opal-security 3.2.1 → 3.2.2

package/lib/labels.d.ts

@@ -0,0 +1,3 @@
+import { ConnectionType, EntityType } from "./graphql/graphql";
+export declare const connectionTypeLabelByType: Record<ConnectionType, string>;
+export declare const DisplayLabels: Partial<Record<EntityType, string>>;

package/lib/labels.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DisplayLabels = exports.connectionTypeLabelByType = void 0;
+const graphql_1 = require("./graphql/graphql");
+exports.connectionTypeLabelByType = {
+    [graphql_1.ConnectionType.ActiveDirectory]: "Active Directory",
+    [graphql_1.ConnectionType.Aws]: "Amazon Web Services (Legacy)",
+    [graphql_1.ConnectionType.AwsSso]: "Amazon Web Services",
+    [graphql_1.ConnectionType.Custom]: "Custom Integration",
+    [graphql_1.ConnectionType.CustomConnector]: "Custom App Connector",
+    [graphql_1.ConnectionType.Duo]: "Duo",
+    [graphql_1.ConnectionType.Gcp]: "Google Cloud Platform",
+    [graphql_1.ConnectionType.GitHub]: "GitHub",
+    [graphql_1.ConnectionType.GitLab]: "GitLab",
+    [graphql_1.ConnectionType.GoogleGroups]: "Google Groups",
+    [graphql_1.ConnectionType.GoogleWorkspace]: "Google Workspace",
+    [graphql_1.ConnectionType.Ldap]: "LDAP",
+    [graphql_1.ConnectionType.Mongo]: "MongoDB Database",
+    [graphql_1.ConnectionType.MongoAtlas]: "MongoDB Atlas Database",
+    [graphql_1.ConnectionType.OktaDirectory]: "Okta Directory",
+    [graphql_1.ConnectionType.Opal]: "Opal",
+    [graphql_1.ConnectionType.Pagerduty]: "PagerDuty",
+    [graphql_1.ConnectionType.Tailscale]: "Tailscale",
+    [graphql_1.ConnectionType.Salesforce]: "Salesforce",
+    [graphql_1.ConnectionType.Workday]: "Workday",
+    [graphql_1.ConnectionType.Mysql]: "MySQL",
+    [graphql_1.ConnectionType.Mariadb]: "MariaDB",
+    [graphql_1.ConnectionType.Postgres]: "PostgreSQL",
+    [graphql_1.ConnectionType.Teleport]: "Teleport",
+    [graphql_1.ConnectionType.AzureAd]: "Azure",
+    [graphql_1.ConnectionType.Snowflake]: "Snowflake",
+    [graphql_1.ConnectionType.Databricks]: "Databricks",
+};
+exports.DisplayLabels = {
+    [graphql_1.EntityType.Resource]: "Resource",
+    [graphql_1.EntityType.Group]: "Group",
+};

package/lib/lib/request/api/index.d.ts

@@ -0,0 +1,6 @@
+export { queryRequestableApps } from "./queries/apps";
+export { queryRequestableAssets, queryCatalogItems } from "./queries/assets";
+export { queryAssetRoles, queryAssociatedItems } from "./queries/roles";
+export { queryRequestDefaults } from "./queries/request-defaults";
+export { queryRequest, queryRequests } from "./queries/requests";
+export { createRequest } from "./mutations/create-request";

