opal-security 5.0.1 → 5.1.0

package/README.md

@@ -22,7 +22,7 @@ $ npm install -g opal-security
 $ opal COMMAND
 running command...
 $ opal (--version)
-opal-security/5.0.1 darwin-arm64 node-v22.21.1
+opal-security/5.1.0 darwin-arm64 node-v18.20.4
 $ opal --help [COMMAND]
 USAGE
   $ opal COMMAND
@@ -68,7 +68,7 @@ USAGE
   $ opal autocomplete [SHELL] [-r]
 
 ARGUMENTS
-  [SHELL]  shell type
+  SHELL  shell type
 
 FLAGS
   -r, --refresh-cache  Refresh cache (ignores displaying instructions)
@@ -106,7 +106,7 @@ EXAMPLES
   $ opal aws:identity
 ```
 
-_See code: [src/commands/aws/identity.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/aws/identity.ts)_
+_See code: [src/commands/aws/identity.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/aws/identity.ts)_
 
 ## `opal clear-auth-config`
 
@@ -123,7 +123,7 @@ EXAMPLES
   $ opal clear-auth-config
 ```
 
-_See code: [src/commands/clear-auth-config.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/clear-auth-config.ts)_
+_See code: [src/commands/clear-auth-config.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/clear-auth-config.ts)_
 
 ## `opal curl-example`
 
@@ -140,7 +140,7 @@ DESCRIPTION
   Prints out an example cURL command containing the parameters the CLI uses to query the Opal server.
 ```
 
-_See code: [src/commands/curl-example.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/curl-example.ts)_
+_See code: [src/commands/curl-example.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/curl-example.ts)_
 
 ## `opal groups get`
 
@@ -161,7 +161,7 @@ EXAMPLES
   $ opal groups:get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4
 ```
 
-_See code: [src/commands/groups/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/groups/get.ts)_
+_See code: [src/commands/groups/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/groups/get.ts)_
 
 ## `opal help [COMMANDS]`
 
@@ -172,7 +172,7 @@ USAGE
   $ opal help [COMMANDS...] [-n]
 
 ARGUMENTS
-  [COMMANDS...]  Command to show help for.
+  COMMANDS...  Command to show help for.
 
 FLAGS
   -n, --nested-commands  Include all nested commands in the output.
@@ -208,7 +208,7 @@ EXAMPLES
   $ opal iam-roles:start --id 51f7176b-0464-4a6f-8369-e951e187b398 --profileName "custom-profile"
 ```
 
-_See code: [src/commands/iam-roles/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/iam-roles/start.ts)_
+_See code: [src/commands/iam-roles/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/iam-roles/start.ts)_
 
 ## `opal kube-roles start`
 
@@ -235,7 +235,7 @@ EXAMPLES
   $ opal kube-roles:start --id 51f7176b-0464-4a6f-8369-e951e187b398 --accessLevelRemoteId "arn:aws:iam::712234975475:role/acme-eks-cluster-admin-role"
 ```
 
-_See code: [src/commands/kube-roles/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/kube-roles/start.ts)_
+_See code: [src/commands/kube-roles/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/kube-roles/start.ts)_
 
 ## `opal login`
 
@@ -243,11 +243,9 @@ Authenticates you with the Opal server.
 
 ```
 USAGE
-  $ opal login [-h] [--email <value>] [-d]
+  $ opal login [-h] [--email <value>]
 
 FLAGS
-  -d, --device-code    Enables the Device Code flow instead of the Authorization Code flow when logging in.
-                       Use the Device Code flow if your environment can't open a browser or listen on a local port.
   -h, --help           Show CLI help.
       --email=<value>  Email address to login with.
 
@@ -258,7 +256,7 @@ EXAMPLES
   $ opal login
 ```
 
-_See code: [src/commands/login.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/login.ts)_
 
 ## `opal logout`
 
@@ -278,7 +276,7 @@ EXAMPLES
   $ opal logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/logout.ts)_
 
 ## `opal postgres-instances start`
 
@@ -312,7 +310,7 @@ EXAMPLES
   $ opal postgres-instances:start --id 51f7176b-0464-4a6f-8369-e951e187b398 --accessLevelRemoteId fullaccess --action view
 ```
 
-_See code: [src/commands/postgres-instances/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/postgres-instances/start.ts)_
+_See code: [src/commands/postgres-instances/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/postgres-instances/start.ts)_
 
 ## `opal request create`
 
@@ -338,7 +336,7 @@ DESCRIPTION
   Creates an Opal access request via an interactive form
 ```
 
-_See code: [src/commands/request/create.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/request/create.ts)_
+_See code: [src/commands/request/create.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/request/create.ts)_
 
