Merge pull request #71 from thand-io/new-approval-tui-p2

Enhanced session management to support provider filtering for multi-provider authentication scenarios
Improved workflow status UI with better formatting, authorization tracking, and error handling
Added utility functions for formatting durations in both ISO 8601 and human-readable formats

Author: hughneale

.vscode/launch.json

@@ -55,8 +55,8 @@
             "mode": "auto",
             "program": "${workspaceFolder}",
             "cwd": "${workspaceFolder}",
-            "args": ["--login-server", "https://agent-717249053981.europe-west1.run.app"],
             "env": {},
+            "envFile": "${workspaceFolder}/.env.remote.local",
             "showLog": true
         },
         {
@@ -77,7 +77,7 @@
             "mode": "auto",
             "program": "${workspaceFolder}",
             "cwd": "${workspaceFolder}",
-            "args": ["request", "access", "--provider", "aws-prod", "--role", "aws_admin", "--duration", "PT1M", "--reason", "Need access for demo", "--login-server", "http://localhost:9090"],
+            "args": ["request", "access", "--provider", "aws-thand-dev", "--role", "aws_admin", "--duration", "PT1M", "--reason", "Need access for demo", "--login-server", "http://localhost:9090"],
             "env": {},
             "showLog": true
         },
@@ -88,8 +88,9 @@
             "mode": "auto",
             "program": "${workspaceFolder}",
             "cwd": "${workspaceFolder}",
-            "args": ["request", "access", "--provider", "aws-prod", "--role", "aws_admin", "--duration", "PT1M", "--reason", "Need access for demo", "--login-server", "https://agent-717249053981.europe-west1.run.app"],
+            "args": ["request", "access", "--provider", "aws-thand-dev", "--role", "aws_admin", "--duration", "PT1M", "--reason", "Need access for demo"],
             "env": {},
+            "envFile": "${workspaceFolder}/.env.remote.local",
             "showLog": true
         }
     ]

cmd/cli/access.go

@@ -26,12 +26,15 @@ var accessCmd = &cobra.Command{
 		// TODO: use resource, permissions later to let users request specific permissions
 		// and access to specific resources
 		// resource, _ := cmd.Flags().GetString("resource")
-		provider, _ := cmd.Flags().GetString("provider")
+		identities, _ := cmd.Flags().GetStringArray("identity")
+		authenticator, _ := cmd.Flags().GetString("authenticator")
+		workflow, _ := cmd.Flags().GetString("workflow")
+		providers, _ := cmd.Flags().GetStringArray("provider")
 		role, _ := cmd.Flags().GetString("role")
 		duration, _ := cmd.Flags().GetString("duration")
 		reason, _ := cmd.Flags().GetString("reason")
 
-		if len(provider) == 0 || len(role) == 0 || len(duration) == 0 || len(reason) == 0 {
+		if len(providers) == 0 || len(role) == 0 || len(duration) == 0 || len(reason) == 0 {
 			fmt.Println("Error: --provider, --role, --duration, and --reason are required")
 			fmt.Println("Example: agent request access --provider snowflake-prod --role analyst --duration 4h --reason 'Need access for analysis'")
 			return
@@ -45,11 +48,13 @@ var accessCmd = &cobra.Command{
 		}
 
 		err = MakeElevationRequest(&models.ElevateRequest{
-			Role:      foundRole,
-			Providers: []string{provider},
-			// Let the system pick the workflow based on role and provider
-			Reason:   reason,
-			Duration: duration,
+			Role:          foundRole,
+			Providers:     providers,
+			Identities:    identities,
+			Authenticator: authenticator,
+			Workflow:      workflow,
+			Reason:        reason,
+			Duration:      duration,
 		})
 
