Add access review CLI commands
Add prb access-review subcommands for campaigns (create, update, delete, list, view, start, close, cancel, add/ remove source) entries (list, decide, decide-all, flag) and sources (create, update, delete, list, view). Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
330
pkg/cmd/access-review/entry/list/list.go
Normal file
330
pkg/cmd/access-review/entry/list/list.go
Normal file
@@ -0,0 +1,330 @@
|
||||
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package list
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
"go.probo.inc/probo/pkg/cli/api"
|
||||
"go.probo.inc/probo/pkg/cmd/cmdutil"
|
||||
)
|
||||
|
||||
const listQuery = `
|
||||
query(
|
||||
$id: ID!,
|
||||
$first: Int,
|
||||
$after: CursorKey,
|
||||
$orderBy: AccessEntryOrder,
|
||||
$accessSourceId: ID,
|
||||
$filter: AccessEntryFilter
|
||||
) {
|
||||
node(id: $id) {
|
||||
__typename
|
||||
... on AccessReviewCampaign {
|
||||
entries(
|
||||
first: $first,
|
||||
after: $after,
|
||||
orderBy: $orderBy,
|
||||
accessSourceId: $accessSourceId,
|
||||
filter: $filter
|
||||
) {
|
||||
totalCount
|
||||
edges {
|
||||
node {
|
||||
id
|
||||
email
|
||||
fullName
|
||||
role
|
||||
jobTitle
|
||||
isAdmin
|
||||
mfaStatus
|
||||
authMethod
|
||||
accountType
|
||||
lastLogin
|
||||
externalId
|
||||
incrementalTag
|
||||
flags
|
||||
flagReasons
|
||||
decision
|
||||
decisionNote
|
||||
accessSource {
|
||||
id
|
||||
name
|
||||
}
|
||||
createdAt
|
||||
}
|
||||
}
|
||||
pageInfo {
|
||||
hasNextPage
|
||||
endCursor
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`
|
||||
|
||||
type entryNode struct {
|
||||
ID string `json:"id"`
|
||||
Email string `json:"email"`
|
||||
FullName string `json:"fullName"`
|
||||
Role string `json:"role"`
|
||||
JobTitle string `json:"jobTitle"`
|
||||
IsAdmin bool `json:"isAdmin"`
|
||||
MfaStatus string `json:"mfaStatus"`
|
||||
AuthMethod string `json:"authMethod"`
|
||||
AccountType string `json:"accountType"`
|
||||
LastLogin *string `json:"lastLogin"`
|
||||
ExternalID string `json:"externalId"`
|
||||
IncrementalTag string `json:"incrementalTag"`
|
||||
Flags []string `json:"flags"`
|
||||
FlagReasons []string `json:"flagReasons"`
|
||||
Decision string `json:"decision"`
|
||||
DecisionNote *string `json:"decisionNote"`
|
||||
AccessSource struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
} `json:"accessSource"`
|
||||
CreatedAt string `json:"createdAt"`
|
||||
}
|
||||
|
||||
func NewCmdList(f *cmdutil.Factory) *cobra.Command {
|
||||
var (
|
||||
flagLimit int
|
||||
flagOrderBy string
|
||||
flagOrderDir string
|
||||
flagSourceID string
|
||||
flagDecision string
|
||||
flagFlag string
|
||||
flagIncTag string
|
||||
flagIsAdmin *bool
|
||||
flagAuthMethod string
|
||||
flagAccountType string
|
||||
flagOutput *string
|
||||
)
|
||||
|
||||
cmd := &cobra.Command{
|
||||
Use: "list <campaign-id>",
|
||||
Short: "List access entries for a campaign",
|
||||
Args: cobra.ExactArgs(1),
|
||||
Example: ` # List all entries for a campaign
|
||||
prb access-review entry list <campaign-id>
|
||||
|
||||
# List entries for a specific source
|
||||
prb access-review entry list <campaign-id> --source-id <source-id>
|
||||
|
||||
# List only pending entries
|
||||
prb access-review entry list <campaign-id> --decision PENDING
|
||||
|
||||
# List flagged entries
|
||||
prb access-review entry list <campaign-id> --flag ORPHANED`,
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
if err := cmdutil.ValidateOutputFlag(flagOutput); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
cfg, err := f.Config()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
