node-vault-client 0.6.1 → 1.0.0

package/src/auth/VaultBaseAuth.js

@@ -1,140 +1,140 @@
-'use strict';
-
-const lt = require('long-timeout');
-const prettyMs = require('pretty-ms');
-const AuthToken = require('./AuthToken');
-const errors = require('../errors');
-
-class VaultBaseAuth {
-
-    /**
-     * @param {VaultApiClient} apiClient
-     * @param {Object} logger
-     * @param {String} mount - Vault's mount point
-     */
-    constructor(apiClient, logger, mount) {
-        this.__apiClient = apiClient;
-        /** @protected */
-        this._log = logger;
-        this._mount = mount;
-
-        /** @type AuthToken */
-        this.__authToken = null;
-        this.__refreshTimeout = null;
-    }
-
-    /**
-     * @protected
-     * @returns {Promise<AuthToken>}
-     */
-    _authenticate() {
-        throw new Error('Method should be overridden');
-    }
-
-    getAuthToken() {
-        if (this.__authToken === null || (this.__authToken instanceof AuthToken && this.__authToken.isExpired() && this._reauthenticationAllowed())) {
-            if (this.__authToken !== null && this.__authToken.isExpired() && !this._reauthenticationAllowed()) {
-                throw new errors.AuthTokenExpiredError('Auth token has expired & cannot be refreshed since auth method doesn\'t support this.');
-            }
-
-            this._log.info('getting auth token (mount=%s)', this._mount);
-
-            const tokenPromise = this._authenticate().then(authToken => {
-                this.__authToken = authToken;
-
-                if (this.__authToken.isRenewable()) {
-                    this._log.debug(
-                        'setting refresh timer for token %s',
-                        authToken.getId()
-                    );
-                    this.__setupTokenRefreshTimer(this.__authToken);
-                }
-
-                return this.__authToken;
-            }).catch(e => {
-                this.__authToken = null;
-                throw e;
-            });
-
-            this.__authToken = tokenPromise;
-            return tokenPromise;
-        }
-
-        this._log.debug('token already exist');
-        return Promise.resolve(this.__authToken);
-    }
-
-    /**
-     * @protected
-     * @returns {Promise<AuthToken>}
-     */
-    _getTokenEntity(tokenId) {
-        return this.__apiClient.makeRequest('GET', '/auth/token/lookup-self', null, {'X-Vault-Token': tokenId})
-            .then(res => {
-                return AuthToken.fromResponse(res);
-            });
-    }
-
-    /**
-     * @protected
-     * @returns {boolean}
-     */
-    _reauthenticationAllowed() {
-        return true;
-    }
-
-    /**
-     * @param {AuthToken} authToken
-     * @private
-     */
-    __setupTokenRefreshTimer(authToken) {
-        if (this.__refreshTimeout !== null) {
-            lt.clearTimeout(this.__refreshTimeout);
-            this.__refreshTimeout = null;
-        }
-
-        if (!authToken.isRenewable() || authToken.isExpired()) {
-            return;
-        }
-
-        const timer = Math.max((authToken.getExpiresAt() - Math.floor(Date.now() / 1000)) / 2, 1) * 1000;
-
-        this.__refreshTimeout = lt.setTimeout(() => {
-            this.__renewToken(authToken).then(authToken => {
-                this.__authToken = authToken;
-                this.__setupTokenRefreshTimer(authToken);
-            }).catch(err => {
-                this.__setupTokenRefreshTimer(authToken);
-
-                this._log.error(`Cannot refresh auth token with "${authToken.getAccessor()}" accessor. Error: ${err.message}`);
-                this._log.error(err);
-            });
-        }, timer);
-
-        this._log.debug(
-            'sleeping for %s',
-            prettyMs(timer)
-        );
-    }
-
-    /**
