node-vault-client 3.1.0 → 3.3.0

package/src/VaultClient.js

@@ -16,7 +16,13 @@ const safeMessage = require('./safeMessage');
 const { trimTrailingSlashes } = require('./slashes');
 
 const noop = () => {};
-const vaultInstances = {};
+// Named instances. A Map, so a name such as "toString" or "constructor" is not found on
+// Object.prototype; keyed exactly as an object property would be, so boot(1) and get('1') still
+// meet and an object that converts to a symbol is keyed by that symbol.
+const vaultInstances = new Map();
+const instanceKey = (name) => Reflect.ownKeys({ [name]: undefined })[0];
+// clear(name) with a non-string name warns once per process (#239); see VaultClient.clear().
+let warnedClearNonString = false;
 
 // Functions, and objects that are not plain data (an undici dispatcher, a logger class
 // instance), compare by identity. Their own enumerable keys say nothing about what they do:
@@ -187,6 +193,32 @@ function assertSafeKvPath(path, allowTrailingSlash) {
     return trimmed;
 }
 
+/**
+ * clear() with a name that is not a string closes every instance, which is rarely what the
+ * caller meant (#239): `clear(42)`, or `clear` passed as a callback that receives an exit code
+ * or a resolved value. The behaviour stays as it was; this makes it visible, once per process.
+ * It names only the argument's type, never its value, which could be anything (#239).
+ * Node delivers warnings on the next tick, so one emitted from an 'exit' listener is never shown;
+ * --no-deprecation silences it, as for any DeprecationWarning.
+ * @param {*} name
+ * @returns {void}
+ * @private
+ */
+function warnClearNonString(name) {
+    if (warnedClearNonString) {
+        return;
+    }
+    warnedClearNonString = true;
+    const type = typeof name;
+    const what = name === null ? 'null' : (type === 'object' ? 'an object' : `a ${type}`);
+    process.emitWarning(
+        `VaultClient.clear() was called with ${what} ` +
+        'instead of a string name, which clears every instance not named by a symbol, as it always ' +
+        'has. Call clear() with no argument to clear them all, or pass the string name of one instance.',
+        { type: 'DeprecationWarning', code: 'NVC_DEP_CLEAR_NON_STRING' }
+    );
+}
+
 class VaultClient {
 
     /**
@@ -194,10 +226,12 @@ class VaultClient {
      *
      * @param {Object} options
      * @param {Object} options.api
-     * @param {String} options.api.url - the url of the vault server
+     * @param {String} options.api.url - the url of the vault server. Plain `http://` to a host
+     *      other than this machine logs a warning; see "Plain `http://` api.url" in the README
      * @param {String} [options.api.apiVersion='v1']
      * @param {Object} [options.api.requestOptions] - extra options merged into every HTTP
      *      request (e.g. an undici `dispatcher` for a proxy/SOCKS agent or custom TLS/CA trust).
+     *      Redirects are followed only within the origin of `api.url` unless it sets `redirect`.
      *      See {@link VaultApiClient#constructor}.
      * @param {number} [options.api.timeout=120000] - milliseconds a request may take, response
      *      headers, body and redirects included, before it rejects with RequestTimeoutError.
@@ -220,6 +254,10 @@ class VaultClient {
      * @param {number} [options.auth.renewalIncrement] - Seconds of extra TTL to request on each
      *      renewal, sent as `increment` to `auth/token/renew-self`. Vault caps it at the token's
      *      max TTL. Omitted by default, which lets Vault apply the token's own period.
+     * @param {boolean} [options.auth.revokeOnClose=false] - Set `true` to revoke the held token
+     *      (`auth/token/revoke-self`) when {@link VaultClient#close} runs. The token the
+     *      `token` backend was configured with is revoked too, so only enable it when that
+     *      token is not shared with anything else.
      * @param {Object|false} options.logger - Logger that supports "error", "info", "warn", "trace", "debug" methods. Uses `console` by default. Pass `false` to disable logging.
      */
     constructor(options) {
@@ -254,6 +292,13 @@ class VaultClient {
         // `namespace` to `api.namespace`.
         this.__auth.configureRenewal(options.auth);
 
