node-vault-client 2.1.1 → 2.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-vault-client",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "A Vault Client implemented in pure javascript for HashiCorp Vault. It supports variety of Auth Backends and performs lease renewal for issued auth token.",
   "repository": {
     "url": "git+https://github.com/namecheap/node-vault-client.git"

package/src/auth/VaultBaseAuth.js

@@ -38,8 +38,17 @@ class VaultBaseAuth {
         this._log = logger;
         this._mount = mount;
 
-        /** @type AuthToken */
+        /**
+         * The currently held token, or `null` when none has been obtained yet.
+         * @type {AuthToken|null}
+         */
         this.__authToken = null;
+        /**
+         * The in-flight login, or `null` when no login is running. Concurrent
+         * `getAuthToken()` callers await this same promise (single-flight).
+         * @type {Promise<AuthToken>|null}
+         */
+        this.__pendingLogin = null;
         this.__refreshTimeout = null;
     }
 
@@ -52,7 +61,12 @@ class VaultBaseAuth {
     }
 
     getAuthToken() {
-        const tokenExpired = this.__authToken instanceof AuthToken && this.__authToken.isExpired();
+        if (this.__pendingLogin !== null) {
+            this._log.debug('login already in flight');
+            return this.__pendingLogin;
+        }
+
+        const tokenExpired = this.__authToken !== null && this.__authToken.isExpired();
 
         if (tokenExpired && !this._reauthenticationAllowed()) {
             return Promise.reject(new errors.AuthTokenExpiredError(
@@ -60,32 +74,34 @@ class VaultBaseAuth {
             ));
         }
 
-        if (this.__authToken === null || tokenExpired) {
-            this._log.info('getting auth token (mount=%s)', this._mount);
+        if (this.__authToken !== null && !tokenExpired) {
+            this._log.debug('token already exist');
+            return Promise.resolve(this.__authToken);
+        }
 
-            const tokenPromise = this._authenticate().then(authToken => {
-                this.__authToken = authToken;
+        this._log.info('getting auth token (mount=%s)', this._mount);
 
-                if (this.__authToken.isRenewable()) {
-                    this._log.debug(
-                        'setting refresh timer for token (accessor=%s)',
-                        authToken.getAccessor()
-                    );
-                    this.__setupTokenRefreshTimer(this.__authToken);
-                }
-
-                return this.__authToken;
-            }).catch(e => {
-                this.__authToken = null;
-                throw e;
-            });
+        const pendingLogin = this._authenticate().then(authToken => {
+            this.__pendingLogin = null;
+            this.__authToken = authToken;
 
-            this.__authToken = tokenPromise;
-            return tokenPromise;
-        }
+            if (authToken.isRenewable()) {
+                this._log.debug(
+                    'setting refresh timer for token (accessor=%s)',
+                    authToken.getAccessor()
+                );
+                this.__setupTokenRefreshTimer(authToken);
+            }
+
+            return authToken;
+        }).catch(e => {
+            this.__pendingLogin = null;
+            this.__authToken = null;
+            throw e;
+        });
 
-        this._log.debug('token already exist');
-        return Promise.resolve(this.__authToken);
+        this.__pendingLogin = pendingLogin;
+        return pendingLogin;
     }
 
     /**