opal-security 3.1.1-beta.8a533e4 → 3.1.1-beta.981ec0b

package/lib/lib/requests.d.ts

@@ -1,24 +1,29 @@
 import type { NormalizedCacheObject } from "@apollo/client/core";
 import type { ApolloClient } from "@apollo/client/core/ApolloClient";
 import type { Command } from "@oclif/core/lib/command";
-interface AppNode {
+import { type AppType, type ConnectionType, EntityType } from "../graphql/graphql";
+type AppNode = {
+    appId: string;
     appName: string;
+    appType?: AppType | ConnectionType;
     assets: Record<string, AssetNode>;
-}
-interface AssetNode {
+};
+type AssetNode = {
+    assetId: string;
     assetName: string;
-    type: string;
+    type: EntityType;
     roles?: Record<string, RoleNode>;
-}
-interface RoleNode {
+};
+type RoleNode = {
+    roleId: string;
     roleName: string;
-}
+};
 export type RequestMap = Record<string, AppNode>;
-interface DurationOption {
+type DurationOption = {
     durationInMinutes: number;
     label: string;
-}
-interface RequestDefaults {
+};
+type RequestDefaults = {
     durationOptions?: DurationOption[];
     recommendedDurationInMinutes?: number | null;
     defaultDurationInMinutes?: number;
@@ -26,21 +31,22 @@ interface RequestDefaults {
     requireSupportTicket?: boolean;
     reasonOptional?: boolean;
     requesterIsAdmin?: boolean;
-}
-export interface RequestMetadata {
+};
+export type RequestMetadata = {
     requestMap: RequestMap;
     requestDefaults: RequestDefaults;
     durationLabel: string;
     durationInMinutes?: number;
     reason: string;
-}
+};
 export declare function initEmptyRequestMetadata(): RequestMetadata;
 export declare function selectRequestableItems(cmd: Command, client: ApolloClient<NormalizedCacheObject>, requestMap: RequestMap): Promise<void>;
-export declare function chooseAssets(cmd: Command, client: ApolloClient<NormalizedCacheObject>, appId: string, requestMap: RequestMap): Promise<void>;
-export declare function chooseRoles(cmd: Command, client: ApolloClient<NormalizedCacheObject>, appId: string, assetId: string, requestMap: RequestMap): Promise<void>;
 export declare function doneSelectingAssets(): Promise<boolean>;
 export declare function setRequestDefaults(cmd: Command, client: ApolloClient<NormalizedCacheObject>, metadata: RequestMetadata): Promise<void>;
 export declare function promptForReason(metadata: RequestMetadata): Promise<void>;
 export declare function promptForExpiration(metadata: RequestMetadata): Promise<void>;
+export declare function promptRequestSubmission(cmd: Command, metadata: RequestMetadata): Promise<void>;
 export declare function submitFinalRequest(cmd: Command, client: ApolloClient<NormalizedCacheObject>, metadata: RequestMetadata): Promise<void>;
+export declare function bypassRequestSelection(cmd: Command, client: ApolloClient<NormalizedCacheObject>, flagValue: string[], metadata: RequestMetadata): Promise<void>;
+export declare function bypassDuration(cmd: Command, duration: number, metadata: RequestMetadata): void;
 export {};

package/lib/lib/requests.js

@@ -2,19 +2,31 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.initEmptyRequestMetadata = initEmptyRequestMetadata;
 exports.selectRequestableItems = selectRequestableItems;
-exports.chooseAssets = chooseAssets;
-exports.chooseRoles = chooseRoles;
 exports.doneSelectingAssets = doneSelectingAssets;
 exports.setRequestDefaults = setRequestDefaults;
 exports.promptForReason = promptForReason;
 exports.promptForExpiration = promptForExpiration;
+exports.promptRequestSubmission = promptRequestSubmission;
 exports.submitFinalRequest = submitFinalRequest;
+exports.bypassRequestSelection = bypassRequestSelection;
+exports.bypassDuration = bypassDuration;
 const chalk_1 = require("chalk");
 const inquirer = require("inquirer");
 const graphql_1 = require("../graphql");
+const graphql_2 = require("../graphql/graphql");
 const displays_1 = require("../utils/displays");
 const config_1 = require("./config");
 const { AutoComplete, Select, prompt, Form } = require("enquirer");
+function entityTypeFromString(str) {
+    if (str === "Resource") {
+        return graphql_2.EntityType.Resource;
+    }
+    if (str === "Group") {
+        return graphql_2.EntityType.Group;
+    }
+    // if type unknown, default to resource
+    return graphql_2.EntityType.Resource;
+}
 function initEmptyRequestMetadata() {
     // Initialize with empty defaults
     const requestDefaults = {
@@ -94,6 +106,7 @@ async function queryRequestableApps(cmd, client, input) {
