opal-security 3.2.1 → 3.2.2

package/lib/lib/request/api/queries/requests.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryBundle = exports.queryRequests = exports.queryRequest = void 0;
+const graphql_1 = require("../../../../graphql");
+const RESOURCE_FRAGMENT = (0, graphql_1.graphql)(`
+  fragment ResourceFields on Resource {
+    displayName
+    id
+    connectionId
+    connection {
+      name
+      connectionType
+    }
+  }
+`);
+const GROUP_FRAGMENT = (0, graphql_1.graphql)(`
+  fragment GroupFields on Group {
+    name
+    id
+    connectionId
+    connection {
+      name
+      connectionType
+    }
+  }
+`);
+const REQUEST_FIELDS_FRAGMENT = (0, graphql_1.graphql)(`
+  fragment RequestFields on Request {
+    id
+    createdAt
+    status
+    durationInMinutes
+    reason
+    requester {
+      displayName
+    }
+    targetUser {
+      displayName
+    }
+    requestedResources {
+      resource {
+        ...ResourceFields
+      }
+      accessLevel {
+        accessLevelName
+        accessLevelRemoteId
+      }
+    }
+    requestedGroups {
+      group {
+        ...GroupFields
+      }
+      accessLevel {
+        accessLevelName
+        accessLevelRemoteId
+      }
+    }
+  }
+`);
+const GET_REQUEST = (0, graphql_1.graphql)(`
+  query GetRequest(
+  $id: RequestId!
+) {
+  request(input: {id: $id}) {
+    __typename
+    ... on RequestResult {
+      request {
+        ...RequestFields
+      }
+    }
+    ... on RequestNotFoundError {
+      message
+    }
+  }
+}
+`);
+const queryRequest = async (client, requestId) => {
+    const resp = await client.query({
+        query: GET_REQUEST,
+        variables: {
+            id: requestId,
+        },
+        fetchPolicy: "network-only", // to avoid caching
+    });
+    return resp;
+};
+exports.queryRequest = queryRequest;
+// TODO: Add date filters, search query,
+const GET_OUTGOING_REQUESTS = (0, graphql_1.graphql)(`
+  query GetRequests($showPendingOnly: Boolean!, $pageSize: Int) {
+  requests(input: {
+    requestType: OUTGOING
+    maxNumEntries: $pageSize
+    filters: {
+      showPendingOnly: $showPendingOnly
+    }
+    }) {
+    __typename
+    ... on RequestsResult {
+      requestType
+      requests {
+        ...RequestFields
+      }
+      
+    }
+  
+  }
+}`);
+const queryRequests = async (client, pageSize, showPendingOnly) => {
+    const resp = await client.query({
+        query: GET_OUTGOING_REQUESTS,
+        variables: {
+            pageSize: pageSize,
+            showPendingOnly: showPendingOnly,
+        },
+        fetchPolicy: "network-only", // to avoid caching
+    });
+    return resp;
+};
+exports.queryRequests = queryRequests;
+const GET_BUNDLE = (0, graphql_1.graphql)(`query GetBundle($id: BundleId!) {
+  bundle(input: { id: $id }) {
+    __typename
+    ... on BundleResult {
+      bundle {
+        name
+        id
+        items {
+          edges {
+            accessLevel {
+              accessLevelName
+              accessLevelRemoteId
+            }
+            node {
+              ... on Resource {
+                ...ResourceFields
+                isRequestable
+              }
+              ... on Group {
+                ...GroupFields
+                isRequestable
+              }
+            }
+          }
+        }
+      }
+    }
+    ... on BundleNotFoundError {
+      message
+    }
+  }
+}`);
+const queryBundle = async (client, bundleId) => {
+    const resp = await client.query({
+        query: GET_BUNDLE,
+        variables: {
+            id: bundleId,
+        },
+        fetchPolicy: "network-only", // to avoid caching
+    });
+    return resp;
+};
+exports.queryBundle = queryBundle;