+        if (options.auth && options.auth.revokeOnClose === true && options.auth.type === 'token') {
+            this.__log.warn(
+                'auth.revokeOnClose revokes the token from the configuration itself on close(); ' +
+                'enable it only when that token is not shared with anything else'
+            );
+        }
+
         // KV v2 support
         const kvOpts = (options.api && options.api.kv) || {};
         const autoDetect = kvOpts.autoDetect === true;
@@ -304,9 +349,10 @@ class VaultClient {
             throw new errors.InvalidArgumentsError('Options should be provided');
         }
 
-        let instance = vaultInstances[name];
+        let instance = vaultInstances.get(instanceKey(name));
         if (instance === undefined) {
-            vaultInstances[name] = instance = new VaultClient(options);
+            instance = new VaultClient(options);
+            vaultInstances.set(instanceKey(name), instance);
             instance.__bootDigests = optionsDigests(options);
             instance.__bootWarned = new Set();
             return instance;
@@ -338,7 +384,7 @@ class VaultClient {
      * @return {VaultClient}
      */
     static get(name) {
-        let instance = vaultInstances[name];
+        let instance = vaultInstances.get(instanceKey(name));
 
         if (instance === undefined) {
             throw new errors.InvalidArgumentsError('Invalid instance name');
@@ -352,22 +398,33 @@ class VaultClient {
      *
      * If no name passed all named instances will be cleared.
      *
+     * Only a string names one instance. Any other argument (a number, `null`, an object) clears
+     * every instance, as it always has, and emits a one-time `DeprecationWarning`
+     * (`NVC_DEP_CLEAR_NON_STRING`): call `clear()` with no argument to clear them all.
+     *
      * @param {String} [name] - Vault instance name, all instances will be cleared if no name were passed
      */
     static clear(name) {
         if (typeof name === 'string') {
-            const instance = vaultInstances[name];
+            const instance = vaultInstances.get(name);
             if (instance !== undefined) {
                 instance.close();
-                delete vaultInstances[name];
+                vaultInstances.delete(name);
             }
-        } else {
-            for (let k in vaultInstances) {
-                if (Object.hasOwn(vaultInstances, k)) {
-                    vaultInstances[k].close();
-                    delete vaultInstances[k];
-                }
+            return;
+        }
+        if (name !== undefined) {
+            warnClearNonString(name);
+        }
+        for (const [key, instance] of vaultInstances) {
+            // Kept for compatibility: the object this replaced was walked with for...in,
+            // which skips symbol keys, so a symbol-named instance has always stayed
+            // registered, with its renewal timer, through clear(), and callers may rely on it.
+            if (typeof key === 'symbol') {
+                continue;
             }
+            instance.close();
+            vaultInstances.delete(key);
         }
     }
 
@@ -378,14 +435,34 @@ class VaultClient {
      * alive for renewable tokens. Call this once you are done with the client so a
      * short-lived script can exit on its own. Safe to call when no timer is armed and
      * safe to call multiple times. After calling `close()` the client may still be used;
-     * the next operation that fetches a renewable token will arm a new refresh timer.
+     * the next operation that fetches a renewable token will arm a new refresh timer. A
+     * login already in flight when `close()` runs still resolves, but arms no timer, and
+     * neither does a call that joins that login after `close()`.
+     *
+     * With `auth.revokeOnClose: true` the held token is also revoked on the Vault server
+     * (`auth/token/revoke-self`): the one held now, or the one a login still in flight is
+     * about to produce. The revocation request keeps the event loop open until it lands, so
+     * a short-lived script that ignores the return value still completes it.
      *
-     * @returns {void}
+     * @returns {Promise<void>|null|undefined} `null` (or `undefined` for an auth provider
+     *      without revocation support) when there is nothing to revoke, otherwise a
+     *      promise for the revocation. It never rejects: a failed revocation is logged and
+     *      the token is left live on the Vault server.
      */
     close() {
+        if (this.__auth && typeof this.__auth.__markClosed === 'function') {
+            // Directly as well: a subclass may override cancelTokenRefresh() without super.
+            this.__auth.__markClosed();
+        }
         if (this.__auth && typeof this.__auth.cancelTokenRefresh === 'function') {
             this.__auth.cancelTokenRefresh();
         }
+        if (this.__auth && typeof this.__auth.revokeSelfOnClose === 'function') {
+            // null unless auth.revokeOnClose started a revocation. Fire-and-forget when
+            // ignored (clear() does that): the request holds the event loop open until it
+            // lands. Returned so a caller that wants certainty can await it.
+            return this.__auth.revokeSelfOnClose();
+        }
     }
 
     /**
@@ -468,11 +545,39 @@ class VaultClient {
      * @private
      */
     __detectMount(path) {
-        return this.__auth.getAuthToken()
-            .then((token) => {
-                const detectPath = `sys/internal/ui/mounts/${path}`;
-                return this.__api.makeRequest('GET', detectPath, null, this.getHeaders(token));
+        return this.__withAuthToken((token) => {
+            const detectPath = `sys/internal/ui/mounts/${path}`;
+            return this.__api.makeRequest('GET', detectPath, null, this.getHeaders(token));
+        });
+    }
+
+    /**
+     * Calls `send` with the current auth token. When Vault answers 403 and the token turns out
+     * to be one Vault no longer accepts (revoked server-side), logs in again and calls `send`
+     * once more; see {@link VaultBaseAuth#checkRejectedToken}. A policy denial and a 403 under
+     * `token` auth surface that 403; otherwise the retry's own result or error is returned.
+     *
+     * @param {function(AuthToken): Promise<*>} send
+     * @returns {Promise<*>}
+     * @private
+     */
+    __withAuthToken(send) {
+        return this.__auth.getAuthToken().then((token) => send(token).catch((err) => {
+            if (!(err instanceof errors.VaultHttpError) || err.statusCode !== 403
+                    || typeof this.__auth.checkRejectedToken !== 'function') {
+                throw err;
+            }
+            return this.__auth.checkRejectedToken(token).then((retry) => {
+                if (!retry) {
+                    throw err;
+                }
+                // What the retry got, success or failure, is the request's outcome now: a login
+                // that fails, a 404 or a timeout says more than the 403 of a token already gone.
+                return this.__auth.getAuthToken().then(send);
+            }, () => {
+                throw err;
             });
+        }));
     }
 
     // -------------------------------------------------------------------------
@@ -517,50 +622,49 @@ class VaultClient {
             }
         }
 
-        return this.__auth.getAuthToken()
-            .then((token) => {
-                const headers = Object.assign({}, this.getHeaders(token), extraHeaders || {});
+        return this.__withAuthToken((token) => {
+            const headers = Object.assign({}, this.getHeaders(token), extraHeaders || {});
 
-                if (raw) {
-                    return this.__api.makeRequest(method, path, data, headers)
-                        .then((body) => ({ body, version: undefined, mount: undefined, apiPath: path }));
-                }
+            if (raw) {
+                return this.__api.makeRequest(method, path, data, headers)
+                    .then((body) => ({ body, version: undefined, mount: undefined, apiPath: path }));
+            }
 
