opal-security 3.1.3 → 3.2.1

package/lib/lib/requests.js

@@ -1,16 +1,61 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DISPLAY_LABELS = void 0;
+exports.initEmptyRequestMetadata = initEmptyRequestMetadata;
 exports.selectRequestableItems = selectRequestableItems;
-exports.chooseAssets = chooseAssets;
-exports.chooseRoles = chooseRoles;
 exports.doneSelectingAssets = doneSelectingAssets;
+exports.setRequestDefaults = setRequestDefaults;
 exports.promptForReason = promptForReason;
 exports.promptForExpiration = promptForExpiration;
+exports.promptRequestSubmission = promptRequestSubmission;
 exports.submitFinalRequest = submitFinalRequest;
-const inquirer = require("inquirer");
+exports.getRequestLink = getRequestLink;
+exports.bypassRequestSelection = bypassRequestSelection;
+exports.bypassDuration = bypassDuration;
+const chalk_1 = require("chalk");
 const graphql_1 = require("../graphql");
-inquirer.registerPrompt("autocomplete", require("inquirer-autocomplete-prompt"));
+const graphql_2 = require("../graphql/graphql");
+const displays_1 = require("../utils/displays");
+const config_1 = require("./config");
+const { AutoComplete, Select, prompt, Form } = require("enquirer");
+function entityTypeFromString(str) {
+    const capStr = str === null || str === void 0 ? void 0 : str.toLocaleUpperCase();
+    if (capStr === "RESOURCE") {
+        return graphql_2.EntityType.Resource;
+    }
+    if (capStr === "GROUP") {
+        return graphql_2.EntityType.Group;
+    }
+    // if type unknown, default to resource
+    return graphql_2.EntityType.Resource;
+}
+exports.DISPLAY_LABELS = {
+    [graphql_2.EntityType.Resource]: "Resource",
+    [graphql_2.EntityType.Group]: "Group",
+};
+function initEmptyRequestMetadata() {
+    // Initialize with empty defaults
+    const requestDefaults = {
+        durationOptions: [],
+        recommendedDurationInMinutes: undefined,
+        defaultDurationInMinutes: undefined,
+        maxDurationInMinutes: undefined,
+        requireSupportTicket: false,
+        reasonOptional: false,
+        requesterIsAdmin: false,
+    };
+    // Initialize with empty map
+    const requestMap = {};
+    return {
+        requestMap,
+        requestDefaults,
+        durationLabel: "",
+        durationInMinutes: 0,
+        reason: "",
+    };
+}
 // Queries and Mutations
+// TODO: add pagination ability from CLI. (Load more...) option
 const GET_REQUESTABLE_APPS_QUERY = (0, graphql_1.graphql)(`
   query GetRequestableAppsQuery($searchQuery: String) {
     appsV2(
@@ -40,6 +85,45 @@ const GET_REQUESTABLE_APPS_QUERY = (0, graphql_1.graphql)(`
     }
   }
   `);
+async function queryRequestableApps(cmd, client, input) {
+    var _a, _b;
+    try {
+        const resp = await client.query({
+            query: GET_REQUESTABLE_APPS_QUERY,
+            variables: {
+                searchQuery: input || "",
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+        return (_b = (_a = resp === null || resp === void 0 ? void 0 : resp.data) === null || _a === void 0 ? void 0 : _a.appsV2) === null || _b === void 0 ? void 0 : _b.edges.map((edge) => {
+            let type = undefined;
+            switch (edge.node.__typename) {
+                case "Resource":
+                    type = edge.node.resourceType;
+                    break;
+                case "Connection":
+                    type = edge.node.connectionType;
+                    break;
+                default:
+                    type = edge.node.__typename;
+            }
+            return {
+                message: `${edge.node.displayName} [${type}]`,
+                value: {
+                    id: edge.node.id,
+                    name: edge.node.displayName,
+                    type: type,
+                    toString: () => edge.node.displayName,
+                },
+            };
+        });
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
 const GET_ASSETS_QUERY = (0, graphql_1.graphql)(`
   query PaginatedEntityDropdown(
   $id: UUID!