package/lib/lib/request/api/queries/roles.d.ts

@@ -0,0 +1,5 @@
+import type { ApolloClient, NormalizedCacheObject } from "@apollo/client";
+import type { Command } from "@oclif/core";
+import type { PromptChoice } from "../../types";
+export declare function queryAssetRoles(cmd: Command, client: ApolloClient<NormalizedCacheObject>, assetType: string, assetId: string): Promise<PromptChoice[] | undefined>;
+export declare function queryAssociatedItems(cmd: Command, client: ApolloClient<NormalizedCacheObject>, id: string, input: string | undefined): Promise<PromptChoice[] | undefined>;

package/lib/lib/request/api/queries/roles.js

@@ -0,0 +1,239 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryAssetRoles = queryAssetRoles;
+exports.queryAssociatedItems = queryAssociatedItems;
+const graphql_1 = require("../../../../graphql");
+const graphql_2 = require("../../../../graphql/graphql");
+const labels_1 = require("../../../../labels");
+const RESOURCE_ROLES_QUERY = (0, graphql_1.graphql)(`
+  query ResourceAccessLevels($resourceId: ResourceId!) {
+    accessLevels(input: {
+      resourceId: $resourceId,
+      onlyMine: false,
+    }) {
+      __typename
+      ... on ResourceAccessLevelsResult {
+        accessLevels {
+          ... on ResourceAccessLevel {
+            accessLevelName
+            accessLevelRemoteId
+          }
+        }
+      }
+      ... on ResourceNotFoundError {
+        message
+      }
+    }
+  }
+`);
+const GROUP_ROLES_QUERY = (0, graphql_1.graphql)(`
+query GroupAccessLevels($groupId: GroupId!) {
+  groupAccessLevels(
+    input: { groupId: $groupId }
+  ) {
+    ... on GroupAccessLevelsResult {
+      groupId
+      accessLevels {
+        ... on GroupAccessLevel {
+            accessLevelName
+            accessLevelRemoteId
+          }
+      }
+    }
+  }
+}
+`);
+async function queryAssetRoles(cmd, client, assetType, assetId) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    try {
+        switch (assetType) {
+            case graphql_2.EntityType.Resource: {
+                const resp = await client.query({
+                    query: RESOURCE_ROLES_QUERY,
+                    variables: {
+                        resourceId: assetId,
+                    },
+                    fetchPolicy: "network-only", // to avoid caching
+                });
+                // no fall through doesn't consider process.exit();
+                let x;
+                switch (resp.data.accessLevels.__typename) {
+                    case "ResourceAccessLevelsResult":
+                        return (_c = (_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.accessLevels) === null || _b === void 0 ? void 0 : _b.accessLevels) === null || _c === void 0 ? void 0 : _c.map((role) => {
+                            return {
+                                message: role.accessLevelName || "",
+                                value: {
+                                    name: role.accessLevelName || "",
+                                    id: role.accessLevelRemoteId || "",
+                                },
+                            };
+                        });
+                    case "ResourceNotFoundError":
+                        x = cmd.error((_e = (_d = resp.data) === null || _d === void 0 ? void 0 : _d.accessLevels) === null || _e === void 0 ? void 0 : _e.message);
+                        break;
+                    default:
+                        cmd.error(resp.error || "Unknown error occurred.");
+                }
+                return;
+            }
+            case graphql_2.EntityType.Group: {
+                const resp = await client.query({
+                    query: GROUP_ROLES_QUERY,
+                    variables: {
+                        groupId: assetId,
+                    },
+                    fetchPolicy: "network-only", // to avoid caching
+                });
+                // no fall through doesn't consider process.exit();
+                let x;
+                switch (resp.data.groupAccessLevels.__typename) {
+                    case "GroupAccessLevelsResult":
+                        return (_h = (_g = (_f = resp.data) === null || _f === void 0 ? void 0 : _f.groupAccessLevels) === null || _g === void 0 ? void 0 : _g.accessLevels) === null || _h === void 0 ? void 0 : _h.map((role) => {
+                            return {
+                                message: role.accessLevelName,
+                                value: {
+                                    name: role.accessLevelName,
+                                    id: role.accessLevelRemoteId,
+                                },
+                            };
+                        });
+                    default:
