opal-security 3.2.1 → 3.2.2

package/lib/lib/requests.js

@@ -1,1160 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DISPLAY_LABELS = void 0;
-exports.initEmptyRequestMetadata = initEmptyRequestMetadata;
-exports.selectRequestableItems = selectRequestableItems;
-exports.doneSelectingAssets = doneSelectingAssets;
-exports.setRequestDefaults = setRequestDefaults;
-exports.promptForReason = promptForReason;
-exports.promptForExpiration = promptForExpiration;
-exports.promptRequestSubmission = promptRequestSubmission;
-exports.submitFinalRequest = submitFinalRequest;
-exports.getRequestLink = getRequestLink;
-exports.bypassRequestSelection = bypassRequestSelection;
-exports.bypassDuration = bypassDuration;
-const chalk_1 = require("chalk");
-const graphql_1 = require("../graphql");
-const graphql_2 = require("../graphql/graphql");
-const displays_1 = require("../utils/displays");
-const config_1 = require("./config");
-const { AutoComplete, Select, prompt, Form } = require("enquirer");
-function entityTypeFromString(str) {
-    const capStr = str === null || str === void 0 ? void 0 : str.toLocaleUpperCase();
-    if (capStr === "RESOURCE") {
-        return graphql_2.EntityType.Resource;
-    }
-    if (capStr === "GROUP") {
-        return graphql_2.EntityType.Group;
-    }
-    // if type unknown, default to resource
-    return graphql_2.EntityType.Resource;
-}
-exports.DISPLAY_LABELS = {
-    [graphql_2.EntityType.Resource]: "Resource",
-    [graphql_2.EntityType.Group]: "Group",
-};
-function initEmptyRequestMetadata() {
-    // Initialize with empty defaults
-    const requestDefaults = {
-        durationOptions: [],
-        recommendedDurationInMinutes: undefined,
-        defaultDurationInMinutes: undefined,
-        maxDurationInMinutes: undefined,
-        requireSupportTicket: false,
-        reasonOptional: false,
-        requesterIsAdmin: false,
-    };
-    // Initialize with empty map
-    const requestMap = {};
-    return {
-        requestMap,
-        requestDefaults,
-        durationLabel: "",
-        durationInMinutes: 0,
-        reason: "",
-    };
-}
-// Queries and Mutations
-// TODO: add pagination ability from CLI. (Load more...) option
-const GET_REQUESTABLE_APPS_QUERY = (0, graphql_1.graphql)(`
-  query GetRequestableAppsQuery($searchQuery: String) {
-    appsV2(
-      filters: {
-        access: REQUESTABLE
-        searchQuery: $searchQuery
-      }
-    ) @connection(key: "paginated-app-dropdown") {
-      edges {
-        node {
-          id
-          displayName
-          ... on Connection {
-            connectionType
-          }
-          ... on Resource {
-            resourceType
-          }
-        }
-      }
-      pageInfo {
-        hasNextPage
-        hasPreviousPage
-        startCursor
-        endCursor
-      }
-    }
-  }
-  `);
-async function queryRequestableApps(cmd, client, input) {
-    var _a, _b;
-    try {
-        const resp = await client.query({
-            query: GET_REQUESTABLE_APPS_QUERY,
-            variables: {
-                searchQuery: input || "",
-            },
-            fetchPolicy: "network-only", // to avoid caching
-        });
-        return (_b = (_a = resp === null || resp === void 0 ? void 0 : resp.data) === null || _a === void 0 ? void 0 : _a.appsV2) === null || _b === void 0 ? void 0 : _b.edges.map((edge) => {
-            let type = undefined;
-            switch (edge.node.__typename) {
-                case "Resource":
-                    type = edge.node.resourceType;
-                    break;
-                case "Connection":
-                    type = edge.node.connectionType;
-                    break;
-                default:
-                    type = edge.node.__typename;
-            }
-            return {
-                message: `${edge.node.displayName} [${type}]`,
-                value: {
-                    id: edge.node.id,
-                    name: edge.node.displayName,
-                    type: type,
-                    toString: () => edge.node.displayName,
-                },
-            };
-        });
-    }
-    catch (error) {
-        if (error instanceof Error || typeof error === "string") {
-            cmd.error(error);
-        }
-    }
-}
-const GET_ASSETS_QUERY = (0, graphql_1.graphql)(`
-  query PaginatedEntityDropdown(
-  $id: UUID!
