Class: Veil::CredentialCollection::Base

Inherits:
Object
  • Object
show all
Extended by:
Forwardable
Defined in:
lib/veil/credential_collection/base.rb

Direct Known Subclasses

ChefSecretsEnv, ChefSecretsFd, ChefSecretsFile

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(opts = {}) ⇒ Base

Returns a new instance of Base.



21
22
23
24
25
26
 
# File 'lib/veil/credential_collection/base.rb', line 21

def initialize(opts = {})
  @hasher = Veil::Hasher.create(opts[:hasher] || {})
  @decryptor, @encryptor = Veil::Cipher.create(opts[:cipher] || {})
  @credentials = expand_credentials_hash(decryptor.decrypt(opts[:credentials]) || {})
  @version = opts[:version] || 1
end

Instance Attribute Details

#credentials ⇒ Object (readonly)

Returns the value of attribute credentials.



17
18
19
 
# File 'lib/veil/credential_collection/base.rb', line 17

def credentials
  @credentials
end

#decryptor ⇒ Object (readonly)

Returns the value of attribute decryptor.



17
18
19
 
# File 'lib/veil/credential_collection/base.rb', line 17

def decryptor
  @decryptor
end

#encryptor ⇒ Object (readonly)

Returns the value of attribute encryptor.



17
18
19
 
# File 'lib/veil/credential_collection/base.rb', line 17

def encryptor
  @encryptor
end

#hasher ⇒ Object (readonly)

Returns the value of attribute hasher.



17
18
19
 
# File 'lib/veil/credential_collection/base.rb', line 17

def hasher
  @hasher
end

#version ⇒ Object (readonly)

Returns the value of attribute version.



17
18
19
 
# File 'lib/veil/credential_collection/base.rb', line 17

def version
  @version
end

Class Method Details

.create(hash = {}) ⇒ Object 



10
11
12
 
# File 'lib/veil/credential_collection/base.rb', line 10

def create(hash = {})
  new(hash)
end

Instance Method Details

#add(*args) ⇒ Object Also known as: <<

Add a new credential to the credentials

Parameters:

  • args (Hash) 


109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
 
# File 'lib/veil/credential_collection/base.rb', line 109

def add(*args)
  params = { name: nil, group: nil, length: 128, value: nil, force: false }
  case args.length
  when 1
    # add('foo')
    params[:name] = args.first
  when 2
    if args.all? { |a| a.is_a?(String) }
      # add('my_app', 'foo')
      params[:group], params[:name] = args
    elsif args[1].is_a?(Hash)
      # add('my_app', value: 'something')
      # add('foo', length: 50)
      params[:name] = args.first
      params.merge!(args[1])
    end
  when 3
    # add('my_app', 'foo', value: 'something')
    # add('my_app', 'foo', length: 50)
    params[:group], params[:name] = args[0], args[1]
    params.merge!(args[2])
  else
    raise ArgumentError, "wrong number of arguments (given #{args.length}, expected 1-3)"
  end

  add_from_params(params)
end

#add_from_file(filepath, *args) ⇒ Object

Add the contents of a file as a credential after verifying that the file can be read. Usage:

 add_from_file(filename, "secretname")
 add_from_file(filename, "groupname", "secretname")

Anything added from file will automatically be frozen.

add‘s options are not supported.



147
148
149
150
151
152
153
 
# File 'lib/veil/credential_collection/base.rb', line 147

def add_from_file(filepath, *args)
  unless File.readable?(filepath)
    raise Veil::FileNotReadable.new("Cannot read #{filepath}")
  end
  add(*args, value: File.read(filepath),
             frozen: true)
end