 ## `opal request get`
 
@@ -362,7 +360,7 @@ EXAMPLES
   $ opal request get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4 --verbose
 ```
 
-_See code: [src/commands/request/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/request/get.ts)_
+_See code: [src/commands/request/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/request/get.ts)_
 
 ## `opal request list`
 
@@ -394,7 +392,7 @@ EXAMPLES
   $ opal request list --n 5 --pending --verbose
 ```
 
-_See code: [src/commands/request/list.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/request/list.ts)_
+_See code: [src/commands/request/list.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/request/list.ts)_
 
 ## `opal request ls`
 
@@ -445,7 +443,7 @@ EXAMPLES
   $ opal resources:get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4
 ```
 
-_See code: [src/commands/resources/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/resources/get.ts)_
+_See code: [src/commands/resources/get.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/resources/get.ts)_
 
 ## `opal set-auth-config`
 
@@ -475,7 +473,7 @@ EXAMPLES
   $ opal set-auth-config --organizationID=org-456 --clientID=abc123 --issuerUrl=https://auth.example.com
 ```
 
-_See code: [src/commands/set-auth-config.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/set-auth-config.ts)_
+_See code: [src/commands/set-auth-config.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/set-auth-config.ts)_
 
 ## `opal set-custom-header`
 
@@ -496,7 +494,7 @@ EXAMPLES
   $ opal set-custom-header --header 'cf-access-token: $TOKEN'
 ```
 
-_See code: [src/commands/set-custom-header.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/set-custom-header.ts)_
+_See code: [src/commands/set-custom-header.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/set-custom-header.ts)_
 
 ## `opal set-token`
 
@@ -516,7 +514,7 @@ EXAMPLES
   $ opal set-token
 ```
 
-_See code: [src/commands/set-token.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/set-token.ts)_
+_See code: [src/commands/set-token.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/set-token.ts)_
 
 ## `opal set-url [URL]`
 
@@ -527,7 +525,7 @@ USAGE
   $ opal set-url [URL] [-h] [--allowSelfSignedCerts]
 
 ARGUMENTS
-  [URL]  URL of the Opal server to use. If unspecified, defaults to https://app.opal.dev
+  URL  URL of the Opal server to use. If unspecified, defaults to https://app.opal.dev
 
 FLAGS
   -h, --help                  Show CLI help.
@@ -540,7 +538,7 @@ EXAMPLES
   $ opal set-url
 ```
 
-_See code: [src/commands/set-url.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/set-url.ts)_
+_See code: [src/commands/set-url.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/set-url.ts)_
 
 ## `opal ssh copyFrom`
 
@@ -568,7 +566,7 @@ EXAMPLES
   $ opal ssh:copyFrom --src instance/dir --dest my/dir --id 51f7176b-0464-4a6f-8369-e951e187b398
 ```
 
-_See code: [src/commands/ssh/copyFrom.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/ssh/copyFrom.ts)_
+_See code: [src/commands/ssh/copyFrom.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/ssh/copyFrom.ts)_
 
 ## `opal ssh copyTo`
 
@@ -596,7 +594,7 @@ EXAMPLES
   $ opal ssh:copyTo --src my/dir --dest instance/dir --id 51f7176b-0464-4a6f-8369-e951e187b398
 ```
 
-_See code: [src/commands/ssh/copyTo.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/ssh/copyTo.ts)_
+_See code: [src/commands/ssh/copyTo.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/ssh/copyTo.ts)_
 
 ## `opal ssh start`
 
@@ -619,7 +617,7 @@ EXAMPLES
   $ opal ssh:start --id 51f7176b-0464-4a6f-8369-e951e187b398
 ```
 
-_See code: [src/commands/ssh/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/ssh/start.ts)_
+_See code: [src/commands/ssh/start.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/ssh/start.ts)_
 
 ## `opal version`
 
@@ -656,5 +654,5 @@ DESCRIPTION
   Describes current url set, organization name, and logged in user if applicable.
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/opalsecurity/opal-cli/blob/v5.0.1/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/opalsecurity/opal-cli/blob/v5.1.0/src/commands/whoami.ts)_
 <!-- commandsstop -->

package/build/commands/login.d.ts

@@ -9,7 +9,6 @@ export default class Login extends Command {
     static flags: {
         help: import("@oclif/core/lib/interfaces").BooleanFlag<void>;
         email: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        "device-code": import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     static args: {};
     run(): Promise<void>;

