Hide physical keepass paths in token and approval UX

internal/appui/api/model.go

@@ -71,7 +71,7 @@ func AuditEventSearchTerms(event apiaudit.Event) string {
 		event.ClientName,
 		string(event.Operation),
 		AuditOperationLabel(event.Operation),
-		strings.Join(event.Resource.Path, " / "),
+		FormatResourcePath(event.Resource.Path),
 		event.Resource.EntryID,
 		event.Message,
 	}
@@ -91,3 +91,17 @@ func AuditEventSearchTerms(event apiaudit.Event) string {
 	}
 	return strings.ToLower(strings.Join(parts, " "))
 }
+
+func DisplayResourcePath(path []string) []string {
+	if len(path) == 0 {
+		return nil
+	}
+	if path[0] == "keepass" {
+		return append([]string{"Root"}, append([]string(nil), path[1:]...)...)
+	}
+	return append([]string(nil), path...)
+}
+
+func FormatResourcePath(path []string) string {
+	return strings.Join(DisplayResourcePath(path), " / ")
+}

internal/appui/api_views.go

@@ -336,7 +336,7 @@ func (u *ui) editAPIPolicyRuleAction(index int) error {
 	}
 	u.apiPolicyGroupScope = true
 	u.apiPolicyGroupScopeW.Value = true
-	u.apiPolicyPath.SetText(strings.Join(rule.Resource.Path, " / "))
+	u.apiPolicyPath.SetText(apiui.FormatResourcePath(rule.Resource.Path))
 	u.apiPolicyEntryID.SetText("")
 	return nil
 }
@@ -476,7 +476,7 @@ func policyRuleParts(rule apitokens.PolicyRule) (string, string, string) {
 	if rule.Resource.Kind == apitokens.ResourceEntry {
 		resource = "Entry: " + rule.Resource.EntryID
 	} else if len(rule.Resource.Path) > 0 {
-		resource = strings.Join(rule.Resource.Path, " / ")
+		resource = apiui.FormatResourcePath(rule.Resource.Path)
 	}
 	return effect, operation, resource
 }
@@ -1211,5 +1211,5 @@ func formatAuditResource(resource apitokens.Resource) string {
 	if len(resource.Path) == 0 {
 		return "/"
 	}
-	return strings.Join(resource.Path, " / ")
+	return apiui.FormatResourcePath(resource.Path)
 }

internal/appui/app.go

@@ -27,6 +27,7 @@ import (
 	"git.julianfamily.org/keepassgo/internal/apiaudit"
 	"git.julianfamily.org/keepassgo/internal/apitokens"
 	"git.julianfamily.org/keepassgo/internal/appstate"
+	apiui "git.julianfamily.org/keepassgo/internal/appui/api"
 	detailmodel "git.julianfamily.org/keepassgo/internal/appui/detail"
 	detaillayout "git.julianfamily.org/keepassgo/internal/appui/detail/layout"
 	lifecyclemodel "git.julianfamily.org/keepassgo/internal/appui/lifecycle"
@@ -1511,7 +1512,7 @@ func approvalResourceText(request apiapproval.Request) string {
 		}
 	case apitokens.ResourceGroup:
 		if len(request.Resource.Path) > 0 {
-			return strings.Join(request.Resource.Path, " / ")
+			return apiui.FormatResourcePath(request.Resource.Path)
 		}
 	}
 	return "Vault root"

internal/appui/main_test.go

@@ -9355,6 +9355,49 @@ func TestUIAPIPolicyTargetActionsUseCurrentContext(t *testing.T) {
 	}
 }
 
+func TestUIEditAPIPolicyRuleHidesPhysicalKeepassRoot(t *testing.T) {
+	t.Parallel()
+
+	token := apitokens.Token{
+		ID:   "token-1",
+		Name: "Crew Browser",
+		Policies: []apitokens.PolicyRule{{
+			Effect:    apitokens.EffectAllow,
+			Operation: apitokens.OperationListEntries,
+			Resource: apitokens.Resource{
+				Kind: apitokens.ResourceGroup,
+				Path: []string{"keepass", "Crew", "bashertarr"},
+			},
+		}},
+	}
+	u := newUIWithModel("desktop", vault.Model{
+		Entries: []vault.Entry{
+			token.Entry(apitokens.EntryPath),
+		},
+	})
+	u.showAPITokensSection()
+	u.state.SelectedEntryID = "token-1"
+
+	if err := u.editAPIPolicyRuleAction(0); err != nil {
+		t.Fatalf("editAPIPolicyRuleAction() error = %v", err)
+	}
+	if got := u.apiPolicyPath.Text(); got != "Root / Crew / bashertarr" {
+		t.Fatalf("apiPolicyPath.Text() = %q, want %q", got, "Root / Crew / bashertarr")
+	}
+}
+
+func TestUIAuditAndApprovalFormattingHidePhysicalKeepassRoot(t *testing.T) {
+	t.Parallel()
+
+	resource := apitokens.Resource{Kind: apitokens.ResourceGroup, Path: []string{"keepass", "Crew", "bashertarr"}}
+	if got := formatAuditResource(resource); got != "Root / Crew / bashertarr" {
+		t.Fatalf("formatAuditResource() = %q, want %q", got, "Root / Crew / bashertarr")
+	}
+	if got := approvalResourceText(apiapproval.Request{Resource: resource}); got != "Root / Crew / bashertarr" {
+		t.Fatalf("approvalResourceText() = %q, want %q", got, "Root / Crew / bashertarr")
+	}
+}
+
 func TestUIVisibleBreadcrumbsCompressesAggressivelyOnPhone(t *testing.T) {
 	t.Parallel()