-     * @param {AuthToken} authToken
-     * @returns {Promise.<AuthToken>}
-     * @private
-     */
-    __renewToken(authToken) {
-        this._log.debug('renewing vault token');
-
-        return this.__apiClient.makeRequest('POST', '/auth/token/renew-self', null, {'X-Vault-Token': authToken.getId()})
-            .then(() => {
-                this._log.info('successfully renewed token');
-                return this._getTokenEntity(authToken.getId());
-            })
-            .catch((reason) => {
-                this._log.error('token renew failed: %s', reason.message);
-                throw reason;
-            });
-    }
-}
-
-module.exports = VaultBaseAuth;
+'use strict';
+
+const lt = require('long-timeout');
+const prettyMs = require('pretty-ms');
+const AuthToken = require('./AuthToken');
+const errors = require('../errors');
+
+class VaultBaseAuth {
+
+    /**
+     * @param {VaultApiClient} apiClient
+     * @param {Object} logger
+     * @param {String} mount - Vault's mount point
+     */
+    constructor(apiClient, logger, mount) {
+        this.__apiClient = apiClient;
+        /** @protected */
+        this._log = logger;
+        this._mount = mount;
+
+        /** @type AuthToken */
+        this.__authToken = null;
+        this.__refreshTimeout = null;
+    }
+
+    /**
+     * @protected
+     * @returns {Promise<AuthToken>}
+     */
+    _authenticate() {
+        throw new Error('Method should be overridden');
+    }
+
+    getAuthToken() {
+        if (this.__authToken === null || (this.__authToken instanceof AuthToken && this.__authToken.isExpired() && this._reauthenticationAllowed())) {
+            if (this.__authToken !== null && this.__authToken.isExpired() && !this._reauthenticationAllowed()) {
+                throw new errors.AuthTokenExpiredError('Auth token has expired & cannot be refreshed since auth method doesn\'t support this.');
+            }
+
+            this._log.info('getting auth token (mount=%s)', this._mount);
+
+            const tokenPromise = this._authenticate().then(authToken => {
+                this.__authToken = authToken;
+
+                if (this.__authToken.isRenewable()) {
+                    this._log.debug(
+                        'setting refresh timer for token %s',
+                        authToken.getId()
+                    );
+                    this.__setupTokenRefreshTimer(this.__authToken);
+                }
+
+                return this.__authToken;
+            }).catch(e => {
+                this.__authToken = null;
+                throw e;
+            });
+
+            this.__authToken = tokenPromise;
+            return tokenPromise;
+        }
+
+        this._log.debug('token already exist');
+        return Promise.resolve(this.__authToken);
+    }
+
+    /**
+     * @protected
+     * @returns {Promise<AuthToken>}
+     */
+    _getTokenEntity(tokenId) {
+        return this.__apiClient.makeRequest('GET', '/auth/token/lookup-self', null, {'X-Vault-Token': tokenId})
+            .then(res => {
+                return AuthToken.fromResponse(res);
+            });
+    }
+
+    /**
+     * @protected
+     * @returns {boolean}
+     */
+    _reauthenticationAllowed() {
+        return true;
+    }
+
+    /**
+     * @param {AuthToken} authToken
+     * @private
+     */
+    __setupTokenRefreshTimer(authToken) {
+        if (this.__refreshTimeout !== null) {
+            lt.clearTimeout(this.__refreshTimeout);
+            this.__refreshTimeout = null;
+        }
+
+        if (!authToken.isRenewable() || authToken.isExpired()) {
+            return;
+        }
+
+        const timer = Math.max((authToken.getExpiresAt() - Math.floor(Date.now() / 1000)) / 2, 1) * 1000;
+
+        this.__refreshTimeout = lt.setTimeout(() => {
