node-vault-client 1.0.1 → 1.0.3

package/src/auth/VaultKubernetesAuth.js

@@ -1,48 +1,48 @@
-const fs = require('fs');
-const VaultBaseAuth = require('./VaultBaseAuth');
-
-class VaultKubernetesAuth extends VaultBaseAuth {
-    /**
-     * @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
-     * @param {Object} config
-     * @param {String} config.role - Role configured in Vault Kubernetes Auth backend under which we want to issue Vault token.
-     * @param {String} [config.tokenPath] - Path to the Kube JWT token. If omitted - default will be used.
-     * @param {String} mount - Vault's  mount point ("kubernetes" by default)
-     */
-    constructor(apiClient, logger, config, mount) {
-        super(apiClient, logger, mount || 'kubernetes');
-
-        this.__role = config.role;
-        this.__tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token';
-        if (config.tokenPath !== undefined) {
-            this.__tokenPath = config.tokenPath;
-        }
-    }
-
-    _authenticate() {
-        this._log.info(
-            'making authentication request: Vault role: "%s"; K8s token path: "%s"',
-            this.__role, this.__tokenPath
-        );
-
-        const k8sJwtToken = fs.readFileSync(this.__tokenPath).toString();
-        this._log.debug(
-            'receive K8s token: %s',
-            k8sJwtToken
-        );
-
-        return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
-            role: this.__role,
-            jwt: k8sJwtToken,
-        }).then((res) => {
-            this._log.debug(
-                'receive token: %s',
-                res.auth.client_token
-            );
-
-            return this._getTokenEntity(res.auth.client_token);
-        });
-    }
-}
-
-module.exports = VaultKubernetesAuth;
+const fs = require('fs');
+const VaultBaseAuth = require('./VaultBaseAuth');
+
+class VaultKubernetesAuth extends VaultBaseAuth {
+    /**
+     * @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
+     * @param {Object} config
+     * @param {String} config.role - Role configured in Vault Kubernetes Auth backend under which we want to issue Vault token.
+     * @param {String} [config.tokenPath] - Path to the Kube JWT token. If omitted - default will be used.
+     * @param {String} mount - Vault's  mount point ("kubernetes" by default)
+     */
+    constructor(apiClient, logger, config, mount) {
+        super(apiClient, logger, mount || 'kubernetes');
+
+        this.__role = config.role;
+        this.__tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token';
+        if (config.tokenPath !== undefined) {
+            this.__tokenPath = config.tokenPath;
+        }
+    }
+
+    _authenticate() {
+        this._log.info(
+            'making authentication request: Vault role: "%s"; K8s token path: "%s"',
+            this.__role, this.__tokenPath
+        );
+
+        const k8sJwtToken = fs.readFileSync(this.__tokenPath).toString();
+        this._log.debug(
+            'receive K8s token: %s',
+            k8sJwtToken
+        );
+
+        return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
+            role: this.__role,
+            jwt: k8sJwtToken,
+        }).then((res) => {
+            this._log.debug(
+                'receive token: %s',
+                res.auth.client_token
+            );
+
+            return this._getTokenEntity(res.auth.client_token);
+        });
+    }
+}
+
+module.exports = VaultKubernetesAuth;

package/src/auth/VaultTokenAuth.js

@@ -1,34 +1,34 @@
-'use strict';
-
-const VaultBaseAuth = require('./VaultBaseAuth');
-const errors = require('../errors');
-
-class VaultTokenAuth extends VaultBaseAuth {
-
-    /**
-     * @param {Object} connConfig - see {@link VaultBaseAuth#constructor}
-     * @param {Object} config
-     * @param {String} config.token
-     * @param {String} mount - Vault's  mount point ("token" by default)
-     */
-    constructor(connConfig, logger, config, mount) {
-        super(connConfig, logger, mount || 'token');
-
-        if (!config.token) {
-            throw new errors.InvalidArgumentsError('Auth token should be provided for VaultTokenAuth');
-        }
-
-        this.__token = config.token;
-    }
-
-    _authenticate() {
-        return this._getTokenEntity(this.__token);
-    }
-
-    _reauthenticationAllowed() {
-        return false;
-    }
-
-}
-
-module.exports = VaultTokenAuth;
+'use strict';
+
+const VaultBaseAuth = require('./VaultBaseAuth');
+const errors = require('../errors');
+
+class VaultTokenAuth extends VaultBaseAuth {
+
+    /**
+     * @param {Object} connConfig - see {@link VaultBaseAuth#constructor}
+     * @param {Object} config
+     * @param {String} config.token
+     * @param {String} mount - Vault's  mount point ("token" by default)
+     */
+    constructor(connConfig, logger, config, mount) {
+        super(connConfig, logger, mount || 'token');
+
+        if (!config.token) {
+            throw new errors.InvalidArgumentsError('Auth token should be provided for VaultTokenAuth');
+        }
+
+        this.__token = config.token;
+    }
+
+    _authenticate() {
+        return this._getTokenEntity(this.__token);
+    }
+
+    _reauthenticationAllowed() {
+        return false;
+    }
+
+}
+
+module.exports = VaultTokenAuth;

