@volter/world-core 2.0.16 → 2.0.17

package/dist/src/credential.js

@@ -131,6 +131,33 @@ export function transitSealer(options) {
     const named = `${mount}/${options.key}`;
     const addr = options.addr.replace(/\/+$/, '');
     const fingerprintKey = options.fingerprintKey ?? `${options.key}-fingerprint`;
+    // a periodic token lives while it is renewed within its period: after a call it answered, at most once a day, the
+    // sealer renews its own. A vault that refuses (a token that is not renewable, a root or dev token) is asked again the
+    // next day; one that did not answer, after the next call. The token's own period is the bound.
+    let renewedAt = 0;
+    const renew = async () => {
+        if (Date.now() - renewedAt < 86_400_000)
+            return;
+        renewedAt = Date.now();
+        let status;
+        try {
+            status = (await (options.fetch ?? fetch)(`${addr}/v1/auth/token/renew-self`, {
+                method: 'POST',
+                headers: { 'x-vault-token': await options.token(), 'content-type': 'application/json', ...(options.namespace ? { 'x-vault-namespace': options.namespace } : {}) },
+                body: '{}',
+                signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+            })).status;
+        }
+        catch (error) {
+            renewedAt = 0;
+            console.warn(`[credential] the vault at ${addr} did not answer renewing this host's token (${error.message})`);
+            return;
+        }
+        if (status >= 500)
+            renewedAt = 0;
+        if (status >= 300)
+            console.warn(`[credential] the vault at ${addr} did not renew this host's token (${status})`);
+    };
     const call = async (op, body, key = options.key) => {
         const which = `${mount}/${key}`;
         let response;
@@ -150,6 +177,7 @@ export function transitSealer(options) {
         const answer = (await response.json());
         if (!answer.data)
             throw new Error(`the vault answered transit ${op} with ${which} without data`);
+        void renew();
         return answer.data;
     };
     const fingerprintOf = async (plaintext) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "2.0.16",
+  "version": "2.0.17",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/credential.ts

@@ -207,6 +207,29 @@ export function transitSealer(options: TransitSealerOptions): Sealer {
   const named = `${mount}/${options.key}`;
   const addr = options.addr.replace(/\/+$/, '');
   const fingerprintKey = options.fingerprintKey ?? `${options.key}-fingerprint`;
+  // a periodic token lives while it is renewed within its period: after a call it answered, at most once a day, the
+  // sealer renews its own. A vault that refuses (a token that is not renewable, a root or dev token) is asked again the
+  // next day; one that did not answer, after the next call. The token's own period is the bound.
+  let renewedAt = 0;
+  const renew = async (): Promise<void> => {
+    if (Date.now() - renewedAt < 86_400_000) return;
+    renewedAt = Date.now();
+    let status: number;
+    try {
+      status = (await (options.fetch ?? fetch)(`${addr}/v1/auth/token/renew-self`, {
+        method: 'POST',
+        headers: { 'x-vault-token': await options.token(), 'content-type': 'application/json', ...(options.namespace ? { 'x-vault-namespace': options.namespace } : {}) },
+        body: '{}',
+        signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+      })).status;
+    } catch (error) {
+      renewedAt = 0;
+      console.warn(`[credential] the vault at ${addr} did not answer renewing this host's token (${(error as Error).message})`);
+      return;
+    }
+    if (status >= 500) renewedAt = 0;
+    if (status >= 300) console.warn(`[credential] the vault at ${addr} did not renew this host's token (${status})`);
+  };
   const call = async (op: 'encrypt' | 'decrypt' | 'hmac', body: Record<string, string | number>, key = options.key): Promise<Record<string, string>> => {
     const which = `${mount}/${key}`;
     let response: Response;
@@ -223,6 +246,7 @@ export function transitSealer(options: TransitSealerOptions): Sealer {
     if (!response.ok) throw new Error(`the vault refused transit ${op} with ${which} (${response.status})`);
     const answer = (await response.json()) as { data?: Record<string, string> };
     if (!answer.data) throw new Error(`the vault answered transit ${op} with ${which} without data`);
+    void renew();
     return answer.data;
   };
   const fingerprintOf = async (plaintext: Uint8Array): Promise<string> => {