lumos-identity-cli 0.0.0.dev1__py3-none-any.whl

lumos/common/helpers.py

@@ -0,0 +1,90 @@
+import functools
+import os
+
+from click_extra import confirm, echo, prompt
+from pick import pick
+
+from lumos.common.client import AuthClient
+from lumos.common.keyhelpers import key_file_path, read_key, write_key
+from lumos.common.models import App, Permission, SupportRequestStatus
+
+
+def authenticate(func):
+    """Makes sure client is authenticated first"""
+
+    @functools.wraps(func)
+    def wrapper_authenticate(*args, **kwargs):
+        setup(show_prompt=True)
+        return func(*args, **kwargs)
+
+    return wrapper_authenticate
+
+
+def setup(show_prompt: bool = False, show_overwrite_prompt: bool = False):
+    key_file = key_file_path()
+    # if the key file exists, ask if they want to overwrite
+    if key_file.exists():
+        read_key()
+        if not show_overwrite_prompt or not confirm(
+            "You already have a key setup. Do you want to overwrite?", default=True
+        ):
+            return
+    if show_prompt and not confirm(
+        " 🛠️ You need to authenticate to use this application. Do you want to do that now?",
+        default=True,
+    ):
+        raise SystemExit(1)
+    selected, _ = pick(["OAuth 2.0", "API key"], "How do you want to authenticate?")
+    if selected == "API key":
+        echo(" ⚙️ Go to your Lumos account > Settings > API Tokens > Add an API Token, and copy the token.")
+        api_key = prompt("API key", hide_input=True, confirmation_prompt=True)
+        write_key(api_key)
+    else:
+        login()
+
+    read_key()
+
+
+def login(admin: bool | None = False):
+    AuthClient().authenticate(admin or False)
+
+
+def logout():
+    key_file = key_file_path()
+    key_file.unlink(missing_ok=True)
+    if os.environ.get("API_KEY"):
+        os.environ["API_KEY"] = None
+
+
+def get_statuses(status: list[SupportRequestStatus], pending: bool, past: bool) -> set[SupportRequestStatus]:
+    if not status:
+        status = []
+    if pending:
+        status += SupportRequestStatus.PENDING_STATUSES
+    if past:
+        for e in SupportRequestStatus.ALL_STATUSES:
+            if e in SupportRequestStatus.PENDING_STATUSES:
+                continue
+            status.append(e)
+
+    if len(status) == 0:
+        return None
+    return set(status)
+
+
+def check_current_apps(
+    apps: list[App], selected_app: App, selected_permissions: list[Permission] | None
+) -> tuple[App, str | None]:
+    for app in apps:
+        if str(app.app_id) == str(selected_app.id):
+            if len(app.requestable_permissions) > 0 and selected_permissions:
+                for permission in [str(r.id) for r in app.requestable_permissions]:
+                    if permission in [str(r.id) for r in selected_permissions]:
+                        return (
+                            app,
+                            "There's already a request for this app and permission",
+                        )
+            elif len(app.requestable_permissions) == 0 and not selected_permissions:
+                return app, "There's already a request for this app"
+
+    return None, None

lumos/common/keyhelpers.py

@@ -0,0 +1,41 @@
+import os
+from pathlib import Path
+
+from lumos.common.logging import logdebug
+
+
+def key_file_path() -> Path:
+    if os.environ.get("DEV_MODE"):
+        return Path.home() / ".lumos-dev"
+    return Path.home() / ".lumos"
+
+
+def write_key(key: str | None, scope: str | None = None) -> None:
+    if not key:
+        return
+
+    os.environ["API_KEY"] = key
+    os.environ["SCOPE"] = scope or ""
+
+    if scope:
+        key = f"{scope}:{key}"
+
+    key_file = key_file_path()
+    logdebug(f"Writing token [{key[:9]}...] to {key_file}")
+    with key_file.open("w") as f:
+        f.write(key)
+
+
+def read_key() -> str:
+    api_key = os.environ.get("API_KEY")
+    if api_key:
+        return api_key
+
+    key_file = key_file_path()
+    with key_file.open("r") as f:
+        api_key = f.read().strip()
+    if api_key.count(":") == 1:
+        scope, api_key = api_key.split(":")
+        os.environ["SCOPE"] = scope
+    os.environ["API_KEY"] = api_key
+    return api_key