+                        x = cmd.error(resp.error || "Unknown error occurred.");
+                }
+                return;
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}
+const ASSOCIATED_ITEMS_QUERY = (0, graphql_1.graphql)(`
+  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {
+    resource(input: {
+      id: $resourceId
+    }) {
+      __typename
+      ... on ResourceResult {
+        __typename
+        resource {
+          associatedItems(
+            first: 200
+            filters: {
+              searchQuery: {
+                contains: $searchQuery
+              }
+              access: REQUESTABLE
+              endUserVisible: true
+              entityType: {
+                in: [GROUP, RESOURCE]
+              }
+            }
+          ) {
+            edges {
+              __typename
+              ... on ResourceAssociatedItemEdge {
+                alias
+                node {
+                  __typename
+                  id
+                  name
+                  ... on Resource {
+                    accessLevels(
+                    filters: {
+                      skipRemoteAccessLevels: false # azure app roles are remote
+                    }
+                  ) {
+                    __typename
+                    accessLevelName
+                    accessLevelRemoteId
+                  }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+      ... on ResourceNotFoundError {
+        message
+      }
+    }
+  }
+`);
+function appRolesFromEdge(edge) {
+    var _a, _b, _c, _d;
+    switch (edge.node.__typename) {
+        case "Resource": {
+            if (edge.node.accessLevels && edge.node.accessLevels.length > 0) {
+                return edge.node.accessLevels.map((accessLevel) => ({
+                    message: accessLevel.accessLevelName || "No Role (Direct access)",
+                    value: {
+                        id: edge.node.id + accessLevel.accessLevelRemoteId,
+                        name: accessLevel.accessLevelName,
+                        type: labels_1.DisplayLabels[graphql_2.EntityType.Resource],
+                        toString: () => accessLevel.accessLevelName,
+                    },
+                }));
+            }
+            return [
+                {
+                    message: (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name,
+                    value: {
+                        id: edge.node.id,
+                        name: (_b = edge.alias) !== null && _b !== void 0 ? _b : edge.node.name,
+                        type: labels_1.DisplayLabels[graphql_2.EntityType.Resource],
+                        toString: () => { var _a; return (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name; },
+                    },
+                },
+            ];
+        }
+        case "Group":
+            return [
+                {
+                    message: `${(_c = edge.alias) !== null && _c !== void 0 ? _c : edge.node.name} ${graphql_2.EntityType.Group}`,
+                    value: {
+                        id: edge.node.id,
+                        name: (_d = edge.alias) !== null && _d !== void 0 ? _d : edge.node.name,
+                        type: labels_1.DisplayLabels[graphql_2.EntityType.Group],
+                        toString: () => { var _a; return (_a = edge.alias) !== null && _a !== void 0 ? _a : edge.node.name; },
+                    },
+                },
+            ];
+    }
+}
+async function queryAssociatedItems(cmd, client, id, input) {
+    var _a, _b;
+    try {
+        const resp = await client.query({
+            query: ASSOCIATED_ITEMS_QUERY,
+            variables: {
+                resourceId: id || "",
+                searchQuery: input || "",
+            },
+            fetchPolicy: "network-only", // to avoid caching
+        });
+        switch (resp.data.resource.__typename) {
+            case "ResourceResult": {
+                const associatedItems = resp.data.resource.resource.associatedItems.edges.filter((edge) => edge.__typename === "ResourceAssociatedItemEdge");
+                const initial = [];
+                for (const edge of associatedItems) {
+                    initial.push(...appRolesFromEdge(edge));
+                }
+                return initial;
+            }
+            case "ResourceNotFoundError":
+                cmd.log((_b = (_a = resp.data) === null || _a === void 0 ? void 0 : _a.resource) === null || _b === void 0 ? void 0 : _b.message);
+                break;
+            default:
+                cmd.error(resp.error || "Unknown error occurred.");
+        }
+    }
+    catch (error) {
+        if (error instanceof Error || typeof error === "string") {
+            cmd.error(error);
+        }
+    }
+}