-  $searchQuery: String
-) {
-  app(id: $id) {
-    __typename
-    ... on App {
-      id
-      items(
-        input: {
-          access: REQUESTABLE
-          searchQuery: $searchQuery
-          includeOnlyRequestable: true
-        }
-      ) {
-        items {
-          key
-          resource {
-            id
-            name
-          }
-          group {
-            id
-            name
-          }
-        }
-        cursor
-      }
-    }
-    ... on AppNotFoundError {
-      message
-    }
-  }
-}
-`);
-async function queryRequestableAssets(cmd, client, appId, input) {
-    var _a, _b, _c, _d, _e, _f;
-    try {
-        const resp = await client.query({
-            query: GET_ASSETS_QUERY,
-            variables: {
-                id: appId || "",
-                searchQuery: input || "",
-            },
-            fetchPolicy: "network-only", // to avoid caching
-        });
-        // no fall through doesn't consider process.exit();
-        let x;
-        switch (resp.data.app.__typename) {
-            case "App":
-                return (_d = (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.app) === null || _b === void 0 ? void 0 : _b.items) === null || _c === void 0 ? void 0 : _c.items) === null || _d === void 0 ? void 0 : _d.map((item) => {
-                    var _a, _b, _c, _d, _e, _f, _g, _h;
-                    const name = ((_a = item.resource) === null || _a === void 0 ? void 0 : _a.name) || ((_b = item.group) === null || _b === void 0 ? void 0 : _b.name);
-                    const id = ((_c = item.resource) === null || _c === void 0 ? void 0 : _c.id) || ((_d = item.group) === null || _d === void 0 ? void 0 : _d.id);
-                    const type = ((_e = item.resource) === null || _e === void 0 ? void 0 : _e.__typename) || ((_f = item.group) === null || _f === void 0 ? void 0 : _f.__typename);
-                    return {
-                        message: `${name} [${type}]`,
-                        value: {
-                            name: name || "",
-                            id: id || "",
-                            type: entityTypeFromString(((_g = item.resource) === null || _g === void 0 ? void 0 : _g.__typename) || ((_h = item.group) === null || _h === void 0 ? void 0 : _h.__typename)),
-                        },
-                    };
-                });
-            case "AppNotFoundError":
-                x = cmd.error((_f = (_e = resp.data) === null || _e === void 0 ? void 0 : _e.app) === null || _f === void 0 ? void 0 : _f.message);
-                break;
-            default:
-                cmd.error(resp.error || "Unknown error occurred.");
-        }
-    }
-    catch (error) {
-        if (error instanceof Error || typeof error === "string") {
-            cmd.error(error);
-        }
-    }
-}
-const RESOURCE_ROLES_QUERY = (0, graphql_1.graphql)(`
-  query ResourceAccessLevels($resourceId: ResourceId!) {
-    accessLevels(input: {
-      resourceId: $resourceId,
-      onlyMine: false,
-    }) {
-      __typename
-      ... on ResourceAccessLevelsResult {
-        accessLevels {
-          ... on ResourceAccessLevel {
-            accessLevelName
-            accessLevelRemoteId
-          }
-        }
-      }
-      ... on ResourceNotFoundError {
-        message
-      }
-    }
-  }
-`);
-const GROUP_ROLES_QUERY = (0, graphql_1.graphql)(`
-query GroupAccessLevels($groupId: GroupId!) {
-  groupAccessLevels(
-    input: { groupId: $groupId }
-  ) {
-    ... on GroupAccessLevelsResult {
-      groupId
-      accessLevels {
-        ... on GroupAccessLevel {
-            accessLevelName
-            accessLevelRemoteId
-          }
-      }
-    }
-  }
-}
-`);
-async function queryAssetRoles(cmd, client, assetType, assetId) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
-    try {
-        switch (assetType) {
-            case graphql_2.EntityType.Resource: {
-                const resp = await client.query({
-                    query: RESOURCE_ROLES_QUERY,
-                    variables: {
-                        resourceId: assetId,
-                    },
-                    fetchPolicy: "network-only", // to avoid caching
-                });
-                // no fall through doesn't consider process.exit();
-                let x;
-                switch (resp.data.accessLevels.__typename) {
-                    case "ResourceAccessLevelsResult":
-                        return (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.accessLevels) === null || _b === void 0 ? void 0 : _b.accessLevels) === null || _c === void 0 ? void 0 : _c.map((role) => {
-                            return {
-                                message: role.accessLevelName || "",
-                                value: {
-                                    name: role.accessLevelName || "",
-                                    id: role.accessLevelRemoteId || "",
-                                },
-                            };
-                        });
-                    case "ResourceNotFoundError":
-                        x = cmd.error((_e = (_d = resp.data) === null || _d === void 0 ? void 0 : _d.accessLevels) === null || _e === void 0 ? void 0 : _e.message);
-                        break;
-                    default:
-                        cmd.error(resp.error || "Unknown error occurred.");
-                }
-                return;
-            }
-            case graphql_2.EntityType.Group: {
-                const resp = await client.query({
-                    query: GROUP_ROLES_QUERY,
-                    variables: {
-                        groupId: assetId,
-                    },
-                    fetchPolicy: "network-only", // to avoid caching
-                });
-                // no fall through doesn't consider process.exit();
-                let x;
-                switch (resp.data.groupAccessLevels.__typename) {
-                    case "GroupAccessLevelsResult":
-                        return (_h = (_g = (_f = resp.data) === null || _f === void 0 ? void 0 : _f.groupAccessLevels) === null || _g === void 0 ? void 0 : _g.accessLevels) === null || _h === void 0 ? void 0 : _h.map((role) => {
-                            return {
-                                message: role.accessLevelName,
-                                value: {
-                                    name: role.accessLevelName,
-                                    id: role.accessLevelRemoteId,
-                                },
-                            };
-                        });
-                    default:
-                        x = cmd.error(resp.error || "Unknown error occurred.");
-                }
-                return;
-            }
-        }
-    }
-    catch (error) {
-        if (error instanceof Error || typeof error === "string") {
-            cmd.error(error);
-        }
-    }
-}
-const REQUEST_DEFAULTS_QUERY = (0, graphql_1.graphql)(`
-  query RequestDefaults(
-    $requestedResources: [RequestConfigurationResourceInput!]!