lumos/common/logging.py

@@ -0,0 +1,30 @@
+import os
+
+from click_extra import secho
+
+
+def logdebug_request(url, headers, body, params, method) -> None:
+    logdebug(method + " " + url)
+    headers_copy = headers.copy()
+    if headers_copy.get("Authorization"):
+        headers_copy["Authorization"] = headers_copy["Authorization"][:12] + "..."
+    logdebug("HEADERS: " + str(headers_copy))
+    logdebug("BODY: " + str(body))
+    logdebug("PARAMETERS: " + str(params))
+
+
+def logdebug_response(response) -> None:
+    logdebug("\nRESPONSE: " + str(response.status_code))
+    try:
+        json = response.json()
+        if json.get("access_token"):
+            json["access_token"] = json["access_token"][:5] + "..."
+        logdebug("HEADERS: " + str(response.headers))
+        logdebug("CONTENT: " + str(json))
+    except Exception:
+        logdebug("CONTENT: " + str(response.content))
+
+
+def logdebug(msg: str) -> None:
+    if os.environ.get("DEBUG"):
+        secho(msg, fg="red")

lumos/common/models.py

@@ -0,0 +1,236 @@
+from abc import abstractmethod
+from enum import Enum
+from typing import ClassVar
+from uuid import UUID
+
+import pytz
+from pydantic import BaseModel
+
+
+class ProvisioningMethodOption(Enum):
+    DIRECT_TO_USER = "DIRECT_TO_USER"
+    GROUPS_AND_HIDDEN = "GROUPS_AND_HIDDEN"
+    GROUPS_AND_VISIBLE = "GROUPS_AND_VISIBLE"
+
+
+class LumosModel(BaseModel):
+    @abstractmethod
+    def tabulate(self) -> list[str]:
+        pass
+
+
+class AppSettingProvisioning(BaseModel):
+    groups_provisioning: ProvisioningMethodOption
+    time_based_access: list[str] = []
+    allow_multiple_permission_selection: bool
+
+
+class AppSetting(BaseModel):
+    custom_request_instructions: str
+    provisioning: AppSettingProvisioning
+
+
+class App(LumosModel):
+    id: UUID
+    user_friendly_label: str
+    app_class_id: str
+    instance_id: str
+
+    def __str__(self):
+        return self.user_friendly_label
+
+    def tabulate(self):
+        return [str(self.id), self.user_friendly_label]
+
+    @staticmethod
+    def headers():
+        return ["ID", "App"]
+
+
+class Group(LumosModel):
+    id: UUID
+    name: str
+    description: str
+    app_id: str
+    source_app_id: str
+    integration_specific_id: str
+
+    @staticmethod
+    def headers():
+        return ["ID", "Name", "Description"]
+
+    def tabulate(self):
+        return [str(self.id), self.name, self.description]
+
+
+class Permission(LumosModel):
+    id: UUID
+    label: str
+    app_id: str
+    app_class_id: str
+    duration_options: list[str] = []
+
+    def __str__(self):
+        return self.label
+
+    def tabulate(self):
+        return [str(self.id), self.label, ", ".join(self.duration_options)]
+
+    @staticmethod
+    def headers():
+        return ["ID", "Permission", "Access length options"]
+
+
+class User(LumosModel):
+    id: UUID
+    given_name: str
+    family_name: str
+    email: str
+
+    def __str__(self):
+        return f"{self.given_name} {self.family_name} ({self.email})"
+
+    def tabulate(self):
+        return [f"{self.given_name} {self.family_name}", self.email, str(self.id)]
+
+    @staticmethod
+    def headers():
+        return ["Name", "Email", "ID"]
+
+
+class AccessRequest(LumosModel):
+    id: UUID
+    app_id: UUID
+    app_name: str
+    status: str
+    requested_at: str
+    expires_at: str | None
+    requester_user: User
+    supporter_user: User | None
+    target_user: User
+    requestable_permission_ids: list[UUID] | None = None
+    requestable_permissions: list[Permission] | None = None
+
+    @staticmethod
+    def _convert_to_human_date(inp: str) -> str:
+        if not inp:
+            return ""
+        import datetime
+
+        # Parse the input UTC time string to a datetime object
+        utc_time = datetime.datetime.strptime(inp, "%Y-%m-%dT%H:%M:%S")
+
+        # Set the timezone to UTC for the parsed datetime
+        utc_time = utc_time.replace(tzinfo=pytz.utc)
+
+        # Convert UTC time to EST
+        est_time = utc_time.astimezone(pytz.timezone("America/New_York"))
+
+        # Format the EST time into a more human-readable string
+        human_date = est_time.strftime("%a %b %d, %Y %I:%M %p EST")
+
+        return human_date