@@ -70,45 +154,14 @@ const GET_ASSETS_QUERY = (0, graphql_1.graphql)(`
         cursor
       }
     }
+    ... on AppNotFoundError {
+      message
+    }
   }
 }
 `);
-async function queryRequestableApps(cmd, client, input) {
-    var _a, _b;
-    try {
-        const resp = await client.query({
-            query: GET_REQUESTABLE_APPS_QUERY,
-            variables: {
-                searchQuery: input || "",
-            },
-            fetchPolicy: "network-only", // to avoid caching
-        });
-        return (_b = (_a = resp === null || resp === void 0 ? void 0 : resp.data) === null || _a === void 0 ? void 0 : _a.appsV2) === null || _b === void 0 ? void 0 : _b.edges.map((edge) => {
-            let type = undefined;
-            if (edge.node.__typename === "Resource") {
-                type = edge.node.resourceType;
-            }
-            if (edge.node.__typename === "Connection") {
-                type = edge.node.connectionType;
-            }
-            const label = `${edge.node.displayName} (${type})`;
-            return {
-                name: label,
-                value: {
-                    id: edge.node.id,
-                    name: label,
-                },
-            };
-        });
-    }
-    catch (error) {
-        if (error instanceof Error || typeof error === "string") {
-            cmd.error(error);
-        }
-    }
-}
 async function queryRequestableAssets(cmd, client, appId, input) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e, _f;
     try {
         const resp = await client.query({
             query: GET_ASSETS_QUERY,
@@ -123,24 +176,450 @@ async function queryRequestableAssets(cmd, client, appId, input) {
         switch (resp.data.app.__typename) {
             case "App":
                 return (_d = (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.app) === null || _b === void 0 ? void 0 : _b.items) === null || _c === void 0 ? void 0 : _c.items) === null || _d === void 0 ? void 0 : _d.map((item) => {
-                    var _a, _b, _c, _d, _e, _f;
+                    var _a, _b, _c, _d, _e, _f, _g, _h;
                     const name = ((_a = item.resource) === null || _a === void 0 ? void 0 : _a.name) || ((_b = item.group) === null || _b === void 0 ? void 0 : _b.name);
                     const id = ((_c = item.resource) === null || _c === void 0 ? void 0 : _c.id) || ((_d = item.group) === null || _d === void 0 ? void 0 : _d.id);
                     const type = ((_e = item.resource) === null || _e === void 0 ? void 0 : _e.__typename) || ((_f = item.group) === null || _f === void 0 ? void 0 : _f.__typename);
-                    const label = `${name} (${type})`;
                     return {
-                        name: label,
+                        message: `${name} [${type}]`,
                         value: {
-                            name: label,
-                            id: id,
+                            name: name || "",
+                            id: id || "",
+                            type: entityTypeFromString(((_g = item.resource) === null || _g === void 0 ? void 0 : _g.__typename) || ((_h = item.group) === null || _h === void 0 ? void 0 : _h.__typename)),
                         },
                     };
                 });
             case "AppNotFoundError":
-                x = cmd.error("App not found");
+                x = cmd.error((_f = (_e = resp.data) === null || _e === void 0 ? void 0 : _e.app) === null || _f === void 0 ? void 0 : _f.message);
                 break;
             default:
-                cmd.error("Unknown error occurred.");
+                cmd.error(resp.error || "Unknown error occurred.");
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
+const RESOURCE_ROLES_QUERY = (0, graphql_1.graphql)(`
+  query ResourceAccessLevels($resourceId: ResourceId!) {
+    accessLevels(input: {
+      resourceId: $resourceId,
+      onlyMine: false,
+    }) {
+      __typename
+      ... on ResourceAccessLevelsResult {
+        accessLevels {
+          ... on ResourceAccessLevel {
+            accessLevelName
+            accessLevelRemoteId
+          }
+        }
+      }
+      ... on ResourceNotFoundError {
+        message
+      }
+    }
+  }
+`);
+const GROUP_ROLES_QUERY = (0, graphql_1.graphql)(`
+query GroupAccessLevels($groupId: GroupId!) {
+  groupAccessLevels(
+    input: { groupId: $groupId }
+  ) {
+    ... on GroupAccessLevelsResult {
+      groupId
+      accessLevels {
+        ... on GroupAccessLevel {
+            accessLevelName
+            accessLevelRemoteId
+          }
+      }
+    }
+  }
+}
+`);
+async function queryAssetRoles(cmd, client, assetType, assetId) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    try {
+        switch (assetType) {
+            case graphql_2.EntityType.Resource: {
+                const resp = await client.query({
+                    query: RESOURCE_ROLES_QUERY,
+                    variables: {
+                        resourceId: assetId,
+                    },
+                    fetchPolicy: "network-only", // to avoid caching
+                });
+                // no fall through doesn't consider process.exit();
+                let x;
+                switch (resp.data.accessLevels.__typename) {
+                    case "ResourceAccessLevelsResult":
+                        return (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.accessLevels) === null || _b === void 0 ? void 0 : _b.accessLevels) === null || _c === void 0 ? void 0 : _c.map((role) => {
+                            return {
+                                message: role.accessLevelName || "",
+                                value: {
+                                    name: role.accessLevelName || "",
+                                    id: role.accessLevelRemoteId || "",
+                                },
+                            };
+                        });
+                    case "ResourceNotFoundError":
+                        x = cmd.error((_e = (_d = resp.data) === null || _d === void 0 ? void 0 : _d.accessLevels) === null || _e === void 0 ? void 0 : _e.message);
+                        break;
+                    default:
+                        cmd.error(resp.error || "Unknown error occurred.");
+                }
+                return;
+            }
+            case graphql_2.EntityType.Group: {
+                const resp = await client.query({
+                    query: GROUP_ROLES_QUERY,
+                    variables: {
+                        groupId: assetId,
+                    },
+                    fetchPolicy: "network-only", // to avoid caching
+                });
+                // no fall through doesn't consider process.exit();
+                let x;
+                switch (resp.data.groupAccessLevels.__typename) {
+                    case "GroupAccessLevelsResult":
+                        return (_h = (_g = (_f = resp.data) === null || _f === void 0 ? void 0 : _f.groupAccessLevels) === null || _g === void 0 ? void 0 : _g.accessLevels) === null || _h === void 0 ? void 0 : _h.map((role) => {
+                            return {
+                                message: role.accessLevelName,
+                                value: {
+                                    name: role.accessLevelName,
+                                    id: role.accessLevelRemoteId,
+                                },
+                            };
+                        });
+                    default:
+                        x = cmd.error(resp.error || "Unknown error occurred.");
+                }
+                return;
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
+const REQUEST_DEFAULTS_QUERY = (0, graphql_1.graphql)(`
+  query RequestDefaults(
+    $requestedResources: [RequestConfigurationResourceInput!]!
