2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
|
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
|
2015-03-12 03:46:25 +03:00
|
|
|
package api
|
|
|
|
|
|
|
|
import (
|
2018-07-12 17:18:50 +03:00
|
|
|
"bytes"
|
2022-11-17 21:51:37 +03:00
|
|
|
"encoding/json"
|
2017-10-08 01:41:07 +03:00
|
|
|
"fmt"
|
2015-03-12 03:46:25 +03:00
|
|
|
"io"
|
2022-11-17 21:51:37 +03:00
|
|
|
"reflect"
|
|
|
|
"strings"
|
2016-06-07 23:01:09 +03:00
|
|
|
"time"
|
2016-07-06 19:25:40 +03:00
|
|
|
|
2018-04-05 18:49:21 +03:00
|
|
|
"github.com/hashicorp/errwrap"
|
2021-07-16 03:17:31 +03:00
|
|
|
"github.com/hashicorp/go-secure-stdlib/parseutil"
|
2015-03-12 03:46:25 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
// Secret is the structure returned for every secret within Vault.
|
|
|
|
type Secret struct {
|
2016-07-27 16:25:04 +03:00
|
|
|
// The request ID that generated this response
|
|
|
|
RequestID string `json:"request_id"`
|
|
|
|
|
2015-04-14 03:40:05 +03:00
|
|
|
LeaseID string `json:"lease_id"`
|
|
|
|
LeaseDuration int `json:"lease_duration"`
|
|
|
|
Renewable bool `json:"renewable"`
|
|
|
|
|
|
|
|
// Data is the actual contents of the secret. The format of the data
|
|
|
|
// is arbitrary and up to the secret backend.
|
|
|
|
Data map[string]interface{} `json:"data"`
|
|
|
|
|
2015-10-07 22:30:54 +03:00
|
|
|
// Warnings contains any warnings related to the operation. These
|
|
|
|
// are not issues that caused the command to fail, but that the
|
|
|
|
// client should be aware of.
|
|
|
|
Warnings []string `json:"warnings"`
|
|
|
|
|
2015-04-14 03:40:05 +03:00
|
|
|
// Auth, if non-nil, means that there was authentication information
|
|
|
|
// attached to this response.
|
|
|
|
Auth *SecretAuth `json:"auth,omitempty"`
|
2016-05-02 08:58:58 +03:00
|
|
|
|
|
|
|
// WrapInfo, if non-nil, means that the initial response was wrapped in the
|
|
|
|
// cubbyhole of the given token (which has a TTL of the given number of
|
|
|
|
// seconds)
|
|
|
|
WrapInfo *SecretWrapInfo `json:"wrap_info,omitempty"`
|
|
|
|
}
|
|
|
|
|
2017-09-03 01:48:48 +03:00
|
|
|
// TokenID returns the standardized token ID (token) for the given secret.
|
2017-10-08 01:41:07 +03:00
|
|
|
func (s *Secret) TokenID() (string, error) {
|
2017-09-03 01:48:48 +03:00
|
|
|
if s == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return "", nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Auth != nil && len(s.Auth.ClientToken) > 0 {
|
2017-10-08 01:41:07 +03:00
|
|
|
return s.Auth.ClientToken, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Data == nil || s.Data["id"] == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return "", nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
id, ok := s.Data["id"].(string)
|
|
|
|
if !ok {
|
2017-10-08 01:41:07 +03:00
|
|
|
return "", fmt.Errorf("token found but in the wrong format")
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
2017-10-08 01:41:07 +03:00
|
|
|
return id, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// TokenAccessor returns the standardized token accessor for the given secret.
|
|
|
|
// If the secret is nil or does not contain an accessor, this returns the empty
|
|
|
|
// string.
|
2017-10-08 01:41:07 +03:00
|
|
|
func (s *Secret) TokenAccessor() (string, error) {
|
2017-09-03 01:48:48 +03:00
|
|
|
if s == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return "", nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Auth != nil && len(s.Auth.Accessor) > 0 {
|
2017-10-08 01:41:07 +03:00
|
|
|
return s.Auth.Accessor, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Data == nil || s.Data["accessor"] == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return "", nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
accessor, ok := s.Data["accessor"].(string)
|
|
|
|
if !ok {
|
2017-10-08 01:41:07 +03:00
|
|
|
return "", fmt.Errorf("token found but in the wrong format")
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
2017-10-08 01:41:07 +03:00
|
|
|
return accessor, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// TokenRemainingUses returns the standardized remaining uses for the given
|
2017-10-08 01:41:07 +03:00
|
|
|
// secret. If the secret is nil or does not contain the "num_uses", this
|
|
|
|
// returns -1. On error, this will return -1 and a non-nil error.
