Kv preflight

command/command_test.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	log "github.com/hashicorp/go-hclog"
+	kv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/audit"
 	"github.com/hashicorp/vault/builtin/logical/pki"
@@ -41,6 +42,7 @@ var (
 		"pki":            pki.Factory,
 		"ssh":            ssh.Factory,
 		"transit":        transit.Factory,
+		"kv":             kv.Factory,
 	}
 )
 

command/kv_delete.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/hashicorp/vault/api"
 	"github.com/mitchellh/cli"
 	"github.com/posener/complete"
 )
@@ -87,13 +88,25 @@ func (c *KVDeleteCommand) Run(args []string) int {
 		return 1
 	}
 
+	client, err := c.Client()
+	if err != nil {
+		c.UI.Error(err.Error())
+		return 2
+	}
+
 	path := sanitizePath(args[0])
-	var err error
-	if len(c.flagVersions) > 0 {
-		err = c.deleteVersions(path, kvParseVersionsFlags(c.flagVersions))
+	mountPath, v2, err := isKVv2(path, client)
+	if err != nil {
+		c.UI.Error(err.Error())
+		return 2
+	}
+
+	if v2 {
+		err = c.deleteV2(path, mountPath, client)
 	} else {
-		err = c.deleteLatest(path)
+		_, err = client.Logical().Delete(path)
 	}
+
 	if err != nil {
 		c.UI.Error(fmt.Sprintf("Error deleting %s: %s", path, err))
 		return 2
@@ -103,39 +116,29 @@ func (c *KVDeleteCommand) Run(args []string) int {
 	return 0
 }
 
-func (c *KVDeleteCommand) deleteLatest(path string) error {
+func (c *KVDeleteCommand) deleteV2(path, mountPath string, client *api.Client) error {
 	var err error
-	path, err = addPrefixToVKVPath(path, "data")
-	if err != nil {
-		return err
-	}
-
-	client, err := c.Client()
-	if err != nil {
-		return err
-	}
-
-	_, err = kvDeleteRequest(client, path)
+	switch {
+	case len(c.flagVersions) > 0:
+		path = addPrefixToVKVPath(path, mountPath, "delete")
+		if err != nil {
+			return err
+		}
 
-	return err
-}
+		data := map[string]interface{}{
+			"versions": kvParseVersionsFlags(c.flagVersions),
+		}
 
-func (c *KVDeleteCommand) deleteVersions(path string, versions []string) error {
-	var err error
-	path, err = addPrefixToVKVPath(path, "delete")
-	if err != nil {
-		return err
-	}
+		_, err = client.Logical().Write(path, data)
+	default:
 
-	data := map[string]interface{}{
-		"versions": versions,
-	}
+		path = addPrefixToVKVPath(path, mountPath, "data")
+		if err != nil {
+			return err
+		}
 
-	client, err := c.Client()
-	if err != nil {
-		return err
+		_, err = client.Logical().Delete(path)
 	}
 
-	_, err = kvWriteRequest(client, path, data)
 	return err
 }

command/kv_destroy.go

@@ -86,23 +86,33 @@ func (c *KVDestroyCommand) Run(args []string) int {
 	}
 	var err error
 	path := sanitizePath(args[0])
-	path, err = addPrefixToVKVPath(path, "destroy")
+
+	client, err := c.Client()
 	if err != nil {
 		c.UI.Error(err.Error())
 		return 2
 	}
 
-	data := map[string]interface{}{
-		"versions": kvParseVersionsFlags(c.flagVersions),
+	mountPath, v2, err := isKVv2(path, client)
+	if err != nil {
+		c.UI.Error(err.Error())
+		return 2
 	}
-
-	client, err := c.Client()
+	if !v2 {
+		c.UI.Error("Destroy not supported on KV Version 1")
+		return 1
+	}
+	path = addPrefixToVKVPath(path, mountPath, "destroy")
 	if err != nil {
 		c.UI.Error(err.Error())
 		return 2
 	}
 
-	secret, err := kvWriteRequest(client, path, data)
+	data := map[string]interface{}{
+		"versions": kvParseVersionsFlags(c.flagVersions),
+	}
+
+	secret, err := client.Logical().Write(path, data)
 	if err != nil {
 		c.UI.Error(fmt.Sprintf("Error writing data to %s: %s", path, err))
 		return 2

command/kv_get.go

@@ -91,16 +91,25 @@ func (c *KVGetCommand) Run(args []string) int {
 	}
 
 	path := sanitizePath(args[0])
-	path, err = addPrefixToVKVPath(path, "data")
+	mountPath, v2, err := isKVv2(path, client)
 	if err != nil {
 		c.UI.Error(err.Error())
 		return 2
 	}
 
 	var versionParam map[string]string
-	if c.flagVersion > 0 {
-		versionParam = map[string]string{
-			"version": fmt.Sprintf("%d", c.flagVersion),
+
+	if v2 {
+		path = addPrefixToVKVPath(path, mountPath, "data")
+		if err != nil {
+			c.UI.Error(err.Error())
+			return 2
+		}
+
+		if c.flagVersion > 0 {
+			versionParam = map[string]string{
+				"version": fmt.Sprintf("%d", c.flagVersion),
+			}
 		}
 	}
 
@@ -128,8 +137,17 @@ func (c *KVGetCommand) Run(args []string) int {
 		OutputData(c.UI, metadata)
 		c.UI.Info("")
 	}
-	if data, ok := secret.Data["data"]; ok && data != nil {
-		c.UI.Info(getHeaderForMap("Data", data.(map[string]interface{})))
+
+	data := secret.Data
+	if v2 && data != nil {
+		dataRaw := secret.Data["data"]
+		if dataRaw != nil {
+			data = dataRaw.(map[string]interface{})
+		}
+	}
+
+	if data != nil {
+		c.UI.Info(getHeaderForMap("Data", data))
 		OutputData(c.UI, data)
 	}
 

command/kv_helpers.go

@@ -1,25 +1,17 @@
 package command
 
 import (
-	"errors"
 	"fmt"
 	"io"
-	"net/http"
 	"path"
 	"strings"
 
 	"github.com/hashicorp/vault/api"
-	"github.com/hashicorp/vault/helper/consts"
 	"github.com/hashicorp/vault/helper/strutil"
 )
 
 func kvReadRequest(client *api.Client, path string, params map[string]string) (*api.Secret, error) {
 	r := client.NewRequest("GET", "/v1/"+path)
-	if r.Headers == nil {
-		r.Headers = http.Header{}
-	}
-	r.Headers.Add(consts.VaultKVCLIClientHeader, "v2")
-
 	for k, v := range params {
 		r.Params.Set(k, v)
 	}
@@ -48,121 +40,55 @@ func kvReadRequest(client *api.Client, path string, params map[string]string) (*
 	return api.ParseSecret(resp.Body)
 }
 
-func kvListRequest(client *api.Client, path string) (*api.Secret, error) {
-	r := client.NewRequest("LIST", "/v1/"+path)
-	if r.Headers == nil {
-		r.Headers = http.Header{}
-	}
-	r.Headers.Add(consts.VaultKVCLIClientHeader, "v2")
-
-	// Set this for broader compatibility, but we use LIST above to be able to
-	// handle the wrapping lookup function
-	r.Method = "GET"
-	r.Params.Set("list", "true")
+func kvPreflightVersionRequest(client *api.Client, path string) (string, int, error) {
+	r := client.NewRequest("GET", "/v1/sys/internal/ui/mount/"+path)
 	resp, err := client.RawRequest(r)
 	if resp != nil {
 		defer resp.Body.Close()
 	}
-	if resp != nil && resp.StatusCode == 404 {
-		secret, parseErr := api.ParseSecret(resp.Body)
-		switch parseErr {
-		case nil:
-		case io.EOF:
-			return nil, nil
-		default:
-			return nil, err
-		}
-		if secret != nil && (len(secret.Warnings) > 0 || len(secret.Data) > 0) {
-			return secret, nil
-		}
-		return nil, nil
-	}
 	if err != nil {
-		return nil, err
+		return "", 0, err
 	}
 
