vaultkit 1.1.5 → 1.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1d59f182a1b48be74a0e73fd35c23c7e32c8d453acc810c359c9d20ebe1570e
-  data.tar.gz: 466d3f664c8eb9104db19536d4c2c372fb456c2b01e9e080c9120f50087bdc7e
+  metadata.gz: 42e3300980d3a6c3041304eea365fad63d8bfb2a5b56a49c32ccb89d21366ec8
+  data.tar.gz: f353b00284834a0c3eed06f4af09da181d4bb3f622f61bbcfcc949d4014bf109
 SHA512:
-  metadata.gz: 32dbb26e53c3b110b15ea4d92e75a7fc871b39647fb4c5f7b8d6c7e2832647b34dce8c1f1a0e2156ce73d9bd7af625150ddd48db588665e81e7e11bcb8afeb96
-  data.tar.gz: 7c30f17e8e4af03dd89464dff02c1aa861006a870883c026fac492be82f3728b41d682dbce33e0764fa70e0cb5a1bbbd4747f147406c68094a8dabde415f2243
+  metadata.gz: fcf5ba06e5f6256f705de1d228b70c52a94fe4ce26c11d82d3e2dbab30397119ea33d511acdac0d1e383cb3e501c1286e303490f3035a2b9991cee8b04863d87
+  data.tar.gz: 537cf82edb8000c9a0c5d273c14e1958198022a16a6918b5f5f2ac7f673b1f9df7b1b26c5daf95acbb6bc0a6f3395ff430e73cc09ee6f8934f2179336b09789a

data/README.md

@@ -200,6 +200,38 @@ Clear stored credentials and end session.
 vkit logout
 ```
 
+### Credentials from the environment
+
+`vkit` normally uses the login saved by `vkit login`, in your OS keychain or
+`~/.vkit/credentials.json`. Scripts, CI jobs and demos can supply credentials for
+a single command or shell instead, without replacing your saved login:
+
+```bash
+export VKIT_ENDPOINT=http://localhost:3300
+export VKIT_TOKEN=<a VaultKit user token>
+vkit request < query.json
+```
+
+- **Both variables are needed.** When both are set, they replace the saved login
+  for every command except `vkit login` and `vkit logout`, which always work on
+  the saved login.
+- **One alone is an error.** `vkit` stops and names the missing variable, rather
+  than mixing the environment with your saved login.
+- **A notice goes to stderr** once per command while the override is active.
+  The token is never printed.
+- **Unset both** (`unset VKIT_ENDPOINT VKIT_TOKEN`) to go back to your saved login.
+
+To act as someone else for one command, override the token on that command only.
+For example, a reviewer approving a request from the same shell:
+
+```bash
+VKIT_TOKEN="$APPROVER_TOKEN" vkit approval:list
+VKIT_TOKEN="$APPROVER_TOKEN" vkit approval:approve 42
+```
+
+`vkit login --endpoint` still reads `VKIT_ENDPOINT` as its default endpoint when
+`VKIT_TOKEN` isn't set.
+
 ---
 
 ## 🔄 Core Workflows

data/lib/vkit/cli/commands/login_command.rb

@@ -21,7 +21,7 @@ module Vkit
           endpoint =
             @endpoint ||
             ENV["VKIT_ENDPOINT"] ||
-            credential_store.endpoint ||
+            credential_store.stored_payload&.dig("endpoint") ||
             prompt("VaultKit Control Plane URL")
           client = Vkit::Core::AuthClient.new(base_url: endpoint)
 

data/lib/vkit/cli/commands/logout_command.rb

@@ -2,13 +2,15 @@ module Vkit
   module CLI
     module Commands
       class LogoutCommand < BaseCommand
+        # Always the saved login, even when VKIT_ENDPOINT/VKIT_TOKEN are set.
         def call
-          token = credential_store.token
+          saved = credential_store.stored_payload || {}
+          token = saved["token"]
 
           if token
             begin
               client = Vkit::Core::AuthClient.new(
-                base_url: credential_store.endpoint
+                base_url: saved["endpoint"]
               )
 
               client.logout(token)

data/lib/vkit/core/credential_store.rb

@@ -2,13 +2,26 @@ require "json"
 require "fileutils"
 require "open3"
 require "rbconfig"
+require_relative "auth_client"
+require_relative "../cli/errors"
 
 module Vkit
   module Core
+    # Where vkit keeps its login: the OS keychain (or ~/.vkit), unless
+    # VKIT_ENDPOINT and VKIT_TOKEN are both set, which then take over for
+    # reading credentials without touching the saved login. That's for
+    # scripts, CI and demos that shouldn't replace a person's own login.