-    $requestedGroups: [RequestConfigurationGroupInput!]!
-    ) {
-    requestDefaults(input: {
-      requestedResources: $requestedResources,
-      requestedGroups: $requestedGroups,
-      }
-    ) {
-      ... on RequestDefaults {
-        durationOptions {
-          durationInMinutes
-          label
-        }
-        recommendedDurationInMinutes
-        defaultDurationInMinutes
-        maxDurationInMinutes
-        requireSupportTicket
-        reasonOptional
-        requesterIsAdmin
-      }
-    }
-  }`);
-async function queryRequestDefaults(cmd, client, requestedResources, requestedGroups) {
-    try {
-        const resp = await client.query({
-            query: REQUEST_DEFAULTS_QUERY,
-            variables: {
-                requestedResources: requestedResources,
-                requestedGroups: requestedGroups,
-            },
-            fetchPolicy: "network-only", // to avoid caching
-        });
-        return resp.data.requestDefaults;
-    }
-    catch (error) {
-        if (error instanceof Error || typeof error === "string") {
-            cmd.error(error);
-        }
-    }
-}
-const CREATE_REQUEST_MUTATION = (0, graphql_1.graphql)(`
-  mutation CreateRequest(
-    $requestedResources: [RequestedResourceInput!]!
-    $requestedGroups: [RequestedGroupInput!]!
-    $reason: String!
-    $durationInMinutes: Int
-  ) {
-    createRequest(
-      input: {
-        requestedResources: $requestedResources
-        requestedGroups: $requestedGroups
-        reason: $reason
-        durationInMinutes: $durationInMinutes
-      }
-    ) {
-      ... on CreateRequestResult {
-        request {
-          id
-          status
-        }
-      }
-      ... on RequestDurationTooLargeError {
-        message
-      }
-      ... on RequestRequiresUserAuthTokenForConnectionError {
-        message
-      }
-      ... on NoReviewersSetForOwnerError {
-        message
-        ownerId
-      }
-      ... on NoReviewersSetForResourceError {
-        message
-        resourceId
-      }
-      ... on NoReviewersSetForGroupError {
-        message
-        groupId
-      }
-      ... on NoManagerSetForRequestingUserError {
-        message
-      }
-      ... on MfaInvalidError {
-        message
-      }
-      ... on BulkRequestTooLargeError {
-        message
-      }
-      ... on ItemCannotBeRequestedError {
-        message
-      }
-      ... on UserCannotRequestAccessForTargetGroupError {
-        message
-        groupId
-        userId
-      }
-      ... on GroupNestingNotAllowedError {
-        message
-        fromGroupId
-        toGroupId
-      }
-      ... on TargetUserHasNestedAccessError {
-        message
-        groupIds
-      }
-      ... on RequestReasonMissingError {
-        message
-      }
-      ... on RequestFieldValueMissingError {
-        message
-        fieldName
-      }
-      ... on LinkedGroupNotRequestableError {
-        message
-        sourceGroupId
-        groupBindingId
-      }
-      ... on RequestReasonBelowMinLengthError {
-        message
-      }
-
-    }
-  }
-`);
-async function createRequest(cmd, client, requestedResources, requestedGroups, reason, durationInMinutes) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t;
-    try {
-        const resp = await client.mutate({
-            mutation: CREATE_REQUEST_MUTATION,
-            variables: {
-                requestedResources: requestedResources,
-                requestedGroups: requestedGroups,
-                reason: reason,
-                durationInMinutes: durationInMinutes,
-            },
-        });
-        switch ((_a = resp.data) === null || _a === void 0 ? void 0 : _a.createRequest.__typename) {
-            case "CreateRequestResult":
-                return (_b = resp.data) === null || _b === void 0 ? void 0 : _b.createRequest.request;
-            case "RequestDurationTooLargeError":
-                cmd.log((_c = resp.data) === null || _c === void 0 ? void 0 : _c.createRequest.message);
-                break;
-            case "RequestRequiresUserAuthTokenForConnectionError":
-                cmd.log((_d = resp.data) === null || _d === void 0 ? void 0 : _d.createRequest.message);
-                break;
-            case "NoReviewersSetForOwnerError":
-                cmd.log((_e = resp.data) === null || _e === void 0 ? void 0 : _e.createRequest.message);
-                break;
-            case "NoReviewersSetForResourceError":
-                cmd.log((_f = resp.data) === null || _f === void 0 ? void 0 : _f.createRequest.message);
-                break;
-            case "NoReviewersSetForGroupError":
-                cmd.log((_g = resp.data) === null || _g === void 0 ? void 0 : _g.createRequest.message);
-                break;
-            case "NoManagerSetForRequestingUserError":
-                cmd.log((_h = resp.data) === null || _h === void 0 ? void 0 : _h.createRequest.message);
-                break;
-            case "MfaInvalidError":
-                cmd.log((_j = resp.data) === null || _j === void 0 ? void 0 : _j.createRequest.message);
-                break;
-            case "BulkRequestTooLargeError":
-                cmd.log((_k = resp.data) === null || _k === void 0 ? void 0 : _k.createRequest.message);
