diff --git a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTokenTemplate.java b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTokenTemplate.java index ddde0e82..6382f15e 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTokenTemplate.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTokenTemplate.java @@ -48,7 +48,7 @@ public class VaultTokenTemplate implements VaultTokenOperations { @Override public VaultTokenResponse create() { - return create(new VaultTokenRequest()); + return create(VaultTokenRequest.builder().build()); } @Override @@ -61,7 +61,7 @@ public class VaultTokenTemplate implements VaultTokenOperations { @Override public VaultTokenResponse createOrphan() { - return createOrphan(new VaultTokenRequest()); + return createOrphan(VaultTokenRequest.builder().build()); } @Override diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java index 979e2077..b5cf6186 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java @@ -59,6 +59,14 @@ public class SslConfiguration { */ private final String trustStorePassword; + /** + * Creates a new {@link SslConfiguration}. + * + * @param keyStore + * @param keyStorePassword + * @param trustStore + * @param trustStorePassword + */ public SslConfiguration(Resource keyStore, String keyStorePassword, Resource trustStore, String trustStorePassword) { diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultCertificateRequest.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultCertificateRequest.java index 58999dba..b31ca3df 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultCertificateRequest.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultCertificateRequest.java @@ -130,7 +130,7 @@ public class VaultCertificateRequest { } /** - * Configure alternative names. Replaces previously configured alt names + * Configure alternative names. Replaces previously configured alt names. * * @param altNames must not be {@literal null}. * @return {@code this} {@link VaultCertificateRequestBuilder}. @@ -272,10 +272,12 @@ public class VaultCertificateRequest { } private static List toList(Iterable iter) { + List list = new ArrayList(); for (E item : iter) { list.add(item); } + return list; } } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultMount.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultMount.java index fc49b912..1a1485f5 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultMount.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultMount.java @@ -113,7 +113,7 @@ public class VaultMount { * @param type the backend type, must not be empty or {@literal null}. * @return {@literal this} {@link VaultMountBuilder}. */ - public VaultMount.VaultMountBuilder type(String type) { + public VaultMountBuilder type(String type) { Assert.hasText(type, "Type must not be empty or null"); @@ -127,7 +127,7 @@ public class VaultMount { * @param description a human readable description of this mount. * @return {@literal this} {@link VaultMountBuilder}. */ - public VaultMount.VaultMountBuilder description(String description) { + public VaultMountBuilder description(String description) { this.description = description; return this; } @@ -138,7 +138,7 @@ public class VaultMount { * @param config additional configuration details for this mount. * @return {@literal this} {@link VaultMountBuilder}. */ - public VaultMount.VaultMountBuilder config(Map config) { + public VaultMountBuilder config(Map config) { this.config = config; return this; } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultResponseSupport.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultResponseSupport.java index 7182eed2..75348230 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultResponseSupport.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultResponseSupport.java @@ -51,66 +51,130 @@ public class VaultResponseSupport { private boolean renewable; + /** + * + * @return authentication payload. + */ public Map getAuth() { return auth; } + /** + * + * @param auth the authentication payload. + */ public void setAuth(Map auth) { this.auth = auth; } + /** + * + * @return secret data. + */ public T getData() { return data; } + /** + * + * @param data secret data. + */ public void setData(T data) { this.data = data; } + /** + * + * @return request metadata. + */ public Map getMetadata() { return metadata; } + /** + * + * @param metadata request metadata. + */ public void setMetadata(Map metadata) { this.metadata = metadata; } + /** + * + * @return the lease duration. + */ public long getLeaseDuration() { return leaseDuration; } + /** + * + * @param leaseDuration the lease duration. + */ public void setLeaseDuration(long leaseDuration) { this.leaseDuration = leaseDuration; } + /** + * + * @return the lease Id. + */ public String getLeaseId() { return leaseId; } + /** + * + * @param leaseId the lease Id. + */ public void setLeaseId(String leaseId) { this.leaseId = leaseId; } + /** + * + * @return {@literal true} if the lease is renewable. + */ public boolean isRenewable() { return renewable; } + /** + * + * @param renewable {@literal true} if the lease is renewable. + */ public void setRenewable(boolean renewable) { this.renewable = renewable; } + /** + * + * @return response wrapping details. + */ public Map getWrapInfo() { return wrapInfo; } + /** + * + * @param wrapInfo response wrapping details. + */ public void setWrapInfo(Map wrapInfo) { this.wrapInfo = wrapInfo; } + /** + * + * @return the request Id. + */ public String getRequestId() { return requestId; } + /** + * + * @param requestId the request Id. + */ public void setRequestId(String requestId) { this.requestId = requestId; } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTokenRequest.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTokenRequest.java index 9fe046b4..337fad36 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTokenRequest.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTokenRequest.java @@ -15,11 +15,17 @@ */ package org.springframework.vault.support; +import java.util.ArrayList; +import java.util.Collections; +import java.util.LinkedHashMap; import java.util.List; import java.util.Map; +import java.util.concurrent.TimeUnit; import com.fasterxml.jackson.annotation.JsonProperty; +import org.springframework.util.Assert; + /** * Value object to bind Vault HTTP Token API requests. * @@ -27,108 +33,413 @@ import com.fasterxml.jackson.annotation.JsonProperty; */ public class VaultTokenRequest { - private String id; + private final String id; - private List policies; + private final List policies; - private Map meta; + private final Map meta; - @JsonProperty("no_parent") - private Boolean noParent; + private final Boolean noParent; @JsonProperty("no_default_policy") - private Boolean noDefaultPolicy; + private final Boolean noDefaultPolicy; - private Boolean renewable; + private final Boolean renewable; - private String ttl; + private final String ttl; @JsonProperty("explicit_max_ttl") - private String explicitMaxTtl; + private final String explicitMaxTtl; @JsonProperty("display_name") - private String displayName; + private final String displayName; @JsonProperty("num_uses") - private Integer numUses; + private final Integer numUses; + VaultTokenRequest(String id, List policies, Map meta, + Boolean noParent, Boolean noDefaultPolicy, Boolean renewable, String ttl, + String explicitMaxTtl, String displayName, Integer numUses) { + + this.id = id; + this.policies = policies; + this.meta = meta; + this.noParent = noParent; + this.noDefaultPolicy = noDefaultPolicy; + this.renewable = renewable; + this.ttl = ttl; + this.explicitMaxTtl = explicitMaxTtl; + this.displayName = displayName; + this.numUses = numUses; + } + + /** + * @return a new {@link VaultTokenRequestBuilder}. + */ + public static VaultTokenRequestBuilder builder() { + return new VaultTokenRequestBuilder(); + } + + /** + * + * @return Id of the client token. + */ public String getId() { return id; } - public void setId(String id) { - this.id = id; - } - + /** + * + * @return policies for the token. + */ public List getPolicies() { return policies; } - public void setPolicies(List policies) { - this.policies = policies; - } - + /** + * + * @return map of string to string valued metadata, passed through to the audit + * backends. + */ public Map getMeta() { return meta; } - public void setMeta(Map meta) { - this.meta = meta; - } - + /** + * + * @return {@literal true} if the token should not have the parent. + */ public Boolean getNoParent() { return