node-vault-client 1.0.1 → 2.0.0

package/src/VaultNodeConfig.js

@@ -1,105 +1,104 @@
-'use strict';
-
-const path = require('path');
-const fs = require('fs');
-const Bluebird = require('bluebird');
-const _ = require('lodash');
-const assignDeep = require('assign-deep');
-
-const errors = require('./errors');
-
-class VaultNodeConfig {
-
-    constructor(vault) {
-        this.__vault = vault;
-
-        try {
-            require.resolve('config');
-        } catch(e) {
-            throw new errors.VaultError(`NPM package "config" isn't installed`);
-        }
-
-        this.__nodeConfig = require('config');
-    }
-
-    /**
-     * Populates Vault's values to "node-config"
-     */
-    populate() {
-        const substitutionMap = this.__getSubstitutionMap();
-        let requiredData = {};
-
-        this.__traverse(substitutionMap, (key, val) => {
-            const splitRes = val.split('#');
-            const path = splitRes[0], value = splitRes[1];
-            if (path === undefined || value === undefined) {
-                throw new errors.InvalidArgumentsError('Invalid format of substitution value');
-            }
-
-            requiredData[path] = null;
-        });
-
-        let promises = _.mapValues(requiredData, (value, path) => this.__vault.read(path));
-
-        return Bluebird.props(promises).then(results => {
-            requiredData = _.mapValues(requiredData, (value, path) => results[path].getData());
-
-            this.__traverse(substitutionMap, (key, val, obj) => {
-                const splitRes = val.split('#');
-                const path = splitRes[0], value = splitRes[1];
-                const res = requiredData[path][value];
-                if (res === undefined) {
-                    throw new errors.VaultError(`Can't find substitution for "${val}"`);
-                }
-
-                obj[key] = requiredData[path][value];
-            });
-
-            return assignDeep(this.__nodeConfig, substitutionMap);
-        });
-    }
-
-    /**
-     * @private
-     */
-    __getSubstitutionMap() {
-        let config_dir = this.__nodeConfig.util.initParam('NODE_CONFIG_DIR', path.join( process.cwd(), 'config') );
-        if (config_dir.indexOf('.') === 0) {
-            config_dir = path.join(process.cwd() , config_dir);
-        }
-
-        const fullFilename = path.join(config_dir, 'custom-vault-variables.js');
-
-        let fileContent;
-        try {
-            fileContent = require(fullFilename);
-        } catch (e) {
-            throw new errors.VaultError('Config file ' + fullFilename + ' cannot be read');
-        }
-
-        if (!_.isPlainObject(fileContent)) {
-            throw new errors.VaultError('Config file ' + fullFilename + ' should return plain object');
-        }
-
-        return _.cloneDeep(fileContent);
-    }
-
-    __traverse(o, func) {
-        for (let i in o) {
-            if (!o.hasOwnProperty(i)) {
-                continue;
-            }
-
-            if (o[i] !== null && typeof(o[i]) === "object") {
-                //going one step down in the object tree!!
