node-vault-client 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE.txt +200 -200
- package/README.md +153 -154
- package/package.json +44 -44
- package/src/Lease.js +57 -57
- package/src/VaultApiClient.js +55 -55
- package/src/VaultClient.js +263 -263
- package/src/VaultNodeConfig.js +105 -105
- package/src/auth/AuthToken.js +94 -94
- package/src/auth/VaultAppRoleAuth.js +47 -40
- package/src/auth/VaultBaseAuth.js +140 -140
- package/src/auth/VaultIAMAuth.js +187 -187
- package/src/auth/VaultKubernetesAuth.js +48 -48
- package/src/auth/VaultTokenAuth.js +34 -34
- package/src/errors.js +21 -21
package/README.md
CHANGED
|
@@ -1,154 +1,153 @@
|
|
|
1
|
-
# Node.js Vault Client
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
A Vault Client implemented in pure javascript for [HashiCorp Vault](https://github.com/hashicorp/vault).
|
|
7
|
+
It supports variety of Auth Backends and performs lease renewal for issued auth token.
|
|
8
|
+
|
|
9
|
+
## Install
|
|
10
|
+
```
|
|
11
|
+
npm install --save node-vault-client
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
## Example
|
|
15
|
+
|
|
16
|
+
```javascript
|
|
17
|
+
const VaultClient = require('node-vault-client');
|
|
18
|
+
|
|
19
|
+
const vaultClient = VaultClient.boot('main', {
|
|
20
|
+
api: { url: 'https://vault.example.com:8200/' },
|
|
21
|
+
auth: {
|
|
22
|
+
type: 'appRole', // or 'token', 'iam'
|
|
23
|
+
config: { role_id: '637c065f-c644-5e12-d3d1-e9fa4363af61' }
|
|
24
|
+
},
|
|
25
|
+
});
|
|
26
|
+
|
|
27
|
+
vaultClient.read('secret/tst').then(v => {
|
|
28
|
+
console.log(v);
|
|
29
|
+
}).catch(e => console.error(e));
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
## Supported Auth Backends
|
|
33
|
+
|
|
34
|
+
* [AWS IAM](https://www.vaultproject.io/docs/auth/aws.html#iam-auth-method)
|
|
35
|
+
* [AppRole](https://www.vaultproject.io/docs/auth/approle.html)
|
|
36
|
+
* [Token](https://www.vaultproject.io/docs/auth/token.html)
|
|
37
|
+
|
|
38
|
+
## API
|
|
39
|
+
|
|
40
|
+
<a name="VaultClient"></a>
|
|
41
|
+
|
|
42
|
+
### VaultClient
|
|
43
|
+
|
|
44
|
+
* [VaultClient](#VaultClient)
|
|
45
|
+
* [new VaultClient(options)](#new_VaultClient_new)
|
|
46
|
+
* _instance_
|
|
47
|
+
* [.fillNodeConfig()](#VaultClient+fillNodeConfig)
|
|
48
|
+
* [.read(path)](#VaultClient+read) ⇒ <code>Promise.<Lease></code>
|
|
49
|
+
* [.list(path)](#VaultClient+list) ⇒ <code>Promise.<Lease></code>
|
|
50
|
+
* [.write(path, data)](#VaultClient+write) ⇒ <code>Promise.<(T\|never)></code>
|
|
51
|
+
* _static_
|
|
52
|
+
* [.boot(name, [options])](#VaultClient.boot) ⇒
|
|
53
|
+
* [.get(name)](#VaultClient.get) ⇒
|
|
54
|
+
* [.clear([name])](#VaultClient.clear)
|
|
55
|
+
|
|
56
|
+
<a name="new_VaultClient_new"></a>
|
|
57
|
+
|
|
58
|
+
#### new VaultClient(options)
|
|
59
|
+
Client constructor function.
