chore: fix step output syntax

Bumps [got](https://github.com/sindresorhus/got) from 10.5.7 to 10.6.0.
- [Release notes](https://github.com/sindresorhus/got/releases)
- [Commits](https://github.com/sindresorhus/got/compare/v10.5.7...v10.6.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

.github/FUNDING.yml

@@ -0,0 +1 @@
+ko_fi: richicoder

.github/workflows/build.yml

@@ -110,8 +110,9 @@ jobs:
       env:
         VAULT_HOST: localhost
         VAULT_PORT: ${{ job.services.vault.ports[8200] }}
-    - name: use vault action
+    - name: use vault action (default K/V version 2)
       uses: ./
+      id: kv-secrets
       with:
         url: http://localhost:${{ job.services.vault.ports[8200] }}
         token: testtoken
@@ -119,8 +120,29 @@ jobs:
           test secret ;
           test secret | NAMED_SECRET ;
           nested/test otherSecret ;
+    - name: use vault action (custom K/V version 1)
+      uses: ./
+      with:
+        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        token: testtoken
+        path: my-secret
+        kv-version: 1
+        secrets: |
+          test altSecret ;
+          test altSecret | NAMED_ALTSECRET ;
+          nested/test otherAltSecret ;
+    - name: use vault action (using cubbyhole engine)
+      uses: ./
+      with:
+        url: http://localhost:${{ job.services.vault.ports[8200] }}
+        token: testtoken
+        secrets: |
+          /cubbyhole/test foo ;
+          /cubbyhole/test zip | NAMED_CUBBYSECRET ;
     - name: verify
       run: npm run test:e2e
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
 
   publish:
     if: github.event_name	== 'push' && contains(github.ref, 'master')

README.md

@@ -1,6 +1,8 @@
 # vault-action
 
-A helper action for easily pulling secrets from the default v2 K/V backend of vault.
+A helper action for easily pulling secrets from HashiCorp Vault™.
+
+By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the K/V Engine. See examples below for how to [use v1](#using-kv-version-1) as well as [other non-K/V engines](#other-secret-engines).
 
 ## Example Usage
 
@@ -24,7 +26,8 @@ jobs:
 
 ## Authentication method
 
-The `method` parameter can have these value :
+While most workflows will likely use a vault token, you can also use an `approle` to authenticate with vaule. You can configure which by using the `method` parameter:
+
 - **token**: (by default) you must provide a token parameter
 ```yaml
 ...
@@ -39,7 +42,7 @@ with:
   url: https://vault.mycompany.com:8200
   method: approle
   roleId: ${{ secrets.roleId }}
-  secretId : ${{ secrets.secretId }}
+  secretId: ${{ secrets.secretId }}
 ```
 
 ## Key Syntax
@@ -49,7 +52,7 @@ The `secrets` parameter is a set of multiple secret requests separated by the `;
 Each secret request is comprised of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
 
 ```raw
-{{ Secret Path }} {{ Secret Key }} | {{ Output Environment Variable Name }}
+{{ Secret Path }} {{ Secret Key }} | {{ Output Variable Name }}
 ```
 
 ### Simple Key
@@ -61,15 +64,28 @@ with:
     secrets: ci npmToken
 ```
 
-`vault-action` will automatically normalize the given data key, and output:
+`vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:
 
 ```bash
 NPMTOKEN=somelongtoken
 ```
 
-### Set Environment Variable Name
+You can also access the secret via ouputs:
 
-However, if you want to set it to a specific environmental variable, say `NPM_TOKEN`, you could do this instead:
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      id: secrets
+      # Import config...
+    - name: Sensitive Operation
+      run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
+
+```
+
+### Set Output Variable Name
+
+However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do this instead:
 
 ```yaml
 with:
@@ -82,6 +98,17 @@ With that, `vault-action` will now use your requested name and output:
 NPM_TOKEN=somelongtoken
 ```
 
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
+
+```
+
 ### Multiple Secrets
 
 This action can take multi-line input, so say you had your AWS keys stored in a path and wanted to retrieve both of them. You can do:
@@ -93,9 +120,93 @@ with:
         ci/aws secretKey | AWS_SECRET_ACCESS_KEY
 ```
 
