vagrant_cloud 3.1.0 → 3.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4768031887b3a27585e8cf55091810654545e2aee475d7e2b2dbff927e8c7d6f
-  data.tar.gz: 480e6a69c2eac82185ff3cd9d90a30f00cd26e4a7d45c548ed2ba2785ecef96d
+  metadata.gz: 013f62b5aeeb2125349790b206a2fc42ee6e60288bb28fab28aefa129af8c55c
+  data.tar.gz: a928446b785eb485285ba3e030589391cc3fd3e49fdeb15053677e58ff864e2e
 SHA512:
-  metadata.gz: 7343ea8f89e7e4ecb8f9f2e0f1f5478a37382e3c4de44bb61ec40fcebd18b5e65f302365cfa02aead507d28883a3ab561bf3af949f77418e46366043ee7eddea
-  data.tar.gz: 50b74d2dcf7f8671afa67bfec5d0fdeebdf40b51206a48f53a35f21b63f65674e1859bcdcaeb2f9d79e940870df50c75b4e6fc9b412b86b1c028bcac9c9f2bcd
+  metadata.gz: 58ae036121f99b0e1054e49deb30644510f1310ab55ea7f07d2be89b6b27287f4c5a933ff20199e1eb64556506d548677beb0e543d6a7bf5f8e3217698c12c99
+  data.tar.gz: 3de0d70c11834c2228c78201600f07354a788b563d378e222001c9fbc1651f40e4ae1c0d3346fd342ccad16cb48d8a5efd6471987ab5321d1dd71ed0644d9312

data/README.md

@@ -13,6 +13,14 @@ The Vagrant Cloud library provides two methods for interacting with the Vagrant
 first is direct interaction using a `VagrantCloud::Client` instance. The second is a basic
 model based approach using a `VagrantCloud::Account` instance.
 
+### Authentication
+
+The access token that is used for authenticated requests can be set in one of three ways:
+
+* Static access token set directly in the client
+* Static access token extracted from the `VAGRANT_CLOUD_TOKEN` environment variable 
+* Generated [HCP service principal](https://developer.hashicorp.com/hcp/docs/hcp/iam/service-principal) access token when `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` environment variables are set
+
 ### Direct Client
 
 The `VagrantCloud::Client` class contains all the underlying functionality which with

