2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2015-04-08 00:36:17 +03:00
|
|
|
package command
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"strings"
|
2016-04-01 20:16:05 +03:00
|
|
|
|
2017-09-05 07:05:14 +03:00
|
|
|
"github.com/mitchellh/cli"
|
|
|
|
"github.com/posener/complete"
|
2015-04-08 00:36:17 +03:00
|
|
|
)
|
|
|
|
|
2021-04-08 19:43:39 +03:00
|
|
|
var (
|
|
|
|
_ cli.Command = (*TokenRevokeCommand)(nil)
|
|
|
|
_ cli.CommandAutocomplete = (*TokenRevokeCommand)(nil)
|
|
|
|
)
|
2017-09-05 07:05:14 +03:00
|
|
|
|
2015-04-08 00:36:17 +03:00
|
|
|
type TokenRevokeCommand struct {
|
2017-09-05 07:05:14 +03:00
|
|
|
*BaseCommand
|
|
|
|
|
|
|
|
flagAccessor bool
|
|
|
|
flagSelf bool
|
|
|
|
flagMode string
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *TokenRevokeCommand) Synopsis() string {
|
2017-09-08 04:58:13 +03:00
|
|
|
return "Revoke a token and its children"
|
2017-09-05 07:05:14 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
func (c *TokenRevokeCommand) Help() string {
|
|
|
|
helpText := `
|
2017-09-08 04:58:13 +03:00
|
|
|
Usage: vault token revoke [options] [TOKEN | ACCESSOR]
|
2017-09-05 07:05:14 +03:00
|
|
|
|
|
|
|
Revokes authentication tokens and their children. If a TOKEN is not provided,
|
|
|
|
the locally authenticated token is used. The "-mode" flag can be used to
|
|
|
|
control the behavior of the revocation. See the "-mode" flag documentation
|
|
|
|
for more information.
|
|
|
|
|
|
|
|
Revoke a token and all the token's children:
|
|
|
|
|
2017-09-08 04:58:13 +03:00
|
|
|
$ vault token revoke 96ddf4bc-d217-f3ba-f9bd-017055595017
|
2017-09-05 07:05:14 +03:00
|
|
|
|
|
|
|
Revoke a token leaving the token's children:
|
|
|
|
|
2017-09-08 04:58:13 +03:00
|
|
|
$ vault token revoke -mode=orphan 96ddf4bc-d217-f3ba-f9bd-017055595017
|
2017-09-05 07:05:14 +03:00
|
|
|
|
|
|
|
Revoke a token by accessor:
|
|
|
|
|
2017-09-08 04:58:13 +03:00
|
|
|
$ vault token revoke -accessor 9793c9b3-e04a-46f3-e7b8-748d7da248da
|
2017-09-05 07:05:14 +03:00
|
|
|
|
|
|
|
For a full list of examples, please see the documentation.
|
|
|
|
|
|
|
|
` + c.Flags().Help()
|
|
|
|
|
|
|
|
return strings.TrimSpace(helpText)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *TokenRevokeCommand) Flags() *FlagSets {
|
|
|
|
set := c.flagSet(FlagSetHTTP)
|
|
|
|
|
|
|
|
f := set.NewFlagSet("Command Options")
|
|
|
|
|
|
|
|
f.BoolVar(&BoolVar{
|
|
|
|
Name: "accessor",
|
|
|
|
Target: &c.flagAccessor,
|
|
|
|
Default: false,
|
|
|
|
EnvVar: "",
|
|
|
|
Completion: complete.PredictNothing,
|
|
|
|
Usage: "Treat the argument as an accessor instead of a token.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.BoolVar(&BoolVar{
|
|
|
|
Name: "self",
|
|
|
|
Target: &c.flagSelf,
|
|
|
|
Default: false,
|
|
|
|
EnvVar: "",
|
|
|
|
Completion: complete.PredictNothing,
|
|
|
|
Usage: "Perform the revocation on the currently authenticated token.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: "mode",
|
|
|
|
Target: &c.flagMode,
|
|
|
|
Default: "",
|
|
|
|
EnvVar: "",
|
|
|
|
Completion: complete.PredictSet("orphan", "path"),
|
|
|
|
Usage: "Type of revocation to perform. If unspecified, Vault will revoke " +
|
|
|
|
"the token and all of the token's children. If \"orphan\", Vault will " +
|
|
|
|
"revoke only the token, leaving the children as orphans. If \"path\", " +
|
|
|
|
"tokens created from the given authentication path prefix are deleted " +
|
|