noParent; } - public void setNoParent(Boolean noParent) { - this.noParent = noParent; - } - + /** + * + * @return {@literal true} if the default policy should not be be applied. + */ public Boolean getNoDefaultPolicy() { return noDefaultPolicy; } - public void setNoDefaultPolicy(Boolean noDefaultPolicy) { - this.noDefaultPolicy = noDefaultPolicy; - } - + /** + * + * @return {@literal true} if then the token should be renewable. + */ public Boolean getRenewable() { return renewable; } - public void setRenewable(Boolean renewable) { - this.renewable = renewable; - } - + /** + * + * @return TTL period of the token. + */ public String getTtl() { return ttl; } - public void setTtl(String ttl) { - this.ttl = ttl; - } - + /** + * + * @return explicit TTL of the token. + */ public String getExplicitMaxTtl() { return explicitMaxTtl; } - public void setExplicitMaxTtl(String explicitMaxTtl) { - this.explicitMaxTtl = explicitMaxTtl; - } - + /** + * + * @return the display name. + */ public String getDisplayName() { return displayName; } - public void setDisplayName(String displayName) { - this.displayName = displayName; - } - + /** + * + * @return the number of allowed token uses. + */ public Integer getNumUses() { return numUses; } - public void setNumUses(Integer numUses) { - this.numUses = numUses; + /** + * Builder to build a {@link VaultTokenRequest}. + */ + public static class VaultTokenRequestBuilder { + + private String id; + + private List policies = new ArrayList(); + + private Map meta = new LinkedHashMap(); + + private Boolean noParent; + + private Boolean noDefaultPolicy; + + private Boolean renewable; + + private String ttl; + + private String explicitMaxTtl; + + private String displayName; + + private Integer numUses; + + VaultTokenRequestBuilder() { + } + + /** + * Configure a the Id of the client token. Can only be specified by a root token. + * Otherwise, the token Id is a randomly generated UUID. + * + * @param id the token Id. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder id(String id) { + this.id = id; + return this; + } + + /** + * Configure policies. Replaces previously configured policies. + * + * @param policies must not be {@literal null}. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder policies(Iterable policies) { + + Assert.notNull(policies, "Policies must not be null"); + + this.policies = toList(policies); + return this; + } + + /** + * Add a policy. + * + * @param policy must not be empty or {@literal null}. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder withPolicy(String policy) { + + Assert.hasText(policy, "Policy must not be empty"); + + this.policies.add(policy); + return this; + } + + /** + * Configure meta. Replaces previously meta. + * + * @param meta must not be {@literal null}. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder meta(Map meta) { + + Assert.notNull(meta, "Meta must not be null"); + + this.meta = meta; + return this; + } + + /** + * Configure the token to not have the parent token of the caller. This creates a + * token with no parent. Requires a root caller. + * + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder noParent() { + return noParent(true); + } + + /** + * Configure the token to not have the parent token of the caller. This creates a + * token with no parent. Requires a root caller. + * + * @param noParent {@literal true} to not have the parent token of the caller. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder noParent(boolean noParent) { + this.noParent = noParent; + return this; + } + + /** + * Omit the default policy in the token's policy set + * + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder noDefaultPolicy() { + return noDefaultPolicy(true); + } + + /** + * Configure whether the default policy should be part of the token's policy set. + * + * @param noDefaultPolicy {@literal true} to omit the default policy in the + * token's policy set. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder noDefaultPolicy(boolean noDefaultPolicy) { + this.noDefaultPolicy = noDefaultPolicy; + return this; + } + + /** + * Enable TTL extension/renewal for the token. + * + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder renewable() { + return renewable(true); + } + + /** + * Configure TTL extension/renewal for the token. + * + * @param renewable {@literal false} to disable the ability of the token to be + * renewed past its initial TTL. {@literal true}, or omitting this option, will + * allow the token to be renewable up to the system/mount maximum TTL. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder renewable(boolean renewable) { + this.renewable = renewable; + return this; + } + + /** + * Configure a TTL (seconds) for the token. + * + * @param ttl the time to live in seconds, must not be negative. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder ttl(long ttl) { + return ttl(ttl, TimeUnit.SECONDS); + } + + /** + * Configure a TTL (seconds) for the token. + * + * @param ttl the time to live, must not be negative. + * @param timeUnit the time to live, must not be {@literal null}. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder ttl(long ttl, TimeUnit timeUnit) { + + Assert.isTrue(ttl >= 0, "TTL must not be negative"); + Assert.notNull(timeUnit, "TimeUnit must not be null"); + + this.ttl = String.format("%ss", timeUnit.toSeconds(ttl)); + return this; + } + + /** + * Configure the explicit maximum TTL (seconds) for the token. This maximum token + * TTL cannot be changed later, and unlike with normal tokens, updates to the + * system/mount max TTL value will have no effect at renewal time - the token will + * never be able to be renewed or used past the value set at issue time. + * + * @param explicitMaxTtl the time to live in seconds, must not be negative. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder explicitMaxTtl(long explicitMaxTtl) { + return explicitMaxTtl(explicitMaxTtl, TimeUnit.SECONDS); + } + + /** + * Configure the explicit maximum TTL for the token. This maximum token TTL cannot + * be changed later, and unlike with normal tokens, updates to the system/mount + * max TTL value will have no effect at renewal time - the token will never be + * able to be renewed or used past the value set at issue time. + * + * @param explicitMaxTtl the time to live, must not be negative. + * @param timeUnit the time to live, must not be {@literal null}. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder explicitMaxTtl(long explicitMaxTtl, + TimeUnit timeUnit) { + + Assert.isTrue(explicitMaxTtl >= 0, "TTL must not be negative"); + Assert.notNull(timeUnit, "TimeUnit must not be null"); + + this.explicitMaxTtl = String + .format("%ss", timeUnit.toSeconds(explicitMaxTtl)); + return this; + } + + /** + * Configure the maximum uses for the token. This can be used to create a + * one-time-token or limited use token. Defaults to {@literal 0}, which has no + * limit to the number of uses. + * + * @param numUses number of uses, must not be negative. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder numUses(int numUses) { + + Assert.isTrue(numUses >= 0, "Number of uses must not be negative"); + + this.numUses = numUses; + return this; + } + + /** + * Configure a display name for the token, defaults to "token". + * + * @param displayName must not be empty or {@literal null}. + * @return {@code this} {@link VaultTokenRequestBuilder}. + */ + public VaultTokenRequestBuilder displayName(String displayName) { + + Assert.hasText(displayName, "Display name must not be empty"); + + this.displayName = displayName; + return this; + } + + /** + * Build a new {@link VaultTokenRequest} instance. + * + * @return a new {@link VaultCertificateRequest}. + */ + public VaultTokenRequest build() { + + List policies; + switch (this.policies.size()) { + case 0: + policies = Collections.emptyList(); + break; + case 1: + policies = Collections.singletonList(this.policies.get(0)); + break; + default: + policies = Collections.unmodifiableList(new ArrayList( + this.policies)); + + } + Map meta = null; + switch (this.meta.size()) { + case 0: + meta = Collections.emptyMap(); + break; + default: + meta = Collections + .unmodifiableMap(new LinkedHashMap(meta)); + } + + return new VaultTokenRequest(id, policies, meta, noParent, noDefaultPolicy, + renewable, ttl, explicitMaxTtl, displayName, numUses); + } + + private static List toList(Iterable iter) { + + List list = new ArrayList(); + for (E item : iter) { + list.add(item); + } + + return list; + } } } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitContext.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitContext.java index 54df9129..450f1876 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitContext.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitContext.java @@ -58,6 +58,7 @@ public class VaultTransitContext { public static class VaultTransitRequestBuilder { private byte[] context; + private byte[] nonce; VaultTransitRequestBuilder() { @@ -70,7 +71,7 @@ public class VaultTransitContext { * provided if derivation is enabled. * @return {@code this} {@link VaultTransitRequestBuilder}. */ - public VaultTransitContext.VaultTransitRequestBuilder context(byte[] context) { + public VaultTransitRequestBuilder context(byte[] context) { this.context = context; return this; } @@ -85,7 +86,7 @@ public class VaultTransitContext { * nonce value is never reused * @return {@code this} {@link VaultTransitRequestBuilder}. */ - public VaultTransitContext.VaultTransitRequestBuilder nonce(byte[] nonce) { + public VaultTransitRequestBuilder nonce(byte[] nonce) { this.nonce = nonce; return this; } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java index 0f9e623b..53267d38 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java @@ -62,6 +62,7 @@ public class VaultTransitKeyConfiguration { public static class VaultTransitKeyConfigurationBuilder { private Boolean deletionAllowed; + private Integer latestVersion; VaultTransitKeyConfigurationBuilder() { @@ -97,6 +98,5 @@ public class VaultTransitKeyConfiguration { public VaultTransitKeyConfiguration build() { return new VaultTransitKeyConfiguration(deletionAllowed, latestVersion); } - } } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java index 4cc171be..55e7e93b 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java @@ -48,14 +48,27 @@ public class VaultTransitKeyCreationRequest { return new VaultTransitKeyCreationRequestBuilder(); } + /** + * + * @return {@literal true} if key derivation MUST be used. + */ public Boolean getDerived() { return derived; } + /** + * + * @return {@literal true} if convergent encryption should be used (where the same + * plaintext creates the same cipher text). + */ public Boolean getConvergentEncryption() { return convergentEncryption; } + /** + * + * @return the key type. + */ public String getType() { return type; } diff --git a/spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerIntegrationTests.java index 3ac5029e..913679e5 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerIntegrationTests.java @@ -16,6 +16,7 @@ package org.springframework.vault.authentication; import java.util.Map; +import java.util.concurrent.TimeUnit; import java.util.concurrent.atomic.AtomicInteger; import org.junit.Test; @@ -60,10 +61,10 @@ public class LifecycleAwareSessionManagerIntegrationTests extends IntegrationTes VaultTokenOperations tokenOperations = prepare().getVaultOperations() .opsForToken(); - VaultTokenRequest tokenRequest = new VaultTokenRequest(); - tokenRequest.setRenewable(true); - tokenRequest.setTtl("1h"); - tokenRequest.setExplicitMaxTtl("10h"); + VaultTokenRequest tokenRequest = VaultTokenRequest.builder() // + .renewable().ttl(1, TimeUnit.HOURS) // + .explicitMaxTtl(10, TimeUnit.HOURS) // + .build(); VaultToken token = tokenOperations.create(tokenRequest).getToken(); diff --git a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTokenTemplateIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTokenTemplateIntegrationTests.java index 32b8203c..ca265c74 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTokenTemplateIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTokenTemplateIntegrationTests.java @@ -16,6 +16,7 @@ package org.springframework.vault.core; import java.util.Collections; +import java.util.concurrent.TimeUnit; import org.junit.Before; import org.junit.Test; @@ -62,14 +63,17 @@ public class VaultTokenTemplateIntegrationTests extends IntegrationTestSupport { @Test public void createTokenShouldCreateACustomizedToken() { - VaultTokenRequest tokenRequest = new VaultTokenRequest(); - tokenRequest.setDisplayName("display"); - tokenRequest.setExplicitMaxTtl("1h"); - tokenRequest.setTtl("30m"); - tokenRequest.setPolicies(Collections.singletonList("root")); - tokenRequest.setNumUses(2); - tokenRequest.setRenewable(true); - tokenRequest.setId("HELLO-WORLD"); + VaultTokenRequest