opal-security 3.1.0 → 3.1.1-beta.01fe2fd

package/lib/utils/displays.d.ts

@@ -1,5 +1,10 @@
+import type { ApolloQueryResult } from "@apollo/client";
 import type { Command } from "@oclif/core/lib/command";
-import type { RequestMap } from "../lib/requests";
+import type { GetRequestQuery, GetRequestsQuery } from "../graphql/graphql";
+import { type RequestMap, type RequestMetadata } from "../lib/requests";
 export declare function headerMessage(cmd: Command): void;
-export declare function treeifyRequestMap(requestMap: RequestMap): string;
-export declare function displayFinalRequestSummary(cmd: Command, requestMap: RequestMap, reason: string, expiration: string): void;
+export declare function treeifyRequestMap(cmd: Command, requestMap: RequestMap): void;
+export declare function displayFinalRequestSummary(cmd: Command, metadata: RequestMetadata): void;
+export declare function getStyledStatus(status: string): string;
+export declare function displayRequestDetails(cmd: Command, requestResp: ApolloQueryResult<GetRequestQuery>): void;
+export declare function displayRequestListTable(cmd: Command, requestResp: ApolloQueryResult<GetRequestsQuery>): void;

package/lib/utils/displays.js

@@ -3,63 +3,222 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.headerMessage = headerMessage;
 exports.treeifyRequestMap = treeifyRequestMap;
 exports.displayFinalRequestSummary = displayFinalRequestSummary;
-const treeify = require("object-treeify");
+exports.getStyledStatus = getStyledStatus;
+exports.displayRequestDetails = displayRequestDetails;
+exports.displayRequestListTable = displayRequestListTable;
+const chalk_1 = require("chalk");
+const terminal_link_1 = require("terminal-link");
+const requests_1 = require("../lib/requests");
 const Table = require("cli-table3");
-const tableStyle = {
-    top: "═",
-    "top-mid": "╤",
-    "top-left": "╔",
-    "top-right": "╗",
-    bottom: "═",
-    "bottom-mid": "╧",
-    "bottom-left": "╚",
-    "bottom-right": "╝",
-    left: "║",
-    "left-mid": "╟",
-    mid: "─",
-    "mid-mid": "┼",
-    right: "║",
-    "right-mid": "╢",
-    middle: "│",
-};
+const treeify = require("object-treeify").default;
 function headerMessage(cmd) {
     console.clear();
-    cmd.log("============================================================");
+    cmd.log("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
     cmd.log("Opal Access Request ✏️");
     cmd.log("Press Ctrl+C to cancel at any time.\n");
 }
-function treeifyRequestMap(requestMap) {
-    const requestTree = {};
-    // Create a tree structure from the requestMap
-    // Iterate over apps
-    for (const [_appId, appNode] of requestMap.entries()) {
-        const appKey = `🔧${appNode.appName}`;
-        requestTree[appKey] = {}; // Initialize the app key
-        // Iterate over assets
-        for (const [_assetId, assetNode] of appNode.assets.entries()) {
-            const assetKey = `📦${assetNode.assetName}`;
+function treeifyRequestMap(cmd, requestMap) {
+    // Configuration options for treeify
+    const options = {
+        joined: true,
+        spacerNoNeighbour: "    ",
+        spacerNeighbour: "│   ",
+        keyNoNeighbour: "└── ",
+        keyNeighbour: "├── ",
+        separator: "",
+    };
+    for (const [_appId, appNode] of Object.entries(requestMap)) {
+        const assetsTree = {};
+        for (const [_assetId, assetNode] of Object.entries(appNode.assets)) {
+            // If okta/azure asset with no role, change asset name
+            const assetName = assetNode.assetName || "No Role (Direct access)";
+            const assetKey = `${assetName} ${chalk_1.default.dim(`[${requests_1.DISPLAY_LABELS[assetNode.type]}]`)}`;
             if (assetNode.roles !== undefined) {
-                // If no roles were previously selected
-                requestTree[appKey][assetKey] = {}; // Initialize the asset key
-                // Iterate over roles
-                for (const [roleName, _] of assetNode.roles.entries()) {
-                    requestTree[appKey][assetKey][roleName] = null; // Initialize the role key
+                assetsTree[assetKey] = {};
+                for (const [_roleId, roleNode] of Object.entries(assetNode.roles)) {
+                    const roleName = roleNode.roleName;
+                    if (roleName !== "") {
+                        const roleKey = `${roleName} ${chalk_1.default.dim("[Role]")}`;
+                        assetsTree[assetKey][roleKey] = null;
+                    }
