node-vault-client 2.0.0 → 2.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-vault-client",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "A Vault Client implemented in pure javascript for HashiCorp Vault. It supports variety of Auth Backends and performs lease renewal for issued auth token.",
   "repository": {
     "url": "git+https://github.com/namecheap/node-vault-client.git"
@@ -15,6 +15,7 @@
   "scripts": {
     "test": "mocha --exit \"test/**/*.test.mjs\"",
     "test:unit": "mocha \"test/*.test.mjs\"",
+    "test:e2e": "mocha --exit \"test/e2e/**/*.test.mjs\"",
     "coverage": "c8 npm run test:unit",
     "lint": "eslint src/",
     "version": "git add -A ."
@@ -34,13 +35,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@aws-sdk/credential-providers": "^3.382.0",
-    "assign-deep": "^1.0.1",
     "aws4": "^1.8.0",
-    "bluebird": "^3.7.0",
-    "lodash": "^4.17.15",
-    "long-timeout": "^0.1.1",
-    "pretty-ms": "^2.1.0",
-    "url-join": "^2.0.5"
+    "lodash": "^4.17.21",
+    "long-timeout": "^0.1.1"
   },
   "peerDependencies": {
     "config": ">=1 <4"
@@ -55,8 +52,8 @@
     "c8": "^11.0.0",
     "chai": "^6.0.0",
     "deep-freeze": "^0.0.1",
-    "eslint": "^9.0.0",
-    "globals": "^16.0.0",
+    "eslint": "^9.39.4",
+    "globals": "^17.6.0",
     "mocha": "^11.7.6",
     "sinon": "^22.0.0",
     "sinon-chai": "^4.0.0"

package/src/VaultApiClient.js

@@ -1,8 +1,27 @@
 'use strict';
 
-const urljoin = require('url-join');
 const _ = require('lodash');
 
+/**
+ * Joins URL segments with single slashes while preserving the leading
+ * protocol (e.g. "https://"). Replaces the former `url-join` dependency.
+ */
+function joinUrl(...parts) {
+    return parts
+        .map((part, i) => {
+            let segment = String(part);
+            if (i > 0) {
+                segment = segment.replace(/^\/+/, '');
+            }
+            if (i < parts.length - 1) {
+                segment = segment.replace(/\/+$/, '');
+            }
+            return segment;
+        })
+        .filter((segment) => segment.length > 0)
+        .join('/');
+}
+
 class VaultApiClient {
 
     /**
@@ -35,7 +54,7 @@ class VaultApiClient {
         data = data === undefined ? null : data;
         headers = headers === undefined ? {} : headers;
 
-        const uri = urljoin(this.__config.url, this.__config.apiVersion, path);
+        const uri = joinUrl(this.__config.url, this.__config.apiVersion, path);
 
         const requestOptions = this.__config.requestOptions || {};
 
@@ -80,10 +99,12 @@ class VaultApiClient {
                     throw error;
                 }
 
-                this._logger.debug('%s %s response body:\n%s',
+                // Do not log the response body: Vault responses carry secret
+                // material (auth tokens, secret reads). Log status only.
+                this._logger.debug('%s %s -> %d',
                     method,
                     uri,
-                    JSON.stringify(body, null, ' ')
+                    response.status
                 );
                 return body;
             });

package/src/VaultNodeConfig.js

@@ -1,9 +1,7 @@
 'use strict';
 
 const path = require('path');
-const Bluebird = require('bluebird');
 const _ = require('lodash');
-const assignDeep = require('assign-deep');
 
 const errors = require('./errors');
 
@@ -29,45 +27,54 @@ class VaultNodeConfig {
         let requiredData = {};
 
         this.__traverse(substitutionMap, (key, val) => {
-            const splitRes = val.split('#');
-            const path = splitRes[0], value = splitRes[1];
-            if (path === undefined || value === undefined) {
-                throw new errors.InvalidArgumentsError('Invalid format of substitution value');
-            }
-
-            requiredData[path] = null;
+            const { vaultPath } = this.__parseSubstitutionValue(val);
+            requiredData[vaultPath] = null;
         });
 
-        let promises = _.mapValues(requiredData, (value, path) => this.__vault.read(path));
+        const vaultPaths = Object.keys(requiredData);
 
