feat: rethink how key retrevial is structued and add e2e test

.github/workflows/test.yml

@@ -41,8 +41,8 @@ jobs:
         node-version: 10.x
     - name: npm install
       run: npm ci
-    - name: test connection
+    - name: npm run test:e2e
-      run: node quicktest.js
+      run: npm run test:e2e
       env:
         VAULT_HOST: localhost
         VAULT_PORT: ${{ job.services.vault.ports[8200] }}

README.md

@@ -16,10 +16,9 @@ jobs:
                 vaultUrl: https://vault.mycompany.com
                 vaultToken: ${{ secrets.VaultToken }}
                 keys: |
-                    ci_key ;
+                    ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-                    ci/aws > $.accessKey | AWS_ACCESS_KEY_ID ;
+                    ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
-                    ci/aws > $.secretKey | AWS_SECRET_ACCESS_KEY ;
+                    ci/npm token | NPM_TOKEN
-                    ci/npm_token | NPM_TOKEN
             # ...
 ```
 
@@ -35,17 +34,17 @@ Each key is comprised of the `path` of they key, and optionally a [`JSONPath`](h
 
 ### Simple Key
 
-To retrieve a key `ci/npm_token` that has value `somelongtoken` from vault you could do:
+To retrieve a key `npmToken` from path `ci` that has value `somelongtoken` from vault you could do:
 
 ```yaml
 with:
-    keys: ci/npm_token
+    keys: ci npmToken
 ```
 
-`vault-action` will automatically normalize the given path, and output:
+`vault-action` will automatically normalize the given data key, and output:
 
 ```bash
-CI__NPM_TOKEN=somelongtoken
+NPMTOKEN=somelongtoken
 ```
 
 ### Set Environment Variable Name
@@ -54,40 +53,24 @@ However, if you want to set it to a specific environmental variable, say `NPM_TO
 
 ```yaml
 with:
-    keys: ci/npm_token | NPM_TOKEN
+    keys: ci npmToken | NPM_TOKEN
 ```
 
-With that, `vault-action` will now use your request name and output:
+With that, `vault-action` will now use your requested name and output:
 
 ```bash
 NPM_TOKEN=somelongtoken
 ```
 
-### JSON Key
+### Multiple Keys
 
-Say you are storing a set of AWS keys as a JSON document in Vault like so:
+This action can take multi-line input, so say you had your AWS keys stored in a path and wanted to retrieve both of them. You can do:
-
-```json
-{
-    "accessKey": "AKIAIOSFODNN7EXAMPLE",
-    "secretKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-}
-```
-
-And you want to set them to `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` respectively so you could use the AWS CLI:
 