package/lib/{utils → lib/request}/displays.d.ts

@@ -1,10 +1,12 @@
 import type { ApolloQueryResult } from "@apollo/client";
 import type { Command } from "@oclif/core/lib/command";
-import type { GetRequestQuery, GetRequestsQuery } from "../graphql/graphql";
-import { type RequestMap, type RequestMetadata } from "../lib/requests";
+import type { GetRequestQuery, GetRequestsQuery } from "../../graphql/graphql";
+import type { RequestMap, RequestMetadata } from "./types";
 export declare function headerMessage(cmd: Command): void;
 export declare function treeifyRequestMap(cmd: Command, requestMap: RequestMap): void;
 export declare function displayFinalRequestSummary(cmd: Command, metadata: RequestMetadata): void;
 export declare function getStyledStatus(status: string): string;
 export declare function displayRequestDetails(cmd: Command, requestResp: ApolloQueryResult<GetRequestQuery>): void;
 export declare function displayRequestListTable(cmd: Command, requestResp: ApolloQueryResult<GetRequestsQuery>): void;
+export declare function formatDuration(durationInMinutes: number): string;
+export declare function displayRequestAgain(cmd: Command, id: string): void;

package/lib/{utils → lib/request}/displays.js

@@ -6,8 +6,10 @@ exports.displayFinalRequestSummary = displayFinalRequestSummary;
 exports.getStyledStatus = getStyledStatus;
 exports.displayRequestDetails = displayRequestDetails;
 exports.displayRequestListTable = displayRequestListTable;
+exports.formatDuration = formatDuration;
+exports.displayRequestAgain = displayRequestAgain;
 const chalk_1 = require("chalk");
-const requests_1 = require("../lib/requests");
+const labels_1 = require("../../labels");
 const Table = require("cli-table3");
 function headerMessage(cmd) {
     console.clear();
@@ -15,6 +17,16 @@ function headerMessage(cmd) {
     cmd.log("Opal Access Request ✏️");
     cmd.log("Press Ctrl+C to cancel at any time.\n");
 }
+/*
+Example treeified output:
+
+Opal [App]
+└── Infosec Group [Group]
+└── Infosec Prod Databases [Group]
+MongoDB Atlas Test [App]
+└── my-mongo-db-atlas [Resource]
+    └── admin:test [Role]
+*/
 function treeifyRequestMap(cmd, requestMap) {
     for (const [_appId, appNode] of Object.entries(requestMap)) {
         // Print App title first (without tree lines)
@@ -22,7 +34,7 @@ function treeifyRequestMap(cmd, requestMap) {
         for (const [_assetId, assetNode] of Object.entries(appNode.assets)) {
             // If okta/azure asset with no role, change asset name
             const assetName = assetNode.assetName || "No Role (Direct access)";
-            cmd.log(`└── ${assetName} ${chalk_1.default.dim(`[${requests_1.DISPLAY_LABELS[assetNode.type]}]`)}`);
+            cmd.log(`└── ${assetName} ${chalk_1.default.dim(`[${labels_1.DisplayLabels[assetNode.type]}]`)}`);
             if (assetNode.roles !== undefined) {
                 for (const [_roleId, roleNode] of Object.entries(assetNode.roles)) {
                     const roleName = roleNode.roleName;
@@ -75,34 +87,37 @@ function displayRequestDetails(cmd, requestResp) {
     var _a, _b, _c, _d, _e, _f;
     switch (requestResp.data.request.__typename) {
         case "RequestResult": {
+            const request = requestResp.data.request.request;
             cmd.log("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
-            cmd.log(`Request Details ${chalk_1.default.cyan(requestResp.data.request.request.id)}`);
+            cmd.log(`Request Details ${chalk_1.default.cyan(request.id)}`);
             cmd.log("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
-            const status = requestResp.data.request.request.status;
+            const status = request.status;
             cmd.log(getStyledStatus(status));
             // Request users "Requested by: <requester> -> Requested for: <targetUser>"
-            const requester = (_a = requestResp.data.request.request.requester) === null || _a === void 0 ? void 0 : _a.displayName;
-            const targetUser = (_b = requestResp.data.request.request.targetUser) === null || _b === void 0 ? void 0 : _b.displayName;
+            const requester = (_a = request.requester) === null || _a === void 0 ? void 0 : _a.displayName;
+            const targetUser = (_b = request.targetUser) === null || _b === void 0 ? void 0 : _b.displayName;
             if (requester && targetUser) {
                 cmd.log(`${chalk_1.default.bold("Requested by:")} ${requester} ${chalk_1.default.gray("->")} ${chalk_1.default.bold("Requested for:")} ${targetUser}`);
             }
-            const durationInMinutes = requestResp.data.request.request.durationInMinutes;
+            const durationInMinutes = request.durationInMinutes;
             cmd.log(`${chalk_1.default.bold("Duration:")} ${durationInMinutes ? formatDuration(durationInMinutes) : "Permanent"}`);
-            const reason = requestResp.data.request.request.reason;
+            const reason = request.reason;
             if (reason) {