|
|
|
|
func (s *Secret) TokenRemainingUses() (int, error) {
|
2017-09-03 01:48:48 +03:00
|
|
|
if s == nil || s.Data == nil || s.Data["num_uses"] == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return -1, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
2022-05-16 20:57:19 +03:00
|
|
|
return parseutil.SafeParseInt(s.Data["num_uses"])
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// TokenPolicies returns the standardized list of policies for the given secret.
|
2018-06-14 16:49:33 +03:00
|
|
|
// If the secret is nil or does not contain any policies, this returns nil. It
|
|
|
|
// also populates the secret's Auth info with identity/token policy info.
|
2017-10-08 01:41:07 +03:00
|
|
|
func (s *Secret) TokenPolicies() ([]string, error) {
|
2017-09-03 01:48:48 +03:00
|
|
|
if s == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return nil, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Auth != nil && len(s.Auth.Policies) > 0 {
|
2017-10-08 01:41:07 +03:00
|
|
|
return s.Auth.Policies, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Data == nil || s.Data["policies"] == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
2018-06-14 16:49:33 +03:00
|
|
|
var tokenPolicies []string
|
2017-09-03 01:48:48 +03:00
|
|
|
|
2018-06-14 16:49:33 +03:00
|
|
|
// Token policies
|
|
|
|
{
|
|
|
|
_, ok := s.Data["policies"]
|
|
|
|
if !ok {
|
|
|
|
goto TOKEN_DONE
|
|
|
|
}
|
|
|
|
|
|
|
|
sList, ok := s.Data["policies"].([]string)
|
|
|
|
if ok {
|
|
|
|
tokenPolicies = sList
|
|
|
|
goto TOKEN_DONE
|
|
|
|
}
|
|
|
|
|
|
|
|
list, ok := s.Data["policies"].([]interface{})
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("unable to convert token policies to expected format")
|
|
|
|
}
|
|
|
|
for _, v := range list {
|
|
|
|
p, ok := v.(string)
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("unable to convert policy %v to string", v)
|
|
|
|
}
|
|
|
|
tokenPolicies = append(tokenPolicies, p)
|
|
|
|
}
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
2018-06-14 16:49:33 +03:00
|
|
|
TOKEN_DONE:
|
|
|
|
var identityPolicies []string
|
|
|
|
|
|
|
|
// Identity policies
|
|
|
|
{
|
2023-05-19 16:51:52 +03:00
|
|
|
v, ok := s.Data["identity_policies"]
|
|
|
|
if !ok || v == nil {
|
2018-06-14 16:49:33 +03:00
|
|
|
goto DONE
|
|
|
|
}
|
|
|
|
|
|
|
|
sList, ok := s.Data["identity_policies"].([]string)
|
|
|
|
if ok {
|
|
|
|
identityPolicies = sList
|
|
|
|
goto DONE
|
|
|
|
}
|
|
|
|
|
|
|
|
list, ok := s.Data["identity_policies"].([]interface{})
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("unable to convert identity policies to expected format")
|
|
|
|
}
|
|
|
|
for _, v := range list {
|
|
|
|
p, ok := v.(string)
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("unable to convert policy %v to string", v)
|
|
|
|
}
|
|
|
|
identityPolicies = append(identityPolicies, p)
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-06-14 16:49:33 +03:00
|
|
|
DONE:
|
|
|
|
|
|
|
|
if s.Auth == nil {
|
|
|
|
s.Auth = &SecretAuth{}
|
|
|
|
}
|
|
|
|
|
|
|
|
policies := append(tokenPolicies, identityPolicies...)
|
|
|
|
|
|
|
|
s.Auth.TokenPolicies = tokenPolicies
|
|
|
|
s.Auth.IdentityPolicies = identityPolicies
|
|
|
|
s.Auth.Policies = policies
|
|
|
|
|
2017-10-08 01:41:07 +03:00
|
|
|
return policies, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
2017-09-08 04:55:36 +03:00
|
|
|
// TokenMetadata returns the map of metadata associated with this token, if any
|
|
|
|
// exists. If the secret is nil or does not contain the "metadata" key, this
|
|
|
|
// returns nil.