package/src/errors.js

@@ -1,21 +1,21 @@
-'use strict';
-
-class VaultError extends Error {
-    constructor(message, error) {
-        super(message);
-        this.name = this.constructor.name;
-        this.message = message;
-
-        Error.captureStackTrace(this, this.constructor.name);
-    }
-}
-class InvalidArgumentsError extends VaultError {}
-class InvalidAWSCredentialsError extends InvalidArgumentsError {}
-class AuthTokenExpiredError extends VaultError {}
-
-module.exports = {
-    VaultError,
-    InvalidArgumentsError,
-    InvalidAWSCredentialsError,
-    AuthTokenExpiredError,
-};
+'use strict';
+
+class VaultError extends Error {
+    constructor(message, error) {
+        super(message);
+        this.name = this.constructor.name;
+        this.message = message;
+
+        Error.captureStackTrace(this, this.constructor.name);
+    }
+}
+class InvalidArgumentsError extends VaultError {}
+class InvalidAWSCredentialsError extends InvalidArgumentsError {}
+class AuthTokenExpiredError extends VaultError {}
+
+module.exports = {
+    VaultError,
+    InvalidArgumentsError,
+    InvalidAWSCredentialsError,
+    AuthTokenExpiredError,
+};

package/src/kvTransform.js

@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * Pure KV path-rewriting and response-normalizing helpers.
+ * No I/O; fully testable in isolation.
+ *
+ * rewritePath(version, op, mount, logicalPath) -> apiPath
+ * normalizeResponse(version, op, body)         -> normalized body
+ */
+
+// Map of op -> v2 path segment inserted between mount and logical path.
+const V2_SEGMENT = {
+    read:            'data',
+    write:           'data',
+    delete:          'data',
+    update:          'data',
+    list:            'metadata',
+    readMetadata:    'metadata',
+    deleteMetadata:  'metadata',
+    deleteVersions:  'delete',
+    undeleteVersions:'undelete',
+    destroyVersions: 'destroy',
+};
+
+/**
+ * Rewrite a logical path to the correct API path for the given engine version.
+ *
+ * @param {number} version   - Engine version (2 = KV v2; anything else = passthrough)
+ * @param {string} op        - Operation name (read, write, list, delete, update, …)
+ * @param {string} mount     - Mount point (e.g. "secret" or "secret/")
+ * @param {string} logicalPath - Path relative to the mount (e.g. "team/svc")
+ * @returns {string}
+ */
+function rewritePath(version, op, mount, logicalPath) {
+    // Normalise trailing slash on mount
+    const m = mount.replace(/\/+$/, '');
+
+    if (version !== 2) {
+        // v1 / non-kv: simple concatenation
+        return logicalPath ? `${m}/${logicalPath}` : m;
+    }
+
+    const segment = V2_SEGMENT[op] || 'data';
+    return `${m}/${segment}/${logicalPath}`;
+}
+
+/**
+ * Normalise a Vault API response body for the given engine version and operation.
+ *
+ * For v1 / non-kv the body is always returned as-is.
+ * For v2:
+ *  - read:         body.data is replaced with body.data.data; body.metadata is set to body.data.metadata
+ *  - readMetadata: body.data is replaced with the original body.data (unwrapped one level)
+ *  - write/delete/update/…: body returned as-is
+ *
+ * @param {number} version
+ * @param {string} op
+ * @param {*}      body
+ * @returns {*}
+ */
+function normalizeResponse(version, op, body) {
+    if (version !== 2) {
+        return body;
+    }
+
+    if (op === 'read') {
+        if (!body || !body.data) {
+            return body;
+        }
+        // Promote inner data/metadata to top-level response fields
+        const result = Object.assign({}, body);
+        result.metadata = body.data.metadata;
+        result.data = body.data.data;
+        return result;
+    }
+
+    if (op === 'readMetadata') {
+        if (!body || !body.data) {
+            return body;
+        }
+        const result = Object.assign({}, body);
+        result.data = body.data;
+        return result;
+    }
+
+    // All other v2 ops (write, list, delete, update, deleteVersions, …): passthrough
+    return body;
+}
+
+module.exports = { rewritePath, normalizeResponse };