mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-16 03:27:01 +02:00
188bdca4bd
* Fix sudo paths missing from OpenAPI and docs Various sudo (a.k.a. root-protected) paths are implemented in non-standard ways, and as a result: * are not declared as x-vault-sudo in the OpenAPI spec * and as a result of that, are not included in the hardcoded patterns powering the Vault CLI `-output-policy` flag * and in some cases are missing from the table of all sudo paths in the docs too Fix these problems by: * Adding `seal` and `step-down` to the list of root paths for the system backend. They don't need to be there for enforcement, as those two special endpoints bypass the standard request handling code, but they do need to be there for the OpenAPI generator to be able to know they require sudo. The way in which those two endpoints do things differently can be observed in the code search results for `RootPrivsRequired`: https://github.com/search?q=repo%3Ahashicorp%2Fvault%20RootPrivsRequired&type=code * Fix the implementation of `auth/token/revoke-orphan` to implement endpoint sudo requirements in the standard way. Currently, it has an **incorrect** path declared in the special paths metadata, and then compensates with custom code throwing an error within the request handler function itself. * changelog * As discussed in PR, delete test which is just testing equality of a constant * Restore sudo check as requested, and add comment * Update vault/token_store.go Co-authored-by: Anton Averchenkov <84287187+averche@users.noreply.github.com> --------- Co-authored-by: Anton Averchenkov <84287187+averche@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| client-count | ||
| integrated-storage | ||
| auth.mdx | ||
| dev-server.mdx | ||
| duration-format.mdx | ||
| events.mdx | ||
| ha.mdx | ||
| identity.mdx | ||
| index.mdx | ||
| lease.mdx | ||
| mount-migration.mdx | ||
| namespace-api-lock.mdx | ||
| oidc-provider.mdx | ||
| password-policies.mdx | ||
| pgp-gpg-keybase.mdx | ||
| policies.mdx | ||
| recovery-mode.mdx | ||
| resource-quotas.mdx | ||
| response-wrapping.mdx | ||
| seal.mdx | ||
| storage.mdx | ||
| tokens.mdx | ||
| transform.mdx | ||
| user-lockout.mdx | ||
| username-templating.mdx | ||