+    # `vkit login` and `vkit logout` always work on the saved login.
     class CredentialStore
       SERVICE = "vkit"
       ACCOUNT = "credentials"
 
+      @override_noticed = false
+
+      class << self
+        attr_accessor :override_noticed
+      end
+
       def initialize
         @os = RbConfig::CONFIG["host_os"]
         @fallback_path = File.join(Dir.home, ".vkit", "credentials.json")
@@ -34,6 +47,11 @@ module Vkit
       end
 
       def save_user(user)
+        if env_override
+          @override_user = user
+          return
+        end
+
         payload = load_payload
         return unless payload
       
@@ -58,13 +76,34 @@ module Vkit
       end
 
       def user
-        load_payload&.dig("user")
+        override = env_override
+        return override_user(override) if override
+
+        stored_payload&.dig("user")
       end
 
       def logged_in?
         !!(endpoint && token)
       end
 
+      # { "endpoint", "token" } from the environment, or nil when neither
+      # variable is set. Exactly one of them set is a mistake worth stopping on.
+      def env_override
+        endpoint = ENV.fetch("VKIT_ENDPOINT", "").strip
+        token = ENV.fetch("VKIT_TOKEN", "").strip
+        return nil if endpoint.empty? && token.empty?
+
+        if endpoint.empty? || token.empty?
+          missing, given = endpoint.empty? ? %w[VKIT_ENDPOINT VKIT_TOKEN] : %w[VKIT_TOKEN VKIT_ENDPOINT]
+          raise Vkit::CLI::Error,
+                "#{given} is set but #{missing} isn't. Set both to use credentials from the environment, " \
+                "or unset #{given} to use your saved login."
+        end
+
+        notice_override(endpoint)
+        { "endpoint" => endpoint, "token" => token }
+      end
+
       def clear!
         case
         when mac?
@@ -77,7 +116,7 @@ module Vkit
       end
 
       def clear_token!
-        payload = load_payload
+        payload = stored_payload
         return unless payload
       
         payload.delete("token")
@@ -92,7 +131,13 @@ module Vkit
         end
       end
 
+      # endpoint and token only; the user is looked up separately (#user),
+      # so reading the token never makes a network call.
       def load_payload
+        env_override || stored_payload
+      end
+
+      def stored_payload
         case
         when mac?
           mac_keychain_load
@@ -103,6 +148,17 @@ module Vkit
         end
       end
 
+      def override_user(override)
+        @override_user ||= AuthClient.new(base_url: override["endpoint"]).whoami(override["token"])
+      end
+
+      def notice_override(endpoint)
+        return if self.class.override_noticed
+
+        self.class.override_noticed = true
+        warn "vkit: using VKIT_ENDPOINT (#{endpoint}) and VKIT_TOKEN from the environment; your saved login is not used."
+      end
+
       def mac?
         @os =~ /darwin/
       end

data/lib/vkit/policy/bundle_compiler.rb

@@ -58,8 +58,10 @@ module Vkit
       end
 
       # Normalization
+      # Unknown values (a repo with no origin remote) are left out: the
+      # bundle schema requires strings where they are present.
       def self.normalize_source(source)
-        { "type" => "git" }.merge(source.transform_keys(&:to_s))
+        { "type" => "git" }.merge(source.transform_keys(&:to_s).compact)
       end
 
       def self.normalize_policies(policies)
@@ -163,12 +165,12 @@ module Vkit
         end
       end
 
+      # The control plane's methods (full, partial, hash) pass through; the
+      # older names map onto them. Anything else masks fully.
       def self.normalize_mask_method(method)
         case method.to_s
-        when "redact"   then "full"
-        when "hash"     then "hash"
+        when "full", "partial", "hash" then method.to_s
         when "truncate" then "partial"
-        when "nullify"  then "full"
         else "full"
         end
       end

data/lib/vkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vkit
-  VERSION = "1.1.5"
+  VERSION = "1.1.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vaultkit
 version: !ruby/object:Gem::Version
-  version: 1.1.5
+  version: 1.1.6
 platform: ruby
 authors:
 - Nnamdi Ogundu
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-28 00:00:00.000000000 Z
+date: 2026-10-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor