Documentation
¶
Index ¶
- func IsForbidden(err error) bool
- func ReadSecondsField(data map[string]any, key string) (int64, bool)
- type Client
- func (c *Client) CreateChildToken(ctx context.Context, policies []string, noDefaultPolicy bool) (string, error)
- func (c *Client) CreateChildTokenFor(ctx context.Context, parentToken string, policies []string, ...) (string, error)
- func (c *Client) DeleteKVv2(ctx context.Context, mount, path string) error
- func (c *Client) EnableKVv2(ctx context.Context, path string) error
- func (c *Client) IssueCertificate(ctx context.Context, mount, role, commonName, ttl string) (*IssuedCert, error)
- func (c *Client) ListKVv2(ctx context.Context, mount, path string) ([]string, error)
- func (c *Client) LoginCert(ctx context.Context, mount, role string) error
- func (c *Client) LoginLDAP(ctx context.Context, mount, username, password string) (*LoginResult, error)
- func (c *Client) LookupSelf(ctx context.Context) (*vaultapi.Secret, error)
- func (c *Client) NewSibling(token string) (*Client, error)
- func (c *Client) Raw() *vaultapi.Client
- func (c *Client) ReadKVv2(ctx context.Context, mount, path string) (*Secret, error)
- func (c *Client) RenewSelf(ctx context.Context, increment int) (*vaultapi.Secret, error)
- func (c *Client) ServerHealth(ctx context.Context) (*HealthResponse, error)
- func (c *Client) SetToken(token string)
- func (c *Client) SignCSR(ctx context.Context, mount, role, csrPEM, commonName, ttl string) (*IssuedCert, error)
- func (c *Client) SubscribeEvents(ctx context.Context, eventType string) (<-chan Event, <-chan error, error)
- func (c *Client) Token() string
- func (c *Client) ValidateMFA(ctx context.Context, mfaRequestID, methodID, passcode string) (string, error)
- func (c *Client) WriteKVv2(ctx context.Context, mount, path string, data map[string]any) error
- type Config
- type Event
- type HealthResponse
- type IssuedCert
- type LoginResult
- type MFAMethod
- type Secret
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsForbidden ¶
IsForbidden returns true if the error is a Vault 403 response, indicating the token is invalid, revoked, or lacks permissions.
func ReadSecondsField ¶
ReadSecondsField extracts an integer-seconds value from a Vault secret data map, handling the json.Number / float64 / int variants the underlying decoder may produce. Returns (0, false) when the key is missing or the value isn't a parseable number.
Lives in internal/vault because every call site is reading a field off a *vaultapi.Secret's data map. Used by the lifecycle manager for ttl / creation_ttl and by the CLI login-check for the same fields; centralising avoids the duplicated type switch silently diverging (e.g. when a future Vault SDK change introduces a uint64 wire form).
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client wraps the Vault API client.
func (*Client) CreateChildToken ¶ added in v0.25.0
func (c *Client) CreateChildToken(ctx context.Context, policies []string, noDefaultPolicy bool) (string, error)
CreateChildToken mints a child of the currently-set token, restricted to the given policies and (optionally) without the implicit `default` policy. It is the least-privilege downscoping primitive: a freshly-minted login token carries every policy the auth role granted, and exchanging it for a narrower child shrinks the blast radius of a leaked cached token. Vault enforces that the requested policies are a subset of the parent token's own policies, so this can only ever drop privilege, never escalate it.
The child is renewable so the lifecycle manager can keep it alive; its TTL is the Vault default for the parent (no explicit ttl is requested). A DisplayName of "dotvault" is set so the downscoped tokens are recognisable in Vault's audit log.
func (*Client) CreateChildTokenFor ¶ added in v0.25.0
func (c *Client) CreateChildTokenFor(ctx context.Context, parentToken string, policies []string, noDefaultPolicy bool) (string, error)
CreateChildTokenFor mints a child of parentToken without disturbing the receiver's own token. It builds an isolated sibling client (NewSibling: same address/TLS/client-cert, parentToken as the auth token) and creates the child there.