+    $requestedGroups: [RequestConfigurationGroupInput!]!
+    ) {
+    requestDefaults(input: {
+      requestedResources: $requestedResources,
+      requestedGroups: $requestedGroups,
+      }
+    ) {
+      ... on RequestDefaults {
+        durationOptions {
+          durationInMinutes
+          label
+        }
+        recommendedDurationInMinutes
+        defaultDurationInMinutes
+        maxDurationInMinutes
+        requireSupportTicket
+        reasonOptional
+        requesterIsAdmin
+      }
+    }
+  }`);
+async function queryRequestDefaults(cmd, client, requestedResources, requestedGroups) {
+    try {
+        const resp = await client.query({
+            query: REQUEST_DEFAULTS_QUERY,
+            variables: {
+                requestedResources: requestedResources,
+                requestedGroups: requestedGroups,
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+        return resp.data.requestDefaults;
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
+const CREATE_REQUEST_MUTATION = (0, graphql_1.graphql)(`
+  mutation CreateRequest(
+    $requestedResources: [RequestedResourceInput!]!
+    $requestedGroups: [RequestedGroupInput!]!
+    $reason: String!
+    $durationInMinutes: Int
+  ) {
+    createRequest(
+      input: {
+        requestedResources: $requestedResources
+        requestedGroups: $requestedGroups
+        reason: $reason
+        durationInMinutes: $durationInMinutes
+      }
+    ) {
+      ... on CreateRequestResult {
+        request {
+          id
+          status
+        }
+      }
+      ... on RequestDurationTooLargeError {
+        message
+      }
+      ... on RequestRequiresUserAuthTokenForConnectionError {
+        message
+      }
+      ... on NoReviewersSetForOwnerError {
+        message
+        ownerId
+      }
+      ... on NoReviewersSetForResourceError {
+        message
+        resourceId
+      }
+      ... on NoReviewersSetForGroupError {
+        message
+        groupId
+      }
+      ... on NoManagerSetForRequestingUserError {
+        message
+      }
+      ... on MfaInvalidError {
+        message
+      }
+      ... on BulkRequestTooLargeError {
+        message
+      }
+      ... on ItemCannotBeRequestedError {
+        message
+      }
+      ... on UserCannotRequestAccessForTargetGroupError {
+        message
+        groupId
+        userId
+      }
+      ... on GroupNestingNotAllowedError {
+        message
+        fromGroupId
+        toGroupId
+      }
+      ... on TargetUserHasNestedAccessError {
+        message
+        groupIds
+      }
+      ... on RequestReasonMissingError {
+        message
+      }
+      ... on RequestFieldValueMissingError {
+        message
+        fieldName
+      }
+      ... on LinkedGroupNotRequestableError {
+        message
+        sourceGroupId
+        groupBindingId
+      }
+      ... on RequestReasonBelowMinLengthError {
+        message
+      }
+
+    }
+  }
+`);
+async function createRequest(cmd, client, requestedResources, requestedGroups, reason, durationInMinutes) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t;
+    try {
+        const resp = await client.mutate({
+            mutation: CREATE_REQUEST_MUTATION,
+            variables: {
+                requestedResources: requestedResources,
+                requestedGroups: requestedGroups,
+                reason: reason,
+                durationInMinutes: durationInMinutes,
+            },
+        });
+        switch ((_a = resp.data) === null || _a === void 0 ? void 0 : _a.createRequest.__typename) {
+            case "CreateRequestResult":
+                return (_b = resp.data) === null || _b === void 0 ? void 0 : _b.createRequest.request;
+            case "RequestDurationTooLargeError":
+                cmd.log((_c = resp.data) === null || _c === void 0 ? void 0 : _c.createRequest.message);
+                break;
+            case "RequestRequiresUserAuthTokenForConnectionError":
+                cmd.log((_d = resp.data) === null || _d === void 0 ? void 0 : _d.createRequest.message);
+                break;
+            case "NoReviewersSetForOwnerError":
+                cmd.log((_e = resp.data) === null || _e === void 0 ? void 0 : _e.createRequest.message);
+                break;
+            case "NoReviewersSetForResourceError":
+                cmd.log((_f = resp.data) === null || _f === void 0 ? void 0 : _f.createRequest.message);
+                break;
+            case "NoReviewersSetForGroupError":
+                cmd.log((_g = resp.data) === null || _g === void 0 ? void 0 : _g.createRequest.message);
+                break;
+            case "NoManagerSetForRequestingUserError":
+                cmd.log((_h = resp.data) === null || _h === void 0 ? void 0 : _h.createRequest.message);
+                break;
+            case "MfaInvalidError":
+                cmd.log((_j = resp.data) === null || _j === void 0 ? void 0 : _j.createRequest.message);
+                break;
+            case "BulkRequestTooLargeError":
+                cmd.log((_k = resp.data) === null || _k === void 0 ? void 0 : _k.createRequest.message);
+                break;
+            case "ItemCannotBeRequestedError":
+                cmd.log((_l = resp.data) === null || _l === void 0 ? void 0 : _l.createRequest.message);
+                break;
+            case "UserCannotRequestAccessForTargetGroupError":
+                cmd.log((_m = resp.data) === null || _m === void 0 ? void 0 : _m.createRequest.message);
+                break;
+            case "GroupNestingNotAllowedError":
+                cmd.log((_o = resp.data) === null || _o === void 0 ? void 0 : _o.createRequest.message);
+                break;
+            case "TargetUserHasNestedAccessError":