+### Using K/V version 1
+
+By default, `vault-action` expects a K/V engine using [version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2.html).
+
+In order to work with a [v1 engine](https://www.vaultproject.io/docs/secrets/kv/kv-v1/), the `kv-version` parameter may be passed:
+
+```yaml
+with:
+    kv-version: 1
+```
+
+### Custom K/V Engine Path
+
+When you enable the K/V Engine, by default it's placed at the path `secret`, so a secret named `ci` will be accessed from `secret/ci`. However, [if you enabled the secrets engine using a custom `path`](https://www.vaultproject.io/docs/commands/secrets/enable/#inlinecode--path-4), you
+can pass it as follows:
+
+```yaml
+with:
+    path: my-secrets
+    secrets: ci npmToken
+```
+
+This way, the `ci` secret in the example above will be retrieved from `my-secrets/ci`.
+
+### Other Secret Engines
+
+While this action primarily supports the K/V engine, it is possible to request secrets from other engines in Vault.
+
+To do so when specifying the `Secret Path`, just append a leading formard slash (`/`) and specify the path as described in the Vault API documentation.
+
+For example, to retrieve a stored secret from the [`cubbyhole` engine](https://www.vaultproject.io/api-docs/secret/cubbyhole/), assuming you have a stored secret at the path `foo` with the contents:
+
+```json
+{
+  "foo": "bar",
+  "zip": "zap"
+}
+```
+
+You could request the contents like so:
+
+```yaml
+with:
+    secrets: |
+        /cubbyhole/foo foo ;
+        /cubbyhole/foo zip | MY_KEY ;
+```
+
+Resulting in:
+
+```bash
+FOO=bar
+MY_KEY=zap
+```
+
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.foo }}'"
+  - name: Another Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.MY_KEY }}'"
+```
+
+Secrets pulled from the same `Secret Path` are cached by default. So if you, for example, are using the `aws` engine and retrieve a key, only a single key for a given path is returned.
+
+e.g.:
+
+```yaml
+with:
+    secrets: |
+        /aws/creds/ci access_key | AWS_ACCESS_KEY_ID ;
+        /aws/creds/ci secret_key | AWS_SECRET_ACCESS_KEY
+```
+
+would work fine.
+
+NOTE: The `Secret Key` is pulled from the `data` property of the response.
+
+## Vault Enterprise Features
+
 ### Namespace
 
