From 495dea2382d13cd3d81293a4300525f7fc45a183 Mon Sep 17 00:00:00 2001
From: Marc Parisi <phrocker@apache.org>
Date: Mon, 7 Jul 2025 07:06:28 -0400
Subject: [PATCH 1/5] Refresh instead of reload page

---
 .../api/ZeroTrustATApiController.java         |  75 +++++
 .../templates/sso/ztats/view_ztats.html       | 263 +++++++++++++++++-
 .../security/ZeroTrustAccessTokenService.java |  21 +-
 ops-scripts/local/deploy-helm.sh              |   4 +-
 4 files changed, 344 insertions(+), 19 deletions(-)

diff --git a/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java b/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
index a82edc5e..d35eaaea 100644
--- a/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
+++ b/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
@@ -327,6 +327,81 @@ public ResponseEntity<?> listZtatRequests(@RequestHeader("Authorization") String
         return ResponseEntity.ok(ztatTracker);
     }
 
+    @GetMapping("/list/{state}/{type}")
+    @LimitAccess(ztatAccess = {ZeroTrustAccessTokenEnum.CAN_VIEW_ZTATS})
+    public ResponseEntity<?> listTypedZtatRequests(@RequestHeader("Authorization") String token,
+                                              @PathVariable("type") String type,
+                                               @PathVariable("state") String state,
+                                              HttpServletRequest request, HttpServletResponse response) {
+        String compactJwt = token.startsWith("Bearer ") ? token.substring(7) : token;
+
+
+        log.info("Received ZTAT request from agent: {}", compactJwt);
+        if (!keycloakService.validateJwt(compactJwt)) {
+            log.warn("Invalid Keycloak token");
+            return ResponseEntity.status(HttpStatus.SC_UNAUTHORIZED).body("Invalid Keycloak token");
+        }
+
+        // Extract agent identity from the JWT
+        var operatingUser = getOperatingUser(request, response );
+
+        // Extract agent identity from the JWT
+        String agentId = keycloakService.extractAgentId(compactJwt);
+
+        if (null == operatingUser) {
+            log.warn("No operating user found for agent: {}", agentId);
+            var username = keycloakService.extractUsername(compactJwt);
+            operatingUser = userService.getUserByUsername(username);
+
+        }
+        List<ZtatDTO> ztatTracker = new ArrayList<ZtatDTO>();
+        switch(type){
+            case "terminal":
+                if ("denied".equalsIgnoreCase(state)) {
+                    ztatTracker = ztatService.getDeniedJITRequests(operatingUser);
+                } else if ("approved".equalsIgnoreCase(state)) {
+                    ztatTracker = ztatService.getApprovedJITRequests(operatingUser);
+                } else {
+                    ztatTracker = ztatService.getOpenJITRequests(operatingUser);
+                }
+                break;
+            case "ops":
+                if ("denied".equalsIgnoreCase(state)) {
+                    ztatTracker = ztatService.getDeniedOpsJITRequests(operatingUser);
+                } else if ("approved".equalsIgnoreCase(state)) {
+                    ztatTracker = ztatService.getApprovedOpsJITRequests(operatingUser);
+                } else {
+                    ztatTracker = ztatService.getOpenOpsRequests(operatingUser);
+                }
+                break;
+            case "atat":
+                if ("denied".equalsIgnoreCase(state)) {
+                    ztatTracker = ztatService.getDeniedOpsJITRequests(operatingUser);
+                } else if ("approved".equalsIgnoreCase(state)) {
+                    ztatTracker = ztatService.getApprovedOpsJITRequests(operatingUser);
+                } else {
+                    ztatTracker = ztatService.getOpenOpsRequests(operatingUser);
+                }
+                ztatTracker = ztatTracker.stream().filter(dto -> {
+                    if (dto.getCommand().equals("register")) {
+                        return false;
+                    }
+                    try {
+                        if (userService.isNPE(dto.getUserName())){
+                            return true;
+                        }
+                    } catch (Exception e) {
+                        throw new RuntimeException(e);
+                    }
+                    return false;
+                }).toList();
+                break;
+            default:
+                log.warn("Invalid type: {}", type);
+        }
+        return ResponseEntity.ok(ztatTracker);
+    }
+
     @PostMapping("/jwt/issue")
     public ResponseEntity<UserTokenResponse> issueZtat(@RequestBody UserTokenDTO request) {
         String ztat = tokenService.issueZtat(request.getUserId(), request.getSessionId(), request.getPublicKey());
diff --git a/api/src/main/resources/templates/sso/ztats/view_ztats.html b/api/src/main/resources/templates/sso/ztats/view_ztats.html
index 2d326382..9d21291d 100755
--- a/api/src/main/resources/templates/sso/ztats/view_ztats.html
+++ b/api/src/main/resources/templates/sso/ztats/view_ztats.html
@@ -254,39 +254,272 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
 
