- {p.owned && (
+ {profile.owned && (
@@ -190,10 +209,10 @@ export function VaultProfileManager({
type="button"
variant="outline"
size="sm"
- className="h-7 text-[10px] self-start"
+ className="h-7 text-[10px] self-start rounded-none"
onClick={() => setForm({ ...emptyForm })}
>
-
{t("hosts.vaultNewProfile")}
+
{t("profiles.new")}
)}
@@ -201,33 +220,25 @@ export function VaultProfileManager({
{form && (
- {field(t("hosts.friendlyNameLabel"), "name", "Production Vault")}
+ {field(t("profiles.name"), "name", "Production Vault")}
+ {field(t("profiles.vaultAddr"), "vaultAddr", "https://vault:8200")}
+ {field(t("profiles.namespace"), "vaultNamespace", "admin")}
+ {field(t("profiles.oidcMount"), "oidcMount", "oidc")}
+ {field(t("profiles.oidcRole"), "oidcRole", "default")}
+ {field(t("profiles.sshMount"), "sshMount", "ssh-client-signer")}
+ {field(t("profiles.sshRole"), "sshRole", "my-role")}
{field(
- t("hosts.vaultAddrLabel"),
- "vaultAddr",
- "https://vault:8200",
- )}
- {field(t("hosts.vaultNamespaceLabel"), "vaultNamespace", "admin")}
- {field(t("hosts.vaultOidcMountLabel"), "oidcMount", "oidc")}
- {field(t("hosts.vaultOidcRoleLabel"), "oidcRole", "default")}
- {field(
- t("hosts.vaultSshMountLabel"),
- "sshMount",
- "ssh-client-signer",
- )}
- {field(t("hosts.vaultSshRoleLabel"), "sshRole", "my-role")}
- {field(
- t("hosts.vaultValidPrincipalsLabel"),
+ t("profiles.validPrincipals"),
"validPrincipals",
"root,deploy",
)}
setField("keyType", e.target.value)}
className="flex h-8 w-full border border-border bg-background px-3 py-1 text-xs outline-none focus:ring-1 focus:ring-ring"
>
@@ -236,35 +247,36 @@ export function VaultProfileManager({
-
+ {canShare && (
+
+ )}
diff --git a/plugins/vault/src/frontend/index.tsx b/plugins/vault/src/frontend/index.tsx
new file mode 100644
index 000000000..aec147cff
--- /dev/null
+++ b/plugins/vault/src/frontend/index.tsx
@@ -0,0 +1,29 @@
+import type { ComponentType } from "react";
+import type { TermixApp } from "@termix/plugin-sdk/frontend";
+import { VaultAuthEditor } from "./VaultAuthEditor";
+import { VaultOverlay } from "./VaultOverlay";
+import { RedirectUriSetting } from "./RedirectUriSetting";
+
+export function activate(app: TermixApp): void {
+ app.registerSshAuthEditor({
+ authType: "vault",
+ titleKey: "hosts.filterAuthVault",
+ component: VaultAuthEditor,
+ });
+
+ // The Vault sign-in while a terminal connects to a Vault host.
+ app.registerSlotContribution("terminal.overlay", {
+ actionId: "vault.signIn",
+ titleKey: "dialog.title",
+ kind: "component",
+ component: VaultOverlay as unknown as ComponentType<
+ Record
+ >,
+ });
+
+ app.registerSettingsComponent("redirectUri", RedirectUriSetting);
+}
+
+export function deactivate(): void {
+ // Registrations through app are disposed by core.
+}
diff --git a/plugins/vault/src/frontend/types.ts b/plugins/vault/src/frontend/types.ts
new file mode 100644
index 000000000..2cb0e61f1
--- /dev/null
+++ b/plugins/vault/src/frontend/types.ts
@@ -0,0 +1,34 @@
+/** A Vault signer profile as GET /profiles returns it. */
+export interface VaultProfile {
+ id: number;
+ name: string;
+ vaultAddr: string;
+ vaultNamespace: string | null;
+ oidcMount: string | null;
+ oidcRole: string | null;
+ sshMount: string | null;
+ sshRole: string;
+ validPrincipals: string | null;
+ keyType: string | null;
+ shared: boolean;
+ owned: boolean;
+}
+
+export interface VaultProfilePayload {
+ name: string;
+ vaultAddr: string;
+ vaultNamespace: string | null;
+ oidcMount: string | null;
+ oidcRole: string | null;
+ sshMount: string | null;
+ sshRole: string;
+ validPrincipals: string | null;
+ keyType: string | null;
+ shared: boolean;
+}
+
+export function errorMessage(error: unknown, fallback: string): string {
+ const data = (error as { response?: { data?: { error?: unknown } } })
+ ?.response?.data;
+ return typeof data?.error === "string" ? data.error : fallback;
+}
diff --git a/plugins/vault/tests/backend/helpers.ts b/plugins/vault/tests/backend/helpers.ts
new file mode 100644
index 000000000..9d3d8ad30
--- /dev/null
+++ b/plugins/vault/tests/backend/helpers.ts
@@ -0,0 +1,174 @@
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+import { fileURLToPath } from "node:url";
+import express, { type Router } from "express";
+import {
+ createMockCtx,
+ createTestDb,
+ type MockPluginContext,
+ type TestDb,
+ type TestDbOptions,
+} from "@termix/plugin-sdk/testing";
+import type {
+ PluginFetchInit,
+ PluginSshAuthProvider,
+} from "@termix/plugin-sdk/backend";
+import type { PluginManifest } from "@termix/plugin-sdk/manifest";
+import manifestJson from "../../manifest.json";
+
+export const pluginDir = fileURLToPath(new URL("../..", import.meta.url));
+export const manifest = manifestJson as unknown as PluginManifest;
+
+export const VAULT_ADDR = "https://vault.internal:8200";
+export const SIGNED_CERT = "ssh-ed25519-cert-v01@openssh.com AAAAsigned";
+
+/** A fake Vault answering the three calls the plugin makes. */
+export function createFakeVault(
+ options: { signStatus?: number; state?: string } = {},
+) {
+ const calls: Array<{ url: string; init?: PluginFetchInit }> = [];
+ const state = options.state ?? "vault-state-1";
+ const json = (status: number, body: unknown) =>
+ new Response(JSON.stringify(body), { status });
+
+ const fetch = async (url: string, init?: PluginFetchInit) => {
+ calls.push({ url, init });
+ const { pathname } = new URL(url);
+ if (pathname === "/v1/auth/oidc/oidc/auth_url") {
+ return json(200, {
+ data: {
+ auth_url: `https://idp.test/authorize?client_id=termix&state=${state}`,
+ },
+ });
+ }
+ if (pathname === "/v1/auth/oidc/oidc/callback") {
+ return json(200, { auth: { client_token: "hvs.token" } });
+ }
+ if (pathname.startsWith("/v1/ssh-client-signer/sign/")) {
+ if (options.signStatus && options.signStatus !== 200) {
+ return json(options.signStatus, { errors: ["permission denied"] });
+ }
+ return json(200, { data: { signed_key: SIGNED_CERT } });
+ }
+ return json(404, { errors: ["not found"] });
+ };
+ return { fetch, calls, state };
+}
+
+/** A fake terminal socket that records what it was sent. */
+export function fakeSocket() {
+ const sent: Array> = [];
+ return {
+ sent,
+ socket: { send: (data: string) => sent.push(JSON.parse(data)) },
+ };
+}
+
+export interface TestServer {
+ db: TestDb;
+ mock: MockPluginContext;
+ provider: () => PluginSshAuthProvider;
+ request: (
+ method: string,
+ path: string,
+ options?: { user?: string; body?: unknown },
+ // Route bodies vary per test; asserting on them is the point.
+ // eslint-disable-next-line @typescript-eslint/no-explicit-any
+ ) => Promise<{ status: number; body: any; text: string }>;
+ close: () => Promise;
+}
+
+/**
+ * The plugin activated against a real in-memory database, its router mounted
+ * the way core mounts it: JSON parsed and the acting user taken from the
+ * request.
+ */
+export async function startServer(
+ options: {
+ permissions?: string[];
+ settings?: Record;
+ fetch?: (url: string, init?: PluginFetchInit) => Promise;
+ before?: TestDbOptions["before"];
+ } = {},
+): Promise {
+ const db = await createTestDb(pluginDir, { before: options.before });
+ for (const user of ["user-1", "user-2"]) {
+ db.sqlite.prepare("INSERT OR IGNORE INTO users (id) VALUES (?)").run(user);
+ }
+ db.sqlite.prepare("INSERT OR IGNORE INTO ssh_data (id) VALUES (?)").run(7);
+
+ let router: Router | null = null;
+ const mock = createMockCtx({
+ pluginId: manifest.id,
+ manifest,
+ capabilities: manifest.capabilities,
+ db: db.database,
+ router: () => (router = express.Router()),
+ permissions: options.permissions,
+ settings: options.settings,
+ fetch: options.fetch,
+ actor: "user-1",
+ });
+
+ const { activate } = await import("../../src/backend/index.js");
+ await activate(mock.ctx);
+
+ const app = express();
+ app.use(express.json());
+ app.use((req, _res, next) => {
+ mock.setActor(req.header("x-test-user") ?? undefined);
+ next();
+ });
+ app.use((req, res, next) => router!(req, res, next));
+ const server = http.createServer(app);
+ await new Promise((resolve) => server.listen(0, resolve));
+ const { port } = server.address() as AddressInfo;
+
+ return {
+ db,
+ mock,
+ provider: () =>
+ mock.auth.sshAuthProviders.find((provider) => provider.type === "vault")!,
+ async request(method, path, { user = "user-1", body } = {}) {
+ const response = await fetch(`http://127.0.0.1:${port}${path}`, {
+ method,
+ redirect: "manual",
+ headers: {
+ "x-test-user": user,
+ ...(body !== undefined ? { "content-type": "application/json" } : {}),
+ },
+ body: body !== undefined ? JSON.stringify(body) : undefined,
+ });
+ const text = await response.text();
+ let parsed: unknown = null;
+ try {
+ parsed = text ? JSON.parse(text) : null;
+ } catch {
+ parsed = null;
+ }
+ return { status: response.status, body: parsed, text };
+ },
+ async close() {
+ await new Promise((resolve) => server.close(() => resolve()));
+ db.close();
+ },
+ };
+}
+
+export const env = (userId = "user-1", hostId = 7) => ({
+ client: {},
+ userId,
+ hostId,
+ purpose: "terminal",
+ interactive: true,
+ log: () => {},
+});
+
+export const HOST = { id: 7, ip: "10.0.0.7", port: 22, username: "root" };
+
+export const PROFILE = {
+ name: "Prod",
+ vaultAddr: VAULT_ADDR,
+ sshRole: "ops",
+ oidcRole: "dev",
+};
diff --git a/plugins/vault/tests/backend/migrations.test.ts b/plugins/vault/tests/backend/migrations.test.ts
new file mode 100644
index 000000000..02b0060d8
--- /dev/null
+++ b/plugins/vault/tests/backend/migrations.test.ts
@@ -0,0 +1,121 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { createTestDb, type TestDb } from "@termix/plugin-sdk/testing";
+import { pluginDir } from "./helpers";
+
+// vault_profiles and vault_tokens as core's SQLite bootstrap created them
+// before 2.9.0, including the sync_id column added later.
+const LEGACY_DDL = `
+ CREATE TABLE vault_profiles (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL,
+ name TEXT NOT NULL,
+ description TEXT,
+ folder TEXT,
+ tags TEXT,
+ vault_addr TEXT NOT NULL,
+ vault_namespace TEXT,
+ oidc_mount TEXT,
+ oidc_role TEXT,
+ ssh_mount TEXT,
+ ssh_role TEXT NOT NULL,
+ valid_principals TEXT,
+ key_type TEXT,
+ shared INTEGER NOT NULL DEFAULT 0,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ sync_id TEXT,
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+ );
+ CREATE TABLE vault_tokens (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL,
+ profile_id INTEGER NOT NULL,
+ ssh_cert TEXT NOT NULL,
+ private_key TEXT NOT NULL,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ expires_at TEXT NOT NULL,
+ last_used TEXT,
+ UNIQUE(user_id, profile_id),
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+ FOREIGN KEY (profile_id) REFERENCES vault_profiles (id) ON DELETE CASCADE
+ );
+`;
+
+let db: TestDb | null = null;
+
+afterEach(() => {
+ db?.close();
+ db = null;
+});
+
+const tableExists = (name: string) =>
+ !!db!.sqlite
+ .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?")
