opal-security 3.1.1-beta.e5e99da → 3.1.1-beta.f2bce00

package/lib/lib/requests.d.ts

@@ -7,6 +7,7 @@ interface AppNode {
 }
 interface AssetNode {
     assetName: string;
+    type: string;
     roles?: Record<string, RoleNode>;
 }
 interface RoleNode {

package/lib/lib/requests.js

@@ -11,7 +11,7 @@ exports.promptForExpiration = promptForExpiration;
 exports.submitFinalRequest = submitFinalRequest;
 const inquirer = require("inquirer");
 const graphql_1 = require("../graphql");
-inquirer.registerPrompt("autocomplete", require("inquirer-autocomplete-prompt"));
+const { AutoComplete, Select, prompt, Form } = require("enquirer");
 function createEmptyRequestMetadata() {
     // Initialize with empty defaults
     const requestDefaults = {
@@ -73,18 +73,23 @@ async function queryRequestableApps(cmd, client, input) {
         });
         return (_b = (_a = resp === null || resp === void 0 ? void 0 : resp.data) === null || _a === void 0 ? void 0 : _a.appsV2) === null || _b === void 0 ? void 0 : _b.edges.map((edge) => {
             let type = undefined;
-            if (edge.node.__typename === "Resource") {
-                type = edge.node.resourceType;
-            }
-            if (edge.node.__typename === "Connection") {
-                type = edge.node.connectionType;
+            switch (edge.node.__typename) {
+                case "Resource":
+                    type = edge.node.resourceType;
+                    break;
+                case "Connection":
+                    type = edge.node.connectionType;
+                    break;
+                default:
+                    type = edge.node.__typename;
             }
             const label = `${edge.node.displayName} (${type})`;
             return {
-                name: label,
+                message: label,
                 value: {
                     id: edge.node.id,
                     name: label,
+                    toString: () => label,
                 },
             };
         });
@@ -147,16 +152,17 @@ async function queryRequestableAssets(cmd, client, appId, input) {
         switch (resp.data.app.__typename) {
             case "App":
                 return (_d = (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.app) === null || _b === void 0 ? void 0 : _b.items) === null || _c === void 0 ? void 0 : _c.items) === null || _d === void 0 ? void 0 : _d.map((item) => {
-                    var _a, _b, _c, _d, _e, _f;
+                    var _a, _b, _c, _d, _e, _f, _g, _h;
                     const name = ((_a = item.resource) === null || _a === void 0 ? void 0 : _a.name) || ((_b = item.group) === null || _b === void 0 ? void 0 : _b.name);
                     const id = ((_c = item.resource) === null || _c === void 0 ? void 0 : _c.id) || ((_d = item.group) === null || _d === void 0 ? void 0 : _d.id);
                     const type = ((_e = item.resource) === null || _e === void 0 ? void 0 : _e.__typename) || ((_f = item.group) === null || _f === void 0 ? void 0 : _f.__typename);
                     const label = `${name} (${type})`;
                     return {
-                        name: label,
+                        message: label,
                         value: {
-                            name: label,
-                            id: id,
+                            name: label || "",
+                            id: id || "",
+                            type: ((_g = item.resource) === null || _g === void 0 ? void 0 : _g.__typename) || ((_h = item.group) === null || _h === void 0 ? void 0 : _h.__typename) || "",
                         },
                     };
                 });
@@ -182,7 +188,6 @@ const RESOURCE_ROLES_QUERY = (0, graphql_1.graphql)(`
       __typename
       ... on ResourceAccessLevelsResult {
         accessLevels {
-          __typename
           ... on ResourceAccessLevel {
             accessLevelName
             accessLevelRemoteId
@@ -195,34 +200,82 @@ const RESOURCE_ROLES_QUERY = (0, graphql_1.graphql)(`
     }
   }
 `);
-async function queryResourceRoles(cmd, client, resourceId) {
-    var _a, _b, _c, _d, _e;
+const GROUP_ROLES_QUERY = (0, graphql_1.graphql)(`
+query GroupAccessLevels($groupId: GroupId!) {
+  groupAccessLevels(
+    input: { groupId: $groupId }
+  ) {
+    ... on GroupAccessLevelsResult {
+      groupId
+      accessLevels {
+        ... on GroupAccessLevel {
+            accessLevelName
+            accessLevelRemoteId
+          }
+      }
+    }
+  }
+}
+`);
+async function queryAssetRoles(cmd, client, assetType, assetId) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     try {
-        const resp = await client.query({
-            query: RESOURCE_ROLES_QUERY,
-            variables: {
-                resourceId: resourceId,
-            },
-            fetchPolicy: "network-only", // to avoid caching
-        });
-        // no fall through doesn't consider process.exit();