+
+    def __str__(self):
+        return f"{self.app_name} ({self.status})"
+
+    def tabulate(self):
+        return [str(self.id), *self._tabulate()]
+
+    def tabulate_as_app(self):
+        return [self.app_id, *self._tabulate()]
+
+    def _tabulate(self):
+        return [
+            self.app_name,
+            "\n".join([p.label for p in self.requestable_permissions]) if self.requestable_permissions else "-----",
+            self.requester_user.given_name + " " + self.requester_user.family_name,
+            self.target_user.given_name + " " + self.target_user.family_name
+            if self.requester_user.id != self.target_user.id
+            else "(self)",
+            self.status,
+            self._convert_to_human_date(self.requested_at),
+            self._convert_to_human_date(self.expires_at),
+        ]
+
+    @staticmethod
+    def headers():
+        return ["ID", "App", "Permissions", "Requester", "For", "Status", "Requested at", "Expires at"]
+
+
+# If this enum is updated both this table as well as SupportRequestComments must be updated.
+class SupportRequestStatus:
+    # initial status, right after creating a request, no action should be taken on the request
+    # at this stage
+    PENDING = "PENDING"
+    # after recognizing the manager approval for the request is required, it's waiting for manager
+    PENDING_MANAGER_APPROVAL = "PENDING_MANAGER_APPROVAL"
+    # after a manager approves it
+    MANAGER_APPROVED = "MANAGER_APPROVED"
+    # when a manager rejects it
+    MANAGER_DENIED = "MANAGER_DENIED"
+    # after recognizing the approval for the request is required, it's waiting for end-user
+    PENDING_APPROVAL = "PENDING_APPROVAL"
+    # after an approver approves it or assigned automatically when there is no need for approval
+    APPROVED = "APPROVED"
+    # when an approver rejects it
+    DENIED = "DENIED"
+    # assigned automatically when neither the approver or admin completes the request in time
+    EXPIRED = "EXPIRED"
+    # after user cancels the request
+    CANCELLED = "CANCELLED"
+    # when the request enters provisioning and it's still not clear whether it'll happen
+    # automatically or we will need to ask for manual provisioning
+    PENDING_PROVISIONING = "PENDING_PROVISIONING"
+    # after recognizing the provisioning for the request needs to be done manually,
+    # it's waiting for end-user
+    PENDING_MANUAL_PROVISIONING = "PENDING_MANUAL_PROVISIONING"
+    # when admin denied the request
+    DENIED_PROVISIONING = "DENIED_PROVISIONING"
+    # after either the manual or automatic provisioning,
+    # when it's waiting for the final "cleanup" on our end
+    PROVISIONED = "PROVISIONED"
+    # when a time based request has been completed and the time has elapsed but automatic removal
+    # failed and access needs to be manually removed
+    PENDING_MANUAL_DEPROVISIONING = "PENDING_MANUAL_DEPROVISIONING"
+    # when the request has been completed and access has been removed because the request was
+    # only for a limited amount of time
+    TIME_BASED_EXPIRED = "TIME_BASED_EXPIRED"
+    # when the request has been fully finalized and there are no more actions pending
+    COMPLETED = "COMPLETED"
+    # when the request has been marked to be reverted by a user via the "Undo an action" flow
+    # but before the actual reverting is completed
+    REVERTING = "REVERTING"
+    # when the request has been fully reverted
+    REVERTED = "REVERTED"
+
+    PENDING_STATUSES: ClassVar[list[str]] = [
+        PENDING,
+        PENDING_MANAGER_APPROVAL,
+        PENDING_MANUAL_PROVISIONING,
+        PENDING_APPROVAL,
+        PENDING_PROVISIONING,
+    ]
+
+    SUCCESS_STATUSES: ClassVar[list[str]] = [APPROVED, COMPLETED, PROVISIONED]
+
+    ALL_STATUSES: ClassVar[list[str]] = [
+        PENDING,
+        PENDING_MANAGER_APPROVAL,
+        MANAGER_APPROVED,
+        MANAGER_DENIED,
+        PENDING_APPROVAL,
+        APPROVED,
+        DENIED,
+        EXPIRED,
+        CANCELLED,
+        PENDING_PROVISIONING,
+        PENDING_MANUAL_PROVISIONING,
+        DENIED_PROVISIONING,
+        PROVISIONED,
+        PENDING_MANUAL_DEPROVISIONING,
+        TIME_BASED_EXPIRED,
+        COMPLETED,
+        REVERTING,
+        REVERTED,
+    ]

