node-vault-client 1.0.1 → 2.0.0

package/src/VaultClient.js

@@ -1,263 +1,288 @@
-'use strict';
-
-const _ = require('lodash');
-const Lease = require('./Lease');
-const errors = require('./errors');
-const VaultApiClient = require('./VaultApiClient');
-const VaultAppRoleAuth = require('./auth/VaultAppRoleAuth');
-const VaultTokenAuth = require('./auth/VaultTokenAuth');
-const VaultIAMAuth = require('./auth/VaultIAMAuth');
-const VaultNodeConfig = require('./VaultNodeConfig');
-const VaultKubernetesAuth = require('./auth/VaultKubernetesAuth');
-const vaultInstances = {};
-
-class VaultClient {
-
-    /**
-     * Client constructor function.
-     *
-     * @param {Object} options
-     * @param {Object} options.api
-     * @param {String} options.api.url - the url of the vault server
-     * @param {String} [options.api.apiVersion='v1']
-     * @param {Object} options.auth
-     * @param {String} options.auth.type
-     * @param {Object} options.auth.config - auth configuration variables
-     * @param {Object|false} options.logger - Logger that supports "error", "info", "warn", "trace", "debug" methods. Uses `console` by default. Pass `false` to disable logging.
-     */
-    constructor(options) {
-        this.__log = this.__setupLogger(options.logger);
-
-        this.__api = new VaultApiClient(
-            options.api,
-            this.__log
-        );
-
-        /**
-         * @type {VaultBaseAuth}
-         * @private
-         */
-        this.__auth = this.__getAuthProvider(
-            options.auth,
-            this.__api
-        );
-
-        this.__namespace = options.auth.config.namespace;
-    }
-
-    /**
-     * Boot an instance of Vault
-     *
-     * The instance will be stored in a local hash. Calling Vault.boot multiple
-     * times with the same name will return the same instance.
-     *
-     * @param {String} name - Vault instance name
-     * @param {Object} [options] - options for {@link Vault#constructor}.
-     * @return Vault
-     */
-    static boot(name, options) {
-        if (options === undefined) {
-            throw new errors.InvalidArgumentsError('Options should be provided');
-        }
-
-        let instance = vaultInstances[name];
-        if (instance === undefined) {
-            vaultInstances[name] = instance = new VaultClient(options);
-        }
-        return instance;
-    }
-
-    /**
-     * Get an instance of Vault
-     *
-     * The instance will be stored in a local hash. Calling Vault.pop multiple
-     * times with the same name will return the same instance.
-     *
-     * @param {String} name - Vault instance name
-     * @return Vault
-     */
-    static get(name) {
-        let instance = vaultInstances[name];
-
-        if (instance === undefined) {
-            throw new errors.InvalidArgumentsError('Invalid instance name');
-        }
-
-        return instance;
-    }
-
-    /**
-     * Clear named Vault instance
-     *
-     * If no name passed all named instances will be cleared.