 ```yaml
 with:
     keys: |
-        ci/aws > $.accessKey | AWS_ACCESS_KEY_ID ;
+        ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-        ci/aws > $.secretKey | AWS_SECRET_ACCESS_KEY
+        ci/aws secretKey | AWS_SECRET_ACCESS_KEY
-```
-
-This would output:
-
-```bash
-AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
-AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
 ```
 
 ## Masking

action.js

@@ -2,7 +2,6 @@
 // @ts-ignore
 const core = require('@actions/core');
 const got = require('got');
-const jq = require('jsonpath');
 
 async function exportSecrets() {
     const vaultUrl = core.getInput('vaultUrl', { required: true });
@@ -12,21 +11,19 @@ async function exportSecrets() {
     const keys = parseKeysInput(keysInput);
 
     for (const key of keys) {
-        const [keyPath, { name, query }] = key;
+        const [keyPath, { outputName, dataKey }] = key;
-        const result = await got(`${vaultUrl}/secret/data/${keyPath}`, {
+        const result = await got(`${vaultUrl}/v1/secret/data/${keyPath}`, {
             headers: {
-                'Accept': 'application/json',
                 'X-Vault-Token': vaultToken
             }
         });
 
         const parsedResponse = JSON.parse(result.body);
-        let value = parsedResponse.data;
+        const vaultKeyData = parsedResponse.data;
-        if (query) {
+        const versionData = vaultKeyData.data;
-            value = jq.value(value, query);
+        const value = versionData[dataKey];
-        }
+        core.exportSecret(outputName, value);
-        core.exportSecret(name, value);
+        core.debug(`✔ ${keyPath} => ${outputName}`);
-        core.debug(`✔ ${keyPath} => ${name}`);
     }
 };
 
@@ -41,51 +38,41 @@ function parseKeysInput(keys) {
         .map(key => key.trim())
         .filter(key => key.length !== 0);
 
-    /** @type {Map<string, { name: string; query: string; }>} */
+    /** @type {Map<string, { outputName: string; dataKey: string; }>} */
     const output = new Map();
     for (const keyPair of keyPairs) {
         let path = keyPair;
-        let mappedName = null;
+        let outputName = null;
-        let query = null;
 
         const renameSigilIndex = keyPair.lastIndexOf('|');
         if (renameSigilIndex > -1) {
             path = keyPair.substring(0, renameSigilIndex).trim();
-            mappedName = keyPair.substring(renameSigilIndex + 1).trim();
+            outputName = keyPair.substring(renameSigilIndex + 1).trim();
 
-            if (mappedName.length < 1) {
+            if (outputName.length < 1) {
                 throw Error(`You must provide a value when mapping a secret to a name. Input: "${keyPair}"`);
             }
         }
 
-        const pathPair = path;
+        const pathParts = path
-        const querySigilIndex = pathPair.indexOf('>');
+            .split(/\s+/)
-        if (querySigilIndex > -1) {
+            .map(part => part.trim())
-            path = pathPair.substring(0, querySigilIndex).trim();
+            .filter(part => part.length !== 0);
-            query = pathPair.substring(querySigilIndex + 1).trim();
 
-            try {
+        if (pathParts.length !== 2) {
-                const expression = jq.parse(query);
+            throw Error(`You must provide a valid path and key. Input: "${keyPair}"`)
-                if (expression.length === 0) {
-                    throw Error(`Invalid query expression provided "${query}" from "${keyPair}".`);
-                }
-            } catch (_) {
-                throw Error(`Invalid query expression provided "${query}" from "${keyPair}".`);
-            }
         }
 
-        if (path.length === 0) {
+        const [secretPath, dataKey] = pathParts;
-            throw Error(`You must provide a valid path. Input: "${keyPair}"`)
-        }
 
         // If we're not using a mapped name, normalize the key path into a variable name.
-        if (!mappedName) {
+        if (!outputName) {
-            mappedName = normalizeKeyName(path);
+            outputName = normalizeKeyName(dataKey);
         }
         
-        output.set(path, {
+        output.set(secretPath, {
-            name: mappedName,
+            outputName,
-            query
+            dataKey
         });
     }
     return output;