lumos/list_collections/__init__.py

@@ -0,0 +1 @@
+from .cli import list_group as list_group

lumos/list_collections/cli.py

@@ -0,0 +1,289 @@
+from json import dumps
+from uuid import UUID
+
+from click_extra import group, option
+from tabulate import tabulate
+
+from lumos.common.client import ApiClient
+from lumos.common.helpers import authenticate, get_statuses
+from lumos.common.models import AccessRequest, LumosModel
+
+client = ApiClient()
+
+
+@group(name="list")
+def list_group():
+    """List various Lumos resources"""
+    pass
+
+
+@list_group.command("users", help="List users in Lumos")
+@option("--like", default=None, help="Search by name or email")
+@option("--csv", is_flag=True, help="Output as CSV")
+@option("--json", "output_json", is_flag=True, help="Output as JSON")
+@option("--paginate/--no-paginate", default=True, help="Pagination")
+@option("--page-size", default=100, help="Page size")
+@option("--page", default=1, help="Page")
+@option("--id-only", is_flag=True, help="Output ID only")
+@authenticate
+def list_users(
+    like: str | None,
+    csv: bool,
+    output_json: bool,
+    paginate: bool,
+    page_size: int,
+    page: int,
+    id_only: bool,
+) -> None:
+    all = csv or output_json or not paginate
+    users, count, total = client.get_users(like=like, all=all, page=page, page_size=page_size)
+    display(
+        "users",
+        users,
+        count,
+        total,
+        csv,
+        output_json,
+        page=page,
+        page_size=page_size,
+        id_only=id_only,
+    )
+
+
+@list_group.command("permissions", help="List permissions for a given app")
+@option("--app", required=True, type=str, help="App UUID")
+@option("--like", default=None, help="Filters permissions")
+@option("--csv", is_flag=True, help="Output as CSV")
+@option("--json", "output_json", is_flag=True, help="Output as JSON")
+@option("--paginate/--no-paginate", default=True, help="Pagination")
+@option("--page-size", default=100, help="Page size")
+@option("--page", default=1, help="Page")
+@option("--id-only", is_flag=True, help="Output ID only")
+@authenticate
+def list_permissions(
+    app: str,
+    like: str | None,
+    csv: bool,
+    output_json: bool,
+    paginate: bool,
+    page_size: int,
+    page: int,
+    id_only: bool,
+) -> None:
+    app_uuid = UUID(app)
+    all = csv or output_json or not paginate
+    permissions, count, total = client.get_app_requestable_permissions(
+        app_id=app_uuid, search_term=like, all=all, page=page, page_size=page_size
+    )
+
+    display(
+        "permissions",
+        permissions,
+        count,
+        total,
+        csv,
+        output_json,
+        page=page,
+        page_size=page_size,
+        id_only=id_only,
+    )
+
+
+@list_group.command("groups", help="List groups for the domain or the specified --app")
+@option(
+    "--app",
+    default=None,
+    type=str,
+    help="App ID to filter groups by. If not provided, lists all groups.",
+)
+@option("--like", default=None, help="Filters groups")
+@option("--csv", is_flag=True, help="Output as CSV")
+@option("--json", "output_json", is_flag=True, help="Output as JSON")
+@option("--paginate/--no-paginate", default=True, help="Pagination")
+@option("--page-size", default=100, help="Page size")
+@option("--page", default=1, help="Page")
+@option("--id-only", is_flag=True, help="Output ID only")
+@authenticate
+def list_groups(
+    app: str | None,
+    like: str | None,
+    csv: bool,
+    output_json: bool,
+    paginate: bool,
+    page_size: int,
+    page: int,
+    id_only: bool,
+) -> None:
+    app_uuid = UUID(app) if app else None
+    all = csv or output_json or not paginate
+    groups, count, total = client.get_groups(app_id=app_uuid, search_term=like, all=all, page=page, page_size=page_size)
+
+    display(
+        "groups",
+        groups,
+        count,
+        total,
+        csv,
+        output_json,
+        page=page,
+        page_size=page_size,
+        id_only=id_only,
+    )
+
+
+@list_group.command("requests", help="List access requests")
+@option(
+    "--for-user",
+    default=None,
+    type=str,
+    help="Show only requests for ('targetting') a particular user",
+)
+@option(
+    "--mine",
+    is_flag=True,
+    help="Show only requests for ('targetting') me. Takes precedence over --for-user.",
+)
+@option(
+    "--status",