|
2017-10-08 01:41:07 +03:00
|
|
|
func (s *Secret) TokenMetadata() (map[string]string, error) {
|
2017-09-08 04:55:36 +03:00
|
|
|
if s == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return nil, nil
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Auth != nil && len(s.Auth.Metadata) > 0 {
|
2017-10-08 01:41:07 +03:00
|
|
|
return s.Auth.Metadata, nil
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Data == nil || (s.Data["metadata"] == nil && s.Data["meta"] == nil) {
|
2017-10-08 01:41:07 +03:00
|
|
|
return nil, nil
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
data, ok := s.Data["metadata"].(map[string]interface{})
|
|
|
|
if !ok {
|
|
|
|
data, ok = s.Data["meta"].(map[string]interface{})
|
|
|
|
if !ok {
|
2017-10-08 01:41:07 +03:00
|
|
|
return nil, fmt.Errorf("unable to convert metadata field to expected format")
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
metadata := make(map[string]string, len(data))
|
|
|
|
for k, v := range data {
|
|
|
|
typed, ok := v.(string)
|
|
|
|
if !ok {
|
2017-10-08 01:41:07 +03:00
|
|
|
return nil, fmt.Errorf("unable to convert metadata value %v to string", v)
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
metadata[k] = typed
|
|
|
|
}
|
|
|
|
|
2017-10-08 01:41:07 +03:00
|
|
|
return metadata, nil
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
|
2017-09-03 01:48:48 +03:00
|
|
|
// TokenIsRenewable returns the standardized token renewability for the given
|
|
|
|
// secret. If the secret is nil or does not contain the "renewable" key, this
|
|
|
|
// returns false.
|
2017-10-08 01:41:07 +03:00
|
|
|
func (s *Secret) TokenIsRenewable() (bool, error) {
|
2017-09-03 01:48:48 +03:00
|
|
|
if s == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return false, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Auth != nil && s.Auth.Renewable {
|
2017-10-08 01:41:07 +03:00
|
|
|
return s.Auth.Renewable, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Data == nil || s.Data["renewable"] == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return false, nil
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
|
2017-10-08 01:41:07 +03:00
|
|
|
renewable, err := parseutil.ParseBool(s.Data["renewable"])
|
2017-09-08 04:55:36 +03:00
|
|
|
if err != nil {
|
2018-04-05 18:49:21 +03:00
|
|
|
return false, errwrap.Wrapf("could not convert renewable value to a boolean: {{err}}", err)
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
|
2017-10-08 01:41:07 +03:00
|
|
|
return renewable, nil
|
2017-09-08 04:55:36 +03:00
|
|
|
}
|
|
|
|
|
2017-09-03 01:48:48 +03:00
|
|
|
// TokenTTL returns the standardized remaining token TTL for the given secret.
|
2017-10-08 01:41:07 +03:00
|
|
|
// If the secret is nil or does not contain a TTL, this returns 0.
|
|
|
|
func (s *Secret) TokenTTL() (time.Duration, error) {
|
2017-09-03 01:48:48 +03:00
|
|
|
if s == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return 0, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Auth != nil && s.Auth.LeaseDuration > 0 {
|
2017-10-08 01:41:07 +03:00
|
|
|
return time.Duration(s.Auth.LeaseDuration) * time.Second, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.Data == nil || s.Data["ttl"] == nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return 0, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
2017-10-08 01:41:07 +03:00
|
|
|
ttl, err := parseutil.ParseDurationSecond(s.Data["ttl"])
|
2017-09-03 01:48:48 +03:00
|
|
|
if err != nil {
|
2017-10-08 01:41:07 +03:00
|
|
|
return 0, err
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
2017-10-08 01:41:07 +03:00
|
|
|
return ttl, nil
|
2017-09-03 01:48:48 +03:00
|
|
|
}
|
|
|
|
|
2016-06-14 02:58:17 +03:00
|
|
|
// SecretWrapInfo contains wrapping information if we have it. If what is
|
|
|
|
// contained is an authentication token, the accessor for the token will be
|
|
|
|
// available in WrappedAccessor.
|
2016-05-02 08:58:58 +03:00
|
|
|
type SecretWrapInfo struct {
|
2016-06-14 02:58:17 +03:00
|
|
|
Token string `json:"token"`
|
2017-11-13 23:31:32 +03:00
|
|
|
Accessor string `json:"accessor"`
|
2016-06-14 02:58:17 +03:00
|
|
|
TTL int `json:"ttl"`
|
|
|
|
CreationTime time.Time `json:"creation_time"`
|
2017-08-03 01:28:58 +03:00
|
|
|
CreationPath string `json:"creation_path"`
|
2016-06-14 02:58:17 +03:00
|
|
|
WrappedAccessor string `json:"wrapped_accessor"`
|
2015-04-05 01:40:41 +03:00
|
|
|
}
|
|
|
|
|
2023-02-06 17:41:56 +03:00
|
|
|
type MFAMethodID struct {
|
|
|
|
Type string `json:"type,omitempty"`
|
|
|
|
ID string `json:"id,omitempty"`
|
|
|
|
UsesPasscode bool `json:"uses_passcode,omitempty"`
|
|
|
|
Name string `json:"name,omitempty"`
|
|
|
|
}
|
|
|
|
|
|
|
|
type MFAConstraintAny struct {
|
|
|
|
Any []*MFAMethodID `json:"any,omitempty"`
|
|
|
|
}
|
|
|
|
|
|
|
|
type MFARequirement struct {
|
|
|
|
MFARequestID string `json:"mfa_request_id,omitempty"`
|
|
|
|
MFAConstraints map[string]*MFAConstraintAny `json:"mfa_constraints,omitempty"`
|
|
|
|
}
|
|
|
|
|
2015-09-29 10:35:16 +03:00
|
|
|
// SecretAuth is the structure containing auth information if we have it.
