-
Notifications
You must be signed in to change notification settings - Fork 111
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Integrated async access to vault secrets (#1452)
* Integrate async access to vault secrets * Add and fix tests for vault secrets * Fix errors for pm.vault * Fix mutation tracking for vault secrets * Update dependencies --------- Co-authored-by: Pranav Joglekar <[email protected]>
- Loading branch information
1 parent
7c6debc
commit 7ddff0f
Showing
8 changed files
with
253 additions
and
56 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,6 +21,8 @@ var _ = require('lodash'), | |
| EXECUTION_COOKIES_EVENT_BASE = 'execution.cookies.', | ||
| EXECUTION_SKIP_REQUEST_EVENT_BASE = 'execution.skipRequest.', | ||
|
|
||
| EXECUTION_VAULT_BASE = 'execution.vault.', | ||
|
|
||
| COOKIES_EVENT_STORE_ACTION = 'store', | ||
| COOKIE_STORE_PUT_METHOD = 'putCookie', | ||
| COOKIE_STORE_UPDATE_METHOD = 'updateCookie', | ||
|
|
@@ -240,8 +242,17 @@ module.exports = { | |
|
|
||
| packageResolver = _.get(this, 'options.script.packageResolver'), | ||
|
|
||
| vaultSecrets = payload.context.vaultSecrets, | ||
| allowVaultAccess = _.get(vaultSecrets, '_.allowScriptAccess'), | ||
|
|
||
| events; | ||
|
|
||
| // Explicitly enable tracking for vault secrets here as this will | ||
| // not be sent to sandbox who otherwise takes care of mutation tracking | ||
| if (allowVaultAccess) { | ||
| vaultSecrets.enableTracking({ autoCompact: true }); | ||
| } | ||
|
|
||
| // @todo: find a better place to code this so that event is not aware of such options | ||
| if (abortOnFailure) { | ||
| abortOnError = true; | ||
|
|
@@ -387,6 +398,22 @@ module.exports = { | |
| } | ||
| }.bind(this)); | ||
|
|
||
| this.host.on(EXECUTION_VAULT_BASE + executionId, function (id, cmd, ...args) { | ||
| // Ensure error is string | ||
| // TODO identify why error objects are not being serialized correctly | ||
| const dispatch = (e, r) => { this.host.dispatch(EXECUTION_VAULT_BASE + executionId, id, e, r); }; | ||
|
|
||
| if (!allowVaultAccess) { | ||
| return dispatch('Vault access denied'); | ||
| } | ||
|
|
||
| if (!['get', 'set', 'unset'].includes(cmd)) { | ||
| return dispatch(`Invalid vault command: ${cmd}`); | ||
| } | ||
|
|
||
| dispatch(null, vaultSecrets[cmd](...args)); | ||
| }.bind(this)); | ||
|
|
||
| this.host.on(EXECUTION_REQUEST_EVENT_BASE + executionId, | ||
| function (scriptCursor, id, requestId, request) { | ||
| // remove files in request body if any | ||
|
|
@@ -458,11 +485,7 @@ module.exports = { | |
| // @todo: Expose this as a property in Collection SDK's Script | ||
| timeout: payload.scriptTimeout, | ||
| cursor: scriptCursor, | ||
| context: { | ||
| ..._.pick(payload.context, SAFE_CONTEXT_VARIABLES), | ||
| vaultSecrets: _.get(payload.context.vaultSecrets, '_.allowScriptAccess') ? | ||
| payload.context.vaultSecrets : undefined | ||
| }, | ||
| context: _.pick(payload.context, SAFE_CONTEXT_VARIABLES), | ||
| resolvedPackages: resolvedPackages, | ||
|
|
||
| // legacy options | ||
|
|
@@ -479,6 +502,7 @@ module.exports = { | |
| this.host.removeAllListeners(EXECUTION_COOKIES_EVENT_BASE + executionId); | ||
| this.host.removeAllListeners(EXECUTION_ERROR_EVENT_BASE + executionId); | ||
| this.host.removeAllListeners(EXECUTION_SKIP_REQUEST_EVENT_BASE + executionId); | ||
| this.host.removeAllListeners(EXECUTION_VAULT_BASE + executionId); | ||
|
|
||
| // Handle async errors as well. | ||
| // If there was an error running the script itself, that takes precedence | ||
|
|
@@ -529,10 +553,16 @@ module.exports = { | |
| result && result.globals && (result.globals = new sdk.VariableScope(result.globals)); | ||
| result && result.collectionVariables && | ||
| (result.collectionVariables = new sdk.VariableScope(result.collectionVariables)); | ||
| result && result.vaultSecrets && | ||
| (result.vaultSecrets = new sdk.VariableScope(result.vaultSecrets)); | ||
| result && result.request && (result.request = new sdk.Request(result.request)); | ||
|
|
||
| // vault secrets are not sent to sandbox, thus using the scope from run context. | ||
| if (allowVaultAccess && vaultSecrets) { | ||
| result.vaultSecrets = vaultSecrets; | ||
|
|
||
| // Prevent mutations from being carry-forwarded to subsequent events | ||
| vaultSecrets.disableTracking(); | ||
| } | ||
|
|
||
| // @note Since [email protected], response object is not included in the execution | ||
| // result. | ||
| // Refer: https://github.com/postmanlabs/postman-sandbox/pull/512 | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.