-This action could be use with namespace Vault Enterprise feature. You can specify namespace in request : 
+If you need to retrieve secrets from a specific vault namespace, all that's required is an additional parameter specifying the namespace.
 
 ```yaml
 steps:

action.js

@@ -1,14 +1,23 @@
+// @ts-check
+
+// @ts-ignore
 const core = require('@actions/core');
+// @ts-ignore
 const command = require('@actions/core/lib/command');
 const got = require('got');
 
 const AUTH_METHODS = ['approle', 'token'];
+const VALID_KV_VERSION = [-1, 1, 2];
+
 async function exportSecrets() {
     const vaultUrl = core.getInput('url', { required: true });
     const vaultNamespace = core.getInput('namespace', { required: false });
 
+    let enginePath = core.getInput('path', { required: false });
+    let kvVersion = core.getInput('kv-version', { required: false });
+
     const secretsInput = core.getInput('secrets', { required: true });
-    const secrets = parseSecretsInput(secretsInput);
+    const secretRequests = parseSecretsInput(secretsInput);
 
     const vaultMethod = core.getInput('method', { required: false }) || 'token';
     if (!AUTH_METHODS.includes(vaultMethod)) {
@@ -21,16 +30,17 @@ async function exportSecrets() {
             const vaultRoleId = core.getInput('roleId', { required: true });
             const vaultSecretId = core.getInput('secretId', { required: true });
             core.debug('Try to retrieve Vault Token from approle');
-            var options = { 
+            var options = {
-                headers: {}, 
+                headers: {},
-                json: { role_id: vaultRoleId, secret_id: vaultSecretId }, 
+                json: { role_id: vaultRoleId, secret_id: vaultSecretId },
-                responseType: 'json' 
+                responseType: 'json'
             };
 
             if (vaultNamespace != null) {
                 options.headers["X-Vault-Namespace"] = vaultNamespace;
             }
 
+            /** @type {any} */
             const result = await got.post(`${vaultUrl}/v1/auth/approle/login`, options);
             if (result && result.body && result.body.auth && result.body.auth.client_token) {
                 vaultToken = result.body.auth.client_token;
@@ -44,8 +54,22 @@ async function exportSecrets() {
             break;
     }
 
-    for (const secret of secrets) {
+    if (!enginePath) {
-        const { secretPath, outputName, secretKey } = secret;
+        enginePath = 'secret';
+    }
+
+    if (!kvVersion) {
+        kvVersion = 2;
+    }
+    kvVersion = +kvVersion;
+
+    if (Number.isNaN(kvVersion) || !VALID_KV_VERSION.includes(kvVersion)) {
+        throw Error(`You must provide a valid K/V version (${VALID_KV_VERSION.slice(1).join(', ')}). Input: "${kvVersion}"`);
+    }
+
+    const responseCache = new Map();
+    for (const secretRequest of secretRequests) {
+        const { secretPath, outputVarName, envVarName, secretSelector, isJSONPath } = secretRequest;
         const requestOptions = {
             headers: {
                 'X-Vault-Token': vaultToken
@@ -56,18 +80,45 @@ async function exportSecrets() {
             requestOptions.headers["X-Vault-Namespace"] = vaultNamespace;
         }
 
-        const result = await got(`${vaultUrl}/v1/secret/data/${secretPath}`, requestOptions);
+        let requestPath = `${vaultUrl}/v1`;
+        const kvRequest = !secretPath.startsWith('/')
+        if (!kvRequest) {
+            requestPath += secretPath;
+        } else {
+           requestPath += (kvVersion === 2)
+                    ? `/${enginePath}/data/${secretPath}`
+                    : `/${enginePath}/${secretPath}`;
+        }
 
-        const parsedResponse = JSON.parse(result.body);
+        let body;
-        const vaultKeyData = parsedResponse.data;
+        if (responseCache.has(requestPath)) {
-        const versionData = vaultKeyData.data;
+            body = responseCache.get(requestPath);
-        const value = versionData[secretKey];
+            core.debug('ℹ using cached response');
+        } else {
+            const result = await got(requestPath, requestOptions);
+            body = result.body;
+            responseCache.set(requestPath, body);
+        }
+
+        let dataDepth = isJSONPath === true ? 0 : kvRequest === false ? 1 : kvVersion;
+
+        const secretData = getResponseData(body, dataDepth);
+        const value = selectData(secretData, secretSelector, isJSONPath);
         command.issue('add-mask', value);
-        core.exportVariable(outputName, `${value}`);
+        core.exportVariable(envVarName, `${value}`);
-        core.debug(`✔ ${secretPath} => ${outputName}`);
+        core.setOutput(outputVarName, `${value}`);
+        core.debug(`✔ ${secretPath} => outputs.${outputVarName} | env.${envVarName}`);
     }
 };
 
+/** @typedef {Object} SecretRequest 
+ * @property {string} secretPath
+ * @property {string} envVarName
+ * @property {string} outputVarName
+ * @property {string} secretSelector
