rails_kms_credentials 0.0.1 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d9002ffd4c1c4c037cfefa42fa524a68c695d6fdfa7010a966e5d6a0ed1c0130
-  data.tar.gz: cd9410a02314fcc000d5e5e44f1947aa8aa0e5a50a8e434fc29775073ced335c
+  metadata.gz: 75b923804031caddd3be015d207c02cdb9758d2dc98ebe527ee5ecd163823478
+  data.tar.gz: 98fef79cee6c7910b8e665de1c99ce886159b4c903095321e751f0e1339e801d
 SHA512:
-  metadata.gz: 14fc42d0dc79b8da2b0458a8109bf7aa224230e9cb76975fbed7412c32d795c7cfea449a9d75ee62406c9bbbf7995a2776f6bf1281ae3192cee43184b50671ad
-  data.tar.gz: 4bd8c88b3788508b5ba3e1b3223aceebb862a6595ec76b96b00e70370bb8d2f0e9b43c77b0cd9c2463c4270da17cca0b2bab65e125115c035dc14fd4ff0a4c1c
+  metadata.gz: 14f001897a77ad3664c9125a493992ec2586ee467e2b15c39beaa4ece0685ea29e2ed7281dc8258a17768884431f2dac8e38c0c630ea3ef7b92d1be28cebcbcf
+  data.tar.gz: 257fddec2f37904ef64e578a1bb93e57c8573cf3dee5749fcac565801a79edd2d417669a6b979de3b76ed72618c6aa5da049212d37d3b08829b32126384766ac

data/lib/rails_kms_credentials/store/azure_key_vault/client/managed_identity.rb

@@ -6,13 +6,37 @@ module RailsKmsCredentials
       module Client
         class ManagedIdentity < Base
           def get_secrets_list(url)
-            HTTParty.get url
+            HTTParty.get(
+              url,
+              headers: {
+                Authorization: "Bearer #{access_token}",
+              },
+            )
           end
 
           def get_secret(url)
-            HTTParty.get url
+            HTTParty.get(
+              url,
+              headers: {
+                Authorization: "Bearer #{access_token}",
+              },
+            )
           end
 
+          private
+
+            def access_token
+              return @access_token if instance_variable_defined?(:@access_token)
+              @_access_token_response = HTTParty.get(
+                'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net',
+                {
+                  headers: { Metadata: 'true' },
+                }
+              )
+              raise 'KmsCredentials AzureKeyVault ClientCredentials unable to get access token' unless @_access_token_response.ok?
+              @access_token = @_access_token_response['access_token']
+            end
+
         end
 
         add(:managed_identity, ManagedIdentity)

data/lib/rails_kms_credentials/store/azure_key_vault.rb

@@ -5,13 +5,13 @@ module RailsKmsCredentials
     module AzureKeyVault
 
       class Store < Base::Store
-        attr_reader :vault, :vault_url, :client
+        attr_reader :vault, :vault_url, :client, :secret_prefix, :loaded
 
         SECRETS_API_VERSION = '7.3'
 
         EMPTY_VALUE = '--EMPTY--'
 
-        def initialize(*) # rubocop:disable Metrics/AbcSize
+        def initialize(*) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
           super
           @vault = config['vault']
           raise 'Missing KmsCredentials AzureKeyVault vault' if vault.blank?
@@ -21,6 +21,13 @@ module RailsKmsCredentials
           raise 'Missing KmsCredentials AzureKeyVault client.type' if config['client']['type'].blank?
           @_client_klass = Client.get config['client']['type']
           @client = @_client_klass.new self
+          @secret_prefix =  case config['client']['secret_prefix']
+                            when true
+                              Rails.application.class.parent.to_s.underscore.dasherize
+                            when String
+                              config['client']['secret_prefix']
+                            end
+          @_secret_prefix = @secret_prefix ? Regexp.new("^#{@secret_prefix}----") : ''
           @loaded = false
         end
 
@@ -28,7 +35,7 @@ module RailsKmsCredentials
           return @credentials if instance_variable_defined?(:@credentials)
           load_secrets
           @credentials = @_secrets.values.each_with_object(ActiveSupport::OrderedOptions.new) do |secret, memo|
-            name = secret['name'].split('--')
+            name = secret['name'].remove(@_secret_prefix).split('--')
             name.each { |x| x.gsub!('-', '_') }
             parent = name[0..-2].inject(memo) do |h, key|
               if h.key?(key) && !h[key].is_a?(ActiveSupport::OrderedOptions)
@@ -47,7 +54,7 @@ module RailsKmsCredentials
             load_secrets_list
           end
 
-          def load_secrets_list(url = nil) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+          def load_secrets_list(url = nil) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/MethodLength
             @_get_secrets_list_responses ||= []
             @_secrets ||= {}
             url ||= "#{vault_url}/secrets?api-version=#{SECRETS_API_VERSION}"
@@ -56,6 +63,7 @@ module RailsKmsCredentials
             raise "KmsCredentials AzureKeyVault unable to get list of secrets: #{url}" unless response.ok?
             response['value'].each do |secret|
               secret_name = secret['id'].split('/').last
+              next unless secret_name =~ @_secret_prefix
               secret['name'] = secret_name
               @_secrets[secret_name] = secret
               load_secret secret_name

data/lib/rails_kms_credentials/version.rb

@@ -5,7 +5,7 @@ module RailsKmsCredentials
   module Version
     MAJOR = 0
     MINOR = 0
-    PATCH = 1
+    PATCH = 3
 
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_kms_credentials
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.3
 platform: ruby
 authors:
 - Taylor Yelverton
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-11-01 00:00:00.000000000 Z
+date: 2022-11-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport