node-vault-client 2.0.0 → 2.1.0

package/src/auth/VaultBaseAuth.js

@@ -1,10 +1,30 @@
 'use strict';
 
+// `long-timeout` is unmaintained (last release 2016) but tiny (~50 LOC), dependency-free and
+// stable: it only works around setTimeout's 32-bit signed-int limit (~24.8 days), which real
+// Vault token TTLs can exceed. Audited and deliberately kept as-is (see issue #111); revisit
+// only if a maintained alternative or a Node.js core fix appears.
 const lt = require('long-timeout');
-const prettyMs = require('pretty-ms');
 const AuthToken = require('./AuthToken');
 const errors = require('../errors');
 
+/**
+ * Formats a millisecond duration as a short human-readable string
+ * (e.g. "1s", "2m 5s", "1h 3m"). Replaces the former `pretty-ms` dependency.
+ */
+function humanizeMs(ms) {
+    const totalSeconds = Math.round(ms / 1000);
+    if (totalSeconds < 60) {
+        return `${totalSeconds}s`;
+    }
+    const totalMinutes = Math.floor(totalSeconds / 60);
+    if (totalMinutes < 60) {
+        return `${totalMinutes}m ${totalSeconds % 60}s`;
+    }
+    const hours = Math.floor(totalMinutes / 60);
+    return `${hours}h ${totalMinutes % 60}m`;
+}
+
 class VaultBaseAuth {
 
     /**
@@ -48,8 +68,8 @@ class VaultBaseAuth {
 
                 if (this.__authToken.isRenewable()) {
                     this._log.debug(
-                        'setting refresh timer for token %s',
-                        authToken.getId()
+                        'setting refresh timer for token (accessor=%s)',
+                        authToken.getAccessor()
                     );
                     this.__setupTokenRefreshTimer(this.__authToken);
                 }
@@ -135,7 +155,7 @@ class VaultBaseAuth {
 
         this._log.debug(
             'sleeping for %s',
-            prettyMs(timer)
+            humanizeMs(timer)
         );
     }
 

package/src/auth/VaultIAMAuth.js

@@ -3,7 +3,6 @@
 const VaultBaseAuth = require('./VaultBaseAuth');
 const aws4 = require('aws4');
 const { fromNodeProviderChain } = require('@aws-sdk/credential-providers');
-const _ = require('lodash');
 const errors = require('../errors');
 
 /**
@@ -49,7 +48,8 @@ class VaultIAMAuth extends VaultBaseAuth {
      * @typedef {Object} VaultIAMAuthConfig
      * @property {String} role - Role name of the auth/{mount}/role/{name} backend.
      * @property {AWSCredentials} [credentials] - Optional. AWS Credentials
-     * @property {String} [namespace] - Optional. Vault namespace, sent as the X-Vault-Namespace header.
+     * @property {String} [namespace] - Optional. Vault namespace. Applied as the X-Vault-Namespace
+     *   header to every request by {@link VaultApiClient}; see {@link VaultClient#constructor}.
      * @property {String} [iam_server_id_header_value] - Optional. Header's value X-Vault-AWS-IAM-Server-ID.
      * @property {String} [region] - Optional. AWS region used to sign the STS GetCallerIdentity
      *   request. When set, the request is signed against the regional STS endpoint
@@ -65,9 +65,12 @@ class VaultIAMAuth extends VaultBaseAuth {
     constructor(api, logger, config, mount) {
         super(api, logger, mount || 'aws');
 
+        if (!config || !config.role) {
+            throw new errors.InvalidArgumentsError('"role" should be provided for VaultIAMAuth');
+        }
+
         this.__role = config.role;
         this.__iam_server_id_header_value = config.iam_server_id_header_value;
-        this.__namespace = config.namespace;
         this.__region = config.region;
 
 
@@ -86,29 +89,19 @@ class VaultIAMAuth extends VaultBaseAuth {
             this.__role
         );
 