action.test.js

@@ -12,55 +12,33 @@ const { when } = require('jest-when');
 
 describe('parseKeysInput', () => {
     it('parses simple key', () => {
-        const output = parseKeysInput('test');
+        const output = parseKeysInput('test key');
         expect(output.has('test')).toBeTruthy();
         expect(output.get('test')).toMatchObject({
-            name: 'TEST',
+            outputName: 'KEY',
-            query: null
+            dataKey: 'key'
         });
     });
 
     it('parses mapped key', () => {
-        const output = parseKeysInput('test|testName');
+        const output = parseKeysInput('test key|testName');
         expect(output.get('test')).toMatchObject({
-            name: 'testName',
+            outputName: 'testName'
-            query: null
         });
     });
 
     it('fails on invalid mapped name', () => {
-        expect(() => parseKeysInput('test|'))
+        expect(() => parseKeysInput('test key|'))
-            .toThrowError(`You must provide a value when mapping a secret to a name. Input: "test|"`)
+            .toThrowError(`You must provide a value when mapping a secret to a name. Input: "test key|"`)
     });
 
     it('fails on invalid path for mapped', () => {
         expect(() => parseKeysInput('|testName'))
-            .toThrowError(`You must provide a valid path. Input: "|testName"`)
+            .toThrowError(`You must provide a valid path and key. Input: "|testName"`)
-    });
-
-    it('parses queried key', () => {
-        const output = parseKeysInput('test>$.test');
-        expect(output.get('test')).toMatchObject({
-            name: 'TEST',
-            query: '$.test'
-        });
-    });
-
-    it('fails on invalid query', () => {
-        expect(() => parseKeysInput('test>#'))
-            .toThrowError(`Invalid query expression provided "#" from "test>#".`)
-    });
-
-    it('parses queried and mapped key', () => {
-        const output = parseKeysInput('test>$.test|testName');
-        expect(output.get('test')).toMatchObject({
-            name: 'testName',
-            query: '$.test'
-        });
     });
 
     it('parses multiple keys', () => {
-        const output = parseKeysInput('first;second;');
+        const output = parseKeysInput('first a;second b;');
 
         expect(output.size).toBe(2);
         expect(output.has('first')).toBeTruthy();
@@ -68,20 +46,19 @@ describe('parseKeysInput', () => {
     });
 
     it('parses multiple complex keys', () => {
-        const output = parseKeysInput('first;second|secondName;third>$.third');
+        const output = parseKeysInput('first a;second b|secondName');
 
-        expect(output.size).toBe(3);
+        expect(output.size).toBe(2);
-        expect(output.has('first')).toBeTruthy();
+        expect(output.get('first')).toMatchObject({
-        expect(output.get('second')).toMatchObject({
+            dataKey: 'a'
-            name: 'secondName'
         });
-        expect(output.get('third')).toMatchObject({
+        expect(output.get('second')).toMatchObject({
-            query: '$.third'
+            outputName: 'secondName'
         });
     });
 
     it('parses multiline input', () => {
-        const output = parseKeysInput('\nfirst;\nsecond;\n');
+        const output = parseKeysInput('\nfirst a;\nsecond b;\n');
 
         expect(output.size).toBe(2);
         expect(output.has('first')).toBeTruthy();
@@ -96,7 +73,7 @@ describe('exportSecrets', () => {
 
         when(core.getInput)
             .calledWith('vaultUrl')
-            .mockReturnValue('https://vault');
+            .mockReturnValue('http://vault:8200');
 
         when(core.getInput)
             .calledWith('vaultToken')
@@ -119,31 +96,24 @@ describe('exportSecrets', () => {
     }
 
     it('simple key retrieval', async () => {
-        mockInput('test');
+        mockInput('test key');
-        mockVaultData('1');
-
-        await exportSecrets();
-
-        expect(core.exportSecret).toBeCalledWith('TEST', '1');
-    });
-
-    it('mapped key retrieval', async () => {
-        mockInput('test|TEST_NAME');
-        mockVaultData('1');
-
-        await exportSecrets();
-
-        expect(core.exportSecret).toBeCalledWith('TEST_NAME', '1');
-    });
-
-    it('queried data retrieval', async () => {