 		if err != nil {
@@ -66,7 +71,10 @@ func init() {
 
 	// Add flags for access command
 	// accessCmd.Flags().StringP("resource", "r", "", "Resource to access (e.g., snowflake-prod, aws-prod)")
-	accessCmd.Flags().StringP("provider", "p", "", "Provider to access (alias for resource)")
+	accessCmd.Flags().StringArrayP("identities", "i", []string{}, "Identities to use for access (e.g., user@example.com)")
+	accessCmd.Flags().StringP("authenticator", "a", "", "Authenticator to use for login (overrides provider selection)")
+	accessCmd.Flags().StringP("workflow", "w", "", "Workflow to execute (e.g., snowflake-access)")
+	accessCmd.Flags().StringArrayP("provider", "p", []string{}, "Provider to access (alias for resource)")
 	accessCmd.Flags().StringP("role", "o", "", "Role to assume (e.g., analyst, admin, readonly)")
 	accessCmd.Flags().StringP("duration", "d", "", "Duration of access (e.g., 1h, 4h, 8h)")
 	accessCmd.Flags().StringP("reason", "e", "", "Reason for access request (e.g., 'Need access for analysis')")

cmd/cli/request.go

@@ -60,7 +60,7 @@ var requestCmd = &cobra.Command{
 			return
 		}
 
-		sesh, err := loginSessions.GetFirstActiveSession()
+		_, sesh, err := loginSessions.GetFirstActiveSession()
 
 		if err != nil {
 			return
@@ -125,13 +125,28 @@ func MakeElevationRequest(request *models.ElevateRequest) error {
 	}
 
 	if len(request.Workflow) == 0 {
+		// Default to first workflow in role
 		if len(request.Role.Workflows) == 0 {
 			return fmt.Errorf("no workflow specified and role has no associated workflows")
 		}
 
 		request.Workflow = request.Role.Workflows[0]
 	}
 
+	if len(request.Authenticator) == 0 {
+
+		// First try to see if we have an authenticator matching the provider
+		foundProvider, localSession, err := sessionManager.GetFirstActiveSession(
+			cfg.GetLoginServerHostname(),
+			request.Role.Authenticators...)
+
+		// If we have a valid session for one of the role's authenticators then use it
+		if err == nil && localSession != nil {
+			request.Authenticator = foundProvider
+			request.Session = localSession
+		}
+	}
+
 	if err := ensureValidSession(request); err != nil {
 		return err
 	}
@@ -164,13 +179,11 @@ func validateElevationRequest(request *models.ElevateRequest) error {
 }
 
 func ensureValidSession(request *models.ElevateRequest) error {
-	session, err := sessionManager.GetSession(
-		cfg.GetLoginServerHostname(), request.Authenticator)
-	request.Session = session
 
-	if err != nil || isSessionExpired(session) {
+	if request.Session == nil || isSessionExpired(request.Session) {
 		return authenticateUser(request)
 	}
+
 	return nil
 }
 
@@ -226,12 +239,13 @@ func authenticateUser(request *models.ElevateRequest) error {
 		sessionHandler := sessionManager.AwaitRefresh(
 			cfg.GetLoginServerHostname())
 
-		session, err := sessionHandler.GetFirstActiveSession()
+		foundProvider, session, err := sessionHandler.GetFirstActiveSession()
 
 		if err != nil {
 			return fmt.Errorf("failed to get session: %w", err)
 		}
 
+		request.Authenticator = foundProvider
 		request.Session = session
 
 	}
@@ -354,14 +368,23 @@ func logRedirectWorkflow() resty.RedirectPolicy {
 			return fmt.Errorf("please complete the authentication request in your browser")
 
 		}
+
+		urlQuery := req.URL.Query()
+
 		// Parse the URL to get the next task name
-		nextTaskName := req.URL.Query().Get("task")
+		nextTaskName := urlQuery.Get("taskName")
 
 		if len(nextTaskName) == 0 {
-			nextTaskName = "unknown"
+			nextTaskName = "initializing"
+		}
+
+		taskStatus := urlQuery.Get("taskStatus")
+
+		if len(taskStatus) == 0 {
+			taskStatus = "running"
 		}
 
-		fmt.Printf("redirecting .. %s\n", nextTaskName)
+		fmt.Printf("redirecting .. %s (%s)\n", nextTaskName, taskStatus)
 
 		return nil
 	})