+ * @property {boolean} isJSONPath
+*/
+
 /**
  * Parses a secrets input string into key paths and their resulting environment variable name.
  * @param {string} secretsInput
@@ -79,18 +130,18 @@ function parseSecretsInput(secretsInput) {
         .map(key => key.trim())
         .filter(key => key.length !== 0);
 
-    /** @type {{ secretPath: string; outputName: string; dataKey: string; }[]} */
+    /** @type {SecretRequest[]} */
     const output = [];
     for (const secret of secrets) {
         let path = secret;
-        let outputName = null;
+        let outputVarName = null;
 
         const renameSigilIndex = secret.lastIndexOf('|');
         if (renameSigilIndex > -1) {
             path = secret.substring(0, renameSigilIndex).trim();
-            outputName = secret.substring(renameSigilIndex + 1).trim();
+            outputVarName = secret.substring(renameSigilIndex + 1).trim();
 
-            if (outputName.length < 1) {
+            if (outputVarName.length < 1) {
                 throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
             }
         }
@@ -101,25 +152,61 @@ function parseSecretsInput(secretsInput) {
             .filter(part => part.length !== 0);
 
         if (pathParts.length !== 2) {
-            throw Error(`You must provide a valid path and key. Input: "${secret}"`)
+            throw Error(`You must provide a valid path and key. Input: "${secret}"`);
         }
 
-        const [secretPath, secretKey] = pathParts;
+        const [secretPath, secretSelector] = pathParts;
 
-        // If we're not using a mapped name, normalize the key path into a variable name.
+        const isJSONPath = secretSelector.includes('.');
-        if (!outputName) {
+
-            outputName = normalizeOutputKey(secretKey);
+        if (isJSONPath && !outputVarName) {
+            throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
+        }
+
+        let envVarName = outputVarName;
+        if (!outputVarName) {
+            outputVarName = secretSelector;
+            envVarName = normalizeOutputKey(outputVarName);
         }
 
         output.push({
             secretPath,
-            outputName,
+            envVarName,
-            secretKey
+            outputVarName,
+            secretSelector,
+            isJSONPath
         });
     }
     return output;
 }
 
+/**
+ * Parses a JSON response and returns the secret data
+ * @param {string} responseBody
+ * @param {number} dataLevel
+ */
+function getResponseData(responseBody, dataLevel) {
+    let secretData = JSON.parse(responseBody);
+
+    for (let i = 0; i < dataLevel; i++) {
+        secretData = secretData['data'];
+    }
+    return secretData;
+}
+
+/**
+ * Parses a JSON response and returns the secret data
+ * @param {Object} data
+ * @param {string} selector
+ */
+function selectData(data, selector, isJSONPath) {
+    if (!isJSONPath) {
+        return data[selector];
+    }
+
+    // TODO: JSONPath
+}
+
 /**
  * Replaces any forward-slash characters to
  * @param {string} dataKey
@@ -128,8 +215,17 @@ function normalizeOutputKey(dataKey) {
     return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
 }
 
+// @ts-ignore
+function parseBoolInput(input) {
+    if (input === null || input === undefined || input.trim() === '') {
+        return null;
+    }
+    return Boolean(input);
+}
+
 module.exports = {
     exportSecrets,
     parseSecretsInput,
+    parseResponse: getResponseData,
     normalizeOutputKey
 };

action.test.js

@@ -7,6 +7,7 @@ const got = require('got');
 const {
     exportSecrets,
     parseSecretsInput,
+    parseResponse
 } = require('./action');
 
 const { when } = require('jest-when');
@@ -16,8 +17,10 @@ describe('parseSecretsInput', () => {
         const output = parseSecretsInput('test key');
         expect(output).toContainEqual({
             secretPath: 'test',
-            secretKey: 'key',
+            secretSelector: 'key',
-            outputName: 'KEY',
+            outputVarName: 'key',
+            envVarName: 'KEY',
+            isJSONPath: false
         });
     });
 
@@ -25,7 +28,8 @@ describe('parseSecretsInput', () => {
         const output = parseSecretsInput('test key|testName');
         expect(output).toHaveLength(1);
         expect(output[0]).toMatchObject({
-            outputName: 'testName',
+            outputVarName: 'testName',
+            envVarName: 'testName',
         });
     });
 
@@ -56,10 +60,12 @@ describe('parseSecretsInput', () => {
 
         expect(output).toHaveLength(2);
         expect(output[0]).toMatchObject({
-            outputName: 'A',
+            outputVarName: 'a',
+            envVarName: 'A',
         });
         expect(output[1]).toMatchObject({
-            outputName: 'secondName',
+            outputVarName: 'secondName',
+            envVarName: 'secondName'
         });
     });
 
@@ -74,14 +80,48 @@ describe('parseSecretsInput', () => {
             secretPath: 'first',
         });