host, hc, err := cfg.DefaultHost()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
client := api.NewClient(
|
||||
host,
|
||||
hc.Token,
|
||||
"/api/console/v1/graphql",
|
||||
cfg.HTTPTimeoutDuration(),
|
||||
)
|
||||
|
||||
variables := map[string]any{
|
||||
"id": args[0],
|
||||
}
|
||||
|
||||
if err := cmdutil.ValidateEnum("order-direction", flagOrderDir, []string{"ASC", "DESC"}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if flagOrderBy != "" {
|
||||
if err := cmdutil.ValidateEnum("order-by", flagOrderBy, []string{"CREATED_AT"}); err != nil {
|
||||
return err
|
||||
}
|
||||
variables["orderBy"] = map[string]any{
|
||||
"field": flagOrderBy,
|
||||
"direction": flagOrderDir,
|
||||
}
|
||||
}
|
||||
|
||||
if flagSourceID != "" {
|
||||
variables["accessSourceId"] = flagSourceID
|
||||
}
|
||||
|
||||
filter := map[string]any{}
|
||||
if flagDecision != "" {
|
||||
if err := cmdutil.ValidateEnum(
|
||||
"decision",
|
||||
flagDecision,
|
||||
[]string{"PENDING", "APPROVED", "REVOKE", "DEFER", "ESCALATE"},
|
||||
); err != nil {
|
||||
return err
|
||||
}
|
||||
filter["decision"] = flagDecision
|
||||
}
|
||||
if flagFlag != "" {
|
||||
if err := cmdutil.ValidateEnum(
|
||||
"flag",
|
||||
flagFlag,
|
||||
[]string{
|
||||
"NONE", "ORPHANED", "INACTIVE", "EXCESSIVE", "ROLE_MISMATCH",
|
||||
"NEW", "DORMANT", "TERMINATED_USER", "CONTRACTOR_EXPIRED",
|
||||
"SOD_CONFLICT", "PRIVILEGED_ACCESS", "ROLE_CREEP",
|
||||
"NO_BUSINESS_JUSTIFICATION", "OUT_OF_DEPARTMENT", "SHARED_ACCOUNT",
|
||||
},
|
||||
); err != nil {
|
||||
return err
|
||||
}
|
||||
filter["flag"] = flagFlag
|
||||
}
|
||||
if flagIncTag != "" {
|
||||
if err := cmdutil.ValidateEnum(
|
||||
"incremental-tag",
|
||||
flagIncTag,
|
||||
[]string{"NEW", "REMOVED", "UNCHANGED"},
|
||||
); err != nil {
|
||||
return err
|
||||
}
|
||||
filter["incrementalTag"] = flagIncTag
|
||||
}
|
||||
if cmd.Flags().Changed("is-admin") {
|
||||
filter["isAdmin"] = *flagIsAdmin
|
||||
}
|
||||
if flagAuthMethod != "" {
|
||||
if err := cmdutil.ValidateEnum(
|
||||
"auth-method",
|
||||
flagAuthMethod,
|
||||
[]string{"SSO", "PASSWORD", "API_KEY", "SERVICE_ACCOUNT", "UNKNOWN"},
|
||||
); err != nil {
|
||||
return err
|
||||
}
|
||||
filter["authMethod"] = flagAuthMethod
|
||||
}
|
||||
if flagAccountType != "" {
|
||||
if err := cmdutil.ValidateEnum(
|
||||
"account-type",
|
||||
flagAccountType,
|
||||
[]string{"USER", "SERVICE_ACCOUNT"},
|
||||
); err != nil {
|
||||
return err
|
||||
}
|
||||
filter["accountType"] = flagAccountType
|
||||
}
|
||||
if len(filter) > 0 {
|
||||
variables["filter"] = filter
|
||||
}
|
||||
|
||||
entries, totalCount, err := api.Paginate(
|
||||
client,
|
||||
listQuery,
|
||||
variables,
|
||||
flagLimit,
|
||||
func(data json.RawMessage) (*api.Connection[entryNode], error) {
|
||||
var resp struct {
|
||||
Node *struct {
|
||||
Typename string `json:"__typename"`
|
||||
Entries api.Connection[entryNode] `json:"entries"`
|
||||
} `json:"node"`
|
||||
}
|
||||
if err := json.Unmarshal(data, &resp); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if resp.Node == nil {
|
||||
return nil, fmt.Errorf("campaign %s not found", args[0])
|
||||
}
|
||||
if resp.Node.Typename != "AccessReviewCampaign" {
|
||||
return nil, fmt.Errorf("expected AccessReviewCampaign node, got %s", resp.Node.Typename)
|
||||
}
|
||||
return &resp.Node.Entries, nil
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if *flagOutput == cmdutil.OutputJSON {
|
||||
if entries == nil {
|
||||
entries = []entryNode{}
|
||||
}
|
||||
return cmdutil.PrintJSON(f.IOStreams.Out, entries)
|
||||
}
|
||||
|
||||
if len(entries) == 0 {
|
||||
_, _ = fmt.Fprintln(f.IOStreams.Out, "No access entries found.")