-	return api.ParseSecret(resp.Body)
-}
-
-func kvWriteRequest(client *api.Client, path string, data map[string]interface{}) (*api.Secret, error) {
-	r := client.NewRequest("PUT", "/v1/"+path)
-	if r.Headers == nil {
-		r.Headers = http.Header{}
+	secret, err := api.ParseSecret(resp.Body)
+	if err != nil {
+		return "", 0, err
 	}
-	r.Headers.Add(consts.VaultKVCLIClientHeader, "v2")
-	if err := r.SetJSONBody(data); err != nil {
-		return nil, err
+	var mountPath string
+	if mountPathRaw, ok := secret.Data["path"]; ok {
+		mountPath = mountPathRaw.(string)
 	}
-
-	resp, err := client.RawRequest(r)
-	if resp != nil {
-		defer resp.Body.Close()
+	options := secret.Data["options"]
+	if options == nil {
+		return mountPath, 1, nil
 	}
-	if resp != nil && resp.StatusCode == 404 {
-		secret, parseErr := api.ParseSecret(resp.Body)
-		switch parseErr {
-		case nil:
-		case io.EOF:
-			return nil, nil
-		default:
-			return nil, err
-		}
-		if secret != nil && (len(secret.Warnings) > 0 || len(secret.Data) > 0) {
-			return secret, err
-		}
-	}
-	if err != nil {
-		return nil, err
+	versionRaw := options.(map[string]interface{})["version"]
+	if versionRaw == nil {
+		return mountPath, 1, nil
 	}
-
-	if resp.StatusCode == 200 {
-		return api.ParseSecret(resp.Body)
+	version := versionRaw.(string)
+	switch version {
+	case "", "1":
+		return mountPath, 1, nil
+	case "2":
+		return mountPath, 2, nil
 	}
 
-	return nil, nil
+	return mountPath, 1, nil
 }
 
-func kvDeleteRequest(client *api.Client, path string) (*api.Secret, error) {
-	r := client.NewRequest("DELETE", "/v1/"+path)
-	if r.Headers == nil {
-		r.Headers = http.Header{}
-	}
-	r.Headers.Add(consts.VaultKVCLIClientHeader, "v2")
-	resp, err := client.RawRequest(r)
-	if resp != nil {
-		defer resp.Body.Close()
-	}
-	if resp != nil && resp.StatusCode == 404 {
-		secret, parseErr := api.ParseSecret(resp.Body)
-		switch parseErr {
-		case nil:
-		case io.EOF:
-			return nil, nil
-		default:
-			return nil, err
-		}
-		if secret != nil && (len(secret.Warnings) > 0 || len(secret.Data) > 0) {
-			return secret, err
-		}
-	}
+func isKVv2(path string, client *api.Client) (string, bool, error) {
+	mountPath, version, err := kvPreflightVersionRequest(client, path)
 	if err != nil {
-		return nil, err
+		return "", false, err
 	}
 
-	if resp.StatusCode == 200 {
-		return api.ParseSecret(resp.Body)
-	}
-
-	return nil, nil
+	return mountPath, version == 2, nil
 }
 
-func addPrefixToVKVPath(p, apiPrefix string) (string, error) {
-	parts := strings.SplitN(p, "/", 2)
-	if len(parts) != 2 {
-		return "", errors.New("invalid path")
-	}
-
-	return path.Join(parts[0], apiPrefix, parts[1]), nil
+func addPrefixToVKVPath(p, mountPath, apiPrefix string) string {
+	p = strings.TrimPrefix(p, mountPath)
+	return path.Join(mountPath, apiPrefix, p)
 }
 
 func getHeaderForMap(header string, data map[string]interface{}) string {