-        mockInput('test > $.key');
         mockVaultData({
-            key: 'SECURE'
+            key: 1
         });
 
         await exportSecrets();
 
-        expect(core.exportSecret).toBeCalledWith('TEST', 'SECURE');
+        expect(core.exportSecret).toBeCalledWith('KEY', 1);
+    });
+
+    it('mapped key retrieval', async () => {
+        mockInput('test key|TEST_NAME');
+        mockVaultData({
+            key: 1
+        });
+
+        await exportSecrets();
+
+        expect(core.exportSecret).toBeCalledWith('TEST_NAME', 1);
     });
 });

e2e/e2e.test.js

@@ -0,0 +1,93 @@
+jest.mock('@actions/core');
+const core = require('@actions/core');
+
+const got = require('got');
+const { when } = require('jest-when');
+
+const { exportSecrets } = require('../action');
+
+describe('e2e', () => {
+
+    beforeAll(async () => {
+        console.debug(`Testing against: http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret`)
+
+        // Verify Connection
+        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+        });
+
+        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            body: {
+                data: {
+                    a: 1,
+                    b: 2,
+                    c: 3,
+                },
+            },
+            json: true,
+        });
+
+        await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/data/nested/test`, {
+            method: 'POST',
+            headers: {
+                'X-Vault-Token': 'testtoken',
+            },
+            body: {
+                data: {
+                    e: 4,
+                    f: 5,
+                    g: 6,
+                },
+            },
+            json: true,
+        });
+    })
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+
+        when(core.getInput)
+            .calledWith('vaultUrl')
+            .mockReturnValue(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`);
+
+        when(core.getInput)
+            .calledWith('vaultToken')
+            .mockReturnValue('testtoken');
+    });
+
+    function mockInput(key) {
+        when(core.getInput)
+            .calledWith('keys')
+            .mockReturnValue(key);
+    }
+
+    it('get simple secret', async () => {
+        mockInput('test a')
+
+        await exportSecrets();
+
+        expect(core.exportSecret).toBeCalledWith('A', 1);
+    });
+
+    it('re-map secret', async () => {
+        mockInput('test a | TEST_KEY')
+
+        await exportSecrets();
+
+        expect(core.exportSecret).toBeCalledWith('TEST_KEY', 1);
+    });
+
+    it('get nested secret', async () => {
+        mockInput('nested/test e')
+
+        await exportSecrets();
+
+        expect(core.exportSecret).toBeCalledWith('E', 4);
+    });
+});

e2e/jest.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+    verbose: true
+};

jest.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+    testPathIgnorePatterns: ['/node_modules/', '<rootDir>/e2e/'],
+};

package-lock.json

@@ -1181,7 +1181,8 @@
     "deep-is": {
       "version": "0.1.3",
       "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.3.tgz",
-      "integrity": "sha1-s2nW+128E+7PUk+RsHD+7cNXzzQ="
+      "integrity": "sha1-s2nW+128E+7PUk+RsHD+7cNXzzQ=",
+      "dev": true
     },
     "defer-to-connect": {
       "version": "1.0.2",
@@ -1352,6 +1353,7 @@
       "version": "1.12.0",
       "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-1.12.0.tgz",
       "integrity": "sha512-TuA+EhsanGcme5T3R0L80u4t8CpbXQjegRmf7+FPTJrtCTErXFeelblRgHQa1FofEzqYYJmJ/OqjTwREp9qgmg==",
+      "dev": true,
       "requires": {
         "esprima": "^3.1.3",
         "estraverse": "^4.2.0",
@@ -1363,24 +1365,22 @@
         "esprima": {
           "version": "3.1.3",
           "resolved": "https://registry.npmjs.org/esprima/-/esprima-3.1.3.tgz",
-          "integrity": "sha1-/cpRzuYTOJXjyI1TXOSdv/YqRjM="
+          "integrity": "sha1-/cpRzuYTOJXjyI1TXOSdv/YqRjM=",
+          "dev": true
         }
       }
     },
-    "esprima": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-1.2.2.tgz",
-      "integrity": "sha1-dqD9Zvz+FU/SkmZ9wmQBl1CxZXs="
-    },
     "estraverse": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw=="
+      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "dev": true
