve the unencrypted record key from nested_share_records or record_cache.

GET helper that surfaces connection errors as a graceful warning instead of a stack trace. Returns the ``requests.Response`` on success, or `

Map CyberArk permission booleans to Keeper shared folder permissions. Returns dict with keys: manage_users, manage_records, can_edit, can_sha

Parse a RecordSharing.Status protobuf into a result dict.

Parse timeout input to return instance of timedelta timeout_input(str): String to parse for one or more integer values followed by time unit name

Record a completed batch and adapt parameters if needed. Throttle detection is purely timing-based: if the batch took more than THROT

Return server-assigned rotation revision from cache, syncing when missing (not sequential). NSF rotations may not yet arrive via sync_down into `

Remove any dynamically mounted clickable field widgets

Helper to encode YAML string to base64.

Build a DAG with a mocked connection so we can assert sync wiring. Skips real load — caller invokes _sync_legacy / _sync_per_graph directly.

Create a real vault.TypedField.

Vault state after sync: nested_share_folders keeps the raw parent from the server, while prepare_folder_tree clears it on the folder_cache node fo

Validate that the PVWA host is not targeting internal/private addresses (SSRF protection).

Build structured post-import report matching the spec.

On Terraform Docker only: if Min-Commander-Version is present, require running Commander >= that version. Non-Terraform service mode: no

Connect to the Guacamole server. Args: data: Arbitrary connection data to send during handshake. Raises:

Create default configuration structure.

Log storage operation errors consistently

Raise ``CommandError`` if *folder_uid* is not a Nested Share Folder.

Create a real RestApiContext with QRC disabled to simplify mocking.

Create a minimal ApiRequestPayload for execute_rest.

Parse ``--expire-at`` / ``--expire-in`` into a millisecond timestamp. Returns *None* if neither argument is provided, or ``-1`` for ``'never'``.