                 }
             }
             else {
-                requestTree[appKey][assetKey] = null;
+                assetsTree[assetKey] = null;
             }
         }
+        // Render tree for this app's assets
+        const assetsTreeString = treeify(assetsTree, options);
+        // Print App title first (without tree lines)
+        cmd.log(`${chalk_1.default.bold(appNode.appName)} ${chalk_1.default.dim("[App]")}`);
+        // Print its assets/roles indented underneath
+        cmd.log(assetsTreeString);
     }
-    return String(treeify(requestTree));
+    cmd.log();
 }
-function displayFinalRequestSummary(cmd, requestMap, reason, expiration) {
-    headerMessage(cmd);
-    cmd.log("Final Summary of Request\n");
-    const requestedAssets = treeifyRequestMap(requestMap);
-    const table = new Table({
-        chars: tableStyle,
-    });
-    table.push(["Requested Assets", requestedAssets], ["Reason", reason], ["Expiration", expiration]);
-    cmd.log(table.toString());
+function displayFinalRequestSummary(cmd, metadata) {
+    console.clear();
+    cmd.log("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
+    cmd.log("Final Summary of Request ✏️");
+    cmd.log("Press Ctrl+C to cancel at any time.\n");
+    cmd.log();
+    treeifyRequestMap(cmd, metadata.requestMap);
+    const durationInMinutes = metadata.durationInMinutes;
+    cmd.log(`Duration: ${durationInMinutes ? formatDuration(durationInMinutes) : "Permanent"}`);
+    const reason = metadata.reason;
+    if (reason) {
+        cmd.log(`Reason: "${chalk_1.default.italic(reason)}"`);
+    }
+    cmd.log();
+}
+function getStyledStatus(status) {
+    switch (status) {
+        case "PENDING": {
+            return `${chalk_1.default.bold("Status:")} ${chalk_1.default.blueBright(status)}`;
+        }
+        case "APPROVED": {
+            return `${chalk_1.default.bold("Status:")}  ${chalk_1.default.greenBright(status)}`;
+        }
+        case "DENIED": {
+            return `${chalk_1.default.bold("Status:")}  ${chalk_1.default.redBright(status)}`;
+        }
+        case "CANCELED": {
+            return `${chalk_1.default.bold("Status:")}  ${chalk_1.default.redBright(status)}`;
+        }
+        default: {
+            return `${chalk_1.default.bold("Status:")}  ${chalk_1.default.gray(status)}`;
+        }
+    }
+}
+function displayRequestDetails(cmd, requestResp) {
+    var _a, _b, _c, _d, _e, _f;
+    switch (requestResp.data.request.__typename) {
+        case "RequestResult": {
+            cmd.log("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
+            cmd.log(`Request Details ${chalk_1.default.cyan(requestResp.data.request.request.id)}`);
+            cmd.log("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
+            const status = requestResp.data.request.request.status;
+            cmd.log(getStyledStatus(status));
+            // Request users "Requested by: <requester> -> Requested for: <targetUser>"
+            const requester = (_a = requestResp.data.request.request.requester) === null || _a === void 0 ? void 0 : _a.displayName;
+            const targetUser = (_b = requestResp.data.request.request.targetUser) === null || _b === void 0 ? void 0 : _b.displayName;
+            if (requester && targetUser) {
+                cmd.log(`${chalk_1.default.bold("Requested by:")} ${requester} ${chalk_1.default.gray("->")} ${chalk_1.default.bold("Requested for:")} ${targetUser}`);
+            }
+            const durationInMinutes = requestResp.data.request.request.durationInMinutes;
+            cmd.log(`${chalk_1.default.bold("Duration:")} ${durationInMinutes ? formatDuration(durationInMinutes) : "Permanent"}`);
+            const reason = requestResp.data.request.request.reason;
+            if (reason) {
+                cmd.log(`${chalk_1.default.bold("Reason:")} "${chalk_1.default.italic(reason)}"`);
+            }
+            // Requested resources
+            const requestedResources = (_d = (_c = requestResp.data.request.request.requestedResources) === null || _c === void 0 ? void 0 : _c.map((resource) => {
+                var _a, _b, _c;
+                if (((_a = resource.resource) === null || _a === void 0 ? void 0 : _a.__typename) === "Resource") {
+                    return formatAssetName((_b = resource.resource) === null || _b === void 0 ? void 0 : _b.displayName, ((_c = resource.accessLevel) === null || _c === void 0 ? void 0 : _c.accessLevelName) || "");
+                }