-        let x;
-        switch (resp.data.accessLevels.__typename) {
-            case "ResourceAccessLevelsResult":
-                return (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.accessLevels) === null || _b === void 0 ? void 0 : _b.accessLevels) === null || _c === void 0 ? void 0 : _c.map((role) => {
-                    return {
-                        name: role.accessLevelName,
-                        value: {
-                            name: role.accessLevelName,
-                            id: role.accessLevelRemoteId,
-                        },
-                    };
+        switch (assetType) {
+            case "Resource": {
+                const resp = await client.query({
+                    query: RESOURCE_ROLES_QUERY,
+                    variables: {
+                        resourceId: assetId,
+                    },
+                    fetchPolicy: "network-only", // to avoid caching
                 });
-            case "ResourceNotFoundError":
-                x = cmd.error((_e = (_d = resp.data) === null || _d === void 0 ? void 0 : _d.accessLevels) === null || _e === void 0 ? void 0 : _e.message);
-                break;
-            default:
-                cmd.error(resp.error || "Unknown error occurred.");
+                // no fall through doesn't consider process.exit();
+                let x;
+                switch (resp.data.accessLevels.__typename) {
+                    case "ResourceAccessLevelsResult":
+                        return (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.accessLevels) === null || _b === void 0 ? void 0 : _b.accessLevels) === null || _c === void 0 ? void 0 : _c.map((role) => {
+                            return {
+                                message: role.accessLevelName || "",
+                                value: {
+                                    name: role.accessLevelName || "",
+                                    id: role.accessLevelRemoteId || "",
+                                },
+                            };
+                        });
+                    case "ResourceNotFoundError":
+                        x = cmd.error((_e = (_d = resp.data) === null || _d === void 0 ? void 0 : _d.accessLevels) === null || _e === void 0 ? void 0 : _e.message);
+                        break;
+                    default:
+                        cmd.error(resp.error || "Unknown error occurred.");
+                }
+                return;
+            }
+            case "Group": {
+                const resp = await client.query({
+                    query: GROUP_ROLES_QUERY,
+                    variables: {
+                        groupId: assetId,
+                    },
+                    fetchPolicy: "network-only", // to avoid caching
+                });
+                // no fall through doesn't consider process.exit();
+                let x;
+                switch (resp.data.groupAccessLevels.__typename) {
+                    case "GroupAccessLevelsResult":
+                        return (_h = (_g = (_f = resp.data) === null || _f === void 0 ? void 0 : _f.groupAccessLevels) === null || _g === void 0 ? void 0 : _g.accessLevels) === null || _h === void 0 ? void 0 : _h.map((role) => {
+                            return {
+                                message: role.accessLevelName,
+                                value: {
+                                    name: role.accessLevelName,
+                                    id: role.accessLevelRemoteId,
+                                },
+                            };
+                        });
+                    default:
+                        x = cmd.error(resp.error || "Unknown error occurred.");
+                }
+                return;
+            }
         }
     }
     catch (error) {
@@ -241,16 +294,18 @@ const REQUEST_DEFAULTS_QUERY = (0, graphql_1.graphql)(`
       requestedGroups: $requestedGroups,
       }
     ) {
-      durationOptions {
-        durationInMinutes
-        label
+      ... on RequestDefaults {
+        durationOptions {
+          durationInMinutes
+          label
+        }
+        recommendedDurationInMinutes
+        defaultDurationInMinutes
+        maxDurationInMinutes
+        requireSupportTicket
+        reasonOptional
+        requesterIsAdmin
       }
-      recommendedDurationInMinutes
-      defaultDurationInMinutes
-      maxDurationInMinutes
-      requireSupportTicket
-      reasonOptional
-      requesterIsAdmin
     }
   }`);
 async function queryRequestDefaults(cmd, client, requestedResources, requestedGroups) {
@@ -271,20 +326,176 @@ async function queryRequestDefaults(cmd, client, requestedResources, requestedGr
         }
     }
 }
+const CREATE_REQUEST_MUTATION = (0, graphql_1.graphql)(`
+  mutation CreateRequest(
+    $requestedResources: [RequestedResourceInput!]!