-        return Bluebird.props(promises).then(results => {
-            requiredData = _.mapValues(requiredData, (value, path) => results[path].getData());
+        return Promise.all(vaultPaths.map((vaultPath) => this.__vault.read(vaultPath))).then((leases) => {
+            const results = _.zipObject(vaultPaths, leases);
+            requiredData = _.mapValues(requiredData, (value, vaultPath) => results[vaultPath].getData());
 
             this.__traverse(substitutionMap, (key, val, obj) => {
-                const splitRes = val.split('#');
-                const path = splitRes[0], value = splitRes[1];
-                const res = requiredData[path][value];
+                const { vaultPath, value } = this.__parseSubstitutionValue(val);
+                const res = requiredData[vaultPath][value];
                 if (res === undefined) {
                     throw new errors.VaultError(`Can't find substitution for "${val}"`);
                 }
 
-                obj[key] = requiredData[path][value];
+                obj[key] = requiredData[vaultPath][value];
             });
 
-            return assignDeep(this.__nodeConfig, substitutionMap);
+            return _.merge(this.__nodeConfig, substitutionMap);
         });
     }
 
+    /**
+     * Splits a substitution value of the form "<vaultPath>#<value>".
+     *
+     * @private
+     */
+    __parseSubstitutionValue(val) {
+        const [vaultPath, value] = val.split('#');
+        if (!vaultPath || !value) {
+            throw new errors.InvalidArgumentsError('Invalid format of substitution value');
+        }
+
+        return { vaultPath, value };
+    }
+
     /**
      * @private
      */
     __getSubstitutionMap() {
-        let config_dir = this.__nodeConfig.util.initParam('NODE_CONFIG_DIR', path.join( process.cwd(), 'config') );
-        if (config_dir.indexOf('.') === 0) {
-            config_dir = path.join(process.cwd() , config_dir);
+        let configDir = this.__nodeConfig.util.initParam('NODE_CONFIG_DIR', path.join(process.cwd(), 'config'));
+        if (configDir.indexOf('.') === 0) {
+            configDir = path.join(process.cwd(), configDir);
         }
 
-        const fullFilename = path.join(config_dir, 'custom-vault-variables.js');
+        const fullFilename = path.join(configDir, 'custom-vault-variables.js');
 
         let fileContent;
         try {
@@ -84,12 +91,8 @@ class VaultNodeConfig {
     }
 
     __traverse(o, func) {
-        for (let i in o) {
-            if (!Object.hasOwn(o, i)) {
-                continue;
-            }
-
-            if (o[i] !== null && typeof(o[i]) === "object") {
+        for (const i of Object.keys(o)) {
+            if (o[i] !== null && typeof o[i] === 'object') {
                 //going one step down in the object tree!!
                 this.__traverse(o[i], func);
             } else if (typeof o[i] === 'string') {

package/src/auth/VaultBaseAuth.js

@@ -1,10 +1,26 @@
 'use strict';
 
 const lt = require('long-timeout');
-const prettyMs = require('pretty-ms');
 const AuthToken = require('./AuthToken');
 const errors = require('../errors');
 
+/**
+ * Formats a millisecond duration as a short human-readable string
+ * (e.g. "1s", "2m 5s", "1h 3m"). Replaces the former `pretty-ms` dependency.
+ */
+function humanizeMs(ms) {
+    const totalSeconds = Math.round(ms / 1000);
+    if (totalSeconds < 60) {
+        return `${totalSeconds}s`;
+    }
+    const totalMinutes = Math.floor(totalSeconds / 60);
+    if (totalMinutes < 60) {
+        return `${totalMinutes}m ${totalSeconds % 60}s`;
+    }
+    const hours = Math.floor(totalMinutes / 60);
+    return `${hours}h ${totalMinutes % 60}m`;
+}
+
 class VaultBaseAuth {
 
     /**
@@ -135,7 +151,7 @@ class VaultBaseAuth {
 
         this._log.debug(
             'sleeping for %s',
-            prettyMs(timer)
+            humanizeMs(timer)
         );
     }
 

package/src/auth/VaultKubernetesAuth.js

@@ -28,18 +28,15 @@ class VaultKubernetesAuth extends VaultBaseAuth {
 
         const k8sJwtToken = fs.readFileSync(this.__tokenPath).toString();
         this._log.debug(
-            'receive K8s token: %s',
-            k8sJwtToken
+            'read K8s service-account JWT from "%s" (%d bytes)',
+            this.__tokenPath, k8sJwtToken.length
         );
 
         return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
             role: this.__role,
             jwt: k8sJwtToken,
         }).then((res) => {
-            this._log.debug(
-                'receive token: %s',
-                res.auth.client_token
-            );
+            this._log.debug('received Vault client token from Kubernetes login');
 
             return this._getTokenEntity(res.auth.client_token);
         });