 <!-- DataTables Initialization -->
 <script>
-    $(document).ready(function () {
-        $('#open-terminal-table, #open-ops-table, #approved-terminal-table, #approved-ops-table, #denied-terminal-table, #denied-ops-table').DataTable();
+    function reloadTerminalTATs() {
+        $.get('/api/v1/zerotrust/accesstoken/list/terminal', function (data) {
+            const $table = $('#open-terminal-table').DataTable();
+            $table.clear();
+
+            for (let s of data) {
+                let actions = '';
+                if (s.canApprove) {
+                    actions += `<button id="app_btn_${s.id}" class="btn-secondary app_btn">Approve</button>`;
+                }
+                if (s.canDeny) {
+                    actions += `<button id="den_btn_${s.id}" class="btn-secondary den_btn">Deny</button>`;
+                }
+                if (s.isCurrentUser) {
+                    actions += `<button id="rev_btn_${s.id}" class="btn-secondary rev_btn">Revoke</button>`;
+                }
+
+                $table.row.add([
+                    s.command,
+                    s.userName,
+                    s.hostName,
+                    actions
+                ]);
+            }
+
+            $table.draw();
+            attachZtatButtonHandlers(); // re-bind the click events
+        });
+
+        $.get('/api/v1/zerotrust/accesstoken/list/approved/terminal', function (data) {
+            const $table = $('#approved-terminal-table').DataTable();
+            $table.clear();
+
+            for (let s of data) {
+                let actions = '';
+                if (s.canApprove) {
+                    actions += `<button id="app_btn_${s.id}" class="btn-secondary app_btn">Approve</button>`;
+                }
+                if (s.canDeny) {
+                    actions += `<button id="den_btn_${s.id}" class="btn-secondary den_btn">Deny</button>`;
+                }
+                if (s.isCurrentUser) {
+                    actions += `<button id="rev_btn_${s.id}" class="btn-secondary rev_btn">Revoke</button>`;
+                }
+
+                $table.row.add([
+                    s.command,
+                    s.userName,
+                    s.hostName,
+                    s.usesRemaining,
+                    actions
+                ]);
+            }
+
+            $table.draw();
+            attachZtatButtonHandlers(); // re-bind the click events
+        });
+
+        $.get('/api/v1/zerotrust/accesstoken/list/denied/terminal', function (data) {
+            const $table = $('#denied-terminal-table').DataTable();
+            $table.clear();
+
+            for (let s of data) {
+                let actions = '';
+                if (s.canApprove) {
+                    actions += `<button id="app_btn_${s.id}" class="btn-secondary app_btn">Approve</button>`;
+                }
+                if (s.canDeny) {
+                    actions += `<button id="den_btn_${s.id}" class="btn-secondary den_btn">Deny</button>`;
+                }
+
+                $table.row.add([
+                    s.command,
+                    s.userName,
+                    s.hostName,
+                    actions
+                ]);
+            }
+
+            $table.draw();
+            attachZtatButtonHandlers(); // re-bind the click events
+        });
+    }
+
+    function reloadOpsTATs() {
+        $.get('/api/v1/zerotrust/accesstoken/list/ops', function (data) {
+            const $table = $('#open-ops-table').DataTable();
+            $table.clear();
+
+            for (let s of data) {
+                let actions = '';
+                if (s.canApprove) {
+                    actions += `<button id="ops_app_btn_${s.id}" class="btn-secondary ops_app_btn">Approve</button>`;
+                }
+                if (s.canDeny) {
+                    actions += `<button id="ops_den_btn_${s.id}" class="btn-secondary ops_den_btn">Deny</button>`;
+                }
+                if (s.isCurrentUser) {
+                    actions += `<button id="ops_rev_btn_${s.id}" class="btn-secondary ops_rev_btn">Revoke</button>`;
+                }
+
+                $table.row.add([
+                    s.summary,
+                    s.userName,
+                    actions
+                ]);
+            }
+
+            $table.draw();
+            attachZtatButtonHandlers(); // re-bind the click events
+        });
 
