Scaffold ghp secrets engine modelled on vault-plugin-secrets-gitea

Mints ephemeral, scoped ghp access tokens via ghp's admin token API
(POST /api/tokens), bound to a Vault lease and revoked on lease
expiry (DELETE /api/tokens/{id}).

- config: base_url + write-only admin_token (ghpsvc_ service token),
  TLS settings; verifies the token is a ghp admin on write. No
  rotate-root: the service token is static and operator-managed.
- roles: token_type (agent/proxy), installation_id, app_record_id,
  repositories, scopes (permission:level), session_prefix, ttl/max_ttl.
- creds: mint a lease-bound token; ghp-side duration bounded by the
  lease ceiling as defence in depth.
- secret ghp_token: idempotent revoke + lease renew.
- Unit tests (config/role/creds/client/scopes/revocation), mock-ghp
  e2e on Vault + OpenBao, Woodpecker pre-commit/build/test/release,
  Makefile patch/minor/major, nfpm RPM packaging.

path_creds.go

@@ -0,0 +1,123 @@
+package ghp
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func pathCredentials(b *ghpBackend) *framework.Path {
+	return &framework.Path{
+		Pattern: "creds/" + framework.GenericNameRegex("name"),
+		DisplayAttrs: &framework.DisplayAttributes{
+			OperationPrefix: "ghp",
+			OperationSuffix: "credentials",
+		},
+		Fields: map[string]*framework.FieldSchema{
+			"name": {
+				Type:        framework.TypeLowerCaseString,
+				Description: "Name of the role to mint a token for.",
+				Required:    true,
+			},
+		},
+		Operations: map[logical.Operation]framework.OperationHandler{
+			logical.ReadOperation:   &framework.PathOperation{Callback: b.pathCredentialsRead},
+			logical.UpdateOperation: &framework.PathOperation{Callback: b.pathCredentialsRead},
+		},
+		HelpSynopsis:    "Mint a short-lived ghp token from a role.",
+		HelpDescription: "Reading this path mints a new, lease-bound ghp token for the role; the token is deleted from ghp when the lease is revoked.",
+	}
+}
+
+func (b *ghpBackend) pathCredentialsRead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	roleName := data.Get("name").(string)
+
+	role, err := b.getRole(ctx, req.Storage, roleName)
+	if err != nil {
+		return nil, err
+	}
+	if role == nil {
+		return logical.ErrorResponse("role %q does not exist", roleName), nil
+	}
+
+	config, err := getConfig(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+	if config == nil {
+		return nil, errBackendNotConfigured
+	}
+
+	client, err := newClient(config)
+	if err != nil {
+		return nil, err
+	}
+
+	ttl, maxTTL := b.resolveTTLs(role.TTL, role.MaxTTL)
+
+	suffix, err := uuid.GenerateUUID()
+	if err != nil {
+		return nil, fmt.Errorf("generating session id suffix: %w", err)
+	}
+	sessionID := fmt.Sprintf("%s-%s-%s", role.sessionPrefix(), roleName, suffix[:8])
+
+	createReq := createTokenRequest{
+		Type:         role.tokenType(),
+		Repositories: role.Repositories,
+		Scopes:       scopeString(role.Scopes),
+		// Bound the ghp-side expiry to the lease ceiling so the token self-expires
+		// even if lease revocation never reaches ghp; the lease remains primary.
+		Duration:  maxTTL.String(),
+		SessionID: sessionID,
+	}
+	if role.tokenType() == tokenTypeAgent {
+		createReq.InstallationID = role.InstallationID
+		createReq.AppRecordID = role.AppRecordID
+	}
+
+	out, err := client.CreateToken(ctx, createReq)
+	if err != nil {
+		return nil, fmt.Errorf("minting ghp token: %w", err)
+	}
+
+	internal := map[string]interface{}{
+		"token_id": out.ID,
+	}
+	external := map[string]interface{}{
+		"token":        out.Token,
+		"token_id":     out.ID,
+		"token_type":   out.Type,
+		"repositories": out.Repositories,
+		"scopes":       out.Scopes,
+		"expires_at":   out.ExpiresAt,
+		"session_id":   out.SessionID,
+		"base_url":     config.BaseURL,
+	}
+
+	resp := b.Secret(ghpTokenType).Response(external, internal)
+	resp.Secret.TTL = ttl
+	resp.Secret.MaxTTL = maxTTL
+	resp.Secret.Renewable = true
+	return resp, nil
+}
+
+// resolveTTLs clamps a role's TTL/MaxTTL against the mount and system limits.
+func (b *ghpBackend) resolveTTLs(roleTTL, roleMaxTTL time.Duration) (ttl, maxTTL time.Duration) {
+	sysMaxTTL := b.System().MaxLeaseTTL()
+	maxTTL = roleMaxTTL
+	if maxTTL <= 0 || maxTTL > sysMaxTTL {
+		maxTTL = sysMaxTTL
+	}
+	ttl = roleTTL
+	if ttl <= 0 {
+		ttl = b.System().DefaultLeaseTTL()
+	}
+	if ttl > maxTTL {
+		ttl = maxTTL
+	}
+	return ttl, maxTTL
+}