|
|
60
|
+
|
|
61
|
+
|
|
62
|
+
| Param | Type | Default | Description |
|
|
63
|
+
| --- | --- | --- | --- |
|
|
64
|
+
| options | `Object` | | |
|
|
65
|
+
| options.api | <code>Object</code> | | |
|
|
66
|
+
| options.api.url | <code>String</code> | | the url of the vault server |
|
|
67
|
+
| [options.api.apiVersion] | <code>String</code> | `v1` | |
|
|
68
|
+
| options.auth | <code>Object</code> | | |
|
|
69
|
+
| options.auth.type | <code>String</code> | | |
|
|
70
|
+
| options.auth.config | <code>Object</code> | | auth configuration variables |
|
|
71
|
+
| options.logger | <code>Object</code> | `false` | | Logger that supports "error", "info", "warn", "trace", "debug" methods. Uses `console` by default. Pass `false` to disable logging. |
|
|
72
|
+
|
|
73
|
+
#### vaultClient.fillNodeConfig()
|
|
74
|
+
Populates Vault's values to NPM "config" module
|
|
75
|
+
|
|
76
|
+
**Kind**: instance method of [<code>VaultClient</code>](#VaultClient)
|
|
77
|
+
<a name="VaultClient+read"></a>
|
|
78
|
+
|
|
79
|
+
#### vaultClient.read(path) ⇒ <code>Promise.<Lease></code>
|
|
80
|
+
Read secret from Vault
|
|
81
|
+
|
|
82
|
+
**Kind**: instance method of [<code>VaultClient</code>](#VaultClient)
|
|
83
|
+
|
|
84
|
+
| Param | Type | Description |
|
|
85
|
+
| --- | --- | --- |
|
|
86
|
+
| path | <code>string</code> | path to the secret |
|
|
87
|
+
|
|
88
|
+
<a name="VaultClient+list"></a>
|
|
89
|
+
|
|
90
|
+
#### vaultClient.list(path) ⇒ <code>Promise.<Lease></code>
|
|
91
|
+
Retrieves secrets list
|
|
92
|
+
|
|
93
|
+
**Kind**: instance method of [<code>VaultClient</code>](#VaultClient)
|
|
94
|
+
|
|
95
|
+
| Param | Type | Description |
|
|
96
|
+
| --- | --- | --- |
|
|
97
|
+
| path | <code>string</code> | path to the secret |
|
|
98
|
+
|
|
99
|
+
<a name="VaultClient+write"></a>
|
|
100
|
+
|
|
101
|
+
#### vaultClient.write(path, data) ⇒ <code>Promise.<(T\|never)></code>
|
|
102
|
+
Writes data to Vault
|
|
103
|
+
|
|
104
|
+
**Kind**: instance method of [<code>VaultClient</code>](#VaultClient)
|
|
105
|
+
|
|
106
|
+
| Param | Type | Description |
|
|
107
|
+
| --- | --- | --- |
|
|
108
|
+
| path | | path used to write data |
|
|
109
|
+
| data | <code>object</code> | data to write |
|
|
110
|
+
|
|
111
|
+
<a name="VaultClient.boot"></a>
|
|
112
|
+
|
|
113
|
+
#### VaultClient.boot(name, [options]) ⇒
|
|
114
|
+
Boot an instance of Vault
|
|
115
|
+
|
|
116
|
+
The instance will be stored in a local hash. Calling Vault.boot multiple
|
|
117
|
+
times with the same name will return the same instance.
|
|
118
|
+
|
|
119
|
+
**Kind**: static method of [<code>VaultClient</code>](#VaultClient)
|
|
120
|
+
**Returns**: Vault
|
|
121
|
+
|
|
122
|
+
| Param | Type | Description |
|
|
123
|
+
| --- | --- | --- |
|
|
124
|
+
| name | <code>String</code> | Vault instance name |
|
|
125
|
+
| [options] | <code>Object</code> | options for [Vault#constructor](#new_VaultClient_new). |
|
|
126
|
+
|
|
127
|
+
<a name="VaultClient.get"></a>
|
|
128
|
+
|
|
129
|
+
#### VaultClient.get(name) ⇒
|
|
130
|
+
Get an instance of Vault
|
|
131
|
+
|
|
132
|
+
The instance will be stored in a local hash. Calling Vault.pop multiple
|
|
133
|
+
times with the same name will return the same instance.
