allthingssecurity commented on code in PR #27669:
URL: https://github.com/apache/camel/pull/27669#discussion_r4240516054
##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +267,26 @@ private String getSecretFromSource(String key, String
subkey, String defaultValu
return returnValue;
}
+ /**
+ * The name of a secret as the refresh task tracks it: engine:secret, or
only the secret for the default secret
+ * engine. A lookup without engine is tracked as a secret of the default
secret engine, which is also how the
+ * refresh task reads a name without engine.
+ */
+ private static String trackedSecretName(String secretEngine, String key) {
+ return secretEngine == null || "secret".equals(secretEngine) ? key :
secretEngine + ":" + key;
+ }
+
+ private void captureVersion(String secretName, VaultResponse rawSecret) {
+ if (rawSecret.getData().get("metadata") instanceof Map<?, ?> metadata
&& metadata.get("version") != null) {
+ try {
+ secretVersions.put(secretName,
Integer.valueOf(metadata.get("version").toString()));
Review Comment:
Confirmed with a test: resolve the secret at version 1, update it to version
2, resolve it again, then run the first
check. With `put` the function reported version 2 and the task saw no update
(`rotationBetweenTwoLookupsBeforeFirstCheckIsDetected` failed with
"expected: <1> but was: <2>"). Applied in 67fb08297966:
`secretVersions.merge(..., Math::min)`, and the
javadoc of `getSecretVersion` now says "oldest version resolved".
camel-hashicorp-vault suite: 9 tests, 0 failures
(the 32 integration tests are skipped without a Vault container).
_Claude Code on behalf of allthingssecurity_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
