unkin-agent
3418cfd8f6
Mint dynamic arrproxy machine tokens via arrproxy's bearer-gated admin API so Terraform-driven *arr onboarding can issue and revoke per-role tokens non-interactively. - Add backend, config, roles, creds paths and the arrstack_token secret - Call POST/DELETE /api/admin/tokens with a vault:arrstack:<role> subject - Enforce apps as a non-empty subset of sonarr/radarr/prowlarr - Cap lease renewal at the arrproxy token's fixed expiry - Add table-driven unit tests against a fake arrproxy admin server - Add Makefile, nfpm packaging, and pre-commit/build/test/release pipelines
108 lines
2.8 KiB
Go
108 lines
2.8 KiB
Go
package arrstack
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
// arrstackTokenType is the identifier for the dynamic secret produced by this
|
|
// backend.
|
|
const arrstackTokenType = "arrstack_token"
|
|
|
|
func (b *arrstackBackend) arrstackToken() *framework.Secret {
|
|
return &framework.Secret{
|
|
Type: arrstackTokenType,
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"token": {
|
|
Type: framework.TypeString,
|
|
Description: "The arrproxy machine token.",
|
|
},
|
|
"id": {
|
|
Type: framework.TypeString,
|
|
Description: "The arrproxy token id (used for revocation).",
|
|
},
|
|
},
|
|
Revoke: b.tokenRevoke,
|
|
Renew: b.tokenRenew,
|
|
}
|
|
}
|
|
|
|
// tokenRevoke disables the token in arrproxy when the lease is revoked.
|
|
func (b *arrstackBackend) tokenRevoke(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
|
|
rawID, ok := req.Secret.InternalData["id"]
|
|
if !ok {
|
|
return nil, errors.New("secret is missing internal id data")
|
|
}
|
|
id, ok := rawID.(string)
|
|
if !ok {
|
|
return nil, errors.New("secret internal id data is not a string")
|
|
}
|
|
|
|
client, err := b.getClient(ctx, req.Storage)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if err := client.RevokeToken(ctx, id); err != nil {
|
|
return nil, fmt.Errorf("revoking arrproxy token: %w", err)
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
// tokenRenew extends the lease honoring the role's max_ttl. The arrproxy token
|
|
// has a fixed expiry set at mint time, so a renewal can never push the lease
|
|
// past that expiry: the new TTL is capped at the remaining time to expiry, and
|
|
// an already-expired token is not extended.
|
|
func (b *arrstackBackend) tokenRenew(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
|
|
resp := &logical.Response{Secret: req.Secret}
|
|
|
|
rawRole, ok := req.Secret.InternalData["role"]
|
|
if !ok {
|
|
return nil, errors.New("secret is missing internal role data")
|
|
}
|
|
roleName, ok := rawRole.(string)
|
|
if !ok {
|
|
return nil, errors.New("secret internal role data is not a string")
|
|
}
|
|
|
|
role, err := b.getRole(ctx, req.Storage, roleName)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if role == nil {
|
|
return nil, fmt.Errorf("role %q no longer exists; cannot renew", roleName)
|
|
}
|
|
|
|
remaining := time.Duration(-1)
|
|
if rawExp, ok := req.Secret.InternalData["expires_at"].(string); ok {
|
|
if expiresAt, err := time.Parse(time.RFC3339, rawExp); err == nil {
|
|
remaining = time.Until(expiresAt)
|
|
}
|
|
}
|
|
|
|
// The token has already reached its fixed expiry: do not extend.
|
|
if remaining <= 0 {
|
|
resp.Secret.TTL = 0
|
|
return resp, nil
|
|
}
|
|
|
|
ttl := role.TTL
|
|
if ttl <= 0 {
|
|
ttl = req.Secret.TTL
|
|
}
|
|
if ttl <= 0 || ttl > remaining {
|
|
ttl = remaining
|
|
}
|
|
resp.Secret.TTL = ttl
|
|
if role.MaxTTL > 0 {
|
|
resp.Secret.MaxTTL = role.MaxTTL
|
|
}
|
|
|
|
return resp, nil
|
|
}
|