opal-security 4.1.0 → 5.0.1

package/build/commands/ssh/copyTo.d.ts

@@ -8,7 +8,6 @@ export default class StartSCPSession extends Command {
         dest: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         user: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         id: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        sessionId: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/build/commands/ssh/copyTo.js

@@ -3,7 +3,7 @@ import { handleError } from "../../lib/apollo.js";
 import { runCommandSpawn, setMostRecentCommand } from "../../lib/cmd.js";
 import { SHARED_FLAGS } from "../../lib/flags.js";
 import { DEFAULT_ACCESS_LEVEL } from "../../lib/resources.js";
-import { getOrCreateSession } from "../../lib/sessions.js";
+import { createSession } from "../../lib/sessions.js";
 import { assertSessionManagerPluginExists, selectComputeInstance, } from "../../lib/ssh.js";
 import { Ec2SessionMetadataFragment } from "./start.js";
 class StartSCPSession extends Command {
@@ -25,11 +25,11 @@ class StartSCPSession extends Command {
             instanceId = selectedInstance.id;
             instanceName = selectedInstance.name;
         }
-        const session = await getOrCreateSession(this, instanceId, DEFAULT_ACCESS_LEVEL, sessionId, Ec2SessionMetadataFragment);
+        const session = await createSession(this, instanceId, DEFAULT_ACCESS_LEVEL, sessionId, Ec2SessionMetadataFragment);
         if (!session) {
             return;
         }
-        const metadata = session.metadata;
+        const metadata = session.sessionMetadata;
         switch (metadata === null || metadata === void 0 ? void 0 : metadata.__typename) {
             case "AwsIamFederatedSSMSession": {
                 const envVars = {
@@ -44,7 +44,7 @@ class StartSCPSession extends Command {
                 break;
             }
             default:
-                return handleError(this, undefined, session);
+                return handleError(this, undefined);
         }
     }
 }
@@ -73,6 +73,5 @@ StartSCPSession.flags = {
         description: "The user you want to run SCP over. Keep in mind not all users will have access to each other's home directory.",
     }),
     id: SHARED_FLAGS.id,
-    sessionId: SHARED_FLAGS.sessionId,
 };
 export default StartSCPSession;

package/build/commands/ssh/start.d.ts

@@ -6,8 +6,6 @@ export default class StartSSHSession extends Command {
     static flags: {
         help: import("@oclif/core/lib/interfaces").BooleanFlag<void>;
         id: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        sessionId: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        refresh: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/build/commands/ssh/start.js

@@ -6,7 +6,7 @@ import { getAwsConfigUpdateCmd } from "../../lib/aws.js";
 import { setMostRecentCommand, startInteractiveShell } from "../../lib/cmd.js";
 import { SHARED_FLAGS } from "../../lib/flags.js";
 import { DEFAULT_ACCESS_LEVEL } from "../../lib/resources.js";
-import { getOrCreateSession, getSessionExpirationMessage, } from "../../lib/sessions.js";
+import { createSession, getSessionExpirationMessage } from "../../lib/sessions.js";
 import { assertSessionManagerPluginExists, selectComputeInstance, } from "../../lib/ssh.js";
 export const Ec2SessionMetadataFragment = `
 ... on AwsIamFederatedSSMSession {
@@ -56,14 +56,14 @@ class StartSSHSession extends Command {
             }
             instanceName = (resp === null || resp === void 0 ? void 0 : resp.data.resource.resource.name) || "ssh-instance";
         }
-        const session = await getOrCreateSession(this, instanceId, DEFAULT_ACCESS_LEVEL, sessionId, Ec2SessionMetadataFragment, flags.refresh);
+        const session = await createSession(this, instanceId, DEFAULT_ACCESS_LEVEL, sessionId, Ec2SessionMetadataFragment);
         if (!session) {
             return;
         }
-        const metadata = session.metadata;
+        const metadata = session.sessionMetadata;
         switch (metadata === null || metadata === void 0 ? void 0 : metadata.__typename) {
             case "AwsIamFederatedSSMSession": {
-                this.log(`\n🕰  Connecting to a session that expires in ${getSessionExpirationMessage(session)}.`);
+                this.log(`\n🕰  Connecting to a session that expires in ${getSessionExpirationMessage(session.session)}.`);
                 const updateAwsConfigCommand = getAwsConfigUpdateCmd(instanceName, metadata.awsAccessKeyId, metadata.awsSecretAccessKey, metadata.awsSessionToken);
                 const sessionCmd = `aws ssm start-session --target ${metadata.ec2InstanceId} --region ${metadata.ec2Region} --profile opal`;
                 // TODO: Unfortunately allowing SSH over SSM disables logging
@@ -74,7 +74,7 @@ class StartSSHSession extends Command {
                 break;
             }
             default:
-                return handleError(this, undefined, session);
+                return handleError(this, undefined);
         }
     }
 }
@@ -92,7 +92,5 @@ StartSSHSession.flags = {
     //   required: false,
     //   default: "ssm-user",
     // }),
-    sessionId: SHARED_FLAGS.sessionId,
-    refresh: SHARED_FLAGS.refresh,
 };
 export default StartSSHSession;

