Add tctl decision command

Implements the new subcommand as described in RFD024e. The only
deviation is in naming, instead of a `decision-service` command
with subcommands of `evaluate-ssh-access` and `evaluate-db-access`
as described in the RFD there is a series of commands:

- `tctl decicion evaluate ssh`
- `tctl decicion evaluate db`

This will allow the decision subcommand to grow as new features are
added and also removes the `-` from the commands to better follow
existing command names.

tool/tctl/common/cmds.go

@@ -20,6 +20,7 @@ package common
 
 import (
 	"github.com/gravitational/teleport/tool/tctl/common/accessmonitoring"
+	"github.com/gravitational/teleport/tool/tctl/common/decision"
 	"github.com/gravitational/teleport/tool/tctl/common/loginrule"
 	"github.com/gravitational/teleport/tool/tctl/common/plugin"
 	"github.com/gravitational/teleport/tool/tctl/sso/configure"
@@ -67,5 +68,6 @@ func Commands() []CLICommand {
 		&touchIDCommand{},
 		&TerraformCommand{},
 		&AutoUpdateCommand{},
+		&decision.Command{},
 	}
 }

tool/tctl/common/decision/command.go

@@ -0,0 +1,54 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package decision
+
+import (
+	"context"
+	"io"
+	"os"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/service/servicecfg"
+	commonclient "github.com/gravitational/teleport/tool/tctl/common/client"
+	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
+)
+
+// Command is a group of commands to interact with the Teleport Decision Service.
+type Command struct {
+	// Output is the writer that any command output should be written to.
+	Output io.Writer
+
+	evaluateCommand EvaluateCommand
+}
+
+// Initialize sets up the "tctl decision" command.
+func (c *Command) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFlags, _ *servicecfg.Config) {
+	if c.Output == nil {
+		c.Output = os.Stdout
+	}
+
+	cmd := app.Command("decision", "Interact with the Teleport Decision Service.").Hidden()
+	c.evaluateCommand.Initialize(cmd, c.Output)
+}
+
+// TryRun attempts to run subcommands.
+func (c *Command) TryRun(ctx context.Context, cmd string, clientFunc commonclient.InitFunc) (bool, error) {
+	match, err := c.evaluateCommand.TryRun(ctx, cmd, clientFunc)
+	return match, trace.Wrap(err)
+}

tool/tctl/common/decision/command_test.go

@@ -0,0 +1,59 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package decision_test
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+
+	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+)
+
+type fakeDecisionService struct {
+	authclient.ClientI
+
+	decisionClient decisionpb.DecisionServiceClient
+}
+
+func (f fakeDecisionService) DecisionClient() decisionpb.DecisionServiceClient {
+	return f.decisionClient
+}
+
+type fakeDecisionServiceClient struct {
+	decisionpb.DecisionServiceClient
+
+	sshResponse      *decisionpb.EvaluateSSHAccessResponse
+	databaseResponse *decisionpb.EvaluateDatabaseAccessResponse
+}
+
+// EvaluateSSHAccess evaluates an SSH access attempt.
+func (f fakeDecisionServiceClient) EvaluateSSHAccess(ctx context.Context, in *decisionpb.EvaluateSSHAccessRequest, opts ...grpc.CallOption) (*decisionpb.EvaluateSSHAccessResponse, error) {
+	return f.sshResponse, nil
+}
+
+// EvaluateDatabaseAccess evaluate a database access attempt.
+func (f fakeDecisionServiceClient) EvaluateDatabaseAccess(ctx context.Context, in *decisionpb.EvaluateDatabaseAccessRequest, opts ...grpc.CallOption) (*decisionpb.EvaluateDatabaseAccessResponse, error) {
+	return f.databaseResponse, nil
+}
+
+func clientFunc(f fakeDecisionService) func(ctx context.Context) (client authclient.ClientI, close func(context.Context), err error) {
+	return func(ctx context.Context) (client authclient.ClientI, close func(context.Context), err error) {
+		return f, func(ctx context.Context) {}, nil
+	}
+}

tool/tctl/common/decision/evaluate_command.go

@@ -0,0 +1,63 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package decision
+
+import (
+	"context"
+	"io"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/tool/tctl/common/client"
+)
+
+// EvaluateCommand is a group of commands to evaluate access
+// via the Teleport Decision Service.
+type EvaluateCommand struct {
+	sshCommand EvaluateSSHCommand
+	dbCommand  EvaluateDatabaseCommand
+}
+
+// Initialize sets up the "tctl decision evaluate" command.
+func (c *EvaluateCommand) Initialize(cmd *kingpin.CmdClause, output io.Writer) {
+	evaluateCommand := cmd.Command("evaluate", "Evaluate access for a user.")
+	c.sshCommand.Initialize(evaluateCommand, output)
+	c.dbCommand.Initialize(evaluateCommand, output)
+}
+
+// TryRun attempts to run subcommands.
+func (c *EvaluateCommand) TryRun(ctx context.Context, cmd string, clientFunc client.InitFunc) (bool, error) {
+	var run func(context.Context, authclient.ClientI) error
+	switch cmd {
+	case c.sshCommand.FullCommand():
+		run = c.sshCommand.Run
+	case c.dbCommand.FullCommand():
+		run = c.dbCommand.Run
+	default:
+		return false, nil
+	}
+
+	client, closeFn, err := clientFunc(ctx)
+	if err != nil {
+		return true, trace.Wrap(err)
+	}
+
+	defer func() { closeFn(ctx) }()
+	return true, trace.Wrap(run(ctx, client))
+}

