Skip to content

Commit 5ad08a8

Browse files
phrockerphrocker
authored
Merge pull request #35 from SentriusLLC/chatdialog
Chatdialog
2 parents 1083877 + 2caa099 commit 5ad08a8

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+3643
-440
lines changed

‎.gcp.env‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
SENTRIUS_VERSION=1.0.44
1+
SENTRIUS_VERSION=1.0.45
22
SENTRIUS_SSH_VERSION=1.0.4
33
SENTRIUS_KEYCLOAK_VERSION=1.0.7
44
SENTRIUS_AGENT_VERSION=1.0.18

‎.gitignore‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@ replay_pid*
3333
target/*
3434
api/target/**
3535
core/target/**
36-
analyagents/target/**
36+
java-agent/target/**
3737
core/target/
38-
analyagents/target/
38+
java-agent/target/
3939
node/*
4040
node_modules/*
4141
api/node_modules/*

‎api/dynamic.properties‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ sshEnabled=true
77
systemLogoName=Sentrius
88
AccessTokenAuditor.rule.4=io.sentrius.sso.automation.auditing.rules.OpenAISessionRule;Malicious AI Monitoring
99
AccessTokenAuditor.rule.5=io.sentrius.sso.automation.auditing.rules.TwoPartyAIMonitor;AI Second Party Monitor
10+
AccessTokenAuditor.rule.6=io.sentrius.sso.automation.auditing.rules.SudoApproval;Sudo Approval
1011
allowProxies=true
1112
AccessTokenAuditor.rule.2=io.sentrius.sso.automation.auditing.rules.DeletePrevention;Delete Prevention
1213
AccessTokenAuditor.rule.3=io.sentrius.sso.automation.auditing.rules.TwoPartySessionRule;Require Second Party Monitoring

‎api/src/main/java/io/sentrius/sso/controllers/api/ChatApiController.java‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
package io.sentrius.sso.controllers.api;
2+
3+
import java.security.GeneralSecurityException;
4+
import java.time.ZoneOffset;
5+
import java.util.List;
6+
import java.util.stream.Collectors;
7+
import io.sentrius.sso.core.utils.AccessUtil;
8+
import io.sentrius.sso.protobuf.Session.ChatMessage;
9+
import io.sentrius.sso.core.config.SystemOptions;
10+
import io.sentrius.sso.core.controllers.BaseController;
11+
import io.sentrius.sso.core.model.security.enums.SSHAccessEnum;
12+
import io.sentrius.sso.core.model.sessions.SessionLog;
13+
import io.sentrius.sso.core.repository.ChatLogRepository;
14+
import io.sentrius.sso.core.security.service.CryptoService;
15+
import io.sentrius.sso.core.services.ErrorOutputService;
16+
import io.sentrius.sso.core.services.UserService;
17+
import io.sentrius.sso.core.services.auditing.AuditService;
18+
import io.sentrius.sso.core.services.terminal.SessionTrackingService;
19+
import jakarta.servlet.http.HttpServletRequest;
20+
import jakarta.servlet.http.HttpServletResponse;
21+
import lombok.extern.slf4j.Slf4j;
22+
import org.springframework.http.ResponseEntity;
23+
import org.springframework.web.bind.annotation.GetMapping;
24+
import org.springframework.web.bind.annotation.RequestMapping;
25+
import org.springframework.web.bind.annotation.RequestParam;
26+
import org.springframework.web.bind.annotation.RestController;
27+
28+
@Slf4j
29+
@RestController
30+
@RequestMapping("/api/v1/chat")
31+
public class ChatApiController extends BaseController {
32+
private final AuditService auditService;
33+
final CryptoService cryptoService;
34+
final SessionTrackingService sessionTrackingService;
35+
final ChatLogRepository chatLogRepository;
36+
37+
public ChatApiController(
38+
UserService userService,
39+
SystemOptions systemOptions,
40+
ErrorOutputService errorOutputService,
41+
AuditService auditService,
42+
CryptoService cryptoService, SessionTrackingService sessionTrackingService, ChatLogRepository chatLogRepository
43+
) {
44+
super(userService, systemOptions, errorOutputService);
45+
this.auditService = auditService;
46+
this.cryptoService = cryptoService;
47+
this.sessionTrackingService = sessionTrackingService;
48+
this.chatLogRepository = chatLogRepository;
49+
}
50+
51+
public SessionLog createSession(@RequestParam String username, @RequestParam String ipAddress) {
52+
return auditService.createSession(username, ipAddress);
53+
}
54+
55+
@GetMapping("/history")
56+
public ResponseEntity<List<ChatMessage>> getChatHistory(
57+
HttpServletRequest request,
58+
HttpServletResponse response,
59+
@RequestParam(name="sessionId") String sessionIdEncrypted,
60+
@RequestParam(name="chatGroupId") String chatGroupIdEncrypted)
61+
throws GeneralSecurityException {
62+
63+
Long sessionId = Long.parseLong(cryptoService.decrypt(sessionIdEncrypted));
64+
65+
// Check if the user has access to this session
66+
var myConnectedSystem = sessionTrackingService.getConnectedSession(sessionId);
67+
68+
var user = getOperatingUser(request, response);
69+
70+
if (myConnectedSystem == null ||
71+
(
72+
!myConnectedSystem.getUser().getId().equals(user.getId()) &&
73+
!AccessUtil.canAccess(user, SSHAccessEnum.CAN_MANAGE_SYSTEMS))) {
74+
return ResponseEntity.status(403).body(null); // Forbidden access
75+
}
76+
77+
78+
String chatGroupId = cryptoService.decrypt(chatGroupIdEncrypted);
79+
List<ChatMessage> messages = chatLogRepository.findBySessionIdAndChatGroupId(sessionId, chatGroupId)
80+
.stream()
81+
.map(chatLog -> ChatMessage.newBuilder()
82+
.setSessionId(sessionId)
83+
.setChatGroupId(chatGroupId)
84+
.setSender(chatLog.getSender())
85+
.setMessage(chatLog.getMessage())
86+
.setTimestamp(chatLog.getMessageTimestamp().toEpochSecond(ZoneOffset.UTC)).build())
87+
.collect(Collectors.toList());
88+
89+
return ResponseEntity.ok(messages);
90+
}
91+
92+
93+
}