-        $(".app_btn").click(function () {
+        $.get('/api/v1/zerotrust/accesstoken/list/approved/ops', function (data) {
+            const $table = $('#approved-ops-table').DataTable();
+            $table.clear();
+
+            for (let s of data) {
+                let actions = '';
+                if (s.canApprove) {
+                    actions += `<button id="ops_app_btn_${s.id}" class="btn-secondary ops_app_btn">Approve</button>`;
+                }
+                if (s.canDeny) {
+                    actions += `<button id="ops_den_btn_${s.id}" class="btn-secondary ops_den_btn">Deny</button>`;
+                }
+                if (s.isCurrentUser) {
+                    actions += `<button id="ops_rev_btn_${s.id}" class="btn-secondary ops_rev_btn">Revoke</button>`;
+                }
+
+                $table.row.add([
+                    s.summary,
+                    s.userName,
+                    s.usesRemaining
+                ]);
+            }
+
+            $table.draw();
+            attachZtatButtonHandlers(); // re-bind the click events
+        });
+
+        $.get('/api/v1/zerotrust/accesstoken/list/denied/ops', function (data) {
+            const $table = $('#denied-ops-table').DataTable();
+            $table.clear();
+
+            for (let s of data) {
+                let actions = '';
+                if (s.canApprove) {
+                    actions += `<button id="ops_app_btn_${s.id}" class="btn-secondary ops_app_btn">Approve</button>`;
+                }
+                if (s.canDeny) {
+                    actions += `<button id="ops_den_btn_${s.id}" class="btn-secondary ops_den_btn">Deny</button>`;
+                }
+
+                $table.row.add([
+                    s.summary,
+                    s.userName,
+                    actions
+                ]);
+            }
+
+            $table.draw();
+            attachZtatButtonHandlers(); // re-bind the click events
+        });
+    }
+
+
+    function attachZtatButtonHandlers() {
+        $(".app_btn").off().click(function () {
             let id = this.id.split("_").pop();
-            $.get('/api/v1/zerotrust/accesstoken/terminal/approve?ztatId=' + id, {}, function() {
-                location.reload(); });
+            $.get('/api/v1/zerotrust/accesstoken/terminal/approve?ztatId=' + id, {}, function () {
+                reloadTerminalTATs();
+            });
         });
 
-        $(".den_btn").click(function () {
+        $(".den_btn").off().click(function () {
             let id = this.id.split("_").pop();
-            $.get('/api/v1/zerotrust/accesstoken/terminal/deny?ztatId='+ id, {}, function() { location.reload(); });
+            $.get('/api/v1/zerotrust/accesstoken/terminal/deny?ztatId=' + id, {}, function () {
+                reloadTerminalTATs();
+            });
         });
 
-        $(".rev_btn").click(function () {
+        $(".rev_btn").off().click(function () {
             let id = this.id.split("_").pop();
-            $.get('/api/v1/zerotrust/accesstoken/terminal/revoke?ztatId='+ id, {}, function() { location.reload(); });
+            $.get('/api/v1/zerotrust/accesstoken/terminal/revoke?ztatId=' + id, {}, function () {
+                reloadTerminalTATs();
+            });
         });
 
-        $(".ops_app_btn").click(function () {
+        $(".ops_app_btn").off().click(function () {
             let id = this.id.split("_").pop();
-            $.get('/api/v1/zerotrust/accesstoken/ops/approve?ztatId='+ id, {}, function() { location.reload(); });
+            $.get('/api/v1/zerotrust/accesstoken/ops/approve?ztatId=' + id, {}, function () {
+                reloadOpsTATs();
+            });
         });
 
-        $(".ops_den_btn").click(function () {
+        $(".ops_den_btn").off().click(function () {
             let id = this.id.split("_").pop();
-            $.get('/api/v1/zerotrust/accesstoken/ops/deny?ztatId='+ id, {}, function() { location.reload(); });
+            $.get('/api/v1/zerotrust/accesstoken/ops/deny?ztatId=' + id, {}, function () {
+                reloadOpsTATs();
+            });
         });
 
-        $(".ops_rev_btn").click(function () {
+        $(".ops_rev_btn").off().click(function () {
             let id = this.id.split("_").pop();
-            $.get('/api/v1/zerotrust/accesstoken/my/ops/revoke?ztatId='+ id, {}, function() { location.reload(); });
+            $.get('/api/v1/zerotrust/accesstoken/my/ops/revoke?ztatId=' + id, {}, function () {
+                reloadOpsTATs();
+            });
         });
+    }
+
+    let openTerminalTable, openOpsTable, approvedTerminalTable, approvedOpsTable, deniedTerminalTable, deniedOpsTable;
+
+    $(document).ready(function () {
+        openTerminalTable = $('#open-terminal-table').DataTable({
+            columns: [
+                { title: "Operation" },
+                { title: "User" },
+                { title: "System" },
+                { title: "Actions" }
+            ]
+        });
+
+        openOpsTable = $('#open-ops-table').DataTable({
+            columns: [
+                { title: "Operation" },
+                { title: "User" },
+                { title: "Actions" }
+            ]
+        });
+
+        approvedTerminalTable = $('#approved-terminal-table').DataTable({
+            columns: [
+                { title: "Operation" },
+                { title: "User" },
+                { title: "System" },
+                { title: "Uses Remaining" },
+                { title: "Actions" }
+            ]
+        });
+
+        approvedOpsTable = $('#approved-ops-table').DataTable({
+            columns: [
+                { title: "Operation" },
+                { title: "User" },
+                { title: "Uses Remaining" },
+                { title: "Actions" }
+            ]
+        });
+
+        deniedTerminalTable = $('#denied-terminal-table').DataTable({
+            columns: [
+                { title: "Operation" },
+                { title: "User" },
+                { title: "System" },
+                { title: "Actions" }
+            ]
+        });
+
+        deniedOpsTable = $('#denied-ops-table').DataTable({
+            columns: [
+                { title: "Operation" },
+                { title: "User" },
+                { title: "Actions" }
+            ]
+        });
+
+        attachZtatButtonHandlers();
     });
 </script>
 
diff --git a/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustAccessTokenService.java b/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustAccessTokenService.java
index 907f5762..aeb7d19f 100644
--- a/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustAccessTokenService.java
+++ b/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustAccessTokenService.java
@@ -277,10 +277,25 @@ public boolean hasJITRequest(String command, User user, HostSystem system) {
     return ztatRequestService.hasJITRequest(command, user.getId(), system.getId());
   }
 