-        var headers = {};
-
-        if (this.__namespace) {
-            headers = {
-                'X-Vault-Namespace': this.__namespace,
-            }
-        }
-
-
         return Promise.resolve()
             .then(() => this.__getCredentials())
             .then((credentials) => {
                 return this.__apiClient.makeRequest(
                     'POST',
                     `/auth/${this._mount}/login`,
-                    this.__getVaultAuthRequestBody(this.__getStsRequest(credentials)),
-                    headers
+                    this.__getVaultAuthRequestBody(this.__getStsRequest(credentials))
                 );
             })
             .then((response) => {
                 this._log.debug(
-                    'receive token: %s',
-                    response.auth.client_token
+                    'received token (accessor=%s)',
+                    response.auth.accessor
                 );
                 return this._getTokenEntity(response.auth.client_token)
             })
@@ -194,7 +187,9 @@ class VaultIAMAuth extends VaultBaseAuth {
      * @private
      */
     __headersLikeGolangStyle(headers) {
-        return _.mapValues(headers, (value) => [`${value}`]);
+        return Object.fromEntries(
+            Object.entries(headers).map(([key, value]) => [key, [`${value}`]])
+        );
     }
 
     _validateCredentialsConfig(credentials) {

package/src/auth/VaultKubernetesAuth.js

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const VaultBaseAuth = require('./VaultBaseAuth');
+const errors = require('../errors');
 
 class VaultKubernetesAuth extends VaultBaseAuth {
     /**
@@ -8,11 +9,17 @@ class VaultKubernetesAuth extends VaultBaseAuth {
      * @param {Object} config
      * @param {String} config.role - Role configured in Vault Kubernetes Auth backend under which we want to issue Vault token.
      * @param {String} [config.tokenPath] - Path to the Kube JWT token. If omitted - default will be used.
+     * @param {String} [config.namespace] - Optional. Vault namespace. Applied as the X-Vault-Namespace
+     *   header to every request by {@link VaultApiClient}; see {@link VaultClient#constructor}.
      * @param {String} mount - Vault's  mount point ("kubernetes" by default)
      */
     constructor(apiClient, logger, config, mount) {
         super(apiClient, logger, mount || 'kubernetes');
 
+        if (!config || !config.role) {
+            throw new errors.InvalidArgumentsError('"role" should be provided for VaultKubernetesAuth');
+        }
+
         this.__role = config.role;
         this.__tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token';
         if (config.tokenPath !== undefined) {
@@ -28,18 +35,15 @@ class VaultKubernetesAuth extends VaultBaseAuth {
 
         const k8sJwtToken = fs.readFileSync(this.__tokenPath).toString();
         this._log.debug(
-            'receive K8s token: %s',
-            k8sJwtToken
+            'read K8s service-account JWT from "%s" (%d bytes)',
+            this.__tokenPath, k8sJwtToken.length
         );
 
         return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
             role: this.__role,
             jwt: k8sJwtToken,
         }).then((res) => {
-            this._log.debug(
-                'receive token: %s',
-                res.auth.client_token
-            );
+            this._log.debug('received Vault client token from Kubernetes login');
 
             return this._getTokenEntity(res.auth.client_token);
         });

package/src/auth/VaultTokenAuth.js

@@ -15,7 +15,7 @@ class VaultTokenAuth extends VaultBaseAuth {
     constructor(apiClient, logger, config, mount) {
         super(apiClient, logger, mount || 'token');
 
-        if (!config.token) {
+        if (!config || !config.token) {
             throw new errors.InvalidArgumentsError('Auth token should be provided for VaultTokenAuth');
         }
 

package/src/errors.js

@@ -1,8 +1,13 @@
 'use strict';
 
 class VaultError extends Error {
-    constructor(message) {
-        super(message);
+    /**
+     * @param {string} message
+     * @param {{cause?: *}} [options] - standard `Error` options. Pass `{ cause }` to chain the
+     *   underlying error (e.g. a wrapped HTTP/transport failure); it is exposed as `error.cause`.
+     */
+    constructor(message, options) {
+        super(message, options);
         this.name = this.constructor.name;
         this.message = message;
 