-                this.__traverse(o[i], func);
-            } else if (typeof o[i] === 'string') {
-                func(i, o[i], o);
-            } else {
-                throw new errors.InvalidArgumentsError('Illegal key type for substitution map');
-            }
-        }
-    }
-}
-
-module.exports = VaultNodeConfig;
+'use strict';
+
+const path = require('path');
+const Bluebird = require('bluebird');
+const _ = require('lodash');
+const assignDeep = require('assign-deep');
+
+const errors = require('./errors');
+
+class VaultNodeConfig {
+
+    constructor(vault) {
+        this.__vault = vault;
+
+        try {
+            require.resolve('config');
+        } catch {
+            throw new errors.VaultError(`NPM package "config" isn't installed`);
+        }
+
+        this.__nodeConfig = require('config');
+    }
+
+    /**
+     * Populates Vault's values to "node-config"
+     */
+    populate() {
+        const substitutionMap = this.__getSubstitutionMap();
+        let requiredData = {};
+
+        this.__traverse(substitutionMap, (key, val) => {
+            const splitRes = val.split('#');
+            const path = splitRes[0], value = splitRes[1];
+            if (path === undefined || value === undefined) {
+                throw new errors.InvalidArgumentsError('Invalid format of substitution value');
+            }
+
+            requiredData[path] = null;
+        });
+
+        let promises = _.mapValues(requiredData, (value, path) => this.__vault.read(path));
+
+        return Bluebird.props(promises).then(results => {
+            requiredData = _.mapValues(requiredData, (value, path) => results[path].getData());
+
+            this.__traverse(substitutionMap, (key, val, obj) => {
+                const splitRes = val.split('#');
+                const path = splitRes[0], value = splitRes[1];
+                const res = requiredData[path][value];
+                if (res === undefined) {
+                    throw new errors.VaultError(`Can't find substitution for "${val}"`);
+                }
+
+                obj[key] = requiredData[path][value];
+            });
+
+            return assignDeep(this.__nodeConfig, substitutionMap);
+        });
+    }
+
+    /**
+     * @private
+     */
+    __getSubstitutionMap() {
+        let config_dir = this.__nodeConfig.util.initParam('NODE_CONFIG_DIR', path.join( process.cwd(), 'config') );
+        if (config_dir.indexOf('.') === 0) {
+            config_dir = path.join(process.cwd() , config_dir);
+        }
+
+        const fullFilename = path.join(config_dir, 'custom-vault-variables.js');
+
+        let fileContent;
+        try {
+            fileContent = require(fullFilename);
+        } catch {
+            throw new errors.VaultError('Config file ' + fullFilename + ' cannot be read');
+        }
+
+        if (!_.isPlainObject(fileContent)) {
+            throw new errors.VaultError('Config file ' + fullFilename + ' should return plain object');
+        }
+
+        return _.cloneDeep(fileContent);
+    }
+
+    __traverse(o, func) {
+        for (let i in o) {
+            if (!Object.hasOwn(o, i)) {
+                continue;
+            }
+
+            if (o[i] !== null && typeof(o[i]) === "object") {
+                //going one step down in the object tree!!
+                this.__traverse(o[i], func);
+            } else if (typeof o[i] === 'string') {
+                func(i, o[i], o);
+            } else {
+                throw new errors.InvalidArgumentsError('Illegal key type for substitution map');
+            }
+        }
+    }
+}
+
+module.exports = VaultNodeConfig;

package/src/auth/AuthToken.js

@@ -1,94 +1,141 @@
-'use strict';
-
-const _ = require('lodash');
-
-class AuthToken {
-
-    /**
-     *
-     * @param {string} id
-     * @param {string} accessor
-     * @param {int} createdAt - UNIX timestamp
-     * @param {int|null} expiresAt - UNIX timestamp
-     * @param {int} explicitMaxTtl - in seconds
-     * @param {int} numUses
-     * @param {boolean} isRenewable
-     */
-    constructor(
-        id,
-        accessor,
-        createdAt,
-        expiresAt,
-        explicitMaxTtl,
-        numUses,
-        isRenewable
-    ) {
-        this.__id = id;
-        this.__accessor = accessor;
-        this.__createdAt = createdAt;
-        this.__expiresAt = expiresAt;
-        this.__explicitMaxTtl = explicitMaxTtl;
-        this.__numUses = numUses;