-    public List<ZtatDTO> getOpenJITRequests(User operatingUser) {
-        return ztatRequestService.getOpenAccessTokenRequests(operatingUser);
-    }
+  public List<ZtatDTO> getOpenJITRequests(User operatingUser) {
+      return ztatRequestService.getOpenAccessTokenRequests(operatingUser);
+  }
 
+  public List<ZtatDTO> getDeniedJITRequests(User operatingUser) {
+    return ztatRequestService.getDeniedTerminalAccessTokenRequests(operatingUser);
+  }
+
+  public List<ZtatDTO> getDeniedOpsJITRequests(User operatingUser) {
+    return ztatRequestService.getDeniedOpsAccessTokenRequests(operatingUser);
+  }
+
+  public List<ZtatDTO> getApprovedJITRequests(User operatingUser) {
+    return ztatRequestService.getApprovedTerminalAccessTokenRequests(operatingUser);
+  }
+
+  public List<ZtatDTO> getApprovedOpsJITRequests(User operatingUser) {
+    return ztatRequestService.getApprovedOpsAccessTokenRequests(operatingUser);
+  }
   public List<ZtatDTO> getOpenOpsRequests(User operatingUser) {
       return ztatRequestService.getOpenOpsRequests(operatingUser);
   }
diff --git a/ops-scripts/local/deploy-helm.sh b/ops-scripts/local/deploy-helm.sh
index ecada310..3a3bb5c7 100755
--- a/ops-scripts/local/deploy-helm.sh
+++ b/ops-scripts/local/deploy-helm.sh
@@ -14,6 +14,8 @@ ENABLE_TLS=false
 INSTALL_CERT_MANAGER=false
 ENV_TARGET="local"  # default mode
 CERT_DIR="${SCRIPT_DIR}/../../docker/dev-certs"
+# set default to false
+DEPLOY_ADMINER=${DEPLOY_ADMINER:-false}
 
 # --- Load and back up environment file ---
 ENV_FILE="${SCRIPT_DIR}/../../.$ENV_TARGET.env"
@@ -208,7 +210,7 @@ if [[ -z "$KEYCLOAK_CLIENT_SECRET" ]]; then
 fi
 
 helm upgrade --install sentrius ./sentrius-chart --namespace ${TENANT} \
-    --set adminer.enabled=true \
+    --set adminer.enabled=${DEPLOY_ADMINER} \
     --set tenant=${TENANT} \
     --set environment=${ENVIRONMENT} \
     --set subdomain="${SUBDOMAIN}" \

From 8244f065a9a59122999866009e8409084ac269ae Mon Sep 17 00:00:00 2001
From: Marc <phrocker@apache.org>
Date: Mon, 7 Jul 2025 07:10:15 -0400
Subject: [PATCH 2/5] Update
 api/src/main/resources/templates/sso/ztats/view_ztats.html

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Marc <phrocker@apache.org>
---
 api/src/main/resources/templates/sso/ztats/view_ztats.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/api/src/main/resources/templates/sso/ztats/view_ztats.html b/api/src/main/resources/templates/sso/ztats/view_ztats.html
index 9d21291d..83f11936 100755
--- a/api/src/main/resources/templates/sso/ztats/view_ztats.html
+++ b/api/src/main/resources/templates/sso/ztats/view_ztats.html
@@ -385,7 +385,8 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                 $table.row.add([
                     s.summary,
                     s.userName,
-                    s.usesRemaining
+                    s.usesRemaining,
+                    actions
                 ]);
             }
 

From da1446dc52747a954395560f40c67f47d1244c97 Mon Sep 17 00:00:00 2001
From: Marc <phrocker@apache.org>
Date: Mon, 7 Jul 2025 07:10:33 -0400
Subject: [PATCH 3/5] Update
 api/src/main/resources/templates/sso/ztats/view_ztats.html

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Marc <phrocker@apache.org>
---
 api/src/main/resources/templates/sso/ztats/view_ztats.html | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/api/src/main/resources/templates/sso/ztats/view_ztats.html b/api/src/main/resources/templates/sso/ztats/view_ztats.html
index 83f11936..6756f2fe 100755
--- a/api/src/main/resources/templates/sso/ztats/view_ztats.html
+++ b/api/src/main/resources/templates/sso/ztats/view_ztats.html
@@ -521,6 +521,8 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
         });
 
         attachZtatButtonHandlers();
+        reloadTerminalTATs();
+        reloadOpsTATs();
     });
 </script>
 

