Scaffold vault-plugin-secrets-arrstack engine

Mint dynamic arrproxy machine tokens via arrproxy's bearer-gated admin API so Terraform-driven *arr onboarding can issue and revoke per-role tokens non-interactively. - Add backend, config, roles, creds paths and the arrstack_token secret - Call POST/DELETE /api/admin/tokens with a vault:arrstack:<role> subject - Enforce apps as a non-empty subset of sonarr/radarr/prowlarr - Cap lease renewal at the arrproxy token's fixed expiry - Add table-driven unit tests against a fake arrproxy admin server - Add Makefile, nfpm packaging, and pre-commit/build/test/release pipelines
2026-08-18 21:52:07 +10:00
parent 1287e1b27e
commit 3418cfd8f6
25 changed files with 2657 additions and 1 deletions
@@ -0,0 +1,228 @@
+package arrstack
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"time"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+const roleStoragePrefix = "role/"
+
+// knownApps is the fixed set of *arr apps arrproxy fronts. A role's apps must be
+// a non-empty subset of these.
+var knownApps = map[string]bool{
+	"sonarr":   true,
+	"radarr":   true,
+	"prowlarr": true,
+}
+
+// arrstackRole constrains the machine tokens minted from the creds/<name> path.
+type arrstackRole struct {
+	// Apps is the subset of sonarr/radarr/prowlarr a minted token may reach.
+	Apps []string `json:"apps"`
+	// TTL is the default lease duration for tokens issued from this role.
+	TTL time.Duration `json:"ttl"`
+	// MaxTTL is the maximum lease duration for tokens issued from this role.
+	MaxTTL time.Duration `json:"max_ttl"`
+}
+
+func (r *arrstackRole) toResponseData() map[string]interface{} {
+	return map[string]interface{}{
+		"apps":    r.Apps,
+		"ttl":     int64(r.TTL.Seconds()),
+		"max_ttl": int64(r.MaxTTL.Seconds()),
+	}
+}
+
+// validateApps returns the requested apps de-duplicated and sorted if they form
+// a non-empty subset of knownApps; otherwise it returns an error.
+func validateApps(requested []string) ([]string, error) {
+	if len(requested) == 0 {
+		return nil, fmt.Errorf("apps must be a non-empty subset of sonarr/radarr/prowlarr")
+	}
+	seen := map[string]bool{}
+	out := make([]string, 0, len(requested))
+	for _, a := range requested {
+		if !knownApps[a] {
+			return nil, fmt.Errorf("unknown app %q: apps must be a subset of sonarr/radarr/prowlarr", a)
+		}
+		if !seen[a] {
+			seen[a] = true
+			out = append(out, a)
+		}
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+func pathRole(b *arrstackBackend) *framework.Path {
+	return &framework.Path{
+		Pattern: "roles/" + framework.GenericNameRegex("name"),
+		DisplayAttrs: &framework.DisplayAttributes{
+			OperationPrefix: "arrstack",
+			OperationSuffix: "role",
+		},
+		Fields: map[string]*framework.FieldSchema{
+			"name": {
+				Type:        framework.TypeLowerCaseString,
+				Description: "Name of the role.",
+				Required:    true,
+			},
+			"apps": {
+				Type:        framework.TypeCommaStringSlice,
+				Description: "Comma-separated subset of sonarr/radarr/prowlarr a minted token may reach.",
+				Required:    true,
+			},
+			"ttl": {
+				Type:        framework.TypeDurationSecond,
+				Description: "Default lease TTL for tokens minted from this role.",
+			},
+			"max_ttl": {
+				Type:        framework.TypeDurationSecond,
+				Description: "Maximum lease TTL for tokens minted from this role.",
+			},
+		},
+		Operations: map[logical.Operation]framework.OperationHandler{
+			logical.ReadOperation: &framework.PathOperation{
+				Callback: b.pathRoleRead,
+			},
+			logical.CreateOperation: &framework.PathOperation{
+				Callback: b.pathRoleWrite,
+			},
+			logical.UpdateOperation: &framework.PathOperation{
+				Callback: b.pathRoleWrite,
+			},
+			logical.DeleteOperation: &framework.PathOperation{