package/build/commands/login.js

@@ -95,7 +95,6 @@ class Login extends Command {
             let organizationId = existingCreds.organizationID;
             let organizationName;
             let clientIDCandidate = (_a = existingCreds.clientID) !== null && _a !== void 0 ? _a : (_b = configData === null || configData === void 0 ? void 0 : configData.creds) === null || _b === void 0 ? void 0 : _b.clientIDCandidate; // configData.creds.clientIDCandidate is pre-4.0, load from here for backwards-compat
-            const useDeviceCodeFlow = flags["device-code"];
             // If user starts a new login, remove their existing auth cookie / API token
             await removeAuthSecret(this);
             // Only use the previous email + organizationID if email isn't explicitly specified.
@@ -225,67 +224,21 @@ class Login extends Command {
                 scope += " mfa:skip";
             }
             let tokens;
-            if (useDeviceCodeFlow) {
-                const response = await client.initiateDeviceAuthorization(config, {
-                    audience: "https://opal.dev",
-                    scope,
-                });
-                const authURI = response.verification_uri_complete || response.verification_uri;
-                this.log(`
-🔐 Authentication Required
-
-To continue, authorize this device:
-
-Verify this code in your browser
-
-    ${chalk.blue(response.user_code)}
-
-(Code expires in ${Math.floor(response.expires_in / 60)} minutes)
-
-⚠️  Security Check:
-  • Verify the URL starts with: ${chalk.underline(response.verification_uri)}
-  • You should see the Opal logo and a device activation dialog
-  • Never enter this code on any other website
-`);
-                await inquirer.prompt([
-                    {
-                        type: "input",
-                        name: "continue",
-                        message: "Press Enter to open your browser and continue\n",
-                    },
-                ]);
-                this.log(`
-If your browser doesn't automatically, go to: 
-
-  ${authURI}
-`);
-                await open(authURI, { wait: false });
-                ux.action.start("Waiting for authorization");
-                try {
-                    tokens = await client.pollDeviceAuthorizationGrant(config, response);
-                    ux.action.stop("✓ Authorized");
-                }
-                catch (error) {
-                    ux.action.stop("✗ Failed");
-                    throw error;
-                }
-            }
-            else {
-                const { port, urlPromise } = await startLocalServer();
-                const code_verifier = client.randomPKCECodeVerifier();
-                const code_challenge = await client.calculatePKCECodeChallenge(code_verifier);
-                const clientState = client.randomState();
-                const parameters = {
-                    redirect_uri: `http://127.0.0.1:${port}/callback`,
-                    scope,
-                    code_challenge,
-                    code_challenge_method: "S256",
-                    state: clientState,
-                };
-                const redirectTo = client
-                    .buildAuthorizationUrl(config, parameters)
-                    .toString();
-                this.log(`
+            const { port, urlPromise } = await startLocalServer();
+            const code_verifier = client.randomPKCECodeVerifier();
+            const code_challenge = await client.calculatePKCECodeChallenge(code_verifier);
+            const clientState = client.randomState();
+            const parameters = {
+                redirect_uri: `http://127.0.0.1:${port}/callback`,
+                scope,
+                code_challenge,
+                code_challenge_method: "S256",
+                state: clientState,
+            };
+            const redirectTo = client
+                .buildAuthorizationUrl(config, parameters)
+                .toString();
+            this.log(`
 🔐 Authentication Required
 
 To continue, please authorize this application in your browser.
@@ -296,32 +249,31 @@ To continue, please authorize this application in your browser.
   • After authenticating, you should be redirected to a page that says Authentication Successful!
   • Never enter your credentials on suspicious-looking pages
 `);
-                await inquirer.prompt([
-                    {
-                        type: "input",
-                        name: "continue",
-                        message: "Press Enter to open your browser and continue\n",
-                    },
-                ]);
-                this.log(`
+            await inquirer.prompt([
+                {
+                    type: "input",
+                    name: "continue",
+                    message: "Press Enter to open your browser and continue\n",
+                },
+            ]);
+            this.log(`
 If your browser doesn't automatically, go to:
 
 ${redirectTo}
 `);
-                ux.action.start("Waiting for authorization");
-                try {
-                    await open(redirectTo.toString(), { wait: false });
-                    const url = await urlPromise;
-                    tokens = await client.authorizationCodeGrant(config, new URL(url), {
-                        pkceCodeVerifier: code_verifier,
-                        expectedState: clientState,
-                    });
-                    ux.action.stop("✓ Authorized");
-                }
-                catch (error) {
-                    ux.action.stop("✗ Failed");
-                    throw error;
-                }
+            ux.action.start("Waiting for authorization");
+            try {
+                await open(redirectTo.toString(), { wait: false });
+                const url = await urlPromise;
+                tokens = await client.authorizationCodeGrant(config, new URL(url), {
+                    pkceCodeVerifier: code_verifier,
+                    expectedState: clientState,
+                });
+                ux.action.stop("✓ Authorized");
+            }
+            catch (error) {
+                ux.action.stop("✗ Failed");
+                throw error;
             }
             const { error: tokenExchangeError } = await runMutation({
                 command: this,
@@ -378,11 +330,6 @@ Login.flags = {
         multiple: false,
         description: "Email address to login with.",
     }),
-    "device-code": Flags.boolean({
-        char: "d",
-        description: "Enables the Device Code flow instead of the Authorization Code flow when logging in.\n\
-        Use the Device Code flow if your environment can't open a browser or listen on a local port.",
-    }),
 };
 Login.args = {};
 export default Login;

