f.weber
ae30ba1240
- Added internal/vault/client.go for creating a Vault client with configuration settings. - Introduced internal/vault/errors.go to classify Vault API errors for better UI handling. - Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations. - Implemented internal/vault/mounts.go to list and describe secret engine mounts. - Developed internal/vault/service.go to provide a unified entry point for Vault operations. - Added internal/vault/kv_test.go for comprehensive testing of KV operations. - Introduced internal/ui/toast.go for transient notifications in the UI. - Added renovate.json for dependency management and updates.
60 lines
1.8 KiB
Go
60 lines
1.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"errors"
|
|
"fmt"
|
|
"math/big"
|
|
"path"
|
|
|
|
"github.com/hashicorp/vault/api"
|
|
)
|
|
|
|
var errNoAuth = errors.New("empty response from credential provider")
|
|
|
|
// loginWrite performs POST auth/<mount>/<suffix> and normalises errors.
|
|
// This single helper backs every "raw" method (see the method table in the
|
|
// design doc) — the official api/auth/{userpass,approle,ldap,kubernetes}
|
|
// submodules add nothing over this plus Field.EnvFallback.
|
|
func loginWrite(ctx context.Context, c *api.Client, mount, suffix string, data map[string]interface{}) (*api.Secret, error) {
|
|
p := path.Join("auth", mount, suffix)
|
|
sec, err := c.Logical().WriteWithContext(ctx, p, data)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("login at %s: %w", p, err)
|
|
}
|
|
if sec == nil || sec.Auth == nil || sec.Auth.ClientToken == "" {
|
|
return nil, fmt.Errorf("%s: %w", p, errNoAuth)
|
|
}
|
|
return sec, nil
|
|
}
|
|
|
|
// mountOf returns req.Mount if set, else def.
|
|
func mountOf(req Request, def string) string {
|
|
if req.Mount != "" {
|
|
return req.Mount
|
|
}
|
|
return def
|
|
}
|
|
|
|
const base62Alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
|
|
|
|
// randomNonce returns an n-character base62 string from crypto/rand. Used
|
|
// for OIDC's client_nonce and Okta's verify nonce — anywhere Vault's own
|
|
// CLI uses go-secure-stdlib/base62.Random, which this deliberately does not
|
|
// depend on (it is ~10 lines backed by the same crypto/rand primitive).
|
|
func randomNonce(n int) string {
|
|
b := make([]byte, n)
|
|
max := big.NewInt(int64(len(base62Alphabet)))
|
|
for i := range b {
|
|
idx, err := rand.Int(rand.Reader, max)
|
|
if err != nil {
|
|
// crypto/rand failing is fatal for anything security-sensitive;
|
|
// panic rather than silently degrade nonce quality.
|
|
panic(fmt.Sprintf("auth: crypto/rand unavailable: %v", err))
|
|
}
|
|
b[i] = base62Alphabet[idx.Int64()]
|
|
}
|
|
return string(b)
|
|
}
|