package/lib/lib/request/api/index.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRequest = exports.queryRequests = exports.queryRequest = exports.queryRequestDefaults = exports.queryAssociatedItems = exports.queryAssetRoles = exports.queryCatalogItems = exports.queryRequestableAssets = exports.queryRequestableApps = void 0;
+// Query exports
+var apps_1 = require("./queries/apps");
+Object.defineProperty(exports, "queryRequestableApps", { enumerable: true, get: function () { return apps_1.queryRequestableApps; } });
+var assets_1 = require("./queries/assets");
+Object.defineProperty(exports, "queryRequestableAssets", { enumerable: true, get: function () { return assets_1.queryRequestableAssets; } });
+Object.defineProperty(exports, "queryCatalogItems", { enumerable: true, get: function () { return assets_1.queryCatalogItems; } });
+var roles_1 = require("./queries/roles");
+Object.defineProperty(exports, "queryAssetRoles", { enumerable: true, get: function () { return roles_1.queryAssetRoles; } });
+Object.defineProperty(exports, "queryAssociatedItems", { enumerable: true, get: function () { return roles_1.queryAssociatedItems; } });
+var request_defaults_1 = require("./queries/request-defaults");
+Object.defineProperty(exports, "queryRequestDefaults", { enumerable: true, get: function () { return request_defaults_1.queryRequestDefaults; } });
+var requests_1 = require("./queries/requests");
+Object.defineProperty(exports, "queryRequest", { enumerable: true, get: function () { return requests_1.queryRequest; } });
+Object.defineProperty(exports, "queryRequests", { enumerable: true, get: function () { return requests_1.queryRequests; } });
+// Mutation exports
+var create_request_1 = require("./mutations/create-request");
+Object.defineProperty(exports, "createRequest", { enumerable: true, get: function () { return create_request_1.createRequest; } });

package/lib/lib/request/api/mutations/create-request.d.ts

@@ -0,0 +1,8 @@
+import type { ApolloClient, NormalizedCacheObject } from "@apollo/client";
+import type { Command } from "@oclif/core";
+import type { RequestedGroupInput, RequestedResourceInput } from "../../../../graphql/graphql";
+export declare function createRequest(cmd: Command, client: ApolloClient<NormalizedCacheObject>, requestedResources: RequestedResourceInput[], requestedGroups: RequestedGroupInput[], reason: string, durationInMinutes?: number): Promise<{
+    __typename?: "Request";
+    id: string;
+    status: import("../../../../graphql/graphql").RequestStatus;
+} | undefined>;