-     *
-     * @param {String} [name] - Vault instance name, all instances will be cleared if no name were passed
-     */
-    static clear(name) {
-        if (typeof name === 'string') {
-            delete vaultInstances[name];
-        } else {
-            for (let k in vaultInstances) {
-                if (vaultInstances.hasOwnProperty(k)) {
-                    delete vaultInstances[k];
-                }
-            }
-        }
-    }
-
-    /**
-     * @protected
-     *
-     * @param {Object} authConfig
-     * @param {string} authConfig.type
-     * @param {string} authConfig.mount
-     * @param {Object} authConfig.config
-     * @param {VaultApiClient} api
-     * @return {VaultBaseAuth}
-     * @private
-     */
-    __getAuthProvider(authConfig, api) {
-        this.__log.debug('creating vault auth method: "%s"', authConfig.type);
-
-        switch (authConfig.type) {
-            case 'iam':
-                return new VaultIAMAuth(
-                    api,
-                    this.__log,
-                    authConfig.config,
-                    authConfig.mount
-                );
-            case 'appRole':
-                return new VaultAppRoleAuth(
-                    api,
-                    this.__log,
-                    authConfig.config,
-                    authConfig.mount
-                );
-            case 'token':
-                return new VaultTokenAuth(
-                    api,
-                    this.__log,
-                    authConfig.config,
-                    authConfig.mount
-                );
-            case 'kubernetes':
-                return new VaultKubernetesAuth(
-                    api,
-                    this.__log,
-                    authConfig.config,
-                    authConfig.mount
-                );
-        }
-
-        throw new errors.InvalidArgumentsError('Unsupported auth method')
-    }
-
-    /**
-     * Populates Vault's values to NPM "config" module
-     */
-    fillNodeConfig() {
-        const vaultConf = new VaultNodeConfig(this);
-
-        return vaultConf.populate();
-    }
-
-    getHeaders(token) {
-        if (this.__namespace) {
-            return {
-                'X-Vault-Token': token.getId(),
-                'X-Vault-Namespace': this.__namespace
-            }
-        }
-
-        return {'X-Vault-Token': token.getId()}
-    }
-
-    /**
-     * Read secret from Vault
-     * @param {string} path - path to the secret
-     * @returns {Promise<Lease>}
-     */
-    read(path) {
-        this.__log.debug('read secret %s', path);
-        return this.__auth.getAuthToken()
-            .then(token => this.__api.makeRequest('GET', path, null, this.getHeaders(token)))
-            .then(res => {
-                this.__log.debug('receive secret %s', path);
-                return Lease.fromResponse(res);
-            })
-            .catch((reason) => {
-                this.__log.error('read secret failed: %s', reason.message);
-                throw reason;
-            });
-    }
-
-    /**
-     * Retrieves secrets list
-     *
-     * @param {string} path - path to the secret
-     * @returns {Promise<Lease>}
-     */
-    list(path) {
-        this.__log.debug('list secrets %s', path);
-        return this.__auth.getAuthToken()
-            .then(token => this.__api.makeRequest('LIST', path, null, this.getHeaders(token)))
-            .then(res => {
-                this.__log.debug('got secrets list %s', path);
-                return Lease.fromResponse(res);
-            })
-            .catch((reason) => {
-                this.__log.error('list secrets failed: %s', reason.message);
-                throw reason;
-            });
-    }
-
-    /**
-     * Writes data to Vault
-     *
-     * @param path - path used to write data
-     * @param {object} data - data to write
-     * @returns {Promise<T | never>}
-     */
-    write(path, data) {
-        this.__log.debug('write secret %s', path);
-        return this.__auth.getAuthToken()
-            .then((token) => this.__api.makeRequest('POST', path, data, this.getHeaders(token)))
-            .then((response) => {
-                this.__log.debug('secret %s was written', path);
-                return response;
-            })
-            .catch((reason) => {
-                this.__log.error('write secret failed: %s', reason.message);
-                throw reason;
-            });
-    }
-
-    /**
-     * @private
-     */
-    __setupLogger(logger) {
-        if (logger === false) {
-            return {
-                error: _.noop,
-                warn: _.noop,
-                info: _.noop,
-                debug: _.noop,
-                trace: _.noop,
-            }
-        } else if (_.intersection(_.functionsIn(logger), ['error', 'warn', 'info', 'debug', 'trace']).length >= 5) {
-            return logger
-        } else {
-            return {
-                error: console.error,
-                warn: console.warn,
-                info: console.info,
-                trace: console.trace,
-                // avoid output sensitive information
-                debug: _.noop
-            };
-        }
-    }
-}
-
-module.exports = VaultClient;
+'use strict';
+
+const _ = require('lodash');
+const Lease = require('./Lease');
+const errors = require('./errors');
+const VaultApiClient = require('./VaultApiClient');
+const VaultAppRoleAuth = require('./auth/VaultAppRoleAuth');
+const VaultTokenAuth = require('./auth/VaultTokenAuth');
+const VaultIAMAuth = require('./auth/VaultIAMAuth');
+const VaultNodeConfig = require('./VaultNodeConfig');
+const VaultKubernetesAuth = require('./auth/VaultKubernetesAuth');
+const vaultInstances = {};
+
+class VaultClient {
+
+    /**
+     * Client constructor function.