                 cmd.log(`${chalk_1.default.bold("Reason:")} "${chalk_1.default.italic(reason)}"`);
             }
             // Requested resources
-            const requestedResources = (_d = (_c = requestResp.data.request.request.requestedResources) === null || _c === void 0 ? void 0 : _c.map((resource) => {
-                var _a, _b, _c;
+            const requestedResources = (_d = (_c = request.requestedResources) === null || _c === void 0 ? void 0 : _c.map((resource) => {
+                var _a, _b;
                 if (((_a = resource.resource) === null || _a === void 0 ? void 0 : _a.__typename) === "Resource") {
-                    return formatAssetName((_b = resource.resource) === null || _b === void 0 ? void 0 : _b.displayName, ((_c = resource.accessLevel) === null || _c === void 0 ? void 0 : _c.accessLevelName) || "");
+                    const requestedResource = resource.resource;
+                    return formatAssetName(requestedResource.displayName, ((_b = resource.accessLevel) === null || _b === void 0 ? void 0 : _b.accessLevelName) || "");
                 }
             })) !== null && _d !== void 0 ? _d : [];
-            const requestedGroups = (_f = (_e = requestResp.data.request.request.requestedGroups) === null || _e === void 0 ? void 0 : _e.map((group) => {
-                var _a, _b, _c;
+            const requestedGroups = (_f = (_e = request.requestedGroups) === null || _e === void 0 ? void 0 : _e.map((group) => {
+                var _a, _b;
                 if (((_a = group.group) === null || _a === void 0 ? void 0 : _a.__typename) === "Group") {
-                    return formatAssetName((_b = group.group) === null || _b === void 0 ? void 0 : _b.name, ((_c = group.accessLevel) === null || _c === void 0 ? void 0 : _c.accessLevelName) || "");
+                    const requestedGroup = group.group;
+                    return formatAssetName(requestedGroup.name, ((_b = group.accessLevel) === null || _b === void 0 ? void 0 : _b.accessLevelName) || "");
                 }
             })) !== null && _f !== void 0 ? _f : [];
             const requestedItems = [...requestedResources, ...requestedGroups].join(", ");
@@ -131,7 +146,8 @@ function displayRequestListTable(cmd, requestResp) {
                     wordWrap: true,
                     wrapOnWordBoundary: false,
                 });
-                for (const request of requests) {
+                for (const req of requests) {
+                    const request = req;
                     const targetUser = (_a = request.targetUser) === null || _a === void 0 ? void 0 : _a.displayName;
                     const reason = request.reason;
                     const status = request.status;
@@ -139,15 +155,17 @@ function displayRequestListTable(cmd, requestResp) {
                         ? formatDuration(request.durationInMinutes)
                         : "Permanent";
                     const requestedResources = (_c = (_b = request.requestedResources) === null || _b === void 0 ? void 0 : _b.map((resource) => {
-                        var _a, _b, _c;
+                        var _a, _b;
                         if (((_a = resource.resource) === null || _a === void 0 ? void 0 : _a.__typename) === "Resource") {
-                            return formatAssetName((_b = resource.resource) === null || _b === void 0 ? void 0 : _b.displayName, ((_c = resource.accessLevel) === null || _c === void 0 ? void 0 : _c.accessLevelName) || "");
+                            const requestedResource = resource.resource;
+                            return formatAssetName(requestedResource.displayName, ((_b = resource.accessLevel) === null || _b === void 0 ? void 0 : _b.accessLevelName) || "");
                         }
                     })) !== null && _c !== void 0 ? _c : [];
                     const requestedGroups = (_e = (_d = request.requestedGroups) === null || _d === void 0 ? void 0 : _d.map((group) => {
-                        var _a, _b, _c;
+                        var _a, _b;
                         if (((_a = group.group) === null || _a === void 0 ? void 0 : _a.__typename) === "Group") {
-                            return formatAssetName((_b = group.group) === null || _b === void 0 ? void 0 : _b.name, ((_c = group.accessLevel) === null || _c === void 0 ? void 0 : _c.accessLevelName) || "");
+                            const requestedGroup = group.group;
+                            return formatAssetName(requestedGroup.name, ((_b = group.accessLevel) === null || _b === void 0 ? void 0 : _b.accessLevelName) || "");
                         }
                     })) !== null && _e !== void 0 ? _e : [];
                     const requestedItems = [
@@ -199,3 +217,7 @@ function formatAssetName(assetName, roleName) {
     }
     return str;
 }
+function displayRequestAgain(cmd, id) {
+    cmd.log(chalk_1.default.bold("\nTo request this again, run:"));
+    cmd.log(chalk_1.default.italic(`    opal request create --template ${id}\n`));
+}