This isolation is load-bearing for the downscope flow: minting on the shared client would require installing the broad parent token on it first, and a failure mid-mint (or a concurrent reader on the web server) could then observe — or persist — that broad token. The sibling carries the client certificate too, so on an mTLS deployment that requires a client cert on every Vault request the auth/token/create call still succeeds.
func (*Client) DeleteKVv2 ¶
DeleteKVv2 deletes all versions of a KVv2 secret (the full metadata record, not just a soft-delete of the latest version). Used by the refresh manager when the upstream credential has been permanently revoked and the local state needs to be wiped so the user can re-enrol.
func (*Client) EnableKVv2 ¶
EnableKVv2 enables a KVv2 secrets engine at the given path. Used for testing. Returns an error if it already exists (non-fatal).
func (*Client) IssueCertificate ¶ added in v0.23.0
func (c *Client) IssueCertificate(ctx context.Context, mount, role, commonName, ttl string) (*IssuedCert, error)
IssueCertificate asks the PKI engine to generate a keypair and certificate. Used only when the PKI role forbids the sign endpoint; the returned PrivateKeyPEM must be handed to the secure store immediately.
func (*Client) LoginCert ¶ added in v0.23.0
LoginCert authenticates via the TLS cert auth method. The client must have been built with a ClientCert so the certificate is presented during the handshake; Vault matches it against the registered CA and the named role's policies. On success the returned token is adopted onto the client.
func (*Client) LoginLDAP ¶
func (c *Client) LoginLDAP(ctx context.Context, mount, username, password string) (*LoginResult, error)
LoginLDAP authenticates via LDAP and detects if MFA is required.
func (*Client) LookupSelf ¶
LookupSelf returns the current token's metadata, or an error if invalid.
func (*Client) NewSibling ¶ added in v0.25.0
NewSibling builds an isolated client that shares this client's connection settings (address, CA, TLS-skip, and the client certificate) but carries the given token instead of this client's. It is the seam for operations that must run under a different token without disturbing the shared client: the least-privilege downscope mint (CreateChildTokenFor) and the mTLS bootstrap login both use it so a broad token is never installed on the shared, web-exposed client.
The client certificate is carried so that on a Vault listener configured to require a client cert on every request, the sibling's calls still present it.
func (*Client) ReadKVv2 ¶
ReadKVv2 reads a KVv2 secret at the given mount and path. Returns nil (not error) if the secret doesn't exist.
func (*Client) ServerHealth ¶
func (c *Client) ServerHealth(ctx context.Context) (*HealthResponse, error)
ServerHealth returns the Vault server health status.
func (*Client) SignCSR ¶ added in v0.23.0
func (c *Client) SignCSR(ctx context.Context, mount, role, csrPEM, commonName, ttl string) (*IssuedCert, error)
SignCSR submits a CSR to the PKI engine's sign endpoint and returns the signed certificate. The private key behind the CSR never leaves the host — this is the preferred issuance path for both mtls and mtls+tpm.
func (*Client) SubscribeEvents ¶
func (c *Client) SubscribeEvents(ctx context.Context, eventType string) (<-chan Event, <-chan error, error)
SubscribeEvents connects to the Vault Events API via WebSocket and returns a channel of events and an error channel. The caller should cancel the context to disconnect.
func (*Client) ValidateMFA ¶
func (c *Client) ValidateMFA(ctx context.Context, mfaRequestID, methodID, passcode string) (string, error)
ValidateMFA validates an MFA challenge. For push methods (Duo), pass an empty passcode — the call blocks until the user approves or the context is cancelled. For TOTP, pass the user-provided code. Returns the authenticated client token on success.
type Config ¶
type Config struct {
Address string
Token string
CACert string
TLSSkipVerify bool
// ClientCert, when non-nil, is presented during the TLS handshake. It is
// used by the cert auth method (mtls / mtls+tpm): the certificate's
// private key may be a hardware-backed crypto.Signer, so GetClientCertificate
// invokes it lazily per handshake rather than holding key bytes.
ClientCert *tls.Certificate
}
Config holds Vault connection settings.
type HealthResponse ¶
HealthResponse contains selected fields from the Vault health endpoint.
type IssuedCert ¶ added in v0.23.0
type IssuedCert struct {
// CertPEM is the leaf certificate followed by any CA chain, PEM-encoded.
CertPEM string
// PrivateKeyPEM is populated only by IssueCertificate (Vault generates the
// key). SignCSR leaves it empty because the key never left the host.
PrivateKeyPEM string
// Serial is the certificate serial number, for audit/revocation.
Serial string
}
IssuedCert is the result of a PKI issue or sign operation.
type LoginResult ¶
type LoginResult struct {
Token string
MFARequired bool
MFARequestID string
MFAMethods []MFAMethod
}
LoginResult holds the outcome of an LDAP login attempt.
Source Files