-        this.__isRenewable = isRenewable;
-    }
-
-    static fromResponse(response) {
-        const data = response.data;
-
-        let expiresAt = null;
-        if (data.ttl !== 0) {
-            const creationTime = parseInt(data.last_renewal_time !== undefined ? data.last_renewal_time : data.creation_time, 10);
-            const networkLatency = 60;
-            const ttl = parseInt(data.ttl > networkLatency ? data.ttl - networkLatency : data.ttl);
-            expiresAt = creationTime + ttl;
-        }
-
-        return new AuthToken(
-            data.id,
-            data.accessor,
-            data.creation_time,
-            expiresAt,
-            data.explicit_max_ttl,
-            data.num_uses,
-            data.renewable !== undefined ? data.renewable : false
-        );
-    }
-
-    /**
-     * @returns {string}
-     */
-    getId() {
-        return this.__id;
-    }
-
-    getAccessor() {
-        return this.__accessor;
-    }
-
-    /**
-     * @returns {boolean}
-     */
-    isExpired() {
-        if (this.__expiresAt === null) {
-            return false;
-        }
-
-        return Math.floor(Date.now() / 1000) > this.__expiresAt;
-    }
-
-    /**
-     * @returns {boolean}
-     */
-    isRenewable() {
-        return this.__isRenewable && this.getExpiresAt() !== null;
-    }
-
-    /**
-     * @returns {int|null} UNIX timestamp
-     */
-    getExpiresAt() {
-        return this.__expiresAt;
-    }
-}
-
-module.exports = AuthToken;
+'use strict';
+
+
+class AuthToken {
+
+    /**
+     *
+     * @param {string} id
+     * @param {string} accessor
+     * @param {int} createdAt - UNIX timestamp
+     * @param {int|null} expiresAt - UNIX timestamp
+     * @param {int} explicitMaxTtl - in seconds
+     * @param {int} numUses
+     * @param {boolean} isRenewable
+     */
+    constructor(
+        id,
+        accessor,
+        createdAt,
+        expiresAt,
+        explicitMaxTtl,
+        numUses,
+        isRenewable
+    ) {
+        this.__id = id;
+        this.__accessor = accessor;
+        this.__createdAt = createdAt;
+        this.__expiresAt = expiresAt;
+        this.__explicitMaxTtl = explicitMaxTtl;
+        this.__numUses = numUses;
+        this.__isRenewable = isRenewable;
+    }
+
+    static fromResponse(response) {
+        const data = response.data;
+
+        return new AuthToken(
+            data.id,
+            data.accessor,
+            data.creation_time,
+            AuthToken.__resolveExpiresAt(data),
+            data.explicit_max_ttl,
+            data.num_uses,
+            data.renewable !== undefined ? data.renewable : false
+        );
+    }
+
+    /**
+     * Resolve the UNIX timestamp (seconds) at which the client should treat the token
+     * as expired, shifted earlier by a network-latency safety margin so renewal happens
+     * before the real expiry.
+     *
+     * Prefers Vault's authoritative `expire_time` (RFC3339), which is the documented
+     * absolute expiry. Falls back to `(last_renewal_time || creation_time) + ttl` for
+     * responses that don't carry `expire_time` — note `ttl` is the *remaining* lifetime,
+     * so that sum is only accurate when the lookup happens right after issuance/renewal.
+     *
+     * @private
+     * @param {Object} data - the `data` object of a token lookup response
+     * @returns {int|null} null when the token never expires (ttl === 0)
+     */
+    static __resolveExpiresAt(data) {
+        if (data.ttl === 0) {
+            return null;
+        }
+
+        const networkLatency = 60;
+        const margin = data.ttl > networkLatency ? networkLatency : 0;
+
+        const expireTime = AuthToken.__parseRfc3339Seconds(data.expire_time);
+        if (expireTime !== null) {
+            return expireTime - margin;
+        }
+
+        // Fallback for responses without a usable `expire_time`.
+        const creationTime = parseInt(data.last_renewal_time !== undefined ? data.last_renewal_time : data.creation_time, 10);
+        const ttl = data.ttl > networkLatency ? data.ttl - networkLatency : data.ttl;
+        return creationTime + parseInt(ttl, 10);
+    }
+
+    /**
+     * Parse an RFC3339 timestamp (as returned by Vault, up to nanosecond precision with
+     * a timezone offset) into whole UNIX seconds. Returns null for missing, empty,
+     * unparseable, or non-positive (e.g. Vault's "0001-01-01T00:00:00Z" zero value) input.