+ .get(name);
+
+describe("adopting vault_profiles and vault_tokens", () => {
+ it("keeps every existing row when the legacy tables are there", async () => {
+ db = await createTestDb(pluginDir, {
+ before: (sqlite) => {
+ sqlite.exec("INSERT INTO users (id) VALUES ('user-1'), ('user-2')");
+ sqlite.exec(LEGACY_DDL);
+ sqlite
+ .prepare(
+ "INSERT INTO vault_profiles (id, user_id, name, vault_addr, ssh_role, shared, sync_id) VALUES (?, ?, ?, ?, ?, ?, ?)",
+ )
+ .run(4, "user-1", "Prod", "https://vault:8200", "ops", 1, "sync-a");
+ sqlite
+ .prepare(
+ "INSERT INTO vault_tokens (user_id, profile_id, ssh_cert, private_key, expires_at) VALUES (?, ?, ?, ?, ?)",
+ )
+ .run("user-2", 4, "cert", "key", "2999-01-01T00:00:00.000Z");
+ },
+ });
+
+ expect(tableExists("vault_profiles")).toBe(false);
+ expect(tableExists("vault_tokens")).toBe(false);
+ expect(db.sqlite.prepare("SELECT * FROM p_vault_profiles").all()).toEqual([
+ expect.objectContaining({
+ id: 4,
+ user_id: "user-1",
+ name: "Prod",
+ shared: 1,
+ sync_id: "sync-a",
+ }),
+ ]);
+ expect(db.sqlite.prepare("SELECT * FROM p_vault_tokens").all()).toEqual([
+ expect.objectContaining({ user_id: "user-2", profile_id: 4 }),
+ ]);
+
+ // The 2.8 foreign key follows the rename, so deleting a profile still
+ // takes its cached certificates with it.
+ db.sqlite.exec("PRAGMA foreign_keys = ON");
+ db.sqlite.prepare("DELETE FROM p_vault_profiles WHERE id = 4").run();
+ expect(
+ db.sqlite.prepare("SELECT COUNT(*) AS n FROM p_vault_tokens").get(),
+ ).toEqual({ n: 0 });
+ });
+
+ it("creates both tables on a fresh install", async () => {
+ db = await createTestDb(pluginDir);
+ expect(tableExists("p_vault_profiles")).toBe(true);
+ expect(tableExists("p_vault_tokens")).toBe(true);
+ expect(
+ db.sqlite
+ .prepare(
+ "SELECT name FROM sqlite_master WHERE type = 'index' AND name = 'idx_vault_tokens_user_profile'",
+ )
+ .get(),
+ ).toBeTruthy();
+ });
+
+ it("keeps one certificate per user and profile", async () => {
+ db = await createTestDb(pluginDir);
+ db.sqlite.exec("INSERT INTO users (id) VALUES ('user-1')");
+ const insert = db.sqlite.prepare(
+ "INSERT INTO p_vault_tokens (user_id, profile_id, ssh_cert, private_key, expires_at) VALUES ('user-1', 1, 'c', 'k', 'x')",
+ );
+ insert.run();
+ expect(() => insert.run()).toThrow(/UNIQUE/);
+ });
+});
diff --git a/src/backend/tests/hosts/vault-signer-core.test.ts b/plugins/vault/tests/backend/vault-client.test.ts
similarity index 50%
rename from src/backend/tests/hosts/vault-signer-core.test.ts
rename to plugins/vault/tests/backend/vault-client.test.ts
index 398750dd2..574b733ff 100644
--- a/src/backend/tests/hosts/vault-signer-core.test.ts
+++ b/plugins/vault/tests/backend/vault-client.test.ts
@@ -1,17 +1,19 @@
-import { describe, it, expect, beforeAll, afterEach, vi } from "vitest";
-import { execFileSync } from "child_process";
-import { mkdtempSync, readFileSync, rmSync } from "fs";
-import os from "os";
-import path from "path";
+import { describe, it, expect, beforeAll } from "vitest";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
import ssh2Pkg from "ssh2";
+import type { PluginFetchInit } from "@termix/plugin-sdk/backend";
import {
+ allowedHosts,
+ completeVaultOidc,
generateEphemeralKeyPair,
parseCertValidBefore,
- startVaultOidc,
- completeVaultOidc,
signWithVault,
+ startVaultOidc,
type VaultProfileConfig,
-} from "../../hosts/vault-signer-core.js";
+} from "../../src/backend/vault-client.js";
const { utils: ssh2Utils } = ssh2Pkg;
@@ -25,12 +27,8 @@ describe("generateEphemeralKeyPair", () => {
const pair = generateEphemeralKeyPair(keyType);
expect(pair.privateKey).toContain("BEGIN OPENSSH PRIVATE KEY");
expect(pair.publicKey.split(/\s+/)[0]).toBe(keyType);
-
- // Both halves must be parseable by the same library that signs/connects.
- const priv = ssh2Utils.parseKey(pair.privateKey);
- expect(priv instanceof Error).toBe(false);
- const pub = ssh2Utils.parseKey(pair.publicKey);
- expect(pub instanceof Error).toBe(false);
+ expect(ssh2Utils.parseKey(pair.privateKey) instanceof Error).toBe(false);
+ expect(ssh2Utils.parseKey(pair.publicKey) instanceof Error).toBe(false);
});
}
@@ -48,24 +46,17 @@ describe("parseCertValidBefore", () => {
beforeAll(() => {
const dir = mkdtempSync(path.join(os.tmpdir(), "vault-cert-test-"));
try {
- execFileSync("ssh-keygen", [
- "-t",
- "ed25519",
- "-f",
- `${dir}/ca`,
- "-N",
- "",
- "-q",
- ]);
- execFileSync("ssh-keygen", [
- "-t",
- "ed25519",
- "-f",
- `${dir}/user`,
- "-N",
- "",
- "-q",
- ]);
+ for (const name of ["ca", "user"]) {
+ execFileSync("ssh-keygen", [
+ "-t",
+ "ed25519",
+ "-f",
+ `${dir}/${name}`,
+ "-N",
+ "",
+ "-q",
+ ]);
+ }
signedAt = Math.floor(Date.now() / 1000);
execFileSync("ssh-keygen", [
"-s",
@@ -87,12 +78,8 @@ describe("parseCertValidBefore", () => {
});
it("reads valid_before from a real ssh-keygen certificate", () => {
- if (!haveSshKeygen) {
- console.warn("ssh-keygen unavailable; skipping real-cert parse test");
- return;
- }
+ if (!haveSshKeygen) return;
const validBefore = parseCertValidBefore(cert);
- // -V +60m => valid_before is roughly signedAt + 3600 (start rounds to minute)
expect(validBefore).toBeGreaterThan(signedAt + 3300);
expect(validBefore).toBeLessThan(signedAt + 3900);
});
@@ -104,7 +91,7 @@ describe("parseCertValidBefore", () => {
});
});
-describe("Vault HTTP flow (mocked fetch)", () => {
+describe("the Vault HTTP flow", () => {
const profile: VaultProfileConfig = {
id: 1,
vaultAddr: "https://vault.example.com:8200/",
@@ -117,34 +104,23 @@ describe("Vault HTTP flow (mocked fetch)", () => {
keyType: "ssh-ed25519",
};
- afterEach(() => {
- vi.unstubAllGlobals();
- });
-
- function mockFetch(
- impl: (
- url: string,
- init: RequestInit,
- ) => { status?: number; body: unknown },
- ) {
- const calls: Array<{ url: string; init: RequestInit }> = [];
- vi.stubGlobal(
- "fetch",
- vi.fn(async (url: string, init: RequestInit) => {
- calls.push({ url, init });
- const { status = 200, body } = impl(url, init);
- return {
- ok: status >= 200 && status < 300,
- status,
- text: async () => JSON.stringify(body),
- } as Response;
- }),
- );
- return calls;
+ function fakeFetch(respond: () => { status?: number; body: unknown }) {
+ const calls: Array<{ url: string; init?: PluginFetchInit }> = [];
+ const fetch = async (url: string, init?: PluginFetchInit) => {
+ calls.push({ url, init });
+ const { status = 200, body } = respond();
+ return new Response(JSON.stringify(body), { status });
+ };
+ return { fetch, calls };
}
- it("startVaultOidc posts auth_url and extracts state", async () => {
- const calls = mockFetch(() => ({
+ it("allows only the profile's own Vault host past the private address guard", () => {
+ expect(allowedHosts(profile)).toEqual(["vault.example.com"]);
+ expect(allowedHosts({ ...profile, vaultAddr: "not a url" })).toEqual([]);
+ });
+
+ it("startVaultOidc posts auth_url and reads the state", async () => {
+ const { fetch, calls } = fakeFetch(() => ({
body: {
data: {
auth_url:
@@ -154,33 +130,31 @@ describe("Vault HTTP flow (mocked fetch)", () => {
}));
const result = await startVaultOidc(
+ fetch,
profile,
- "https://termix/vault/oidc/callback",
+ "https://termix/plugin-api/vault/oidc/callback",
);
expect(result.state).toBe("ST-abc123");
expect(result.clientNonce).toMatch(/^[0-9a-f]{40}$/);
- expect(calls).toHaveLength(1);
expect(calls[0].url).toBe(
"https://vault.example.com:8200/v1/auth/oidc/oidc/auth_url",
);
- expect(calls[0].init.method).toBe("POST");
- const headers = calls[0].init.headers as Record;
- expect(headers["X-Vault-Namespace"]).toBe("team-a");
- const body = JSON.parse(calls[0].init.body as string);
- expect(body).toMatchObject({
+ expect(calls[0].init?.method).toBe("POST");
+ expect(calls[0].init?.headers?.["X-Vault-Namespace"]).toBe("team-a");
+ expect(JSON.parse(String(calls[0].init?.body))).toMatchObject({
role: "developer",
- redirect_uri: "https://termix/vault/oidc/callback",
+ redirect_uri: "https://termix/plugin-api/vault/oidc/callback",
+ client_nonce: result.clientNonce,
});
- expect(body.client_nonce).toBe(result.clientNonce);
});
it("completeVaultOidc returns the client token", async () => {
- const calls = mockFetch(() => ({
+ const { fetch, calls } = fakeFetch(() => ({
body: { auth: { client_token: "hvs.TESTTOKEN" } },
}));
- const token = await completeVaultOidc(profile, {
+ const token = await completeVaultOidc(fetch, profile, {
state: "ST-abc123",
code: "auth-code",
clientNonce: "nonce123",
@@ -192,17 +166,18 @@ describe("Vault HTTP flow (mocked fetch)", () => {
expect(url.searchParams.get("state")).toBe("ST-abc123");
expect(url.searchParams.get("code")).toBe("auth-code");
expect(url.searchParams.get("client_nonce")).toBe("nonce123");
- expect(calls[0].init.method).toBe("GET");
+ expect(calls[0].init?.method).toBe("GET");
});
it("signWithVault posts the public key and returns signed_key", async () => {
- const calls = mockFetch(() => ({
+ const { fetch, calls } = fakeFetch(() => ({
body: {
data: { signed_key: "ssh-ed25519-cert-v01@openssh.com AAAAcert" },
},
}));
const cert = await signWithVault(
+ fetch,
profile,
"hvs.TESTTOKEN",
"ssh-ed25519 AAAApub comment",
@@ -212,11 +187,8 @@ describe("Vault HTTP flow (mocked fetch)", () => {
expect(calls[0].url).toBe(
"https://vault.example.com:8200/v1/ssh-client-signer/sign/my-role",
);
- const headers = calls[0].init.headers as Record;
- expect(headers["X-Vault-Token"]).toBe("hvs.TESTTOKEN");
- expect(headers["X-Vault-Namespace"]).toBe("team-a");
- const body = JSON.parse(calls[0].init.body as string);
- expect(body).toMatchObject({
+ expect(calls[0].init?.headers?.["X-Vault-Token"]).toBe("hvs.TESTTOKEN");
+ expect(JSON.parse(String(calls[0].init?.body))).toMatchObject({
public_key: "ssh-ed25519 AAAApub comment",
cert_type: "user",
valid_principals: "root,deploy",
@@ -224,45 +196,21 @@ describe("Vault HTTP flow (mocked fetch)", () => {
});
it("surfaces Vault error messages", async () => {
- mockFetch(() => ({
+ const { fetch } = fakeFetch(() => ({
status: 400,
body: { errors: ["role not found", "permission denied"] },
}));
-
await expect(
- signWithVault(profile, "tok", "ssh-ed25519 AAAA"),
+ signWithVault(fetch, profile, "tok", "ssh-ed25519 AAAA"),
).rejects.toThrow(/role not found; permission denied/);
});
-});
-// Live integration against a real Vault (e.g. `vault server -dev` in Docker).