|
2015-04-05 01:40:41 +03:00
|
|
|
type SecretAuth struct {
|
2018-06-14 16:49:33 +03:00
|
|
|
ClientToken string `json:"client_token"`
|
|
|
|
Accessor string `json:"accessor"`
|
|
|
|
Policies []string `json:"policies"`
|
|
|
|
TokenPolicies []string `json:"token_policies"`
|
|
|
|
IdentityPolicies []string `json:"identity_policies"`
|
|
|
|
Metadata map[string]string `json:"metadata"`
|
2019-02-15 04:10:36 +03:00
|
|
|
Orphan bool `json:"orphan"`
|
2019-06-04 20:04:20 +03:00
|
|
|
EntityID string `json:"entity_id"`
|
2015-04-05 01:40:41 +03:00
|
|
|
|
|
|
|
LeaseDuration int `json:"lease_duration"`
|
|
|
|
Renewable bool `json:"renewable"`
|
2022-02-18 00:08:51 +03:00
|
|
|
|
2023-02-06 17:41:56 +03:00
|
|
|
MFARequirement *MFARequirement `json:"mfa_requirement"`
|
2015-03-12 03:46:25 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// ParseSecret is used to parse a secret value from JSON from an io.Reader.
|
|
|
|
func ParseSecret(r io.Reader) (*Secret, error) {
|
2018-07-12 17:18:50 +03:00
|
|
|
// First read the data into a buffer. Not super efficient but we want to
|
|
|
|
// know if we actually have a body or not.
|
|
|
|
var buf bytes.Buffer
|
2022-11-17 21:51:37 +03:00
|
|
|
|
|
|
|
// io.Reader is treated like a stream and cannot be read
|
|
|
|
// multiple times. Duplicating this stream using TeeReader
|
|
|
|
// to use this data in case there is no top-level data from
|
|
|
|
// api response
|
|
|
|
var teebuf bytes.Buffer
|
|
|
|
tee := io.TeeReader(r, &teebuf)
|
|
|
|
|
|
|
|
_, err := buf.ReadFrom(tee)
|
2018-07-12 17:18:50 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if buf.Len() == 0 {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
2015-03-12 03:46:25 +03:00
|
|
|
// First decode the JSON into a map[string]interface{}
|
2015-03-16 06:35:33 +03:00
|
|
|
var secret Secret
|
2023-02-06 17:41:56 +03:00
|
|
|
dec := json.NewDecoder(&buf)
|
|
|
|
dec.UseNumber()
|
|
|
|
if err := dec.Decode(&secret); err != nil {
|
2015-03-12 03:46:25 +03:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2022-11-17 21:51:37 +03:00
|
|
|
// If the secret is null, add raw data to secret data if present
|
|
|
|
if reflect.DeepEqual(secret, Secret{}) {
|
|
|
|
data := make(map[string]interface{})
|
2023-02-06 17:41:56 +03:00
|
|
|
dec := json.NewDecoder(&teebuf)
|
|
|
|
dec.UseNumber()
|
|
|
|
if err := dec.Decode(&data); err != nil {
|
2022-11-17 21:51:37 +03:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
errRaw, errPresent := data["errors"]
|
|
|
|
|
|
|
|
// if only errors are present in the resp.Body return nil
|
|
|
|
// to return value not found as it does not have any raw data
|
|
|
|
if len(data) == 1 && errPresent {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// if errors are present along with raw data return the error
|
|
|
|
if errPresent {
|
|
|
|
var errStrArray []string
|
|
|
|
errBytes, err := json.Marshal(errRaw)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if err := json.Unmarshal(errBytes, &errStrArray); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return nil, fmt.Errorf(strings.Join(errStrArray, " "))
|
|
|
|
}
|
|
|
|
|
|
|
|
// if any raw data is present in resp.Body, add it to secret
|
|
|
|
if len(data) > 0 {
|
|
|
|
secret.Data = data
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-03-16 06:35:33 +03:00
|
|
|
return &secret, nil
|
2015-03-12 03:46:25 +03:00
|
|
|
}
|