         expect(output[1]).toMatchObject({
-            outputName: 'B',
+            outputVarName: 'b',
+            envVarName: 'B'
         });
         expect(output[2]).toMatchObject({
-            outputName: 'SOME_C',
+            outputVarName: 'SOME_C',
+            envVarName: 'SOME_C',
         });
     })
 });
 
+describe('parseResponse', () => {
+    // https://www.vaultproject.io/api/secret/kv/kv-v1.html#sample-response
+    it('parses K/V version 1 response', () => {
+        const response = JSON.stringify({
+            data: {
+                foo: 'bar'
+            }
+        })
+        const output = parseResponse(response, 1);
+
+        expect(output).toEqual({
+            foo: 'bar'
+        });
+    });
+
+    // https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version
+    it('parses K/V version 2 response', () => {
+        const response = JSON.stringify({
+            data: {
+                data: {
+                    foo: 'bar'
+                }
+            }
+        })
+        const output = parseResponse(response, 2);
+
+        expect(output).toEqual({
+            foo: 'bar'
+        });
+    });
+});
+
 
 describe('exportSecrets', () => {
     beforeEach(() => {
@@ -89,27 +129,44 @@ describe('exportSecrets', () => {
 
         when(core.getInput)
             .calledWith('url')
-            .mockReturnValue('http://vault:8200');
+            .mockReturnValueOnce('http://vault:8200');
 
         when(core.getInput)
             .calledWith('token')
-            .mockReturnValue('EXAMPLE');
+            .mockReturnValueOnce('EXAMPLE');
     });
 
     function mockInput(key) {
         when(core.getInput)
             .calledWith('secrets')
-            .mockReturnValue(key);
+            .mockReturnValueOnce(key);
     }
 
-    function mockVaultData(data) {
+    function mockVersion(version) {
-        got.mockResolvedValue({
+        when(core.getInput)
-            body: JSON.stringify({
+            .calledWith('kv-version')
-                data: {
+            .mockReturnValueOnce(version);
-                    data
+    }
-                }
+
-            })
+    function mockVaultData(data, version='2') {
-        });
+        switch(version) {
+            case '1':
+                got.mockResolvedValue({
+                    body: JSON.stringify({
+                        data
+                    })
+                });
+            break;
+            case '2':
+                got.mockResolvedValue({
+                    body: JSON.stringify({
+                        data: {
+                            data
+                        }
+                    })
+                });
+            break;
+        }
     }
 
     it('simple secret retrieval', async () => {
@@ -121,6 +178,7 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
     });
 
     it('mapped secret retrieval', async () => {
@@ -132,5 +190,21 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
+        expect(core.setOutput).toBeCalledWith('TEST_NAME', '1');
     });
-});
+
+    it('simple secret retrieval from K/V v1', async () => {
+        const version = '1';
+
+        mockInput('test key');
+        mockVersion(version);
+        mockVaultData({
+            key: 1
+        }, version);
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+});

integrationTests/basic/integration.test.js

@@ -39,6 +39,46 @@ describe('integration', () => {
                 data: {
                     otherSecret: 'OTHERSUPERSECRET',
                 },
+            }
+        });
+
+        // Enable custom secret engine
+        try {
+            await got(`${vaultUrl}/v1/sys/mounts/my-secret`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+                json: {
+                    type: 'kv'
+                }
+            });
+        } catch (error) {
+            const {response} = error;
+            if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+                // Engine might already be enabled from previous test runs
+            } else {
+                throw error;
+            }
+        }
+
+        await got(`${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                secret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                otherSecret: 'OTHERCUSTOMSECRET',
             },
         });
     });
@@ -48,17 +88,29 @@ describe('integration', () => {
 
         when(core.getInput)
             .calledWith('url')
-            .mockReturnValue(`${vaultUrl}`);
+            .mockReturnValueOnce(`${vaultUrl}`);
 
         when(core.getInput)
             .calledWith('token')
-            .mockReturnValue('testtoken');
+            .mockReturnValueOnce('testtoken');
     });
 
     function mockInput(secrets) {
         when(core.getInput)
             .calledWith('secrets')
-            .mockReturnValue(secrets);
+            .mockReturnValueOnce(secrets);
+    }
+
+    function mockEngineName(name) {
+        when(core.getInput)