-// Runs only when VAULT_ADDR + VAULT_TOKEN are set and the SSH signer mount
-// (VAULT_SSH_MOUNT/VAULT_SSH_ROLE) has been configured by the test harness.
-describe("Vault live signing", () => {
- const addr = process.env.VAULT_ADDR;
- const token = process.env.VAULT_TOKEN;
- const run = !!addr && !!token;
-
- it.skipIf(!run)("signs an ephemeral key against a real Vault", async () => {
- const profile: VaultProfileConfig = {
- id: 99,
- vaultAddr: addr!,
- sshMount: process.env.VAULT_SSH_MOUNT || "ssh-client-signer",
- sshRole: process.env.VAULT_SSH_ROLE || "my-role",
- validPrincipals: "root",
- keyType: "ssh-ed25519",
+ it("reports an unreachable Vault", async () => {
+ const fetch = async () => {
+ throw new Error("refused");
};
-
- const pair = generateEphemeralKeyPair(profile.keyType);
- const before = Math.floor(Date.now() / 1000);
- const cert = await signWithVault(profile, token!, pair.publicKey);
-
- expect(cert).toMatch(/-cert-v01@openssh\.com /);
- // The signed cert must parse with the same library used to connect.
- const parsed = ssh2Utils.parseKey(cert);
- expect(parsed instanceof Error).toBe(false);
-
- const validBefore = parseCertValidBefore(cert);
- expect(validBefore).toBeGreaterThan(before);
+ await expect(
+ startVaultOidc(fetch, profile, "https://termix/cb"),
+ ).rejects.toThrow(/Failed to reach Vault/);
});
});
diff --git a/plugins/vault/tests/backend/vault.test.ts b/plugins/vault/tests/backend/vault.test.ts
new file mode 100644
index 000000000..8d76cb873
--- /dev/null
+++ b/plugins/vault/tests/backend/vault.test.ts
@@ -0,0 +1,471 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { PluginCapabilityError } from "@termix/plugin-sdk/backend";
+import { createMockCtx, createTestDb } from "@termix/plugin-sdk/testing";
+import {
+ HOST,
+ PROFILE,
+ SIGNED_CERT,
+ VAULT_ADDR,
+ createFakeVault,
+ env,
+ fakeSocket,
+ manifest,
+ pluginDir,
+ startServer,
+ type TestServer,
+} from "./helpers.js";
+
+const certs = vi.hoisted(() => ({ applyCertificateAuth: vi.fn() }));
+vi.mock("@termix/plugin-sdk/ssh-certs", () => certs);
+
+let server: TestServer | null = null;
+
+beforeEach(() => {
+ certs.applyCertificateAuth.mockReset();
+});
+
+afterEach(async () => {
+ await server?.close();
+ server = null;
+});
+
+/** Creates a profile as user-1 and points host 7 at it. */
+async function profileOnHost(options: { shared?: boolean } = {}) {
+ const created = await server!.request("POST", "/profiles", {
+ body: { ...PROFILE, shared: options.shared ?? false },
+ });
+ expect(created.status).toBe(201);
+ await server!.mock.ctx.settings.setHost(7, "profileId", created.body.id);
+ return created.body as { id: number };
+}
+
+async function startSignIn(userId = "user-1") {
+ const socket = fakeSocket();
+ await server!.provider().startInteraction!({
+ userId,
+ hostId: 7,
+ host: { name: "box", ip: HOST.ip, username: HOST.username },
+ socket: socket.socket,
+ requestOrigin: "https://termix.test",
+ payload: {},
+ });
+ return socket;
+}
+
+describe("activate", () => {
+ it("registers the vault auth type, the sync entity and a public callback", async () => {
+ server = await startServer();
+ const provider = server.provider();
+ expect(provider).toMatchObject({
+ type: "vault",
+ interaction: "vault",
+ needsUserInteraction: true,
+ supportsBackground: false,
+ });
+ expect(server.mock.syncEntities).toEqual([
+ expect.objectContaining({ type: "vaultProfiles", order: 20 }),
+ ]);
+ expect(server.mock.httpRouters[0]?.public).toEqual(["/oidc/callback"]);
+ });
+
+ // secrets:own and network:outbound are checked when used, ui:surface by the
+ // frontend.
+ it.each(["db:own", "network:serve", "auth:provide"])(
+ "fails closed without %s",
+ async (capability) => {
+ const db = await createTestDb(pluginDir);
+ const mock = createMockCtx({
+ pluginId: manifest.id,
+ manifest,
+ capabilities: manifest.capabilities.filter((c) => c !== capability),
+ db: db.database,
+ router: () => ({ get: () => {}, use: () => {} }),
+ });
+ const { activate } = await import("../../src/backend/index.js");
+ await expect(activate(mock.ctx)).rejects.toThrow(PluginCapabilityError);
+ db.close();
+ },
+ );
+});
+
+describe("profiles", () => {
+ it("creates, lists, updates and deletes a profile", async () => {
+ server = await startServer();
+ const created = await server.request("POST", "/profiles", {
+ body: { ...PROFILE, vaultNamespace: " team ", tags: ["a", "b"] },
+ });
+ expect(created.status).toBe(201);
+ expect(created.body).toMatchObject({
+ name: "Prod",
+ vaultAddr: VAULT_ADDR,
+ vaultNamespace: "team",
+ sshRole: "ops",
+ tags: ["a", "b"],
+ shared: false,
+ owned: true,
+ });
+
+ const listed = await server.request("GET", "/profiles");
+ expect(listed.body).toHaveLength(1);
+
+ const updated = await server.request(
+ "PUT",
+ `/profiles/${created.body.id}`,
+ { body: { name: "Staging", keyType: "ssh-rsa" } },
+ );
+ expect(updated.status).toBe(200);
+ expect(updated.body).toMatchObject({ name: "Staging", keyType: "ssh-rsa" });
+
+ const deleted = await server.request(
+ "DELETE",
+ `/profiles/${created.body.id}`,
+ );
+ expect(deleted.status).toBe(200);
+ expect((await server.request("GET", "/profiles")).body).toEqual([]);
+ });
+
+ it("records a tombstone and drops cached certificates on delete", async () => {
+ server = await startServer();
+ const { id } = await profileOnHost();
+ server.db.sqlite
+ .prepare(
+ "INSERT INTO p_vault_tokens (user_id, profile_id, ssh_cert, private_key, expires_at) VALUES (?, ?, ?, ?, ?)",
+ )
+ .run("user-1", id, "c", "k", "2999-01-01T00:00:00.000Z");
+ const syncId = (
+ server.db.sqlite
+ .prepare("SELECT sync_id FROM p_vault_profiles WHERE id = ?")
+ .get(id) as { sync_id: string }
+ ).sync_id;
+
+ await server.request("DELETE", `/profiles/${id}`);
+
+ expect(server.mock.tombstones).toEqual([
+ { userId: "user-1", entityType: "vaultProfiles", syncId },
+ ]);
+ expect(
+ server.db.sqlite
+ .prepare("SELECT COUNT(*) AS n FROM p_vault_tokens")
+ .get(),
+ ).toEqual({ n: 0 });
+ });
+
+ it("requires name, address and signer role", async () => {
+ server = await startServer();
+ const response = await server.request("POST", "/profiles", {
+ body: { name: "x" },
+ });
+ expect(response.status).toBe(400);
+ });
+
+ it("shows other users only shared profiles, and only the owner may change one", async () => {
+ server = await startServer();
+ const own = await server.request("POST", "/profiles", { body: PROFILE });
+ const shared = await server.request("POST", "/profiles", {
+ body: { ...PROFILE, name: "Shared", shared: true },
+ });
+
+ const seen = await server.request("GET", "/profiles", { user: "user-2" });
+ expect(seen.body.map((p: { name: string }) => p.name)).toEqual(["Shared"]);
+ expect(seen.body[0].owned).toBe(false);
+
+ for (const id of [own.body.id, shared.body.id]) {
+ const put = await server.request("PUT", `/profiles/${id}`, {
+ user: "user-2",
+ body: { name: "mine" },
+ });
+ expect(put.status).toBe(403);
+ const del = await server.request("DELETE", `/profiles/${id}`, {
+ user: "user-2",
+ });
+ expect(del.status).toBe(403);
+ }
+ });
+
+ it("needs the share permission to share a profile", async () => {
+ server = await startServer({ permissions: ["vault.use"] });
+ const create = await server.request("POST", "/profiles", {
+ body: { ...PROFILE, shared: true },
+ });
+ expect(create.status).toBe(403);
+
+ const own = await server.request("POST", "/profiles", { body: PROFILE });
+ expect(own.status).toBe(201);
+ const share = await server.request("PUT", `/profiles/${own.body.id}`, {
+ body: { shared: true },
+ });
+ expect(share.status).toBe(403);
+ const unshare = await server.request("PUT", `/profiles/${own.body.id}`, {
+ body: { shared: false },
+ });
+ expect(unshare.status).toBe(200);
+ });
+
+ it("refuses every profile route without the use permission", async () => {
+ server = await startServer({ permissions: [] });
+ for (const [method, path] of [
+ ["GET", "/profiles"],
+ ["POST", "/profiles"],
+ ["PUT", "/profiles/1"],
+ ["DELETE", "/profiles/1"],
+ ]) {
+ const response = await server.request(method, path, {
+ body: method === "GET" ? undefined : PROFILE,
+ });
+ expect(response.status, `${method} ${path}`).toBe(403);
+ }
+ });
+
+ it("answers 404 for a profile that does not exist", async () => {
+ server = await startServer();
+ expect(
+ (await server.request("PUT", "/profiles/99", { body: {} })).status,
+ ).toBe(404);
+ expect((await server.request("DELETE", "/profiles/99")).status).toBe(404);
+ expect((await server.request("DELETE", "/profiles/abc")).status).toBe(400);
+ });
+});
+
+describe("signing a certificate", () => {
+ it("runs the OIDC flow against Vault and stores the certificate sealed", async () => {
+ const vault = createFakeVault();
+ server = await startServer({ fetch: vault.fetch });
+ const { id } = await profileOnHost();
+
+ const socket = await startSignIn();
+ expect(socket.sent).toEqual([
+ expect.objectContaining({
+ type: "vault_auth_url",
+ hostId: 7,
+ requestId: vault.state,
+ url: expect.stringContaining("https://idp.test/authorize"),
+ }),
+ ]);
+ const authUrlCall = vault.calls[0];
+ expect(JSON.parse(String(authUrlCall.init?.body))).toMatchObject({
+ role: "dev",
+ redirect_uri: "https://termix.test/plugin-api/vault/oidc/callback",
+ });
+ expect(authUrlCall.init?.allowPrivateHosts).toEqual(["vault.internal"]);
+
+ const callback = await server.request(
+ "GET",
+ `/oidc/callback?state=${vault.state}&code=abc`,
+ { user: "" },
+ );
+ expect(callback.status).toBe(200);
+ expect(callback.text).toContain("Vault sign-in complete");
+ expect(socket.sent.at(-1)).toMatchObject({
+ type: "vault_completed",
+ hostId: 7,
+ });
+
+ const signCall = vault.calls.find((call) => call.url.includes("/sign/"));
+ expect(signCall?.url).toBe(`${VAULT_ADDR}/v1/ssh-client-signer/sign/ops`);
+ expect(signCall?.init?.headers?.["X-Vault-Token"]).toBe("hvs.token");
+
+ const row = server.db.sqlite
+ .prepare("SELECT * FROM p_vault_tokens WHERE profile_id = ?")
