fix: release new action bundle

* feat: add the ability to set extra headers

* switch to more generic map solution for headers

.github/FUNDING.yml

@@ -0,0 +1 @@
+ko_fi: richicoder

.github/workflows/build.yml

@@ -112,6 +112,7 @@ jobs:
         VAULT_PORT: ${{ job.services.vault.ports[8200] }}
     - name: use vault action (default K/V version 2)
       uses: ./
+      id: kv-secrets
       with:
         url: http://localhost:${{ job.services.vault.ports[8200] }}
         token: testtoken
@@ -140,6 +141,8 @@ jobs:
           /cubbyhole/test zip | NAMED_CUBBYSECRET ;
     - name: verify
       run: npm run test:e2e
+      env:
+        OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
 
   publish:
     if: github.event_name	== 'push' && contains(github.ref, 'master')

README.md

@@ -2,7 +2,7 @@
 
 A helper action for easily pulling secrets from HashiCorp Vault™.
 
-By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the K/V Engine. See examples below for how to [use v1](#using-kv-version-1) as well as non-K/V engines.
+By default, this action pulls from  [Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2/) of the K/V Engine. See examples below for how to [use v1](#using-kv-version-1) as well as [other non-K/V engines](#other-secret-engines).
 
 ## Example Usage
 
@@ -52,7 +52,7 @@ The `secrets` parameter is a set of multiple secret requests separated by the `;
 Each secret request is comprised of the `path` and the `key` of the desired secret, and optionally the desired Env Var output name.
 
 ```raw
-{{ Secret Path }} {{ Secret Key }} | {{ Output Environment Variable Name }}
+{{ Secret Path }} {{ Secret Key }} | {{ Output Variable Name }}
 ```
 
 ### Simple Key
@@ -64,15 +64,28 @@ with:
     secrets: ci npmToken
 ```
 
-`vault-action` will automatically normalize the given data key, and output:
+`vault-action` will automatically normalize the given secret selector key, and set the follow as environment variables for the following steps in the current job:
 
 ```bash
 NPMTOKEN=somelongtoken
 ```
 
-### Set Environment Variable Name
+You can also access the secret via ouputs:
 
-However, if you want to set it to a specific environmental variable, say `NPM_TOKEN`, you could do this instead:
+```yaml
+steps:
+    # ...
+    - name: Import Secrets
+      id: secrets
+      # Import config...
+    - name: Sensitive Operation
+      run: "my-cli --token '${{ steps.secrets.outputs.npmToken }}'"
+
+```
+
+### Set Output Variable Name
+
+However, if you want to set it to a specific name, say `NPM_TOKEN`, you could do this instead:
 
 ```yaml
 with:
@@ -85,6 +98,17 @@ With that, `vault-action` will now use your requested name and output:
 NPM_TOKEN=somelongtoken
 ```
 
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
+
+```
+
 ### Multiple Secrets
 
 This action can take multi-line input, so say you had your AWS keys stored in a path and wanted to retrieve both of them. You can do:
@@ -147,7 +171,20 @@ with:
 Resulting in:
 