                 value: {
                     id: edge.node.id,
                     name: edge.node.displayName,
+                    type: type,
                     toString: () => edge.node.displayName,
                 },
             };
@@ -485,39 +498,245 @@ async function createRequest(cmd, client, requestedResources, requestedGroups, r
         }
     }
 }
+const CATALOG_ITEM = (0, graphql_1.graphql)(`
+  query GetCatalogItem($uuid: UUID!) {
+    catalogItem(id: $uuid) {
+      __typename
+      ... on Connection {
+        id
+        displayName
+      }
+      ... on Resource {
+        id
+        displayName
+        connection {
+          id
+          displayName
+        }
+        accessLevels{
+          accessLevelName
+          accessLevelRemoteId
+        }
+      }
+      ...on Group {
+        id
+        name
+        connection {
+          id
+          displayName
+        }
+        accessLevels{
+          accessLevelName
+          accessLevelRemoteId
+        }
+      }
+      ... on UserFacingError {
+        message
+      }
+    }
+  }
+  `);
+const ASSOCIATED_ITEMS_QUERY = (0, graphql_1.graphql)(`
+  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {
+    resource(input: {
+      id: $resourceId
+    }) {
+      __typename
+      ... on ResourceResult {
+        __typename
+        resource {
+          associatedItems(
+            first: 200
+            filters: {
+              searchQuery: {
+                contains: $searchQuery
+              }
+              access: REQUESTABLE
+              endUserVisible: true
+              entityType: {
+                in: [GROUP, RESOURCE]
+              }
+            }
+          ) {
+            edges {
+              __typename
+              ... on ResourceAssociatedItemEdge {
+                alias
+                node {
+                  __typename
+                  id
+                  name
+                  ... on Resource {
+                    accessLevels(
+                    filters: {
+                      skipRemoteAccessLevels: false # azure app roles are remote
+                    }
+                  ) {
+                    __typename
+                    accessLevelName
+                    accessLevelRemoteId
+                  }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+      ... on ResourceNotFoundError {
+        message
+      }
+    }
+  }
+`);
+async function queryAssociatedItems(cmd, client, id, input) {
+    var _a, _b;
+    try {
+        const resp = await client.query({
+            query: ASSOCIATED_ITEMS_QUERY,
+            variables: {
+                resourceId: id || "",
+                searchQuery: input || "",
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+        switch (resp.data.resource.__typename) {
+            case "ResourceResult": {
+                const associatedItems = resp.data.resource.resource.associatedItems.edges.filter((edge) => edge.__typename === "ResourceAssociatedItemEdge");
+                const initial = [];
+                for (const edge of associatedItems) {
+                    initial.push(...appRolesFromEdge(edge));
+                }
+                return initial;
+            }
+            case "ResourceNotFoundError":
+                cmd.log((_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.resource) === null || _b === void 0 ? void 0 : _b.message);
+                break;
+            default:
+                cmd.error(resp.error || "Unknown error occurred.");
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
 // Helper functions
 async function selectRequestableItems(cmd, client, requestMap) {
-    const initialChoices = (await queryRequestableApps(cmd, client, "")) || [];
+    const initial = (await queryRequestableApps(cmd, client, "")) || [];
     const appPrompt = new AutoComplete({
         name: "App",
         message: "Select an app:",
         limit: 15,
-        choices: initialChoices,
+        choices: initial,
         async suggest(input) {
             const filteredChoices = await queryRequestableApps(cmd, client, input || "");
-            return filteredChoices || initialChoices;
+            return filteredChoices || initial;
         },
     });
     const App = await appPrompt.run();
     // Set the app in the requestMap and call choose assets step
     if (!(App.id in requestMap)) {
         requestMap[App.id] = {
+            appId: App.id,
             appName: App.name,
