unkinben
20613afb26
Add a Vault/OpenBao secrets engine that mints ephemeral, scoped Gitea access tokens on demand. The engine holds a single seeded Gitea site-admin Basic-Auth credential and, per role, mints a fresh per-user token via the admin API, bound to a Vault lease and deleted from Gitea on revocation. Gitea requires Basic Auth for token management (token auth is rejected), and reqSelfOrAdmin lets a site admin manage any user's tokens, which is the mechanism this relies on. Gitea tokens never expire server-side, so the Vault lease is the sole expiry mechanism. - add backend wiring, config (+ rotate-root), roles, creds paths - add the gitea client (Basic Auth create/delete token, admin password change) - add scope validation against Gitea's access-token scope set - add unit tests (fake Gitea API) and a Vault+OpenBao e2e harness - add Makefile, nfpm RPM packaging, and Woodpecker build/test/release pipelines Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
84 lines
2.4 KiB
Go
84 lines
2.4 KiB
Go
package gitea
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
const giteaTokenType = "gitea_token"
|
|
|
|
func (b *giteaBackend) giteaTokenSecret() *framework.Secret {
|
|
return &framework.Secret{
|
|
Type: giteaTokenType,
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"token": {
|
|
Type: framework.TypeString,
|
|
Description: "The Gitea access token value.",
|
|
},
|
|
"token_id": {
|
|
Type: framework.TypeString,
|
|
Description: "The Gitea access token id (used for deletion).",
|
|
},
|
|
"token_name": {
|
|
Type: framework.TypeString,
|
|
Description: "The Gitea access token name.",
|
|
},
|
|
"username": {
|
|
Type: framework.TypeString,
|
|
Description: "The Gitea user the token belongs to.",
|
|
},
|
|
},
|
|
Revoke: b.secretRevoke,
|
|
Renew: b.secretRenew,
|
|
}
|
|
}
|
|
|
|
// secretRevoke deletes the minted Gitea token via the admin API. Returning an
|
|
// error lets Vault retry revocation; a token that is already gone (404) is
|
|
// treated as success inside DeleteToken so retries converge.
|
|
func (b *giteaBackend) secretRevoke(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
|
|
tokenID, err := internalString(req.Secret.InternalData, "token_id")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
username, err := internalString(req.Secret.InternalData, "username")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
b.lock.RLock()
|
|
defer b.lock.RUnlock()
|
|
|
|
client, err := b.clientFor(ctx, req.Storage)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := client.DeleteToken(ctx, username, tokenID); err != nil {
|
|
return nil, fmt.Errorf("revoking gitea token %q for user %q: %w", tokenID, username, err)
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
// secretRenew extends the Vault lease; the token material is unchanged. Gitea
|
|
// tokens never expire server-side, so the lease alone bounds the lifetime and a
|
|
// renew within max_ttl simply postpones deletion.
|
|
func (b *giteaBackend) secretRenew(_ context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
|
|
return &logical.Response{Secret: req.Secret}, nil
|
|
}
|
|
|
|
func internalString(data map[string]interface{}, key string) (string, error) {
|
|
raw, ok := data[key]
|
|
if !ok {
|
|
return "", fmt.Errorf("secret is missing internal %s data", key)
|
|
}
|
|
s, ok := raw.(string)
|
|
if !ok {
|
|
return "", errors.New("secret internal " + key + " data is not a string")
|
|
}
|
|
return s, nil
|
|
}
|