+                cmd.log((_p = resp.data) === null || _p === void 0 ? void 0 : _p.createRequest.message);
+                break;
+            case "RequestReasonMissingError":
+                cmd.log((_q = resp.data) === null || _q === void 0 ? void 0 : _q.createRequest.message);
+                break;
+            case "RequestFieldValueMissingError":
+                cmd.log((_r = resp.data) === null || _r === void 0 ? void 0 : _r.createRequest.message);
+                break;
+            case "LinkedGroupNotRequestableError":
+                cmd.log((_s = resp.data) === null || _s === void 0 ? void 0 : _s.createRequest.message);
+                break;
+            case "RequestReasonBelowMinLengthError":
+                cmd.log((_t = resp.data) === null || _t === void 0 ? void 0 : _t.createRequest.message);
+                break;
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
+const CATALOG_ITEM = (0, graphql_1.graphql)(`
+  query GetCatalogItem($uuid: UUID!) {
+    catalogItem(id: $uuid) {
+      __typename
+      ... on Connection {
+        id
+        displayName
+      }
+      ... on Resource {
+        id
+        displayName
+        connection {
+          id
+          displayName
+        }
+        accessLevels{
+          accessLevelName
+          accessLevelRemoteId
+        }
+      }
+      ...on Group {
+        id
+        name
+        connection {
+          id
+          displayName
+        }
+        accessLevels{
+          accessLevelName
+          accessLevelRemoteId
+        }
+      }
+      ... on UserFacingError {
+        message
+      }
+    }
+  }
+  `);
+const ASSOCIATED_ITEMS_QUERY = (0, graphql_1.graphql)(`
+  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {
+    resource(input: {
+      id: $resourceId
+    }) {
+      __typename
+      ... on ResourceResult {
+        __typename
+        resource {
+          associatedItems(
+            first: 200
+            filters: {
+              searchQuery: {
+                contains: $searchQuery
+              }
+              access: REQUESTABLE
+              endUserVisible: true
+              entityType: {
+                in: [GROUP, RESOURCE]
+              }
+            }
+          ) {
+            edges {
+              __typename
+              ... on ResourceAssociatedItemEdge {
+                alias
+                node {
+                  __typename
+                  id
+                  name
+                  ... on Resource {
+                    accessLevels(
+                    filters: {
+                      skipRemoteAccessLevels: false # azure app roles are remote
+                    }
+                  ) {
+                    __typename
+                    accessLevelName
+                    accessLevelRemoteId
+                  }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+      ... on ResourceNotFoundError {
+        message
+      }
+    }
+  }
+`);
+async function queryAssociatedItems(cmd, client, id, input) {
+    var _a, _b;
+    try {
+        const resp = await client.query({
+            query: ASSOCIATED_ITEMS_QUERY,
+            variables: {
+                resourceId: id || "",
+                searchQuery: input || "",
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+        switch (resp.data.resource.__typename) {
+            case "ResourceResult": {
+                const associatedItems = resp.data.resource.resource.associatedItems.edges.filter((edge) => edge.__typename === "ResourceAssociatedItemEdge");
+                const initial = [];
+                for (const edge of associatedItems) {
+                    initial.push(...appRolesFromEdge(edge));
+                }
+                return initial;
+            }
+            case "ResourceNotFoundError":
+                cmd.log((_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.resource) === null || _b === void 0 ? void 0 : _b.message);
+                break;
+            default:
+                cmd.error(resp.error || "Unknown error occurred.");
         }
     }
     catch (error) {
@@ -150,36 +629,126 @@ async function queryRequestableAssets(cmd, client, appId, input) {
     }
 }
 // Helper functions
+const selectInstructions = chalk_1.default.dim("[↑↓] Navigate · [Enter] Select · Type to filter");
+const multiSelectInstructions = chalk_1.default.dim("[↑↓] Navigate · [Space] Select · [Enter] Confirm · Type to filter");
 async function selectRequestableItems(cmd, client, requestMap) {
-    const { App } = await inquirer.prompt([
-        {
-            name: "App",
-            message: "Select an app:",
-            type: "autocomplete",
-            source: async (answers, input) => {
-                var _a;
-                return (_a = (await queryRequestableApps(cmd, client, input))) !== null && _a !== void 0 ? _a : [];
-            },
-            pageSize: 15,
+    const initial = (await queryRequestableApps(cmd, client, "")) || [];
+    const appPrompt = new AutoComplete({
+        name: "App",
+        message: "Select an app",
+        hint: selectInstructions,
+        limit: 15,
+        choices: initial,
+        async suggest(input) {
+            const filteredChoices = await queryRequestableApps(cmd, client, input || "");
+            return filteredChoices || initial;
         },
-    ]);
+    });
+    const App = await appPrompt.run();
     // Set the app in the requestMap and call choose assets step
-    if (!requestMap.has(App.id)) {
-        requestMap.set(App.id, {
+    if (!(App.id in requestMap)) {
+        requestMap[App.id] = {
+            appId: App.id,
             appName: App.name,
-            assets: new Map(),
-        });
+            assets: {},