tokenRequest = VaultTokenRequest.builder() + .displayName("display") // + .explicitMaxTtl(TimeUnit.HOURS.toSeconds(10)) // + .ttl(30 * 60) // + .policies(Collections.singleton("root")) // + .numUses(2) // + .renewable() // + .noDefaultPolicy() // + .noParent() // + .id("HELLO-WORLD") // + .build(); VaultTokenResponse tokenResponse = tokenOperations.create(tokenRequest); assertThat(tokenResponse.getAuth()).containsEntry("client_token", @@ -86,14 +90,17 @@ public class VaultTokenTemplateIntegrationTests extends IntegrationTestSupport { @Test public void createOrphanTokenShouldCreateACustomizedToken() { - VaultTokenRequest tokenRequest = new VaultTokenRequest(); - tokenRequest.setDisplayName("display"); - tokenRequest.setExplicitMaxTtl("1h"); - tokenRequest.setTtl("30m"); - tokenRequest.setPolicies(Collections.singletonList("root")); - tokenRequest.setNumUses(2); - tokenRequest.setRenewable(true); - tokenRequest.setId("HELLO-WORLD"); + VaultTokenRequest tokenRequest = VaultTokenRequest.builder() + .displayName("display") // + .explicitMaxTtl(TimeUnit.HOURS.toSeconds(10)) // + .ttl(30 * 60) // + .policies(Collections.singleton("root")) // + .numUses(2) // + .renewable() // + .noDefaultPolicy() // + .noParent() // + .id("HELLO-WORLD") // + .build(); VaultTokenResponse tokenResponse = tokenOperations.createOrphan(tokenRequest); assertThat(tokenResponse.getAuth()).containsEntry("client_token", @@ -103,10 +110,11 @@ public class VaultTokenTemplateIntegrationTests extends IntegrationTestSupport { @Test public void renewShouldRenewToken() { - VaultTokenRequest tokenRequest = new VaultTokenRequest(); - tokenRequest.setDisplayName("display"); - tokenRequest.setExplicitMaxTtl("1h"); - tokenRequest.setTtl("30m"); + VaultTokenRequest tokenRequest = VaultTokenRequest.builder() + .explicitMaxTtl(TimeUnit.HOURS.toSeconds(10)) // + .ttl(30 * 60) // + .renewable() // + .build(); VaultTokenResponse tokenResponse = tokenOperations.create(tokenRequest); VaultTokenResponse renew = tokenOperations.renew(tokenResponse.getToken()); @@ -132,8 +140,8 @@ public class VaultTokenTemplateIntegrationTests extends IntegrationTestSupport { VaultResponseEntity response = lookupSelf(tokenResponse); assertThat(response.getStatusCode()).isIn( - /* <= Vault 0.6.0 */HttpStatus.BAD_REQUEST, - /* >= Vault 0.6.1 */HttpStatus.FORBIDDEN); + /* <= Vault 0.6.0 */HttpStatus.BAD_REQUEST, + /* >= Vault 0.6.1 */HttpStatus.FORBIDDEN); assertThat(response.getMessage()).isEqualTo("permission denied"); } diff --git a/spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java b/spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java index 5a477c7c..57db950a 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java @@ -18,6 +18,7 @@ package org.springframework.vault.util; import java.util.Collections; import org.springframework.util.Assert; +import org.springframework.util.StringUtils; import org.springframework.vault.client.VaultClient; import org.springframework.vault.core.VaultOperations; import org.springframework.vault.core.VaultSysOperations; @@ -26,6 +27,7 @@ import org.springframework.vault.support.VaultInitializationResponse; import org.springframework.vault.support.VaultMount; import org.springframework.vault.support.VaultToken; import org.springframework.vault.support.VaultTokenRequest; +import org.springframework.vault.support.VaultTokenRequest.VaultTokenRequestBuilder; import org.springframework.vault.support.VaultTokenResponse; import org.springframework.vault.support.VaultUnsealStatus; @@ -85,15 +87,14 @@ public class PrepareVault { */ public VaultToken createToken(String tokenId, String policy) { - VaultTokenRequest tokenRequest = new VaultTokenRequest(); + VaultTokenRequestBuilder builder = VaultTokenRequest.builder().id(tokenId); - tokenRequest.setId(tokenId); - if (policy != null) { - tokenRequest.setPolicies(Collections.singletonList(policy)); + if(StringUtils.hasText(policy)){ + builder.withPolicy(policy); } VaultTokenResponse vaultTokenResponse = vaultOperations.opsForToken().create( - tokenRequest); + builder.build()); return vaultTokenResponse.getToken(); }