+    $requestedGroups: [RequestedGroupInput!]!
+    $reason: String!
+    $durationInMinutes: Int
+  ) {
+    createRequest(
+      input: {
+        requestedResources: $requestedResources
+        requestedGroups: $requestedGroups
+        reason: $reason
+        durationInMinutes: $durationInMinutes
+      }
+    ) {
+      ... on CreateRequestResult {
+        request {
+          id
+          status
+        }
+      }
+      ... on RequestDurationTooLargeError {
+        message
+      }
+      ... on RequestRequiresUserAuthTokenForConnectionError {
+        message
+      }
+      ... on NoReviewersSetForOwnerError {
+        message
+        ownerId
+      }
+      ... on NoReviewersSetForResourceError {
+        message
+        resourceId
+      }
+      ... on NoReviewersSetForGroupError {
+        message
+        groupId
+      }
+      ... on NoManagerSetForRequestingUserError {
+        message
+      }
+      ... on MfaInvalidError {
+        message
+      }
+      ... on BulkRequestTooLargeError {
+        message
+      }
+      ... on ItemCannotBeRequestedError {
+        message
+      }
+      ... on UserCannotRequestAccessForTargetGroupError {
+        message
+        groupId
+        userId
+      }
+      ... on GroupNestingNotAllowedError {
+        message
+        fromGroupId
+        toGroupId
+      }
+      ... on TargetUserHasNestedAccessError {
+        message
+        groupIds
+      }
+      ... on RequestReasonMissingError {
+        message
+      }
+      ... on RequestFieldValueMissingError {
+        message
+        fieldName
+      }
+      ... on LinkedGroupNotRequestableError {
+        message
+        sourceGroupId
+        groupBindingId
+      }
+      ... on RequestReasonBelowMinLengthError {
+        message
+      }
+
+    }
+  }
+`);
+async function createRequest(cmd, client, requestedResources, requestedGroups, reason, durationInMinutes) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t;
+    try {
+        const resp = await client.mutate({
+            mutation: CREATE_REQUEST_MUTATION,
+            variables: {
+                requestedResources: requestedResources,
+                requestedGroups: requestedGroups,
+                reason: reason,
+                durationInMinutes: durationInMinutes,
+            },
+        });
+        let x;
+        switch ((_a = resp.data) === null || _a === void 0 ? void 0 : _a.createRequest.__typename) {
+            case "CreateRequestResult":
+                return (_b = resp.data) === null || _b === void 0 ? void 0 : _b.createRequest.request;
+            case "RequestDurationTooLargeError":
+                x = cmd.error((_c = resp.data) === null || _c === void 0 ? void 0 : _c.createRequest.message);
+                break;
+            case "RequestRequiresUserAuthTokenForConnectionError":
+                x = cmd.error((_d = resp.data) === null || _d === void 0 ? void 0 : _d.createRequest.message);
+                break;
+            case "NoReviewersSetForOwnerError":
+                x = cmd.error((_e = resp.data) === null || _e === void 0 ? void 0 : _e.createRequest.message);
+                break;
+            case "NoReviewersSetForResourceError":
+                x = cmd.error((_f = resp.data) === null || _f === void 0 ? void 0 : _f.createRequest.message);
+                break;
+            case "NoReviewersSetForGroupError":
+                x = cmd.error((_g = resp.data) === null || _g === void 0 ? void 0 : _g.createRequest.message);
+                break;
+            case "NoManagerSetForRequestingUserError":
+                x = cmd.error((_h = resp.data) === null || _h === void 0 ? void 0 : _h.createRequest.message);
+                break;
+            case "MfaInvalidError":
+                x = cmd.error((_j = resp.data) === null || _j === void 0 ? void 0 : _j.createRequest.message);
+                break;
+            case "BulkRequestTooLargeError":
+                x = cmd.error((_k = resp.data) === null || _k === void 0 ? void 0 : _k.createRequest.message);
+                break;
+            case "ItemCannotBeRequestedError":
+                x = cmd.error((_l = resp.data) === null || _l === void 0 ? void 0 : _l.createRequest.message);
