Skip to content

Commit 3ad2628

Browse files
feat(vault): not allowing batch token revoke (#4918)
* not allowing batch token revoke * chaging values to hold variable name * error message when identifying service token * refactor --------- Co-authored-by: Googlom <[email protected]>
1 parent 5c47be3 commit 3ad2628

File tree

1 file changed

+22
-1
lines changed

1 file changed

+22
-1
lines changed

pkg/vault/vault.go

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"github.com/hashicorp/vault/api"
88
"path"
99
"strconv"
10+
"strings"
1011
"time"
1112
)
1213

@@ -181,7 +182,27 @@ func (c *Client) RevokeToken() error {
181182
// MustRevokeToken same as RevokeToken but the program is terminated with an error if this fails.
182183
// Should be used in defer statements only.
183184
func (c *Client) MustRevokeToken() {
184-
if err := c.RevokeToken(); err != nil {
185+
lookupPath := "auth/token/lookup-self"
186+
const serviceTokenPrefix = "hvs."
187+
188+
secret, err := c.GetSecret(lookupPath)
189+
if err != nil {
190+
log.Entry().Warnf("Could not lookup token at %s, not continuing to revoke: %v", lookupPath, err)
191+
return
192+
}
193+
194+
tokenID, ok := secret.Data["id"].(string)
195+
if !ok {
196+
log.Entry().Warnf("Could not lookup token.Data.id at %s, not continuing to revoke", lookupPath)
197+
return
198+
}
199+
200+
if !strings.HasPrefix(tokenID, serviceTokenPrefix) {
201+
log.Entry().Warnf("Service token not identified at %s, not continuing to revoke", lookupPath)
202+
return
203+
}
204+
205+
if err = c.RevokeToken(); err != nil {
185206
log.Entry().WithError(err).Fatal("Could not revoke token")
186207
}
187208
}

0 commit comments

Comments
 (0)