+            this.__renewToken(authToken).then(authToken => {
+                this.__authToken = authToken;
+                this.__setupTokenRefreshTimer(authToken);
+            }).catch(err => {
+                this.__setupTokenRefreshTimer(authToken);
+
+                this._log.error(`Cannot refresh auth token with "${authToken.getAccessor()}" accessor. Error: ${err.message}`);
+                this._log.error(err);
+            });
+        }, timer);
+
+        this._log.debug(
+            'sleeping for %s',
+            prettyMs(timer)
+        );
+    }
+
+    /**
+     * @param {AuthToken} authToken
+     * @returns {Promise.<AuthToken>}
+     * @private
+     */
+    __renewToken(authToken) {
+        this._log.debug('renewing vault token');
+
+        return this.__apiClient.makeRequest('POST', '/auth/token/renew-self', null, {'X-Vault-Token': authToken.getId()})
+            .then(() => {
+                this._log.info('successfully renewed token');
+                return this._getTokenEntity(authToken.getId());
+            })
+            .catch((reason) => {
+                this._log.error('token renew failed: %s', reason.message);
+                throw reason;
+            });
+    }
+}
+
+module.exports = VaultBaseAuth;

package/src/auth/VaultIAMAuth.js

@@ -1,182 +1,187 @@
-'use strict';
-
-const VaultBaseAuth = require('./VaultBaseAuth');
-const aws4 = require('aws4');
-const _ = require('lodash');
-const errors = require('../errors');
-
-/**
- * Implementation of AWS Auth Backend :: IAM Authentication Method
- * @link https://www.vaultproject.io/docs/auth/aws.html#iam-authentication-method
- *
- * @usage
- *
- * ```bash
- * vault write auth/aws/config/client secret_key=AWS_SECRET_KEY access_key=AWS_ACCESS_KEY
- * vault write auth/aws/config/client iam_server_id_header_value=VAULT_ADDR
- * vault write auth/aws/role/iam_name_of_role auth_type=iam bound_iam_principal_arn=arn:aws:iam::.... max_ttl=500h
- * ```
- *
- * ```js
- *
- * VaultClient.boot('main', {
- *       api: { url: VAULT_ADDR },
- *       auth: {
- *           type: 'iam',
- *           mount: 'some_other_aws_mount_point',          // Optional
- *           config: {
- *               role: 'my_iam_role',
- *               iam_server_id_header_value: VAULT_ADDR,   // Optional
- *               namespace: 'some_namespace',              // Optional
- *               credentials: new AWS.Credentials({
- *                 accessKeyId: AWS_ACCESS_KEY,
- *                 secretAccessKey: AWS_SECRET_KEY,
- *               })
- *           }
- *       }
- *   })
- *
- * ```
- *
- */
-class VaultIAMAuth extends VaultBaseAuth {
-    /**
-     * @param {VaultApiClient} api - see {@link VaultBaseAuth#constructor}
-     * @param {Object} logger
-     * @param {Object} config
-     * @param {String} config.role - Role name of the auth/{mount}/role/{name} backend.
-     * @param {AWS.Credentials|AWS.Credentials[]} config.credentials {@see AWS.CredentialProviderChain providers}
-     * @param {String} [config.iam_server_id_header_value] - Optional. Header's value X-Vault-AWS-IAM-Server-ID.
-     * @param {String} mount - Vault's AWS Auth Backend mount point ("aws" by default)
-     */
-    constructor(api, logger, config, mount) {
-        super(api, logger, mount || 'aws');
-
-        const AWS = require('aws-sdk');
-
-        this.__role = config.role;
-        this.__iam_server_id_header_value = config.iam_server_id_header_value;
-        this.__namespace = config.namespace;
-
-        if (!(config.credentials instanceof AWS.Credentials) && !_.isArray(config.credentials)) {
-            throw new errors.InvalidAWSCredentialsError('Credentials must be provided. {AWS.Credentials|AWS.Credentials[]} or function-providers, which return them.')