package/lib/lib/request/prompts/apps-prompt.d.ts

@@ -0,0 +1,4 @@
+import type { ApolloClient, NormalizedCacheObject } from "@apollo/client";
+import type { Command } from "@oclif/core";
+import type { RequestMap } from "../types";
+export declare function selectRequestableItems(cmd: Command, client: ApolloClient<NormalizedCacheObject>, requestMap: RequestMap): Promise<void>;

package/lib/lib/request/prompts/apps-prompt.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectRequestableItems = selectRequestableItems;
+const _1 = require(".");
+const api_1 = require("../api");
+const { AutoComplete } = require("enquirer");
+async function selectRequestableItems(cmd, client, requestMap) {
+    const initial = (await (0, api_1.queryRequestableApps)(cmd, client, "")) || [];
+    const appPrompt = new AutoComplete({
+        name: "App",
+        message: "Select an app",
+        hint: _1.selectInstructions,
+        limit: 15,
+        choices: initial,
+        async suggest(input) {
+            const filteredChoices = await (0, api_1.queryRequestableApps)(cmd, client, input || "");
+            return filteredChoices || initial;
+        },
+    });
+    const App = await appPrompt.run();
+    // Set the app in the requestMap and call choose assets step
+    if (!(App.id in requestMap)) {
+        requestMap[App.id] = {
+            appId: App.id,
+            appType: App.type,
+            appName: App.name,
+            assets: {},
+        };
+    }
+    if (App.type === "OKTA_APP" || App.type === "AZURE_ENTERPRISE_APP") {
+        await (0, _1.chooseOktaAzureRoles)(cmd, client, App, requestMap);
+        return;
+    }
+    await (0, _1.chooseAssets)(cmd, client, App.id, requestMap);
+}

