mirror of
https://github.com/hashicorp/vault-action.git
synced 2026-04-07 04:29:26 +00:00
chore: make vault action consumable (#43)
* chore: make vault action consumable * fix prefixless queries to default to data * fix the right build entrypoint * make output more forgiving and shore up selectors * clarify doc language * add npmtoken
This commit is contained in:
Richard Simpson
GitHub
parent
9878eba70a
commit
a7527a3e8a
11 changed files with 7819 additions and 244 deletions
134
src/action.js
134
src/action.js
|
|
@ -2,7 +2,8 @@
|
|||
const core = require('@actions/core');
|
||||
const command = require('@actions/core/lib/command');
|
||||
const got = require('got').default;
|
||||
const { retrieveToken } = require('./auth');
|
||||
const jsonata = require('jsonata');
|
||||
const { auth: { retrieveToken }, secrets: { getSecrets } } = require('./index');
|
||||
|
||||
const AUTH_METHODS = ['approle', 'token', 'github'];
|
||||
const VALID_KV_VERSION = [-1, 1, 2];
|
||||
|
|
@ -39,8 +40,9 @@ async function exportSecrets() {
|
|||
defaultOptions.headers["X-Vault-Namespace"] = vaultNamespace;
|
||||
}
|
||||
|
||||
const vaultToken = await retrieveToken(vaultMethod, got.extend(defaultOptions));
|
||||
defaultOptions.headers['X-Vault-Token'] = vaultToken;
|
||||
const client = got.extend(defaultOptions);
|
||||
const vaultToken = await retrieveToken(vaultMethod, client);
|
||||
|
||||
if (!enginePath) {
|
||||
enginePath = 'secret';
|
||||
|
|
@ -55,62 +57,42 @@ async function exportSecrets() {
|
|||
throw Error(`You must provide a valid K/V version (${VALID_KV_VERSION.slice(1).join(', ')}). Input: "${kvVersion}"`);
|
||||
}
|
||||
|
||||
const responseCache = new Map();
|
||||
for (const secretRequest of secretRequests) {
|
||||
const { secretPath, outputVarName, envVarName, secretSelector, isJSONPath } = secretRequest;
|
||||
const requestOptions = {
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
};
|
||||
const requests = secretRequests.map(request => {
|
||||
const { path, selector } = request;
|
||||
|
||||
for (const [headerName, headerValue] of extraHeaders) {
|
||||
requestOptions.headers[headerName] = headerValue;
|
||||
if (path.startsWith('/')) {
|
||||
return request;
|
||||
}
|
||||
const kvPath = (kvVersion === 2)
|
||||
? `/${enginePath}/data/${path}`
|
||||
: `/${enginePath}/${path}`;
|
||||
const kvSelector = (kvVersion === 2)
|
||||
? `data.data.${selector}`
|
||||
: `data.${selector}`;
|
||||
return { ...request, path: kvPath, selector: kvSelector };
|
||||
});
|
||||
|
||||
if (vaultNamespace != null) {
|
||||
requestOptions.headers["X-Vault-Namespace"] = vaultNamespace;
|
||||
}
|
||||
const results = await getSecrets(requests, client);
|
||||
|
||||
let requestPath = `v1`;
|
||||
const kvRequest = !secretPath.startsWith('/')
|
||||
if (!kvRequest) {
|
||||
requestPath += secretPath;
|
||||
} else {
|
||||
requestPath += (kvVersion === 2)
|
||||
? `/${enginePath}/data/${secretPath}`
|
||||
: `/${enginePath}/${secretPath}`;
|
||||
}
|
||||
|
||||
let body;
|
||||
if (responseCache.has(requestPath)) {
|
||||
body = responseCache.get(requestPath);
|
||||
for (const result of results) {
|
||||
const { value, request, cachedResponse } = result;
|
||||
if (cachedResponse) {
|
||||
core.debug('ℹ using cached response');
|
||||
} else {
|
||||
const result = await client.get(requestPath, requestOptions);
|
||||
body = result.body;
|
||||
responseCache.set(requestPath, body);
|
||||
}
|
||||
|
||||
let dataDepth = isJSONPath === true ? 0 : kvRequest === false ? 1 : kvVersion;
|
||||
|
||||
const secretData = getResponseData(body, dataDepth);
|
||||
const value = selectData(secretData, secretSelector, isJSONPath);
|
||||
}
|
||||
command.issue('add-mask', value);
|
||||