-        }
-
-        const credentialsProviders = _.isArray(config.credentials)
-            ? config.credentials
-            : [config.credentials];
-
-        this.__credentialChain = new AWS.CredentialProviderChain(
-            credentialsProviders
-        );
-    }
-
-    /**
-     * @inheritDoc
-     */
-    _authenticate() {
-        this._log.info(
-            'making authentication request: role=%s',
-            this.__role
-        );
-
-        var headers = {};
-
-        if (this.__namespace) {
-            headers = {
-                'X-Vault-Namespace': this.__namespace,
-            }
-        }
-
-
-        return Promise.resolve()
-            .then(() => this.__getCredentials())
-            .then((credentials) => {
-                return this.__apiClient.makeRequest(
-                    'POST',
-                    `/auth/${this._mount}/login`,
-                    this.__getVaultAuthRequestBody(this.__getStsRequest(credentials)),
-                    headers
-                );
-            })
-            .then((response) => {
-                this._log.debug(
-                    'receive token: %s',
-                    response.auth.client_token
-                );
-                return this._getTokenEntity(response.auth.client_token)
-            })
-    }
-
-    /**
-     * Credentials resolved by {@see AWS.CredentialProviderChain}
-     *
-     * @returns {Promise<AWS.Credentials>}
-     * @private
-     */
-    __getCredentials() {
-        return new Promise((resolve, reject) =>
-            this.__credentialChain.resolve((err, credentials) =>
-                err ? reject(err) : resolve(credentials)
-            )
-        );
-    }
-
-    /**
-     * Prepare vault auth request body
-     *
-     * @param stsRequest
-     * @returns {Object} {@link https://www.vaultproject.io/docs/auth/aws.html#via-the-api}
-     * @private
-     */
-    __getVaultAuthRequestBody(stsRequest) {
-        return {
-            iam_http_request_method: stsRequest.method,
-            iam_request_headers: this.__base64encode(
-                JSON.stringify(this.__headersLikeGolangStyle(stsRequest.headers))
-            ),
-            iam_request_body: this.__base64encode(stsRequest.body),
-            iam_request_url: this.__base64encode(`https://${stsRequest.hostname}${stsRequest.path}`),
-            role: this.__role
-        }
-    }
-
-    /**
-     * Prepare signed request to AWS STS :: GetCallerIdentity
-     *
-     * @param credentials
-     * @private
-     */
-    __getStsRequest(credentials) {
-        return aws4.sign({
-            service: 'sts',
-            method: 'POST',
-            body: 'Action=GetCallerIdentity&Version=2011-06-15',
-            headers: this.__iam_server_id_header_value ? {
-                'X-Vault-AWS-IAM-Server-ID': this.__iam_server_id_header_value,
-            } : {}
-        }, credentials);
-    }
-
-    /**
-     * @param string
-     * @private
-     */
-    __base64encode(string) {
-        return new Buffer(string).toString('base64')
-    }
-
-    /**
-     * @link https://github.com/hashicorp/vault/issues/2810
-     * @link https://golang.org/pkg/net/http/#Header
-     *
-     * @param {Object} headers
-     * @returns {Object}
-     * @private
-     */
-    __headersLikeGolangStyle(headers) {
-        return _.mapValues(headers, (value) => [`${value}`]);
-    }
-}
-
-module.exports = VaultIAMAuth;
+'use strict';
+
+const VaultBaseAuth = require('./VaultBaseAuth');
+const aws4 = require('aws4');
+const { fromNodeProviderChain } = require('@aws-sdk/credential-providers');
+const _ = require('lodash');
+const errors = require('../errors');
+
+/**
+ * Implementation of AWS Auth Backend :: IAM Authentication Method
+ * @link https://www.vaultproject.io/docs/auth/aws.html#iam-authentication-method
+ *
+ * @usage
+ *
+ * ```bash
+ * vault write auth/aws/config/client secret_key=AWS_SECRET_KEY access_key=AWS_ACCESS_KEY
+ * vault write auth/aws/config/client iam_server_id_header_value=VAULT_ADDR
+ * vault write auth/aws/role/iam_name_of_role auth_type=iam bound_iam_principal_arn=arn:aws:iam::.... max_ttl=500h
+ * ```
+ *
+ * ```js
+ *
+ * VaultClient.boot('main', {
+ *       api: { url: VAULT_ADDR },
+ *       auth: {
+ *           type: 'iam',
+ *           mount: 'some_other_aws_mount_point',          // Optional
+ *           config: {
+ *               role: 'my_iam_role',
+ *               iam_server_id_header_value: VAULT_ADDR,   // Optional
+ *               namespace: 'some_namespace',              // Optional
+ *               credentials: {                            // Optional
+ *                 accessKeyId: AWS_ACCESS_KEY,
+ *                 secretAccessKey: AWS_SECRET_KEY,
+ *               },
+ *           }
+ *       }
+ *   })
+ * ```
+ *
+ */
+class VaultIAMAuth extends VaultBaseAuth {
+    /**
+     * @typedef AWSCredentials
+     * @property {String} accessKeyId
+     * @property {String} secretAccessKey
+     *
+     * @typedef {Object} VaultIAMAuthConfig
+     * @property {String} role - Role name of the auth/{mount}/role/{name} backend.
+     * @property [AWSCredentials] [credentials] - Optional. AWS Credentials
+     * @property {String} [iam_server_id_header_value] - Optional. Header's value X-Vault-AWS-IAM-Server-ID.