-                break;
-            case "ItemCannotBeRequestedError":
-                cmd.log((_l = resp.data) === null || _l === void 0 ? void 0 : _l.createRequest.message);
-                break;
-            case "UserCannotRequestAccessForTargetGroupError":
-                cmd.log((_m = resp.data) === null || _m === void 0 ? void 0 : _m.createRequest.message);
-                break;
-            case "GroupNestingNotAllowedError":
-                cmd.log((_o = resp.data) === null || _o === void 0 ? void 0 : _o.createRequest.message);
-                break;
-            case "TargetUserHasNestedAccessError":
-                cmd.log((_p = resp.data) === null || _p === void 0 ? void 0 : _p.createRequest.message);
-                break;
-            case "RequestReasonMissingError":
-                cmd.log((_q = resp.data) === null || _q === void 0 ? void 0 : _q.createRequest.message);
-                break;
-            case "RequestFieldValueMissingError":
-                cmd.log((_r = resp.data) === null || _r === void 0 ? void 0 : _r.createRequest.message);
-                break;
-            case "LinkedGroupNotRequestableError":
-                cmd.log((_s = resp.data) === null || _s === void 0 ? void 0 : _s.createRequest.message);
-                break;
-            case "RequestReasonBelowMinLengthError":
-                cmd.log((_t = resp.data) === null || _t === void 0 ? void 0 : _t.createRequest.message);
-                break;
-        }
-    }
-    catch (error) {
-        if (error instanceof Error || typeof error === "string") {
-            cmd.error(error);
-        }
-    }
-}
-const CATALOG_ITEM = (0, graphql_1.graphql)(`
-  query GetCatalogItem($uuid: UUID!) {
-    catalogItem(id: $uuid) {
-      __typename
-      ... on Connection {
-        id
-        displayName
-      }
-      ... on Resource {
-        id
-        displayName
-        connection {
-          id
-          displayName
-        }
-        accessLevels{
-          accessLevelName
-          accessLevelRemoteId
-        }
-      }
-      ...on Group {
-        id
-        name
-        connection {
-          id
-          displayName
-        }
-        accessLevels{
-          accessLevelName
-          accessLevelRemoteId
-        }
-      }
-      ... on UserFacingError {
-        message
-      }
-    }
-  }
-  `);
-const ASSOCIATED_ITEMS_QUERY = (0, graphql_1.graphql)(`
-  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {
-    resource(input: {
-      id: $resourceId
-    }) {
-      __typename
-      ... on ResourceResult {
-        __typename
-        resource {
-          associatedItems(
-            first: 200
-            filters: {
-              searchQuery: {
-                contains: $searchQuery
-              }
-              access: REQUESTABLE
-              endUserVisible: true
-              entityType: {
-                in: [GROUP, RESOURCE]
-              }
-            }
-          ) {
-            edges {
-              __typename
-              ... on ResourceAssociatedItemEdge {
-                alias
-                node {
-                  __typename
-                  id
-                  name
-                  ... on Resource {
-                    accessLevels(
-                    filters: {
-                      skipRemoteAccessLevels: false # azure app roles are remote
-                    }
-                  ) {
-                    __typename
-                    accessLevelName
-                    accessLevelRemoteId
-                  }
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-      ... on ResourceNotFoundError {
-        message
-      }
-    }
-  }
-`);
-async function queryAssociatedItems(cmd, client, id, input) {
-    var _a, _b;
-    try {
-        const resp = await client.query({
-            query: ASSOCIATED_ITEMS_QUERY,
-            variables: {
-                resourceId: id || "",
-                searchQuery: input || "",
-            },
-            fetchPolicy: "network-only", // to avoid caching
-        });
-        switch (resp.data.resource.__typename) {
-            case "ResourceResult": {
-                const associatedItems = resp.data.resource.resource.associatedItems.edges.filter((edge) => edge.__typename === "ResourceAssociatedItemEdge");
-                const initial = [];
-                for (const edge of associatedItems) {
-                    initial.push(...appRolesFromEdge(edge));
-                }
-                return initial;
-            }
-            case "ResourceNotFoundError":
-                cmd.log((_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.resource) === null || _b === void 0 ? void 0 : _b.message);
-                break;
-            default:
-                cmd.error(resp.error || "Unknown error occurred.");
-        }
-    }
-    catch (error) {
-        if (error instanceof Error || typeof error === "string") {
-            cmd.error(error);
-        }
-    }
-}
-// Helper functions
-const selectInstructions = chalk_1.default.dim("[↑↓] Navigate · [Enter] Select · Type to filter");
-const multiSelectInstructions = chalk_1.default.dim("[↑↓] Navigate · [Space] Select · [Enter] Confirm · Type to filter");