#credentials_as_hash ⇒ Object 



179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
 
# File 'lib/veil/credential_collection/base.rb', line 179

def credentials_as_hash
  hash = Hash.new

  credentials.each do |cred_or_group_name, cred_or_group_attrs|
    if cred_or_group_attrs.is_a?(Hash)
      cred_or_group_attrs.each do |name, cred|
        hash[cred_or_group_name] ||= Hash.new
        hash[cred_or_group_name][name] = cred.to_hash
      end
    else
      hash[cred_or_group_name] = cred_or_group_attrs.to_hash
    end
  end

  hash
end

#credentials_for_export ⇒ Object Also known as: legacy_credentials_hash 



196
197
198
199
200
201
202
203
204
205
206
207
208
209
 
# File 'lib/veil/credential_collection/base.rb', line 196

def credentials_for_export
  hash = Hash.new

  credentials.each do |namespace, cred_or_creds|
    if cred_or_creds.is_a?(Veil::Credential)
      hash[namespace] = cred_or_creds.value
    else
      hash[namespace] = {}
      cred_or_creds.each { |name, cred| hash[namespace][name] = cred.value }
    end
  end

  hash
end

#exist?(*args) ⇒ Boolean

Check to see if a given credential has been added.

Returns:

  • (Boolean) 


97
98
99
100
101
102
 
# File 'lib/veil/credential_collection/base.rb', line 97

def exist?(*args)
  get(*args)
  true
rescue Veil::GroupNotFound, Veil::CredentialNotFound
  false
end

#get(*args) ⇒ Object Also known as: get_credential

Retrieves a credential from the credential store:

get(name)
get(group, name)



61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/veil/credential_collection/base.rb', line 61

def get(*args)
  case args.length
  when 1
    cred_name = args[0]
    c = credentials[cred_name]
    if c.nil?
      raise Veil::CredentialNotFound, "Credential '#{cred_name}' not found."
    else
      c.value
    end
  when 2
    group_name = args[0]
    cred_name = args[1]

    g = credentials[group_name]
    if g.nil?
      raise Veil::GroupNotFound, "Credential group '#{group_name}' not found."
    else
      c = g[cred_name]
      if c.nil?
        raise Veil::CredentialNotFound, "Credential '#{cred_name}' not found in group '#{group_name}'."
      else
        c.value
      end
    end
  else
    raise ArgumentError, "wrong number of arguments (given #{args.length}, expected 1 or 2)"
  end
end

#remove(group_or_cred, cred = nil) ⇒ Object Also known as: delete 



155
156
157
158
159
160
161
 
# File 'lib/veil/credential_collection/base.rb', line 155

def remove(group_or_cred, cred = nil)
  if group_or_cred && cred && credentials.key?(group_or_cred)
    credentials[group_or_cred].delete(cred)
  else
    credentials.delete(group_or_cred)
  end
end

#rotate(group_or_cred, cred = nil) ⇒ Object 



43
44
45
46
47
48
49
50
51
52
53
 
# File 'lib/veil/credential_collection/base.rb', line 43

def rotate(group_or_cred, cred = nil)
  if cred && credentials.key?(group_or_cred) && credentials[group_or_cred].key?(cred)
    credentials[group_or_cred][cred].rotate(hasher)
  elsif credentials.key?(group_or_cred)
    if credentials[group_or_cred].is_a?(Hash)
      credentials[group_or_cred].each { |_s, c| c.rotate(hasher) }
    else
      credentials[group_or_cred].rotate(hasher)
    end
  end
end

#rotate_credentials ⇒ Object 



169
170
171
172
173
174
175
176
177
 
# File 'lib/veil/credential_collection/base.rb', line 169

def rotate_credentials
  credentials.each do |cred_or_group_name, cred_or_group|
    if cred_or_group.is_a?(Veil::Credential)
      cred_or_group.rotate(hasher)
    else
      cred_or_group.each { |_group, cred| cred.rotate(hasher) }
    end
  end
end

#rotate_hasher ⇒ Object 



164
165
166
167
 
# File 'lib/veil/credential_collection/base.rb', line 164

def rotate_hasher
  @hasher = Veil::Hasher.create
  rotate_credentials
end

#save ⇒ Object 



39
40
41
 
# File 'lib/veil/credential_collection/base.rb', line 39

def save
  raise "Save has not been implemented for this class"
end

#to_hash ⇒ Object Also known as: to_h 



28
29
30
31
32
33
34
35
36
 
# File 'lib/veil/credential_collection/base.rb', line 28

def to_hash
  {
    type: self.class.name,
    version: version,
    hasher: hasher.to_h,
    cipher: encryptor.to_h,
    credentials: encryptor.encrypt(credentials_as_hash.to_json)
  }
end