feature: Using terraform together with infisical login. #36
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| package cliuser | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "errors" | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| "github.com/zalando/go-keyring" | ||
| ) | ||
|
|
||
| type UserCredentials struct { | ||
| Email string `json:"email"` | ||
| PrivateKey string `json:"privateKey"` | ||
| JTWToken string `json:"JTWToken"` | ||
| RefreshToken string `json:"RefreshToken"` | ||
| } | ||
|
|
||
| func GetCurrentLoggedInUserDetails(profile string) (string, error) { | ||
| if ConfigFileExists() { | ||
| configFile, err := GetConfigFile() | ||
| if err != nil { | ||
| return "", fmt.Errorf("getCurrentLoggedInUserDetails: unable to get logged in user from config file [err=%s]", err) | ||
| } | ||
|
|
||
| if configFile.LoggedInUserEmail == "" { | ||
| return "", errors.New("Login user not found. Try infisical login.") | ||
| } | ||
|
|
||
| if configFile.LoggedInUserEmail != profile { | ||
| return "", errors.New("User profile not found. Try infisical login.") | ||
| } | ||
|
|
||
| userCreds, err := GetUserCredsFromKeyRing(configFile.LoggedInUserEmail) | ||
| if err != nil { | ||
| if strings.Contains(err.Error(), "credentials not found in system keyring") { | ||
| return "", errors.New("we couldn't find your logged in details, try running [infisical login] then try again") | ||
| } else { | ||
| return "", fmt.Errorf("failed to fetch credentials from keyring because [err=%s]", err) | ||
| } | ||
| } | ||
| return userCreds.JTWToken, nil | ||
| } | ||
|
|
||
| return "", errors.New("Config file not found. Try infisical login.") | ||
| } | ||
|
|
||
| func GetUserCredsFromKeyRing(userEmail string) (credentials UserCredentials, err error) { | ||
| credentialsValue, err := GetValueInKeyring(userEmail) | ||
| if err != nil { | ||
| if err == keyring.ErrUnsupportedPlatform { | ||
| return UserCredentials{}, errors.New("your OS does not support keyring. Consider using a service token https://infisical.com/docs/documentation/platform/token") | ||
| } else if err == keyring.ErrNotFound { | ||
| return UserCredentials{}, errors.New("credentials not found in system keyring") | ||
| } else { | ||
| return UserCredentials{}, fmt.Errorf("something went wrong, failed to retrieve value from system keyring [error=%v]", err) | ||
| } | ||
| } | ||
|
|
||
| var userCredentials UserCredentials | ||
|
|
||
| err = json.Unmarshal([]byte(credentialsValue), &userCredentials) | ||
| if err != nil { | ||
| return UserCredentials{}, fmt.Errorf("getUserCredsFromKeyRing: Something went wrong when unmarshalling user creds [err=%s]", err) | ||
| } | ||
|
|
||
| return userCredentials, err | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| package cliuser | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "fmt" | ||
| "os" | ||
| ) | ||
|
|
||
| const ( | ||
| CONFIG_FOLDER_NAME = ".infisical" | ||
| CONFIG_FILE_NAME = "infisical-config.json" | ||
| ) | ||
|
|
||
| type LoggedInUser struct { | ||
| Email string `json:"email"` | ||
| Domain string `json:"domain"` | ||
| } | ||
|
|
||
| // The file struct for Infisical config file. | ||
| type ConfigFile struct { | ||
| LoggedInUserEmail string `json:"loggedInUserEmail"` | ||
| LoggedInUserDomain string `json:"LoggedInUserDomain,omitempty"` | ||
| LoggedInUsers []LoggedInUser `json:"loggedInUsers,omitempty"` | ||
| VaultBackendType string `json:"vaultBackendType,omitempty"` | ||
| } | ||
|
|
||
| func GetHomeDir() (string, error) { | ||
| directory, err := os.UserHomeDir() | ||
| return directory, err | ||
| } | ||
|
|
||
| func GetFullConfigFilePath() (fullPathToFile string, fullPathToDirectory string, err error) { | ||
| homeDir, err := GetHomeDir() | ||
| if err != nil { | ||
| return "", "", err | ||
| } | ||
|
|
||
| fullPath := fmt.Sprintf("%s/%s/%s", homeDir, CONFIG_FOLDER_NAME, CONFIG_FILE_NAME) | ||
| fullDirPath := fmt.Sprintf("%s/%s", homeDir, CONFIG_FOLDER_NAME) | ||
| return fullPath, fullDirPath, err | ||
| } | ||
|
|
||
| func GetConfigFile() (ConfigFile, error) { | ||
| fullConfigFilePath, _, err := GetFullConfigFilePath() | ||
| if err != nil { | ||
| return ConfigFile{}, err | ||
| } | ||
|
|
||
| configFileAsBytes, err := os.ReadFile(fullConfigFilePath) | ||
| if err != nil { | ||
| if err, ok := err.(*os.PathError); !ok { | ||
| return ConfigFile{}, err | ||
| } | ||
| return ConfigFile{}, nil | ||
| } | ||
|
|
||
| var configFile ConfigFile | ||
| err = json.Unmarshal(configFileAsBytes, &configFile) | ||
| if err != nil { | ||
| return ConfigFile{}, err | ||
| } | ||
|
|
||
| return configFile, nil | ||
| } | ||
|
|
||
| func ConfigFileExists() bool { | ||
| fullConfigFileURI, _, err := GetFullConfigFilePath() | ||
| if err != nil { | ||
| return false | ||
| } | ||
|
|
||
| if _, err := os.Stat(fullConfigFileURI); err == nil { | ||
| return true | ||
| } else { | ||
| return false | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| package cliuser | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "github.com/zalando/go-keyring" | ||
| ) | ||
|
|
||
| const MAIN_KEYRING_SERVICE = "infisical-cli" | ||
|
|
||
| func GetCurrentVaultBackend() (string, error) { | ||
| configFile, err := GetConfigFile() | ||
| if err != nil { | ||
| return "", fmt.Errorf("getCurrentVaultBackend: unable to get config file [err=%s]", err) | ||
| } | ||
|
|
||
| if configFile.VaultBackendType == "" { | ||
| return "auto", nil | ||
| } | ||
|
|
||
| if configFile.VaultBackendType != "auto" && configFile.VaultBackendType != "file" { | ||
| return "auto", nil | ||
| } | ||
|
|
||
| return configFile.VaultBackendType, nil | ||
| } | ||
|
|
||
| func GetValueInKeyring(key string) (string, error) { | ||
| currentVaultBackend, err := GetCurrentVaultBackend() | ||
| if err != nil { | ||
| return "", fmt.Errorf("Unable to get current vault. Tip: run [infisical reset] then try again. %w", err) | ||
| } | ||
|
|
||
| return keyring.Get(currentVaultBackend, MAIN_KEYRING_SERVICE, key) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's point users towards machine identities instead of service tokens