+				Callback: b.pathRoleDelete,
+			},
+		},
+		ExistenceCheck:  b.pathRoleExistenceCheck,
+		HelpSynopsis:    "Manage roles that constrain minted arrproxy tokens.",
+		HelpDescription: "Roles define the allowed apps and TTLs applied to machine tokens issued from creds/<name>.",
+	}
+}
+
+func pathRolesList(b *arrstackBackend) *framework.Path {
+	return &framework.Path{
+		Pattern: "roles/?$",
+		DisplayAttrs: &framework.DisplayAttributes{
+			OperationPrefix: "arrstack",
+			OperationSuffix: "roles",
+		},
+		Operations: map[logical.Operation]framework.OperationHandler{
+			logical.ListOperation: &framework.PathOperation{
+				Callback: b.pathRolesList,
+			},
+		},
+		HelpSynopsis:    "List the configured roles.",
+		HelpDescription: "List the roles configured on this arrstack backend.",
+	}
+}
+
+func (b *arrstackBackend) pathRoleExistenceCheck(ctx context.Context, req *logical.Request, data *framework.FieldData) (bool, error) {
+	role, err := b.getRole(ctx, req.Storage, data.Get("name").(string))
+	if err != nil {
+		return false, err
+	}
+	return role != nil, nil
+}
+
+func (b *arrstackBackend) pathRolesList(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
+	entries, err := req.Storage.List(ctx, roleStoragePrefix)
+	if err != nil {
+		return nil, err
+	}
+	return logical.ListResponse(entries), nil
+}
+
+func (b *arrstackBackend) pathRoleRead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	role, err := b.getRole(ctx, req.Storage, data.Get("name").(string))
+	if err != nil {
+		return nil, err
+	}
+	if role == nil {
+		return nil, nil
+	}
+	return &logical.Response{Data: role.toResponseData()}, nil
+}
+
+func (b *arrstackBackend) pathRoleWrite(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	name := data.Get("name").(string)
+	if name == "" {
+		return logical.ErrorResponse("role name is required"), nil
+	}
+
+	role, err := b.getRole(ctx, req.Storage, name)
+	if err != nil {
+		return nil, err
+	}
+	if role == nil {
+		role = &arrstackRole{}
+	}
+
+	if v, ok := data.GetOk("apps"); ok {
+		apps, err := validateApps(v.([]string))
+		if err != nil {
+			return logical.ErrorResponse(err.Error()), nil
+		}
+		role.Apps = apps
+	}
+	if v, ok := data.GetOk("ttl"); ok {
+		role.TTL = time.Duration(v.(int)) * time.Second
+	}
+	if v, ok := data.GetOk("max_ttl"); ok {
+		role.MaxTTL = time.Duration(v.(int)) * time.Second
+	}
+
+	if len(role.Apps) == 0 {
+		return logical.ErrorResponse("apps must be a non-empty subset of sonarr/radarr/prowlarr"), nil
+	}
+	if role.MaxTTL != 0 && role.TTL > role.MaxTTL {
+		return logical.ErrorResponse("ttl must not be greater than max_ttl"), nil
+	}
+
+	if err := setRole(ctx, req.Storage, name, role); err != nil {
+		return nil, err
+	}
+	return nil, nil
+}
+
+func (b *arrstackBackend) pathRoleDelete(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	if err := req.Storage.Delete(ctx, roleStoragePrefix+data.Get("name").(string)); err != nil {
+		return nil, fmt.Errorf("error deleting arrstack role: %w", err)
+	}
+	return nil, nil
+}
+
+func (b *arrstackBackend) getRole(ctx context.Context, s logical.Storage, name string) (*arrstackRole, error) {
+	if name == "" {
+		return nil, fmt.Errorf("missing role name")
+	}
+	entry, err := s.Get(ctx, roleStoragePrefix+name)
+	if err != nil {
+		return nil, err
+	}
+	if entry == nil {
+		return nil, nil
+	}
+	role := &arrstackRole{}
+	if err := entry.DecodeJSON(role); err != nil {
+		return nil, err
+	}
+	return role, nil
+}
+
+func setRole(ctx context.Context, s logical.Storage, name string, role *arrstackRole) error {
+	entry, err := logical.StorageEntryJSON(roleStoragePrefix+name, role)
+	if err != nil {
+		return err
+	}
+	if entry == nil {
+		return fmt.Errorf("failed to create storage entry for role %q", name)
+	}
+	return s.Put(ctx, entry)
+}