|
|
"along with their children.",
|
|
|
|
})
|
|
|
|
|
|
|
|
return set
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *TokenRevokeCommand) AutocompleteArgs() complete.Predictor {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *TokenRevokeCommand) AutocompleteFlags() complete.Flags {
|
|
|
|
return c.Flags().Completions()
|
2015-04-08 00:36:17 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
func (c *TokenRevokeCommand) Run(args []string) int {
|
2017-09-05 07:05:14 +03:00
|
|
|
f := c.Flags()
|
|
|
|
|
|
|
|
if err := f.Parse(args); err != nil {
|
|
|
|
c.UI.Error(err.Error())
|
|
|
|
return 1
|
|
|
|
}
|
|
|
|
|
|
|
|
args = f.Args()
|
|
|
|
token := ""
|
|
|
|
if len(args) > 0 {
|
|
|
|
token = strings.TrimSpace(args[0])
|
|
|
|
}
|
|
|
|
|
|
|
|
switch c.flagMode {
|
|
|
|
case "", "orphan", "path":
|
|
|
|
default:
|
|
|
|
c.UI.Error(fmt.Sprintf("Invalid mode: %s", c.flagMode))
|
2015-04-08 00:36:17 +03:00
|
|
|
return 1
|
|
|
|
}
|
|
|
|
|
2017-04-17 19:40:51 +03:00
|
|
|
switch {
|
2017-09-05 07:05:14 +03:00
|
|
|
case c.flagSelf && len(args) > 0:
|
|
|
|
c.UI.Error(fmt.Sprintf("Too many arguments with -self (expected 0, got %d)", len(args)))
|
|
|
|
return 1
|
|
|
|
case !c.flagSelf && len(args) > 1:
|
|
|
|
c.UI.Error(fmt.Sprintf("Too many arguments (expected 1 or -self, got %d)", len(args)))
|
|
|
|
return 1
|
|
|
|
case !c.flagSelf && len(args) < 1:
|
|
|
|
c.UI.Error(fmt.Sprintf("Not enough arguments (expected 1 or -self, got %d)", len(args)))
|
|
|
|
return 1
|
|
|
|
case c.flagSelf && c.flagAccessor:
|
|
|
|
c.UI.Error("Cannot use -self with -accessor!")
|
2017-04-17 19:40:51 +03:00
|
|
|
return 1
|
2017-09-05 07:05:14 +03:00
|
|
|
case c.flagSelf && c.flagMode != "":
|
|
|
|
c.UI.Error("Cannot use -self with -mode!")
|
|
|
|
return 1
|
|
|
|
case c.flagAccessor && c.flagMode == "orphan":
|
|
|
|
c.UI.Error("Cannot use -accessor with -mode=orphan!")
|
|
|
|
return 1
|
|
|
|
case c.flagAccessor && c.flagMode == "path":
|
|
|
|
c.UI.Error("Cannot use -accessor with -mode=path!")
|
2015-04-08 00:36:17 +03:00
|
|
|
return 1
|
|
|
|
}
|
|
|
|
|
|
|
|
client, err := c.Client()
|
|
|
|
if err != nil {
|
2017-09-05 07:05:14 +03:00
|
|
|
c.UI.Error(err.Error())
|
2015-04-08 00:36:17 +03:00
|
|
|
return 2
|
|
|
|
}
|
|
|
|
|
2017-09-05 07:05:14 +03:00
|
|
|
var revokeFn func(string) error
|
2016-03-11 01:04:04 +03:00
|
|
|
// Handle all 6 possible combinations
|
|
|
|
switch {
|
2017-09-05 07:05:14 +03:00
|
|
|
case !c.flagAccessor && c.flagSelf && c.flagMode == "":
|
|
|
|
revokeFn = client.Auth().Token().RevokeSelf
|
|
|
|
case !c.flagAccessor && !c.flagSelf && c.flagMode == "":
|
|
|
|
revokeFn = client.Auth().Token().RevokeTree
|
|
|
|
case !c.flagAccessor && !c.flagSelf && c.flagMode == "orphan":
|
|
|
|
revokeFn = client.Auth().Token().RevokeOrphan
|
|
|
|
case !c.flagAccessor && !c.flagSelf && c.flagMode == "path":
|
|
|
|
revokeFn = client.Sys().RevokePrefix
|
|
|
|
case c.flagAccessor && !c.flagSelf && c.flagMode == "":
|
|
|
|
revokeFn = client.Auth().Token().RevokeAccessor
|
2015-04-08 00:36:17 +03:00
|
|
|
}
|
|
|
|
|
2017-09-05 07:05:14 +03:00
|
|
|
if err := revokeFn(token); err != nil {
|
|
|
|
c.UI.Error(fmt.Sprintf("Error revoking token: %s", err))
|
2015-04-08 00:36:17 +03:00
|
|
|
return 2
|
|
|
|
}
|
|
|
|
|
2017-09-05 07:05:14 +03:00
|
|
|
c.UI.Output("Success! Revoked token (if it existed)")
|
2015-04-08 00:36:17 +03:00
|
|
|
return 0
|
|
|
|
}
|