Add self-service access requests + approvals (lightweight IGA)

A user requests membership in a group; a reviewer approves or denies. Approval
grants the group through the normal Okta -> AD path (so nesting + ACLs apply),
and every step is audited -- access via a reviewable workflow, not a favour.

- requests.py: AccessRequest + RequestQueue
- engine: request_access / approve_request / deny_request (audited), state persisted
- cli: request, requests, approve, deny
- api: GET/POST /requests, POST /requests/approve, /requests/deny
- GUI: Requests view (queue + approve/deny buttons + file-a-request form),
  demo + live backends; snapshot exports the group list + request queue
- 6 request tests (73 total, ruff-clean); browser-verified end-to-end

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9BehfGmiCrz3J15W18rc9

Author: sanjaydoc

README.md

@@ -127,6 +127,7 @@ Delivery, Platform, Data-Science + Lab-Ops, Compliance, Facilities, Legal, IT):
 | Module | What it does | Who it serves |
 |---|---|---|
 | **Identity & access** | Onboard/offboard, SCIM sync, nested-group ACLs, audited allow/deny, access reviews | IT, everyone |
+| **Access requests & approvals** | Self-service request → reviewer approve/deny → auto-provisioned through the normal Okta→AD path, audited | IT, managers, everyone |
 | **Endpoints / devices** | Images + ships a managed laptop per role (encryption, MDM, MFA, Iru/Ansible); wipe & return at offboard | IT |
 | **Compliance-gated access** | Training records (IACUC, biosafety…) that gate sensitive lab data; access auto-revokes when training lapses | Compliance, In-Vivo, IT |
 | **SaaS & cost** | Who has a seat in what and **what it costs**; orphaned-seat detection; provisioned on onboard, reclaimed on offboard | IT, Finance |
@@ -265,6 +266,9 @@ labsuite train --user nrahman --training IACUC      # complete a training (unloc
 labsuite offboard --user nrahman                    # same-day, verified clean
 
 # governance + operations
+labsuite request --user lpark --group Data-Science --why "ML side-project"
+labsuite requests                                   # the request queue
+labsuite approve --id REQ-0001                       # grants it through Okta -> AD
 labsuite review                                     # access review + anomaly flags
 labsuite compliance                                 # training records
 labsuite devices                                    # managed laptop fleet

RUN.md

@@ -51,6 +51,12 @@ labsuite train  --user nrahman --training IACUC          # complete a training
 labsuite train  --user nrahman --training Biosafety --expire   # lapse it (revokes gated access)
 labsuite compliance                                       # all training records
 
+# Access requests + approvals (self-service governance)
+labsuite request --user lpark --group Data-Science --why "ML side-project"
+labsuite requests                         # the request queue
+labsuite approve --id REQ-0001            # grant it (Okta -> AD)
+labsuite deny --id REQ-0002 --note "not justified"
+
 # Governance + operations
 labsuite login   --user anguyen           # demo password is used by default
 labsuite sync                             # run the SCIM reconcile
@@ -99,6 +105,7 @@ labsuite serve                 # http://127.0.0.1:8000
 - `GET /devices`, `GET /compliance`, `POST /compliance/complete` · `/expire`
 - `GET /ops`, `GET /saas`, `GET /assets`, `GET /inventory`, `GET /vendors`, `GET /safety`
 - `POST /assets/maintenance`, `/inventory/reorder`, `/safety/resolve`, `/vendors/renew`, `/saas/grant`, `/saas/revoke`
+- `GET /requests`, `POST /requests` · `/requests/approve` · `/requests/deny`
 
 The web GUI is **fully operable** — onboard/offboard, complete/lapse training,
 grant/revoke SaaS seats, mark maintenance done, reorder stock, renew vendors, and

docs/app/app.js

@@ -53,6 +53,8 @@ class DemoEngine {
     this.inventory = ops.inventory || [];
     this.vendors = ops.vendors || [];
     this.safety = ops.safety || [];
+    this.requests = (data.requests || []).map((r) => ({ ...r }));
+    this.reqCounter = this._maxReq();
   }
 