+            })) !== null && _d !== void 0 ? _d : [];
+            const requestedGroups = (_f = (_e = requestResp.data.request.request.requestedGroups) === null || _e === void 0 ? void 0 : _e.map((group) => {
+                var _a, _b, _c;
+                if (((_a = group.group) === null || _a === void 0 ? void 0 : _a.__typename) === "Group") {
+                    return formatAssetName((_b = group.group) === null || _b === void 0 ? void 0 : _b.name, ((_c = group.accessLevel) === null || _c === void 0 ? void 0 : _c.accessLevelName) || "");
+                }
+            })) !== null && _f !== void 0 ? _f : [];
+            const requestedItems = [...requestedResources, ...requestedGroups].join(", ");
+            if (requestedItems) {
+                cmd.log(`${chalk_1.default.bold("Requested Items:")} ${chalk_1.default.cyan(requestedItems)}`);
+            }
+        }
+    }
+}
+function displayRequestListTable(cmd, requestResp) {
+    var _a, _b, _c, _d, _e;
+    switch (requestResp.data.requests.__typename) {
+        case "RequestsResult": {
+            const requests = requestResp.data.requests.requests;
+            if (requests && requests.length > 0) {
+                const table = new Table({
+                    head: [
+                        "Request ID",
+                        "Status",
+                        "For",
+                        "Duration",
+                        "Requested Items",
+                        "Reason",
+                    ],
+                    colWidths: [null, null, 20, null, 30, 20],
+                    wordWrap: true,
+                    wrapOnWordBoundary: false,
+                });
+                for (const request of requests) {
+                    const targetUser = (_a = request.targetUser) === null || _a === void 0 ? void 0 : _a.displayName;
+                    const reason = request.reason;
+                    const status = request.status;
+                    const formattedDuration = request.durationInMinutes
+                        ? formatDuration(request.durationInMinutes)
+                        : "Permanent";
+                    const requestedResources = (_c = (_b = request.requestedResources) === null || _b === void 0 ? void 0 : _b.map((resource) => {
+                        var _a, _b, _c;
+                        if (((_a = resource.resource) === null || _a === void 0 ? void 0 : _a.__typename) === "Resource") {
+                            return formatAssetName((_b = resource.resource) === null || _b === void 0 ? void 0 : _b.displayName, ((_c = resource.accessLevel) === null || _c === void 0 ? void 0 : _c.accessLevelName) || "");
+                        }
+                    })) !== null && _c !== void 0 ? _c : [];
+                    const requestedGroups = (_e = (_d = request.requestedGroups) === null || _d === void 0 ? void 0 : _d.map((group) => {
+                        var _a, _b, _c;
+                        if (((_a = group.group) === null || _a === void 0 ? void 0 : _a.__typename) === "Group") {
+                            return formatAssetName((_b = group.group) === null || _b === void 0 ? void 0 : _b.name, ((_c = group.accessLevel) === null || _c === void 0 ? void 0 : _c.accessLevelName) || "");
+                        }
+                    })) !== null && _e !== void 0 ? _e : [];
+                    const requestedItems = [
+                        ...requestedResources,
+                        ...requestedGroups,
+                    ].join(", ");
+                    const requestLink = (0, requests_1.getRequestLink)(cmd, request.id);
+                    const clickableId = (0, terminal_link_1.default)(request.id, requestLink, {
+                        fallback: false,
+                    });
+                    table.push([
+                        clickableId,
+                        status,
+                        targetUser,
+                        formattedDuration,
+                        requestedItems,
+                        reason,
+                    ]);
+                }
+                cmd.log(table.toString());
+            }
+            else {
+                cmd.log("No requests found.");
+            }
+            return;
+        }
+        default: {
+            cmd.log("No requests found.");
+        }
+    }
+}
+function formatDuration(durationInMinutes) {
+    const days = Math.floor(durationInMinutes / 1440);
+    const remainingMinutes = durationInMinutes % 1440;