+     *
+     * @param {VaultApiClient} api - see {@link VaultBaseAuth#constructor}
+     * @param {Object} logger
+     * @param {VaultIAMAuthConfig} config
+     * @param {String} mount - Vault's AWS Auth Backend mount point ("aws" by default)
+     */
+    constructor(api, logger, config, mount) {
+        super(api, logger, mount || 'aws');
+
+        this.__role = config.role;
+        this.__iam_server_id_header_value = config.iam_server_id_header_value;
+        this.__namespace = config.namespace;
+
+
+        const { credentials } = config;
+        this._validateCredentialsConfig(credentials);
+
+        this.__credentialChain = credentials ? () => Promise.resolve(credentials) : fromNodeProviderChain();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    _authenticate() {
+        this._log.info(
+            'making authentication request: role=%s',
+            this.__role
+        );
+
+        var headers = {};
+
+        if (this.__namespace) {
+            headers = {
+                'X-Vault-Namespace': this.__namespace,
+            }
+        }
+
+
+        return Promise.resolve()
+            .then(() => this.__getCredentials())
+            .then((credentials) => {
+                return this.__apiClient.makeRequest(
+                    'POST',
+                    `/auth/${this._mount}/login`,
+                    this.__getVaultAuthRequestBody(this.__getStsRequest(credentials)),
+                    headers
+                );
+            })
+            .then((response) => {
+                this._log.debug(
+                    'receive token: %s',
+                    response.auth.client_token
+                );
+                return this._getTokenEntity(response.auth.client_token)
+            })
+    }
+
+    /**
+     * Credentials resolved by {@see @aws-sdk/credential-providers}
+     *
+     * @returns {Promise<AwsCredentialIdentity>}
+     * @private
+     */
+    __getCredentials() {
+        return this.__credentialChain();
+    }
+
+    /**
+     * Prepare vault auth request body
+     *
+     * @param stsRequest
+     * @returns {Object} {@link https://www.vaultproject.io/docs/auth/aws.html#via-the-api}
+     * @private
+     */
+    __getVaultAuthRequestBody(stsRequest) {
+        return {
+            iam_http_request_method: stsRequest.method,
+            iam_request_headers: this.__base64encode(
+                JSON.stringify(this.__headersLikeGolangStyle(stsRequest.headers))
+            ),
+            iam_request_body: this.__base64encode(stsRequest.body),
+            iam_request_url: this.__base64encode(`https://${stsRequest.hostname}${stsRequest.path}`),
+            role: this.__role
+        }
+    }
+
+    /**
+     * Prepare signed request to AWS STS :: GetCallerIdentity
+     *
+     * @param credentials
+     * @private
+     */
+    __getStsRequest(credentials) {
+        return aws4.sign({
+            service: 'sts',
+            method: 'POST',
+            body: 'Action=GetCallerIdentity&Version=2011-06-15',
+            headers: this.__iam_server_id_header_value ? {
+                'X-Vault-AWS-IAM-Server-ID': this.__iam_server_id_header_value,
+            } : {}
+        }, credentials);
+    }
+
+    /**
+     * @param string
+     * @private
+     */
+    __base64encode(string) {
+        return new Buffer(string).toString('base64')
+    }
+
+    /**
+     * @link https://github.com/hashicorp/vault/issues/2810
+     * @link https://golang.org/pkg/net/http/#Header
+     *
+     * @param {Object} headers
+     * @returns {Object}
+     * @private
+     */
+    __headersLikeGolangStyle(headers) {
+        return _.mapValues(headers, (value) => [`${value}`]);
+    }
+
+    _validateCredentialsConfig(credentials) {
+        if (Array.isArray(credentials)) {
+            throw new errors.InvalidAWSCredentialsError('Invalid AWS credentials provided in config. See CHANGELOG if migating from 0.x.x');
+        }
+        if (credentials && typeof credentials === 'object') {
+            if (!credentials.secretAccessKey || !credentials.accessKeyId) {
+                throw new errors.InvalidAWSCredentialsError('Invalid AWS credentials provided in config: accessKeyId and secretAccessKey are required.');
+            }
+        }
+    }
+}
+
+module.exports = VaultIAMAuth;