disinto-admin/disinto
1
0
Fork 0
Code Issues 17 Pull requests Projects Releases Packages Wiki Activity Actions

fix: lib/hvault.sh uses secret/ mount prefix but migration policies use kv/ — agents will get 403 (#890) #909

Merged
dev-qwen2 merged 1 commit from fix/issue-890 into main 2026-04-16 19:49:22 +00:00
Conversation 2 Commits 1 Files changed 2 +11 -6
2 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 5fd36e94bb - Show all commits

11
lib/hvault.sh
View file

@ -100,6 +100,11 @@ _hvault_request() {
# ── Public API ─────────────────────────────────────────────────────────────── # ── Public API ───────────────────────────────────────────────────────────────
# VAULT_KV_MOUNT — KV v2 mount point (default: "kv")
# Override with: export VAULT_KV_MOUNT=secret
# Used by: hvault_kv_get, hvault_kv_put, hvault_kv_list
: "${VAULT_KV_MOUNT:=kv}"
# hvault_kv_get PATH [KEY] # hvault_kv_get PATH [KEY]
# Read a KV v2 secret at PATH, optionally extract a single KEY. # Read a KV v2 secret at PATH, optionally extract a single KEY.
# Outputs: JSON value (full data object, or single key value) # Outputs: JSON value (full data object, or single key value)
@ -114,7 +119,7 @@ hvault_kv_get() {
_hvault_check_prereqs "hvault_kv_get" || return 1 _hvault_check_prereqs "hvault_kv_get" || return 1
local response local response
response="$(_hvault_request GET "secret/data/${path}")" || return 1 response="$(_hvault_request GET "${VAULT_KV_MOUNT}/data/${path}")" || return 1
if [ -n "$key" ]; then if [ -n "$key" ]; then
printf '%s' "$response" | jq -e -r --arg key "$key" '.data.data[$key]' 2>/dev/null || { printf '%s' "$response" | jq -e -r --arg key "$key" '.data.data[$key]' 2>/dev/null || {
@ -154,7 +159,7 @@ hvault_kv_put() {
payload="$(printf '%s' "$payload" | jq --arg k "$k" --arg v "$v" '.data[$k] = $v')" payload="$(printf '%s' "$payload" | jq --arg k "$k" --arg v "$v" '.data[$k] = $v')"
done done
_hvault_request POST "secret/data/${path}" "$payload" >/dev/null _hvault_request POST "${VAULT_KV_MOUNT}/data/${path}" "$payload" >/dev/null
} }
# hvault_kv_list PATH # hvault_kv_list PATH
@ -170,7 +175,7 @@ hvault_kv_list() {
_hvault_check_prereqs "hvault_kv_list" || return 1 _hvault_check_prereqs "hvault_kv_list" || return 1
local response local response
response="$(_hvault_request LIST "secret/metadata/${path}")" || return 1 response="$(_hvault_request LIST "${VAULT_KV_MOUNT}/metadata/${path}")" || return 1
printf '%s' "$response" | jq -e '.data.keys' 2>/dev/null || { printf '%s' "$response" | jq -e '.data.keys' 2>/dev/null || {
_hvault_err "hvault_kv_list" "failed to parse response" "path=$path" _hvault_err "hvault_kv_list" "failed to parse response" "path=$path"

6
tests/lib-hvault.bats
View file

@ -126,7 +126,7 @@ setup() {
@test "hvault_policy_apply creates a policy" { @test "hvault_policy_apply creates a policy" {
local pfile="${BATS_TEST_TMPDIR}/test-policy.hcl" local pfile="${BATS_TEST_TMPDIR}/test-policy.hcl"
cat > "$pfile" <<'HCL' cat > "$pfile" <<'HCL'
path "secret/data/test/*" { path "kv/data/test/*" {
capabilities = ["read"] capabilities = ["read"]
} }
HCL HCL
@ -138,12 +138,12 @@ HCL
run curl -sf -H "X-Vault-Token: ${VAULT_TOKEN}" \ run curl -sf -H "X-Vault-Token: ${VAULT_TOKEN}" \
"${VAULT_ADDR}/v1/sys/policies/acl/test-reader" "${VAULT_ADDR}/v1/sys/policies/acl/test-reader"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
echo "$output" | jq -e '.data.policy' | grep -q "secret/data/test" echo "$output" | jq -e '.data.policy' | grep -q "kv/data/test"
} }
@test "hvault_policy_apply is idempotent" { @test "hvault_policy_apply is idempotent" {
local pfile="${BATS_TEST_TMPDIR}/idem-policy.hcl" local pfile="${BATS_TEST_TMPDIR}/idem-policy.hcl"
printf 'path "secret/*" { capabilities = ["list"] }\n' > "$pfile" printf 'path "kv/*" { capabilities = ["list"] }\n' > "$pfile"
run hvault_policy_apply "idem-policy" "$pfile" run hvault_policy_apply "idem-policy" "$pfile"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]