+     *
+     * @private
+     * @param {String} value
+     * @returns {int|null}
+     */
+    static __parseRfc3339Seconds(value) {
+        if (typeof value !== 'string' || value === '') {
+            return null;
+        }
+
+        const ms = Date.parse(value);
+        if (isNaN(ms)) {
+            return null;
+        }
+
+        const seconds = Math.floor(ms / 1000);
+        return seconds > 0 ? seconds : null;
+    }
+
+    /**
+     * @returns {string}
+     */
+    getId() {
+        return this.__id;
+    }
+
+    getAccessor() {
+        return this.__accessor;
+    }
+
+    /**
+     * @returns {boolean}
+     */
+    isExpired() {
+        if (this.__expiresAt === null) {
+            return false;
+        }
+
+        return Math.floor(Date.now() / 1000) > this.__expiresAt;
+    }
+
+    /**
+     * @returns {boolean}
+     */
+    isRenewable() {
+        return this.__isRenewable && this.getExpiresAt() !== null;
+    }
+
+    /**
+     * @returns {int|null} UNIX timestamp
+     */
+    getExpiresAt() {
+        return this.__expiresAt;
+    }
+}
+
+module.exports = AuthToken;

package/src/auth/VaultAppRoleAuth.js

@@ -1,40 +1,49 @@
-'use strict';
-
-const VaultBaseAuth = require('./VaultBaseAuth');
-
-class VaultAppRoleAuth extends VaultBaseAuth {
-
-    /**
-     * @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
-     * @param {Object} config
-     * @param {String} config.role_id - RoleID of the AppRole.
-     * @param {String} [config.secret_id] - required when bind_secret_id is enabled SecretID belonging to AppRole.
-     * @param {String} mount - Vault's  mount point ("approle" by default)
-     */
-    constructor(apiClient, logger, config, mount) {
-        super(apiClient, logger, mount || 'approle');
-
-        this.__roleId = config.role_id;
-        this.__secretId = config.secret_id;
-    }
-
-    _authenticate() {
-        this._log.info(
-            'making authentication request: role_id=%s',
-            this.__roleId
-        );
-        return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
-            role_id: this.__roleId,
-            secret_id: this.__secretId,
-        }).then(res => {
-            this._log.debug(
-                'receive token: %s',
-                res.auth.client_token
-            );
-            return this._getTokenEntity(res.auth.client_token);
-        });
-    }
-
-}
-
-module.exports = VaultAppRoleAuth;
+'use strict';
+
+const VaultBaseAuth = require('./VaultBaseAuth');
+
+class VaultAppRoleAuth extends VaultBaseAuth {
+
+    /**
+     * @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
+     * @param {Object} logger
+     * @param {Object} config
+     * @param {String} config.role_id - RoleID of the AppRole.
+     * @param {String} [config.secret_id] - required when bind_secret_id is enabled SecretID belonging to AppRole.
+     * @param {String} [config.namespace] - Optional. Vault namespace, sent as the X-Vault-Namespace header.
+     * @param {String} mount - Vault's  mount point ("approle" by default)
+     */
+    constructor(apiClient, logger, config, mount) {
+        super(apiClient, logger, mount || 'approle');
+
+        this.__roleId = config.role_id;
+        this.__secretId = config.secret_id;
+        this.__namespace = config.namespace;
+    }
+
+    _authenticate() {
+        this._log.info(
+            'making authentication request: role_id=%s',
+            this.__roleId
+        );
+
+        const headers = {};
+        if (this.__namespace) {
+            headers['X-Vault-Namespace'] = this.__namespace;
+        }
+
+        return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
+            role_id: this.__roleId,
+            secret_id: this.__secretId,
+        }, headers).then(res => {
+            this._log.debug(
+                'receive token: %s',
+                res.auth.client_token
+            );
+            return this._getTokenEntity(res.auth.client_token);
+        });
+    }
+
+}
+
+module.exports = VaultAppRoleAuth;