allthingssecurity commented on code in PR #27669:
URL: https://github.com/apache/camel/pull/27669#discussion_r4239723672
##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +262,24 @@ private String getSecretFromSource(String key, String
subkey, String defaultValu
return returnValue;
}
+ /**
+ * The name of a secret as the refresh task tracks it: engine:secret, or
only the secret for the default secret
+ * engine
+ */
+ private static String trackedSecretName(String secretEngine, String key) {
+ return "secret".equals(secretEngine) ? key : secretEngine + ":" + key;
Review Comment:
Good catch, fixed in 86a401aa58f2: a null engine (a plain `hashicorp:key`
before any lookup set one) is now tracked as `key`, the same way the refresh
task's `buildMetadataPath` reads a name without engine; I checked the method's
`secretEngine` parameter, as the method is static. New test
`secretWithoutEngineIsTrackedAsDefaultEngine` fails without it (`expected:
<[api]> but was: <[null:api]>`).
_Claude Code on behalf of allthingssecurity_
##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +262,24 @@ private String getSecretFromSource(String key, String
subkey, String defaultValu
return returnValue;
}
+ /**
+ * The name of a secret as the refresh task tracks it: engine:secret, or
only the secret for the default secret
+ * engine
+ */
+ private static String trackedSecretName(String secretEngine, String key) {
+ return "secret".equals(secretEngine) ? key : secretEngine + ":" + key;
+ }
+
+ private void captureVersion(String secretName, VaultResponse rawSecret) {
+ if (rawSecret.getData().get("metadata") instanceof Map<?, ?> metadata
&& metadata.get("version") != null) {
+ try {
+ secretVersions.put(secretName,
Integer.valueOf(metadata.get("version").toString()));
+ } catch (NumberFormatException e) {
+ // ignore, the refresh task then uses the version it reads
first
+ }
Review Comment:
Done in 86a401aa58f2: the class had no logger yet, so I added one and log
the secret name, the unparsable version and the exception at DEBUG.
_Claude Code on behalf of allthingssecurity_
##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -268,9 +291,17 @@ public CamelContext getCamelContext() {
}
/**
- * Ids of the secrets in use
+ * Ids of the secrets in use, as engine:secret, or only the secret for the
default secret engine
*/
public Set<String> getSecrets() {
return secrets;
}
+
+ /**
+ * The version of the secret (named as in {@link #getSecrets()}) that was
last resolved, or null if not known (such
+ * as when a specific version was requested).
+ */
+ public Integer getSecretVersion(String secretName) {
Review Comment:
Added `@param` and `@return` in 86a401aa58f2.
_Claude Code on behalf of allthingssecurity_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