   // ---- compliance ---------------------------------------------------
@@ -127,6 +129,35 @@ class DemoEngine {
     if (v) { v.renewal_in_days = 365; this.log("operations", "vendor.renew", name, "success"); }
     return v;
   }
+  // ---- access requests + approvals ---------------------------------
+  requestAccess(user, group, justification) {
+    this.reqCounter = (this.reqCounter || this._maxReq()) + 1;
+    const req = { id: "REQ-" + String(this.reqCounter).padStart(4, "0"), requester: user, group,
+      justification: justification || "", status: "pending", decided_by: "", note: "" };
+    this.requests.push(req);
+    this.log(user, "access.request", `${req.id}:${group}`, "success", justification || "");
+    return req;
+  }
+  _maxReq() {
+    return this.requests.reduce((m, r) => Math.max(m, parseInt(r.id.replace(/\D/g, ""), 10) || 0), 0);
+  }
+  approveRequest(id) {
+    const r = this.requests.find((x) => x.id === id);
+    if (!r || r.status !== "pending") return r;
+    const u = this.users[r.requester];
+    if (u && !u.okta_groups.includes(r.group)) u.okta_groups.push(r.group);
+    r.status = "approved"; r.decided_by = "it-admin";
+    this.log("it-admin", "request.approve", `${r.id}:${r.group}`, "success", `granted ${r.group} to ${r.requester}`);
+    return r;
+  }
+  denyRequest(id, note) {
+    const r = this.requests.find((x) => x.id === id);
+    if (!r || r.status !== "pending") return r;
+    r.status = "denied"; r.decided_by = "it-admin"; r.note = note || "";
+    this.log("it-admin", "request.deny", `${r.id}:${r.group}`, "denied", note || "");
+    return r;
+  }
+
   grantSaasSeat(username, app) {
     (this.saas[app] ||= { name: app, cost: (this.d.saas_catalog || {})[app] || 0, assignees: new Set() }).assignees.add(username);
     this.log("saas", "saas.grant", username, "success", app);
@@ -370,6 +401,10 @@ const demoBackend = {
   async renewVendor(name) { engine.renewVendor(name); },
   async grantSaasSeat(u, app) { engine.grantSaasSeat(u, app); },
   async revokeSaasSeat(u, app) { engine.revokeSaasSeat(u, app); },
+  async requestsList() { return engine.requests.slice(); },
+  async createRequest(u, g, j) { engine.requestAccess(u, g, j); },
+  async approveRequest(id) { engine.approveRequest(id); },
+  async denyRequest(id, note) { engine.denyRequest(id, note); },
   async usernames() { return Object.keys(engine.users).sort(); },
 };
 
@@ -426,6 +461,10 @@ const liveBackend = {
   async renewVendor(name) { await this._post("/vendors/renew", { name }); },
   async grantSaasSeat(u, app) { await this._post("/saas/grant", { username: u, app_name: app }); },
   async revokeSaasSeat(u, app) { await this._post("/saas/revoke", { username: u, app_name: app }); },
+  async requestsList() { try { return (await this._json("/requests")).requests; } catch { return []; } },
+  async createRequest(u, g, j) { await this._post("/requests", { requester: u, group: g, justification: j }); },
+  async approveRequest(id) { await this._post("/requests/approve", { request_id: id }); },
+  async denyRequest(id, note) { await this._post("/requests/deny", { request_id: id, note }); },
   async usernames() {
     try { return (await this._json("/scim/v2/Users")).Resources.map((u) => u.userName).sort(); }
     catch { return Object.keys(engine.users).sort(); }
@@ -666,6 +705,34 @@ async function renderAudit() {
     </div>`).join("") : '<div class="muted">No events yet — try onboarding or a decision, then return here.</div>';
 }
 