+     *
+     * @param {Object} options
+     * @param {Object} options.api
+     * @param {String} options.api.url - the url of the vault server
+     * @param {String} [options.api.apiVersion='v1']
+     * @param {Object} [options.api.requestOptions] - extra options merged into every HTTP
+     *      request (e.g. an undici `dispatcher` for a proxy/SOCKS agent or custom TLS/CA trust).
+     *      See {@link VaultApiClient#constructor}.
+     * @param {Object} options.auth
+     * @param {String} options.auth.type
+     * @param {Object} options.auth.config - auth configuration variables
+     * @param {Object|false} options.logger - Logger that supports "error", "info", "warn", "trace", "debug" methods. Uses `console` by default. Pass `false` to disable logging.
+     */
+    constructor(options) {
+        this.__log = this.__setupLogger(options.logger);
+
+        this.__api = new VaultApiClient(
+            options.api,
+            this.__log
+        );
+
+        /**
+         * @type {VaultBaseAuth}
+         * @private
+         */
+        this.__auth = this.__getAuthProvider(
+            options.auth,
+            this.__api
+        );
+
+        this.__namespace = options.auth.config.namespace;
+    }
+
+    /**
+     * Boot an instance of Vault
+     *
+     * The instance will be stored in a local hash. Calling Vault.boot multiple
+     * times with the same name will return the same instance.
+     *
+     * @param {String} name - Vault instance name
+     * @param {Object} [options] - options for {@link VaultClient#constructor}.
+     * @return {VaultClient}
+     */
+    static boot(name, options) {
+        if (options === undefined) {
+            throw new errors.InvalidArgumentsError('Options should be provided');
+        }
+
+        let instance = vaultInstances[name];
+        if (instance === undefined) {
+            vaultInstances[name] = instance = new VaultClient(options);
+        }
+        return instance;
+    }
+
+    /**
+     * Get an instance of Vault
+     *
+     * The instance will be stored in a local hash. Calling Vault.pop multiple
+     * times with the same name will return the same instance.
+     *
+     * @param {String} name - Vault instance name
+     * @return {VaultClient}
+     */
+    static get(name) {
+        let instance = vaultInstances[name];
+
+        if (instance === undefined) {
+            throw new errors.InvalidArgumentsError('Invalid instance name');
+        }
+
+        return instance;
+    }
+
+    /**
+     * Clear named Vault instance
+     *
+     * If no name passed all named instances will be cleared.
+     *
+     * @param {String} [name] - Vault instance name, all instances will be cleared if no name were passed
+     */
+    static clear(name) {
+        if (typeof name === 'string') {
+            const instance = vaultInstances[name];
+            if (instance !== undefined) {
+                instance.close();
+                delete vaultInstances[name];
+            }
+        } else {
+            for (let k in vaultInstances) {
+                if (Object.hasOwn(vaultInstances, k)) {
+                    vaultInstances[k].close();
+                    delete vaultInstances[k];
+                }
+            }
+        }
+    }
+
+    /**
+     * Release resources held by this client.
+     *
+     * Cancels the background auth-token refresh timer that keeps the Node.js event loop
+     * alive for renewable tokens. Call this once you are done with the client so a
+     * short-lived script can exit on its own. Safe to call when no timer is armed and
+     * safe to call multiple times. After calling `close()` the client may still be used;
+     * the next operation that fetches a renewable token will arm a new refresh timer.