-async function selectRequestableItems(cmd, client, requestMap) {
-    const initial = (await queryRequestableApps(cmd, client, "")) || [];
-    const appPrompt = new AutoComplete({
-        name: "App",
-        message: "Select an app",
-        hint: selectInstructions,
-        limit: 15,
-        choices: initial,
-        async suggest(input) {
-            const filteredChoices = await queryRequestableApps(cmd, client, input || "");
-            return filteredChoices || initial;
-        },
-    });
-    const App = await appPrompt.run();
-    // Set the app in the requestMap and call choose assets step
-    if (!(App.id in requestMap)) {
-        requestMap[App.id] = {
-            appId: App.id,
-            appName: App.name,
-            assets: {},
-        };
-    }
-    if (App.type === "OKTA_APP" || App.type === "AZURE_ENTERPRISE_APP") {
-        await chooseOktaAzureRoles(cmd, client, App, requestMap);
-        return;
-    }
-    await chooseAssets(cmd, client, App.id, requestMap);
-}
-async function chooseOktaAzureRoles(cmd, client, app, requestMap) {
-    const associatedItems = (await queryAssociatedItems(cmd, client, app.id, "")) || [];
-    const rolePrompt = new AutoComplete({
-        name: "Roles",
-        message: `Select a role for ${app.name}:`,
-        hint: multiSelectInstructions,
-        limit: 15,
-        multiple: true,
-        async choices(input) {
-            if (!input)
-                return associatedItems;
-            const filteredChoices = await queryAssociatedItems(cmd, client, app.id, input);
-            return filteredChoices || associatedItems;
-        },
-        validate: (answer) => {
-            if (answer.length !== 1) {
-                return "Only one role is allowed to be requested for on Okta or Azure apps.";
-            }
-            return true;
-        },
-    });
-    const Roles = await rolePrompt.run();
-    const entry = requestMap[app.id];
-    for (const role of Roles) {
-        if (!(role.id in entry.assets)) {
-            entry.assets[role.id] = {
-                assetId: role.id,
-                assetName: role.name,
-                type: entityTypeFromString(role.type),
-                roles: {},
-            };
-        }
-    }
-}
-function appRolesFromEdge(edge) {
-    var _a, _b, _c, _d;
-    switch (edge.node.__typename) {
-        case "Resource": {
-            if (edge.node.accessLevels && edge.node.accessLevels.length > 0) {
-                return edge.node.accessLevels.map((accessLevel) => ({
-                    message: accessLevel.accessLevelName || "No Role (Direct access)",
-                    value: {
-                        id: edge.node.id + accessLevel.accessLevelRemoteId,
-                        name: accessLevel.accessLevelName,
-                        type: exports.DISPLAY_LABELS[graphql_2.EntityType.Resource],
-                        toString: () => accessLevel.accessLevelName,
-                    },
-                }));
-            }
-            return [
-                {
-                    message: (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name,
-                    value: {
-                        id: edge.node.id,
-                        name: (_b = edge.alias) !== null && _b !== void 0 ? _b : edge.node.name,
-                        type: exports.DISPLAY_LABELS[graphql_2.EntityType.Resource],
-                        toString: () => { var _a; return (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name; },
-                    },
-                },
-            ];
-        }
-        case "Group":
-            return [
-                {
-                    message: `${(_c = edge.alias) !== null && _c !== void 0 ? _c : edge.node.name} ${graphql_2.EntityType.Group}`,
-                    value: {
-                        id: edge.node.id,
-                        name: (_d = edge.alias) !== null && _d !== void 0 ? _d : edge.node.name,
-                        type: exports.DISPLAY_LABELS[graphql_2.EntityType.Group],
-                        toString: () => { var _a; return (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name; },
-                    },
-                },
-            ];
-    }
-}
-async function chooseAssets(cmd, client, appId, requestMap) {
-    const initial = (await queryRequestableAssets(cmd, client, appId, "")) || [];
-    const assetPrompt = new AutoComplete({
-        name: "Assets",
-        message: "Select one or more assets:",
-        hint: multiSelectInstructions,
-        limit: 15,
-        multiple: true,
-        async choices(input) {
-            if (!input) {
-                return initial;
-            }
-            const filteredChoices = await queryRequestableAssets(cmd, client, appId, input);
-            return filteredChoices || initial;
-        },
-        validate: (answer) => {
-            if (answer.length < 1) {
-                return "You must select at least one item.";
-            }
-            return true;
-        },
-    });
-    const Assets = await assetPrompt.run();
-    const entry = requestMap[appId];
-    for (const asset of Assets) {
-        if (entry === undefined) {