             assets: {},
         };
     }
+    if (App.type === "OKTA_APP" || App.type === "AZURE_ENTERPRISE_APP") {
+        await chooseOktaAzureRoles(cmd, client, App, requestMap);
+        return;
+    }
     await chooseAssets(cmd, client, App.id, requestMap);
 }
+async function chooseOktaAzureRoles(cmd, client, app, requestMap) {
+    const associatedItems = (await queryAssociatedItems(cmd, client, app.id, "")) || [];
+    const rolePrompt = new AutoComplete({
+        name: "Roles",
+        message: `Select a role for ${app.name}:`,
+        limit: 15,
+        multiple: true,
+        async choices(input) {
+            if (!input)
+                return associatedItems;
+            const filteredChoices = await queryAssociatedItems(cmd, client, app.id, input);
+            return filteredChoices || associatedItems;
+        },
+        validate: (answer) => {
+            if (answer.length !== 1) {
+                return "You must select only one item.";
+            }
+            return true;
+        },
+    });
+    const Roles = await rolePrompt.run();
+    const entry = requestMap[app.id];
+    for (const role of Roles) {
+        if (!(role.id in entry.assets)) {
+            entry.assets[role.id] = {
+                assetId: role.id,
+                assetName: role.name,
+                type: entityTypeFromString(role.type),
+                roles: {},
+            };
+        }
+    }
+}
+function appRolesFromEdge(edge) {
+    var _a, _b, _c, _d;
+    switch (edge.node.__typename) {
+        case "Resource": {
+            if (edge.node.accessLevels && edge.node.accessLevels.length > 0) {
+                return edge.node.accessLevels.map((accessLevel) => ({
+                    message: accessLevel.accessLevelName || "No Role (Direct access)",
+                    value: {
+                        id: edge.node.id + accessLevel.accessLevelRemoteId,
+                        name: accessLevel.accessLevelName,
+                        type: graphql_2.EntityType.Resource,
+                        toString: () => accessLevel.accessLevelName,
+                    },
+                }));
+            }
+            return [
+                {
+                    message: (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name,
+                    value: {
+                        id: edge.node.id,
+                        name: (_b = edge.alias) !== null && _b !== void 0 ? _b : edge.node.name,
+                        type: graphql_2.EntityType.Resource,
+                        toString: () => { var _a; return (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name; },
+                    },
+                },
+            ];
+        }
+        case "Group":
+            return [
+                {
+                    message: (_c = edge.alias) !== null && _c !== void 0 ? _c : edge.node.name,
+                    value: {
+                        id: edge.node.id,
+                        name: (_d = edge.alias) !== null && _d !== void 0 ? _d : edge.node.name,
+                        type: graphql_2.EntityType.Group,
+                        toString: () => { var _a; return (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name; },
+                    },
+                },
+            ];
+    }
+}
 async function chooseAssets(cmd, client, appId, requestMap) {
-    const initialChoices = (await queryRequestableAssets(cmd, client, appId, "")) || [];
+    const initial = (await queryRequestableAssets(cmd, client, appId, "")) || [];
     const assetPrompt = new AutoComplete({
         name: "Assets",
         message: "Select one or more assets:",
         limit: 15,
         multiple: true,
         async choices(input) {
+            if (!input) {
+                return initial;
+            }
             const filteredChoices = await queryRequestableAssets(cmd, client, appId, input);
-            return filteredChoices || initialChoices;
+            return filteredChoices || initial;
         },
         validate: (answer) => {
             if (answer.length < 1) {
@@ -534,6 +753,7 @@ async function chooseAssets(cmd, client, appId, requestMap) {
         }
         if (!(asset.id in entry.assets)) {
             entry.assets[asset.id] = {
+                assetId: asset.id,
                 assetName: asset.name,
                 type: asset.type,
                 roles: {},
@@ -574,6 +794,7 @@ async function chooseRoles(cmd, client, appId, assetId, requestMap) {
