Merge pull request #22 from thand-io/store-state-for-rbac

Store state for rbac

Author: hughneale

cmd/cli/access.go

@@ -42,8 +42,9 @@ var accessCmd = &cobra.Command{
 		}
 
 		err = MakeElevationRequest(&models.ElevateRequest{
-			Role:     foundRole,
-			Provider: resource,
+			Role:      foundRole,
+			Providers: []string{resource},
+			// Let the system pick the workflow based on role and provider
 			Reason:   reason,
 			Duration: duration,
 		})

cmd/cli/request.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/go-resty/resty/v2"
 	"github.com/spf13/cobra"
+	"github.com/thand-io/agent/internal/common"
 	"github.com/thand-io/agent/internal/models"
 )
 
@@ -118,11 +119,21 @@ var requestCmd = &cobra.Command{
 }
 
 func MakeElevationRequest(request *models.ElevateRequest) error {
+
 	if err := validateElevationRequest(request); err != nil {
 		return err
 	}
 
+	if len(request.Workflow) == 0 {
+		if len(request.Role.Workflows) == 0 {
+			return fmt.Errorf("no workflow specified and role has no associated workflows")
+		}
+
+		request.Workflow = request.Role.Workflows[0]
+	}
+
 	requestingWorkflow, err := cfg.GetWorkflowFromElevationRequest(request)
+
 	if err != nil {
 		return fmt.Errorf("failed to get workflow from elevation request: %w", err)
 	}
@@ -146,6 +157,15 @@ func validateElevationRequest(request *models.ElevateRequest) error {
 	if len(request.Reason) == 0 {
 		return fmt.Errorf("invalid request: empty reason")
 	}
+	if request.Role == nil {
+		return fmt.Errorf("invalid request: nil role")
+	}
+	if len(request.Providers) == 0 {
+		return fmt.Errorf("invalid request: no providers")
+	}
+	if _, err := common.ValidateDuration(request.Duration); err != nil {
+		return fmt.Errorf("invalid request: duration must be greater than zero")
+	}
 	return nil
 }
 

cmd/cli/wizard.go

@@ -30,7 +30,7 @@ func RunRequestWizard(config *config.Config) (*models.ElevateRequest, error) {
 	if err != nil {
 		return nil, err
 	}
-	data.Provider = provider
+	data.Providers = []string{provider}
 
 	// Step 2: Select Role (filtered by provider)
 	role, err := selectRole(config, provider)
@@ -341,7 +341,7 @@ func displaySummary(data *models.ElevateRequest) {
 	fmt.Println(successStyle.Render("Request Configuration Complete!"))
 	fmt.Println()
 
-	fmt.Printf("Provider: %s\n", data.Provider)
+	fmt.Printf("Providers: %s\n", data.Providers)
 	fmt.Printf("Role: %s\n", data.Role.Name)
 	fmt.Printf("Duration: %s\n", data.Duration)
 	fmt.Printf("Reason: %s\n", data.Reason)

internal/config/model.go

@@ -510,25 +510,33 @@ func (r *Config) GetWorkflowFromElevationRequest(elevationRequest *models.Elevat
 		return nil, fmt.Errorf("role is nil")
 	}
 
-	if len(elevationRequest.Provider) == 0 {
-		return nil, fmt.Errorf("provider is nil")
+	if len(elevationRequest.Providers) == 0 {
+		return nil, fmt.Errorf("providers are empty")
 	}
 
+	primaryProvider := strings.ToLower(elevationRequest.Providers[0])
+
 	roleName := strings.ToLower(elevationRequest.Role.Name)
-	providerName := strings.ToLower(elevationRequest.Provider)
+	providerName := strings.ToLower(primaryProvider)
+	workflowName := strings.ToLower(elevationRequest.Workflow)
 
 	role := elevationRequest.Role
 
+	if len(workflowName) == 0 {
+		// If no workflow is specified, use the first workflow associated with the role
+		if len(role.Workflows) == 0 {
+			return nil, fmt.Errorf("no workflow specified and role has no associated workflows")
+		}
+
+		workflowName = role.Workflows[0]
+	}
+
 	if !slices.Contains(role.Providers, providerName) {
 		return nil, fmt.Errorf("provider '%s' not allowed for role '%s', roles: %v", providerName, roleName, role.Providers)
 	}
 