+ .get(id) as { ssh_cert: string; private_key: string };
+ expect(row.ssh_cert).not.toBe(SIGNED_CERT);
+ expect(await server.mock.ctx.secrets.unseal(row.ssh_cert)).toBe(
+ SIGNED_CERT,
+ );
+ expect(await server.mock.ctx.secrets.unseal(row.private_key)).toContain(
+ "OPENSSH PRIVATE KEY",
+ );
+
+ const outcome = await server.provider().prepare({}, HOST, env());
+ expect(outcome).toEqual({ status: "ready" });
+ expect(certs.applyCertificateAuth).toHaveBeenCalledWith(
+ {},
+ {},
+ expect.objectContaining({ certificate: SIGNED_CERT }),
+ "root",
+ );
+ });
+
+ it("answers a second use of the same callback with an error", async () => {
+ const vault = createFakeVault();
+ server = await startServer({ fetch: vault.fetch });
+ await profileOnHost();
+ await startSignIn();
+ const path = `/oidc/callback?state=${vault.state}&code=abc`;
+ expect((await server.request("GET", path)).status).toBe(200);
+ expect((await server.request("GET", path)).status).toBe(400);
+ });
+
+ it("reports Vault refusing to sign", async () => {
+ const vault = createFakeVault({ signStatus: 403 });
+ server = await startServer({ fetch: vault.fetch });
+ await profileOnHost();
+ const socket = await startSignIn();
+ const callback = await server.request(
+ "GET",
+ `/oidc/callback?state=${vault.state}&code=abc`,
+ );
+ expect(callback.status).toBe(400);
+ expect(socket.sent.at(-1)).toMatchObject({
+ type: "vault_error",
+ error: expect.stringContaining("permission denied"),
+ });
+ });
+
+ it("passes an identity provider error through", async () => {
+ server = await startServer();
+ const callback = await server.request(
+ "GET",
+ "/oidc/callback?error=access_denied",
+ );
+ expect(callback.status).toBe(400);
+ expect(callback.text).toContain("access_denied");
+ });
+
+ it("sends the 2.8 redirect URI while legacyCallback is on", async () => {
+ const vault = createFakeVault();
+ server = await startServer({
+ fetch: vault.fetch,
+ settings: { legacyCallback: true },
+ });
+ await profileOnHost();
+ await startSignIn();
+ expect(JSON.parse(String(vault.calls[0].init?.body)).redirect_uri).toBe(
+ "https://termix.test/vault/oidc/callback",
+ );
+ });
+
+ it("lets a pending sign-in be cancelled", async () => {
+ const vault = createFakeVault();
+ server = await startServer({ fetch: vault.fetch });
+ await profileOnHost();
+ await startSignIn();
+ await server.provider().cancelInteraction!({ userId: "user-1", hostId: 7 });
+ const callback = await server.request(
+ "GET",
+ `/oidc/callback?state=${vault.state}&code=abc`,
+ );
+ expect(callback.status).toBe(400);
+ });
+
+ it("refuses to start without a profile on the host", async () => {
+ server = await startServer();
+ await expect(startSignIn()).rejects.toThrow(/No Vault signer profile/);
+ });
+});
+
+describe("the vault provider", () => {
+ it("fails without a profile on the host", async () => {
+ server = await startServer();
+ expect(await server.provider().prepare({}, HOST, env())).toMatchObject({
+ status: "error",
+ message: "Host has no Vault signer profile configured",
+ });
+ });
+
+ it("asks for a sign-in without a certificate", async () => {
+ server = await startServer();
+ await profileOnHost();
+ expect(await server.provider().prepare({}, HOST, env())).toEqual({
+ status: "interaction-required",
+ interaction: "vault",
+ message: expect.any(String),
+ flag: "requiresVaultAuth",
+ });
+ });
+
+ it("uses a profile another user shared with the host's owner", async () => {
+ server = await startServer();
+ const shared = await server.request("POST", "/profiles", {
+ user: "user-2",
+ body: { ...PROFILE, shared: true },
+ });
+ await server.mock.ctx.settings.setHost(7, "profileId", shared.body.id);
+ expect((await server.provider().prepare({}, HOST, env())).status).toBe(
+ "interaction-required",
+ );
+ });
+
+ it("drops a certificate 2.8 cached with the user's data key", async () => {
+ server = await startServer();
+ const { id } = await profileOnHost();
+ server.db.sqlite
+ .prepare(
+ "INSERT INTO p_vault_tokens (user_id, profile_id, ssh_cert, private_key, expires_at) VALUES (?, ?, ?, ?, ?)",
+ )
+ .run(
+ "user-1",
+ id,
+ "v1:dek-cipher",
+ "v1:dek-cipher",
+ "2999-01-01T00:00:00.000Z",
+ );
+
+ const outcome = await server.provider().prepare({}, HOST, env());
+ expect(outcome.status).toBe("interaction-required");
+ expect(
+ server.db.sqlite
+ .prepare("SELECT COUNT(*) AS n FROM p_vault_tokens")
+ .get(),
+ ).toEqual({ n: 0 });
+ });
+
+ it("forgets an expired certificate", async () => {
+ server = await startServer();
+ const { id } = await profileOnHost();
+ const seal = server.mock.ctx.secrets.seal;
+ server.db.sqlite
+ .prepare(
+ "INSERT INTO p_vault_tokens (user_id, profile_id, ssh_cert, private_key, expires_at) VALUES (?, ?, ?, ?, ?)",
+ )
+ .run(
+ "user-1",
+ id,
+ await seal("c"),
+ await seal("k"),
+ "2000-01-01T00:00:00.000Z",
+ );
+ expect((await server.provider().prepare({}, HOST, env())).status).toBe(
+ "interaction-required",
+ );
+ expect(
+ server.db.sqlite
+ .prepare("SELECT COUNT(*) AS n FROM p_vault_tokens")
+ .get(),
+ ).toEqual({ n: 0 });
+ });
+
+ it("drops the certificate when the host rejects it", async () => {
+ const vault = createFakeVault();
+ server = await startServer({ fetch: vault.fetch });
+ await profileOnHost();
+ await startSignIn();
+ await server.request("GET", `/oidc/callback?state=${vault.state}&code=abc`);
+
+ const outcome = server.provider().onAuthFailed!(HOST, env(), {
+ error: new Error("All configured authentication methods failed"),
+ retries: 0,
+ canRetry: false,
+ methodNotAvailable: false,
+ });
+ expect(outcome).toMatchObject({ status: "interaction-required" });
+ await vi.waitFor(() =>
+ expect(
+ server!.db.sqlite
+ .prepare("SELECT COUNT(*) AS n FROM p_vault_tokens")
+ .get(),
+ ).toEqual({ n: 0 }),
+ );
+ });
+
+ it("ignores other auth failures", async () => {
+ server = await startServer();
+ expect(
+ server.provider().onAuthFailed!(HOST, env(), {
+ error: new Error("connection reset"),
+ retries: 0,
+ canRetry: false,
+ methodNotAvailable: false,
+ }),
+ ).toBeUndefined();
+ });
+});
diff --git a/plugins/vault/tests/frontend/activate.test.tsx b/plugins/vault/tests/frontend/activate.test.tsx
new file mode 100644
index 000000000..3b1642d9f
--- /dev/null
+++ b/plugins/vault/tests/frontend/activate.test.tsx
@@ -0,0 +1,268 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+ act,
+ fireEvent,
+ render,
+ screen,
+ waitFor,
+} from "@testing-library/react";
+import {
+ renderWithApp,
+ type RenderedPluginApp,
+} from "@termix/plugin-sdk/testing";
+import type { PluginManifest } from "@termix/plugin-sdk/manifest";
+import * as plugin from "../../src/frontend/index";
+import { VaultOverlay } from "../../src/frontend/VaultOverlay";
+import { VaultAuthEditor } from "../../src/frontend/VaultAuthEditor";
+import { redirectUri } from "../../src/frontend/RedirectUriSetting";
+import manifestJson from "../../manifest.json";
+import locales from "../../locales/en.json";
+
+const stubs = vi.hoisted(() => ({
+ permissions: new Set(["use", "share"]),
+ api: {
+ get: vi.fn(),
+ post: vi.fn(),
+ put: vi.fn(),
+ delete: vi.fn(),
+ patch: vi.fn(),
+ },
+ toast: { success: vi.fn(), error: vi.fn(), info: vi.fn(), warning: vi.fn() },
+}));
+
+vi.mock("@termix/plugin-sdk/frontend", async (importOriginal) => ({
+ ...(await importOriginal()),
+ useTranslation: () => ({
+ t: (key: string, options?: Record) =>
+ options?.name ? `${key}:${options.name}` : key,
+ }),
+ usePluginApi: () => stubs.api,
+ usePermission: (permission: string) => stubs.permissions.has(permission),
+ useToast: () => stubs.toast,
+}));
+
+const manifest = manifestJson as unknown as PluginManifest;
+
+let rendered: RenderedPluginApp | null = null;
+
+beforeEach(() => {
+ stubs.permissions = new Set(["use", "share"]);
+ for (const fn of Object.values(stubs.api)) fn.mockReset();
+ stubs.api.get.mockResolvedValue({ data: [] });
+});
+
+afterEach(async () => {
+ await rendered?.deactivate();
+ rendered = null;
+});
+
+describe("vault activate", () => {
+ it("registers the terminal overlay and the settings field, and removes them on deactivate", async () => {
+ rendered = await renderWithApp(plugin, { manifest, locales });
+ expect(rendered.registered.settingsComponents()).toEqual(["redirectUri"]);
+ expect(rendered.registered.slot("terminal.overlay")).toEqual([
+ "vault.signIn",
+ ]);
+ await rendered.deactivate();
+ expect(rendered.registered.settingsComponents()).toEqual([]);
+ expect(rendered.registered.slot("terminal.overlay")).toEqual([]);
+ rendered = null;
+ });
+});
+
+describe("redirectUri", () => {
+ it("names the plugin callback, or the 2.8 one", () => {
+ expect(redirectUri(false, "https://t.example/app/")).toBe(
+ "https://t.example/app/plugin-api/vault/oidc/callback",
+ );
+ expect(redirectUri(true, "https://t.example/")).toBe(
+ "https://t.example/vault/oidc/callback",
+ );
+ });
+});
+
+describe("VaultAuthEditor", () => {
+ const profiles = [
+ {
+ id: 3,
+ name: "Prod",
+ vaultAddr: "https://v",
+ sshRole: "r",
+ shared: false,
+ owned: true,
+ },
+ {
+ id: 4,
+ name: "Team",
+ vaultAddr: "https://v",
+ sshRole: "r",
+ shared: true,
+ owned: false,
+ },
+ ];
+
+ it("lists the profiles and stores the choice as the profileId host setting", async () => {
+ stubs.api.get.mockResolvedValue({ data: profiles });
+ const setField = vi.fn();
+ render(
+ ,
+ );
+ await waitFor(() => expect(screen.getByText("Prod")).toBeTruthy());
+ expect(stubs.api.get).toHaveBeenCalledWith("/profiles");
+ expect(screen.getByText("editor.sharedProfile:Team")).toBeTruthy();