package/lib/lib/request/api/mutations/create-request.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRequest = createRequest;
+const graphql_1 = require("../../../../graphql");
+const CREATE_REQUEST_MUTATION = (0, graphql_1.graphql)(`
+  mutation CreateRequest(
+    $requestedResources: [RequestedResourceInput!]!
+    $requestedGroups: [RequestedGroupInput!]!
+    $reason: String!
+    $durationInMinutes: Int
+  ) {
+    createRequest(
+      input: {
+        requestedResources: $requestedResources
+        requestedGroups: $requestedGroups
+        reason: $reason
+        durationInMinutes: $durationInMinutes
+      }
+    ) {
+      ... on CreateRequestResult {
+        request {
+          id
+          status
+        }
+      }
+      ... on RequestDurationTooLargeError {
+        message
+      }
+      ... on RequestRequiresUserAuthTokenForConnectionError {
+        message
+      }
+      ... on NoReviewersSetForOwnerError {
+        message
+        ownerId
+      }
+      ... on NoReviewersSetForResourceError {
+        message
+        resourceId
+      }
+      ... on NoReviewersSetForGroupError {
+        message
+        groupId
+      }
+      ... on NoManagerSetForRequestingUserError {
+        message
+      }
+      ... on MfaInvalidError {
+        message
+      }
+      ... on BulkRequestTooLargeError {
+        message
+      }
+      ... on ItemCannotBeRequestedError {
+        message
+      }
+      ... on UserCannotRequestAccessForTargetGroupError {
+        message
+        groupId
+        userId
+      }
+      ... on GroupNestingNotAllowedError {
+        message
+        fromGroupId
+        toGroupId
+      }
+      ... on TargetUserHasNestedAccessError {
+        message
+        groupIds
+      }
+      ... on RequestReasonMissingError {
+        message
+      }
+      ... on RequestFieldValueMissingError {
+        message
+        fieldName
+      }
+      ... on LinkedGroupNotRequestableError {
+        message
+        sourceGroupId
+        groupBindingId
+      }
+      ... on RequestReasonBelowMinLengthError {
+        message
+      }
+
+    }
+  }
+`);
+async function createRequest(cmd, client, requestedResources, requestedGroups, reason, durationInMinutes) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t;
+    try {
+        const resp = await client.mutate({
+            mutation: CREATE_REQUEST_MUTATION,
+            variables: {
+                requestedResources: requestedResources,
+                requestedGroups: requestedGroups,
+                reason: reason,
+                durationInMinutes: durationInMinutes,
+            },
+        });
+        switch ((_a = resp.data) === null || _a === void 0 ? void 0 : _a.createRequest.__typename) {
+            case "CreateRequestResult":
+                return (_b = resp.data) === null || _b === void 0 ? void 0 : _b.createRequest.request;
+            case "RequestDurationTooLargeError":
+                cmd.log((_c = resp.data) === null || _c === void 0 ? void 0 : _c.createRequest.message);
+                break;
+            case "RequestRequiresUserAuthTokenForConnectionError":
+                cmd.log((_d = resp.data) === null || _d === void 0 ? void 0 : _d.createRequest.message);
+                break;
+            case "NoReviewersSetForOwnerError":
+                cmd.log((_e = resp.data) === null || _e === void 0 ? void 0 : _e.createRequest.message);
+                break;
+            case "NoReviewersSetForResourceError":
+                cmd.log((_f = resp.data) === null || _f === void 0 ? void 0 : _f.createRequest.message);
+                break;
+            case "NoReviewersSetForGroupError":
+                cmd.log((_g = resp.data) === null || _g === void 0 ? void 0 : _g.createRequest.message);
+                break;
+            case "NoManagerSetForRequestingUserError":
+                cmd.log((_h = resp.data) === null || _h === void 0 ? void 0 : _h.createRequest.message);
+                break;
+            case "MfaInvalidError":
+                cmd.log((_j = resp.data) === null || _j === void 0 ? void 0 : _j.createRequest.message);
+                break;
+            case "BulkRequestTooLargeError":
+                cmd.log((_k = resp.data) === null || _k === void 0 ? void 0 : _k.createRequest.message);
+                break;
+            case "ItemCannotBeRequestedError":
+                cmd.log((_l = resp.data) === null || _l === void 0 ? void 0 : _l.createRequest.message);
+                break;
+            case "UserCannotRequestAccessForTargetGroupError":
+                cmd.log((_m = resp.data) === null || _m === void 0 ? void 0 : _m.createRequest.message);
+                break;
+            case "GroupNestingNotAllowedError":
+                cmd.log((_o = resp.data) === null || _o === void 0 ? void 0 : _o.createRequest.message);
+                break;
+            case "TargetUserHasNestedAccessError":
+                cmd.log((_p = resp.data) === null || _p === void 0 ? void 0 : _p.createRequest.message);
+                break;
+            case "RequestReasonMissingError":
+                cmd.log((_q = resp.data) === null || _q === void 0 ? void 0 : _q.createRequest.message);
+                break;
+            case "RequestFieldValueMissingError":
+                cmd.log((_r = resp.data) === null || _r === void 0 ? void 0 : _r.createRequest.message);
+                break;
+            case "LinkedGroupNotRequestableError":
+                cmd.log((_s = resp.data) === null || _s === void 0 ? void 0 : _s.createRequest.message);
+                break;
+            case "RequestReasonBelowMinLengthError":
+                cmd.log((_t = resp.data) === null || _t === void 0 ? void 0 : _t.createRequest.message);
+                break;
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}

package/lib/lib/request/api/queries/apps.d.ts

@@ -0,0 +1,4 @@
+import type { ApolloClient, NormalizedCacheObject } from "@apollo/client";
+import type { Command } from "@oclif/core";
+import type { PromptChoice } from "../../types";
+export declare function queryRequestableApps(cmd: Command, client: ApolloClient<NormalizedCacheObject>, input: string | undefined): Promise<PromptChoice[] | undefined>;