package/lib/lib/request/prompts/asset-prompt.d.ts

@@ -0,0 +1,5 @@
+import type { ApolloClient, NormalizedCacheObject } from "@apollo/client";
+import type { Command } from "@oclif/core";
+import { type EntityValue, type RequestMap } from "../types";
+export declare function chooseOktaAzureRoles(cmd: Command, client: ApolloClient<NormalizedCacheObject>, app: EntityValue, requestMap: RequestMap): Promise<void>;
+export declare function chooseAssets(cmd: Command, client: ApolloClient<NormalizedCacheObject>, appId: string, requestMap: RequestMap): Promise<void>;

package/lib/lib/request/prompts/asset-prompt.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.chooseOktaAzureRoles = chooseOktaAzureRoles;
+exports.chooseAssets = chooseAssets;
+const _1 = require(".");
+const api_1 = require("../api");
+const types_1 = require("../types");
+const { AutoComplete } = require("enquirer");
+async function chooseOktaAzureRoles(cmd, client, app, requestMap) {
+    const associatedItems = (await (0, api_1.queryAssociatedItems)(cmd, client, app.id, "")) || [];
+    const rolePrompt = new AutoComplete({
+        name: "Roles",
+        message: `Select a role for ${app.name}:`,
+        hint: _1.multiSelectInstructions,
+        limit: 15,
+        multiple: true,
+        async choices(input) {
+            if (!input)
+                return associatedItems;
+            const filteredChoices = await (0, api_1.queryAssociatedItems)(cmd, client, app.id, input);
+            return filteredChoices || associatedItems;
+        },
+        validate: (answer) => {
+            if (answer.length !== 1) {
+                return "Only one role is allowed to be requested for on Okta or Azure apps.";
+            }
+            return true;
+        },
+    });
+    const Roles = await rolePrompt.run();
+    const entry = requestMap[app.id];
+    for (const role of Roles) {
+        if (!(role.id in entry.assets)) {
+            entry.assets[role.id] = {
+                assetId: role.id,
+                assetName: role.name,
+                type: (0, types_1.entityTypeFromString)(role.type),
+                roles: {},
+            };
+        }
+    }
+}
+async function chooseAssets(cmd, client, appId, requestMap) {
+    const initial = (await (0, api_1.queryRequestableAssets)(cmd, client, appId, "")) || [];
+    const assetPrompt = new AutoComplete({
+        name: "Assets",
+        message: "Select one or more assets:",
+        hint: _1.multiSelectInstructions,
+        limit: 15,
+        multiple: true,
+        async choices(input) {
+            if (!input) {
+                return initial;
+            }
+            const filteredChoices = await (0, api_1.queryRequestableAssets)(cmd, client, appId, input);
+            return filteredChoices || initial;
+        },
+        validate: (answer) => {
+            if (answer.length < 1) {
+                return "You must select at least one item.";
+            }
+            return true;
+        },
+    });
+    const Assets = await assetPrompt.run();
+    const entry = requestMap[appId];
+    for (const asset of Assets) {
+        if (entry === undefined) {
+            throw new Error(`Error formatting app ${appId} in request`);
+        }
+        if (!(asset.id in entry.assets)) {
+            entry.assets[asset.id] = {
+                assetId: asset.id,
+                assetName: asset.name,
+                type: asset.type,
+                roles: {},
+            };
+        }
+        await (0, _1.chooseRoles)(cmd, client, appId, asset.id, requestMap);
+    }
+}