From 43e457b2b5d9c7ee85a14ebc427e46149da2891a Mon Sep 17 00:00:00 2001
From: Marc Parisi <phrocker@apache.org>
Date: Mon, 7 Jul 2025 08:35:14 -0400
Subject: [PATCH 4/5] Fix issue with ztats not reloading

---
 .../api/ZeroTrustATApiController.java         | 91 ++++++++++++-------
 .../templates/sso/ztats/view_ztats.html       | 81 ++++++++++-------
 .../security/ZeroTrustRequestService.java     |  4 +
 3 files changed, 112 insertions(+), 64 deletions(-)

diff --git a/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java b/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
index d35eaaea..09a482a2 100644
--- a/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
+++ b/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
@@ -33,6 +33,7 @@
 import io.sentrius.sso.core.services.security.KeycloakService;
 import io.sentrius.sso.core.services.security.ZeroTrustAccessTokenService;
 import io.sentrius.sso.core.services.security.ZtatTokenService;
+import io.sentrius.sso.core.utils.AccessUtil;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
@@ -273,28 +274,27 @@ public ResponseEntity<?> getRequest(HttpServletRequest request, HttpServletRespo
 
     @GetMapping("/list/{type}")
     @LimitAccess(ztatAccess = {ZeroTrustAccessTokenEnum.CAN_VIEW_ZTATS})
-    public ResponseEntity<?> listZtatRequests(@RequestHeader("Authorization") String token,
+    public ResponseEntity<?> listZtatRequests(@RequestHeader(name= "Authorization", required=false) String token,
         @PathVariable("type") String type,
                                                                 HttpServletRequest request, HttpServletResponse response) {
-        String compactJwt = token.startsWith("Bearer ") ? token.substring(7) : token;
+        var operatingUser = getOperatingUser(request, response );
+        if (null != token) {
+            String compactJwt = token.startsWith("Bearer ") ? token.substring(7) : token;
 
 
-        log.info("Received ZTAT request from agent: {}", compactJwt);
-        if (!keycloakService.validateJwt(compactJwt)) {
-            log.warn("Invalid Keycloak token");
-            return ResponseEntity.status(HttpStatus.SC_UNAUTHORIZED).body("Invalid Keycloak token");
-        }
+            log.info("Received ZTAT request from agent: {}", compactJwt);
+            if (!keycloakService.validateJwt(compactJwt)) {
+                log.warn("Invalid Keycloak token");
+                return ResponseEntity.status(HttpStatus.SC_UNAUTHORIZED).body("Invalid Keycloak token");
+            }
+            String agentId = keycloakService.extractAgentId(compactJwt);
 
-        // Extract agent identity from the JWT
-        var operatingUser = getOperatingUser(request, response );
+            if (null == operatingUser) {
+                log.warn("No operating user found for agent: {}", agentId);
+                var username = keycloakService.extractUsername(compactJwt);
+                operatingUser = userService.getUserByUsername(username);
 
-        // Extract agent identity from the JWT
-        String agentId = keycloakService.extractAgentId(compactJwt);
-
-        if (null == operatingUser) {
-            log.warn("No operating user found for agent: {}", agentId);
-            var username = keycloakService.extractUsername(compactJwt);
-            operatingUser = userService.getUserByUsername(username);
+            }
 
         }
         List<ZtatDTO> ztatTracker = new ArrayList<ZtatDTO>();
@@ -324,36 +324,42 @@ public ResponseEntity<?> listZtatRequests(@RequestHeader("Authorization") String
             default:
                 log.warn("Invalid type: {}", type);
         }
+        ztatTracker = decorateTats(ztatTracker, operatingUser);
         return ResponseEntity.ok(ztatTracker);
     }
 
     @GetMapping("/list/{state}/{type}")
     @LimitAccess(ztatAccess = {ZeroTrustAccessTokenEnum.CAN_VIEW_ZTATS})
-    public ResponseEntity<?> listTypedZtatRequests(@RequestHeader("Authorization") String token,
+    public ResponseEntity<?> listTypedZtatRequests(@RequestHeader(name= "Authorization", required=false) String token,
                                               @PathVariable("type") String type,
                                                @PathVariable("state") String state,
                                               HttpServletRequest request, HttpServletResponse response) {
-        String compactJwt = token.startsWith("Bearer ") ? token.substring(7) : token;
 
+        var operatingUser = getOperatingUser(request, response );
+       if (null != token) {
+            String compactJwt = token.startsWith("Bearer ") ? token.substring(7) : token;
 
-        log.info("Received ZTAT request from agent: {}", compactJwt);
-        if (!keycloakService.validateJwt(compactJwt)) {
-            log.warn("Invalid Keycloak token");
-            return ResponseEntity.status(HttpStatus.SC_UNAUTHORIZED).body("Invalid Keycloak token");
-        }
 