+        };
+    }
+    if (App.type === "OKTA_APP" || App.type === "AZURE_ENTERPRISE_APP") {
+        await chooseOktaAzureRoles(cmd, client, App, requestMap);
+        return;
     }
     await chooseAssets(cmd, client, App.id, requestMap);
 }
+async function chooseOktaAzureRoles(cmd, client, app, requestMap) {
+    const associatedItems = (await queryAssociatedItems(cmd, client, app.id, "")) || [];
+    const rolePrompt = new AutoComplete({
+        name: "Roles",
+        message: `Select a role for ${app.name}:`,
+        hint: multiSelectInstructions,
+        limit: 15,
+        multiple: true,
+        async choices(input) {
+            if (!input)
+                return associatedItems;
+            const filteredChoices = await queryAssociatedItems(cmd, client, app.id, input);
+            return filteredChoices || associatedItems;
+        },
+        validate: (answer) => {
+            if (answer.length !== 1) {
+                return "Only one role is allowed to be requested for on Okta or Azure apps.";
+            }
+            return true;
+        },
+    });
+    const Roles = await rolePrompt.run();
+    const entry = requestMap[app.id];
+    for (const role of Roles) {
+        if (!(role.id in entry.assets)) {
+            entry.assets[role.id] = {
+                assetId: role.id,
+                assetName: role.name,
+                type: entityTypeFromString(role.type),
+                roles: {},
+            };
+        }
+    }
+}
+function appRolesFromEdge(edge) {
+    var _a, _b, _c, _d;
+    switch (edge.node.__typename) {
+        case "Resource": {
+            if (edge.node.accessLevels && edge.node.accessLevels.length > 0) {
+                return edge.node.accessLevels.map((accessLevel) => ({
+                    message: accessLevel.accessLevelName || "No Role (Direct access)",
+                    value: {
+                        id: edge.node.id + accessLevel.accessLevelRemoteId,
+                        name: accessLevel.accessLevelName,
+                        type: exports.DISPLAY_LABELS[graphql_2.EntityType.Resource],
+                        toString: () => accessLevel.accessLevelName,
+                    },
+                }));
+            }
+            return [
+                {
+                    message: (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name,
+                    value: {
+                        id: edge.node.id,
+                        name: (_b = edge.alias) !== null && _b !== void 0 ? _b : edge.node.name,
+                        type: exports.DISPLAY_LABELS[graphql_2.EntityType.Resource],
+                        toString: () => { var _a; return (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name; },
+                    },
+                },
+            ];
+        }
+        case "Group":
+            return [
+                {
+                    message: `${(_c = edge.alias) !== null && _c !== void 0 ? _c : edge.node.name} ${graphql_2.EntityType.Group}`,
+                    value: {
+                        id: edge.node.id,
+                        name: (_d = edge.alias) !== null && _d !== void 0 ? _d : edge.node.name,
+                        type: exports.DISPLAY_LABELS[graphql_2.EntityType.Group],
+                        toString: () => { var _a; return (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name; },
+                    },
+                },
+            ];
+    }
+}
 async function chooseAssets(cmd, client, appId, requestMap) {
-    var _a;
-    const { Assets } = await inquirer.prompt({
+    const initial = (await queryRequestableAssets(cmd, client, appId, "")) || [];
+    const assetPrompt = new AutoComplete({
         name: "Assets",
-        type: "checkbox",
-        pageSize: 15,
-        message: "Select one or more items:",
-        choices: (_a = (await queryRequestableAssets(cmd, client, appId, undefined))) !== null && _a !== void 0 ? _a : [],
+        message: "Select one or more assets:",
+        hint: multiSelectInstructions,
+        limit: 15,
+        multiple: true,
+        async choices(input) {
+            if (!input) {
+                return initial;
+            }
+            const filteredChoices = await queryRequestableAssets(cmd, client, appId, input);
+            return filteredChoices || initial;
+        },
         validate: (answer) => {
             if (answer.length < 1) {
                 return "You must select at least one item.";
@@ -187,88 +756,405 @@ async function chooseAssets(cmd, client, appId, requestMap) {
             return true;
         },
     });
-    const entry = requestMap.get(appId);
+    const Assets = await assetPrompt.run();
+    const entry = requestMap[appId];
     for (const asset of Assets) {
         if (entry === undefined) {
-            throw new Error(`App ${appId} not found in requestMap`);
+            throw new Error(`Error formatting app ${appId} in request`);
         }
-        if (!entry.assets.has(asset.id)) {
-            entry.assets.set(asset.id, {
+        if (!(asset.id in entry.assets)) {
+            entry.assets[asset.id] = {
+                assetId: asset.id,
                 assetName: asset.name,
-                roles: new Map(),
-            });
+                type: asset.type,
+                roles: {},
+            };
         }
-        await chooseRoles(appId, asset.id, requestMap);
+        await chooseRoles(cmd, client, appId, asset.id, requestMap);
     }
 }
-async function chooseRoles(appId, assetId, requestMap) {
+async function chooseRoles(cmd, client, appId, assetId, requestMap) {
     var _a;
-    const { roles } = await inquirer.prompt({
-        name: "roles",
-        type: "checkbox",