+     *
+     * @returns {void}
+     */
+    close() {
+        if (this.__auth && typeof this.__auth.cancelTokenRefresh === 'function') {
+            this.__auth.cancelTokenRefresh();
+        }
+    }
+
+    /**
+     * @protected
+     *
+     * @param {Object} authConfig
+     * @param {string} authConfig.type
+     * @param {string} authConfig.mount
+     * @param {Object} authConfig.config
+     * @param {VaultApiClient} api
+     * @return {VaultBaseAuth}
+     * @private
+     */
+    __getAuthProvider(authConfig, api) {
+        this.__log.debug('creating vault auth method: "%s"', authConfig.type);
+
+        switch (authConfig.type) {
+            case 'iam':
+                return new VaultIAMAuth(
+                    api,
+                    this.__log,
+                    authConfig.config,
+                    authConfig.mount
+                );
+            case 'appRole':
+                return new VaultAppRoleAuth(
+                    api,
+                    this.__log,
+                    authConfig.config,
+                    authConfig.mount
+                );
+            case 'token':
+                return new VaultTokenAuth(
+                    api,
+                    this.__log,
+                    authConfig.config,
+                    authConfig.mount
+                );
+            case 'kubernetes':
+                return new VaultKubernetesAuth(
+                    api,
+                    this.__log,
+                    authConfig.config,
+                    authConfig.mount
+                );
+        }
+
+        throw new errors.InvalidArgumentsError('Unsupported auth method')
+    }
+
+    /**
+     * Populates Vault's values to NPM "config" module
+     */
+    fillNodeConfig() {
+        const vaultConf = new VaultNodeConfig(this);
+
+        return vaultConf.populate();
+    }
+
+    getHeaders(token) {
+        if (this.__namespace) {
+            return {
+                'X-Vault-Token': token.getId(),
+                'X-Vault-Namespace': this.__namespace
+            }
+        }
+
+        return {'X-Vault-Token': token.getId()}
+    }
+
+    /**
+     * Read secret from Vault
+     * @param {string} path - path to the secret
+     * @returns {Promise<Lease>}
+     */
+    read(path) {
+        this.__log.debug('read secret %s', path);
+        return this.__auth.getAuthToken()
+            .then(token => this.__api.makeRequest('GET', path, null, this.getHeaders(token)))
+            .then(res => {
+                this.__log.debug('receive secret %s', path);
+                return Lease.fromResponse(res);
+            })
+            .catch((reason) => {
+                this.__log.error('read secret failed: %s', reason.message);
+                throw reason;
+            });
+    }
+
+    /**
+     * Retrieves secrets list
+     *
+     * @param {string} path - path to the secret
+     * @returns {Promise<Lease>}
+     */
+    list(path) {
+        this.__log.debug('list secrets %s', path);
+        return this.__auth.getAuthToken()
+            .then(token => this.__api.makeRequest('LIST', path, null, this.getHeaders(token)))
+            .then(res => {
+                this.__log.debug('got secrets list %s', path);
+                return Lease.fromResponse(res);
+            })
+            .catch((reason) => {
+                this.__log.error('list secrets failed: %s', reason.message);
+                throw reason;
+            });
+    }
+
+    /**
+     * Writes data to Vault
+     *
+     * @param {string} path - path used to write data
+     * @param {object} data - data to write
+     * @returns {Promise<Object>} the parsed Vault response body
+     */
+    write(path, data) {
+        this.__log.debug('write secret %s', path);
+        return this.__auth.getAuthToken()
+            .then((token) => this.__api.makeRequest('POST', path, data, this.getHeaders(token)))
+            .then((response) => {
+                this.__log.debug('secret %s was written', path);
+                return response;
+            })
+            .catch((reason) => {
+                this.__log.error('write secret failed: %s', reason.message);
+                throw reason;
+            });
+    }
+
+    /**
+     * @private
+     */
+    __setupLogger(logger) {
+        if (logger === false) {
+            return {
+                error: _.noop,
+                warn: _.noop,
+                info: _.noop,
+                debug: _.noop,
+                trace: _.noop,
+            }
+        } else if (_.intersection(_.functionsIn(logger), ['error', 'warn', 'info', 'debug', 'trace']).length >= 5) {
+            return logger
+        } else {
+            return {
+                error: console.error,
+                warn: console.warn,
+                info: console.info,
+                trace: console.trace,
+                // avoid output sensitive information
+                debug: _.noop
+            };
+        }
+    }
+}
+
+module.exports = VaultClient;