-        // Extract agent identity from the JWT
-        var operatingUser = getOperatingUser(request, response );
+            log.info("Received ZTAT request from agent: {}", compactJwt);
+            if (!keycloakService.validateJwt(compactJwt)) {
+                log.warn("Invalid Keycloak token");
+                return ResponseEntity.status(HttpStatus.SC_UNAUTHORIZED).body("Invalid Keycloak token");
+            }
+               String agentId = keycloakService.extractAgentId(compactJwt);
 
-        // Extract agent identity from the JWT
-        String agentId = keycloakService.extractAgentId(compactJwt);
+               if (null == operatingUser) {
+                   log.warn("No operating user found for agent: {}", agentId);
+                   var username = keycloakService.extractUsername(compactJwt);
+                   operatingUser = userService.getUserByUsername(username);
 
-        if (null == operatingUser) {
-            log.warn("No operating user found for agent: {}", agentId);
-            var username = keycloakService.extractUsername(compactJwt);
-            operatingUser = userService.getUserByUsername(username);
+               }
 
         }
+        // Extract agent identity from the JWT
+
+
+        // Extract agent identity from the JWT
+
         List<ZtatDTO> ztatTracker = new ArrayList<ZtatDTO>();
         switch(type){
             case "terminal":
@@ -399,6 +405,7 @@ public ResponseEntity<?> listTypedZtatRequests(@RequestHeader("Authorization") S
             default:
                 log.warn("Invalid type: {}", type);
         }
+        ztatTracker = decorateTats(ztatTracker, operatingUser);
         return ResponseEntity.ok(ztatTracker);
     }
 
@@ -439,4 +446,26 @@ public ResponseEntity<Boolean> verifyZtat(@RequestBody ZtatChallengeRequest requ
         }
     }
 
+    List<ZtatDTO> decorateTats(List<ZtatDTO> tats, User operatingUser){
+        boolean canApprove = AccessUtil.canAccess(operatingUser, ZeroTrustAccessTokenEnum.CAN_APPROVE_ZTATS);
+        boolean canDeny = AccessUtil.canAccess(operatingUser, ZeroTrustAccessTokenEnum.CAN_DENY_ZTATS);
+        if (canApprove || canDeny) {
+            for (var tat : tats) {
+
+                if (tat.getUserName().equals(operatingUser.getUsername())) {
+                    tat.setCurrentUser(true);
+                    if (systemOptions.getCanApproveOwnZtat()) {
+                        tat.setCanApprove(canApprove);
+                        tat.setCanDeny(canDeny);
+                    }
+                }
+                else {
+                    tat.setCanApprove(canApprove);
+                    tat.setCanDeny(canDeny);
+                }
+
+            }
+        }
+        return tats;
+    }
 }
diff --git a/api/src/main/resources/templates/sso/ztats/view_ztats.html b/api/src/main/resources/templates/sso/ztats/view_ztats.html
index 6756f2fe..ed02eb0b 100755
--- a/api/src/main/resources/templates/sso/ztats/view_ztats.html
+++ b/api/src/main/resources/templates/sso/ztats/view_ztats.html
@@ -86,6 +86,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                         <tr><th>Operation</th><th>User</th><th>System</th><th>Actions</th></tr>
                                         </thead>
                                         <tbody>
+                                        <!--
                                         <tr th:each="s : ${openTerminalTats}">
                                             <td th:text="${s.command}"></td>
                                             <td th:text="${s.userName}"></td>
@@ -96,9 +97,10 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                                 <button th:id="'den_btn_' + ${s.id}" class="btn-secondary den_btn"
                                                         th:if="${s.canDeny}">Deny</button>
                                                 <button th:id="'rev_btn_' + ${s.id}" class="btn-secondary rev_btn"
-                                                        th:if="${s.isCurrentUser}">Revoke</button>
+                                                        th:if="${s.currentUser}">Revoke</button>
                                             </td>
                                         </tr>
+                                        -->
                                         </tbody>
                                     </table>
                                 </div>
@@ -110,6 +112,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                         <tr><th>Operation</th><th>User</th><th>Actions</th></tr>
                                         </thead>
                                         <tbody>
+                                        <!--
                                         <tr th:each="s : ${openOpsTats}">
                                             <td th:text="${s.summary}"></td>
                                             <td th:text="${s.userName}"></td>
@@ -122,10 +125,11 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                                 </button>
                                                 <button th:id="'ops_rev_btn_' + ${s.id}"
                                                         class="btn-secondary ops_rev_btn"
-                                                        th:if="${s.isCurrentUser}">Revoke
+                                                        th:if="${s.currentUser}">Revoke
                                                 </button>
                                             </td>
                                         </tr>
+                                        -->
                                         </tbody>
                                     </table>
                                 </div>
@@ -150,6 +154,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                                 Remaining</th><th>Actions</th></tr>
                                             </thead>
                                             <tbody>
+                                            <!--
                                             <tr th:each="s : ${approvedTerminalTats}">
                                                 <td th:text="${s.command}"></td>
                                                 <td th:text="${s.userName}"></td>
@@ -160,6 +165,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                                             th:if="${s.canDeny}">Deny</button>
                                                 </td>
                                             </tr>
+                                            -->
                                             </tbody>
                                         </table>
                                     </div>
@@ -172,6 +178,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                             </th></tr>
                                             </thead>
                                             <tbody>
+                                            <!--
                                             <tr th:each="s : ${approvedOpsTats}">
                                                 <td th:text="${s.summary}"></td>
                                                 <td th:text="${s.userName}"></td>
@@ -182,6 +189,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                                     </button>
                                                 </td>
                                             </tr>
+                                            -->
                                             </tbody>
                                         </table>
                                     </div>
@@ -189,8 +197,8 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                 </div>
 