if (exportEnv) {
|
||||
core.exportVariable(envVarName, `${value}`);
|
||||
core.exportVariable(request.envVarName, `${value}`);
|
||||
}
|
||||
core.setOutput(outputVarName, `${value}`);
|
||||
core.debug(`✔ ${secretPath} => outputs.${outputVarName}${exportEnv ? ` | env.${envVarName}` : ''}`);
|
||||
core.setOutput(request.outputVarName, `${value}`);
|
||||
core.debug(`✔ ${request.path} => outputs.${request.outputVarName}${exportEnv ? ` | env.${request.envVarName}` : ''}`);
|
||||
}
|
||||
};
|
||||
|
||||
/** @typedef {Object} SecretRequest
|
||||
* @property {string} secretPath
|
||||
* @property {string} path
|
||||
* @property {string} envVarName
|
||||
* @property {string} outputVarName
|
||||
* @property {string} secretSelector
|
||||
* @property {boolean} isJSONPath
|
||||
* @property {string} selector
|
||||
*/
|
||||
|
||||
/**
|
||||
|
|
@ -127,12 +109,12 @@ function parseSecretsInput(secretsInput) {
|
|||
/** @type {SecretRequest[]} */
|
||||
const output = [];
|
||||
for (const secret of secrets) {
|
||||
let path = secret;
|
||||
let pathSpec = secret;
|
||||
let outputVarName = null;
|
||||
|
||||
const renameSigilIndex = secret.lastIndexOf('|');
|
||||
if (renameSigilIndex > -1) {
|
||||
path = secret.substring(0, renameSigilIndex).trim();
|
||||
pathSpec = secret.substring(0, renameSigilIndex).trim();
|
||||
outputVarName = secret.substring(renameSigilIndex + 1).trim();
|
||||
|
||||
if (outputVarName.length < 1) {
|
||||
|
|
@ -140,7 +122,7 @@ function parseSecretsInput(secretsInput) {
|
|||
}
|
||||
}
|
||||
|
||||
const pathParts = path
|
||||
const pathParts = pathSpec
|
||||
.split(/\s+/)
|
||||
.map(part => part.trim())
|
||||
.filter(part => part.length !== 0);
|
||||
|
|
@ -149,64 +131,43 @@ function parseSecretsInput(secretsInput) {
|
|||
throw Error(`You must provide a valid path and key. Input: "${secret}"`);
|
||||
}
|
||||
|
||||
const [secretPath, secretSelector] = pathParts;
|
||||
const [path, selector] = pathParts;
|
||||
|
||||
const isJSONPath = secretSelector.includes('.');
|
||||
/** @type {any} */
|
||||
const selectorAst = jsonata(selector).ast();
|
||||
|
||||
if (isJSONPath && !outputVarName) {
|
||||
if ((selectorAst.type !== "path" || selectorAst.steps[0].stages) && !outputVarName) {
|
||||
throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
|
||||
}
|
||||
|
||||
let envVarName = outputVarName;
|
||||
if (!outputVarName) {
|
||||
outputVarName = secretSelector;
|
||||
envVarName = normalizeOutputKey(outputVarName);
|
||||
outputVarName = normalizeOutputKey(selector);
|
||||
envVarName = normalizeOutputKey(selector, true);
|
||||
}
|
||||
|
||||
output.push({
|
||||
secretPath,
|
||||
path,
|
||||
envVarName,
|
||||
outputVarName,
|
||||
secretSelector,
|
||||
isJSONPath
|
||||
selector
|
||||
});
|
||||
}
|
||||
return output;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parses a JSON response and returns the secret data
|
||||
* @param {string} responseBody
|
||||
* @param {number} dataLevel
|
||||
*/
|
||||
function getResponseData(responseBody, dataLevel) {
|
||||
let secretData = JSON.parse(responseBody);
|
||||
|
||||
for (let i = 0; i < dataLevel; i++) {
|
||||
secretData = secretData['data'];
|
||||
}
|
||||
return secretData;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parses a JSON response and returns the secret data
|
||||
* @param {Object} data
|
||||
* @param {string} selector
|
||||
*/
|
||||
function selectData(data, selector, isJSONPath) {
|
||||
if (!isJSONPath) {
|
||||
return data[selector];
|
||||
}
|
||||
|
||||
// TODO: JSONPath
|
||||
}
|
||||
|
||||
/**
|
||||
* Replaces any forward-slash characters to
|
||||
* Replaces any dot chars to __ and removes non-ascii charts
|
||||
* @param {string} dataKey
