vvauth 1.2.1 → 2.0.1

package/README.md

@@ -18,7 +18,7 @@ vauth configuration file is a simple yaml file with a specific macro expansion s
 The configuration file should abide the following schema
 
 ### configuration macro expansion set
-* $${profile.XXX} expand to vault entity metadata/custom_metadata vars
+* $${profile.XXX} expand to vault entity metadata and user `.vauth_database` vars
 * $${env.XXX} expand to local environement vars
 * $${secrets.XXX} expand to remote scrapped secrets (see the env.paths)
 

package/index.js

@@ -5,8 +5,9 @@ const os   = require('os');
 const fs    = require('fs');
 const path  = require('path');
 const url   = require('url');
-const {spawn} = require('child_process');
+const {spawn, execFileSync} = require('child_process');
 const passthru = require('nyks/child_process/passthru');
+const wait     = require('nyks/child_process/wait');
 
 const {parse} = require('yaml');
 const semver     = require('semver');
@@ -60,7 +61,28 @@ class vvauth {
     let vauth_rc = VAUTH_RC.filter(path => path && fs.existsSync(path))[0];
     if(vauth_rc) {
       let body = fs.readFileSync(vauth_rc, 'utf8');
-      this.rc = walk(parse(body), v =>  replaceEnv(v, {env : process.env}));
+      let rc = parse(body);
+      let env = process.env;
+
+      if(get(rc, 'env.gitlab') && !env.CI) {
+        try {
+          let remote_url = String(execFileSync('git', ['remote', 'get-url', 'origin'], {cwd : path.dirname(vauth_rc), stdio : ['ignore', 'pipe', 'ignore']})).trim();
+          let match = remote_url.match(/^[^@]+@[^:]+:(.+)$/);
+          let CI_PROJECT_PATH = match ? match[1] : trim(new URL(remote_url).pathname, '/');
+          CI_PROJECT_PATH = trim(CI_PROJECT_PATH, '/').replace(/\.git$/, '');
+
+          if(CI_PROJECT_PATH) {
+            let parts = CI_PROJECT_PATH.split('/');
+            let CI_PROJECT_NAME = parts.pop();
+            let CI_PROJECT_NAMESPACE = parts.join('/');
+            let CI_PROJECT_PATH_SLUG = String(CI_PROJECT_PATH).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+
+            env = {...env, CI_PROJECT_PATH, CI_PROJECT_NAME, CI_PROJECT_NAMESPACE, CI_PROJECT_PATH_SLUG};
+          }
+        } catch(err) {}
+      }
+
+      this.rc = walk(rc, v =>  replaceEnv(v, {env}));
     }
 
     this.VAULT_ADDR = this.rc.vault_addr;
@@ -112,12 +134,12 @@ class vvauth {
 
 
   async set(k, v) {
-    let {entity_id, identity : {metadata}} = await this._vault_get_profile();
-    if(!metadata)
-      metadata = {};
-    let key_name = `env_${k.toUpperCase()}`;
-    metadata[key_name] = v;
-    await this._update_identity(this.VAULT_TOKEN, entity_id, {metadata});
+    let {profile, database} = await this._vault_get_profile();
+    if(!profile.VAUTH_USER_LOGIN)
+      throw "Could not resolve VAUTH_USER_LOGIN from vault identity";
+
+    database[k.toUpperCase()] = v;
+    await this._vault_write(`private/${profile.VAUTH_USER_LOGIN}`, '.vauth_database', database);
   }
 
   async unset(k) {
@@ -125,8 +147,8 @@ class vvauth {
   }
 
   async show() {
-    let {profile} = await this._vault_get_profile();
-    return profile;
+    let {profile, database} = await this._vault_get_profile();
+    return {...database, ...profile};
   }
 
   async _vault_get_profile() {
@@ -137,22 +159,18 @@ class vvauth {
 
     let {entity_id} = await this._lookup_token(this.VAULT_TOKEN);
     let identity = await this._lookup_identity(this.VAULT_TOKEN, entity_id);
-    let profile = {};
-    for(let alias of identity.aliases) {
-      for(let [k, v] of Object.entries(alias.custom_metadata || {})) {
-        if(k.startsWith('env_'))
-          profile[k.substr(4)] = v;
-      }
-    }
-    for(let [k, v] of Object.entries(identity.metadata || {})) {
-      if(k.startsWith('env_'))
-        profile[k.substr(4)] = v;
-    }
-    return {entity_id, identity, profile};
+    let profile = {...(identity.metadata || {})};
+    let database = {};
+
+    if(profile.VAUTH_USER_LOGIN)
+      database = await this._vault_read(`private/${profile.VAUTH_USER_LOGIN}`, '.vauth_database', true);
+
+    return {entity_id, identity, profile, database};
   }
 
   async _get_env() {
-    let {profile} = await this._vault_get_profile();
+    let {profile, database} = await this._vault_get_profile();
+    profile = {...database, ...profile};
 
     let env = {VAULT_TOKEN : this.VAULT_TOKEN, VAULT_ADDR : this.VAULT_ADDR}, secrets = {},
       {git, map = {}, paths, path : mount = "secrets"} = this.rc.env || {};
@@ -163,7 +181,14 @@ class vvauth {
       let child = spawn('ssh-agent-crypt', ["-decrypt", identity]);
 
       child.stdin.end(fs.readFileSync(path));
-      const result = JSON.parse(await drain(child.stdout));
+      child.stderr.pipe(process.stderr);
+
+      const [exit, body] = await Promise.all([wait(child, false), drain(child.stdout)]);
+      if(exit !== 0) {
+        console.error("Could not expand armored %s using %s", path, identity);
+        process.exit();
+      }
+      const result = JSON.parse(body);
       secrets = {...secrets, ...result};
     }
 
@@ -211,11 +236,31 @@ class vvauth {
     return env;
   }
 
-  async _vault_read(mount, secret_path) {
+  async _vault_read(mount, secret_path, optional = false) {
     let remote_url = `${trim(this.VAULT_ADDR, '/')}/v1/${mount}/data/${trim(secret_path, '/')}`;
-    let query = {...url.parse(remote_url), headers : {'x-vault-token' : this.VAULT_TOKEN}, expect : 200};
+    let query = {...url.parse(remote_url), headers : {'x-vault-token' : this.VAULT_TOKEN}};
     let res = await request(query);
-    return get(JSON.parse(String(await drain(res))), 'data.data');
+    let body = String(await drain(res));
+
+    if(optional && res.statusCode == 404)
+      return {};
+
+    if(res.statusCode != 200)
+      throw `Could not read vault secret '${mount}/${trim(secret_path, '/')}' : ${body}`;
+
+    return get(JSON.parse(body), 'data.data');
+  }
+
+  async _vault_write(mount, secret_path, data) {
+    let remote_url = `${trim(this.VAULT_ADDR, '/')}/v1/${mount}/data/${trim(secret_path, '/')}`;
+    let query = {...url.parse(remote_url), headers : {'x-vault-token' : this.VAULT_TOKEN}, json : true};
+    let res = await request(query, {data});
+    let body = String(await drain(res));
+
+    if(res.statusCode != 200)
+      throw `Could not write vault secret '${mount}/${trim(secret_path, '/')}' : ${body}`;
+
+    return body ? JSON.parse(body) : {};
   }
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vvauth",
-  "version": "1.2.1",
+  "version": "2.0.1",
   "description": "Vault Auth helper",
   "main": "index.js",
   "bin": {