data/lib/vagrant_cloud/auth.rb

@@ -0,0 +1,140 @@
+require "oauth2"
+
+module VagrantCloud
+  class Auth
+
+    # Default authentication URL
+    DEFAULT_AUTH_URL = "https://auth.idp.hashicorp.com".freeze
+    # Default authorize path
+    DEFAULT_AUTH_PATH = "/oauth2/auth".freeze
+    # Default token path
+    DEFAULT_TOKEN_PATH = "/oauth2/token".freeze
+    # Number of seconds to pad token expiry
+    TOKEN_EXPIRY_PADDING = 5
+
+    # HCP configuration for generating authentication tokens
+    #
+    # @param [String] client_id Service principal client ID
+    # @param [String] client_secret Service principal client secret
+    # @param [String] auth_url Authentication URL end point
+    # @param [String] auth_path Authorization path (relative to end point)
+    # @param [String] token_path Token path (relative to end point)
+    HCPConfig = Struct.new(:client_id, :client_secret, :auth_url, :auth_path, :token_path, keyword_init: true) do
+      # Raise exception if any values are missing
+      def validate!
+        [:client_id, :client_secret, :auth_url, :auth_path, :token_path].each do |name|
+          raise ArgumentError,
+            "Missing required HCP authentication configuration value: HCP_#{name.to_s.upcase}" if self.send(name).to_s.empty?
+        end
+      end
+    end
+
+    # HCP token
+    #
+    # @param [String] token HCP token value
+    # @param [Integer] expires_at Epoch seconds
+    HCPToken = Struct.new(:token, :expires_at, keyword_init: true) do
+      # Raise exception if any values are missing
+      def validate!
+        [:token, :expires_at].each do |name|
+          raise ArgumentError,
+            "Missing required token value - #{name.inspect}" if self.send(name).nil?
+        end
+      end
+
+      # @return [Boolean] token is expired
+      # @note Will show token as expired TOKEN_EXPIRY_PADDING
+      # seconds prior to actual expiry
+      def expired?
+        validate!
+
+        Time.now.to_i > (expires_at - TOKEN_EXPIRY_PADDING)
+      end
+
+      # @return [Boolean] token is not expired
+      def valid?
+        !expired?
+      end
+    end
+
+    # Create a new auth instance
+    #
+    # @param [String] access_token Static access token
+    # @note If no access token is provided, the token will be extracted
+    # from the VAGRANT_CLOUD_TOKEN environment variable. If that value
+    # is not set, the HCP_CLIENT_ID and HCP_CLIENT_SECRET environment
+    # variables will be checked. If found, tokens will be generated as
+    # needed using the client id and secret. Otherwise, no token will
+    # will be available.
+    def initialize(access_token: nil)
+      @token = access_token
+
+      # The Vagrant Cloud token has precedence over
+      # anything else, so if it is set then it is
+      # the only value used.
+      @token = ENV["VAGRANT_CLOUD_TOKEN"] if @token.nil?
+
+      # If there is no token set, attempt to load HCP configuration
+      if @token.to_s.empty? && (ENV["HCP_CLIENT_ID"] || ENV["HCP_CLIENT_SECRET"])
+        @config = HCPConfig.new(
+          client_id: ENV["HCP_CLIENT_ID"],
+          client_secret: ENV["HCP_CLIENT_SECRET"],
+          auth_url: ENV.fetch("HCP_AUTH_URL", DEFAULT_AUTH_URL),
+          auth_path: ENV.fetch("HCP_AUTH_PATH", DEFAULT_AUTH_PATH),
+          token_path: ENV.fetch("HCP_TOKEN_PATH", DEFAULT_TOKEN_PATH)
+        )
+
+        # Validate configuration is populated
+        @config.validate!
+      end
+    end
+
+    # @return [String] authentication token
+    def token
+      # If a static token is defined, use that value
+      return @token if @token
+
+      # If no configuration is set, there is no auth to provide
+      return if @config.nil?
+
+      # If an HCP token exists and is not expired
+      return @hcp_token.token if @hcp_token&.valid?
+
+      # Generate a new HCP token
+      refresh_token!
+
+      @hcp_token.token
+    end
+
+    # @return [Boolean] Authentication token is available
+    def available?
+      !!(@token || @config)
+    end
+
+    private
+
+    # Refresh the HCP oauth2 token.
+    # @todo rescue exceptions and make them nicer
+    def refresh_token!
+      client = OAuth2::Client.new(
+        @config.client_id,
+        @config.client_secret,
+        site: @config.auth_url,
+        authorize_url: @config.auth_path,
+        token_url: @config.token_path,
+      )
+
+      begin
+        response = client.client_credentials.get_token
+        @hcp_token = HCPToken.new(
+          token: response.token,
+          expires_at: response.expires_at,
+        )
+      rescue OAuth2::Error => err
+        raise Error::AuthenticationError,
+          err.response.body.chomp,
+          err.response.status
+      end
+    end
+  end
+end

data/lib/vagrant_cloud/client.rb

@@ -23,8 +23,6 @@ module VagrantCloud
       DEFAULT_INSTRUMENTOR
     end
 
-    # @return [String] Access token for Vagrant Cloud
-    attr_reader :access_token
     # @return [String] Base request path
     attr_reader :path_base
     # @return [String] URL for initializing connection
@@ -49,19 +47,15 @@ module VagrantCloud
       remote_url = URI.parse(url_base)
       @url_base = "#{remote_url.scheme}://#{remote_url.host}"
       @path_base = remote_url.path
-      if @path_base == API_V1_PATH || @path_base == API_V2_PATH
+      if @path_base.empty? || @path_base == API_V1_PATH || @path_base == API_V2_PATH
         @path_base = nil
       end
-      @access_token = access_token.dup.freeze if access_token
-      if !@access_token && ENV["VAGRANT_CLOUD_TOKEN"]
-        @access_token = ENV["VAGRANT_CLOUD_TOKEN"].dup.freeze
-      end
+      @auth = Auth.new(access_token: access_token)
       @retry_count = retry_count.nil? ? IDEMPOTENT_RETRIES : retry_count.to_i
       @retry_interval = retry_interval.nil? ? IDEMPOTENT_RETRY_INTERVAL : retry_interval.to_i
       @instrumentor = instrumentor.nil? ? Instrumentor::Collection.new : instrumentor
       headers = {}.tap do |h|
         h["Accept"] = "application/json"
-        h["Authorization"] = "Bearer #{@access_token}" if @access_token
         h["Content-Type"] = "application/json"
       end
       @connection_lock = Mutex.new
@@ -71,6 +65,11 @@ module VagrantCloud
       )
     end
 