-        message: `Select one or more roles for ${assetId}:`,
-        choices: ["push", "pull", "triage", "admin"],
-    });
-    const entry = requestMap.get(appId);
-    const assetEntry = entry === null || entry === void 0 ? void 0 : entry.assets.get(assetId);
+    const entry = requestMap[appId];
+    const assetEntry = entry === null || entry === void 0 ? void 0 : entry.assets[assetId];
     if (entry === undefined || assetEntry === undefined) {
         throw new Error(`App ${appId} or Asset ${assetId} not found in requestMap`);
     }
+    const assetRoles = (_a = (await queryAssetRoles(cmd, client, assetEntry.type, assetId))) !== null && _a !== void 0 ? _a : [];
+    if (assetRoles !== undefined &&
+        (assetRoles.length === 0 ||
+            (assetRoles.length === 1 && assetRoles[0].value.name === ""))) {
+        return;
+    }
+    const rolePrompt = new AutoComplete({
+        name: "Roles",
+        message: `Select one or more roles for ${assetEntry.assetName}:`,
+        hint: multiSelectInstructions,
+        limit: 15,
+        multiple: true,
+        choices: assetRoles,
+        validate: (answer) => {
+            if (answer.length < 1) {
+                return "You must select at least one item.";
+            }
+            return true;
+        },
+    });
+    const roles = await rolePrompt.run();
+    if (!assetEntry.roles) {
+        assetEntry.roles = {};
+    }
     for (const role of roles) {
-        (_a = assetEntry.roles) === null || _a === void 0 ? void 0 : _a.set(role, {
-            roleName: role,
-        });
+        assetEntry.roles[role.id] = {
+            roleId: role.id,
+            roleName: role.name,
+        };
     }
 }
 async function doneSelectingAssets() {
     const submitMessage = "✅ Yes, proceed with request";
     const addMoreMessage = "❌ No, add more items";
-    const { submitOrAdd } = await inquirer.prompt([
-        {
-            name: "submitOrAdd",
-            message: "Is this all you want to request?",
-            type: "list",
-            choices: [submitMessage, addMoreMessage],
-        },
-    ]);
+    const prompt = new Select({
+        name: "submitOrAdd",
+        message: "Is this all you want to request?",
+        choices: [submitMessage, addMoreMessage],
+    });
+    const submitOrAdd = await prompt.run();
     return submitOrAdd === submitMessage;
 }
-async function promptForReason() {
-    return await inquirer.prompt([
+async function setRequestDefaults(cmd, client, metadata) {
+    const requestMap = metadata.requestMap;
+    const requestedResources = [];
+    const requestedGroups = [];
+    for (const appNode of Object.values(requestMap)) {
+        for (const [assetId, assetNode] of Object.entries(appNode.assets)) {
+            if (assetNode.roles !== undefined) {
+                const mappedRoles = Object.entries(assetNode.roles).map(([roleId, _roleNode]) => {
+                    return roleId;
+                });
+                const roleIds = mappedRoles.length ? mappedRoles : [""];
+                for (const roleId of roleIds) {
+                    switch (assetNode.type) {
+                        case graphql_2.EntityType.Resource: {
+                            requestedResources.push({
+                                resourceId: assetId,
+                                accessLevelRemoteId: roleId,
+                            });
+                            break;
+                        }
+                        case graphql_2.EntityType.Group: {
+                            requestedGroups.push({
+                                groupId: assetId,
+                                accessLevelRemoteId: roleId,
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    try {
+        const requestDefaults = await queryRequestDefaults(cmd, client, requestedResources, requestedGroups);
+        if (requestDefaults !== undefined) {
+            metadata.requestDefaults.durationOptions =
+                requestDefaults.durationOptions;
+            metadata.requestDefaults.recommendedDurationInMinutes =
+                requestDefaults.recommendedDurationInMinutes;
+            metadata.requestDefaults.defaultDurationInMinutes =
+                requestDefaults.defaultDurationInMinutes;
+            metadata.requestDefaults.maxDurationInMinutes =
+                requestDefaults.maxDurationInMinutes;
+            metadata.requestDefaults.requireSupportTicket =
+                requestDefaults.requireSupportTicket;
+            metadata.requestDefaults.reasonOptional = requestDefaults.reasonOptional;
+            metadata.requestDefaults.requesterIsAdmin =
+                requestDefaults.requesterIsAdmin;
+        }
+    }
+    catch (_a) {
+        cmd.error("Error fetching request defaults.");
+    }
+}
+async function promptForReason(metadata) {
+    const { reason } = await prompt([
         {
             name: "reason",
-            message: "I need access to this because...",
+            message: "Why do you need access?",
             type: "input",
+            validate: (answer) => {
+                if (!metadata.requestDefaults.reasonOptional && answer.length < 1) {
+                    return "A reason for requesting these assets is required.";
+                }
+                return true;
+            },
         },
     ]);
+    metadata.reason = reason;
 }
-async function promptForExpiration() {
-    return await inquirer.prompt([
-        {
-            name: "expiration",
-            message: "When should access expire?",
-            type: "list",
-            choices: ["1 hour", "1 day", "7 days", "30 days", "1 year", "Indefinite"],
+async function promptForExpiration(metadata) {
+    var _a, _b;
+    const durations = ((_b = (_a = metadata.requestDefaults) === null || _a === void 0 ? void 0 : _a.durationOptions) === null || _b === void 0 ? void 0 : _b.map((option) => {
+        var _a;
+        let label = option.label;
+        if (option.durationInMinutes ===
+            ((_a = metadata.requestDefaults) === null || _a === void 0 ? void 0 : _a.maxDurationInMinutes)) {
+            label = `${label} (MAX)`;
+        }
+        if (option.durationInMinutes ===
+            metadata.requestDefaults.recommendedDurationInMinutes) {
+            label = `${label} (RECOMMENDED)`;
+        }
+        return {
+            message: label,
+            value: {
+                label: label,
+                durationInMinutes: option.durationInMinutes,
+                toString: () => label,
+            },
+        };
+    })) || [];
+    // Sort durations by minutes
+    durations.sort((a, b) => a.value.durationInMinutes - b.value.durationInMinutes);
+    const expirationSelect = new AutoComplete({
+        name: "expiration",
+        message: "When should access expire?",
+        hint: "Type to filter",
+        type: "list",
+        choices: durations,
+        pageSize: 15,
+    });
+    let selected = await expirationSelect.run();
+    switch (selected.label) {
+        case "Custom": {
+            selected = await setCustomDuration(metadata);
+            break;
+        }
+        case "Permanent": {
+            selected.durationInMinutes = undefined;
+            break;
+        }
+    }
+    metadata.durationInMinutes = selected.durationInMinutes;
+    metadata.durationLabel = selected.label;
+}
+function getDurationNumbers(duration) {
+    const d = +duration.days || 0;
+    const h = +duration.hours || 0;
+    const m = +duration.minutes || 0;
+    return { d, h, m };
+}
+function getDurationInMinutes(duration) {
+    const { d, h, m } = getDurationNumbers(duration);
+    const minutesInDay = 1440; // 24 hours * 60 minutes
+    const minutesInHour = 60;
+    return d * minutesInDay + h * minutesInHour + m;
+}
+function getDHMFromMinutes(minutes) {
+    const label = [];
+    const d = Math.floor(minutes / 1440);
+    if (d > 0) {
+        label.push(`${d}d`);
+    }
+    const remainingMinutes = minutes % 1440;
+    const h = Math.floor(remainingMinutes / 60);
+    if (h > 0) {
+        label.push(`${h}h`);
+    }
+    const m = remainingMinutes % 60;
+    if (m > 0) {
+        label.push(`${m}m`);
+    }
+    return label.join(" ");
+}
+async function setCustomDuration(metadata) {
+    const durationForm = new Form({
+        name: "user",
+        message: "Please set a custom access duration:",
+        choices: [
+            { name: "days", message: "Days", initial: "0" },
+            { name: "hours", message: "Hours", initial: "0" },
+            { name: "minutes", message: "Minutes", initial: "0" },
+        ],
+        validate: (answer) => {
+            var _a, _b, _c;
+            const { d, h, m } = getDurationNumbers(answer);
+            const durationInMinutes = getDurationInMinutes(answer);
+            if (d < 0 || h < 0 || m < 0 || d + h + m === 0 || (h > 23 && m > 59)) {
+                return "Please enter a valid duration.";
+            }
+            if (((_a = metadata.requestDefaults) === null || _a === void 0 ? void 0 : _a.maxDurationInMinutes) &&
+                durationInMinutes > ((_b = metadata.requestDefaults) === null || _b === void 0 ? void 0 : _b.maxDurationInMinutes)) {
+                const maxDHM = getDHMFromMinutes((_c = metadata.requestDefaults) === null || _c === void 0 ? void 0 : _c.maxDurationInMinutes);
+                return `The max duration for the selected assets is ${maxDHM}.`;
+            }
+            return true;
         },
-    ]);
+        return: (answer) => {
+            return getDurationInMinutes(answer);
+        },
+    });
+    const durationResult = await durationForm.run();
+    const { d, h, m } = getDurationNumbers(durationResult);
+    const durationInMinutes = getDurationInMinutes(durationResult);
+    const durationLabel = getDHMFromMinutes(durationInMinutes);
+    return {
+        durationInMinutes: durationInMinutes,
+        label: durationLabel,
+    };
 }
-async function submitFinalRequest(cmd) {
+async function promptRequestSubmission(cmd, metadata) {
+    (0, displays_1.displayFinalRequestSummary)(cmd, metadata);
     const submitMessage = "✅ Yes, submit request";
     const cancelMessage = "❌ No, cancel request";
-    const { submit } = await inquirer.prompt([
-        {
-            name: "submit",
-            message: "Submit request?",
-            type: "list",
-            choices: [submitMessage, cancelMessage],
-        },
-    ]);
-    if (submit === submitMessage) {
-        const requestLink = "https://dev.opal.dev/requests/sent/05ca5d5f-ea60-4cdb-84e1-7e3c575b2b72"; //TODO: Replace with actual request link
-        cmd.log("\n🎉 Your Access Request has been submitted! Request ID: 1234");
-        cmd.log(`🔍 View request status here: ${requestLink}`);
+    const prompt = new Select({
+        name: "submitOrCancel",
+        message: "Is this all you want to request?",
+        choices: [submitMessage, cancelMessage],
+    });
+    const submitOrCancel = await prompt.run();
+    return submitOrCancel === submitMessage;
+}
+async function submitFinalRequest(cmd, client, metadata) {
+    var _a, _b, _c, _d;
+    // Build requested assets lists for the mutation
+    const requestedResources = [];
+    const requestedGroups = [];
+    for (const appNode of Object.values(metadata.requestMap)) {
+        // This extraction is different than the one in setRequestDefaults.
+        // Both extract the requestedResources and requestedGroups,
+        // use different formats.
+        for (const [assetId, assetNode] of Object.entries(appNode.assets)) {
+            if (assetNode.roles) {
+                const mappedRoles = Object.entries(assetNode.roles).map(([roleId, _roleNode]) => {
+                    return roleId;
+                });
+                const roleIds = mappedRoles.length > 0 ? mappedRoles : [""];
+                for (const roleId of roleIds) {
+                    switch (assetNode.type) {
+                        case graphql_2.EntityType.Resource: {
+                            requestedResources.push({
+                                resourceId: assetId,
+                                accessLevel: {
+                                    accessLevelName: ((_b = (_a = assetNode.roles) === null || _a === void 0 ? void 0 : _a[roleId]) === null || _b === void 0 ? void 0 : _b.roleName) || "",
+                                    accessLevelRemoteId: roleId,
+                                },
+                            });
+                            break;
+                        }
+                        case graphql_2.EntityType.Group: {
+                            requestedGroups.push({
+                                groupId: assetId,
+                                accessLevel: {
+                                    accessLevelName: ((_d = (_c = assetNode.roles) === null || _c === void 0 ? void 0 : _c[roleId]) === null || _d === void 0 ? void 0 : _d.roleName) || "",
+                                    accessLevelRemoteId: roleId,
+                                },
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    const resp = await createRequest(cmd, client, requestedResources, requestedGroups, metadata.reason, metadata.durationInMinutes);
+    // Build link to request
+    if (resp === null || resp === void 0 ? void 0 : resp.id) {
+        cmd.log("\n🎉 Your Access Request has been submitted!\n");
+        cmd.log(`${chalk_1.default.bold("ID: ")} ${chalk_1.default.cyan(resp === null || resp === void 0 ? void 0 : resp.id)}`);
+        if (resp === null || resp === void 0 ? void 0 : resp.status) {
+            cmd.log((0, displays_1.getStyledStatus)(resp === null || resp === void 0 ? void 0 : resp.status));
+        }
+        const requestLink = getRequestLink(cmd, resp.id);
+        cmd.log(`${chalk_1.default.bold("Link:")} ${chalk_1.default.underline(requestLink)}\n`);
+    }
+    return;
+}
+function getRequestLink(cmd, id) {
+    const configData = (0, config_1.getOrCreateConfigData)(cmd.config.configDir);
+    return `${configData[config_1.urlKey]}/requests/sent/${id}`;
+}
+async function bypassRequestSelection(cmd, client, flagValue, metadata) {
+    var _a, _b;
+    try {
+        // Query Catalog Item endpoint to identify what the id belongs to (resource or group)
+        for (const val of flagValue) {
+            const delimiterIndex = val.indexOf(":");
+            const assetId = delimiterIndex === -1 ? val : val.substring(0, delimiterIndex);
+            const roleName = delimiterIndex === -1 ? "" : val.substring(delimiterIndex + 1);
+            const resp = await client.query({
+                query: CATALOG_ITEM,
+                variables: {
+                    uuid: assetId || "",
+                },
+                fetchPolicy: "network-only", // to avoid caching
+            });
+            switch (resp.data.catalogItem.__typename) {
+                case "Group":
+                case "Resource": {
+                    const item = resp.data.catalogItem;
+                    const assetName = item.__typename === "Resource" ? item.displayName : item.name;
+                    const requestableRoles = (item.accessLevels || [])
+                        // TODO: Support okta azure apps ?.filter((role) => role.accessLevelName !== "") // This assumes length == 1
+                        .map((role) => ({
+                        id: role.accessLevelRemoteId,
+                        name: role.accessLevelName,
+                    }));
+                    const appId = ((_a = item.connection) === null || _a === void 0 ? void 0 : _a.id) || "";
+                    if (!(appId in metadata.requestMap)) {
+                        metadata.requestMap[appId] = {
+                            appName: ((_b = item.connection) === null || _b === void 0 ? void 0 : _b.displayName) || "",
+                            appId: appId,
+                            assets: {},
+                        };
+                    }
+                    const assetEntry = metadata.requestMap[appId].assets[assetId];
+                    if (!assetEntry) {
+                        metadata.requestMap[appId].assets[assetId] = {
+                            assetId: assetId,
+                            assetName: assetName,
+                            type: entityTypeFromString(item.__typename),
+                            roles: {},
+                        };
+                    }
+                    if (requestableRoles.length > 0 &&
+                        !(requestableRoles.length === 1 && requestableRoles[0].name === "")) {
+                        const selectedRole = requestableRoles.find((role) => role.name === roleName);
+                        if (selectedRole !== undefined) {
+                            if (!metadata.requestMap[appId].assets[assetId].roles) {
+                                metadata.requestMap[appId].assets[assetId].roles = {};
+                            }
+                            metadata.requestMap[appId].assets[assetId].roles[selectedRole.id] = {
+                                roleId: selectedRole.id,
+                                roleName: selectedRole.name,
+                            };
+                        }
+                        else {
+                            cmd.error(`Access level specified does not match one of ${assetName}'s defined access levels: ${requestableRoles.map((role) => `"${role.name}"`)}`);
+                        }
+                    }
+                    break;
+                }
+                default:
+                    cmd.error("Invalid asset id was passed in using the --id flag.");
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+    return;
+}
+function bypassDuration(cmd, duration, metadata) {
+    if (duration === 0) {
+        metadata.durationInMinutes = undefined;
+        return;
     }
-    else {
-        cmd.log("🚫 Access Request has been cancelled.");
+    const maxDuration = metadata.requestDefaults.maxDurationInMinutes;
+    if (maxDuration && duration > maxDuration) {
+        cmd.error(`The requested duration exceeds the allowed limit of ${maxDuration}`);
     }
+    metadata.durationInMinutes = duration;
 }