+            .calledWith('path')
+            .mockReturnValueOnce(name);
+    }
+
+    function mockVersion(version) {
+        when(core.getInput)
+            .calledWith('kv-version')
+            .mockReturnValueOnce(version);
     }
 
     it('get simple secret', async () => {
@@ -99,4 +151,60 @@ describe('integration', () => {
         expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET');
         expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET');
     });
+
+    it('get secret from K/V v1', async () => {
+        mockInput('test secret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'CUSTOMSECRET');
+    });
+
+    it('get nested secret from K/V v1', async () => {
+        mockInput('nested/test otherSecret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET');
+    });
+
+    describe('generic engines', () => {
+        beforeAll(async () => {
+            await got(`${vaultUrl}/v1/cubbyhole/test`, {
+                method: 'POST',
+                headers: {
+                    'X-Vault-Token': 'testtoken',
+                },
+                json: {
+                    foo: "bar",
+                    zip: "zap"
+                },
+            });
+        });
+
+        it('supports cubbyhole', async () => {            
+            mockInput('/cubbyhole/test foo');
+
+            await exportSecrets();
+
+            expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
+        });
+
+        it('caches responses', async () => {            
+            mockInput(`
+            /cubbyhole/test foo ;
+            /cubbyhole/test zip`);
+
+            await exportSecrets();
+
+            expect(core.debug).toBeCalledWith('ℹ using cached response');
+
+            expect(core.exportVariable).toBeCalledWith('FOO', 'bar');
+            expect(core.exportVariable).toBeCalledWith('ZIP', 'zap');
+        });
+    })
 });

integrationTests/e2e/e2e.test.js

@@ -3,5 +3,11 @@ describe('e2e', () => {
         expect(process.env.SECRET).toBe("SUPERSECRET");
         expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
         expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
+        expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
+        expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
+        expect(process.env.FOO).toBe("bar");
+        expect(process.env.NAMED_CUBBYSECRET).toBe("zap");
     });
-});
+});

integrationTests/e2e/setup.js

@@ -1,15 +1,17 @@
 const got = require('got');
 
+const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
+
 (async () => {
     try {
         // Verify Connection
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
+        await got(`http://${vaultUrl}/v1/secret/config`, {
             headers: {
                 'X-Vault-Token': 'testtoken',
             },
         });
 
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/test`, {
+        await got(`http://${vaultUrl}/v1/secret/data/test`, {
             method: 'POST',
             headers: {
                 'X-Vault-Token': 'testtoken',
@@ -21,7 +23,7 @@ const got = require('got');
             },
         });
 
-        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/nested/test`, {
+        await got(`http://${vaultUrl}/v1/secret/data/nested/test`, {
             method: 'POST',
             headers: {
                 'X-Vault-Token': 'testtoken',
@@ -30,6 +32,47 @@ const got = require('got');
                 data: {
                     otherSecret: 'OTHERSUPERSECRET',
                 },
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/sys/mounts/my-secret`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                type: 'kv'
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/my-secret/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                altSecret: 'CUSTOMSECRET',
+            }
+        });
+
+        await got(`http://${vaultUrl}/v1/my-secret/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                otherAltSecret: 'OTHERCUSTOMSECRET',
+            },
+        });
+
+        await got(`http://${vaultUrl}/v1/cubbyhole/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            json: {
+                foo: 'bar',
+                zip: 'zap',
             },
         });
     } catch (error) {

integrationTests/enterprise/enterprise.test.js

@@ -20,48 +20,19 @@ describe('integration', () => {
             });
 
             // Create namespace
-            await got(`${vaultUrl}/v1/sys/namespaces/ns1`, {
+            await enableNamespace('ns1');
-                method: 'POST',
-                headers: {
-                    'X-Vault-Token': 'testtoken',
-                }
-            });
 
-            // Enable secret engine
+            // Enable K/V v2 secret engine at 'secret/'
-            await got(`${vaultUrl}/v1/sys/mounts/secret`, {
+            await enableEngine('secret', 'ns1', 2);
-                method: 'POST',
-                headers: {
-                    'X-Vault-Token': 'testtoken',