-            throw new Error(`Error formatting app ${appId} in request`);
-        }
-        if (!(asset.id in entry.assets)) {
-            entry.assets[asset.id] = {
-                assetId: asset.id,
-                assetName: asset.name,
-                type: asset.type,
-                roles: {},
-            };
-        }
-        await chooseRoles(cmd, client, appId, asset.id, requestMap);
-    }
-}
-async function chooseRoles(cmd, client, appId, assetId, requestMap) {
-    var _a;
-    const entry = requestMap[appId];
-    const assetEntry = entry === null || entry === void 0 ? void 0 : entry.assets[assetId];
-    if (entry === undefined || assetEntry === undefined) {
-        throw new Error(`App ${appId} or Asset ${assetId} not found in requestMap`);
-    }
-    const assetRoles = (_a = (await queryAssetRoles(cmd, client, assetEntry.type, assetId))) !== null && _a !== void 0 ? _a : [];
-    if (assetRoles !== undefined &&
-        (assetRoles.length === 0 ||
-            (assetRoles.length === 1 && assetRoles[0].value.name === ""))) {
-        return;
-    }
-    const rolePrompt = new AutoComplete({
-        name: "Roles",
-        message: `Select one or more roles for ${assetEntry.assetName}:`,
-        hint: multiSelectInstructions,
-        limit: 15,
-        multiple: true,
-        choices: assetRoles,
-        validate: (answer) => {
-            if (answer.length < 1) {
-                return "You must select at least one item.";
-            }
-            return true;
-        },
-    });
-    const roles = await rolePrompt.run();
-    if (!assetEntry.roles) {
-        assetEntry.roles = {};
-    }
-    for (const role of roles) {
-        assetEntry.roles[role.id] = {
-            roleId: role.id,
-            roleName: role.name,
-        };
-    }
-}
-async function doneSelectingAssets() {
-    const submitMessage = "✅ Yes, proceed with request";
-    const addMoreMessage = "❌ No, add more items";
-    const prompt = new Select({
-        name: "submitOrAdd",
-        message: "Is this all you want to request?",
-        choices: [submitMessage, addMoreMessage],
-    });
-    const submitOrAdd = await prompt.run();
-    return submitOrAdd === submitMessage;
-}
-async function setRequestDefaults(cmd, client, metadata) {
-    const requestMap = metadata.requestMap;
-    const requestedResources = [];
-    const requestedGroups = [];
-    for (const appNode of Object.values(requestMap)) {
-        for (const [assetId, assetNode] of Object.entries(appNode.assets)) {
-            if (assetNode.roles !== undefined) {
-                const mappedRoles = Object.entries(assetNode.roles).map(([roleId, _roleNode]) => {
-                    return roleId;
-                });
-                const roleIds = mappedRoles.length ? mappedRoles : [""];
-                for (const roleId of roleIds) {
-                    switch (assetNode.type) {
-                        case graphql_2.EntityType.Resource: {
-                            requestedResources.push({
-                                resourceId: assetId,
-                                accessLevelRemoteId: roleId,
-                            });
-                            break;
-                        }
-                        case graphql_2.EntityType.Group: {
-                            requestedGroups.push({
-                                groupId: assetId,
-                                accessLevelRemoteId: roleId,
-                            });
-                            break;
-                        }
-                    }
-                }
-            }
-        }
-    }
-    try {
-        const requestDefaults = await queryRequestDefaults(cmd, client, requestedResources, requestedGroups);
-        if (requestDefaults !== undefined) {
-            metadata.requestDefaults.durationOptions =
-                requestDefaults.durationOptions;
-            metadata.requestDefaults.recommendedDurationInMinutes =
-                requestDefaults.recommendedDurationInMinutes;
-            metadata.requestDefaults.defaultDurationInMinutes =
-                requestDefaults.defaultDurationInMinutes;
-            metadata.requestDefaults.maxDurationInMinutes =
-                requestDefaults.maxDurationInMinutes;
-            metadata.requestDefaults.requireSupportTicket =
-                requestDefaults.requireSupportTicket;
-            metadata.requestDefaults.reasonOptional = requestDefaults.reasonOptional;
-            metadata.requestDefaults.requesterIsAdmin =
-                requestDefaults.requesterIsAdmin;
-        }
-    }
-    catch (_a) {
-        cmd.error("Error fetching request defaults.");
-    }
-}
-async function promptForReason(metadata) {
-    const { reason } = await prompt([
-        {
-            name: "reason",
-            message: "Why do you need access?",
-            type: "input",
-            validate: (answer) => {
-                if (!metadata.requestDefaults.reasonOptional && answer.length < 1) {
-                    return "A reason for requesting these assets is required.";
-                }
-                return true;
-            },
-        },
-    ]);
-    metadata.reason = reason;
-}