|
||||
* @param {boolean=} isEnvVar
|
||||
*/
|
||||
function normalizeOutputKey(dataKey) {
|
||||
return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
|
||||
function normalizeOutputKey(dataKey, isEnvVar = false) {
|
||||
let outputKey = dataKey
|
||||
.replace('.', '__').replace(/[^\p{L}\p{N}_-]/gu, '');
|
||||
if (isEnvVar) {
|
||||
outputKey = outputKey.toUpperCase();
|
||||
}
|
||||
return outputKey;
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
@ -237,7 +198,6 @@ function parseHeadersInput(inputKey, inputOptions) {
|
|||
module.exports = {
|
||||
exportSecrets,
|
||||
parseSecretsInput,
|
||||
parseResponse: getResponseData,
|
||||
normalizeOutputKey,
|
||||
parseHeadersInput
|
||||
};
|
||||
};
|
||||
|
|
@ -17,11 +17,10 @@ describe('parseSecretsInput', () => {
|
|||
it('parses simple secret', () => {
|
||||
const output = parseSecretsInput('test key');
|
||||
expect(output).toContainEqual({
|
||||
secretPath: 'test',
|
||||
secretSelector: 'key',
|
||||
path: 'test',
|
||||
selector: 'key',
|
||||
outputVarName: 'key',
|
||||
envVarName: 'KEY',
|
||||
isJSONPath: false
|
||||
envVarName: 'KEY'
|
||||
});
|
||||
});
|
||||
|
||||
|
|
@ -49,10 +48,10 @@ describe('parseSecretsInput', () => {
|
|||
|
||||
expect(output).toHaveLength(2);
|
||||
expect(output[0]).toMatchObject({
|
||||
secretPath: 'first',
|
||||
path: 'first',
|
||||
});
|
||||
expect(output[1]).toMatchObject({
|
||||
secretPath: 'second',
|
||||
path: 'second',
|
||||
});
|
||||
});
|
||||
|
||||
|
|
@ -78,7 +77,7 @@ describe('parseSecretsInput', () => {
|
|||
|
||||
expect(output).toHaveLength(3);
|
||||
expect(output[0]).toMatchObject({
|
||||
secretPath: 'first',
|
||||
path: 'first',
|
||||
});
|
||||
expect(output[1]).toMatchObject({
|
||||
outputVarName: 'b',
|
||||
|
|
@ -88,7 +87,7 @@ describe('parseSecretsInput', () => {
|
|||
outputVarName: 'SOME_C',
|
||||
envVarName: 'SOME_C',
|
||||
});
|
||||
})
|
||||
});
|
||||
});
|
||||
|
||||
describe('parseHeaders', () => {
|
||||
|
|
@ -129,41 +128,8 @@ describe('parseHeaders', () => {
|
|||
const result = parseHeadersInput('extraHeaders');
|
||||
expect(Array.from(result)).toHaveLength(0);
|
||||
});
|
||||
})
|
||||
|
||||
describe('parseResponse', () => {
|
||||
// https://www.vaultproject.io/api/secret/kv/kv-v1.html#sample-response
|
||||
it('parses K/V version 1 response', () => {
|
||||
const response = JSON.stringify({
|
||||
data: {
|
||||
foo: 'bar'
|
||||
}
|
||||
})
|
||||
const output = parseResponse(response, 1);
|
||||
|
||||
expect(output).toEqual({
|
||||
foo: 'bar'
|
||||
});
|
||||
});
|
||||
|
||||
// https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version
|
||||
it('parses K/V version 2 response', () => {
|
||||
const response = JSON.stringify({
|
||||
data: {
|
||||
data: {
|
||||
foo: 'bar'
|
||||
}
|
||||
}
|
||||
})
|
||||
const output = parseResponse(response, 2);
|
||||
|
||||
expect(output).toEqual({
|
||||
foo: 'bar'
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
describe('exportSecrets', () => {
|
||||
beforeEach(() => {
|
||||
jest.resetAllMocks();
|
||||
|
|
@ -224,6 +190,18 @@ describe('exportSecrets', () => {
|
|||
expect(core.setOutput).toBeCalledWith('key', '1');
|
||||
});
|
||||
|
||||
it('intl secret retrieval', async () => {
|
||||
mockInput('测试 测试');
|
||||
mockVaultData({
|
||||
测试: 1
|
||||
});
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('测试', '1');
|
||||
expect(core.setOutput).toBeCalledWith('测试', '1');
|
||||
});
|
||||
|
||||
it('mapped secret retrieval', async () => {
|
||||
mockInput('test key|TEST_NAME');
|
||||
mockVaultData({
|
||||
|
|
@ -267,4 +245,16 @@ describe('exportSecrets', () => {
|
|||
expect(core.exportVariable).toBeCalledWith('KEY', '1');
|
||||