package/lib/lib/request/api/queries/apps.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryRequestableApps = queryRequestableApps;
+const graphql_1 = require("../../../../graphql");
+// TODO: add pagination ability from CLI. (Load more...) option
+const GET_REQUESTABLE_APPS_QUERY = (0, graphql_1.graphql)(`
+  query GetRequestableAppsQuery($searchQuery: String) {
+    appsV2(
+      filters: {
+        access: REQUESTABLE
+        searchQuery: $searchQuery
+      }
+    ) @connection(key: "paginated-app-dropdown") {
+      edges {
+        node {
+          id
+          displayName
+          ... on Connection {
+            connectionType
+          }
+          ... on Resource {
+            resourceType
+          }
+        }
+      }
+      pageInfo {
+        hasNextPage
+        hasPreviousPage
+        startCursor
+        endCursor
+      }
+    }
+  }
+  `);
+async function queryRequestableApps(cmd, client, input) {
+    var _a, _b;
+    try {
+        const resp = await client.query({
+            query: GET_REQUESTABLE_APPS_QUERY,
+            variables: {
+                searchQuery: input || "",
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+        return (_b = (_a = resp === null || resp === void 0 ? void 0 : resp.data) === null || _a === void 0 ? void 0 : _a.appsV2) === null || _b === void 0 ? void 0 : _b.edges.map((edge) => {
+            let type = undefined;
+            switch (edge.node.__typename) {
+                case "Resource":
+                    type = edge.node.resourceType;
+                    break;
+                case "Connection":
+                    type = edge.node.connectionType;
+                    break;
+                default:
+                    type = edge.node.__typename;
+            }
+            return {
+                message: `${edge.node.displayName} [${type}]`,
+                value: {
+                    id: edge.node.id,
+                    name: edge.node.displayName,
+                    type: type,
+                    toString: () => edge.node.displayName,
+                },
+            };
+        });
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}

package/lib/lib/request/api/queries/assets.d.ts

@@ -0,0 +1,6 @@
+import type { ApolloClient, ApolloQueryResult, NormalizedCacheObject } from "@apollo/client";
+import type { Command } from "@oclif/core";
+import type { GetCatalogItemQuery } from "../../../../graphql/graphql";
+import { type PromptChoice } from "../../types";
+export declare function queryRequestableAssets(cmd: Command, client: ApolloClient<NormalizedCacheObject>, appId: string, input: string | undefined): Promise<PromptChoice[] | undefined>;
+export declare function queryCatalogItems(cmd: Command, client: ApolloClient<NormalizedCacheObject>, assetId: string): Promise<ApolloQueryResult<GetCatalogItemQuery>>;

package/lib/lib/request/api/queries/assets.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryRequestableAssets = queryRequestableAssets;
+exports.queryCatalogItems = queryCatalogItems;
+const graphql_1 = require("../../../../graphql");
+const types_1 = require("../../types");
+const GET_ASSETS_QUERY = (0, graphql_1.graphql)(`
+  query PaginatedEntityDropdown(
+  $id: UUID!
+  $searchQuery: String
+) {
+  app(id: $id) {
+    __typename
+    ... on App {
+      id
+      items(
+        input: {
+          access: REQUESTABLE
+          searchQuery: $searchQuery
+          includeOnlyRequestable: true
+        }
+      ) {
+        items {
+          key
+          resource {
+            id
+            name
+          }
+          group {
+            id
+            name
+          }
+        }
+        cursor
+      }
+    }
+    ... on AppNotFoundError {
+      message
+    }
+  }
+}
+`);
+async function queryRequestableAssets(cmd, client, appId, input) {
+    var _a, _b, _c, _d, _e, _f;
+    try {
+        const resp = await client.query({
+            query: GET_ASSETS_QUERY,
+            variables: {
+                id: appId || "",
+                searchQuery: input || "",
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+        // no fall through doesn't consider process.exit();
+        let x;
+        switch (resp.data.app.__typename) {
+            case "App":
+                return (_d = (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.app) === null || _b === void 0 ? void 0 : _b.items) === null || _c === void 0 ? void 0 : _c.items) === null || _d === void 0 ? void 0 : _d.map((item) => {
+                    var _a, _b, _c, _d, _e, _f, _g, _h;
+                    const name = ((_a = item.resource) === null || _a === void 0 ? void 0 : _a.name) || ((_b = item.group) === null || _b === void 0 ? void 0 : _b.name);
+                    const id = ((_c = item.resource) === null || _c === void 0 ? void 0 : _c.id) || ((_d = item.group) === null || _d === void 0 ? void 0 : _d.id);
+                    const type = ((_e = item.resource) === null || _e === void 0 ? void 0 : _e.__typename) || ((_f = item.group) === null || _f === void 0 ? void 0 : _f.__typename);
+                    return {
+                        message: `${name} [${type}]`,
+                        value: {
+                            name: name || "",
+                            id: id || "",
+                            type: (0, types_1.entityTypeFromString)(((_g = item.resource) === null || _g === void 0 ? void 0 : _g.__typename) || ((_h = item.group) === null || _h === void 0 ? void 0 : _h.__typename)),
+                        },
+                    };
+                });
+            case "AppNotFoundError":
+                x = cmd.error((_f = (_e = resp.data) === null || _e === void 0 ? void 0 : _e.app) === null || _f === void 0 ? void 0 : _f.message);
+                break;
+            default:
+                cmd.error(resp.error || "Unknown error occurred.");
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
+const CATALOG_ITEM = (0, graphql_1.graphql)(`
+  query GetCatalogItem($uuid: UUID!) {
+    catalogItem(id: $uuid) {
+      __typename
+      ... on Connection {
+        id
+        displayName
+      }
+      ... on Resource {
+        id
+        displayName
+        connection {
+          id
+          displayName
+        }
+        accessLevels{
+          accessLevelName
+          accessLevelRemoteId
+        }
+      }
+      ...on Group {
+        id
+        name
+        connection {
+          id
+          displayName
+        }
+        accessLevels{
+          accessLevelName
+          accessLevelRemoteId
+        }
+      }
+      ... on UserFacingError {
+        message
+      }
+    }
+  }
+  `);
+async function queryCatalogItems(cmd, client, assetId) {
+    try {
+        return await client.query({
+            query: CATALOG_ITEM,
+            variables: {
+                uuid: assetId || "",
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+    }
+    catch (_a) {
+        cmd.error("Unknown error retreiving catalog items");
+    }
+}