+
+ fireEvent.change(screen.getByRole("combobox"), { target: { value: "4" } });
+ expect(setField).toHaveBeenCalledWith("pluginSettings", {
+ other: { x: 1 },
+ vault: { profileId: 4 },
+ });
+ });
+
+ it("shows the saved profile", async () => {
+ stubs.api.get.mockResolvedValue({ data: profiles });
+ render(
+ ,
+ );
+ await waitFor(() =>
+ expect((screen.getByRole("combobox") as HTMLSelectElement).value).toBe(
+ "3",
+ ),
+ );
+ });
+
+ it("creates a profile from the manager, shared only with the share permission", async () => {
+ stubs.api.post.mockResolvedValue({ data: {} });
+ render();
+ fireEvent.click(screen.getByText("profiles.manage"));
+ fireEvent.click(screen.getByText("profiles.new"));
+ const inputs = screen.getAllByRole("textbox");
+ fireEvent.change(inputs[0], { target: { value: "Prod" } });
+ fireEvent.change(inputs[1], { target: { value: "https://vault:8200" } });
+ fireEvent.change(inputs[6], { target: { value: "ops" } });
+ fireEvent.click(screen.getByRole("checkbox"));
+ await act(async () => {
+ fireEvent.click(screen.getByText("profiles.create"));
+ });
+ expect(stubs.api.post).toHaveBeenCalledWith(
+ "/profiles",
+ expect.objectContaining({
+ name: "Prod",
+ vaultAddr: "https://vault:8200",
+ sshRole: "ops",
+ shared: true,
+ }),
+ );
+ });
+
+ it("hides sharing without the share permission and managing without use", async () => {
+ stubs.permissions = new Set(["use"]);
+ const { unmount } = render(
+ ,
+ );
+ fireEvent.click(screen.getByText("profiles.manage"));
+ fireEvent.click(screen.getByText("profiles.new"));
+ expect(screen.queryByRole("checkbox")).toBeNull();
+ unmount();
+
+ stubs.permissions = new Set();
+ stubs.api.get.mockClear();
+ render();
+ expect(screen.queryByText("profiles.manage")).toBeNull();
+ expect(stubs.api.get).not.toHaveBeenCalled();
+ });
+});
+
+describe("VaultOverlay", () => {
+ function setup() {
+ let listener: (message: {
+ type: string;
+ [key: string]: unknown;
+ }) => void = () => {};
+ const props = {
+ host: { id: 7 },
+ subscribe: vi.fn((next: typeof listener) => {
+ listener = next;
+ return () => {};
+ }),
+ holdConnectTimeout: vi.fn(),
+ fail: vi.fn(),
+ disconnect: vi.fn(),
+ send: vi.fn(),
+ connectPayload: vi.fn(() => ({ hostId: 7, cols: 80, rows: 24 })),
+ };
+ render();
+ const emit = (message: { type: string; [key: string]: unknown }) =>
+ act(() => listener(message));
+ return { props, emit };
+ }
+
+ it("starts the sign-in once, then reports a second request as a failure", () => {
+ const { props, emit } = setup();
+ emit({ type: "vault_auth_required", hostId: 7 });
+ expect(props.send).toHaveBeenCalledWith("vault_start_auth", { hostId: 7 });
+ expect(props.holdConnectTimeout).toHaveBeenCalledWith(true);
+
+ emit({ type: "vault_auth_required", hostId: 7 });
+ expect(props.fail).toHaveBeenCalledWith("dialog.failed");
+ });
+
+ it("opens Vault's sign-in, waits, and reconnects once signed", () => {
+ const close = vi.fn();
+ const open = vi
+ .spyOn(window, "open")
+ .mockReturnValue({ close, focus: vi.fn() } as unknown as Window);
+ const { props, emit } = setup();
+ emit({ type: "vault_auth_required", hostId: 7 });
+ emit({
+ type: "vault_auth_url",
+ hostId: 7,
+ requestId: "st-1",
+ url: "https://idp.test/authorize",
+ });
+ expect(open).toHaveBeenCalledWith(
+ "https://idp.test/authorize",
+ "termix-vault-oidc",
+ "width=540,height=720",
+ );
+ expect(screen.getByText("dialog.description")).toBeTruthy();
+
+ emit({ type: "vault_completed", hostId: 7 });
+ expect(close).toHaveBeenCalled();
+ expect(props.send).toHaveBeenCalledWith("vault_auth_completed", {
+ hostId: 7,
+ cols: 80,
+ rows: 24,
+ });
+ expect(screen.queryByText("dialog.title")).toBeNull();
+ open.mockRestore();
+ });
+
+ it("cancels a pending sign-in", () => {
+ const open = vi.spyOn(window, "open").mockReturnValue(null);
+ const { props, emit } = setup();
+ emit({
+ type: "vault_auth_url",
+ hostId: 7,
+ requestId: "st-2",
+ url: "https://idp.test/authorize",
+ });
+ fireEvent.click(screen.getByText("common.cancel"));
+ expect(props.send).toHaveBeenCalledWith("vault_cancel", {
+ hostId: 7,
+ requestId: "st-2",
+ });
+ open.mockRestore();
+ });
+
+ it("shows Vault's error", () => {
+ const { emit } = setup();
+ emit({ type: "vault_error", hostId: 7, error: "permission denied" });
+ expect(screen.getByText("permission denied")).toBeTruthy();
+ });
+});
diff --git a/plugins/vault/tsconfig.json b/plugins/vault/tsconfig.json
new file mode 100644
index 000000000..7b35314c3
--- /dev/null
+++ b/plugins/vault/tsconfig.json
@@ -0,0 +1,4 @@
+{
+ "extends": "@termix/plugin-sdk/tsconfig.plugin.json",
+ "include": ["src/**/*.ts", "src/**/*.tsx", "tests/**/*.ts", "tests/**/*.tsx"]
+}
diff --git a/plugins/vault/vitest.config.ts b/plugins/vault/vitest.config.ts
new file mode 100644
index 000000000..31ba004fc
--- /dev/null
+++ b/plugins/vault/vitest.config.ts
@@ -0,0 +1,3 @@
+import { pluginVitestConfig } from "@termix/plugin-sdk/vitest-preset";
+
+export default pluginVitestConfig(import.meta.url);
diff --git a/src/backend/auth/legacy-providers.ts b/src/backend/auth/legacy-providers.ts
deleted file mode 100644
index cc68fee11..000000000
--- a/src/backend/auth/legacy-providers.ts
+++ /dev/null
@@ -1,132 +0,0 @@
-/**
- * Auth methods that still live in core for 2.9.0, registered through the same
- * interfaces a plugin uses. Phase C moves each one into its own plugin by
- * relocating its block from here; D1 deletes this file once it is empty.
- *
- * Nothing outside this file should branch on these type names.
- */
-
-import { getErrorMessage } from "../utils/error-message.js";
-import { sshLogger } from "../utils/logger.js";
-import { applyCertificateAuth } from "@termix/plugin-sdk/ssh-certs";
-import { registerSshAuthProvider } from "../hosts/connect/auth-provider-registry.js";
-import type {
- SshAuthProvider,
- SshConnectHost,
-} from "../hosts/connect/types.js";
-
-const VAULT_REQUIRED_MESSAGE =
- "Vault SSH signer authentication required. Please open a Terminal connection first.";
-
-const AUTH_FAILED_PATTERN = /All configured authentication methods failed/i;
-
-function vaultProfileId(host: SshConnectHost): number | undefined {
- return host.vaultProfile?.id ?? undefined;
-}
-
-const vaultProvider: SshAuthProvider = {
- type: "vault",
- pluginId: "core",
- labelKey: "hosts.filterAuthVault",
- needsUserInteraction: true,
- interaction: "vault",
- prepare: async (config, host, env) => {
- const profileId = vaultProfileId(host);
- if (!profileId) {
- return {
- status: "error",
- code: "failed",
- message: "Host has no Vault signer profile configured",
- };
- }
- const { getVaultCert } = await import("../hosts/vault-signer-auth.js");
- const cert = await getVaultCert(env.userId, profileId);
- if (!cert) {
- env.log(
- "info",
- "No valid Vault certificate found, requesting authentication",
- );
- return {
- status: "interaction-required",
- interaction: "vault",
- message: VAULT_REQUIRED_MESSAGE,
- flag: "requiresVaultAuth",
- };
- }
- try {
- await applyCertificateAuth(
- config,
- env.client,
- { privateKey: cert.privateKey, certificate: cert.sshCert },
- host.username,
- );
- } catch (error) {
- return {
- status: "error",
- code: "failed",
- message:
- "Vault SSH signer authentication failed: " + getErrorMessage(error),
- };
- }
- env.log("info", "Using cached Vault-signed certificate");
- return { status: "ready" };
- },
- onAuthFailed: (host, env, context) => {
- if (!AUTH_FAILED_PATTERN.test(context.error.message)) return;
- sshLogger.warn("Vault certificate authentication failed", {
- operation: "vault_auth_failed",
- hostId: env.hostId,
- userId: env.userId,
- });
- const profileId = vaultProfileId(host);
- if (profileId) {
- void import("../hosts/vault-signer-auth.js")
- .then(({ deleteVaultCert }) => deleteVaultCert(env.userId, profileId))
- .catch(() => {});
- }
- return {
- status: "interaction-required",
- interaction: "vault",
- message:
- "Vault authentication failed or expired. Please authenticate again.",
- };
- },
- startInteraction: async (request) => {
- const { loadVaultProfileForHost, startVaultAuth } =
- await import("../hosts/vault-oidc-auth.js");
- const profile = await loadVaultProfileForHost(
- request.hostId,
- request.userId,
- );
- if (!profile) {
- throw new Error("No Vault signer profile configured for this host");
- }
- await startVaultAuth(
- request.userId,
- request.hostId,
- profile,
- request.socket,
- request.requestOrigin,
- );
- },
- cancelInteraction: async (request) => {
- if (request.hostId === undefined) return;
- const { cancelVaultAuthByHost } =
- await import("../hosts/vault-oidc-auth.js");
- cancelVaultAuthByHost(request.userId, request.hostId);
- },
-};
-
-let sshRegistered = false;
-
-export function registerLegacySshAuthProviders(): void {
- if (sshRegistered) return;
- sshRegistered = true;
-
- registerSshAuthProvider(vaultProvider);
-}
-
-/** Test helper. */
-export function resetLegacyProvidersForTests(): void {
- sshRegistered = false;
-}
diff --git a/src/backend/auth/registry.ts b/src/backend/auth/registry.ts
index 1a9fe371e..984dc4b4b 100644
--- a/src/backend/auth/registry.ts
+++ b/src/backend/auth/registry.ts
@@ -2,8 +2,8 @@
* Login methods and second factors, from core and from plugins.
*
* Password login is registered by core and always present. Everything else
- * (OIDC, LDAP, passkeys, TOTP, ...) registers here, from a plugin through
- * ctx.auth or, in 2.9.0, from legacy-providers.ts.
+ * (OIDC, LDAP, passkeys, TOTP, ...) registers here from a plugin through
+ * ctx.auth.
*/
import type {
diff --git a/src/backend/database/database.ts b/src/backend/database/database.ts
index 20ceeb578..bac004ed9 100644
--- a/src/backend/database/database.ts
+++ b/src/backend/database/database.ts
@@ -7,6 +7,7 @@ import multer from "multer";
import cookieParser from "cookie-parser";
import userRoutes from "./routes/users.js";
import hostRoutes from "./routes/host.js";
+import { registerVaultCompatRoutes } from "./routes/host-compat-routes.js";
import alertRoutes from "./routes/alerts.js";
import credentialsRoutes from "./routes/credentials.js";
import sshAuthRoutes from "./routes/ssh-auth-routes.js";
@@ -18,7 +19,6 @@ import credentialSidebarPreferencesRoutes from "./routes/credential-sidebar-pref
import uiPreferencesRoutes from "./routes/ui-preferences.js";
import termixIdRoutes from "./routes/termix-id.js";
import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
-import vaultRoutes from "./routes/vault.js";
import notificationChannelsRoutes from "./routes/notification-channels-routes.js";
import syncRoutes from "./routes/sync.js";
import dashboardRoutes from "./routes/dashboard-routes.js";
@@ -1795,7 +1795,9 @@ app.use("/credential-sidebar/preferences", credentialSidebarPreferencesRoutes);
app.use("/ui-preferences", uiPreferencesRoutes);
app.use("/termix-id", termixIdRoutes);
registerAuditLogRoutes(app, authenticateJWT);
-app.use("/vault", vaultRoutes);
+const vaultCompatRoutes = express.Router();
+registerVaultCompatRoutes(vaultCompatRoutes);
+app.use("/vault", vaultCompatRoutes);
app.use("/", notificationChannelsRoutes);
app.use("/sync", syncRoutes);
app.use("/dashboard", dashboardRoutes);
diff --git a/src/backend/database/db/index.ts b/src/backend/database/db/index.ts
index ead5cf75e..45c81a065 100644
--- a/src/backend/database/db/index.ts
+++ b/src/backend/database/db/index.ts
@@ -978,11 +978,6 @@ const migrateSchema = () => {
"override_credential_username",
"INTEGER",
);
- addColumnIfNotExists(
- "ssh_data",
- "vault_profile_id",
- "INTEGER REFERENCES vault_profiles(id) ON DELETE SET NULL",
- );
addColumnIfNotExists("ssh_data", "autostart_password", "TEXT");
addColumnIfNotExists("ssh_data", "autostart_key", "TEXT");
@@ -1579,67 +1574,6 @@ const migrateSchema = () => {
});
}
- try {
- sqlite.prepare("SELECT id FROM vault_profiles LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS vault_profiles (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- user_id TEXT NOT NULL,
- name TEXT NOT NULL,
- description TEXT,
- folder TEXT,
- tags TEXT,
- vault_addr TEXT NOT NULL,
- vault_namespace TEXT,
- oidc_mount TEXT,
- oidc_role TEXT,
- ssh_mount TEXT,
- ssh_role TEXT NOT NULL,
- valid_principals TEXT,
- key_type TEXT,
- shared INTEGER NOT NULL DEFAULT 0,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create vault_profiles table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
- try {
- sqlite.prepare("SELECT id FROM vault_tokens LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS vault_tokens (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- user_id TEXT NOT NULL,
- profile_id INTEGER NOT NULL,
- ssh_cert TEXT NOT NULL,
- private_key TEXT NOT NULL,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- expires_at TEXT NOT NULL,
- last_used TEXT,
- UNIQUE(user_id, profile_id),
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
- FOREIGN KEY (profile_id) REFERENCES vault_profiles (id) ON DELETE CASCADE
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create vault_tokens table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
try {
const existingRoles = sqlite.prepare("SELECT name, is_system FROM roles").all() as Array<{ name: string; is_system: number }>;
@@ -1878,7 +1812,6 @@ const migrateSchema = () => {
addColumnIfNotExists("ssh_folders", "sync_id", "TEXT");
addColumnIfNotExists("snippets", "sync_id", "TEXT");
addColumnIfNotExists("snippet_folders", "sync_id", "TEXT");
- addColumnIfNotExists("vault_profiles", "sync_id", "TEXT");
// Plugin runtime: lastError reports why a plugin is blocked or failed, and
// grants record whether a capability came from an admin or from bundling.
@@ -1896,7 +1829,6 @@ const migrateSchema = () => {
"ssh_folders",
"snippets",
"snippet_folders",
- "vault_profiles",
];
for (const table of syncIdTables) {
diff --git a/src/backend/database/db/schema.mysql.ts b/src/backend/database/db/schema.mysql.ts
index 605e2c68f..a44f321c2 100644
--- a/src/backend/database/db/schema.mysql.ts
+++ b/src/backend/database/db/schema.mysql.ts
@@ -194,13 +194,6 @@ export const hosts = mysqlTable(
credentialId: int("credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
overrideCredentialUsername: boolean("override_credential_username"),
- // When authType is "vault", the host authenticates via a Vault SSH signer
- // profile (shared settings, no secrets). The signing certificate is obtained
- // per-user at connect time via an interactive Vault OIDC flow.
- vaultProfileId: int("vault_profile_id").references(
- () => vaultProfiles.id,
- { onDelete: "set null" },
- ),
enableTerminal: boolean("enable_terminal")
.notNull()
.default(true),
@@ -660,71 +653,6 @@ export const auditLogs = mysqlTable(
],
);
-// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
-// are intended to be shared across users (shared === true makes a profile
-// visible to every user on the server). Each user authenticates to Vault via an
-// interactive OIDC flow at connect time; no tokens or keys are stored here.
-export const vaultProfiles = mysqlTable("vault_profiles", {
- id: int("id").autoincrement().primaryKey(),
- userId: varchar("user_id", { length: 255 })
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- name: varchar("name", { length: 255 }).notNull(),
- description: text("description"),
- folder: varchar("folder", { length: 255 }),
- tags: text("tags"),
- // Vault server connection (non-secret)
- vaultAddr: text("vault_addr").notNull(),
- vaultNamespace: text("vault_namespace"),
- // OIDC auth method mount + role used to obtain a Vault token interactively
- oidcMount: text("oidc_mount"),
- oidcRole: text("oidc_role"),
- // SSH secrets engine mount + signer role used to sign the ephemeral key
- sshMount: text("ssh_mount"),
- sshRole: text("ssh_role").notNull(),
- validPrincipals: text("valid_principals"),
- // Ephemeral keypair algorithm to generate per connection
- keyType: text("key_type"),
- // When true the profile is visible/usable by all users on the server
- shared: boolean("shared").notNull().default(false),
- syncId: varchar("sync_id", { length: 255 }).unique(),
- createdAt: text("created_at")
- .notNull()
- .default(sql`(CURRENT_TIMESTAMP)`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`(CURRENT_TIMESTAMP)`),
-});
-
-// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
-// Transient: rows live only until the certificate expires. Secret fields are
-// encrypted under the user's data-encryption key (see field-crypto.ts).
-export const vaultTokens = mysqlTable(
- "vault_tokens",
- {
- id: int("id").autoincrement().primaryKey(),
- userId: varchar("user_id", { length: 255 })
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- profileId: int("profile_id")
- .notNull()
- .references(() => vaultProfiles.id, { onDelete: "cascade" }),
-
- sshCert: text("ssh_cert").notNull(),
- privateKey: text("private_key").notNull(),
-
- createdAt: text("created_at")
- .notNull()
- .default(sql`(CURRENT_TIMESTAMP)`),
- expiresAt: varchar("expires_at", { length: 255 }).notNull(),
- lastUsed: text("last_used"),
- },
- // Declared inline in the production DDL as UNIQUE(...), but never here,
- // so the generated Postgres and MySQL schemas allowed duplicates the
- // SQLite deployment forbids — and the upsert had nothing to conflict on.
- (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
-);
-
export const apiKeys = mysqlTable(
"api_keys",
{
diff --git a/src/backend/database/db/schema.pg.ts b/src/backend/database/db/schema.pg.ts
index f37ad417c..f943c1b0c 100644
--- a/src/backend/database/db/schema.pg.ts
+++ b/src/backend/database/db/schema.pg.ts
@@ -195,13 +195,6 @@ export const hosts = pgTable(
credentialId: integer("credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
overrideCredentialUsername: boolean("override_credential_username"),
- // When authType is "vault", the host authenticates via a Vault SSH signer
- // profile (shared settings, no secrets). The signing certificate is obtained
- // per-user at connect time via an interactive Vault OIDC flow.
- vaultProfileId: integer("vault_profile_id").references(
- () => vaultProfiles.id,
- { onDelete: "set null" },
- ),
enableTerminal: boolean("enable_terminal")
.notNull()
.default(true),
@@ -661,71 +654,6 @@ export const auditLogs = pgTable(
],
);
-// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
-// are intended to be shared across users (shared === true makes a profile
-// visible to every user on the server). Each user authenticates to Vault via an
-// interactive OIDC flow at connect time; no tokens or keys are stored here.
-export const vaultProfiles = pgTable("vault_profiles", {
- id: serial("id").primaryKey(),
- userId: varchar("user_id", { length: 255 })
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- name: varchar("name", { length: 255 }).notNull(),
- description: text("description"),
- folder: varchar("folder", { length: 255 }),
- tags: text("tags"),
- // Vault server connection (non-secret)
- vaultAddr: text("vault_addr").notNull(),
- vaultNamespace: text("vault_namespace"),
- // OIDC auth method mount + role used to obtain a Vault token interactively
- oidcMount: text("oidc_mount"),
- oidcRole: text("oidc_role"),
- // SSH secrets engine mount + signer role used to sign the ephemeral key
- sshMount: text("ssh_mount"),
- sshRole: text("ssh_role").notNull(),
- validPrincipals: text("valid_principals"),
- // Ephemeral keypair algorithm to generate per connection
- keyType: text("key_type"),
- // When true the profile is visible/usable by all users on the server
- shared: boolean("shared").notNull().default(false),
- syncId: varchar("sync_id", { length: 255 }).unique(),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
-
-// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
-// Transient: rows live only until the certificate expires. Secret fields are
-// encrypted under the user's data-encryption key (see field-crypto.ts).
-export const vaultTokens = pgTable(
- "vault_tokens",
- {
- id: serial("id").primaryKey(),
- userId: varchar("user_id", { length: 255 })
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- profileId: integer("profile_id")
- .notNull()
- .references(() => vaultProfiles.id, { onDelete: "cascade" }),
-
- sshCert: text("ssh_cert").notNull(),
- privateKey: text("private_key").notNull(),
-
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- expiresAt: varchar("expires_at", { length: 255 }).notNull(),
- lastUsed: text("last_used"),
- },
- // Declared inline in the production DDL as UNIQUE(...), but never here,
- // so the generated Postgres and MySQL schemas allowed duplicates the
- // SQLite deployment forbids — and the upsert had nothing to conflict on.
- (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
-);
-
export const apiKeys = pgTable(
"api_keys",
{
diff --git a/src/backend/database/db/schema.ts b/src/backend/database/db/schema.ts
index dc283451d..518321254 100644
--- a/src/backend/database/db/schema.ts
+++ b/src/backend/database/db/schema.ts
@@ -187,13 +187,6 @@ export const hosts = sqliteTable(
overrideCredentialUsername: integer("override_credential_username", {
mode: "boolean",
}),
- // When authType is "vault", the host authenticates via a Vault SSH signer
- // profile (shared settings, no secrets). The signing certificate is obtained
- // per-user at connect time via an interactive Vault OIDC flow.
- vaultProfileId: integer("vault_profile_id").references(
- () => vaultProfiles.id,
- { onDelete: "set null" },
- ),
enableTerminal: integer("enable_terminal", { mode: "boolean" })
.notNull()
.default(true),
@@ -653,71 +646,6 @@ export const auditLogs = sqliteTable(
],
);
-// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
-// are intended to be shared across users (shared === true makes a profile
-// visible to every user on the server). Each user authenticates to Vault via an
-// interactive OIDC flow at connect time; no tokens or keys are stored here.
-export const vaultProfiles = sqliteTable("vault_profiles", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- name: text("name").notNull(),
- description: text("description"),
- folder: text("folder"),
- tags: text("tags"),
- // Vault server connection (non-secret)
- vaultAddr: text("vault_addr").notNull(),
- vaultNamespace: text("vault_namespace"),
- // OIDC auth method mount + role used to obtain a Vault token interactively
- oidcMount: text("oidc_mount"),
- oidcRole: text("oidc_role"),
- // SSH secrets engine mount + signer role used to sign the ephemeral key
- sshMount: text("ssh_mount"),
- sshRole: text("ssh_role").notNull(),
- validPrincipals: text("valid_principals"),
- // Ephemeral keypair algorithm to generate per connection
- keyType: text("key_type"),
- // When true the profile is visible/usable by all users on the server
- shared: integer("shared", { mode: "boolean" }).notNull().default(false),
- syncId: text("sync_id").unique(),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
-
-// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
-// Transient: rows live only until the certificate expires. Secret fields are
-// encrypted under the user's data-encryption key (see field-crypto.ts).
-export const vaultTokens = sqliteTable(
- "vault_tokens",
- {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- profileId: integer("profile_id")
- .notNull()
- .references(() => vaultProfiles.id, { onDelete: "cascade" }),
-
- sshCert: text("ssh_cert", { length: 8192 }).notNull(),
- privateKey: text("private_key", { length: 8192 }).notNull(),
-
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- expiresAt: text("expires_at").notNull(),
- lastUsed: text("last_used"),
- },
- // Declared inline in the production DDL as UNIQUE(...), but never here,
- // so the generated Postgres and MySQL schemas allowed duplicates the
- // SQLite deployment forbids — and the upsert had nothing to conflict on.