|
|
134
|
+
|
|
135
|
+
**Kind**: static method of [<code>VaultClient</code>](#VaultClient)
|
|
136
|
+
**Returns**: Vault
|
|
137
|
+
|
|
138
|
+
| Param | Type | Description |
|
|
139
|
+
| --- | --- | --- |
|
|
140
|
+
| name | <code>String</code> | Vault instance name |
|
|
141
|
+
|
|
142
|
+
<a name="VaultClient.clear"></a>
|
|
143
|
+
|
|
144
|
+
#### VaultClient.clear([name])
|
|
145
|
+
Clear named Vault instance
|
|
146
|
+
|
|
147
|
+
If no name passed all named instances will be cleared.
|
|
148
|
+
|
|
149
|
+
**Kind**: static method of [<code>VaultClient</code>](#VaultClient)
|
|
150
|
+
|
|
151
|
+
| Param | Type | Description |
|
|
152
|
+
| --- | --- | --- |
|
|
153
|
+
| [name] | <code>String</code> | Vault instance name, all instances will be cleared if no name were passed |
|
package/package.json
CHANGED
|
@@ -1,44 +1,44 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "node-vault-client",
|
|
3
|
-
"version": "1.0.
|
|
4
|
-
"description": "A Vault Client implemented in pure javascript for HashiCorp Vault. It supports variety of Auth Backends and performs lease renewal for issued auth token.",
|
|
5
|
-
"repository": {
|
|
6
|
-
"url": "git+https://github.com/namecheap/node-vault-client.git"
|
|
7
|
-
},
|
|
8
|
-
"engines": {
|
|
9
|
-
"node": ">=14.0.0"
|
|
10
|
-
},
|
|
11
|
-
"main": "src/VaultClient.js",
|
|
12
|
-
"files": [
|
|
13
|
-
"src"
|
|
14
|
-
],
|
|
15
|
-
"scripts": {
|
|
16
|
-
"test": "mocha test/**/*.test.js",
|
|
17
|
-
"version": "git add -A ."
|
|
18
|
-
},
|
|
19
|
-
"author": "Namecheap <opensource@namecheap.com>",
|
|
20
|
-
"license": "Apache-2.0",
|
|
21
|
-
"dependencies": {
|
|
22
|
-
"@aws-sdk/credential-providers": "^3.382.0",
|
|
23
|
-
"assign-deep": "^1.0.1",
|
|
24
|
-
"aws4": "^1.8.0",
|
|
25
|
-
"bluebird": "^3.7.0",
|
|
26
|
-
"lodash": "^4.17.15",
|
|
27
|
-
"long-timeout": "^0.1.1",
|
|
28
|
-
"pretty-ms": "^2.1.0",
|
|
29
|
-
"request": "^2.88.0",
|
|
30
|
-
"request-promise": "^4.2.4",
|
|
31
|
-
"url-join": "^2.0.5"
|
|
32
|
-
},
|
|
33
|
-
"peerDependencies": {
|
|
34
|
-
"config": ">=1 <4"
|
|
35
|
-
},
|
|
36
|
-
"devDependencies": {
|
|
37
|
-
"chai": "^3.5.0",
|
|
38
|
-
"co-mocha": "^1.2.2",
|
|
39
|
-
"deep-freeze": "^0.0.1",
|
|
40
|
-
"mocha": "^3.5.3",
|
|
41
|
-
"sinon": "^2.4.1",
|
|
42
|
-
"sinon-chai": "^2.14.0"
|
|
43
|
-
}
|
|
44
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "node-vault-client",
|
|
3
|
+
"version": "1.0.2",
|
|
4
|
+
"description": "A Vault Client implemented in pure javascript for HashiCorp Vault. It supports variety of Auth Backends and performs lease renewal for issued auth token.",
|
|
5
|
+
"repository": {
|
|
6
|
+
"url": "git+https://github.com/namecheap/node-vault-client.git"
|
|
7
|
+
},
|
|
8
|
+
"engines": {
|
|
9
|
+
"node": ">=14.0.0"
|
|
10
|
+
},
|
|
11
|
+
"main": "src/VaultClient.js",
|
|
12
|
+
"files": [
|
|
13
|
+
"src"
|
|
14
|
+
],
|
|
15
|
+
"scripts": {
|
|
16
|
+
"test": "mocha test/**/*.test.js",
|
|
17
|
+
"version": "git add -A ."