package/build/commands/whoami.js

@@ -10,13 +10,13 @@ class WhoAmI extends Command {
         const configData = getOrCreateConfigData(this.config.configDir);
         const url = configData[urlKey];
         if (email) {
-            this.log(`User email:         ${email}`);
+            this.log(`User email:     ${email}`);
         }
         if (organizationID) {
             this.log(`OrganizationID: ${organizationID}`);
         }
         if (url) {
-            this.log(`Server:       ${url}`);
+            this.log(`Server:         ${url}`);
         }
     }
 }

package/build/graphql/gql.d.ts

@@ -18,7 +18,7 @@ type Documents = {
     "\n      query HasValidOidcIdToken($oidcProviderType: OIDCProviderType!) {\n        hasValidOidcToken(oidcProviderType: $oidcProviderType)\n      }\n    ": typeof types.HasValidOidcIdTokenDocument;
     "\n  mutation CreateRequest(\n    $requestedResources: [RequestedResourceInput!]!\n    $requestedGroups: [RequestedGroupInput!]!\n    $reason: String!\n    $durationInMinutes: Int\n  ) {\n    createRequest(\n      input: {\n        requestedResources: $requestedResources\n        requestedGroups: $requestedGroups\n        reason: $reason\n        durationInMinutes: $durationInMinutes\n      }\n    ) {\n      ... on CreateRequestResult {\n        request {\n          id\n          status\n        }\n      }\n      ... on RequestDurationTooLargeError {\n        message\n      }\n      ... on RequestRequiresUserAuthTokenForConnectionError {\n        message\n      }\n      ... on NoReviewersSetForOwnerError {\n        message\n        ownerId\n      }\n      ... on NoReviewersSetForResourceError {\n        message\n        resourceId\n      }\n      ... on NoReviewersSetForGroupError {\n        message\n        groupId\n      }\n      ... on NoManagerSetForRequestingUserError {\n        message\n      }\n      ... on MfaInvalidError {\n        message\n      }\n      ... on BulkRequestTooLargeError {\n        message\n      }\n      ... on ItemCannotBeRequestedError {\n        message\n      }\n      ... on UserCannotRequestAccessForTargetGroupError {\n        message\n        groupId\n        userId\n      }\n      ... on GroupNestingNotAllowedError {\n        message\n        fromGroupId\n        toGroupId\n      }\n      ... on TargetUserHasNestedAccessError {\n        message\n        groupIds\n      }\n      ... on RequestReasonMissingError {\n        message\n      }\n      ... on RequestFieldValueMissingError {\n        message\n        fieldName\n      }\n      ... on LinkedGroupNotRequestableError {\n        message\n        sourceGroupId\n        groupBindingId\n      }\n      ... on RequestReasonBelowMinLengthError {\n        message\n      }\n\n    }\n  }\n": typeof types.CreateRequestDocument;
     '\n  query GetRequestableAppsQuery($searchQuery: String) {\n    appsV2(\n      filters: {\n        access: REQUESTABLE\n        searchQuery: $searchQuery\n      }\n    ) @connection(key: "paginated-app-dropdown") {\n      edges {\n        node {\n          id\n          displayName\n          ... on Connection {\n            connectionType\n          }\n          ... on Resource {\n            resourceType\n          }\n        }\n      }\n      pageInfo {\n        hasNextPage\n        hasPreviousPage\n        startCursor\n        endCursor\n      }\n    }\n  }\n  ': typeof types.GetRequestableAppsQueryDocument;
-    "\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n          }\n          group {\n            id\n            name\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n": typeof types.PaginatedEntityDropdownDocument;
+    "\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n            resourceType\n          }\n          group {\n            id\n            name\n            groupType\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n": typeof types.PaginatedEntityDropdownDocument;
     "\n  query GetCatalogItem($uuid: UUID!) {\n    catalogItem(id: $uuid) {\n      __typename\n      ... on Connection {\n        id\n        displayName\n      }\n      ... on Resource {\n        id\n        displayName\n        connection {\n          id\n          displayName\n        }\n        accessLevels{\n          accessLevelName\n          accessLevelRemoteId\n        }\n      }\n      ...on Group {\n        id\n        name\n        connection {\n          id\n          displayName\n        }\n        accessLevels{\n          accessLevelName\n          accessLevelRemoteId\n        }\n      }\n      ... on UserFacingError {\n        message\n      }\n    }\n  }\n  ": typeof types.GetCatalogItemDocument;
     "\n  query RequestDefaults(\n    $requestedResources: [RequestConfigurationResourceInput!]!\n    $requestedGroups: [RequestConfigurationGroupInput!]!\n    ) {\n    requestDefaults(input: {\n      requestedResources: $requestedResources,\n      requestedGroups: $requestedGroups,\n      }\n    ) {\n      ... on RequestDefaults {\n        durationOptions {\n          durationInMinutes\n          label\n        }\n        recommendedDurationInMinutes\n        defaultDurationInMinutes\n        maxDurationInMinutes\n        requireSupportTicket\n        reasonOptional\n        requesterIsAdmin\n        messages {\n          entityId\n          level\n          code\n        }\n      }\n    }\n  }": typeof types.RequestDefaultsDocument;