‎api/src/main/java/io/sentrius/sso/controllers/view/HostController.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ public String connectSSHServer(
202202

203203
model.addAttribute("enclaveConfiguration", config);
204204

205-
return "sso/ssh/secure_shell";
205+
return "sso/ssh/sso";
206206

207207
}
208208

@@ -243,7 +243,7 @@ public String attachSession(
243243

244244
model.addAttribute("enclaveConfiguration", config);
245245

246-
return "sso/ssh/secure_shell";
246+
return "sso/ssh/sso";
247247

248248
}
249249

‎api/src/main/java/io/sentrius/sso/controllers/view/ZeroTrustATController.java‎

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
package io.sentrius.sso.controllers.view;
22

3+
import java.util.List;
34
import io.sentrius.sso.core.annotations.LimitAccess;
45
import io.sentrius.sso.core.config.SystemOptions;
56
import io.sentrius.sso.core.controllers.BaseController;
7+
import io.sentrius.sso.core.model.dto.JITTrackerDTO;
68
import io.sentrius.sso.core.model.security.enums.ZeroTrustAccessTokenEnum;
79
import io.sentrius.sso.core.model.users.User;
810
import io.sentrius.sso.core.services.ErrorOutputService;
911
import io.sentrius.sso.core.services.ZeroTrustRequestService;
1012
import io.sentrius.sso.core.services.UserService;
13+
import io.sentrius.sso.core.utils.AccessUtil;
14+
import io.sentrius.sso.core.utils.ZTATUtils;
1115
import jakarta.servlet.http.HttpServletRequest;
1216
import jakarta.servlet.http.HttpServletResponse;
1317
import org.springframework.http.ResponseEntity;
@@ -53,13 +57,38 @@ public String viewMyTats(HttpServletRequest request, HttpServletResponse respons
5357
return "sso/ztats/view_my_ztats";
5458
}
5559

60+
61+
List<JITTrackerDTO> decorateTats(List<JITTrackerDTO> tats, User operatingUser){
62+
boolean canApprove = AccessUtil.canAccess(operatingUser, ZeroTrustAccessTokenEnum.CAN_APPROVE_ZTATS);
63+
boolean canDeny = AccessUtil.canAccess(operatingUser, ZeroTrustAccessTokenEnum.CAN_DENY_ZTATS);
64+
if (canApprove || canDeny) {
65+
for (var tat : tats) {
66+
67+
if (tat.getUserName().equals(operatingUser.getUsername())) {
68+
tat.setCurrentUser(true);
69+
if (systemOptions.getCanApproveOwnZtat()) {
70+
tat.setCanApprove(canApprove);
71+
tat.setCanDeny(canDeny);
72+
}
73+
}
74+
else {
75+
tat.setCanApprove(canApprove);
76+
tat.setCanDeny(canDeny);
77+
}
78+
79+
}
80+
}
81+
return tats;
82+
}
83+
5684
private void modelTATs(Model model, User operatingUser){
57-
model.addAttribute("openTerminalTats", ztatRequestService.getOpenAccessTokenRequests(operatingUser));
58-
model.addAttribute("openOpsTats", ztatRequestService.getOpenOpsRequests(operatingUser));
59-
model.addAttribute("approvedTerminalTats", ztatRequestService.getApprovedTerminalAccessTokenRequests(operatingUser));
60-
model.addAttribute("approvedOpsTats", ztatRequestService.getApprovedOpsAccessTokenRequests(operatingUser));
61-
model.addAttribute("deniedOpsTats", ztatRequestService.getDeniedOpsAccessTokenRequests(operatingUser));
62-
model.addAttribute("deniedTerminalTats", ztatRequestService.getDeniedTerminalAccessTokenRequests(operatingUser));
85+
model.addAttribute("openTerminalTats",
86+
decorateTats(ztatRequestService.getOpenAccessTokenRequests(operatingUser),operatingUser));
87+
model.addAttribute("openOpsTats", decorateTats(ztatRequestService.getOpenOpsRequests(operatingUser),operatingUser));
88+
model.addAttribute("approvedTerminalTats", decorateTats(ztatRequestService.getApprovedTerminalAccessTokenRequests(operatingUser),operatingUser));
89+
model.addAttribute("approvedOpsTats", decorateTats(ztatRequestService.getApprovedOpsAccessTokenRequests(operatingUser),operatingUser));
90+
model.addAttribute("deniedOpsTats",decorateTats( ztatRequestService.getDeniedOpsAccessTokenRequests(operatingUser),operatingUser));
91+
model.addAttribute("deniedTerminalTats", decorateTats(ztatRequestService.getDeniedTerminalAccessTokenRequests(operatingUser),operatingUser));
6392
}
6493

6594
}

0 commit comments

Comments
 (0)