-async function promptForExpiration(metadata) {
-    var _a, _b;
-    const durations = ((_b = (_a = metadata.requestDefaults) === null || _a === void 0 ? void 0 : _a.durationOptions) === null || _b === void 0 ? void 0 : _b.map((option) => {
-        var _a;
-        let label = option.label;
-        if (option.durationInMinutes ===
-            ((_a = metadata.requestDefaults) === null || _a === void 0 ? void 0 : _a.maxDurationInMinutes)) {
-            label = `${label} (MAX)`;
-        }
-        if (option.durationInMinutes ===
-            metadata.requestDefaults.recommendedDurationInMinutes) {
-            label = `${label} (RECOMMENDED)`;
-        }
-        return {
-            message: label,
-            value: {
-                label: label,
-                durationInMinutes: option.durationInMinutes,
-                toString: () => label,
-            },
-        };
-    })) || [];
-    // Sort durations by minutes
-    durations.sort((a, b) => a.value.durationInMinutes - b.value.durationInMinutes);
-    const expirationSelect = new AutoComplete({
-        name: "expiration",
-        message: "When should access expire?",
-        hint: "Type to filter",
-        type: "list",
-        choices: durations,
-        pageSize: 15,
-    });
-    let selected = await expirationSelect.run();
-    switch (selected.label) {
-        case "Custom": {
-            selected = await setCustomDuration(metadata);
-            break;
-        }
-        case "Permanent": {
-            selected.durationInMinutes = undefined;
-            break;
-        }
-    }
-    metadata.durationInMinutes = selected.durationInMinutes;
-    metadata.durationLabel = selected.label;
-}
-function getDurationNumbers(duration) {
-    const d = +duration.days || 0;
-    const h = +duration.hours || 0;
-    const m = +duration.minutes || 0;
-    return { d, h, m };
-}
-function getDurationInMinutes(duration) {
-    const { d, h, m } = getDurationNumbers(duration);
-    const minutesInDay = 1440; // 24 hours * 60 minutes
-    const minutesInHour = 60;
-    return d * minutesInDay + h * minutesInHour + m;
-}
-function getDHMFromMinutes(minutes) {
-    const label = [];
-    const d = Math.floor(minutes / 1440);
-    if (d > 0) {
-        label.push(`${d}d`);
-    }
-    const remainingMinutes = minutes % 1440;
-    const h = Math.floor(remainingMinutes / 60);
-    if (h > 0) {
-        label.push(`${h}h`);
-    }
-    const m = remainingMinutes % 60;
-    if (m > 0) {
-        label.push(`${m}m`);
-    }
-    return label.join(" ");
-}
-async function setCustomDuration(metadata) {
-    const durationForm = new Form({
-        name: "user",
-        message: "Please set a custom access duration:",
-        choices: [
-            { name: "days", message: "Days", initial: "0" },
-            { name: "hours", message: "Hours", initial: "0" },
-            { name: "minutes", message: "Minutes", initial: "0" },
-        ],
-        validate: (answer) => {
-            var _a, _b, _c;
-            const { d, h, m } = getDurationNumbers(answer);
-            const durationInMinutes = getDurationInMinutes(answer);
-            if (d < 0 || h < 0 || m < 0 || d + h + m === 0 || (h > 23 && m > 59)) {
-                return "Please enter a valid duration.";
-            }
-            if (((_a = metadata.requestDefaults) === null || _a === void 0 ? void 0 : _a.maxDurationInMinutes) &&
-                durationInMinutes > ((_b = metadata.requestDefaults) === null || _b === void 0 ? void 0 : _b.maxDurationInMinutes)) {
-                const maxDHM = getDHMFromMinutes((_c = metadata.requestDefaults) === null || _c === void 0 ? void 0 : _c.maxDurationInMinutes);
-                return `The max duration for the selected assets is ${maxDHM}.`;
-            }
-            return true;
-        },
-        return: (answer) => {
-            return getDurationInMinutes(answer);
-        },
-    });
-    const durationResult = await durationForm.run();
-    const { d, h, m } = getDurationNumbers(durationResult);
-    const durationInMinutes = getDurationInMinutes(durationResult);
-    const durationLabel = getDHMFromMinutes(durationInMinutes);
-    return {
-        durationInMinutes: durationInMinutes,
-        label: durationLabel,
-    };
-}
-async function promptRequestSubmission(cmd, metadata) {
-    (0, displays_1.displayFinalRequestSummary)(cmd, metadata);
-    const submitMessage = "✅ Yes, submit request";
-    const cancelMessage = "❌ No, cancel request";
-    const prompt = new Select({
-        name: "submitOrCancel",
-        message: "Is this all you want to request?",
-        choices: [submitMessage, cancelMessage],
-    });
-    const submitOrCancel = await prompt.run();
-    return submitOrCancel === submitMessage;
-}
-async function submitFinalRequest(cmd, client, metadata) {
-    var _a, _b, _c, _d;
-    // Build requested assets lists for the mutation
-    const requestedResources = [];
-    const requestedGroups = [];
-    for (const appNode of Object.values(metadata.requestMap)) {
-        // This extraction is different than the one in setRequestDefaults.
-        // Both extract the requestedResources and requestedGroups,
-        // use different formats.
