Adapt Vault API changes in transit key value/configuration objects.

We now support min encryption/decryption versions via key configuration and expose these along with key capabilities through VaultTransitKey and VaultTransitKeyConfiguration.

Closes gh-124.

spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java

@@ -439,6 +439,8 @@ public class VaultTransitTemplate implements VaultTransitOperations {
 	@Data
 	static class VaultTransitKeyImpl implements VaultTransitKey {
 
+		private String name;
+
 		@JsonProperty("cipher_mode")
 		private String cipherMode;
 
@@ -460,7 +462,20 @@ public class VaultTransitTemplate implements VaultTransitOperations {
 		@JsonProperty("min_decryption_version")
 		private int minDecryptionVersion;
 
-		private String name;
+		@JsonProperty("min_encryption_version")
+		private int minEncryptionVersion;
+
+		@JsonProperty("supports_decryption")
+		private boolean supportsDecryption;
+
+		@JsonProperty("supports_encryption")
+		private boolean supportsEncryption;
+
+		@JsonProperty("supports_derivation")
+		private boolean supportsDerivation;
+
+		@JsonProperty("supports_signing")
+		private boolean supportsSigning;
 
 		@Override
 		public String getType() {
@@ -471,6 +486,26 @@ public class VaultTransitTemplate implements VaultTransitOperations {
 
 			return this.cipherMode;
 		}
+
+		@Override
+		public boolean supportsDecryption() {
+			return isSupportsDecryption();
+		}
+
+		@Override
+		public boolean supportsEncryption() {
+			return isSupportsEncryption();
+		}
+
+		@Override
+		public boolean supportsDerivation() {
+			return isSupportsDerivation();
+		}
+
+		@Override
+		public boolean supportsSigning() {
+			return isSupportsSigning();
+		}
 	}
 
 	@Data

spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java

@@ -25,6 +25,16 @@ import java.util.Map;
  */
 public interface VaultTransitKey {
 
+	/**
+	 * @return name of the key
+	 */
+	String getName();
+
+	/**
+	 * @return the key type ({@code aes-gcm}, {@code ecdsa-p256}, ...).
+	 */
+	String getType();
+
 	/**
 	 * @return {@literal true} if deletion of the key is allowed. Key deletion must be
 	 * turned on to make keys deletable.
@@ -57,12 +67,32 @@ public interface VaultTransitKey {
 	int getMinDecryptionVersion();
 
 	/**
-	 * @return name of the key
+	 * @return required key version to encrypt data.
+	 * @since 1.1
 	 */
-	String getName();
+	int getMinEncryptionVersion();
 
 	/**
-	 * @return the key type ({@code aes-gcm}, {@code ecdsa-p256}, ...).
+	 * @return whether the key supports decryption.
+	 * @since 1.1
 	 */
-	String getType();
+	boolean supportsDecryption();
+
+	/**
+	 * @return whether the key supports encryption.
+	 * @since 1.1
+	 */
+	boolean supportsEncryption();
+
+	/**
+	 * @return whether the key supports derivation.
+	 * @since 1.1
+	 */
+	boolean supportsDerivation();
+
+	/**
+	 * @return whether the key supports signing.
+	 * @since 1.1
+	 */
+	boolean supportsSigning();
 }

spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 the original author or authors.
+ * Copyright 2016-2017 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -30,9 +30,19 @@ public class VaultTransitKeyConfiguration {
 	@JsonProperty("latest_version")
 	private final Integer latestVersion;
 
-	private VaultTransitKeyConfiguration(Boolean deletionAllowed, Integer latestVersion) {
+	@JsonProperty("min_decryption_version")
+	private final Integer minDecryptionVersion;
+
+	@JsonProperty("min_encryption_version")
+	private final Integer minEncryptionVersion;
+
+	private VaultTransitKeyConfiguration(Boolean deletionAllowed, Integer latestVersion,
+			Integer minDecryptionVersion, Integer minEncryptionVersion) {
+
 		this.deletionAllowed = deletionAllowed;
 		this.latestVersion = latestVersion;
+		this.minDecryptionVersion = minDecryptionVersion;
+		this.minEncryptionVersion = minEncryptionVersion;
 	}
 
 	/**
@@ -51,11 +61,30 @@ public class VaultTransitKeyConfiguration {
 
 	/**
 	 * @return latest key version
+	 * @deprecated since 1.1, property does not exist.
 	 */
+	@Deprecated
 	public Integer getLatestVersion() {
 		return latestVersion;
 	}
 
+	/**
+	 * @return the minimum version of ciphertext allowed to be decrypted.
+	 * @since 1.1
+	 */
+	public Integer getMinDecryptionVersion() {
+		return minDecryptionVersion;
+	}
+
+	/**
+	 * @return the minimum version of the key that can be used to encrypt plaintext, sign
+	 * payloads, or generate HMACs.
+	 * @since 1.1
+	 */
+	public Integer getMinEncryptionVersion() {
+		return minEncryptionVersion;
+	}
+
 	/**
 	 * Builder for {@link VaultTransitKeyConfiguration}.
 	 */
@@ -65,6 +94,10 @@ public class VaultTransitKeyConfiguration {
 
 		private Integer latestVersion;
 
