unkin-agent
64d9b89dcd
Mints ephemeral, scoped ghp access tokens via ghp's admin token API
(POST /api/tokens), bound to a Vault lease and revoked on lease
expiry (DELETE /api/tokens/{id}).
- config: base_url + write-only admin_token (ghpsvc_ service token),
TLS settings; verifies the token is a ghp admin on write. No
rotate-root: the service token is static and operator-managed.
- roles: token_type (agent/proxy), installation_id, app_record_id,
repositories, scopes (permission:level), session_prefix, ttl/max_ttl.
- creds: mint a lease-bound token; ghp-side duration bounded by the
lease ceiling as defence in depth.
- secret ghp_token: idempotent revoke + lease renew.
- Unit tests (config/role/creds/client/scopes/revocation), mock-ghp
e2e on Vault + OpenBao, Woodpecker pre-commit/build/test/release,
Makefile patch/minor/major, nfpm RPM packaging.
93 lines
2.7 KiB
Go
93 lines
2.7 KiB
Go
package ghp
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
const ghpTokenType = "ghp_token"
|
|
|
|
func (b *ghpBackend) ghpTokenSecret() *framework.Secret {
|
|
return &framework.Secret{
|
|
Type: ghpTokenType,
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"token": {
|
|
Type: framework.TypeString,
|
|
Description: "The ghp access token value.",
|
|
},
|
|
"token_id": {
|
|
Type: framework.TypeString,
|
|
Description: "The ghp token id (used for revocation).",
|
|
},
|
|
"token_type": {
|
|
Type: framework.TypeString,
|
|
Description: "The ghp token type (agent or proxy).",
|
|
},
|
|
"repositories": {
|
|
Type: framework.TypeCommaStringSlice,
|
|
Description: "Repositories the token is scoped to.",
|
|
},
|
|
"scopes": {
|
|
Type: framework.TypeKVPairs,
|
|
Description: "Permission:level scopes granted to the token.",
|
|
},
|
|
"expires_at": {
|
|
Type: framework.TypeString,
|
|
Description: "The ghp server-side expiry timestamp (RFC3339), if any.",
|
|
},
|
|
"session_id": {
|
|
Type: framework.TypeString,
|
|
Description: "The ghp session id assigned to the token.",
|
|
},
|
|
"base_url": {
|
|
Type: framework.TypeString,
|
|
Description: "The ghp base URL the token authenticates against.",
|
|
},
|
|
},
|
|
Revoke: b.secretRevoke,
|
|
Renew: b.secretRenew,
|
|
}
|
|
}
|
|
|
|
// secretRevoke deletes the minted ghp token via the admin API. Returning an
|
|
// error lets Vault retry; a token already gone (404) is treated as success
|
|
// inside RevokeToken so retries converge.
|
|
func (b *ghpBackend) secretRevoke(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
|
|
tokenID, err := internalString(req.Secret.InternalData, "token_id")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
client, err := b.clientFor(ctx, req.Storage)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := client.RevokeToken(ctx, tokenID); err != nil {
|
|
return nil, fmt.Errorf("revoking ghp token %q: %w", tokenID, err)
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
// secretRenew extends the Vault lease; the token material is unchanged. The
|
|
// ghp-side duration was set to the lease ceiling at mint time, so a renew within
|
|
// max_ttl simply postpones deletion without outliving the server-side expiry.
|
|
func (b *ghpBackend) secretRenew(_ context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
|
|
return &logical.Response{Secret: req.Secret}, nil
|
|
}
|
|
|
|
func internalString(data map[string]interface{}, key string) (string, error) {
|
|
raw, ok := data[key]
|
|
if !ok {
|
|
return "", fmt.Errorf("secret is missing internal %s data", key)
|
|
}
|
|
s, ok := raw.(string)
|
|
if !ok {
|
|
return "", errors.New("secret internal " + key + " data is not a string")
|
|
}
|
|
return s, nil
|
|
}
|