+                break;
+            case "UserCannotRequestAccessForTargetGroupError":
+                x = cmd.error((_m = resp.data) === null || _m === void 0 ? void 0 : _m.createRequest.message);
+                break;
+            case "GroupNestingNotAllowedError":
+                x = cmd.error((_o = resp.data) === null || _o === void 0 ? void 0 : _o.createRequest.message);
+                break;
+            case "TargetUserHasNestedAccessError":
+                x = cmd.error((_p = resp.data) === null || _p === void 0 ? void 0 : _p.createRequest.message);
+                break;
+            case "RequestReasonMissingError":
+                x = cmd.error((_q = resp.data) === null || _q === void 0 ? void 0 : _q.createRequest.message);
+                break;
+            case "RequestFieldValueMissingError":
+                x = cmd.error((_r = resp.data) === null || _r === void 0 ? void 0 : _r.createRequest.message);
+                break;
+            case "LinkedGroupNotRequestableError":
+                x = cmd.error((_s = resp.data) === null || _s === void 0 ? void 0 : _s.createRequest.message);
+                break;
+            case "RequestReasonBelowMinLengthError":
+                x = cmd.error((_t = resp.data) === null || _t === void 0 ? void 0 : _t.createRequest.message);
+                break;
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
 // Helper functions
 async function selectRequestableItems(cmd, client, requestMap) {
-    const { App } = await inquirer.prompt([
-        {
-            name: "App",
-            message: "Select an app:",
-            type: "autocomplete",
-            source: async (answers, input) => {
-                var _a;
-                return (_a = (await queryRequestableApps(cmd, client, input))) !== null && _a !== void 0 ? _a : [];
-            },
-            pageSize: 15,
+    const initialChoices = (await queryRequestableApps(cmd, client, "")) || [];
+    const appPrompt = new AutoComplete({
+        name: "App",
+        message: "Select an app:",
+        limit: 15,
+        choices: initialChoices,
+        async suggest(input) {
+            const filteredChoices = await queryRequestableApps(cmd, client, input || "");
+            return filteredChoices || initialChoices;
         },
-    ]);
+    });
+    const App = await appPrompt.run();
     // Set the app in the requestMap and call choose assets step
     if (!(App.id in requestMap)) {
         requestMap[App.id] = {
@@ -295,13 +506,16 @@ async function selectRequestableItems(cmd, client, requestMap) {
     await chooseAssets(cmd, client, App.id, requestMap);
 }
 async function chooseAssets(cmd, client, appId, requestMap) {
-    var _a;
-    const { Assets } = await inquirer.prompt({
+    const initialChoices = (await queryRequestableAssets(cmd, client, appId, "")) || [];
+    const assetPrompt = new AutoComplete({
         name: "Assets",
-        type: "checkbox",
-        pageSize: 15,
-        message: "Select one or more items:",
-        choices: (_a = (await queryRequestableAssets(cmd, client, appId, undefined))) !== null && _a !== void 0 ? _a : [],
+        message: "Select one or more assets:",
+        limit: 15,
+        multiple: true,
+        async choices(input) {
+            const filteredChoices = await queryRequestableAssets(cmd, client, appId, input);
+            return filteredChoices || initialChoices;
+        },
         validate: (answer) => {
             if (answer.length < 1) {
                 return "You must select at least one item.";
@@ -309,14 +523,16 @@ async function chooseAssets(cmd, client, appId, requestMap) {
             return true;
         },
     });
+    const Assets = await assetPrompt.run();
     const entry = requestMap[appId];
     for (const asset of Assets) {
         if (entry === undefined) {
-            throw new Error(`App ${appId} not found in requestMap`);
+            throw new Error(`Error formatting app ${appId} in request`);
         }
         if (!(asset.id in entry.assets)) {
             entry.assets[asset.id] = {
                 assetName: asset.name,
+                type: asset.type,
                 roles: {},
             };
         }
@@ -325,29 +541,31 @@ async function chooseAssets(cmd, client, appId, requestMap) {
 }
 async function chooseRoles(cmd, client, appId, assetId, requestMap) {
     var _a;
-    const resourceRoles = (_a = (await queryResourceRoles(cmd, client, assetId))) !== null && _a !== void 0 ? _a : [];
-    if (resourceRoles !== undefined &&
-        (resourceRoles.length === 0 ||
-            (resourceRoles.length === 1 && resourceRoles[0].name === ""))) {
+    const entry = requestMap[appId];
+    const assetEntry = entry === null || entry === void 0 ? void 0 : entry.assets[assetId];
+    if (entry === undefined || assetEntry === undefined) {
+        throw new Error(`App ${appId} or Asset ${assetId} not found in requestMap`);
+    }
+    const assetRoles = (_a = (await queryAssetRoles(cmd, client, assetEntry.type, assetId))) !== null && _a !== void 0 ? _a : [];
+    if (assetRoles !== undefined &&
+        (assetRoles.length === 0 ||
+            (assetRoles.length === 1 && assetRoles[0].value.name === ""))) {
         return;
     }
-    const { roles } = await inquirer.prompt({
-        name: "roles",
-        type: "checkbox",
+    const rolePrompt = new AutoComplete({
+        name: "Roles",
         message: `Select one or more roles for ${assetId}:`,
-        choices: resourceRoles,
+        limit: 15,
+        multiple: true,
+        choices: assetRoles,
         validate: (answer) => {
-            if ((resourceRoles === null || resourceRoles === void 0 ? void 0 : resourceRoles.length) > 1 && answer.length < 1) {
-                return "You must select at least one role.";
+            if (answer.length < 1) {
+                return "You must select at least one item.";
             }
             return true;
         },
     });
-    const entry = requestMap[appId];
-    const assetEntry = entry === null || entry === void 0 ? void 0 : entry.assets[assetId];
-    if (entry === undefined || assetEntry === undefined) {
-        throw new Error(`App ${appId} or Asset ${assetId} not found in requestMap`);
-    }
+    const roles = await rolePrompt.run();
     if (!assetEntry.roles) {
         assetEntry.roles = {};
     }
@@ -360,14 +578,12 @@ async function chooseRoles(cmd, client, appId, assetId, requestMap) {
 async function doneSelectingAssets() {
     const submitMessage = "✅ Yes, proceed with request";
     const addMoreMessage = "❌ No, add more items";
-    const { submitOrAdd } = await inquirer.prompt([
-        {
-            name: "submitOrAdd",
-            message: "Is this all you want to request?",
-            type: "list",
-            choices: [submitMessage, addMoreMessage],
-        },
-    ]);
+    const prompt = new Select({
+        name: "submitOrAdd",
+        message: "Is this all you want to request?",
+        choices: [submitMessage, addMoreMessage],
+    });
+    const submitOrAdd = await prompt.run();
     return submitOrAdd === submitMessage;
 }
 async function setRequestDefaults(cmd, client, metadata) {
@@ -388,7 +604,7 @@ async function setRequestDefaults(cmd, client, metadata) {
     }
     try {
         const requestDefaults = await queryRequestDefaults(cmd, client, requestedResources, requestedGroups);
-        if ((requestDefaults === null || requestDefaults === void 0 ? void 0 : requestDefaults.__typename) === "RequestDefaults") {
+        if (requestDefaults !== undefined) {
             metadata.requestDefaults.durationOptions =
                 requestDefaults.durationOptions;
             metadata.requestDefaults.recommendedDurationInMinutes =
@@ -409,47 +625,91 @@ async function setRequestDefaults(cmd, client, metadata) {
     }
 }
 async function promptForReason(metadata) {
-    return await inquirer.prompt([
+    const { reason } = await prompt([
         {
             name: "reason",
             message: "I need access to this because...",
             type: "input",
             validate: (answer) => {
-                if (metadata.requestDefaults.reasonOptional && answer.length < 1) {
+                if (!metadata.requestDefaults.reasonOptional && answer.length < 1) {
                     return "A reason for requesting these assets is required.";
                 }
                 return true;
             },
         },
     ]);
+    return reason;
 }
 async function promptForExpiration(metadata) {
     var _a, _b;
     const durations = ((_b = (_a = metadata.requestDefaults) === null || _a === void 0 ? void 0 : _a.durationOptions) === null || _b === void 0 ? void 0 : _b.map((option) => {
+        const label = option.durationInMinutes ===
+            metadata.requestDefaults.recommendedDurationInMinutes
+            ? `${option.label} (Recommended)`
+            : option.label;
         return {
-            name: option.durationInMinutes ===
-                metadata.requestDefaults.recommendedDurationInMinutes
-                ? `${option.label} (Recommended)`
-                : option.label,
+            message: label,
             value: {
-                label: option.label,
+                label: label,
                 durationInMinutes: option.durationInMinutes,
+                toString: () => label,
             },
         };
     })) || [];
-    // TODO: Sort durations by minutes
-    // durations = durations.sort(
-    //   durations.filter((option) => option.value.durationInMinutes),
-    // );
-    return await inquirer.prompt([
-        {
-            name: "expiration",
-            message: "When should access expire?",
-            type: "list",
-            choices: durations,
-            pageSize: 15,
+    // Sort durations by minutes
+    durations.sort((a, b) => a.value.durationInMinutes - b.value.durationInMinutes);
+    const expirationSelect = new AutoComplete({
+        name: "expiration",
+        message: "When should access expire?",
+        type: "list",
+        choices: durations,
+        pageSize: 15,
+    });
+    let selected = await expirationSelect.run();
+    if (selected.label === "Custom") {
+        selected = await setCustomDuration();
+    }
+    return selected;
+}
+async function setCustomDuration() {
+    const durationForm = new Form({
+        name: "user",
+        message: "Please set a custom access duration:",
+        choices: [
+            { name: "days", message: "Days", initial: "0" },
+            { name: "hours", message: "Hours", initial: "0" },
+            { name: "minutes", message: "Minutes", initial: "0" },
+        ],
+        validate: (answer) => {
+            const days = Number.parseInt(answer.days);
+            const hours = Number.parseInt(answer.hours);
+            const minutes = Number.parseInt(answer.minutes);
+            if (days < 0 ||
+                hours < 0 ||
+                minutes < 0 ||
+                (days === 0 && hours === 0 && minutes === 0)) {
+                return "Please enter a valid duration.";
+            }
+            return true;
         },
-    ]);
+    });
+    const duration = await durationForm.run();
+    // Convert to minutes, define the new custom label
+    const durationInMinutes = duration.days * 1440 + duration.hours * 60 + duration.minutes;
+    let durationLabel = "";
+    if (duration.days > 0) {
+        durationLabel += `${duration.days}d `;
+    }
+    if (duration.hours > 0) {
+        durationLabel += `${duration.hours}h `;
+    }
+    if (duration.minutes > 0) {
+        durationLabel += `${duration.minutes}m`;
+    }
+    return {
+        durationInMinutes: durationInMinutes,
+        label: durationLabel,
+    };
 }
 async function submitFinalRequest(cmd) {
     const submitMessage = "✅ Yes, submit request";

package/lib/utils/displays.d.ts

@@ -1,5 +1,9 @@
+import type { ApolloQueryResult } from "@apollo/client";
 import type { Command } from "@oclif/core/lib/command";
+import type { GetRequestQuery, GetRequestsQuery } from "../graphql/graphql";
 import type { RequestMap } from "../lib/requests";
 export declare function headerMessage(cmd: Command): void;
 export declare function treeifyRequestMap(requestMap: RequestMap): string;
 export declare function displayFinalRequestSummary(cmd: Command, requestMap: RequestMap, reason: string, expiration: string): void;
+export declare function displayRequestDetails(cmd: Command, requestResp: ApolloQueryResult<GetRequestQuery>): void;
+export declare function displayRequestList(cmd: Command, requestResp: ApolloQueryResult<GetRequestsQuery>): void;