-        for (const [assetId, assetNode] of Object.entries(appNode.assets)) {
-            if (assetNode.roles) {
-                const mappedRoles = Object.entries(assetNode.roles).map(([roleId, _roleNode]) => {
-                    return roleId;
-                });
-                const roleIds = mappedRoles.length > 0 ? mappedRoles : [""];
-                for (const roleId of roleIds) {
-                    switch (assetNode.type) {
-                        case graphql_2.EntityType.Resource: {
-                            requestedResources.push({
-                                resourceId: assetId,
-                                accessLevel: {
-                                    accessLevelName: ((_b = (_a = assetNode.roles) === null || _a === void 0 ? void 0 : _a[roleId]) === null || _b === void 0 ? void 0 : _b.roleName) || "",
-                                    accessLevelRemoteId: roleId,
-                                },
-                            });
-                            break;
-                        }
-                        case graphql_2.EntityType.Group: {
-                            requestedGroups.push({
-                                groupId: assetId,
-                                accessLevel: {
-                                    accessLevelName: ((_d = (_c = assetNode.roles) === null || _c === void 0 ? void 0 : _c[roleId]) === null || _d === void 0 ? void 0 : _d.roleName) || "",
-                                    accessLevelRemoteId: roleId,
-                                },
-                            });
-                            break;
-                        }
-                    }
-                }
-            }
-        }
-    }
-    const resp = await createRequest(cmd, client, requestedResources, requestedGroups, metadata.reason, metadata.durationInMinutes);
-    // Build link to request
-    if (resp === null || resp === void 0 ? void 0 : resp.id) {
-        cmd.log("\n🎉 Your Access Request has been submitted!\n");
-        cmd.log(`${chalk_1.default.bold("ID: ")} ${chalk_1.default.cyan(resp === null || resp === void 0 ? void 0 : resp.id)}`);
-        if (resp === null || resp === void 0 ? void 0 : resp.status) {
-            cmd.log((0, displays_1.getStyledStatus)(resp === null || resp === void 0 ? void 0 : resp.status));
-        }
-        const requestLink = getRequestLink(cmd, resp.id);
-        cmd.log(`${chalk_1.default.bold("Link:")} ${chalk_1.default.underline(requestLink)}\n`);
-    }
-    return;
-}
-function getRequestLink(cmd, id) {
-    const configData = (0, config_1.getOrCreateConfigData)(cmd.config.configDir);
-    return `${configData[config_1.urlKey]}/requests/sent/${id}`;
-}
-async function bypassRequestSelection(cmd, client, flagValue, metadata) {
-    var _a, _b;
-    try {
-        // Query Catalog Item endpoint to identify what the id belongs to (resource or group)
-        for (const val of flagValue) {
-            const delimiterIndex = val.indexOf(":");
-            const assetId = delimiterIndex === -1 ? val : val.substring(0, delimiterIndex);
-            const roleName = delimiterIndex === -1 ? "" : val.substring(delimiterIndex + 1);
-            const resp = await client.query({
-                query: CATALOG_ITEM,
-                variables: {
-                    uuid: assetId || "",
-                },
-                fetchPolicy: "network-only", // to avoid caching
-            });
-            switch (resp.data.catalogItem.__typename) {
-                case "Group":
-                case "Resource": {
-                    const item = resp.data.catalogItem;
-                    const assetName = item.__typename === "Resource" ? item.displayName : item.name;
-                    const requestableRoles = (item.accessLevels || [])
-                        // TODO: Support okta azure apps ?.filter((role) => role.accessLevelName !== "") // This assumes length == 1
-                        .map((role) => ({
-                        id: role.accessLevelRemoteId,
-                        name: role.accessLevelName,
-                    }));
-                    const appId = ((_a = item.connection) === null || _a === void 0 ? void 0 : _a.id) || "";
-                    if (!(appId in metadata.requestMap)) {
-                        metadata.requestMap[appId] = {
-                            appName: ((_b = item.connection) === null || _b === void 0 ? void 0 : _b.displayName) || "",
-                            appId: appId,
-                            assets: {},
-                        };
-                    }
-                    const assetEntry = metadata.requestMap[appId].assets[assetId];
-                    if (!assetEntry) {
-                        metadata.requestMap[appId].assets[assetId] = {
-                            assetId: assetId,
-                            assetName: assetName,
-                            type: entityTypeFromString(item.__typename),
-                            roles: {},
-                        };
-                    }
-                    if (requestableRoles.length > 0 &&
-                        !(requestableRoles.length === 1 && requestableRoles[0].name === "")) {
-                        const selectedRole = requestableRoles.find((role) => role.name === roleName);
-                        if (selectedRole !== undefined) {
-                            if (!metadata.requestMap[appId].assets[assetId].roles) {
-                                metadata.requestMap[appId].assets[assetId].roles = {};
-                            }
-                            metadata.requestMap[appId].assets[assetId].roles[selectedRole.id] = {
-                                roleId: selectedRole.id,
-                                roleName: selectedRole.name,
-                            };
-                        }
-                        else {
-                            cmd.error(`Access level specified does not match one of ${assetName}'s defined access levels: ${requestableRoles.map((role) => `"${role.name}"`)}`);
-                        }
-                    }
-                    break;
-                }
-                default:
-                    cmd.error("Invalid asset id was passed in using the --id flag.");
-            }
-        }
-    }
-    catch (error) {
-        if (error instanceof Error || typeof error === "string") {
-            cmd.error(error);
-        }
-    }
-    return;
-}
-function bypassDuration(cmd, duration, metadata) {
-    if (duration === 0) {
-        metadata.durationInMinutes = undefined;
-        return;
-    }
-    const maxDuration = metadata.requestDefaults.maxDurationInMinutes;
-    if (maxDuration && duration > maxDuration) {
-        cmd.error(`The requested duration exceeds the allowed limit of ${maxDuration}`);
-    }
-    metadata.durationInMinutes = duration;
-}