node-vault-client 2.1.0 → 2.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-vault-client",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "A Vault Client implemented in pure javascript for HashiCorp Vault. It supports variety of Auth Backends and performs lease renewal for issued auth token.",
   "repository": {
     "url": "git+https://github.com/namecheap/node-vault-client.git"
@@ -40,30 +40,30 @@
   "author": "Namecheap <opensource@namecheap.com>",
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/credential-providers": "^3.382.0",
-    "aws4": "^1.8.0",
+    "@aws-sdk/credential-providers": "^3.1100.0",
+    "aws4": "^1.13.2",
     "long-timeout": "^0.1.1"
   },
   "peerDependencies": {
     "config": ">=1 <4"
   },
   "overrides": {
-    "serialize-javascript": "^7.0.5",
+    "serialize-javascript": "^7.0.7",
     "glob": "^13.0.0",
     "diff": "^8.0.3",
-    "brace-expansion": "^5.0.8",
+    "brace-expansion": "^5.0.9",
     "js-yaml": "^4.3.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.0.0",
-    "c8": "^11.0.0",
-    "chai": "^6.0.0",
+    "@eslint/js": "^9.39.5",
+    "c8": "^10.1.3",
+    "chai": "^6.2.2",
     "deep-freeze": "^0.0.1",
-    "eslint": "^9.39.4",
-    "globals": "^17.6.0",
-    "lodash": "^4.17.21",
+    "eslint": "^9.39.5",
+    "globals": "^17.8.0",
+    "lodash": "^4.18.1",
     "mocha": "^11.7.6",
-    "sinon": "^22.0.0",
-    "sinon-chai": "^4.0.0"
+    "sinon": "^22.1.0",
+    "sinon-chai": "^4.0.1"
   }
 }

package/src/auth/VaultBaseAuth.js

@@ -38,8 +38,17 @@ class VaultBaseAuth {
         this._log = logger;
         this._mount = mount;
 
-        /** @type AuthToken */
+        /**
+         * The currently held token, or `null` when none has been obtained yet.
+         * @type {AuthToken|null}
+         */
         this.__authToken = null;
+        /**
+         * The in-flight login, or `null` when no login is running. Concurrent
+         * `getAuthToken()` callers await this same promise (single-flight).
+         * @type {Promise<AuthToken>|null}
+         */
+        this.__pendingLogin = null;
         this.__refreshTimeout = null;
     }
 
@@ -52,7 +61,12 @@ class VaultBaseAuth {
     }
 
     getAuthToken() {
-        const tokenExpired = this.__authToken instanceof AuthToken && this.__authToken.isExpired();
+        if (this.__pendingLogin !== null) {
+            this._log.debug('login already in flight');
+            return this.__pendingLogin;
+        }
+
+        const tokenExpired = this.__authToken !== null && this.__authToken.isExpired();
 
         if (tokenExpired && !this._reauthenticationAllowed()) {
             return Promise.reject(new errors.AuthTokenExpiredError(
@@ -60,32 +74,34 @@ class VaultBaseAuth {
             ));
         }
 
-        if (this.__authToken === null || tokenExpired) {
-            this._log.info('getting auth token (mount=%s)', this._mount);
+        if (this.__authToken !== null && !tokenExpired) {
+            this._log.debug('token already exist');
+            return Promise.resolve(this.__authToken);
+        }
 
-            const tokenPromise = this._authenticate().then(authToken => {
-                this.__authToken = authToken;
+        this._log.info('getting auth token (mount=%s)', this._mount);
 
-                if (this.__authToken.isRenewable()) {
-                    this._log.debug(
-                        'setting refresh timer for token (accessor=%s)',
-                        authToken.getAccessor()
-                    );
-                    this.__setupTokenRefreshTimer(this.__authToken);
-                }
-
-                return this.__authToken;
-            }).catch(e => {
-                this.__authToken = null;
-                throw e;
-            });
+        const pendingLogin = this._authenticate().then(authToken => {
+            this.__pendingLogin = null;
+            this.__authToken = authToken;
 
-            this.__authToken = tokenPromise;
-            return tokenPromise;
-        }
+            if (authToken.isRenewable()) {
+                this._log.debug(
+                    'setting refresh timer for token (accessor=%s)',
+                    authToken.getAccessor()
+                );
+                this.__setupTokenRefreshTimer(authToken);
+            }
+
+            return authToken;
+        }).catch(e => {
+            this.__pendingLogin = null;
+            this.__authToken = null;
+            throw e;
+        });
 
-        this._log.debug('token already exist');
-        return Promise.resolve(this.__authToken);
+        this.__pendingLogin = pendingLogin;
+        return pendingLogin;
     }
 
     /**