-                    'X-Vault-Namespace': 'ns1',
-                },
-                json: { path: 'secret', type: 'kv', config: {}, options: { version: 2 }, generate_signing_key: true },
-            });
 
-            await got(`${vaultUrl}/v1/secret/data/test`, {
+            await writeSecret('secret', 'test', 'ns1', 2, {secret: 'SUPERSECRET_IN_NAMESPACE'})
-                method: 'POST',
+            await writeSecret('secret', 'nested/test', 'ns1', 2, {otherSecret: 'OTHERSUPERSECRET_IN_NAMESPACE'})
-                headers: {
-                    'X-Vault-Token': 'testtoken',
-                    'X-Vault-Namespace': 'ns1',
-                },
-                json: {
-                    data: {
-                        secret: 'SUPERSECRET_IN_NAMESPACE',
-                    },
-                },
-            });
 
-            await got(`${vaultUrl}/v1/secret/data/nested/test`, {
+            // Enable K/V v1 secret engine at 'my-secret/'
-                method: 'POST',
+            await enableEngine('my-secret', 'ns1', 1);
-                headers: {
+
-                    'X-Vault-Token': 'testtoken',
+            await writeSecret('my-secret', 'test', 'ns1', 1, {secret: 'CUSTOMSECRET_IN_NAMESPACE'})
-                    'X-Vault-Namespace': 'ns1',
+            await writeSecret('my-secret', 'nested/test', 'ns1', 1, {otherSecret: 'OTHERCUSTOMSECRET_IN_NAMESPACE'})
-                },
-                json: {
-                    data: {
-                        otherSecret: 'OTHERSUPERSECRET_IN_NAMESPACE',
-                    },
-                },
-            });
         } catch (e) {
             console.error('Failed to setup test', e);
             throw e;
@@ -73,23 +44,17 @@ describe('integration', () => {
 
         when(core.getInput)
             .calledWith('url')
-            .mockReturnValue(`${vaultUrl}`);
+            .mockReturnValueOnce(`${vaultUrl}`);
 
         when(core.getInput)
             .calledWith('token')
-            .mockReturnValue('testtoken');
+            .mockReturnValueOnce('testtoken');
 
         when(core.getInput)
             .calledWith('namespace')
-            .mockReturnValue('ns1');
+            .mockReturnValueOnce('ns1');
     });
 
-    function mockInput(secrets) {
-        when(core.getInput)
-            .calledWith('secrets')
-            .mockReturnValue(secrets);
-    }
-
     it('get simple secret', async () => {
         mockInput('test secret');
 
@@ -128,6 +93,26 @@ describe('integration', () => {
         expect(core.exportVariable).toBeCalledWith('NAMED_SECRET', 'SUPERSECRET_IN_NAMESPACE');
         expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERSUPERSECRET_IN_NAMESPACE');
     });
+
+    it('get secret from K/V v1', async () => {
+        mockInput('test secret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('SECRET', 'CUSTOMSECRET_IN_NAMESPACE');
+    });
+
+    it('get nested secret from K/V v1', async () => {
+        mockInput('nested/test otherSecret');
+        mockEngineName('my-secret');
+        mockVersion('1');
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('OTHERSECRET', 'OTHERCUSTOMSECRET_IN_NAMESPACE');
+    });
 });
 
 describe('authenticate with approle', () => {
@@ -143,48 +128,34 @@ describe('authenticate with approle', () => {
             });
 
             // Create namespace
-            await got(`${vaultUrl}/v1/sys/namespaces/ns2`, {
+            await enableNamespace("ns2");
-                method: 'POST',
-                headers: {
-                    'X-Vault-Token': 'testtoken',
-                },
-            });
 
-            // Enable secret engine
+            // Enable K/V v2 secret engine at 'secret/'
-            await got(`${vaultUrl}/v1/sys/mounts/secret`, {
+            await enableEngine("secret", "ns2", 2);
-                method: 'POST',
-                headers: {
-                    'X-Vault-Token': 'testtoken',
-                    'X-Vault-Namespace': 'ns2',
-                },
-                json: { path: 'secret', type: 'kv', config: {}, options: { version: 2 }, generate_signing_key: true },
-            });
 
             // Add secret
-            await got(`${vaultUrl}/v1/secret/data/test`, {
+            await writeSecret('secret', 'test', 'ns2', 2, {secret: 'SUPERSECRET_WITH_APPROLE'})
-                method: 'POST',
-                headers: {
-                    'X-Vault-Token': 'testtoken',
-                    'X-Vault-Namespace': 'ns2',
-                },
-                json: {
-                    data: {
-                        secret: 'SUPERSECRET_WITH_APPROLE',
-                    },
-                },
-            });
 
             // Enable approle
-            await got(`${vaultUrl}/v1/sys/auth/approle`, {
+            try {
-                method: 'POST',
+                await got(`${vaultUrl}/v1/sys/auth/approle`, {
-                headers: {
+                    method: 'POST',