|
||||
return nil
|
||||
}
|
||||
|
||||
rows := make([][]string, 0, len(entries))
|
||||
for _, e := range entries {
|
||||
admin := ""
|
||||
if e.IsAdmin {
|
||||
admin = "yes"
|
||||
}
|
||||
rows = append(rows, []string{
|
||||
e.ID,
|
||||
e.Email,
|
||||
e.FullName,
|
||||
e.AccessSource.Name,
|
||||
e.Decision,
|
||||
strings.Join(e.Flags, ","),
|
||||
admin,
|
||||
})
|
||||
}
|
||||
|
||||
t := cmdutil.NewTable("ID", "EMAIL", "NAME", "SOURCE", "DECISION", "FLAGS", "ADMIN").Rows(rows...)
|
||||
|
||||
_, _ = fmt.Fprintln(f.IOStreams.Out, t)
|
||||
|
||||
if totalCount > len(entries) {
|
||||
_, _ = fmt.Fprintf(
|
||||
f.IOStreams.ErrOut,
|
||||
"\nShowing %d of %d entries\n",
|
||||
len(entries),
|
||||
totalCount,
|
||||
)
|
||||
}
|
||||
|
||||
return nil
|
||||
},
|
||||
}
|
||||
|
||||
cmd.Flags().IntVarP(&flagLimit, "limit", "L", 30, "Maximum number of entries to list")
|
||||
cmd.Flags().StringVar(&flagOrderBy, "order-by", "", "Order by field (CREATED_AT)")
|
||||
cmd.Flags().StringVar(&flagOrderDir, "order-direction", "DESC", "Sort direction (ASC, DESC)")
|
||||
cmd.Flags().StringVar(&flagSourceID, "source-id", "", "Filter by access source ID")
|
||||
cmd.Flags().StringVar(&flagDecision, "decision", "", "Filter by decision (PENDING, APPROVED, REVOKE, DEFER, ESCALATE)")
|
||||
cmd.Flags().StringVar(&flagFlag, "flag", "", "Filter by flag (NONE, ORPHANED, INACTIVE, EXCESSIVE, ROLE_MISMATCH, NEW)")
|
||||
cmd.Flags().StringVar(&flagIncTag, "incremental-tag", "", "Filter by incremental tag (NEW, REMOVED, UNCHANGED)")
|
||||
flagIsAdmin = cmd.Flags().Bool("is-admin", false, "Filter by admin status")
|
||||
cmd.Flags().StringVar(&flagAuthMethod, "auth-method", "", "Filter by auth method (SSO, PASSWORD, API_KEY, SERVICE_ACCOUNT, UNKNOWN)")
|
||||
cmd.Flags().StringVar(&flagAccountType, "account-type", "", "Filter by account type (USER, SERVICE_ACCOUNT)")
|
||||
flagOutput = cmdutil.AddOutputFlag(cmd)
|
||||
|
||||
return cmd
|
||||
}
|
||||
Reference in New Issue
Block a user