     "\n  fragment ResourceFields on Resource {\n    displayName\n    id\n    connectionId\n    connection {\n      name\n      connectionType\n    }\n  }\n": typeof types.ResourceFieldsFragmentDoc;
@@ -29,7 +29,7 @@ type Documents = {
     "query GetBundle($id: BundleId!) {\n  bundle(input: { id: $id }) {\n    __typename\n    ... on BundleResult {\n      bundle {\n        name\n        id\n        items {\n          edges {\n            accessLevel {\n              accessLevelName\n              accessLevelRemoteId\n            }\n            node {\n              ... on Resource {\n                ...ResourceFields\n                isRequestable\n              }\n              ... on Group {\n                ...GroupFields\n                isRequestable\n              }\n            }\n          }\n        }\n      }\n    }\n    ... on BundleNotFoundError {\n      message\n    }\n  }\n}": typeof types.GetBundleDocument;
     "\n  query ResourceAccessLevels($resourceId: ResourceId!) {\n    accessLevels(input: {\n      resourceId: $resourceId,\n      onlyMine: false,\n    }) {\n      __typename\n      ... on ResourceAccessLevelsResult {\n        accessLevels {\n          ... on ResourceAccessLevel {\n            accessLevelName\n            accessLevelRemoteId\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n": typeof types.ResourceAccessLevelsDocument;
     "\nquery GroupAccessLevels($groupId: GroupId!) {\n  groupAccessLevels(\n    input: { groupId: $groupId }\n  ) {\n    ... on GroupAccessLevelsResult {\n      groupId\n      accessLevels {\n        ... on GroupAccessLevel {\n            accessLevelName\n            accessLevelRemoteId\n          }\n      }\n    }\n  }\n}\n": typeof types.GroupAccessLevelsDocument;
-    "\n  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {\n    resource(input: {\n      id: $resourceId\n    }) {\n      __typename\n      ... on ResourceResult {\n        __typename\n        resource {\n          associatedItems(\n            first: 200\n            filters: {\n              searchQuery: {\n                contains: $searchQuery\n              }\n              access: REQUESTABLE\n              endUserVisible: true\n              entityType: {\n                in: [GROUP, RESOURCE]\n              }\n            }\n          ) {\n            edges {\n              __typename\n              ... on ResourceAssociatedItemEdge {\n                alias\n                node {\n                  __typename\n                  id\n                  name\n                  ... on Resource {\n                    accessLevels(\n                    filters: {\n                      skipRemoteAccessLevels: false # azure app roles are remote\n                    }\n                  ) {\n                    __typename\n                    accessLevelName\n                    accessLevelRemoteId\n                  }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n": typeof types.GetAssociatedItemsDocument;
+    "\n  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {\n    resource(input: {\n      id: $resourceId\n    }) {\n      __typename\n      ... on ResourceResult {\n        __typename\n        resource {\n          associatedItems(\n            first: 200\n            filters: {\n              searchQuery: {\n                contains: $searchQuery\n              }\n              access: REQUESTABLE\n              endUserVisible: true\n              entityType: {\n                in: [GROUP, RESOURCE]\n              }\n            }\n          ) {\n            edges {\n              __typename\n              ... on ResourceAssociatedItemEdge {\n                alias\n                node {\n                  __typename\n                  id\n                  name\n                  ... on Group {\n                    groupType\n                  }\n                  ... on Resource {\n                    resourceType\n                    accessLevels(\n                    filters: {\n                      skipRemoteAccessLevels: false # azure app roles are remote\n                    }\n                  ) {\n                    __typename\n                    accessLevelName\n                    accessLevelRemoteId\n                  }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n": typeof types.GetAssociatedItemsDocument;
 };
 declare const documents: Documents;
 /**
@@ -72,7 +72,7 @@ export declare function graphql(source: '\n  query GetRequestableAppsQuery($sear
 /**
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */
-export declare function graphql(source: "\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n          }\n          group {\n            id\n            name\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n"): (typeof documents)["\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n          }\n          group {\n            id\n            name\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n"];
+export declare function graphql(source: "\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n            resourceType\n          }\n          group {\n            id\n            name\n            groupType\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n"): (typeof documents)["\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n            resourceType\n          }\n          group {\n            id\n            name\n            groupType\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n"];
 /**
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */
@@ -116,6 +116,6 @@ export declare function graphql(source: "\nquery GroupAccessLevels($groupId: Gro
 /**
  * The graphql function is used to parse GraphQL queries into a document that can be used by GraphQL clients.
  */
-export declare function graphql(source: "\n  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {\n    resource(input: {\n      id: $resourceId\n    }) {\n      __typename\n      ... on ResourceResult {\n        __typename\n        resource {\n          associatedItems(\n            first: 200\n            filters: {\n              searchQuery: {\n                contains: $searchQuery\n              }\n              access: REQUESTABLE\n              endUserVisible: true\n              entityType: {\n                in: [GROUP, RESOURCE]\n              }\n            }\n          ) {\n            edges {\n              __typename\n              ... on ResourceAssociatedItemEdge {\n                alias\n                node {\n                  __typename\n                  id\n                  name\n                  ... on Resource {\n                    accessLevels(\n                    filters: {\n                      skipRemoteAccessLevels: false # azure app roles are remote\n                    }\n                  ) {\n                    __typename\n                    accessLevelName\n                    accessLevelRemoteId\n                  }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n"): (typeof documents)["\n  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {\n    resource(input: {\n      id: $resourceId\n    }) {\n      __typename\n      ... on ResourceResult {\n        __typename\n        resource {\n          associatedItems(\n            first: 200\n            filters: {\n              searchQuery: {\n                contains: $searchQuery\n              }\n              access: REQUESTABLE\n              endUserVisible: true\n              entityType: {\n                in: [GROUP, RESOURCE]\n              }\n            }\n          ) {\n            edges {\n              __typename\n              ... on ResourceAssociatedItemEdge {\n                alias\n                node {\n                  __typename\n                  id\n                  name\n                  ... on Resource {\n                    accessLevels(\n                    filters: {\n                      skipRemoteAccessLevels: false # azure app roles are remote\n                    }\n                  ) {\n                    __typename\n                    accessLevelName\n                    accessLevelRemoteId\n                  }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n"];
+export declare function graphql(source: "\n  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {\n    resource(input: {\n      id: $resourceId\n    }) {\n      __typename\n      ... on ResourceResult {\n        __typename\n        resource {\n          associatedItems(\n            first: 200\n            filters: {\n              searchQuery: {\n                contains: $searchQuery\n              }\n              access: REQUESTABLE\n              endUserVisible: true\n              entityType: {\n                in: [GROUP, RESOURCE]\n              }\n            }\n          ) {\n            edges {\n              __typename\n              ... on ResourceAssociatedItemEdge {\n                alias\n                node {\n                  __typename\n                  id\n                  name\n                  ... on Group {\n                    groupType\n                  }\n                  ... on Resource {\n                    resourceType\n                    accessLevels(\n                    filters: {\n                      skipRemoteAccessLevels: false # azure app roles are remote\n                    }\n                  ) {\n                    __typename\n                    accessLevelName\n                    accessLevelRemoteId\n                  }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n"): (typeof documents)["\n  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {\n    resource(input: {\n      id: $resourceId\n    }) {\n      __typename\n      ... on ResourceResult {\n        __typename\n        resource {\n          associatedItems(\n            first: 200\n            filters: {\n              searchQuery: {\n                contains: $searchQuery\n              }\n              access: REQUESTABLE\n              endUserVisible: true\n              entityType: {\n                in: [GROUP, RESOURCE]\n              }\n            }\n          ) {\n            edges {\n              __typename\n              ... on ResourceAssociatedItemEdge {\n                alias\n                node {\n                  __typename\n                  id\n                  name\n                  ... on Group {\n                    groupType\n                  }\n                  ... on Resource {\n                    resourceType\n                    accessLevels(\n                    filters: {\n                      skipRemoteAccessLevels: false # azure app roles are remote\n                    }\n                  ) {\n                    __typename\n                    accessLevelName\n                    accessLevelRemoteId\n                  }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n"];
 export type DocumentType<TDocumentNode extends DocumentNode<any, any>> = TDocumentNode extends DocumentNode<infer TType, any> ? TType : never;
 export {};

