vaultclient

type MockVaultClient struct {
	// StoppedTokens tracks the tokens that have stopped renewing
	StoppedTokens []string

	// RenewTokens are the tokens that have been renewed and their error
	// channels
	RenewTokens map[string]chan error

	// RenewTokenErrors is used to return an error when the RenewToken is called
	// with the given token
	RenewTokenErrors map[string]error

	// DeriveTokenErrors maps an allocation ID and tasks to an error when the
	// token is derived
	DeriveTokenErrors map[string]map[string]error

	// DeriveTokenFn allows the caller to control the DeriveToken function. If
	// not set an error is returned if found in DeriveTokenErrors and otherwise
	// a token is generated and returned
	DeriveTokenFn func(a *structs.Allocation, tasks []string) (map[string]string, error)
}

type TokenDeriverFunc func(*structs.Allocation, []string, *vaultapi.Client) (map[string]string, error)

type VaultClient interface {
	// Start initiates the renewal loop of tokens and secrets
	Start()

	// Stop terminates the renewal loop for tokens and secrets
	Stop()

	// DeriveToken contacts the nomad server and fetches wrapped tokens for
	// a set of tasks. The wrapped tokens will be unwrapped using vault and
	// returned.
	DeriveToken(*structs.Allocation, []string) (map[string]string, error)

	// GetConsulACL fetches the Consul ACL token required for the task
	GetConsulACL(string, string) (*vaultapi.Secret, error)

	// RenewToken renews a token with the given increment and adds it to
	// the min-heap for periodic renewal.
	RenewToken(string, int) (<-chan error, error)

	// StopRenewToken removes the token from the min-heap, stopping its
	// renewal.
	StopRenewToken(string) error

	// RenewLease renews a vault secret's lease and adds the lease
	// identifier to the min-heap for periodic renewal.
	RenewLease(string, int) (<-chan error, error)

	// StopRenewLease removes a secret's lease ID from the min-heap,
	// stopping its renewal.
	StopRenewLease(string) error
}