     }
     for (const role of roles) {
         assetEntry.roles[role.id] = {
+            roleId: role.id,
             roleName: role.name,
         };
     }
@@ -602,14 +823,14 @@ async function setRequestDefaults(cmd, client, metadata) {
                 const roleIds = mappedRoles.length ? mappedRoles : [""];
                 for (const roleId of roleIds) {
                     switch (assetNode.type) {
-                        case "Resource": {
+                        case graphql_2.EntityType.Resource: {
                             requestedResources.push({
                                 resourceId: assetId,
                                 accessLevelRemoteId: roleId,
                             });
                             break;
                         }
-                        case "Group": {
+                        case graphql_2.EntityType.Group: {
                             requestedGroups.push({
                                 groupId: assetId,
                                 accessLevelRemoteId: roleId,
@@ -746,7 +967,7 @@ async function setCustomDuration(metadata) {
             var _a, _b, _c;
             const { d, h, m } = getDurationNumbers(answer);
             const durationInMinutes = getDurationInMinutes(answer);
-            if (d < 0 || h < 0 || m < 0 || d + h + m > 0 || (h > 23 && m > 59)) {
+            if (d < 0 || h < 0 || m < 0 || d + h + m === 0 || (h > 23 && m > 59)) {
                 return "Please enter a valid duration.";
             }
             if (((_a = metadata.requestDefaults) === null || _a === void 0 ? void 0 : _a.maxDurationInMinutes) &&
@@ -769,8 +990,8 @@ async function setCustomDuration(metadata) {
         label: durationLabel,
     };
 }
-async function submitFinalRequest(cmd, client, metadata) {
-    var _a, _b, _c, _d;
+async function promptRequestSubmission(cmd, metadata) {
+    (0, displays_1.displayFinalRequestSummary)(cmd, metadata);
     const submitMessage = "✅ Yes, submit request";
     const cancelMessage = "❌ No, cancel request";
     const { submit } = await inquirer.prompt([
@@ -783,55 +1004,6 @@ async function submitFinalRequest(cmd, client, metadata) {
     ]);
     switch (submit) {
         case submitMessage: {
-            // Build requested assets lists for the mutation
-            const requestedResources = [];
-            const requestedGroups = [];
-            for (const appNode of Object.values(metadata.requestMap)) {
-                for (const [assetId, assetNode] of Object.entries(appNode.assets)) {
-                    if (assetNode.roles !== undefined) {
-                        const mappedRoles = Object.entries(assetNode.roles).map(([roleId, _roleNode]) => {
-                            return roleId;
-                        });
-                        const roleIds = mappedRoles.length ? mappedRoles : [""];
-                        for (const roleId of roleIds) {
-                            switch (assetNode.type) {
-                                case "Resource": {
-                                    requestedResources.push({
-                                        resourceId: assetId,
-                                        accessLevel: {
-                                            accessLevelName: ((_b = (_a = assetNode.roles) === null || _a === void 0 ? void 0 : _a[roleId]) === null || _b === void 0 ? void 0 : _b.roleName) || "",
-                                            accessLevelRemoteId: roleId,
-                                        },
-                                    });
-                                    break;
-                                }
-                                case "Group": {
-                                    requestedGroups.push({
-                                        groupId: assetId,
-                                        accessLevel: {
-                                            accessLevelName: ((_d = (_c = assetNode.roles) === null || _c === void 0 ? void 0 : _c[roleId]) === null || _d === void 0 ? void 0 : _d.roleName) || "",
-                                            accessLevelRemoteId: roleId,
-                                        },
-                                    });
-                                    break;
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-            const resp = await createRequest(cmd, client, requestedResources, requestedGroups, metadata.reason, metadata.durationInMinutes);
-            // Build link to request