+    const hours = Math.floor(remainingMinutes / 60);
+    const minutes = remainingMinutes % 60;
+    let durationStr = "";
+    if (days > 0)
+        durationStr += `${days}d`;
+    if (hours > 0)
+        durationStr += `${hours}h`;
+    if (minutes > 0)
+        durationStr += `${minutes}m`;
+    if (durationStr === "")
+        durationStr = `${durationInMinutes}m`;
+    durationStr += ` (${durationInMinutes}m)`;
+    return durationStr;
+}
+function formatAssetName(assetName, roleName) {
+    let str = `${assetName}`;
+    if (roleName) {
+        str += ` (${roleName})`;
+    }
+    return str;
 }

package/oclif.manifest.json

@@ -316,6 +316,34 @@
         "set-url.js"
       ]
     },
+    "whoami": {
+      "aliases": [],
+      "args": {},
+      "description": "Describes current url set, organization name, and logged in user if applicable.",
+      "flags": {
+        "help": {
+          "char": "h",
+          "description": "Show CLI help.",
+          "name": "help",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "whoami",
+      "pluginAlias": "opal-security",
+      "pluginName": "opal-security",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "lib",
+        "commands",
+        "whoami.js"
+      ]
+    },
     "aws:identity": {
       "aliases": [],
       "args": {},
@@ -365,7 +393,7 @@
         },
         "id": {
           "char": "i",
-          "description": "The Opal ID of the resource. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
           "name": "id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -407,7 +435,7 @@
         },
         "id": {
           "char": "i",
-          "description": "The Opal ID of the resource. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
           "name": "id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -471,7 +499,7 @@
         },
         "id": {
           "char": "i",
-          "description": "The Opal ID of the resource. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
           "name": "id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -537,7 +565,7 @@
         },
         "id": {
           "char": "i",
-          "description": "The Opal ID of the resource. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
           "name": "id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -597,10 +625,41 @@
     "request:create": {
       "aliases": [],
       "args": {},
-      "description": "Opens an Opal access request",
-      "flags": {},
+      "description": "Creates an Opal access request via an interactive form",
+      "flags": {
+        "help": {
+          "char": "h",
+          "description": "Show CLI help.",
+          "name": "help",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "assets": {
+          "char": "a",
+          "description": "The ids of the assets (resource, group) to request access to. Append a role ID using a colon if needed, e.g. `--assets 123:456`.        \n If not provided, an interactive selection flow will be available to select assets to request.",
+          "name": "assets",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "reason": {
+          "char": "r",
+          "description": "The reason for the request, contained in quotes. If not provided, you will be prompted.",
+          "name": "reason",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "duration": {
+          "char": "d",
+          "description": "The duration of access for the request in minutes. If not provided, you will be prompted.",
+          "name": "duration",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
       "hasDynamicHelp": false,
-      "hidden": true,
       "hiddenAliases": [],
       "id": "request:create",
       "pluginAlias": "opal-security",
@@ -620,9 +679,35 @@
       "aliases": [],
       "args": {},
       "description": "Lists access requests",
-      "flags": {},
+      "examples": [
+        "opal request get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4",
+        "opal request get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4 --verbose"
+      ],
+      "flags": {
+        "help": {
+          "char": "h",
+          "description": "Show CLI help.",
+          "name": "help",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "id": {
+          "char": "i",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "name": "id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Enable verbose output, prints full response in JSON format. Defaults to false.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