 
-                    </div>
-                </div>
+                            </div>
+                        </div>
 
                         <!-- Denied TATs -->
                         <div id="deniedTats" class="tab-pane fade">
@@ -207,6 +215,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                             <tr><th>Operation</th><th>User</th><th>System</th><th>Actions</th></tr>
                                             </thead>
                                             <tbody>
+                                            <!--
                                             <tr th:each="s : ${deniedTerminalTats}">
                                                 <td th:text="${s.command}"></td>
                                                 <td th:text="${s.userName}"></td>
@@ -216,6 +225,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                                             th:if="${s.canApprove}">Approve</button>
                                                 </td>
                                             </tr>
+                                            -->
                                             </tbody>
                                         </table>
                                     </div>
@@ -227,6 +237,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                             <tr><th>Operation</th><th>User</th><th>Actions</th></tr>
                                             </thead>
                                             <tbody>
+                                            <!--
                                             <tr th:each="s : ${deniedOpsTats}">
                                                 <td th:text="${s.summary}"></td>
                                                 <td th:text="${s.userName}"></td>
@@ -237,6 +248,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                                                     </button>
                                                 </td>
                                             </tr>
+                                            -->
                                             </tbody>
                                         </table>
                                     </div>
@@ -247,10 +259,10 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                             </div>
                         </div>
 
+                    </div>
+                </div>
             </div>
         </div>
-    </div>
-</div>
 
 <!-- DataTables Initialization -->
 <script>
@@ -267,7 +279,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                 if (s.canDeny) {
                     actions += `<button id="den_btn_${s.id}" class="btn-secondary den_btn">Deny</button>`;
                 }
-                if (s.isCurrentUser) {
+                if (s.currentUser) {
                     actions += `<button id="rev_btn_${s.id}" class="btn-secondary rev_btn">Revoke</button>`;
                 }
 
@@ -295,7 +307,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                 if (s.canDeny) {
                     actions += `<button id="den_btn_${s.id}" class="btn-secondary den_btn">Deny</button>`;
                 }
-                if (s.isCurrentUser) {
+                if (s.currentUser) {
                     actions += `<button id="rev_btn_${s.id}" class="btn-secondary rev_btn">Revoke</button>`;
                 }
 
@@ -351,7 +363,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                 if (s.canDeny) {
                     actions += `<button id="ops_den_btn_${s.id}" class="btn-secondary ops_den_btn">Deny</button>`;
                 }
-                if (s.isCurrentUser) {
+                if (s.currentUser) {
                     actions += `<button id="ops_rev_btn_${s.id}" class="btn-secondary ops_rev_btn">Revoke</button>`;
                 }
 
@@ -378,7 +390,7 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
                 if (s.canDeny) {
                     actions += `<button id="ops_den_btn_${s.id}" class="btn-secondary ops_den_btn">Deny</button>`;
                 }
-                if (s.isCurrentUser) {
+                if (s.currentUser) {
                     actions += `<button id="ops_rev_btn_${s.id}" class="btn-secondary ops_rev_btn">Revoke</button>`;
                 }
 
@@ -469,57 +481,60 @@ <h2 class="toast-header">Trust AT (TAT) Management</h2>
     $(document).ready(function () {
         openTerminalTable = $('#open-terminal-table').DataTable({
             columns: [
-                { title: "Operation" },
-                { title: "User" },
-                { title: "System" },
-                { title: "Actions" }
+                { title: "Operation", data: 0 }, // Explicitly map column 0 to array element 0
+                { title: "User", data: 1 },      // Explicitly map column 1 to array element 1
+                { title: "System", data: 2 },
+                { title: "Actions", data: 3 }
             ]
         });
 