tool/tctl/common/decision/evaluate_db_command.go

@@ -0,0 +1,76 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+package decision
+
+import (
+	"context"
+	"io"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport"
+	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/auth/authclient"
+	"github.com/gravitational/teleport/lib/utils"
+)
+
+// EvaluateDatabaseCommand is a command to evaluate
+// database access via the Teleport Decision Service.
+type EvaluateDatabaseCommand struct {
+	output          io.Writer
+	databaseDetails databaseDetails
+	command         *kingpin.CmdClause
+}
+
+type databaseDetails struct {
+	databaseID string
+}
+
+// Initialize sets up the "tctl decision evaluate db" command.
+func (c *EvaluateDatabaseCommand) Initialize(cmd *kingpin.CmdClause, output io.Writer) {
+	c.output = output
+	c.command = cmd.Command("db", "Evaluate database access for a user.")
+	c.command.Flag("database-id", "The id of the target database.").StringVar(&c.databaseDetails.databaseID)
+}
+
+// FullCommand returns the fully qualified name of
+// the subcommand, i.e. tctl decision evaluate db.
+func (c *EvaluateDatabaseCommand) FullCommand() string {
+	return c.command.FullCommand()
+}
+
+// Run executes the subcommand.
+func (c *EvaluateDatabaseCommand) Run(ctx context.Context, clt authclient.ClientI) error {
+	resp, err := clt.DecisionClient().EvaluateDatabaseAccess(ctx, &decisionpb.EvaluateDatabaseAccessRequest{
+		Metadata:    &decisionpb.RequestMetadata{PepVersionHint: teleport.Version},
+		TlsIdentity: &decisionpb.TLSIdentity{},
+		Database: &decisionpb.Resource{
+			Kind: types.KindDatabase,
+			Name: c.databaseDetails.databaseID,
+		},
+	})
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	if err := utils.WriteJSON(c.output, resp); err != nil {
+		return trace.Wrap(err, "failed to marshal result")
+	}
+
+	return nil
+}

tool/tctl/common/decision/evaluate_db_command_test.go

@@ -0,0 +1,90 @@
+// Teleport
+// Copyright (C) 2025 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package decision_test
+
+import (
+	"bytes"
+	"context"
+	"testing"
+
+	"github.com/alecthomas/kingpin/v2"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport"
+	decisionpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1"
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/tool/tctl/common/decision"
+)
+
+func TestEvaluateDB(t *testing.T) {
+	tests := []struct {
+		name     string
+		response *decisionpb.EvaluateDatabaseAccessResponse
+	}{
+		{
+			name: "denied",
+			response: &decisionpb.EvaluateDatabaseAccessResponse{
+				Result: &decisionpb.EvaluateDatabaseAccessResponse_Denial{
+					Denial: &decisionpb.DatabaseAccessDenial{
+						Metadata: &decisionpb.DenialMetadata{
+							PdpVersion:  teleport.Version,
+							UserMessage: "denial",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "permitted",
+			response: &decisionpb.EvaluateDatabaseAccessResponse{
+				Result: &decisionpb.EvaluateDatabaseAccessResponse_Permit{
+					Permit: &decisionpb.DatabaseAccessPermit{
+						Metadata: &decisionpb.PermitMetadata{
+							PdpVersion: teleport.Version,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			var output bytes.Buffer
+			cmd := decision.Command{
+				Output: &output,
+			}
+
+			cmd.Initialize(kingpin.New("decision", "test"), nil, nil)
+
+			svc := fakeDecisionService{
+				decisionClient: fakeDecisionServiceClient{
+					databaseResponse: test.response,
+				},
+			}
+
+			match, err := cmd.TryRun(context.Background(), "decision evaluate db", clientFunc(svc))
+			require.True(t, match, "evaluate db subcommand was not found")
+			require.NoError(t, err, "evaluating database access failed")
+
+			var expected bytes.Buffer
+			utils.WriteJSON(&expected, test.response)
+			require.NoError(t, err, "marshaling expected output failed")
+			require.Equal(t, output.String(), expected.String(), "output did not match")
+		})
+	}
+}