package/build/graphql/gql.js

@@ -7,7 +7,7 @@ const documents = {
     "\n      query HasValidOidcIdToken($oidcProviderType: OIDCProviderType!) {\n        hasValidOidcToken(oidcProviderType: $oidcProviderType)\n      }\n    ": types.HasValidOidcIdTokenDocument,
     "\n  mutation CreateRequest(\n    $requestedResources: [RequestedResourceInput!]!\n    $requestedGroups: [RequestedGroupInput!]!\n    $reason: String!\n    $durationInMinutes: Int\n  ) {\n    createRequest(\n      input: {\n        requestedResources: $requestedResources\n        requestedGroups: $requestedGroups\n        reason: $reason\n        durationInMinutes: $durationInMinutes\n      }\n    ) {\n      ... on CreateRequestResult {\n        request {\n          id\n          status\n        }\n      }\n      ... on RequestDurationTooLargeError {\n        message\n      }\n      ... on RequestRequiresUserAuthTokenForConnectionError {\n        message\n      }\n      ... on NoReviewersSetForOwnerError {\n        message\n        ownerId\n      }\n      ... on NoReviewersSetForResourceError {\n        message\n        resourceId\n      }\n      ... on NoReviewersSetForGroupError {\n        message\n        groupId\n      }\n      ... on NoManagerSetForRequestingUserError {\n        message\n      }\n      ... on MfaInvalidError {\n        message\n      }\n      ... on BulkRequestTooLargeError {\n        message\n      }\n      ... on ItemCannotBeRequestedError {\n        message\n      }\n      ... on UserCannotRequestAccessForTargetGroupError {\n        message\n        groupId\n        userId\n      }\n      ... on GroupNestingNotAllowedError {\n        message\n        fromGroupId\n        toGroupId\n      }\n      ... on TargetUserHasNestedAccessError {\n        message\n        groupIds\n      }\n      ... on RequestReasonMissingError {\n        message\n      }\n      ... on RequestFieldValueMissingError {\n        message\n        fieldName\n      }\n      ... on LinkedGroupNotRequestableError {\n        message\n        sourceGroupId\n        groupBindingId\n      }\n      ... on RequestReasonBelowMinLengthError {\n        message\n      }\n\n    }\n  }\n": types.CreateRequestDocument,
     '\n  query GetRequestableAppsQuery($searchQuery: String) {\n    appsV2(\n      filters: {\n        access: REQUESTABLE\n        searchQuery: $searchQuery\n      }\n    ) @connection(key: "paginated-app-dropdown") {\n      edges {\n        node {\n          id\n          displayName\n          ... on Connection {\n            connectionType\n          }\n          ... on Resource {\n            resourceType\n          }\n        }\n      }\n      pageInfo {\n        hasNextPage\n        hasPreviousPage\n        startCursor\n        endCursor\n      }\n    }\n  }\n  ': types.GetRequestableAppsQueryDocument,
-    "\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n          }\n          group {\n            id\n            name\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n": types.PaginatedEntityDropdownDocument,
+    "\n  query PaginatedEntityDropdown(\n  $id: UUID!\n  $searchQuery: String\n) {\n  app(id: $id) {\n    __typename\n    ... on App {\n      id\n      items(\n        input: {\n          access: REQUESTABLE\n          searchQuery: $searchQuery\n          includeOnlyRequestable: true\n        }\n      ) {\n        items {\n          key\n          resource {\n            id\n            name\n            resourceType\n          }\n          group {\n            id\n            name\n            groupType\n          }\n        }\n        cursor\n      }\n    }\n    ... on AppNotFoundError {\n      message\n    }\n  }\n}\n": types.PaginatedEntityDropdownDocument,
     "\n  query GetCatalogItem($uuid: UUID!) {\n    catalogItem(id: $uuid) {\n      __typename\n      ... on Connection {\n        id\n        displayName\n      }\n      ... on Resource {\n        id\n        displayName\n        connection {\n          id\n          displayName\n        }\n        accessLevels{\n          accessLevelName\n          accessLevelRemoteId\n        }\n      }\n      ...on Group {\n        id\n        name\n        connection {\n          id\n          displayName\n        }\n        accessLevels{\n          accessLevelName\n          accessLevelRemoteId\n        }\n      }\n      ... on UserFacingError {\n        message\n      }\n    }\n  }\n  ": types.GetCatalogItemDocument,
     "\n  query RequestDefaults(\n    $requestedResources: [RequestConfigurationResourceInput!]!\n    $requestedGroups: [RequestConfigurationGroupInput!]!\n    ) {\n    requestDefaults(input: {\n      requestedResources: $requestedResources,\n      requestedGroups: $requestedGroups,\n      }\n    ) {\n      ... on RequestDefaults {\n        durationOptions {\n          durationInMinutes\n          label\n        }\n        recommendedDurationInMinutes\n        defaultDurationInMinutes\n        maxDurationInMinutes\n        requireSupportTicket\n        reasonOptional\n        requesterIsAdmin\n        messages {\n          entityId\n          level\n          code\n        }\n      }\n    }\n  }": types.RequestDefaultsDocument,