- (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
-);
-
export const apiKeys = sqliteTable(
"api_keys",
{
diff --git a/src/backend/database/repositories/factory.ts b/src/backend/database/repositories/factory.ts
index ae3132ed5..ab69eff72 100644
--- a/src/backend/database/repositories/factory.ts
+++ b/src/backend/database/repositories/factory.ts
@@ -42,8 +42,6 @@ import { TrustedDeviceRepository } from "./trusted-device-repository.js";
import { UserDataExportRepository } from "./user-data-export-repository.js";
import { UserPreferenceRepository } from "./user-preference-repository.js";
import { UserRepository } from "./user-repository.js";
-import { VaultProfileRepository } from "./vault-profile-repository.js";
-import { VaultTokenRepository } from "./vault-token-repository.js";
/**
* The context every repository runs against.
@@ -416,20 +414,6 @@ export function createCurrentSharedCredentialSecretsRepository(): SharedCredenti
);
}
-export function createCurrentVaultProfileRepository(): VaultProfileRepository {
- return new VaultProfileRepository(
- createCurrentRepositoryContext(),
- createCurrentRepositoryWriteHook("vault_profile_repository_write"),
- );
-}
-
-export function createCurrentVaultTokenRepository(): VaultTokenRepository {
- return new VaultTokenRepository(
- createCurrentRepositoryContext(),
- createCurrentRepositoryWriteHook("vault_token_repository_write"),
- );
-}
-
/**
* Loads the settings cache. Must run during startup on engines without a
* synchronous read, before anything calls getCurrentSettingValue.
diff --git a/src/backend/database/repositories/host-resolution-repository.ts b/src/backend/database/repositories/host-resolution-repository.ts
index a93afafa4..4e120a4ab 100644
--- a/src/backend/database/repositories/host-resolution-repository.ts
+++ b/src/backend/database/repositories/host-resolution-repository.ts
@@ -18,7 +18,6 @@ export interface HostUpdateStateRecord {
rdpCredentialId: number | null;
vncCredentialId: number | null;
telnetCredentialId: number | null;
- vaultProfileId: number | null;
authType: string;
parentHostId: number | null;
folder: string | null;
@@ -146,7 +145,6 @@ export class HostResolutionRepository {
rdpCredentialId: hosts.rdpCredentialId,
vncCredentialId: hosts.vncCredentialId,
telnetCredentialId: hosts.telnetCredentialId,
- vaultProfileId: hosts.vaultProfileId,
authType: hosts.authType,
parentHostId: hosts.parentHostId,
folder: hosts.folder,
diff --git a/src/backend/database/repositories/vault-profile-repository.ts b/src/backend/database/repositories/vault-profile-repository.ts
deleted file mode 100644
index bcf8cec56..000000000
--- a/src/backend/database/repositories/vault-profile-repository.ts
+++ /dev/null
@@ -1,134 +0,0 @@
-import { desc, eq, or } from "drizzle-orm";
-import { randomUUID } from "crypto";
-import { vaultProfiles } from "../db/schema.js";
-import type { DatabaseContext } from "./database-context.js";
-import { rowsAffected } from "./mutation-result.js";
-import {
- deleteReturning,
- insertReturning,
- updateReturning,
-} from "./returning.js";
-
-export type VaultProfileRecord = typeof vaultProfiles.$inferSelect;
-
-export interface VaultProfileCreateInput {
- userId: string;
- name: string;
- description?: string | null;
- folder?: string | null;
- tags?: string | null;
- vaultAddr: string;
- vaultNamespace?: string | null;
- oidcMount?: string | null;
- oidcRole?: string | null;
- sshMount?: string | null;
- sshRole: string;
- validPrincipals?: string | null;
- keyType?: string | null;
- shared?: boolean;
-}
-
-export type VaultProfileUpdateInput = Partial<
- Omit
-> & {
- updatedAt?: string;
-};
-
-export class VaultProfileRepository {
- constructor(
- private readonly context: DatabaseContext,
- private readonly onWrite?: () => void | Promise,
- ) {}
-
- async listVisibleToUser(userId: string): Promise {
- return this.context.drizzle
- .select()
- .from(vaultProfiles)
- .where(
- or(eq(vaultProfiles.userId, userId), eq(vaultProfiles.shared, true)),
- )
- .orderBy(desc(vaultProfiles.updatedAt));
- }
-
- async create(input: VaultProfileCreateInput): Promise {
- const [created] = await insertReturning(this.context, vaultProfiles, {
- syncId: randomUUID(),
- userId: input.userId,
- name: input.name,
- description: input.description,
- folder: input.folder,
- tags: input.tags,
- vaultAddr: input.vaultAddr,
- vaultNamespace: input.vaultNamespace,
- oidcMount: input.oidcMount,
- oidcRole: input.oidcRole,
- sshMount: input.sshMount,
- sshRole: input.sshRole,
- validPrincipals: input.validPrincipals,
- keyType: input.keyType,
- shared: input.shared ?? false,
- });
-
- await this.afterWrite();
- return created;
- }
-
- async findById(id: number): Promise {
- const rows = await this.context.drizzle
- .select()
- .from(vaultProfiles)
- .where(eq(vaultProfiles.id, id))
- .limit(1);
-
- return rows[0] ?? null;
- }
-
- async updateById(
- id: number,
- input: VaultProfileUpdateInput,
- ): Promise {
- const [updated] = await updateReturning(
- this.context,
- vaultProfiles,
- {
- ...input,
- updatedAt: input.updatedAt ?? new Date().toISOString(),
- },
- eq(vaultProfiles.id, id),
- );
-
- if (updated) {
- await this.afterWrite();
- }
-
- return updated ?? null;
- }
-
- async deleteById(id: number): Promise<{ syncId: string | null } | null> {
- const rows = await deleteReturning(
- this.context,
- vaultProfiles,
- eq(vaultProfiles.id, id),
- );
-
- if (rows.length === 0) return null;
- await this.afterWrite();
- return { syncId: rows[0].syncId };
- }
-
- async deleteByUserId(userId: string): Promise {
- const result = await this.context.drizzle
- .delete(vaultProfiles)
- .where(eq(vaultProfiles.userId, userId));
-
- if (rowsAffected(result) > 0) {
- await this.afterWrite();
- }
-
- return rowsAffected(result);
- }
-
- private async afterWrite(): Promise {
- await this.onWrite?.();
- }
-}
diff --git a/src/backend/database/repositories/vault-token-repository.ts b/src/backend/database/repositories/vault-token-repository.ts
deleted file mode 100644
index a14ea70b7..000000000
--- a/src/backend/database/repositories/vault-token-repository.ts
+++ /dev/null
@@ -1,126 +0,0 @@
-import { and, eq } from "drizzle-orm";
-import { vaultTokens } from "../db/schema.js";
-import type { DatabaseContext } from "./database-context.js";
-import { rowsAffected } from "./mutation-result.js";
-import { upsert } from "./returning.js";
-
-export type VaultTokenRecord = typeof vaultTokens.$inferSelect;
-
-export interface VaultTokenUpsertInput {
- userId: string;
- profileId: number;
- sshCert: string;
- privateKey: string;
- expiresAt: string;
- createdAt?: string;
-}
-
-export class VaultTokenRepository {
- constructor(
- private readonly context: DatabaseContext,
- private readonly onWrite?: () => void | Promise,
- ) {}
-
- async upsert(input: VaultTokenUpsertInput): Promise {
- const createdAt = input.createdAt ?? new Date().toISOString();
-
- await upsert(
- this.context,
- vaultTokens,
- {
- userId: input.userId,
- profileId: input.profileId,
- sshCert: input.sshCert,
- privateKey: input.privateKey,
- expiresAt: input.expiresAt,
- },
- {
- target: [vaultTokens.userId, vaultTokens.profileId],
- set: {
- sshCert: input.sshCert,
- privateKey: input.privateKey,
- expiresAt: input.expiresAt,
- createdAt,
- },
- },
- );
-
- await this.afterWrite();
- }
-
- async findByUserAndProfile(
- userId: string,
- profileId: number,
- ): Promise {
- const rows = await this.context.drizzle
- .select()
- .from(vaultTokens)
- .where(
- and(
- eq(vaultTokens.userId, userId),
- eq(vaultTokens.profileId, profileId),
- ),
- )
- .limit(1);
-
- return rows[0] ?? null;
- }
-
- async updateLastUsed(
- userId: string,
- profileId: number,
- lastUsed = new Date().toISOString(),
- ): Promise {
- const result = await this.context.drizzle
- .update(vaultTokens)
- .set({ lastUsed })
- .where(
- and(
- eq(vaultTokens.userId, userId),
- eq(vaultTokens.profileId, profileId),
- ),
- );
-
- if (rowsAffected(result) > 0) {
- await this.afterWrite();
- }
-
- return rowsAffected(result) > 0;
- }
-
- async deleteByUserAndProfile(
- userId: string,
- profileId: number,
- ): Promise {
- const result = await this.context.drizzle
- .delete(vaultTokens)
- .where(
- and(
- eq(vaultTokens.userId, userId),
- eq(vaultTokens.profileId, profileId),
- ),
- );
-
- if (rowsAffected(result) > 0) {
- await this.afterWrite();
- }
-
- return rowsAffected(result) > 0;
- }
-
- async deleteByUserId(userId: string): Promise {
- const result = await this.context.drizzle
- .delete(vaultTokens)
- .where(eq(vaultTokens.userId, userId));
-
- if (rowsAffected(result) > 0) {
- await this.afterWrite();
- }
-
- return rowsAffected(result);
- }
-
- private async afterWrite(): Promise {
- await this.onWrite?.();
- }
-}
diff --git a/src/backend/database/routes/delete-user-data.ts b/src/backend/database/routes/delete-user-data.ts
index 5327c2d27..298cf48c4 100644
--- a/src/backend/database/routes/delete-user-data.ts
+++ b/src/backend/database/routes/delete-user-data.ts
@@ -23,10 +23,8 @@ import {
createCurrentTrustedDeviceRepository,
createCurrentUserPreferenceRepository,
createCurrentUserRepository,
- createCurrentVaultProfileRepository,
createCurrentSharedCredentialSecretsRepository,
createCurrentCredentialAccessRepository,
- createCurrentVaultTokenRepository,
} from "../repositories/factory.js";
export async function deleteUserAndRelatedData(
@@ -96,11 +94,9 @@ export async function deleteUserAndRelatedData(
// secret_sources cascade on the user's refUser() foreign key, as the
// homepage and secret-sources plugins' adopted tables. The secret
// source's token in ctx.secrets is cleaned up generically below, with
- // every other plugin_settings row for this user. The opkssh plugin's
- // cached certificates cascade the same way.
+ // every other plugin_settings row for this user. The opkssh and vault
+ // plugins' tables cascade the same way.
- await createCurrentVaultTokenRepository().deleteByUserId(userId);
- await createCurrentVaultProfileRepository().deleteByUserId(userId);
await createCurrentTermixIdentityCaRepository().deleteByUserId(userId);
await createCurrentTermixIdentityRepository().deleteByUserId(userId);
await createCurrentOpenTabRepository().deleteByUserId(userId);
diff --git a/src/backend/database/routes/host-compat-routes.ts b/src/backend/database/routes/host-compat-routes.ts
index dfc808f04..e660c20fd 100644
--- a/src/backend/database/routes/host-compat-routes.ts
+++ b/src/backend/database/routes/host-compat-routes.ts
@@ -1,6 +1,7 @@
/**
- * The 2.8 URLs under /host that something outside Termix still depends on:
- * the OPKSSH and Step CA redirect URIs registered with identity providers.
+ * The 2.8 auth callback URLs something outside Termix still depends on: the
+ * OPKSSH and Step CA redirect URIs registered with identity providers, and
+ * the Vault one listed in Vault OIDC roles.
* Each forwards to the plugin route that replaced it, so with the plugin off
* it signs nobody in.
*/
@@ -50,3 +51,21 @@ export function registerHostAuthCompatRoutes(router: Router): void {
res.redirect(307, localUrl(req, "/plugin-api/step-ca/callback"));
});
}
+
+export function registerVaultCompatRoutes(router: Router): void {
+ /**
+ * @openapi
+ * /vault/oidc/callback:
+ * get:
+ * summary: Vault OIDC callback (2.8 URL)
+ * description: The redirect URI Vault OIDC roles allowed before 2.9. Redirects to /plugin-api/vault/oidc/callback with the same query, so existing Vault roles keep working.
+ * tags:
+ * - Vault
+ * responses:
+ * 307:
+ * description: Redirect to the vault plugin's callback.
