-
Notifications
You must be signed in to change notification settings - Fork 2
/
secret_token.go
110 lines (94 loc) · 2.95 KB
/
secret_token.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
package cloudflare
import (
"context"
"errors"
"fmt"
"net/http"
"time"
"github.com/cloudflare/cloudflare-go"
"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/logical"
)
const (
SecretTokenType = "token"
)
func secretToken(b *backend) *framework.Secret {
return &framework.Secret{
Type: SecretTokenType,
Fields: map[string]*framework.FieldSchema{
"token": &framework.FieldSchema{
Type: framework.TypeString,
Description: "cloudflare API token",
},
"id": &framework.FieldSchema{
Type: framework.TypeString,
Description: "ID of the API Token",
},
},
Renew: b.secretTokenRenew,
Revoke: b.secretTokenRevoke,
}
}
func (b *backend) secretTokenRenew(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
c, err := b.client(ctx, req.Storage)
if err != nil {
return nil, err
}
if c == nil {
return nil, fmt.Errorf("error getting cloudflare client")
}
lease, err := b.LeaseConfig(ctx, req.Storage)
if err != nil {
return nil, err
}
if lease == nil {
lease = &configLease{}
}
id, ok := req.Secret.InternalData["id"]
if !ok {
return nil, fmt.Errorf("id is missing on the lease")
}
ttl, _, err := framework.CalculateTTL(b.System(), req.Secret.Increment, lease.TTL, 0, lease.MaxTTL, 0, req.Secret.IssueTime)
if err != nil {
return logical.ErrorResponse("failed to caluclate ttl. err: %s", err), nil
}
// Adding a small buffer since the TTL will be calculated again after this
// call to ensure the credential do not expire before the lease
expirationDate := time.Now().UTC().Truncate(time.Second)
if ttl > 0 {
expirationDate = expirationDate.Add(ttl).Add(time.Minute * 1)
}
updatedAPIToken := cloudflare.APIToken{ExpiresOn: &expirationDate}
_, err = c.UpdateAPIToken(ctx, id.(string), updatedAPIToken)
if err != nil {
return logical.ErrorResponse("failed to update token with new expiration date. err: %s", err), nil
}
resp := &logical.Response{Secret: req.Secret}
resp.Secret.TTL = lease.TTL
resp.Secret.MaxTTL = lease.MaxTTL
return resp, nil
}
func (b *backend) secretTokenRevoke(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
c, err := b.client(ctx, req.Storage)
if err != nil {
return nil, err
}
if c == nil {
return nil, fmt.Errorf("error getting cloudflare client")
}
id, ok := req.Secret.InternalData["id"]
if !ok {
return nil, fmt.Errorf("id is missing on the lease")
}
b.Logger().Info(fmt.Sprintf("Revoking cloudflare token (%s)...", id))
err = c.DeleteAPIToken(ctx, id.(string))
if err != nil {
var responseError *cloudflare.APIRequestError
// If cloudflare returns 404 that means the token is already deleted
if errors.As(err, &responseError) && responseError.HTTPStatusCode() == http.StatusNotFound {
return nil, nil
}
return logical.ErrorResponse(fmt.Sprintf("failed to revoke cloudflare token (%s). err: %s", id, err)), nil
}
return nil, nil
}