+    multiple=True,
+    help="One of `PENDING`, `COMPLETED`, `DENIED_PROVISIONING`, etc",
+)
+@option("--pending", is_flag=True, help="Show only pending requests")
+@option("--past", is_flag=True, help="Show only past requests")
+@option("--csv", is_flag=True, help="Output as CSV")
+@option("--json", "output_json", is_flag=True, help="Output as JSON")
+@option("--paginate/--no-paginate", default=True, help="Pagination")
+@option("--page-size", default=100, help="Page size")
+@option("--page", default=1, help="Page")
+@option("--id-only", is_flag=True, help="Output ID only")
+@authenticate
+def list_requests(
+    for_user: str | None,
+    mine: bool,
+    status: tuple,
+    pending: bool,
+    past: bool,
+    csv: bool,
+    output_json: bool,
+    paginate: bool,
+    page_size: int,
+    page: int,
+    id_only: bool,
+) -> None:
+    user_uuid = None
+    if mine:
+        user_uuid = client.get_current_user_id()
+    elif for_user:
+        user_uuid = UUID(for_user)
+
+    status_list = list(status) if status else None
+    status_set = get_statuses(status_list, pending, past)
+
+    all = csv or output_json or not paginate
+    access_requests, count, total, _, _ = client.get_access_requests(
+        target_user_id=user_uuid,
+        status=status_set,
+        all=all,
+        page=page,
+        page_size=page_size,
+    )
+
+    access_requests = sorted(access_requests, key=lambda x: x.requested_at, reverse=True)
+
+    display(
+        "requests",
+        access_requests,
+        count,
+        total,
+        csv,
+        output_json,
+        page_size=page_size,
+        page=page,
+        id_only=id_only,
+        search=False,
+    )
+
+
+@list_group.command("apps", help="List apps in the appstore")
+@option("--like", default=None, help="Filters apps by search term")
+@option("--mine", is_flag=True, help="Show only my apps.")
+@option("--csv", is_flag=True, help="Output as CSV")
+@option("--json", "output_json", is_flag=True, help="Output as JSON")
+@option("--paginate/--no-paginate", default=True, help="Pagination")
+@option("--page-size", default=100, help="Page size")
+@option("--page", default=1, help="Page")
+@option("--id-only", is_flag=True, help="Output ID only")
+@authenticate
+def list_apps(
+    like: str | None,
+    mine: bool,
+    csv: bool,
+    output_json: bool,
+    paginate: bool,
+    page_size: int,
+    page: int,
+    id_only: bool,
+) -> None:
+    all = csv or output_json or not paginate
+    if mine:
+        access_requests = client.get_my_apps()
+        if len(access_requests) > 0:
+            print(
+                tabulate(
+                    [req.tabulate_as_app() for req in access_requests],
+                    headers=AccessRequest.headers(),
+                ),
+                "\n",
+            )
+        else:
+            print("No apps found.")
+        return
+    apps, count, total = client.get_appstore_apps(name_search=like, all=all, page_size=page_size, page=page)
+    display(
+        "apps",
+        apps,
+        count,
+        total,
+        csv,
+        output_json,
+        page=page,
+        page_size=page_size,
+        id_only=id_only,
+    )
+
+
+def display(
+    description: str,
+    data: list[LumosModel],
+    count: int,
+    total: int,
+    csv: bool,
+    json: bool,
+    page: int,
+    page_size: int,
+    id_only: bool = False,
+    search: bool = True,
+):
+    if len(data) == 0:
+        print(f"No {description} found.")
+        return
+    if csv:
+        for row in data:
+            print(",".join([str(cell).replace(", ", "|") for cell in row.tabulate()]))
+        return
+    if json:
+        print(dumps([d.__dict__ for d in data], default=str, indent=2))
+        return
+    if id_only:
+        if len(data) > 0:
+            for row in data:
+                print(row.tabulate()[0])
+        return
+    headers = data[0].headers()
+    print(tabulate([d.tabulate() for d in data], headers=headers), "\n")
+    remaining = total - count - page_size * (page - 1)
+    if remaining > 0:
+        if search:
+            print(f"There are {remaining} more {description} that match your search. Use --like to search.\n")
+        else:
+            print(f"There are {remaining} more {description} not shown.\n")

lumos/request/__init__.py

@@ -0,0 +1 @@
+from .cli import request as request