 ```bash
-FOO=bar MY_KEY=zap
+FOO=bar
+MY_KEY=zap
+```
+
+```yaml
+steps:
+  # ...
+  - name: Import Secrets
+    id: secrets
+    # Import config...
+  - name: Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.foo }}'"
+  - name: Another Sensitive Operation
+    run: "my-cli --token '${{ steps.secrets.outputs.MY_KEY }}'"
 ```
 
 Secrets pulled from the same `Secret Path` are cached by default. So if you, for example, are using the `aws` engine and retrieve a key, only a single key for a given path is returned.

action.js

@@ -1,4 +1,8 @@
+// @ts-check
+
+// @ts-ignore
 const core = require('@actions/core');
+// @ts-ignore
 const command = require('@actions/core/lib/command');
 const got = require('got');
 
@@ -8,6 +12,7 @@ const VALID_KV_VERSION = [-1, 1, 2];
 async function exportSecrets() {
     const vaultUrl = core.getInput('url', { required: true });
     const vaultNamespace = core.getInput('namespace', { required: false });
+    const extraHeaders = parseHeadersInput('extraHeaders', { required: false });
 
     let enginePath = core.getInput('path', { required: false });
     let kvVersion = core.getInput('kv-version', { required: false });
@@ -36,6 +41,7 @@ async function exportSecrets() {
                 options.headers["X-Vault-Namespace"] = vaultNamespace;
             }
 
+            /** @type {any} */
             const result = await got.post(`${vaultUrl}/v1/auth/approle/login`, options);
             if (result && result.body && result.body.auth && result.body.auth.client_token) {
                 vaultToken = result.body.auth.client_token;
@@ -64,13 +70,17 @@ async function exportSecrets() {
 
     const responseCache = new Map();
     for (const secretRequest of secretRequests) {
-        const { secretPath, outputName, secretSelector, isJSONPath } = secretRequest;
+        const { secretPath, outputVarName, envVarName, secretSelector, isJSONPath } = secretRequest;
         const requestOptions = {
             headers: {
                 'X-Vault-Token': vaultToken
             },
         };
 
+        for (const [headerName, headerValue] of extraHeaders) {
+            requestOptions.headers[headerName] = headerValue;
+        }
+
         if (vaultNamespace != null) {
             requestOptions.headers["X-Vault-Namespace"] = vaultNamespace;
         }
@@ -98,13 +108,22 @@ async function exportSecrets() {
         let dataDepth = isJSONPath === true ? 0 : kvRequest === false ? 1 : kvVersion;
 
         const secretData = getResponseData(body, dataDepth);
-        const value = selectData(secretData, secretSelector);
+        const value = selectData(secretData, secretSelector, isJSONPath);
         command.issue('add-mask', value);
-        core.exportVariable(outputName, `${value}`);
+        core.exportVariable(envVarName, `${value}`);
-        core.debug(`✔ ${secretPath} => ${outputName}`);
+        core.setOutput(outputVarName, `${value}`);
+        core.debug(`✔ ${secretPath} => outputs.${outputVarName} | env.${envVarName}`);
     }
 };
 
+/** @typedef {Object} SecretRequest 
+ * @property {string} secretPath
+ * @property {string} envVarName
+ * @property {string} outputVarName
+ * @property {string} secretSelector
+ * @property {boolean} isJSONPath
+*/
+
 /**
  * Parses a secrets input string into key paths and their resulting environment variable name.
  * @param {string} secretsInput
@@ -116,18 +135,18 @@ function parseSecretsInput(secretsInput) {
         .map(key => key.trim())
         .filter(key => key.length !== 0);
 
-    /** @type {{ secretPath: string; outputName: string; dataKey: string; }[]} */
+    /** @type {SecretRequest[]} */
     const output = [];
     for (const secret of secrets) {
         let path = secret;
-        let outputName = null;
+        let outputVarName = null;
 
         const renameSigilIndex = secret.lastIndexOf('|');
         if (renameSigilIndex > -1) {
             path = secret.substring(0, renameSigilIndex).trim();
-            outputName = secret.substring(renameSigilIndex + 1).trim();
+            outputVarName = secret.substring(renameSigilIndex + 1).trim();
 
-            if (outputName.length < 1) {
+            if (outputVarName.length < 1) {
                 throw Error(`You must provide a value when mapping a secret to a name. Input: "${secret}"`);
             }
         }
@@ -138,21 +157,29 @@ function parseSecretsInput(secretsInput) {
             .filter(part => part.length !== 0);
 
         if (pathParts.length !== 2) {
-            throw Error(`You must provide a valid path and key. Input: "${secret}"`)
+            throw Error(`You must provide a valid path and key. Input: "${secret}"`);
         }
 
         const [secretPath, secretSelector] = pathParts;
 
-        // If we're not using a mapped name, normalize the key path into a variable name.
+        const isJSONPath = secretSelector.includes('.');
-        if (!outputName) {
+
-            outputName = normalizeOutputKey(secretSelector);
+        if (isJSONPath && !outputVarName) {
+            throw Error(`You must provide a name for the output key when using json selectors. Input: "${secret}"`);
+        }
+
+        let envVarName = outputVarName;
+        if (!outputVarName) {
+            outputVarName = secretSelector;
+            envVarName = normalizeOutputKey(outputVarName);
         }
 
         output.push({
             secretPath,
-            outputName,
+            envVarName,
+            outputVarName,
             secretSelector,
-            isJSONPath: secretSelector.startsWith('$')
+            isJSONPath
         });
     }
     return output;
@@ -161,7 +188,7 @@ function parseSecretsInput(secretsInput) {
 /**
  * Parses a JSON response and returns the secret data
  * @param {string} responseBody
- * @param {number} kvVersion
+ * @param {number} dataLevel
  */
 function getResponseData(responseBody, dataLevel) {
     let secretData = JSON.parse(responseBody);
@@ -193,6 +220,10 @@ function normalizeOutputKey(dataKey) {
     return dataKey.replace('/', '__').replace(/[^\w-]/, '').toUpperCase();
 }
 
+// @ts-ignore
+/**
+ * @param {string} input
+ */
 function parseBoolInput(input) {
     if (input === null || input === undefined || input.trim() === '') {
         return null;
@@ -200,9 +231,35 @@ function parseBoolInput(input) {
     return Boolean(input);
 }
 
+/**
+ * @param {string} inputKey
+ * @param {any} inputOptions
+ */
+function parseHeadersInput(inputKey, inputOptions) {
+    /** @type {string}*/
+    const rawHeadersString = core.getInput(inputKey, inputOptions) || '';
+    const headerStrings = rawHeadersString
+        .split('\n')
+        .map(line => line.trim())
+        .filter(line => line !== '');
+    return headerStrings
+        .reduce((map, line) => {
+            const seperator = line.indexOf(':');
+            const key = line.substring(0, seperator).trim().toLowerCase();
+            const value = line.substring(seperator + 1).trim();
+            if (map.has(key)) {
+                map.set(key, [map.get(key), value].join(', '));
+            } else {
+                map.set(key, value);
+            }
+            return map;
+        }, new Map());
+}
+
 module.exports = {
     exportSecrets,
     parseSecretsInput,
     parseResponse: getResponseData,
-    normalizeOutputKey
+    normalizeOutputKey,
+    parseHeadersInput
 };

action.test.js

@@ -7,7 +7,8 @@ const got = require('got');
 const {
     exportSecrets,
     parseSecretsInput,
-    parseResponse
+    parseResponse,
+    parseHeadersInput
 } = require('./action');
 
 const { when } = require('jest-when');
@@ -18,7 +19,8 @@ describe('parseSecretsInput', () => {
         expect(output).toContainEqual({
             secretPath: 'test',
             secretSelector: 'key',
-            outputName: 'KEY',
+            outputVarName: 'key',
+            envVarName: 'KEY',
             isJSONPath: false
         });
     });
@@ -27,7 +29,8 @@ describe('parseSecretsInput', () => {
         const output = parseSecretsInput('test key|testName');
         expect(output).toHaveLength(1);
         expect(output[0]).toMatchObject({
-            outputName: 'testName',
+            outputVarName: 'testName',
+            envVarName: 'testName',
         });
     });
 
@@ -58,10 +61,12 @@ describe('parseSecretsInput', () => {
 
         expect(output).toHaveLength(2);
         expect(output[0]).toMatchObject({
-            outputName: 'A',
+            outputVarName: 'a',
+            envVarName: 'A',
         });
         expect(output[1]).toMatchObject({
-            outputName: 'secondName',
+            outputVarName: 'secondName',
+            envVarName: 'secondName'
         });
     });
 
@@ -76,14 +81,56 @@ describe('parseSecretsInput', () => {
             secretPath: 'first',
         });
         expect(output[1]).toMatchObject({
-            outputName: 'B',
+            outputVarName: 'b',
+            envVarName: 'B'
         });
         expect(output[2]).toMatchObject({
-            outputName: 'SOME_C',
+            outputVarName: 'SOME_C',
+            envVarName: 'SOME_C',
         });
     })
 });
 
+describe('parseHeaders', () => {
+    it('parses simple header', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce('TEST: 1');
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+    });
+
+    it('parses simple header with whitespace', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(`
+            TEST: 1
+            `);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+    });
+
+    it('parses multiple headers', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(`
+            TEST: 1
+            FOO: bAr
+            `);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toContainEqual(['test', '1']);
+        expect(Array.from(result)).toContainEqual(['foo', 'bAr']);
+    });
+
+    it('parses null response', () => {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(null);
+        const result = parseHeadersInput('extraHeaders');
+        expect(Array.from(result)).toHaveLength(0);
+    });
+})
+
 describe('parseResponse', () => {
     // https://www.vaultproject.io/api/secret/kv/kv-v1.html#sample-response
     it('parses K/V version 1 response', () => {
@@ -142,6 +189,12 @@ describe('exportSecrets', () => {
             .mockReturnValueOnce(version);
     }
 
+    function mockExtraHeaders(headerString) {
+        when(core.getInput)
+            .calledWith('extraHeaders')
+            .mockReturnValueOnce(headerString);
+    }
+
     function mockVaultData(data, version='2') {
         switch(version) {
             case '1':
@@ -172,6 +225,7 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
     });
 
     it('mapped secret retrieval', async () => {
@@ -183,11 +237,29 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('TEST_NAME', '1');
+        expect(core.setOutput).toBeCalledWith('TEST_NAME', '1');
     });
 
     it('simple secret retrieval from K/V v1', async () => {
         const version = '1';
 
+        mockInput('test key');
+        mockExtraHeaders(`
+        TEST: 1
+        `);
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
+    });
+
+    it('simple secret retrieval with extra headers', async () => {
+        const version = '1';
+
         mockInput('test key');
         mockVersion(version);
         mockVaultData({
@@ -197,5 +269,6 @@ describe('exportSecrets', () => {
         await exportSecrets();
 
         expect(core.exportVariable).toBeCalledWith('KEY', '1');
+        expect(core.setOutput).toBeCalledWith('key', '1');
     });
 });

action.yml

@@ -13,6 +13,9 @@ inputs:
   namespace:
     description: 'The Vault namespace from which to query secrets. Vault Enterprise only, unset by default'
     required: false
+  extraHeaders:
+    description: 'A string of newline seperated extra headers to include on every request.'
+    required: false
 runs:
   using: 'node12'
   main: 'dist/index.js'

integrationTests/e2e/e2e.test.js

@@ -3,6 +3,7 @@ describe('e2e', () => {
         expect(process.env.SECRET).toBe("SUPERSECRET");
         expect(process.env.NAMED_SECRET).toBe("SUPERSECRET");
         expect(process.env.OTHERSECRET).toBe("OTHERSUPERSECRET");
+        expect(process.env.OTHER_SECRET_OUTPUT).toBe("OTHERSUPERSECRET");
         expect(process.env.ALTSECRET).toBe("CUSTOMSECRET");
         expect(process.env.NAMED_ALTSECRET).toBe("CUSTOMSECRET");
         expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");

package.json

@@ -38,13 +38,13 @@
     },
     "homepage": "https://github.com/RichiCoder1/vault-action#readme",
     "dependencies": {
-        "@actions/core": "^1.1.1",
+        "@actions/core": "^1.2.2",
         "got": "^10.2.2"
     },
     "devDependencies": {
-        "@types/jest": "^24.0.18",
+        "@types/jest": "^25.1.3",
-        "@zeit/ncc": "^0.20.5",
+        "@zeit/ncc": "^0.21.1",
-        "jest": "^24.9.0",
+        "jest": "^25.1.0",
         "jest-when": "^2.7.0",
         "semantic-release": "^15.13.24"
     }