+
         openOpsTable = $('#open-ops-table').DataTable({
             columns: [
-                { title: "Operation" },
-                { title: "User" },
-                { title: "Actions" }
+                { title: "Summary", data: 0 },
+                { title: "User" ,  data: 1},
+                { title: "Actions",  data: 2 }
             ]
         });
 
         approvedTerminalTable = $('#approved-terminal-table').DataTable({
             columns: [
-                { title: "Operation" },
-                { title: "User" },
-                { title: "System" },
-                { title: "Uses Remaining" },
-                { title: "Actions" }
+                { title: "Operation", data: 0 },
+                { title: "User", data: 1 },
+                { title: "System", data: 2 },
+                { title: "Uses Remaining", data: 3 },
+                { title: "Actions", data: 4 }
             ]
         });
 
+
         approvedOpsTable = $('#approved-ops-table').DataTable({
             columns: [
-                { title: "Operation" },
-                { title: "User" },
-                { title: "Uses Remaining" },
-                { title: "Actions" }
+                { title: "Operation", data: 0 },
+                { title: "User", data: 1 },
+                { title: "Uses Remaining", data: 2 },
+                { title: "Actions", data: 3 }
             ]
         });
 
         deniedTerminalTable = $('#denied-terminal-table').DataTable({
             columns: [
-                { title: "Operation" },
-                { title: "User" },
-                { title: "System" },
-                { title: "Actions" }
+                { title: "Operation", data: 0 },
+                { title: "User", data: 1 },
+                { title: "System", data: 2 },
+                { title: "Actions", data: 3 }
             ]
         });
 
         deniedOpsTable = $('#denied-ops-table').DataTable({
             columns: [
-                { title: "Operation" },
-                { title: "User" },
-                { title: "Actions" }
+                { title: "Operation", data: 0 },
+                { title: "User", data: 1 },
+                { title: "Actions", data: 2 }
             ]
         });
 
+
         attachZtatButtonHandlers();
         reloadTerminalTATs();
         reloadOpsTATs();
diff --git a/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java b/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java
index bbc95b09..78c8a891 100644
--- a/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java
+++ b/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java
@@ -269,8 +269,12 @@ public List<ZtatDTO> getOpenAccessTokenRequests(@NonNull User currentUser) {
         for (ZeroTrustAccessTokenRequest request : openRequests) {
             var dto = convertToDTO(request);
             if (Objects.equals(currentUser.getId(), request.getUser().getId())) {
+                log.info("Current user matches request user: {}", request.getUser().getUsername());
                 dto.setCurrentUser(true);
             }
+            else {
+                log.info("Current user does not match request user: {} vs {}", currentUser.getUsername(), request.getUser().getUsername());
+            }
             ztatTrackerList.add(dto);
         }
 

From 798c6afbb940105827ba106642020ea47558e10c Mon Sep 17 00:00:00 2001
From: Marc Parisi <phrocker@apache.org>
Date: Mon, 7 Jul 2025 13:24:57 -0400
Subject: [PATCH 5/5] Fix issue with negative counts

---
 .../api/ZeroTrustATApiController.java         | 23 +++++++++++--------
 .../security/ZeroTrustRequestService.java     |  3 ++-
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java b/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
index 09a482a2..37949df8 100644
--- a/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
+++ b/api/src/main/java/io/sentrius/sso/controllers/api/ZeroTrustATApiController.java
@@ -452,18 +452,21 @@ List<ZtatDTO> decorateTats(List<ZtatDTO> tats, User operatingUser){
         if (canApprove || canDeny) {
             for (var tat : tats) {
 
-                if (tat.getUserName().equals(operatingUser.getUsername())) {
-                    tat.setCurrentUser(true);
-                    if (systemOptions.getCanApproveOwnZtat()) {
-                        tat.setCanApprove(canApprove);
+                    if (tat.getUserName().equals(operatingUser.getUsername())) {
+                        tat.setCurrentUser(true);
+                        if (systemOptions.getCanApproveOwnZtat()) {
+                            if (tat.getUsesRemaining() > 0) {
+                                tat.setCanApprove(canApprove);
+                            }
+                            tat.setCanDeny(canDeny);
+                        }
+                    }
+                    else {
+                        if (tat.getUsesRemaining() > 0) {
+                            tat.setCanApprove(canApprove);
+                        }
                         tat.setCanDeny(canDeny);
                     }
-                }
-                else {
-                    tat.setCanApprove(canApprove);
-                    tat.setCanDeny(canDeny);
-                }
-
             }
         }
         return tats;
diff --git a/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java b/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java
index 78c8a891..47a6f0f7 100644
--- a/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java
+++ b/dataplane/src/main/java/io/sentrius/sso/core/services/security/ZeroTrustRequestService.java
@@ -388,7 +388,8 @@ private Integer getUsesRemaining(ZeroTrustAccessTokenRequest request) {
             List<ZeroTrustAccessTokenApproval> approval = request.getApprovals();
             if (!approval.isEmpty()) {
                 var uses = ztatUseRepository.getUses(approval.get(0));
-                return systemOptions.maxJitUses - uses.size();
+                var usesRemaining = systemOptions.maxJitUses - uses.size();
+                return Math.max(usesRemaining, 0);
             }
 
         return systemOptions.maxJitUses; // Update as needed based on your logic