+async function renderRequests() {
+  const [reqs, users] = await Promise.all([backend.requestsList(), backend.usernames()]);
+  const groups = (D.all_groups || []).filter((g) => g !== "Everyone");
+  const statusChip = (s) => s === "approved" ? '<span class="chip allow">approved</span>'
+    : s === "denied" ? '<span class="chip deny">denied</span>' : '<span class="chip">pending</span>';
+  const rows = reqs.slice().sort((a, b) => b.id.localeCompare(a.id)).map((r) => {
+    const actions = r.status === "pending"
+      ? `${_actBtn("approve", `data-id="${esc(r.id)}"`, "approve")} ${_actBtn("deny", `data-id="${esc(r.id)}"`, "deny")}`
+      : `<span class="muted">${esc(r.decided_by || "")}</span>`;
+    return `<tr><td>${esc(r.id)}</td><td>${esc(r.requester)}</td><td><span class="tag">${esc(r.group)}</span></td>
+      <td class="muted">${esc(r.justification || "")}</td><td>${statusChip(r.status)}</td><td>${actions}</td></tr>`;
+  }).join("") || `<tr><td colspan="6" class="muted">No requests yet — file one below.</td></tr>`;
+  byId("req-table").innerHTML =
+    `<tr><th>ID</th><th>Requester</th><th>Group</th><th>Justification</th><th>Status</th><th></th></tr>${rows}`;
+  byId("req-user").innerHTML = users.map((u) => `<option>${esc(u)}</option>`).join("");
+  byId("req-group").innerHTML = groups.map((g) => `<option>${esc(g)}</option>`).join("");
+  $$("#req-table button.act").forEach((b) => b.onclick = async () => {
+    if (b.dataset.act === "approve") await backend.approveRequest(b.dataset.id);
+    else await backend.denyRequest(b.dataset.id, "");
+    renderRequests();
+  });
+  byId("req-submit").onclick = async () => {
+    await backend.createRequest(byId("req-user").value, byId("req-group").value, byId("req-why").value);
+    byId("req-why").value = "";
+    renderRequests();
+  };
+}
+
 async function renderCompliance() {
   const records = await backend.complianceRecords();
   const trainings = ["Data-Handling", "Biosafety", "Chemical-Safety", "IACUC"];
@@ -810,6 +877,7 @@ const RENDERERS = {
   overview: renderOverview, directory: renderDirectory, explorer: renderExplorer,
   review: renderReview, audit: renderAudit, architecture: renderArchitecture,
   devices: renderDevices, compliance: renderCompliance, saas: renderSaas, ops: renderOps,
+  requests: renderRequests,
 };
 
 function go(view) {

docs/app/data.js

@@ -610,6 +610,29 @@ window.LABSUITE_DATA = {
       }
     ]
   },
+  "all_groups": [
+    "Bio",
+    "CI-Operators",
+    "Compliance",
+    "Compliance-Read",
+    "Data-Science",
+    "Delivery",
+    "Domain-Admins",
+    "Everyone",
+    "Facilities",
+    "GPU-Cluster-Users",
+    "Histology",
+    "IT",
+    "In-Vivo",
+    "Lab",
+    "Lab-DAQ-Operators",
+    "Lab-Ops",
+    "Legal",
+    "Legal-Privileged",
+    "Platform",
+    "Research"
+  ],
+  "requests": [],
   "users": [
     {
       "username": "anguyen",

docs/app/index.html

@@ -41,6 +41,7 @@
       <button class="navitem" data-view="devices">Devices</button>
       <div class="grp">Govern</div>
       <button class="navitem" data-view="explorer">Access explorer</button>
+      <button class="navitem" data-view="requests">Requests</button>
       <button class="navitem" data-view="review">Access review</button>
       <button class="navitem" data-view="compliance">Compliance</button>
       <button class="navitem" data-view="audit">Audit log</button>
@@ -152,6 +153,22 @@ <h2>Audit log</h2>
         <div class="card" id="audit-list"></div>
       </section>
 
+      <!-- Requests -->
+      <section class="view" id="view-requests">
+        <h2>Access requests</h2>
+        <div class="sub">Self-service requests → reviewer approves or denies. Approval grants the group through the normal Okta → AD path — all audited.</div>
+        <div class="card" style="padding:6px 18px;margin-bottom:16px"><table id="req-table"></table></div>
+        <div class="card">
+          <div class="label" style="margin-bottom:8px">File a request</div>
+          <div style="display:flex;gap:10px;align-items:flex-end;flex-wrap:wrap">
+            <div class="field" style="margin:0"><label>User</label><select id="req-user" style="width:auto"></select></div>
+            <div class="field" style="margin:0"><label>Group</label><select id="req-group" style="width:auto"></select></div>
+            <div class="field" style="margin:0;flex:1;min-width:180px"><label>Justification</label><input id="req-why" placeholder="why do you need this?" /></div>
+            <button class="btn btn-sm" id="req-submit">Submit request</button>
+          </div>
+        </div>
+      </section>
+
       <!-- Compliance -->
       <section class="view" id="view-compliance">
         <h2>Compliance</h2>

scripts/export_snapshot.py

@@ -94,6 +94,8 @@ def main() -> None:
         "saas_role_apps": dict(SAAS_ROLE_APPS),
         "compliance_records": cp.compliance.all_records(),
         "operations": cp.ops.to_dict(),
+        "all_groups": sorted({g.name for g in cp.ad.groups.values()} | set(cp.okta.groups)),
+        "requests": cp.requests.to_dict()["requests"],
         "users": users,
         "ad_nesting": ad_nesting,
         "shares": shares,

src/labsuite/api.py

@@ -119,6 +119,34 @@ def offboard(username: str = Body(..., embed=True)) -> dict:
     def sync() -> dict:
         return control.sync().to_dict()
 