       "hasDynamicHelp": false,
-      "hidden": true,
       "hiddenAliases": [],
       "id": "request:get",
       "pluginAlias": "opal-security",
@@ -643,10 +728,46 @@
         "request:ls"
       ],
       "args": {},
-      "description": "Lists access requests",
-      "flags": {},
+      "description": "Lists your n recent outgoing access requests",
+      "examples": [
+        "opal request list --n 5",
+        "opal request list --n 5 --pending",
+        "opal request list --n 5 --verbose",
+        "opal request list --n 5 --pending --verbose"
+      ],
+      "flags": {
+        "help": {
+          "char": "h",
+          "description": "Show CLI help.",
+          "name": "help",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "n": {
+          "char": "n",
+          "description": "Defines number of requests to be returned. 1 <= n <= 100.",
+          "name": "n",
+          "default": 10,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "pending": {
+          "char": "p",
+          "description": "Show only pending requests. Defaults to false.",
+          "name": "pending",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Enable verbose output, prints full response in JSON format. Defaults to false.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
       "hasDynamicHelp": false,
-      "hidden": true,
       "hiddenAliases": [],
       "id": "request:list",
       "pluginAlias": "opal-security",
@@ -679,7 +800,7 @@
         },
         "id": {
           "char": "i",
-          "description": "The Opal ID of the resource. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
           "name": "id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -746,7 +867,7 @@
         },
         "id": {
           "char": "i",
-          "description": "The Opal ID of the resource. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
           "name": "id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -821,7 +942,7 @@
         },
         "id": {
           "char": "i",
-          "description": "The Opal ID of the resource. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
           "name": "id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -870,7 +991,7 @@
         },
         "id": {
           "char": "i",
-          "description": "The Opal ID of the resource. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
+          "description": "The Opal ID of the asset. You can find this from the URL, e.g. https://opal.dev/resources/[ID]",
           "name": "id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -909,5 +1030,5 @@
       ]
     }
   },
-  "version": "3.1.0"
+  "version": "3.1.1-beta.01fe2fd"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opal-security",
   "description": "Opal allows you to centrally manage access to all of your sensitive systems.",
-  "version": "3.1.0",
+  "version": "3.1.1-beta.01fe2fd",
   "author": "Stephen Cobbe",
   "bin": {
     "opal": "./bin/run"
@@ -16,6 +16,7 @@
     "argon2": "^0.40.1",
     "chalk": "^2.4.2",
     "cli-table3": "^0.6.5",
+    "enquirer": "^2.4.1",
     "graphql": "^15.5.0",
     "inquirer": "^8.2.6",
     "inquirer-autocomplete-prompt": "^2.0.1",
@@ -23,10 +24,12 @@
     "lodash": "^4.17.21",
     "moment": "^2.30.1",
     "node-fetch": "^2.6.7",
+    "object-treeify": "^5.0.1",
     "open": "^8.0.4",
     "openid-client": "^5.6.5",
     "prettyjson": "^1.2.1",
     "semver": "^7.5.4",
+    "terminal-link": "^4.0.0",
     "tslib": "^2.8.1"
   },
   "devDependencies": {
@@ -39,6 +42,7 @@
     "@types/lodash": "^4.14.169",
     "@types/node": "^22.14.0",
     "@types/prettyjson": "0.0.29",
+    "@types/react": "^19.1.4",
     "@types/semver": "^7.3.8",
     "better-npm-audit": "^3.7.3",
     "get-graphql-schema": "^2.1.2",
@@ -60,9 +64,7 @@
     "/scripts"
   ],
   "homepage": "https://github.com/opalsecurity/opal-cli/",
-  "keywords": [
-    "oclif"
-  ],
+  "keywords": ["oclif"],
   "license": "MIT",
   "main": "lib/index.js",
   "oclif": {
@@ -88,7 +90,7 @@
     "prepack": "npm run build && oclif manifest && oclif readme",
     "test": "vitest",
     "coverage": "vitest run --coverage",
-    "version": "oclif readme && git add README.md",
+    "version": "oclif readme && git add README.md && biome check --write",
     "posttest": "biome check",
     "biome-ci": "biome ci --reporter=github",
     "gql-codegen": "graphql-codegen",