feat: add grant groups command for Entra ID group membership elevation - #19
Merged
Conversation
Live API exploration revealed the POST /api/access/elevate/groups response IS wrapped in a "response" key (contrary to initial spec). Also documents group session shape from GET /api/access/sessions including the target field with type "groups".
Add Target field to SessionInfo for distinguishing group sessions from cloud sessions. Group sessions have target.type "groups" with target.id containing the group UUID.
Group sessions are now shown under a "Groups sessions:" header instead of being mixed with cloud sessions. FormatSessionOption uses IsGroupSession() to format them as "Group: <id> in <dir>".
Add group favorite support to config with backward compatibility. Legacy configs without type field default to "cloud" via ResolvedType(). New fields use omitempty for clean YAML output.
Add test cases confirming revoke works with group sessions in direct, --all, and interactive modes. No code changes needed — revoke is session-type agnostic by design.
favorites add now supports --type groups with --group flag for direct mode and interactive group selection. favorites list shows group favorites as "name: groups/group-name". Flag validation prevents mixing cloud and group flags.
When the root command's --favorite resolves to a groups-type favorite, return a helpful error directing to 'grant groups --favorite <name>'.
Implements Entra ID group membership elevation via three modes: interactive selection, direct (--group), and favorite (--favorite). Includes models, service methods, UI selector, interfaces, mocks, and comprehensive tests for all modes.
- Verify favorite DirectoryID during group matching to prevent wrong-group elevation across directories - Sort groups copy in SelectGroup so display-collision lookups search the same ordered slice the user sees - Resolve directory names for group sessions in grant status - Remove SilenceErrors/SilenceUsage from groups subcommand - Consolidate test constructors into single NewGroupsCommandWithDeps - Guard buildDirectoryNameMap against nil eligibility response
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
grant groupscommand for requesting temporary Entra ID group membership via SCA, supporting interactive, direct (--group), and favorite (--favorite) modes--type groupssupport so group favorites can be saved and recalled viagrant groups --favorite <name>or redirected fromgrant --favoriteSessionTarget,IsGroupSession()) with separate display ingrant statusand proper handling ingrant revoke/eligibility/groups,/elevate/groups) throughSCAAccessServiceTest plan
go test ./...— full suite passes (cmd, config, sca, sca/models, ui)grant groupsmodes (interactive, direct, favorite)grant statusresolves directory names for group sessions viabuildDirectoryNameMapgrant revokehandles group sessions (existing tests extended)--type groupstestedhttptest.NewServer