-                return this.__resolver.resolve(path)
-                    .then(({ mount, version }) => {
-                        if (v2Only && version !== 2) {
-                            throw new errors.UnsupportedOperationError(
-                                `Operation "${op}" is only supported on KV v2 mounts. ` +
-                                `Mount "${mount}" is not a KV v2 engine.`
-                            );
-                        }
-
-                        let apiPath;
-                        if (version === 2) {
-                            // Split the path into mount + logical sub-path and rewrite for KV v2
-                            const logicalPath = this.__logicalPath(path, mount);
-                            apiPath = rewritePath(version, op, mount, logicalPath);
-                        } else {
-                            // v1 / disabled: preserve the caller's literal path byte-for-byte,
-                            // including any trailing slash, to maintain the old wire behavior.
-                            apiPath = path;
-                        }
-
-                        // Data envelope: wrapData forces { data } on every engine version
-                        // (merge-patch update() semantics — v1 mounts reject PATCH anyway);
-                        // otherwise only v2 write/update wrap non-null data.
-                        let requestData = data;
-                        if (wrapData) {
-                            requestData = { data };
-                        } else if (version === 2 && (op === 'write' || op === 'update')
-                                && data !== null && data !== undefined) {
-                            requestData = { data };
-                        }
-
-                        return this.__api.makeRequest(method, apiPath, requestData, headers)
-                            .then((body) => ({ body, version, mount, apiPath }));
-                    });
-            });
+            return this.__resolver.resolve(path)
+                .then(({ mount, version }) => {
+                    if (v2Only && version !== 2) {
+                        throw new errors.UnsupportedOperationError(
+                            `Operation "${op}" is only supported on KV v2 mounts. ` +
+                            `Mount "${mount}" is not a KV v2 engine.`
+                        );
+                    }
+
+                    let apiPath;
+                    if (version === 2) {
+                        // Split the path into mount + logical sub-path and rewrite for KV v2
+                        const logicalPath = this.__logicalPath(path, mount);
+                        apiPath = rewritePath(version, op, mount, logicalPath);
+                    } else {
+                        // v1 / disabled: preserve the caller's literal path byte-for-byte,
+                        // including any trailing slash, to maintain the old wire behavior.
+                        apiPath = path;
+                    }
+
+                    // Data envelope: wrapData forces { data } on every engine version
+                    // (merge-patch update() semantics — v1 mounts reject PATCH anyway);
+                    // otherwise only v2 write/update wrap non-null data.
+                    let requestData = data;
+                    if (wrapData) {
+                        requestData = { data };
+                    } else if (version === 2 && (op === 'write' || op === 'update')
+                            && data !== null && data !== undefined) {
+                        requestData = { data };
+                    }
+
+                    return this.__api.makeRequest(method, apiPath, requestData, headers)
+                        .then((body) => ({ body, version, mount, apiPath }));
+                });
+        });
     }
 
     /**

package/src/auth/AuthToken.js

@@ -56,19 +56,25 @@ class AuthToken {
         const hasPreciseExpiry = unadjustedExpiresAtMilliseconds !== null;
         const expiresAtMilliseconds = AuthToken.__resolveExpiresAtMilliseconds(data, unadjustedExpiresAtMilliseconds);
 
-        return new AuthToken(
+        const renewable = data.renewable !== undefined ? data.renewable : false;
+        const authToken = new AuthToken(
             data.id,
             data.accessor,
             data.creation_time,
             null,
             data.explicit_max_ttl,
             data.num_uses,
-            data.renewable !== undefined ? data.renewable : false,
+            renewable,
             expiresAtMilliseconds,
             data.ttl,
             hasPreciseExpiry,
             unadjustedExpiresAtMilliseconds
         );
+        // Without an expiry the token is not renewable. Remember that Vault said it was, so the
+        // renewal timer can say why it stops (VaultBaseAuth); a ttl of 0 means it never expires.
+        authToken.__renewableWithoutExpiry = Boolean(renewable) && data.ttl !== 0
+            && expiresAtMilliseconds === null;
+        return authToken;
     }
 
     /**
@@ -85,7 +91,8 @@ class AuthToken {
      * @private
      * @param {Object} data - the `data` object of a token lookup response
      * @param {number|null} expireTime - parsed Vault expiry in milliseconds
-     * @returns {int|null} client expiry in milliseconds, or null when ttl is 0 without expire_time
+     * @returns {int|null} client expiry in milliseconds, or null when there is none to use: ttl 0
+     *      without expire_time, or neither expire_time nor a numeric ttl and creation time
      */
     static __resolveExpiresAtMilliseconds(data, expireTime) {
         const networkLatency = 60;
@@ -106,7 +113,9 @@ class AuthToken {
         // Fallback for responses without a usable `expire_time`.
         const creationTime = parseInt(data.last_renewal_time !== undefined ? data.last_renewal_time : data.creation_time, 10);
         const ttl = data.ttl > networkLatency ? data.ttl - networkLatency : data.ttl;
-        return (creationTime + parseInt(ttl, 10)) * 1000;
+        const expiresAt = (creationTime + parseInt(ttl, 10)) * 1000;
+        // A missing ttl or creation time made this NaN, a deadline that never passes.
+        return Number.isFinite(expiresAt) ? expiresAt : null;
     }
 
     /**