-	// Get the workflow for elevation
-	workflowName := strings.ToLower(role.Workflow)
-
-	// TODO: If this is empty then default to the default workflow
-	if len(workflowName) == 0 {
-		return nil, fmt.Errorf("workflow is nil for role '%s'", roleName)
+	if !slices.Contains(role.Workflows, workflowName) {
+		return nil, fmt.Errorf("workflow '%s' not allowed for role '%s', workflows: %v", workflowName, roleName, role.Workflows)
 	}
 
 	workflow, foundWorkflow := r.Workflows.Definitions[workflowName]

internal/daemon/auth.go

@@ -172,26 +172,16 @@ func (s *Server) getAuthCallbackPage(c *gin.Context, auth models.AuthWrapper) {
 	}
 
 	// Covert our sensitive session to one we can store on the users local system
-	localSession := &models.LocalSession{
-		Version: 1,
-		Expiry:  session.Expiry.UTC(),
-		Session: session.GetEncodedSession(
-			s.Config.GetServices().GetEncryption(),
-		),
-	}
+	localSession := session.ToLocalSession(s.Config.GetServices().GetEncryption())
 
 	data := AuthCallbackPageData{
 		TemplateData: s.GetTemplateData(c),
 		Auth:         auth,
 		Session:      localSession,
 	}
 
-	cookie := sessions.Default(c)
-	cookie.Set(auth.Provider, localSession.GetEncodedLocalSession())
-	err = cookie.Save()
-
-	if err != nil {
-		s.getErrorPage(c, http.StatusInternalServerError, "Failed to set cookie", err)
+	if err := s.setAuthCookie(c, auth.Provider, localSession); err != nil {
+		s.getErrorPage(c, http.StatusInternalServerError, "Failed to set auth cookie", err)
 		return
 	}
 

internal/daemon/cookies.go

@@ -0,0 +1,17 @@
+package daemon
+
+import (
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-gonic/gin"
+	"github.com/thand-io/agent/internal/models"
+)
+
+func (s *Server) setAuthCookie(c *gin.Context, authProvider string, localSession *models.LocalSession) error {
+
+	cookie := sessions.Default(c)
+	cookie.Set(authProvider, localSession.GetEncodedLocalSession())
+	err := cookie.Save()
+
+	return err
+
+}

internal/daemon/elevate.go

@@ -34,12 +34,23 @@ func (s *Server) getElevate(c *gin.Context) {
 		return
 	}
 
+	primaryWorkflow := request.Workflow
+
+	if len(primaryWorkflow) == 0 {
+		if len(role.Workflows) == 0 {
+			s.getErrorPage(c, http.StatusBadRequest, "No workflow specified and role has no associated workflows", err)
+			return
+		}
+		primaryWorkflow = role.Workflows[0]
+	}
+
 	s.elevate(c, models.ElevateRequest{
-		Role:     role,
-		Provider: request.Provider,
-		Reason:   request.Reason,
-		Duration: request.Duration,
-		Session:  request.Session,
+		Role:      role,
+		Providers: []string{request.Provider},
+		Workflow:  primaryWorkflow,
+		Reason:    request.Reason,
+		Duration:  request.Duration,
+		Session:   request.Session,
 	})
 }
 
@@ -129,7 +140,7 @@ func (s *Server) handleDynamicRequest(c *gin.Context, dynamicRequest models.Elev
 	dynamicRole := &models.Role{
 		Name:        "dynamic-role-" + time.Now().Format("20060102-150405"),
 		Description: "Dynamically created role: " + dynamicRequest.Reason,
-		Workflow:    dynamicRequest.Workflow,
+		Workflows:   []string{dynamicRequest.Workflow},
 		Permissions: models.Permissions{
 			Allow: dynamicRequest.Permissions,
 		},
@@ -147,11 +158,12 @@ func (s *Server) handleDynamicRequest(c *gin.Context, dynamicRequest models.Elev
 
 	// Convert to standard ElevateRequest
 	elevateRequest := models.ElevateRequest{
-		Role:     dynamicRole,
-		Provider: dynamicRequest.Providers[0], // Use first provider for now
-		Reason:   dynamicRequest.Reason,
-		Duration: dynamicRequest.Duration,
-		Session:  nil, // Session will be handled by the workflow if needed
+		Role:      dynamicRole,
+		Providers: dynamicRequest.Providers, // Use first provider for now
+		Workflow:  dynamicRequest.Workflow,
+		Reason:    dynamicRequest.Reason,
+		Duration:  dynamicRequest.Duration,
+		Session:   nil, // Session will be handled by the workflow if needed
 	}
 
 	s.elevate(c, elevateRequest)
@@ -164,7 +176,36 @@ func (s *Server) elevate(c *gin.Context, request models.ElevateRequest) {
 
 	ctx := context.Background()
 