+    # @return [String] Access token for Vagrant Cloud
+    def access_token
+      @auth.token
+    end
+
     # Use the remote connection
     #
     # @param [Boolean] wait Wait for the connection to be available
@@ -79,16 +78,28 @@ module VagrantCloud
     def with_connection(wait: true)
       raise ArgumentError,
         "Block expected but no block given" if !block_given?
+
+      # Adds authentication header to connection if available
+      set_authentication = ->(conn) {
+        if @auth.available?
+          conn.connection[:headers]["Authorization"] = "Bearer #{@auth.token}"
+        end
+      }
+
       if !wait
         raise Error::ClientError::ConnectionLockedError,
           "Connection is currently locked" if !@connection_lock.try_lock
+        set_authentication.call(@connection)
         begin
           yield @connection
         ensure
           @connection_lock.unlock
         end
       else
-        @connection_lock.synchronize { yield @connection }
+        @connection_lock.synchronize do
+          set_authentication.call(@connection)
+          yield @connection
+        end
       end
     end
 
@@ -98,19 +109,28 @@ module VagrantCloud
     # @param [Hash] params Parameters to send with request
     # @return [Hash]
     def request(path:, method: :get, params: {}, api_version: 2)
-      if path_base.nil? || !path.start_with?(path_base)
-        if !path_base.nil?
-          start_path = path_base
-        elsif api_version == 1
-          start_path = API_V1_PATH
-        elsif api_version == 2
-          start_path = API_V2_PATH
-        else
-          raise "Unsupported API version provided"
+      # Apply any path modifications that are required
+      catch(:done) do
+        # If a base path is defined, and the provided path
+        # is already properly prefixed with it, do nothing.
+        throw :done if !path_base.nil? && path.start_with?(path_base)
+
+        # If the path does not include an API version
+        # prefix, add it now.
+        if !path.start_with?(API_V1_PATH) && !path.start_with?(API_V2_PATH)
+          case api_version
+          when 1
+            start_path = API_V1_PATH
+          when 2
+            start_path = API_V2_PATH
+          else
+            raise ArgumentError, "Unsupported API version provided"
+          end
         end
-        # Build the full path for the request and clean it
-        path = [start_path, path].compact.join("/").gsub(/\/{2,}/, "/")
+
+        path = [path_base, start_path, path].compact.join("/").gsub(/\/{2,}/, "/")
       end
+
       method = method.to_s.downcase.to_sym
 
       # Build base request parameters

data/lib/vagrant_cloud/error.rb

@@ -29,6 +29,13 @@ module VagrantCloud
       end
 
       class ConnectionLockedError < ClientError; end
+      class AuthenticationError < ClientError
+        def initialize(msg, http_code)
+          @error_arr = [msg]
+          @error_code = http_code.to_i
+          super(msg)
+        end
+      end
     end
 
     class BoxError < Error

data/lib/vagrant_cloud.rb

@@ -8,6 +8,7 @@ require "thread"
 
 module VagrantCloud
   autoload :Account, "vagrant_cloud/account"
+  autoload :Auth, "vagrant_cloud/auth"
   autoload :Box, "vagrant_cloud/box"
   autoload :Client, "vagrant_cloud/client"
   autoload :Data, "vagrant_cloud/data"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vagrant_cloud
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.1.2
 platform: ruby
 authors:
 - HashiCorp
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-09-25 00:00:00.000000000 Z
+date: 2024-11-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: excon
@@ -17,42 +17,56 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.73'
+        version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.73'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: log4r
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.1.10
+        version: '1.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.1.10
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.2.5
+        version: '3.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.2.5
+        version: '3.3'
+- !ruby/object:Gem::Dependency
+  name: oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -105,6 +119,7 @@ files:
 - README.md
 - lib/vagrant_cloud.rb
 - lib/vagrant_cloud/account.rb
+- lib/vagrant_cloud/auth.rb
 - lib/vagrant_cloud/box.rb
 - lib/vagrant_cloud/box/provider.rb
 - lib/vagrant_cloud/box/version.rb