     },
     "esutils": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g=="
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true
     },
     "exec-sh": {
       "version": "0.3.2",
@@ -1571,7 +1571,8 @@
     "fast-levenshtein": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc="
+      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
+      "dev": true
     },
     "fb-watchman": {
       "version": "2.0.0",
@@ -3268,16 +3269,6 @@
         "minimist": "^1.2.0"
       }
     },
-    "jsonpath": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/jsonpath/-/jsonpath-1.0.2.tgz",
-      "integrity": "sha512-rmzlgFZiQPc6q4HDyK8s9Qb4oxBnI5sF61y/Co5PV0lc3q2bIuRsNdueVbhoSHdKM4fxeimphOAtfz47yjCfeA==",
-      "requires": {
-        "esprima": "1.2.2",
-        "static-eval": "2.0.2",
-        "underscore": "1.7.0"
-      }
-    },
     "jsprim": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/jsprim/-/jsprim-1.4.1.tgz",
@@ -3326,6 +3317,7 @@
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/levn/-/levn-0.3.0.tgz",
       "integrity": "sha1-OwmSTt+fCDwEkP3UwLxEIeBHZO4=",
+      "dev": true,
       "requires": {
         "prelude-ls": "~1.1.2",
         "type-check": "~0.3.2"
@@ -3802,6 +3794,7 @@
       "version": "0.8.2",
       "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.8.2.tgz",
       "integrity": "sha1-NkxeQJ0/TWMB1sC0wFu6UBgK62Q=",
+      "dev": true,
       "requires": {
         "deep-is": "~0.1.3",
         "fast-levenshtein": "~2.0.4",
@@ -3961,7 +3954,8 @@
     "prelude-ls": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.1.2.tgz",
-      "integrity": "sha1-IZMqVJ9eUv/ZqCf1cOBL5iqX2lQ="
+      "integrity": "sha1-IZMqVJ9eUv/ZqCf1cOBL5iqX2lQ=",
+      "dev": true
     },
     "prepend-http": {
       "version": "2.0.0",
@@ -4459,7 +4453,8 @@
     "source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "dev": true
     },
     "source-map-resolve": {
       "version": "0.5.2",
@@ -4554,14 +4549,6 @@
       "integrity": "sha512-MTX+MeG5U994cazkjd/9KNAapsHnibjMLnfXodlkXw76JEea0UiNzrqidzo1emMwk7w5Qhc9jd4Bn9TBb1MFwA==",
       "dev": true
     },
-    "static-eval": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/static-eval/-/static-eval-2.0.2.tgz",
-      "integrity": "sha512-N/D219Hcr2bPjLxPiV+TQE++Tsmrady7TqAJugLy7Xk1EumfDWS/f5dtBbkRCGE7wKKXuYockQoj8Rm2/pVKyg==",
-      "requires": {
-        "escodegen": "^1.8.1"
-      }
-    },
     "static-extend": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/static-extend/-/static-extend-0.1.2.tgz",
@@ -4804,6 +4791,7 @@
       "version": "0.3.2",
       "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.3.2.tgz",
       "integrity": "sha1-WITKtRLPHTVeP7eE8wgEsrUg23I=",
+      "dev": true,
       "requires": {
         "prelude-ls": "~1.1.2"
       }
@@ -4819,11 +4807,6 @@
         "source-map": "~0.6.1"
       }
     },
-    "underscore": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.7.0.tgz",
-      "integrity": "sha1-a7rwh3UA02vjTsqlhODbn+8DUgk="
-    },
     "union-value": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz",
@@ -5010,7 +4993,8 @@
     "wordwrap": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz",
-      "integrity": "sha1-J1hIEIkUVqQXHI0CJkQa3pDLyus="
+      "integrity": "sha1-J1hIEIkUVqQXHI0CJkQa3pDLyus=",
+      "dev": true
     },
     "wrap-ansi": {
       "version": "5.1.0",

package.json

@@ -4,7 +4,8 @@
   "description": "A Github Action that allows you to consume vault secrets as secure environment variables.",
   "main": "index.js",
   "scripts": {
-    "test": "jest"
+    "test": "jest",
+    "test:e2e": "jest -c e2e/jest.config.js"
   },
   "repository": {
     "type": "git",
@@ -26,8 +27,7 @@
   "homepage": "https://github.com/RichiCoder1/vault-action#readme",
   "dependencies": {
     "@actions/core": "^1.1.1",
-    "got": "^9.6.0",
+    "got": "^9.6.0"
-    "jsonpath": "^1.0.2"
   },
   "devDependencies": {
     "@types/jest": "^24.0.18",

quicktest.js

@@ -1,11 +0,0 @@
-const got = require('got');
-
-(async () => {
-    const result = await got(`http://${process.env.VAULT_HOST}:${process.env.VAULT_PORT}/v1/secret/config`, {
-        headers: {
-            'X-Vault-Token': 'testtoken'
-        }
-    });
-    
-    console.log(result.body);
-})();