     "\n  fragment ResourceFields on Resource {\n    displayName\n    id\n    connectionId\n    connection {\n      name\n      connectionType\n    }\n  }\n": types.ResourceFieldsFragmentDoc,
@@ -18,7 +18,7 @@ const documents = {
     "query GetBundle($id: BundleId!) {\n  bundle(input: { id: $id }) {\n    __typename\n    ... on BundleResult {\n      bundle {\n        name\n        id\n        items {\n          edges {\n            accessLevel {\n              accessLevelName\n              accessLevelRemoteId\n            }\n            node {\n              ... on Resource {\n                ...ResourceFields\n                isRequestable\n              }\n              ... on Group {\n                ...GroupFields\n                isRequestable\n              }\n            }\n          }\n        }\n      }\n    }\n    ... on BundleNotFoundError {\n      message\n    }\n  }\n}": types.GetBundleDocument,
     "\n  query ResourceAccessLevels($resourceId: ResourceId!) {\n    accessLevels(input: {\n      resourceId: $resourceId,\n      onlyMine: false,\n    }) {\n      __typename\n      ... on ResourceAccessLevelsResult {\n        accessLevels {\n          ... on ResourceAccessLevel {\n            accessLevelName\n            accessLevelRemoteId\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n": types.ResourceAccessLevelsDocument,
     "\nquery GroupAccessLevels($groupId: GroupId!) {\n  groupAccessLevels(\n    input: { groupId: $groupId }\n  ) {\n    ... on GroupAccessLevelsResult {\n      groupId\n      accessLevels {\n        ... on GroupAccessLevel {\n            accessLevelName\n            accessLevelRemoteId\n          }\n      }\n    }\n  }\n}\n": types.GroupAccessLevelsDocument,
-    "\n  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {\n    resource(input: {\n      id: $resourceId\n    }) {\n      __typename\n      ... on ResourceResult {\n        __typename\n        resource {\n          associatedItems(\n            first: 200\n            filters: {\n              searchQuery: {\n                contains: $searchQuery\n              }\n              access: REQUESTABLE\n              endUserVisible: true\n              entityType: {\n                in: [GROUP, RESOURCE]\n              }\n            }\n          ) {\n            edges {\n              __typename\n              ... on ResourceAssociatedItemEdge {\n                alias\n                node {\n                  __typename\n                  id\n                  name\n                  ... on Resource {\n                    accessLevels(\n                    filters: {\n                      skipRemoteAccessLevels: false # azure app roles are remote\n                    }\n                  ) {\n                    __typename\n                    accessLevelName\n                    accessLevelRemoteId\n                  }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n": types.GetAssociatedItemsDocument,
+    "\n  query GetAssociatedItems($resourceId: ResourceId!, $searchQuery: String) {\n    resource(input: {\n      id: $resourceId\n    }) {\n      __typename\n      ... on ResourceResult {\n        __typename\n        resource {\n          associatedItems(\n            first: 200\n            filters: {\n              searchQuery: {\n                contains: $searchQuery\n              }\n              access: REQUESTABLE\n              endUserVisible: true\n              entityType: {\n                in: [GROUP, RESOURCE]\n              }\n            }\n          ) {\n            edges {\n              __typename\n              ... on ResourceAssociatedItemEdge {\n                alias\n                node {\n                  __typename\n                  id\n                  name\n                  ... on Group {\n                    groupType\n                  }\n                  ... on Resource {\n                    resourceType\n                    accessLevels(\n                    filters: {\n                      skipRemoteAccessLevels: false # azure app roles are remote\n                    }\n                  ) {\n                    __typename\n                    accessLevelName\n                    accessLevelRemoteId\n                  }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n      ... on ResourceNotFoundError {\n        message\n      }\n    }\n  }\n": types.GetAssociatedItemsDocument,
 };
 export function graphql(source) {
     var _a;