expect(core.setOutput).toBeCalledWith('key', '1');
|
||||
});
|
||||
|
||||
it('nested secret retrieval', async () => {
|
||||
mockInput('test key.value');
|
||||
mockVaultData({
|
||||
key: { value: 1 }
|
||||
});
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('KEY__VALUE', '1');
|
||||
expect(core.setOutput).toBeCalledWith('key__value', '1');
|
||||
});
|
||||
});
|
||||
|
|
|
|||
10
src/entry.js
Normal file
10
src/entry.js
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
const core = require('@actions/core');
|
||||
const { exportSecrets } = require('./action');
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
await core.group('Get Vault Secrets', exportSecrets);
|
||||
} catch (error) {
|
||||
core.setFailed(error.message);
|
||||
}
|
||||
})();
|
||||
15
src/index.js
15
src/index.js
|
|
@ -1,10 +1,7 @@
|
|||
const core = require('@actions/core');
|
||||
const { exportSecrets } = require('./action');
|
||||
const auth = require('./auth');
|
||||
const secrets = require('./secrets');
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
await core.group('Get Vault Secrets', exportSecrets);
|
||||
} catch (error) {
|
||||
core.setFailed(error.message);
|
||||
}
|
||||
})();
|
||||
module.exports = {
|
||||
auth,
|
||||
secrets
|
||||
};
|
||||
76
src/secrets.js
Normal file
76
src/secrets.js
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
const jsonata = require("jsonata");
|
||||
|
||||
|
||||
/**
|
||||
* @typedef {Object} SecretRequest
|
||||
* @property {string} path
|
||||
* @property {string} selector
|
||||
*/
|
||||
|
||||
/**
|
||||
* @template {SecretRequest} TRequest
|
||||
* @typedef {Object} SecretResponse
|
||||
* @property {TRequest} request
|
||||
* @property {string} value
|
||||
* @property {boolean} cachedResponse
|
||||
*/
|
||||
|
||||
/**
|
||||
* @template TRequest
|
||||
* @param {Array<TRequest>} secretRequests
|
||||
* @param {import('got').Got} client
|
||||
* @return {Promise<SecretResponse<TRequest>[]>}
|
||||
*/
|
||||
async function getSecrets(secretRequests, client) {
|
||||
const responseCache = new Map();
|
||||
const results = [];
|
||||
for (const secretRequest of secretRequests) {
|
||||
const { path, selector } = secretRequest;
|
||||
|
||||
const requestPath = `v1${path}`;
|
||||
let body;
|
||||
let cachedResponse = false;
|
||||
if (responseCache.has(requestPath)) {
|
||||
body = responseCache.get(requestPath);
|
||||
cachedResponse = true;
|
||||
} else {
|
||||
const result = await client.get(requestPath);
|
||||
body = result.body;
|
||||
responseCache.set(requestPath, body);
|
||||
}
|
||||
|
||||
const value = selectData(JSON.parse(body), selector);
|
||||
results.push({
|
||||
request: secretRequest,
|
||||
value,
|
||||
cachedResponse
|
||||
});
|
||||
}
|
||||
return results;
|
||||
}
|
||||
|
||||
/**
|
||||
* Uses a Jsonata selector retrieve a bit of data from the result
|
||||
* @param {object} data
|
||||
* @param {string} selector
|
||||
*/
|
||||
function selectData(data, selector) {
|
||||
const ata = jsonata(selector);
|
||||
let result = JSON.stringify(ata.evaluate(data));
|
||||
// Compat for custom engines
|
||||
if (!result && ata.ast().type === "path" && ata.ast()['steps'].length === 1 && selector !== 'data' && 'data' in data) {
|
||||
result = JSON.stringify(jsonata(`data.${selector}`).evaluate(data));
|
||||
} else if (!result) {
|
||||
throw Error(`Unable to retrieve result for ${selector}. No match data was found. Double check your Key or Selector.`);
|
||||
}
|
||||
|
||||
if (result.startsWith(`"`)) {
|
||||
result = result.substring(1, result.length - 1);
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
getSecrets,
|
||||
selectData
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue