nanvc

nanvc - Not Another Node Vault Client

This is a Vault client written in typescript.

Table of contents

• Install
• How to use it
  • ES5
  • ES6
• What is supported
• TODO list

Install

# requires nodejs >= 14
npm install nanvc --save

How to use it

The VaultClient constructor takes three optional arguments:

• vault cluster address - if not passed in, defaults to NANVC_VAULT_CLUSER_ADDRESS environment variable otherwise it will take 'http://127.0.0.1:8200' value
• vault auth token - if not passed in, defaults to NANVC_VAULT_AUTH_TOKEN env. variable, otherwise will be set to null
• vault api version - if not passed in, defaults to NANVC_VAULT_API_VERSION environment variable, otherwise is set internaly to 'v1'

ES5

var VaultClient = require('nanvc');
var vault = new VaultClient('http://vault.local:8200');
vault.init({ 
        secret_shares: 1, 
        secret_threshold: 1 
    })
    .then(function (result) { // unseal vault
        console.log("Unsealing vault");
        console.log(result);
        if (!result.succeeded) {
            throw new Error(result.errorMessage);
        }
        var keys = result.apiResponse.keys;
        vault.token = result.apiResponse.root_token;
        return vault.unseal({
            secret_shares: 1,
            key: keys[0]
        });
    })
    .then(function (response) { // write a secret
        console.log("Writing a secret");
        return vault.write(
            '/secret/my-app/my-secret', { 
                'foo': 'my-password' 
            }
        )
    })
    .then(function(response) { // update a secret
        console.log(response);
        console.log("Updating secret");
        return vault.update(
            '/secret/my-app/my-secret', { 
                'foo': 'my-updated-password' 
            }
        );  
    })
    .then(function(response){ // read a secret
        console.log(response);
        console.log("Reading a secret");
        return vault.read('/secret/my-app/my-secret');
    })
    .then(function(response){ // delete a secret
        console.log(response);
        console.log("Deleting a secret");
        return vault.delete('/secret/my-app/my-secret');
    })
    .then(function(response){ // handle delete response 
        console.log(response);
    })
    .catch(console.error);

ES6

import VaultClient from "nanvc";
let vault = new VaultClient('http://vault.local:8200');

async function main() {
    try {
        let initResponse = await vault.init({
            secret_shares: 1,
            secret_threshold: 1
        });

        if (initResponse.succeeded) {
            console.log(initResponse);
            vault.token = initResponse.apiResponse.root_token;
            let unsealResponse = await vault.unseal({
                secret_shares: 1,
                key: initResponse.apiResponse.keys[0]
            });
            if (!unsealResponse.succeeded) {
                throw new Error(unsealResponse.errorMessage);
            }
        } else {
            throw new Error(initResponse.errorMessage);
        }
        // write a secret
        let writeSecretResponse = await vault.write('/secret/my-app/my-secret', { 'foo': 'my-password' });
        console.log(writeSecretResponse);
        // update a secret
        let updateSecretResponse = await vault.update('/secret/my-app/my-secret', { 'foo': 'my-updated-password' });
        console.log(updateSecretResponse);
        // read a secret
        let mySecretQueryResponse = await vault.read('/secret/my-app/my-secret');
        let mySecret = mySecretQueryResponse.succeeded && mySecretQueryResponse.apiResponse.data.foo;
        console.log(mySecretQueryResponse);
        // delete a secret
        let mySecretDeleteQueryResponse = await vault.delete('/secret/my-app/my-secret');
        let mySecretIsDeleted = mySecretDeleteQueryResponse.succeeded;
        console.log(mySecretDeleteQueryResponse);
    } catch (e) {
        throw (e);
    }

}

main().then().catch(console.error);

What is supported

Vault Rest API Call	Http Method	Client Library Method	Tested
/:path	GET	VaultClient.read(secretPath: string)	Yes
/:path	POST	VaultClient.write(secretPath: string, secretData: object)	Yes
/:path	PUT	VaultClient.update(secretPath: string, secretData: object)	Yes
/:path	DELETE	VaultClient.delete(secretPath: string)	Yes
/:path	LIST	VaultClient.list(path: string)	Yes
/sys/audit	GET	VaultClient.audits()	Yes
/sys/audit/:name	PUT	VaultClient.enableAudit(auditName: string)	Yes
/sys/audit/:name	DELETE	VaultClient.disableAudit(auditName: string)	Yes
/sys/audit-hash/:path	POST	VaultClient.auditHash(path: string, payload: object)	Yes
/sys/auth	GET	VaultClient.auths()	Yes
/sys/auth	POST	VaultClient.enableAuth(path: string, payload: object)	Yes
/sys/auth	DELETE	VaultClient.disableAuth(path: string)	Yes
/sys/capabilities	POST	N/A	N/A
/sys/capabilities-accessor	POST	N/A	N/A
/sys/capabilities-self	POST	N/A	N/A
/sys/config/auditing	GET	N/A	N/A
/sys/config/control-group	GET	N/A	N/A
/sys/config/cors	GET	N/A	N/A
/sys/control-group	POST	N/A	N/A
/sys/generate-root	GET	N/A	N/A
/sys/health	HEAD	N/A	N/A
/sys/health	GET	N/A	N/A
/sys/init	GET	VaultClient.isInitialized()	Yes
/sys/init	PUT	VaultClient.init(initData: object)	Yes
/sys/key-status	GET	N/A	N/A
/sys/leader	GET	N/A	N/A
/sys/leases	PUT	N/A	N/A
/sys/leases	LIST	N/A	N/A
/sys/license	GET	N/A	N/A
/sys/mfa	N/A	N/A	N/A
/sys/mounts	GET	VaultClient.mounts()	Yes
/sys/mounts/:mount_point	POST	VaultClient.mount(path: string, mountOptions: object)	Yes
/sys/mounts/:mount_point	DELETE	VaultClient.unmount(path: string)	Yes
/sys/mounts/:mount_point/tune	POST	N/A	N/A
/sys/plugins/reload/backend	PUT	N/A	N/A
/sys/plugins/catalog	LIST	N/A	N/A
/sys/plugins/catalog/:catalog_name	PUT	N/A	N/A
/sys/plugins/catalog/:catalog_name	GET	N/A	N/A
/sys/plugins/catalog/:catalog_name	DELETE	N/A	N/A
/sys/policy	GET	VaultClient.policies()	No
/sys/policy	PUT	VaultClient.addPolicy(policyName: string, policyData: obkect )	No
/sys/policy	DELETE	VaultClient.removePolicy(policyName: string)	No
/sys/policies	N/A	N/A	N/a
/sys/raw	N/A	N/A	N/A
/sys/rekey	N/A	N/A	N/A
/sys/rekey-recovery-key	N/A	N/A	N/A
/sys/remount	POST	VaultClient.remount(remountData: object)	Yes
/sys/replication	N/A	N/A	N/A
/sys/rotate	N/A	N/A	N/A
/sys/seal	PUT	VaultClient.seal()	Yes
/sys/seal-status	GET	VaultClient.status()	Yes
/sys/step-down	N/A	N/A	N/A
/sys/tools	N/A	N/A	N/A
/sys/unseal	PUT	VaultClient.unseal(unsealData: object)	Yes
/sys/wrapping/lookup	N/A	N/A	N/A
/sys/wrapping/rewrap	N/A	N/A	N/A
/sys/wrapping/unwrap	N/A	N/A	N/A
/sys/wrapping/wrap	N/A	N/A	N/A

TODO list

• [x] Better documentation(API, more samples, what is supported and what is NOT)
• [ ] Full support for "System Backend Commands"
• [x] Typescript declarations - it will bring IDE intellisense for tools like Vscode, IntelliJ IDEA, Atom, etc