Vault Support (GSI-973) #8
Conversation
Update lock files, openapi, config, readme Add vault config to sms config
Remove custom errors -- are not used
Compartmentalize VaultConfig
Pull Request Test Coverage Report for Build 11593029394Details
💛 - Coveralls |
|
Given that only the case of EKSS exists at the moment, the current SMS configuration is enough but also limited to only one SMS per path in the vault. It would be more convenient not to have only one Security vise it should be safe because the policies attached to the token grant the necessary permissions for those paths. It may require catching the case of permission error in the code to return an appropriate response to the requester. |
| secrets_handler: dummies.SecretsHandlerPortDummy, | ||
| _token: Annotated[TokenAuthContext, require_token], | ||
| ): | ||
| """Delete one or more secrets from the vault""" |
There was a problem hiding this comment.
It's deleting all of them, though
There was a problem hiding this comment.
Agh, outdated docstring. Thought I got all of that. Thanks
tests/fixtures/dummies.py
Outdated
| """Delete all secrets stored in the vault.""" | ||
| self.secrets = [] | ||
| self.secrets.pop(vault_path, None) |
There was a problem hiding this comment.
This would also remove the key from the dict.
Is this intended?
There was a problem hiding this comment.
I've removed the whole dummy class and replaced it with Mock in 536198b
| AsyncTestClient(app=app) as client, | ||
| ): | ||
| response = await client.get("/secrets/doesnotexist", headers=HEADERS) | ||
| assert response.status_code == 200 |
There was a problem hiding this comment.
I think because you cannot distinguish the invalid path from an empty path, it returns an empty list in either case, and I think it should.
There was a problem hiding this comment.
Regardless of if you return an empty list or raise an error, you can't tell if it's a path problem or an empty vault.
But a non-existent vault has no secrets, so I don't really see a problem with doing it that way.
GET /secrets/{vault_path}: returns a list of all keys in the specified vaultDELETE /secrets/{vault_path}: deletes all keys in the specified vault