You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix(okta): make the params transform authoritative over the serialized inputs
The generic block handler merges the transform on top of the raw serialized
inputs (`{ ...inputs, ...transformedParams }`), so a key the transform omits
keeps the raw subBlock string rather than being dropped. Two intended
behaviors were silently defeated by that merge:
- a non-numeric `limit` or `priority` reached Okta verbatim instead of being
dropped so Okta could apply its own default
- a blank profile field in `update_user` — a POST merge, so a partial update —
overwrote the stored Okta value with an empty string instead of leaving it
untouched
Assign every key the block can send, including the ones it drops, so
`undefined` actually removes them. Cover both cases with tests that assert on
the merge rather than on the transform alone.
Also align the block with what the tools really return: drop `targets` and
`debugData`, which only exist nested inside a System Log event and were never
emitted at the top level, and surface the fifteen user and group profile
fields `get_user` and `get_group` emit but the block did not declare.
Declare `authMode` explicitly rather than leaning on the docs generator's
credential-subBlock heuristic, route the remaining fifteen tools through the
shared `oktaHeaders`/`throwOktaError` helpers so there is one auth and error
path, add wand prompts for the search, filter, expression, and timestamp
fields, and add skills for MFA reset, sign-in investigation, and application
access review to match the operations this block now has.
`limit` on List Group Members is Okta's default of 1000, not a maximum.
'Integrate Okta identity management into your workflow. Manage users, groups, and group rules. Run service desk actions like resetting MFA factors and clearing sessions. Review and change application assignments and admin roles. Query the System Log to audit sign-ins and admin changes.',
placeholder: 'Describe who or what to search for',
260
+
prompt:
261
+
'Generate an Okta search expression. The grammar is SCIM-style: a property, an operator (eq, sw, co, gt, ge, lt, le), and a quoted value, combined with and/or and parentheses. User properties are prefixed with profile (profile.firstName, profile.email, profile.department) plus the top-level id, status, created, activated, statusChanged and lastUpdated. Group properties are type plus profile.name and profile.description. Example: profile.department eq "Engineering" and status eq "ACTIVE". Return ONLY the expression - no explanations, no extra text.',
placeholder: 'Describe how to narrow the results',
277
+
prompt:
278
+
'Generate an Okta filter expression. The grammar is SCIM-style: a property, an operator (eq, and for lastUpdated also gt, ge, lt, le), and a quoted value, combined with and/or. Each listing supports a limited property set. Users: status, lastUpdated, id, profile.login, profile.email, profile.firstName, profile.lastName. Groups: id, type, lastUpdated, lastMembershipUpdated. Applications: id, status, name. System Log: any event property, such as eventType, outcome.result, actor.alternateId or client.ipAddress. Example: eventType eq "user.session.start" and outcome.result eq "FAILURE". Return ONLY the expression - no explanations, no extra text.',
placeholder: 'Describe which users the rule should match',
513
532
prompt:
514
-
'Generate an Okta expression language predicate that evaluates to a boolean over a user profile, for example user.department=="Engineering". Return ONLY the expression.',
533
+
'Generate an Okta Expression Language predicate that evaluates to a boolean over a user profile. Reference profile attributes as user.<attribute>, combine them with && and ||, and compare with == or !=. Example: user.department=="Engineering" && user.countryCode=="US". Return ONLY the expression - no explanations, no extra text.',
prompt: 'Generate an ISO 8601 timestamp. Return ONLY the timestamp string.',
807
+
placeholder: 'Describe the start of the time window',
808
+
prompt:
809
+
'Generate an ISO 8601 UTC timestamp for the start of a System Log query window, for example 2026-08-01T00:00:00.000Z. Return ONLY the timestamp - no explanations, no extra text.',
prompt: 'Generate an ISO 8601 timestamp. Return ONLY the timestamp string.',
821
+
placeholder: 'Describe the end of the time window',
822
+
prompt:
823
+
'Generate an ISO 8601 UTC timestamp for the end of a System Log query window, for example 2026-08-15T00:00:00.000Z. Return ONLY the timestamp - no explanations, no extra text.',
'# Audit Group Membership\n\nReview who belongs to Okta groups, focusing on privileged access.\n\n## Steps\n1. Run List Groups to enumerate the groups, or Get Group for a specific one.\n2. For each group of interest, run List Group Members.\n3. Highlight privileged or admin groups and call out any unexpected members.\n\n## Output\nA per-group roster with member counts, and a short list of access concerns to review.',
1241
1280
},
1281
+
{
1282
+
name: 'reset-user-mfa',
1283
+
description: 'Reset a locked-out user MFA enrollment so they can enroll a factor again.',
1284
+
content:
1285
+
'# Reset User MFA\n\nClear a stuck multifactor enrollment, the most common Okta help desk request.\n\n## Steps\n1. Run List Factors for the user to see which factors are enrolled and their status.\n2. Reset the narrowest thing that fixes it: Reset Factor for one factor id, or Reset All Factors when every enrollment must go.\n3. Note that resetting push also unenrolls the related Okta Verify factors, and that factors cannot be reset on a deactivated user.\n4. Run Clear User Sessions if the user must be signed out of existing sessions before re-enrolling.\n\n## Output\nName the factors that were reset and state that the user must re-enroll before they can complete MFA again. Both resets are irreversible, so confirm the target user before running either.',
1286
+
},
1287
+
{
1288
+
name: 'investigate-sign-in-failures',
1289
+
description: 'Query the Okta System Log for failed sign-ins and suspicious authentication.',
1290
+
content:
1291
+
'# Investigate Sign-In Failures\n\nUse the System Log to explain why a user cannot sign in, or to review suspicious authentication.\n\n## Steps\n1. Run Get System Log Events with a Since and Until that bracket the incident.\n2. Filter to the events that matter, for example eventType eq "user.session.start" and outcome.result eq "FAILURE" for failed sign-ins.\n3. Narrow to one person or origin by adding actor.alternateId or client.ipAddress to the filter, or use the keyword query for a free-text sweep.\n4. Read outcomeReason, clientIpAddress, and the client geography on each event to separate a wrong password from an unexpected location.\n5. Page with the returned cursor while hasMore is true when the window is wide.\n\n## Output\nA short timeline of the matching events with actor, time, outcome, reason, and source IP, plus a plain statement of the likely cause.',
1292
+
},
1293
+
{
1294
+
name: 'review-app-access',
1295
+
description: 'Audit who can reach an Okta application through direct and group assignments.',
1296
+
content:
1297
+
'# Review Application Access\n\nEstablish who has access to an application and how they got it.\n\n## Steps\n1. Run List Applications to resolve the application id, or Get Application when the id is known.\n2. Run List Application Users and read the scope on each assignment: USER means a direct grant, GROUP means it was inherited.\n3. Run List Application Groups to see which groups confer access, since every member of those groups reaches the app.\n4. Expand any group of interest with List Group Members to get the real roster.\n5. Revoke with Remove User from Application for a direct grant, or Remove Group from Application to cut the whole group.\n\n## Output\nA roster split into direct and group-inherited access, naming the groups that grant it, and a list of assignments that look unjustified.',
1298
+
},
1242
1299
{
1243
1300
name: 'reset-user-password',
1244
1301
description: 'Trigger an Okta password reset for a user who is locked out.',
0 commit comments