|
| 1 | +'use strict' |
| 2 | +const akeyless = require('akeyless') |
| 3 | +const akeylessCloud = require('akeyless-cloud-id') |
| 4 | +const KVBackend = require('./kv-backend') |
| 5 | + |
| 6 | +/** Akeyless Secrets Manager backend class. */ |
| 7 | +class AkeylessBackend extends KVBackend { |
| 8 | + /** |
| 9 | + * Create Akeyless backend. |
| 10 | + * @param {Object} credential - Credentials for authenticating with Akeyless Vault. |
| 11 | + * @param {Object} logger - Logger for logging stuff. |
| 12 | + */ |
| 13 | + constructor ({ credential, logger }) { |
| 14 | + super({ logger }) |
| 15 | + this._credential = credential |
| 16 | + } |
| 17 | + |
| 18 | + _getCloudId () { |
| 19 | + return new Promise((resolve, reject) => { |
| 20 | + akeylessCloud.getCloudId(this._credential.accessType, this._credential.accessTypeParam, (err, res) => { |
| 21 | + if (err) { |
| 22 | + reject(err) |
| 23 | + } else { |
| 24 | + resolve(res) |
| 25 | + } |
| 26 | + }) |
| 27 | + }) |
| 28 | + } |
| 29 | + |
| 30 | + async _getSecret (key) { |
| 31 | + const api = this._credential.client |
| 32 | + const cloudId = await this._getCloudId() |
| 33 | + const opts = { 'access-id': this._credential.accessId, 'access-type': this._credential.accessType, 'access-key': this._credential.accessTypeParam, 'cloud-id': cloudId } |
| 34 | + |
| 35 | + const authResult = await api.auth(akeyless.Auth.constructFromObject(opts)) |
| 36 | + const token = authResult.token |
| 37 | + |
| 38 | + const dataType = await api.describeItem(akeyless.DescribeItem.constructFromObject({ |
| 39 | + name: key, |
| 40 | + token: token |
| 41 | + })) |
| 42 | + if (dataType.item_type === 'DYNAMIC_SECRET') { |
| 43 | + const data = await api.getDynamicSecretValue(akeyless.GetDynamicSecretValue.constructFromObject({ |
| 44 | + name: key, |
| 45 | + token: token |
| 46 | + })) |
| 47 | + return JSON.stringify(data) |
| 48 | + } |
| 49 | + if (dataType.item_type === 'STATIC_SECRET') { |
| 50 | + const staticSecretParams = akeyless.GetSecretValue.constructFromObject({ |
| 51 | + names: [key], |
| 52 | + token: token |
| 53 | + }) |
| 54 | + const data = await api.getSecretValue(staticSecretParams) |
| 55 | + const secretValue = JSON.stringify(data[key]) |
| 56 | + return JSON.parse(secretValue) |
| 57 | + } else { |
| 58 | + throw new Error('Invalid secret type' + dataType.item_type) |
| 59 | + } |
| 60 | + } |
| 61 | + |
| 62 | + /** |
| 63 | + * Get secret value from Akeyless Vault. |
| 64 | + * @param {string} key - Key the full name (path/name) of the stored secret at Akeyless. |
| 65 | + * @returns {Promise} Promise object representing secret property value. |
| 66 | + */ |
| 67 | + async _get ({ key }) { |
| 68 | + this._logger.info(`fetching secret ${key} from akeyless`) |
| 69 | + const secret = await this._getSecret(key) |
| 70 | + return secret |
| 71 | + } |
| 72 | +} |
| 73 | + |
| 74 | +module.exports = AkeylessBackend |
0 commit comments