-            const configData = (0, config_1.getOrCreateConfigData)(cmd.config.configDir);
-            if (resp === null || resp === void 0 ? void 0 : resp.id) {
-                cmd.log("\n🎉 Your Access Request has been submitted!\n");
-                cmd.log(`${chalk_1.default.bold("ID: ")} ${chalk_1.default.cyan(resp === null || resp === void 0 ? void 0 : resp.id)}`);
-                if (resp === null || resp === void 0 ? void 0 : resp.status) {
-                    cmd.log((0, displays_1.getStyledStatus)(resp === null || resp === void 0 ? void 0 : resp.status));
-                }
-                const requestLink = `${configData[config_1.urlKey]}/requests/sent/${resp === null || resp === void 0 ? void 0 : resp.id}`;
-                cmd.log(`${chalk_1.default.bold("Link:")} ${chalk_1.default.underline(requestLink)}\n`);
-            }
             return;
         }
         case cancelMessage: {
@@ -843,3 +1015,142 @@ async function submitFinalRequest(cmd, client, metadata) {
         }
     }
 }
+async function submitFinalRequest(cmd, client, metadata) {
+    var _a, _b, _c, _d;
+    // Build requested assets lists for the mutation
+    const requestedResources = [];
+    const requestedGroups = [];
+    for (const appNode of Object.values(metadata.requestMap)) {
+        // This extraction is different than the one in setRequestDefaults.
+        // Both extract the requestedResources and requestedGroups,
+        // use different formats.
+        for (const [assetId, assetNode] of Object.entries(appNode.assets)) {
+            if (assetNode.roles) {
+                const mappedRoles = Object.entries(assetNode.roles).map(([roleId, _roleNode]) => {
+                    return roleId;
+                });
+                const roleIds = mappedRoles.length > 0 ? mappedRoles : [""];
+                for (const roleId of roleIds) {
+                    switch (assetNode.type) {
+                        case graphql_2.EntityType.Resource: {
+                            requestedResources.push({
+                                resourceId: assetId,
+                                accessLevel: {
+                                    accessLevelName: ((_b = (_a = assetNode.roles) === null || _a === void 0 ? void 0 : _a[roleId]) === null || _b === void 0 ? void 0 : _b.roleName) || "",
+                                    accessLevelRemoteId: roleId,
+                                },
+                            });
+                            break;
+                        }
+                        case graphql_2.EntityType.Group: {
+                            requestedGroups.push({
+                                groupId: assetId,
+                                accessLevel: {
+                                    accessLevelName: ((_d = (_c = assetNode.roles) === null || _c === void 0 ? void 0 : _c[roleId]) === null || _d === void 0 ? void 0 : _d.roleName) || "",
+                                    accessLevelRemoteId: roleId,
+                                },
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    const resp = await createRequest(cmd, client, requestedResources, requestedGroups, metadata.reason, metadata.durationInMinutes);
+    // Build link to request
+    const configData = (0, config_1.getOrCreateConfigData)(cmd.config.configDir);
+    if (resp === null || resp === void 0 ? void 0 : resp.id) {
+        cmd.log("\n🎉 Your Access Request has been submitted!\n");
+        cmd.log(`${chalk_1.default.bold("ID: ")} ${chalk_1.default.cyan(resp === null || resp === void 0 ? void 0 : resp.id)}`);
+        if (resp === null || resp === void 0 ? void 0 : resp.status) {
+            cmd.log((0, displays_1.getStyledStatus)(resp === null || resp === void 0 ? void 0 : resp.status));
+        }
+        const requestLink = `${configData[config_1.urlKey]}/requests/sent/${resp === null || resp === void 0 ? void 0 : resp.id}`;
+        cmd.log(`${chalk_1.default.bold("Link:")} ${chalk_1.default.underline(requestLink)}\n`);
+    }
+    return;
+}
+async function bypassRequestSelection(cmd, client, flagValue, metadata) {
+    var _a, _b;
+    try {
+        // Query Catalog Item endpoint to identify what the id belongs to (resource or group)
+        for (const id of flagValue) {
+            const resp = await client.query({
+                query: CATALOG_ITEM,
+                variables: {
+                    uuid: id || "",
+                },
+                fetchPolicy: "network-only", // to avoid caching