|
|
18
|
+
},
|
|
19
|
+
"author": "Namecheap <opensource@namecheap.com>",
|
|
20
|
+
"license": "Apache-2.0",
|
|
21
|
+
"dependencies": {
|
|
22
|
+
"@aws-sdk/credential-providers": "^3.382.0",
|
|
23
|
+
"assign-deep": "^1.0.1",
|
|
24
|
+
"aws4": "^1.8.0",
|
|
25
|
+
"bluebird": "^3.7.0",
|
|
26
|
+
"lodash": "^4.17.15",
|
|
27
|
+
"long-timeout": "^0.1.1",
|
|
28
|
+
"pretty-ms": "^2.1.0",
|
|
29
|
+
"request": "^2.88.0",
|
|
30
|
+
"request-promise": "^4.2.4",
|
|
31
|
+
"url-join": "^2.0.5"
|
|
32
|
+
},
|
|
33
|
+
"peerDependencies": {
|
|
34
|
+
"config": ">=1 <4"
|
|
35
|
+
},
|
|
36
|
+
"devDependencies": {
|
|
37
|
+
"chai": "^3.5.0",
|
|
38
|
+
"co-mocha": "^1.2.2",
|
|
39
|
+
"deep-freeze": "^0.0.1",
|
|
40
|
+
"mocha": "^3.5.3",
|
|
41
|
+
"sinon": "^2.4.1",
|
|
42
|
+
"sinon-chai": "^2.14.0"
|
|
43
|
+
}
|
|
44
|
+
}
|
package/src/Lease.js
CHANGED
|
@@ -1,57 +1,57 @@
|
|
|
1
|
-
'use strict';
|
|
2
|
-
|
|
3
|
-
const _ = require('lodash');
|
|
4
|
-
|
|
5
|
-
class Lease {
|
|
6
|
-
constructor(
|
|
7
|
-
requestId,
|
|
8
|
-
leaseId,
|
|
9
|
-
leaseDuration,
|
|
10
|
-
renewable,
|
|
11
|
-
data
|
|
12
|
-
) {
|
|
13
|
-
this.__requestId = requestId;
|
|
14
|
-
this.__leaseId = leaseId;
|
|
15
|
-
this.__leaseDuration = leaseDuration;
|
|
16
|
-
this.__renewable = renewable;
|
|
17
|
-
this.__data = data === undefined ? {} : data;
|
|
18
|
-
}
|
|
19
|
-
|
|
20
|
-
static fromResponse(response) {
|
|
21
|
-
return new Lease(
|
|
22
|
-
response.request_id,
|
|
23
|
-
response.lease_id,
|
|
24
|
-
response.lease_duration,
|
|
25
|
-
response.renewable,
|
|
26
|
-
response.data
|
|
27
|
-
);
|
|
28
|
-
}
|
|
29
|
-
|
|
30
|
-
/**
|
|
31
|
-
* @param {String} key
|
|
32
|
-
* @returns {String}
|
|
33
|
-
*/
|
|
34
|
-
getValue(key) {
|
|
35
|
-
if (this.__data[key] === undefined) {
|
|
36
|
-
throw new Error('Requested key does not exist');
|
|
37
|
-
}
|
|
38
|
-
|
|
39
|
-
return this.__data[key];
|
|
40
|
-
}
|
|
41
|
-
|
|
42
|
-
/**
|
|
43
|
-
* @returns {Object}
|
|
44
|
-
*/
|
|
45
|
-
getData() {
|
|
46
|
-
return _.cloneDeep(this.__data);
|
|
47
|
-
}
|
|
48
|
-
|
|
49
|
-
/**
|
|
50
|
-
* @returns {bool}
|
|
51
|
-
*/
|
|
52
|
-
isRenewable() {
|
|
53
|
-
return this.__renewable;
|
|
54
|
-
}
|
|
55
|
-
}
|
|
56
|
-
|
|
57
|
-
module.exports = Lease;
|
|
1
|
+
'use strict';
|
|
2
|
+
|
|
3
|
+
const _ = require('lodash');
|
|
4
|
+
|
|
5
|
+
class Lease {
|
|
6
|
+
constructor(
|
|
7
|
+
requestId,
|
|
8
|
+
leaseId,
|
|
9
|
+
leaseDuration,
|
|
10
|
+
renewable,
|
|
11
|
+
data
|
|
12
|
+
) {
|
|
13
|
+
this.__requestId = requestId;
|
|
14
|
+
this.__leaseId = leaseId;
|
|
15
|
+
this.__leaseDuration = leaseDuration;
|
|
16
|
+
this.__renewable = renewable;
|
|
17
|
+
this.__data = data === undefined ? {} : data;
|
|
18
|
+
}
|
|
19
|
+
|
|
20
|
+
static fromResponse(response) {
|
|
21
|
+
return new Lease(
|
|
22
|
+
response.request_id,
|
|
23
|
+
response.lease_id,
|
|
24
|
+
response.lease_duration,
|
|
25
|
+
response.renewable,
|
|
26
|
+
response.data
|
|
27
|
+
);
|
|
28
|
+
}
|
|
29
|
+
|
|
30
|
+
/**
|
|
31
|
+
* @param {String} key
|
|
32
|
+
* @returns {String}
|
|
33
|
+
*/
|
|
34
|
+
getValue(key) {
|
|
35
|
+
if (this.__data[key] === undefined) {
|
|
36
|
+
throw new Error('Requested key does not exist');
|
|
37
|
+
}
|
|
38
|
+
|
|
39
|
+
return this.__data[key];
|
|
40
|
+
}
|
|
41
|
+
|
|
42
|
+
/**
|
|
43
|
+
* @returns {Object}
|
|
44
|
+
*/
|
|
45
|
+
getData() {
|
|
46
|
+
return _.cloneDeep(this.__data);
|
|
47
|
+
}
|
|
48
|
+
|
|
49
|
+
/**
|
|
50
|
+
* @returns {bool}
|
|
51
|
+
*/
|
|
52
|
+
isRenewable() {
|
|
53
|
+
return this.__renewable;
|
|
54
|
+
}
|
|
55
|
+
}
|
|
56
|
+
|
|
57
|
+
module.exports = Lease;
|
package/src/VaultApiClient.js
CHANGED
|
@@ -1,55 +1,55 @@
|
|
|
1
|
-
'use strict';
|
|
2
|
-
|
|
3
|
-
const rp = require('request-promise');
|
|
4
|
-
const urljoin = require('url-join');
|
|
5
|
-
const _ = require('lodash');
|
|
6
|
-
|
|
7
|
-
class VaultApiClient {
|
|
8
|
-
|
|
9
|
-
/**
|
|
10
|
-
* @param {Object} config
|
|
11
|
-
* @param {String} config.url - the url of the vault server
|
|
12
|
-
* @param {String} [config.apiVersion='v1']
|
|
13
|
-
* @param {Object} logger
|
|
14
|
-
*/
|
|
15
|
-
constructor(config, logger) {
|
|
16
|
-
this.__config = _.defaultsDeep(_.cloneDeep(config), {
|
|
17
|
-
apiVersion: 'v1',
|
|
18
|
-
});
|
|
19
|
-
|
|
20
|
-
this._logger = logger;
|
|
21
|
-
}
|
|
22
|
-
|
|
23
|
-
makeRequest(method, path, data, headers) {
|
|
24
|
-
data = data === undefined ? null : data;
|
|
25
|
-
headers = headers === undefined ? {} : headers;
|
|
26
|
-
|
|
27
|
-
const requestOptions = {
|
|
28
|
-
method: method,
|
|
29
|
-
body: data === null ? undefined : data,
|
|
30
|
-
uri: urljoin(this.__config.url, this.__config.apiVersion, path),