package/build/graphql/gql.d.ts

@@ -14,6 +14,8 @@ import * as types from "./graphql.js";
 type Documents = {
     "\nquery GetGroup($id: GroupId!) {\n    group(input: { id: $id }) {\n    __typename\n    ... on GroupResult {\n      group {\n        name\n        id\n        description\n        groupType\n        adminOwnerId\n        groupLeaders {\n            fullName\n            email\n            id\n        }\n        connection {\n            name\n            id\n            connectionType\n        }\n        paginatedGroupUsers {\n            totalNumGroupUsers\n            groupUsers {\n                user {\n                    fullName\n                    email\n                    id\n                }\n            }\n        }\n      }\n    }\n    ... on GroupNotFoundError {\n      message\n    }\n  }\n}": typeof types.GetGroupDocument;
     "\nquery CheckAuthSessionQuery {\n  organizationSettings {\n    ... on OrganizationSettingsResult {\n      settings {\n        id\n      }\n    }\n  }\n}\n": typeof types.CheckAuthSessionQueryDocument;
+    "\n      query GetLastMfaAt {\n        lastMfaAt\n      }\n    ": typeof types.GetLastMfaAtDocument;
+    "\n      query HasValidOidcIdToken($oidcProviderType: OIDCProviderType!) {\n        hasValidOidcToken(oidcProviderType: $oidcProviderType)\n      }\n    ": typeof types.HasValidOidcIdTokenDocument;
     "\n  mutation CreateRequest(\n    $requestedResources: [RequestedResourceInput!]!\n    $requestedGroups: [RequestedGroupInput!]!\n    $reason: String!\n    $durationInMinutes: Int\n  ) {\n    createRequest(\n      input: {\n        requestedResources: $requestedResources\n        requestedGroups: $requestedGroups\n        reason: $reason\n        durationInMinutes: $durationInMinutes\n      }\n    ) {\n      ... on CreateRequestResult {\n        request {\n          id\n          status\n        }\n      }\n      ... on RequestDurationTooLargeError {\n        message\n      }\n      ... on RequestRequiresUserAuthTokenForConnectionError {\n        message\n      }\n      ... on NoReviewersSetForOwnerError {\n        message\n        ownerId\n      }\n      ... on NoReviewersSetForResourceError {\n        message\n        resourceId\n      }\n      ... on NoReviewersSetForGroupError {\n        message\n        groupId\n      }\n      ... on NoManagerSetForRequestingUserError {\n        message\n      }\n      ... on MfaInvalidError {\n        message\n      }\n      ... on BulkRequestTooLargeError {\n        message\n      }\n      ... on ItemCannotBeRequestedError {\n        message\n      }\n      ... on UserCannotRequestAccessForTargetGroupError {\n        message\n        groupId\n        userId\n      }\n      ... on GroupNestingNotAllowedError {\n        message\n        fromGroupId\n        toGroupId\n      }\n      ... on TargetUserHasNestedAccessError {\n        message\n        groupIds\n      }\n      ... on RequestReasonMissingError {\n        message\n      }\n      ... on RequestFieldValueMissingError {\n        message\n        fieldName\n      }\n      ... on LinkedGroupNotRequestableError {\n        message\n        sourceGroupId\n        groupBindingId\n      }\n      ... on RequestReasonBelowMinLengthError {\n        message\n      }\n\n    }\n  }\n": typeof types.CreateRequestDocument;
     '\n  query GetRequestableAppsQuery($searchQuery: String) {\n    appsV2(\n      filters: {\n        access: REQUESTABLE\n        searchQuery: $searchQuery\n      }\n    ) @connection(key: "paginated-app-dropdown") {\n      edges {\n        node {\n          id\n          displayName\n          ... on Connection {\n            connectionType\n          }\n          ... on Resource {\n            resourceType\n          }\n        }\n      }\n      pageInfo {\n        hasNextPage\n        hasPreviousPage\n        startCursor\n        endCursor\n      }\n    }\n  }\n  ': typeof types.GetRequestableAppsQueryDocument;
     "\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n          }\n          group {\n            id\n            name\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n": typeof types.PaginatedEntityDropdownDocument;
@@ -51,6 +53,14 @@ export declare function graphql(source: "\nquery GetGroup($id: GroupId!) {\n
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */
 export declare function graphql(source: "\nquery CheckAuthSessionQuery {\n  organizationSettings {\n    ... on OrganizationSettingsResult {\n      settings {\n        id\n      }\n    }\n  }\n}\n"): (typeof documents)["\nquery CheckAuthSessionQuery {\n  organizationSettings {\n    ... on OrganizationSettingsResult {\n      settings {\n        id\n      }\n    }\n  }\n}\n"];
+/**
+ * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
+ */
+export declare function graphql(source: "\n      query GetLastMfaAt {\n        lastMfaAt\n      }\n    "): (typeof documents)["\n      query GetLastMfaAt {\n        lastMfaAt\n      }\n    "];
+/**
+ * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
+ */
+export declare function graphql(source: "\n      query HasValidOidcIdToken($oidcProviderType: OIDCProviderType!) {\n        hasValidOidcToken(oidcProviderType: $oidcProviderType)\n      }\n    "): (typeof documents)["\n      query HasValidOidcIdToken($oidcProviderType: OIDCProviderType!) {\n        hasValidOidcToken(oidcProviderType: $oidcProviderType)\n      }\n    "];
 /**
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */

package/build/graphql/gql.js

@@ -3,6 +3,8 @@ import * as types from "./graphql.js";
 const documents = {
     "\nquery GetGroup($id: GroupId!) {\n    group(input: { id: $id }) {\n    __typename\n    ... on GroupResult {\n      group {\n        name\n        id\n        description\n        groupType\n        adminOwnerId\n        groupLeaders {\n            fullName\n            email\n            id\n        }\n        connection {\n            name\n            id\n            connectionType\n        }\n        paginatedGroupUsers {\n            totalNumGroupUsers\n            groupUsers {\n                user {\n                    fullName\n                    email\n                    id\n                }\n            }\n        }\n      }\n    }\n    ... on GroupNotFoundError {\n      message\n    }\n  }\n}": types.GetGroupDocument,
     "\nquery CheckAuthSessionQuery {\n  organizationSettings {\n    ... on OrganizationSettingsResult {\n      settings {\n        id\n      }\n    }\n  }\n}\n": types.CheckAuthSessionQueryDocument,
+    "\n      query GetLastMfaAt {\n        lastMfaAt\n      }\n    ": types.GetLastMfaAtDocument,
+    "\n      query HasValidOidcIdToken($oidcProviderType: OIDCProviderType!) {\n        hasValidOidcToken(oidcProviderType: $oidcProviderType)\n      }\n    ": types.HasValidOidcIdTokenDocument,
     "\n  mutation CreateRequest(\n    $requestedResources: [RequestedResourceInput!]!\n    $requestedGroups: [RequestedGroupInput!]!\n    $reason: String!\n    $durationInMinutes: Int\n  ) {\n    createRequest(\n      input: {\n        requestedResources: $requestedResources\n        requestedGroups: $requestedGroups\n        reason: $reason\n        durationInMinutes: $durationInMinutes\n      }\n    ) {\n      ... on CreateRequestResult {\n        request {\n          id\n          status\n        }\n      }\n      ... on RequestDurationTooLargeError {\n        message\n      }\n      ... on RequestRequiresUserAuthTokenForConnectionError {\n        message\n      }\n      ... on NoReviewersSetForOwnerError {\n        message\n        ownerId\n      }\n      ... on NoReviewersSetForResourceError {\n        message\n        resourceId\n      }\n      ... on NoReviewersSetForGroupError {\n        message\n        groupId\n      }\n      ... on NoManagerSetForRequestingUserError {\n        message\n      }\n      ... on MfaInvalidError {\n        message\n      }\n      ... on BulkRequestTooLargeError {\n        message\n      }\n      ... on ItemCannotBeRequestedError {\n        message\n      }\n      ... on UserCannotRequestAccessForTargetGroupError {\n        message\n        groupId\n        userId\n      }\n      ... on GroupNestingNotAllowedError {\n        message\n        fromGroupId\n        toGroupId\n      }\n      ... on TargetUserHasNestedAccessError {\n        message\n        groupIds\n      }\n      ... on RequestReasonMissingError {\n        message\n      }\n      ... on RequestFieldValueMissingError {\n        message\n        fieldName\n      }\n      ... on LinkedGroupNotRequestableError {\n        message\n        sourceGroupId\n        groupBindingId\n      }\n      ... on RequestReasonBelowMinLengthError {\n        message\n      }\n\n    }\n  }\n": types.CreateRequestDocument,
     '\n  query GetRequestableAppsQuery($searchQuery: String) {\n    appsV2(\n      filters: {\n        access: REQUESTABLE\n        searchQuery: $searchQuery\n      }\n    ) @connection(key: "paginated-app-dropdown") {\n      edges {\n        node {\n          id\n          displayName\n          ... on Connection {\n            connectionType\n          }\n          ... on Resource {\n            resourceType\n          }\n        }\n      }\n      pageInfo {\n        hasNextPage\n        hasPreviousPage\n        startCursor\n        endCursor\n      }\n    }\n  }\n  ': types.GetRequestableAppsQueryDocument,
     "\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n          }\n          group {\n            id\n            name\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n": types.PaginatedEntityDropdownDocument,