+            });
+            switch (resp.data.catalogItem.__typename) {
+                case "Resource": {
+                    const resourceName = resp.data.catalogItem.displayName;
+                    const roles = (resp.data.catalogItem.accessLevels || [])
+                        // TODO: Support okta azure apps ?.filter((role) => role.accessLevelName !== "") // This assumes length == 1
+                        .map((role) => ({
+                        id: role.accessLevelRemoteId,
+                        name: role.accessLevelName,
+                    }));
+                    if (roles.length > 0 &&
+                        !(roles.length === 1 && roles[0].name === "")) {
+                        cmd.log(`Roles not implemented yet for resource ${resourceName}. Skipping roles selection.`); //TODO: Implement roles support
+                        continue;
+                    }
+                    const appId = ((_a = resp.data.catalogItem.connection) === null || _a === void 0 ? void 0 : _a.id) || "";
+                    if (!(appId in metadata.requestMap)) {
+                        metadata.requestMap[appId] = {
+                            appName: ((_b = resp.data.catalogItem.connection) === null || _b === void 0 ? void 0 : _b.displayName) || "",
+                            appId: appId,
+                            assets: {},
+                        };
+                    }
+                    const assetEntry = metadata.requestMap[appId].assets[id];
+                    if (!assetEntry) {
+                        metadata.requestMap[appId].assets[id] = {
+                            assetId: id,
+                            assetName: resourceName,
+                            type: graphql_2.EntityType.Resource,
+                            roles: {},
+                        };
+                    }
+                    if (roles && !(roles.length === 1 && roles[0].name === "")) {
+                        if (!metadata.requestMap[appId].assets[id].roles) {
+                            metadata.requestMap[appId].assets[id].roles = {};
+                        }
+                        for (const role of roles) {
+                            metadata.requestMap[appId].assets[id].roles[role.id] = {
+                                roleId: role.id,
+                                roleName: role.name,
+                            };
+                        }
+                    }
+                    break;
+                }
+                case "Group": {
+                    //TODO
+                    break;
+                }
+                case "Connection": {
+                    //TODO
+                    break;
+                }
+                default:
+                    cmd.error("Unknown error occurred.");
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+    return;
+}
+function bypassDuration(cmd, duration, metadata) {
+    const maxDuration = metadata.requestDefaults.maxDurationInMinutes;
+    if (maxDuration && duration > maxDuration) {
+        cmd.error(`The requested duration exceeds the allowed limit of ${maxDuration}`);
+    }
+    metadata.durationInMinutes = duration;
+}

package/lib/utils/displays.js

@@ -28,12 +28,17 @@ function treeifyRequestMap(cmd, requestMap) {
     for (const [_appId, appNode] of Object.entries(requestMap)) {
         const assetsTree = {};
         for (const [_assetId, assetNode] of Object.entries(appNode.assets)) {
-            const assetKey = `${assetNode.assetName} ${chalk_1.default.dim(`[${assetNode.type}]`)}`;
+            // If okta/azure asset with no role, change asset name
+            const assetName = assetNode.assetName || "No Role (Direct access)";
+            const assetKey = `${assetName} ${chalk_1.default.dim(`[${assetNode.type}]`)}`;
             if (assetNode.roles !== undefined) {
                 assetsTree[assetKey] = {};
                 for (const [_roleId, roleNode] of Object.entries(assetNode.roles)) {
-                    const roleKey = `${roleNode.roleName} ${chalk_1.default.dim("[Role]")}`;
-                    assetsTree[assetKey][roleKey] = null;
+                    const roleName = roleNode.roleName;
+                    if (roleName !== "") {
+                        const roleKey = `${roleName} ${chalk_1.default.dim("[Role]")}`;
+                        assetsTree[assetKey][roleKey] = null;
+                    }
                 }
             }
             else {