From 02ddcd1f69cf04c2fd833f7369f90a13c535e6ad Mon Sep 17 00:00:00 2001
From: Mark Paluch <mpaluch@pivotal.io>
Date: Tue, 20 Mar 2018 11:45:17 +0100
Subject: [PATCH] Drop VaultToken on infrastructure errors during renewal.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We now drop the VaultToken if an infrastructure error (connection refused/connection timeout/read timeout/…) occurs. Dropping the token prevents usage of an expired token.

Closes gh-222.
---
 .../LifecycleAwareSessionManager.java         | 23 ++++++++++++-------
 ...LifecycleAwareSessionManagerUnitTests.java | 21 +++++++++++++++++
 2 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/LifecycleAwareSessionManager.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/LifecycleAwareSessionManager.java
index 763a9786..998b8f20 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/LifecycleAwareSessionManager.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/LifecycleAwareSessionManager.java
@@ -37,7 +37,6 @@ import org.springframework.vault.client.VaultResponses;
 import org.springframework.vault.support.VaultResponse;
 import org.springframework.vault.support.VaultToken;
 import org.springframework.web.client.HttpStatusCodeException;
-import org.springframework.web.client.RestClientException;
 import org.springframework.web.client.RestOperations;
 
 /**
@@ -195,18 +194,26 @@ public class LifecycleAwareSessionManager implements SessionManager, DisposableB
 		}
 		catch (HttpStatusCodeException e) {
 
+			logger.debug(String.format(
+					"Cannot renew token, resetting token and performing re-login: %s",
+					VaultResponses.getError(e.getResponseBodyAsString())));
+			this.token = null;
+
 			if (e.getStatusCode().is4xxClientError()) {
-				logger.debug(String
-						.format("Cannot refresh token, resetting token and performing re-login: %s",
-								VaultResponses.getError(e.getResponseBodyAsString())));
-				this.token = null;
 				return false;
 			}
 
-			throw new VaultException(VaultResponses.getError(e.getResponseBodyAsString()));
+			throw new VaultException(String.format("Cannot renew token: %s",
+					VaultResponses.getError(e.getResponseBodyAsString())));
 		}
-		catch (RestClientException e) {
-			throw new VaultException("Cannot refresh token", e);
+		catch (RuntimeException e) {
+
+			logger.debug(String.format(
+					"Cannot renew token, resetting token and performing re-login: %s",
+					e.toString()));
+			this.token = null;
+
+			throw new VaultException("Cannot renew token", e);
 		}
 	}
 
diff --git a/spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerUnitTests.java b/spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerUnitTests.java
index 4f3863ff..fced481f 100644
--- a/spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerUnitTests.java
+++ b/spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerUnitTests.java
@@ -37,6 +37,7 @@ import org.springframework.vault.client.VaultHttpHeaders;
 import org.springframework.vault.support.VaultResponse;
 import org.springframework.vault.support.VaultToken;
 import org.springframework.web.client.HttpServerErrorException;
+import org.springframework.web.client.ResourceAccessException;
 import org.springframework.web.client.RestOperations;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -211,6 +212,26 @@ public class LifecycleAwareSessionManagerUnitTests {
 		verify(clientAuthentication, times(2)).login();
 	}
 
+	@Test
+	public void shouldReLoginIfRenewalFails() {
+
+		when(clientAuthentication.login()).thenReturn(
+				LoginToken.renewable("login".toCharArray(), 5),
+				LoginToken.renewable("bar".toCharArray(), 5));
+		when(restOperations.postForObject(anyString(), any(), eq(VaultResponse.class)))
+				.thenThrow(new ResourceAccessException("Connection refused"));
+
+		ArgumentCaptor<Runnable> runnableCaptor = ArgumentCaptor.forClass(Runnable.class);
+		sessionManager.getSessionToken();
+		verify(taskScheduler).schedule(runnableCaptor.capture(), any(Trigger.class));
+		runnableCaptor.getValue().run();
+
+		assertThat(sessionManager.getSessionToken()).isEqualTo(
+				LoginToken.renewable("bar".toCharArray(), 5));
+
+		verify(clientAuthentication, times(2)).login();
+	}
+
 	@Test
 	public void shouldUseTaskScheduler() {