-	WorkflowTask, err := s.Workflows.CreateWorkflow(ctx, request)
+	// If we have a web session and one hasn't been set then
+	// lets attach a user session to the request.
+	if s.Config.IsServer() {
+
+		// Get the auth provider from the workflow if set
+		authProvider := []string{}
+
+		if len(request.Workflow) > 0 {
+			workflowDef, err := s.Config.GetWorkflowByName(request.Workflow)
+			if err != nil {
+				s.getErrorPage(c, http.StatusBadRequest, "Invalid workflow specified", err)
+				return
+			}
+			authProvider = []string{workflowDef.GetAuthentication()}
+		}
+
+		foundUser, err := s.getUser(c, authProvider...)
+
+		if err != nil {
+			s.getErrorPage(c, http.StatusUnauthorized, "Unauthorized: unable to get user for list of available roles", err)
+			return
+		}
+
+		if foundUser != nil {
+			request.Session = foundUser.ToLocalSession(s.Config.GetServices().GetEncryption())
+		}
+
+	}
+
+	workflowTask, err := s.Workflows.CreateWorkflow(ctx, request)
 
 	if err != nil {
 		s.getErrorPage(c, http.StatusBadRequest, "Failed to execute workflow", err)
@@ -173,7 +214,7 @@ func (s *Server) elevate(c *gin.Context, request models.ElevateRequest) {
 
 	// We now redirect the user to the next workflow step.
 	c.Redirect(http.StatusTemporaryRedirect,
-		WorkflowTask.GetRedirectURL(),
+		workflowTask.GetRedirectURL(),
 	)
 }
 
@@ -289,6 +330,13 @@ func (s *Server) getElevateAuthOAuth2(c *gin.Context) {
 
 	workflowTask.SetUser(session.User)
 
+	localSession := session.ToLocalSession(s.Config.GetServices().GetEncryption())
+
+	if err := s.setAuthCookie(c, authProvider, localSession); err != nil {
+		s.getErrorPage(c, http.StatusInternalServerError, "Failed to set auth cookie", err)
+		return
+	}
+
 	s.resumeWorkflow(c, workflowTask)
 
 }

internal/daemon/elevate/llm/main.go

@@ -144,12 +144,13 @@ func buildElevateRequest(role *models.Role, evaluationResponse *ElevationRequest
 	}
 
 	role.Providers = []string{evaluationResponse.Provider}
-	role.Workflow = evaluationResponse.Workflow
+	role.Workflows = []string{evaluationResponse.Workflow}
 
 	return &models.ElevateRequest{
-		Role:     role,
-		Provider: evaluationResponse.Provider,
-		Reason:   reason,
-		Duration: evaluationResponse.Duration.String(),
+		Role:      role,
+		Providers: []string{evaluationResponse.Provider},
+		Workflow:  evaluationResponse.Workflow,
+		Reason:    reason,
+		Duration:  evaluationResponse.Duration.String(),
 	}
 }

internal/daemon/executions.go

@@ -168,7 +168,7 @@ func (s *Server) getRunningWorkflow(c *gin.Context) {
 				elevationReq, err := workflowInfo.GetContextAsElevationRequest()
 
 				if err == nil && elevationReq != nil {
-					workflowName = elevationReq.Role.Workflow
+					workflowName = elevationReq.Workflow
 				}
 
 			}
@@ -197,7 +197,8 @@ func (s *Server) getRunningWorkflow(c *gin.Context) {
 			workflowInfo.Output = err.Error()
 		}
 
-		workflowInfo.Status = swctx.StatusPhase(strings.ToLower(workflowExecInfo.Status))
+		workflowInfo.Status = swctx.StatusPhase(
+			strings.ToLower(workflowExecInfo.Status))
 
 	}
 

internal/daemon/static/elevate_llm.html

@@ -155,7 +155,7 @@ <h2 class="section-title">AI Generated Role</h2>
             const role = generatedRole;
 
             // Set workflow (use first workflow from generated role if available, otherwise default)
-            document.getElementById('hiddenWorkflow').value = role.workflow || 'default-workflow';
+            document.getElementById('hiddenWorkflow').value = role.workflow || '';
 
             // Set providers from the generated role
             const providersContainer = document.getElementById('hiddenProviders');