@@ -12,10 +17,35 @@ class VaultError extends Error {
 class InvalidArgumentsError extends VaultError {}
 class InvalidAWSCredentialsError extends InvalidArgumentsError {}
 class AuthTokenExpiredError extends VaultError {}
+class UnsupportedOperationError extends VaultError {}
+
+/**
+ * A non-2xx HTTP response from the Vault server.
+ *
+ * Preserves the legacy plain-`Error` shape previously thrown by
+ * {@link VaultApiClient#makeRequest} — the message stays `"<status> - <raw body text>"` and the
+ * `statusCode`/`error` properties keep their meaning — while letting callers
+ * `instanceof`-check HTTP failures against the `VaultError` hierarchy.
+ */
+class VaultHttpError extends VaultError {
+    /**
+     * @param {number} statusCode - HTTP status code of the response.
+     * @param {string} text - raw response body text, used in the message.
+     * @param {*} [body] - parsed JSON body when the response was valid JSON, the raw text
+     *   otherwise, or `undefined` for an empty body. Exposed as `error.error`.
+     */
+    constructor(statusCode, text, body) {
+        super(`${statusCode} - ${text}`);
+        this.statusCode = statusCode;
+        this.error = body;
+    }
+}
 
 module.exports = {
     VaultError,
     InvalidArgumentsError,
     InvalidAWSCredentialsError,
     AuthTokenExpiredError,
+    UnsupportedOperationError,
+    VaultHttpError,
 };

package/src/kvTransform.js

@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * Pure KV path-rewriting and response-normalizing helpers.
+ * No I/O; fully testable in isolation.
+ *
+ * rewritePath(version, op, mount, logicalPath) -> apiPath
+ * normalizeResponse(version, op, body)         -> normalized body
+ */
+
+// Map of op -> v2 path segment inserted between mount and logical path.
+const V2_SEGMENT = {
+    read:            'data',
+    write:           'data',
+    delete:          'data',
+    update:          'data',
+    list:            'metadata',
+    readMetadata:    'metadata',
+    deleteMetadata:  'metadata',
+    deleteVersions:  'delete',
+    undeleteVersions:'undelete',
+    destroyVersions: 'destroy',
+};
+
+/**
+ * Rewrite a logical path to the correct API path for the given engine version.
+ *
+ * @param {number} version   - Engine version (2 = KV v2; anything else = passthrough)
+ * @param {string} op        - Operation name (read, write, list, delete, update, …)
+ * @param {string} mount     - Mount point (e.g. "secret" or "secret/")
+ * @param {string} logicalPath - Path relative to the mount (e.g. "team/svc")
+ * @returns {string}
+ */
+function rewritePath(version, op, mount, logicalPath) {
+    // Normalise trailing slash on mount
+    const m = mount.replace(/\/+$/, '');
+
+    if (version !== 2) {
+        // v1 / non-kv: simple concatenation
+        return logicalPath ? `${m}/${logicalPath}` : m;
+    }
+
+    const segment = V2_SEGMENT[op] || 'data';
+    return `${m}/${segment}/${logicalPath}`;
+}
+
+/**
+ * Normalise a Vault API response body for the given engine version and operation.
+ *
+ * For v1 / non-kv the body is always returned as-is.
+ * For v2:
+ *  - read:         body.data is replaced with body.data.data; body.metadata is set to body.data.metadata
+ *  - readMetadata: body.data is replaced with the original body.data (unwrapped one level)
+ *  - write/delete/update/…: body returned as-is
+ *
+ * @param {number} version
+ * @param {string} op
+ * @param {*}      body
+ * @returns {*}
+ */
+function normalizeResponse(version, op, body) {
+    if (version !== 2) {
+        return body;
+    }
+
+    if (op === 'read') {
+        if (!body || !body.data) {
+            return body;
+        }
+        // Promote inner data/metadata to top-level response fields
+        const result = Object.assign({}, body);
+        result.metadata = body.data.metadata;
+        result.data = body.data.data;
+        return result;
+    }
+
+    if (op === 'readMetadata') {
+        if (!body || !body.data) {
+            return body;
+        }
+        const result = Object.assign({}, body);
+        result.data = body.data;
+        return result;
+    }
+
+    // All other v2 ops (write, list, delete, update, deleteVersions, …): passthrough
+    return body;
+}
+
+module.exports = { rewritePath, normalizeResponse };