+    # --------------------------------------------------------------- #
+    # Access requests + approvals
+    # --------------------------------------------------------------- #
+    @app.get("/requests")
+    def list_requests() -> dict:
+        return {"requests": [r.to_dict() for r in control.requests.all()]}
+
+    @app.post("/requests")
+    def create_request(requester: str = Body(...), group: str = Body(...), justification: str = Body(default="")) -> dict:
+        try:
+            return control.request_access(requester, group, justification).to_dict()
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=str(exc)) from exc
+
+    @app.post("/requests/approve")
+    def approve(request_id: str = Body(..., embed=True)) -> dict:
+        try:
+            return control.approve_request(request_id).to_dict()
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=str(exc)) from exc
+
+    @app.post("/requests/deny")
+    def deny(request_id: str = Body(...), note: str = Body(default="")) -> dict:
+        try:
+            return control.deny_request(request_id, note=note).to_dict()
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=str(exc)) from exc
+
     @app.get("/access/{username}")
     def access(username: str) -> dict:
         return control.resolve_access(username).to_dict()

src/labsuite/cli.py

@@ -239,6 +239,51 @@ def cmd_compliance(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_request(args: argparse.Namespace) -> int:
+    cp = _load_or_build(args.state)
+    try:
+        req = cp.request_access(args.user, args.group, args.why or "")
+    except KeyError as exc:
+        raise SystemExit(str(exc)) from exc
+    print(f"{_c(req.id, CYAN)} — {args.user} requests {args.group} {DIM}({req.status}){RESET}")
+    _save(cp, args.state)
+    return 0
+
+
+def cmd_requests(args: argparse.Namespace) -> int:
+    cp = _load_or_build(args.state)
+    _header("Access requests")
+    for r in cp.requests.all():
+        colour = GREEN if r.status == "approved" else RED if r.status == "denied" else CYAN
+        by = f" by {r.decided_by}" if r.decided_by else ""
+        print(f"  {r.id}  {r.requester:10} -> {r.group:18} {_c(r.status, colour)}{by}  {DIM}{r.justification}{RESET}")
+    if not cp.requests.requests:
+        print(f"  {DIM}(no requests){RESET}")
+    return 0
+
+
+def cmd_approve(args: argparse.Namespace) -> int:
+    cp = _load_or_build(args.state)
+    try:
+        req = cp.approve_request(args.id)
+    except KeyError as exc:
+        raise SystemExit(str(exc)) from exc
+    print(f"{req.id}: {_c('approved', GREEN)} — {req.requester} granted {req.group}")
+    _save(cp, args.state)
+    return 0
+
+
+def cmd_deny(args: argparse.Namespace) -> int:
+    cp = _load_or_build(args.state)
+    try:
+        req = cp.deny_request(args.id, note=args.note or "")
+    except KeyError as exc:
+        raise SystemExit(str(exc)) from exc
+    print(f"{req.id}: {_c('denied', RED)}")
+    _save(cp, args.state)
+    return 0
+
+
 def cmd_devices(args: argparse.Namespace) -> int:
     cp = _load_or_build(args.state)
     _header("Managed device fleet")
@@ -473,6 +518,24 @@ def build_parser() -> argparse.ArgumentParser:
     p.set_defaults(func=cmd_check)
 
     sub.add_parser("review", help="quarterly access review with anomaly flags").set_defaults(func=cmd_review)
+
+    p = sub.add_parser("request", help="request access to a group")
+    p.add_argument("--user", required=True)
+    p.add_argument("--group", required=True)
+    p.add_argument("--why", help="justification")
+    p.set_defaults(func=cmd_request)
+
+    sub.add_parser("requests", help="list access requests").set_defaults(func=cmd_requests)
+
+    p = sub.add_parser("approve", help="approve an access request")
+    p.add_argument("--id", required=True)
+    p.set_defaults(func=cmd_approve)
+
+    p = sub.add_parser("deny", help="deny an access request")
+    p.add_argument("--id", required=True)
+    p.add_argument("--note")
+    p.set_defaults(func=cmd_deny)
+
     sub.add_parser("devices", help="list the managed laptop fleet").set_defaults(func=cmd_devices)
     sub.add_parser("compliance", help="show training records").set_defaults(func=cmd_compliance)