|
|
31
|
-
followRedirects: true,
|
|
32
|
-
followAllRedirects: true,
|
|
33
|
-
headers,
|
|
34
|
-
json: true,
|
|
35
|
-
};
|
|
36
|
-
|
|
37
|
-
this._logger.debug(
|
|
38
|
-
'making request: %s %s',
|
|
39
|
-
requestOptions.method,
|
|
40
|
-
requestOptions.uri
|
|
41
|
-
);
|
|
42
|
-
|
|
43
|
-
return rp(requestOptions)
|
|
44
|
-
.then((response) => {
|
|
45
|
-
this._logger.debug('%s %s response body:\n%s',
|
|
46
|
-
requestOptions.method,
|
|
47
|
-
requestOptions.uri,
|
|
48
|
-
JSON.stringify(response, null, ' ')
|
|
49
|
-
);
|
|
50
|
-
return response;
|
|
51
|
-
});
|
|
52
|
-
}
|
|
53
|
-
}
|
|
54
|
-
|
|
55
|
-
module.exports = VaultApiClient;
|
|
1
|
+
'use strict';
|
|
2
|
+
|
|
3
|
+
const rp = require('request-promise');
|
|
4
|
+
const urljoin = require('url-join');
|
|
5
|
+
const _ = require('lodash');
|
|
6
|
+
|
|
7
|
+
class VaultApiClient {
|
|
8
|
+
|
|
9
|
+
/**
|
|
10
|
+
* @param {Object} config
|
|
11
|
+
* @param {String} config.url - the url of the vault server
|
|
12
|
+
* @param {String} [config.apiVersion='v1']
|
|
13
|
+
* @param {Object} logger
|
|
14
|
+
*/
|
|
15
|
+
constructor(config, logger) {
|
|
16
|
+
this.__config = _.defaultsDeep(_.cloneDeep(config), {
|
|
17
|
+
apiVersion: 'v1',
|
|
18
|
+
});
|
|
19
|
+
|
|
20
|
+
this._logger = logger;
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
makeRequest(method, path, data, headers) {
|
|
24
|
+
data = data === undefined ? null : data;
|
|
25
|
+
headers = headers === undefined ? {} : headers;
|
|
26
|
+
|
|
27
|
+
const requestOptions = {
|
|
28
|
+
method: method,
|
|
29
|
+
body: data === null ? undefined : data,
|
|
30
|
+
uri: urljoin(this.__config.url, this.__config.apiVersion, path),
|
|
31
|
+
followRedirects: true,
|
|
32
|
+
followAllRedirects: true,
|
|
33
|
+
headers,
|
|
34
|
+
json: true,
|
|
35
|
+
};
|
|
36
|
+
|
|
37
|
+
this._logger.debug(
|
|
38
|
+
'making request: %s %s',
|
|
39
|
+
requestOptions.method,
|
|
40
|
+
requestOptions.uri
|
|
41
|
+
);
|
|
42
|
+
|
|
43
|
+
return rp(requestOptions)
|
|
44
|
+
.then((response) => {
|
|
45
|
+
this._logger.debug('%s %s response body:\n%s',
|
|
46
|
+
requestOptions.method,
|
|
47
|
+
requestOptions.uri,
|
|
48
|
+
JSON.stringify(response, null, ' ')
|
|
49
|
+
);
|
|
50
|
+
return response;
|
|
51
|
+
});
|
|
52
|
+
}
|
|
53
|
+
}
|
|
54
|
+
|
|
55
|
+
module.exports = VaultApiClient;
|