package/lib/lib/request/api/queries/request-defaults.d.ts

@@ -0,0 +1,5 @@
+import type { ApolloClient, NormalizedCacheObject } from "@apollo/client";
+import type { Command } from "@oclif/core";
+import type { RequestConfigurationGroupInput, RequestConfigurationResourceInput } from "../../../../graphql/graphql";
+import type { RequestDefaults } from "../../types";
+export declare function queryRequestDefaults(cmd: Command, client: ApolloClient<NormalizedCacheObject>, requestedResources: RequestConfigurationResourceInput[], requestedGroups: RequestConfigurationGroupInput[]): Promise<RequestDefaults | undefined>;

package/lib/lib/request/api/queries/request-defaults.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryRequestDefaults = queryRequestDefaults;
+const graphql_1 = require("../../../../graphql");
+const REQUEST_DEFAULTS_QUERY = (0, graphql_1.graphql)(`
+  query RequestDefaults(
+    $requestedResources: [RequestConfigurationResourceInput!]!
+    $requestedGroups: [RequestConfigurationGroupInput!]!
+    ) {
+    requestDefaults(input: {
+      requestedResources: $requestedResources,
+      requestedGroups: $requestedGroups,
+      }
+    ) {
+      ... on RequestDefaults {
+        durationOptions {
+          durationInMinutes
+          label
+        }
+        recommendedDurationInMinutes
+        defaultDurationInMinutes
+        maxDurationInMinutes
+        requireSupportTicket
+        reasonOptional
+        requesterIsAdmin
+        messages {
+          entityId
+          level
+          code
+        }
+      }
+    }
+  }`);
+async function queryRequestDefaults(cmd, client, requestedResources, requestedGroups) {
+    try {
+        const resp = await client.query({
+            query: REQUEST_DEFAULTS_QUERY,
+            variables: {
+                requestedResources: requestedResources,
+                requestedGroups: requestedGroups,
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+        return resp.data.requestDefaults;
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}

package/lib/lib/request/api/queries/requests.d.ts

@@ -0,0 +1,4 @@
+import type { ApolloClient, NormalizedCacheObject } from "@apollo/client";
+export declare const queryRequest: (client: ApolloClient<NormalizedCacheObject>, requestId: string) => Promise<import("@apollo/client").ApolloQueryResult<import("../../../../graphql/graphql").GetRequestQuery>>;
+export declare const queryRequests: (client: ApolloClient<NormalizedCacheObject>, pageSize: number, showPendingOnly: boolean) => Promise<import("@apollo/client").ApolloQueryResult<import("../../../../graphql/graphql").GetRequestsQuery>>;
+export declare const queryBundle: (client: ApolloClient<NormalizedCacheObject>, bundleId: string) => Promise<import("@apollo/client").ApolloQueryResult<import("../../../../graphql/graphql").GetBundleQuery>>;