+		private Integer minDecryptionVersion;
+
+		private Integer minEncryptionVersion;
+
 		VaultTransitKeyConfigurationBuilder() {
 		}
 
@@ -84,19 +117,55 @@ public class VaultTransitKeyConfiguration {
 		 *
 		 * @param latestVersion key version.
 		 * @return {@code this} {@link VaultTransitKeyConfigurationBuilder}.
+		 * @deprecated since 1.1, property does not exist.
 		 */
+		@Deprecated
 		public VaultTransitKeyConfigurationBuilder latestVersion(int latestVersion) {
 			this.latestVersion = latestVersion;
 			return this;
 		}
 
+		/**
+		 * Specifies the minimum version of ciphertext allowed to be decrypted. Adjusting
+		 * this as part of a key rotation policy can prevent old copies of ciphertext from
+		 * being decrypted, should they fall into the wrong hands. For signatures, this
+		 * value controls the minimum version of signature that can be verified against.
+		 * For HMACs, this controls the minimum version of a key allowed to be used as the
+		 * key for verification.
+		 *
+		 * @param minDecryptionVersion key version.
+		 * @return {@code this} {@link VaultTransitKeyConfigurationBuilder}.
+		 * @since 1.1
+		 */
+		public VaultTransitKeyConfigurationBuilder minDecryptionVersion(
+				int minDecryptionVersion) {
+			this.minDecryptionVersion = minDecryptionVersion;
+			return this;
+		}
+
+		/**
+		 * Specifies the minimum version of the key that can be used to encrypt plaintext,
+		 * sign payloads, or generate HMACs. Must be 0 (which will use the latest version)
+		 * or a value greater or equal to {@link #minDecryptionVersion(int)}.
+		 *
+		 * @param minEncryptionVersion key version.
+		 * @return {@code this} {@link VaultTransitKeyConfigurationBuilder}.
+		 * @since 1.1
+		 */
+		public VaultTransitKeyConfigurationBuilder minEncryptionVersion(
+				int minEncryptionVersion) {
+			this.minEncryptionVersion = minEncryptionVersion;
+			return this;
+		}
+
 		/**
 		 * Build a new {@link VaultTransitKeyConfiguration} instance.
 		 *
 		 * @return a new {@link VaultTransitKeyConfiguration}.
 		 */
 		public VaultTransitKeyConfiguration build() {
-			return new VaultTransitKeyConfiguration(deletionAllowed, latestVersion);
+			return new VaultTransitKeyConfiguration(deletionAllowed, latestVersion,
+					minDecryptionVersion, minEncryptionVersion);
 		}
 	}
 }

spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java

@@ -60,6 +60,8 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport
 	private VaultOperations vaultOperations;
 	private VaultTransitOperations transitOperations;
 
+	private Version vaultVersion;
+
 	@Before
 	public void before() {
 
@@ -69,6 +71,8 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport
 			vaultOperations.opsForSys().mount("transit", VaultMount.create("transit"));
 		}
 
+		vaultVersion = prepare().getVersion();
+
 		removeKeys();
 	}
 
@@ -121,6 +125,14 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport
 		assertThat(mykey.isDerived()).isFalse();
 		assertThat(mykey.getMinDecryptionVersion()).isEqualTo(1);
 		assertThat(mykey.isLatestVersion()).isTrue();
+
+		if (vaultVersion.isGreaterThanOrEqualTo(Version.parse("0.7.0"))) {
+
+			assertThat(mykey.supportsDecryption()).isTrue();
+			assertThat(mykey.supportsEncryption()).isTrue();
+			assertThat(mykey.supportsDerivation()).isTrue();
+			assertThat(mykey.supportsSigning()).isFalse();
+		}
 	}
 
 	@Test
@@ -142,6 +154,31 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport
 		assertThat(mykey.isLatestVersion()).isTrue();
 	}
 
+	@Test
+	public void shouldConfigureKey() {
+
+		transitOperations.createKey("mykey");
+		transitOperations.rotate("mykey");
+		transitOperations.rotate("mykey");
+
+		VaultTransitKeyConfiguration configuration = VaultTransitKeyConfiguration
+				.builder().deletionAllowed(true).minDecryptionVersion(1)
+				.minEncryptionVersion(2).build();
+
+		transitOperations.configureKey("mykey", configuration);
+
+		VaultTransitKey mykey = transitOperations.getKey("mykey");
+
+		assertThat(mykey.getMinDecryptionVersion()).isEqualTo(1);
+
+		if (vaultVersion.isGreaterThanOrEqualTo(Version.parse("0.8.0"))) {
+			assertThat(mykey.getMinEncryptionVersion()).isEqualTo(2);
+		}
+		else {
+			assertThat(mykey.getMinEncryptionVersion()).isEqualTo(0);
+		}
+	}
+
 	@Test
 	public void shouldEnumerateKey() {