-                    'X-Vault-Token': 'testtoken',
+                    headers: {
-                    'X-Vault-Namespace': 'ns2',
+                        'X-Vault-Token': 'testtoken',
-                },
+                        'X-Vault-Namespace': 'ns2',
-                json: {
+                    },
-                    type: 'approle'
+                    json: {
-                },
+                        type: 'approle'
-            });
+                    },
+                });
+            } catch (error) {
+                const {response} = error;
+                if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+                    // Approle might already be enabled from previous test runs
+                } else {
+                    throw error;
+                }
+            }
 
             // Create policies
             await got(`${vaultUrl}/v1/sys/policies/acl/test`, {
@@ -232,7 +203,7 @@ describe('authenticate with approle', () => {
             });
             secretId = secretIdResponse.body.data.secret_id;
         } catch(err) {
-            console.warn('Create approle', err);
+            console.warn('Create approle', err.response.body);
             throw err;
         }
     });
@@ -242,27 +213,21 @@ describe('authenticate with approle', () => {
 
         when(core.getInput)
             .calledWith('method')
-            .mockReturnValue('approle');
+            .mockReturnValueOnce('approle');
         when(core.getInput)
             .calledWith('roleId')
-            .mockReturnValue(roleId);
+            .mockReturnValueOnce(roleId);
         when(core.getInput)
             .calledWith('secretId')
-            .mockReturnValue(secretId);
+            .mockReturnValueOnce(secretId);
         when(core.getInput)
             .calledWith('url')
-            .mockReturnValue(`${vaultUrl}`);
+            .mockReturnValueOnce(`${vaultUrl}`);
         when(core.getInput)
             .calledWith('namespace')
-            .mockReturnValue('ns2');
+            .mockReturnValueOnce('ns2');
     });
 
-    function mockInput(secrets) {
-        when(core.getInput)
-            .calledWith('secrets')
-            .mockReturnValue(secrets);
-    }
-
     it('authenticate with approle', async()=> {
         mockInput('test secret');
 
@@ -270,4 +235,73 @@ describe('authenticate with approle', () => {
 
         expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_WITH_APPROLE');
     })
-});
+});
+
+async function enableNamespace(name) {
+    try {
+        await got(`${vaultUrl}/v1/sys/namespaces/${name}`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            }
+        });
+    } catch (error) {
+        const {response} = error;
+        if (response.statusCode === 400 && response.body.includes("already exists")) {
+            // Namespace might already be enabled from previous test runs
+        } else {
+            throw error;
+        }
+    }
+}
+
+async function enableEngine(path, namespace, version) {
+    try {
+        await got(`${vaultUrl}/v1/sys/mounts/${path}`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+                'X-Vault-Namespace': namespace,
+            },
+            json: { type: 'kv', config: {}, options: { version }, generate_signing_key: true },
+        });
+    } catch (error) {
+        const {response} = error;
+        if (response.statusCode === 400 && response.body.includes("path is already in use")) {
+            // Engine might already be enabled from previous test runs
+        } else {
+            throw error;
+        }
+    }
+}
+
+async function writeSecret(engine, path, namespace, version, data) {
+    const secretPath = (version == 1) ? (`${engine}/${path}`) : (`${engine}/data/${path}`);
+    const secretPayload = (version == 1) ? (data) : ({data});
+    await got(`${vaultUrl}/v1/${secretPath}`, {
+        method: 'POST',
+        headers: {
+            'X-Vault-Token': 'testtoken',
+            'X-Vault-Namespace': namespace,
+        },
+        json: secretPayload
+    });
+}
+
+function mockInput(secrets) {
+    when(core.getInput)
+        .calledWith('secrets')
+        .mockReturnValueOnce(secrets);
+}
+
+function mockEngineName(name) {
+    when(core.getInput)
+        .calledWith('path')
+        .mockReturnValueOnce(name);
+}
+
+function mockVersion(version) {
+    when(core.getInput)
+        .calledWith('kv-version')
+        .mockReturnValueOnce(version);
+}

package.json

@@ -38,13 +38,13 @@
     },
     "homepage": "https://github.com/RichiCoder1/vault-action#readme",
     "dependencies": {
-        "@actions/core": "^1.1.1",
+        "@actions/core": "^1.2.2",
         "got": "^10.2.2"
     },
     "devDependencies": {
-        "@types/jest": "^24.0.18",
+        "@types/jest": "^25.1.3",
-        "@zeit/ncc": "^0.20.5",
+        "@zeit/ncc": "^0.21.1",
-        "jest": "^24.9.0",
+        "jest": "^25.1.0",
         "jest-when": "^2.7.0",
         "semantic-release": "^15.13.24"
     }