+ */
+ router.get("/oidc/callback", (req, res) => {
+ res.redirect(307, localUrl(req, "/plugin-api/vault/oidc/callback"));
+ });
+}
diff --git a/src/backend/database/routes/host-normalizers.ts b/src/backend/database/routes/host-normalizers.ts
index b5168a9a8..2a064de61 100644
--- a/src/backend/database/routes/host-normalizers.ts
+++ b/src/backend/database/routes/host-normalizers.ts
@@ -42,7 +42,6 @@ export const OWNER_PRIVATE_AUTH_FIELDS = {
"authType",
"authMethod",
"credentialId",
- "vaultProfileId",
"overrideCredentialUsername",
"shareSshAuth",
"password",
diff --git a/src/backend/database/routes/host.ts b/src/backend/database/routes/host.ts
index a8c32ab4f..df10e3eb7 100644
--- a/src/backend/database/routes/host.ts
+++ b/src/backend/database/routes/host.ts
@@ -183,7 +183,6 @@ router.post(
authType,
shareSshAuth,
credentialId,
- vaultProfileId,
key,
keyPassword,
keyType,
@@ -305,8 +304,6 @@ router.post(
authType: effectiveAuthType,
shareSshAuth: shareSshAuth === true ? 1 : 0,
credentialId: credentialId || null,
- vaultProfileId:
- effectiveAuthType === "vault" ? vaultProfileId || null : null,
overrideCredentialUsername: overrideCredentialUsername ? 1 : 0,
pin: pin ? 1 : 0,
enableTerminal: enableTerminal ? 1 : 0,
@@ -858,7 +855,6 @@ router.put(
authType,
shareSshAuth,
credentialId,
- vaultProfileId,
key,
keyPassword,
keyType,
@@ -981,8 +977,6 @@ router.put(
authType: effectiveAuthType,
shareSshAuth: shareSshAuth === true ? 1 : 0,
credentialId: credentialId || null,
- vaultProfileId:
- effectiveAuthType === "vault" ? vaultProfileId || null : null,
overrideCredentialUsername: overrideCredentialUsername ? 1 : 0,
pin: pin ? 1 : 0,
enableTerminal: enableTerminal ? 1 : 0,
diff --git a/src/backend/database/routes/sync-entities.ts b/src/backend/database/routes/sync-entities.ts
index f452f6fd8..5a5f9d947 100644
--- a/src/backend/database/routes/sync-entities.ts
+++ b/src/backend/database/routes/sync-entities.ts
@@ -15,7 +15,6 @@ import {
hosts,
sshCredentials,
sshFolders,
- vaultProfiles,
userPreferences,
} from "../db/schema.js";
import {
@@ -47,11 +46,6 @@ const HOST_REFERENCES = [
syncField: "telnetCredentialSyncId",
entityType: "sshCredentials",
},
- {
- field: "vaultProfileId",
- syncField: "vaultProfileSyncId",
- entityType: "vaultProfiles",
- },
{
field: "parentHostId",
syncField: "parentHostSyncId",
@@ -78,11 +72,8 @@ export function registerCoreSyncEntities(): void {
order: 10,
});
- registerEntity(CORE_OWNER, {
- type: "vaultProfiles",
- table: vaultProfiles,
- order: 20,
- });
+ // vaultProfiles (order 20) moved to the vault plugin. Hosts no longer
+ // reference it: a host's profile is the plugin's profileId host setting.
registerEntity(CORE_OWNER, {
type: "sshFolders",
diff --git a/src/backend/database/routes/sync-references.ts b/src/backend/database/routes/sync-references.ts
index 843298c1e..b09f51a38 100644
--- a/src/backend/database/routes/sync-references.ts
+++ b/src/backend/database/routes/sync-references.ts
@@ -7,8 +7,7 @@ import { getEntity } from "../../plugins/sync-registry.js";
* A plain string rather than a union: the set is whatever is registered, and a
* plugin can both register an entity and reference one. sync.ts resolves the
* name through the registry, so an unknown one is an error there rather than a
- * silent fallthrough - which is what the old three-way if/else did, routing
- * anything that was not hosts or sshCredentials to vaultProfiles.
+ * silent fallthrough.
*/
export type SyncReferenceEntity = string;
diff --git a/src/backend/database/routes/vault.ts b/src/backend/database/routes/vault.ts
deleted file mode 100644
index 55e915c51..000000000
--- a/src/backend/database/routes/vault.ts
+++ /dev/null
@@ -1,448 +0,0 @@
-import express, { type Request, type Response } from "express";
-import {
- createCurrentVaultProfileRepository,
- createCurrentUserRepository,
- createCurrentSyncTombstoneRepository,
-} from "../repositories/factory.js";
-import type { VaultProfileUpdateInput } from "../repositories/vault-profile-repository.js";
-import type { AuthenticatedRequest } from "../../../types/index.js";
-import { authLogger } from "../../utils/logger.js";
-import { AuthManager } from "../../utils/auth-manager.js";
-import { completeVaultAuth } from "../../hosts/vault-oidc-auth.js";
-
-const router = express.Router();
-
-const authManager = AuthManager.getInstance();
-const authenticateJWT = authManager.createAuthMiddleware();
-
-function isNonEmptyString(val: unknown): val is string {
- return typeof val === "string" && val.trim().length > 0;
-}
-
-async function userIsAdmin(userId: string): Promise {
- try {
- const user = await createCurrentUserRepository().findById(userId);
- return !!user?.isAdmin;
- } catch {
- return false;
- }
-}
-
-function formatProfile(
- row: Record,
- currentUserId: string,
-): Record {
- return {
- id: row.id,
- name: row.name,
- description: row.description,
- folder: row.folder,
- tags:
- typeof row.tags === "string"
- ? row.tags
- ? (row.tags as string).split(",").filter(Boolean)
- : []
- : [],
- vaultAddr: row.vaultAddr,
- vaultNamespace: row.vaultNamespace,
- oidcMount: row.oidcMount,
- oidcRole: row.oidcRole,
- sshMount: row.sshMount,
- sshRole: row.sshRole,
- validPrincipals: row.validPrincipals,
- keyType: row.keyType,
- shared: !!row.shared,
- owned: row.userId === currentUserId,
- createdAt: row.createdAt,
- updatedAt: row.updatedAt,
- };
-}
-
-/**
- * @openapi
- * /vault/oidc/callback:
- * get:
- * summary: Vault OIDC callback
- * description: Unauthenticated endpoint the IdP redirects to after login. Correlates the authorization code to a pending session via the Vault-issued state parameter.
- * tags:
- * - Vault
- * parameters:
- * - in: query
- * name: state
- * required: true
- * schema:
- * type: string
- * - in: query
- * name: code
- * required: true
- * schema:
- * type: string
- * - in: query
- * name: error
- * schema:
- * type: string
- * responses:
- * 200:
- * description: HTML page confirming sign-in success or failure.
- * 400:
- * description: Missing parameters or authentication failure.
- */
-router.get("/oidc/callback", async (req: Request, res: Response) => {
- const state = String(req.query.state || "");
- const code = String(req.query.code || "");
- const oidcError = req.query.error ? String(req.query.error) : "";
-
- const esc = (value: string): string =>
- value
- .replace(/&/g, "&")
- .replace(//g, ">")
- .replace(/"/g, """)
- .replace(/'/g, "'");
-
- const html = (title: string, message: string) =>
- `${esc(title)}
-
-${esc(title)}
${esc(message)}
-
)}
- {authMethod === "vault" && (
-
- )}
- {authMethod === "vault" && showVaultManager && (
-
setShowVaultManager(false)}
- />
- )}
{authMethod === "credential" && (
<>
diff --git a/src/ui/sidebar/HostEditorData.ts b/src/ui/sidebar/HostEditorData.ts
index 147050a5e..ad9cf9d03 100644
--- a/src/ui/sidebar/HostEditorData.ts
+++ b/src/ui/sidebar/HostEditorData.ts
@@ -134,7 +134,6 @@ export function createHostEditorForm(
: d?.credentialId != null
? String(d.credentialId)
: "",
- vaultProfileId: host?.vaultProfileId ?? "",
overrideCredentialUsername: host?.overrideCredentialUsername ?? false,
folder: host?.folder ?? "",
parentHostId: host?.parentHostId ?? "",
@@ -294,7 +293,6 @@ export function omitOwnerSshAuthFromSharedEdit(
keyType: _keyType,
sudoPassword: _sudoPassword,
credentialId: _credentialId,
- vaultProfileId: _vaultProfileId,
overrideCredentialUsername: _overrideCredentialUsername,
shareSshAuth: _shareSshAuth,
...editableFields
@@ -325,7 +323,6 @@ export function buildHostEditorPayload(
const usesKey = form.authType === "key";
const usesPassword = form.authType === "password";
const usesAgent = form.authType === "agent";
- const usesVault = form.authType === "vault";
// With SSH off, the host's primary protocol is the first plugin protocol
// switched on, and its port stands in for the host port.
const primaryProtocol = protocols.enableSsh
@@ -410,8 +407,6 @@ export function buildHostEditorPayload(
keyType: usesKey && form.keyType !== "auto" ? form.keyType : null,
credentialId:
usesCredential && form.credentialId ? Number(form.credentialId) : null,
- vaultProfileId:
- usesVault && form.vaultProfileId ? Number(form.vaultProfileId) : null,
overrideCredentialUsername: form.overrideCredentialUsername,
notes: form.notes,
enableTerminal: form.enableTerminal,
diff --git a/src/ui/sidebar/HostManagerData.ts b/src/ui/sidebar/HostManagerData.ts
index aed5b8a24..d0fd96de7 100644
--- a/src/ui/sidebar/HostManagerData.ts
+++ b/src/ui/sidebar/HostManagerData.ts
@@ -78,10 +78,6 @@ export function sshHostToHost(h: SSHHostWithStatus): Host {
keyPassword: h.keyPassword,
keyType: h.keyType,
credentialId: h.credentialId != null ? String(h.credentialId) : undefined,
- vaultProfileId:
- (h as { vaultProfileId?: number | string | null }).vaultProfileId != null
- ? String((h as { vaultProfileId?: number | string }).vaultProfileId)
- : undefined,
notes: h.notes,
pin: h.pin ?? false,
sortOrder: h.sortOrder ?? null,
diff --git a/src/ui/tests/sidebar/HostEditorData.test.ts b/src/ui/tests/sidebar/HostEditorData.test.ts
index 8eb3ccfa8..eec0c2c53 100644
--- a/src/ui/tests/sidebar/HostEditorData.test.ts
+++ b/src/ui/tests/sidebar/HostEditorData.test.ts
@@ -50,7 +50,6 @@ describe("omitOwnerSshAuthFromSharedEdit", () => {
key: "owner-key",
keyPassword: "owner-passphrase",
keyType: "ssh-ed25519",
- vaultProfileId: "9",
overrideCredentialUsername: true,
shareSshAuth: true,
sudoPassword: "owner-sudo",
@@ -70,7 +69,6 @@ describe("omitOwnerSshAuthFromSharedEdit", () => {
for (const field of [
"authType",
"credentialId",
- "vaultProfileId",
"overrideCredentialUsername",
"shareSshAuth",
"password",
@@ -128,32 +126,6 @@ describe("buildHostEditorPayload auth field isolation", () => {
expect(payload.password).toBe("newpass");
});
- it("drops the vaultProfileId when switching a host away from vault auth", () => {
- const form = {
- ...createHostEditorForm(null),
- authType: "password" as const,
- password: "newpass",
- vaultProfileId: "9",
- };
-
- const payload = buildHostEditorPayload(form, sshOnly);
-
- expect(payload.vaultProfileId).toBeNull();
- expect(payload.password).toBe("newpass");
- });
-
- it("sends vaultProfileId when authType is vault", () => {
- const form = {
- ...createHostEditorForm(null),
- authType: "vault" as const,
- vaultProfileId: "9",
- };
-
- const payload = buildHostEditorPayload(form, sshOnly);
-
- expect(payload.vaultProfileId).toBe(9);
- });
-
it("sends credentialId and optional password when authType is credential", () => {
const form = {
...createHostEditorForm(null),