token-capabilities-api

hashicorp/vault#1171 and hashicorp/vault#1188

src/VaultSharp/IVaultClient.cs

@@ -331,6 +331,35 @@ public interface IVaultClient
         /// </returns>
         Task DeletePolicyAsync(string policyName);
 
+        /// <summary>
+        /// Gets the capabilities of the token on the given path.
+        /// </summary>
+        /// <param name="token"><para>[required]</para>
+        /// Token for which capabilities are being queried.</param>
+        /// <param name="path"><para>[required]</para>
+        /// Path on which the token's capabilities will be checked.</param>
+        /// <returns>The list of capabilities.</returns>
+        Task<IEnumerable<string>> GetTokenCapabilitiesAsync(string token, string path);
+
+        /// <summary>
+        /// Gets the capabilities of client token on the given path. 
+        /// Client token is the Vault token with which this API call is made.
+        /// </summary>
+        /// <param name="path"><para>[required]</para>
+        /// Path on which the token's capabilities will be checked.</param>
+        /// <returns>The list of capabilities.</returns>
+        Task<IEnumerable<string>> GetCallingTokenCapabilitiesAsync(string path);
+
+        /// <summary>
+        /// Gets the capabilities of the token associated with an accessor, on the given path.
+        /// </summary>
+        /// <param name="tokenAccessor"><para>[required]</para>
+        /// Token accessor for which capabilities are being queried.</param>
+        /// <param name="path"><para>[required]</para>
+        /// Path on which the token's capabilities will be checked.</param>
+        /// <returns>The list of capabilities.</returns>
+        Task<IEnumerable<string>> GetTokenAccessorCapabilitiesAsync(string tokenAccessor, string path);
+
         /// <summary>
         /// Gets all the enabled audit backends.
         /// </summary>

src/VaultSharp/VaultClient.cs

@@ -326,6 +326,53 @@ public async Task DeletePolicyAsync(string policyName)
             await MakeVaultApiRequest("sys/policy/" + policyName, HttpMethod.Delete).ConfigureAwait(continueOnCapturedContext: _continueAsyncTasksOnCapturedContext);
         }
 
+        public async Task<IEnumerable<string>> GetTokenCapabilitiesAsync(string token, string path)
+        {
+            Checker.NotNull(token, "token");
+            Checker.NotNull(path, "path");
+
+            var requestData = new {token = token, path = path};
+            var response = await MakeVaultApiRequest<dynamic>("sys/capabilities", HttpMethod.Post, requestData).ConfigureAwait(continueOnCapturedContext: _continueAsyncTasksOnCapturedContext);
+
+            if (response != null && response.capabilities != null)
+            {
+                return response.capabilities.ToObject<List<string>>();
+            }
+
+            return Enumerable.Empty<string>();
+        }
+
+        public async Task<IEnumerable<string>> GetCallingTokenCapabilitiesAsync(string path)
+        {
+            Checker.NotNull(path, "path");
+
+            var requestData = new { path = path };
+            var response = await MakeVaultApiRequest<dynamic>("sys/capabilities-self", HttpMethod.Post, requestData).ConfigureAwait(continueOnCapturedContext: _continueAsyncTasksOnCapturedContext);
+
+            if (response != null && response.capabilities != null)
+            {
+                return response.capabilities.ToObject<List<string>>();
+            }
+
+            return Enumerable.Empty<string>();
+        }
+
+        public async Task<IEnumerable<string>> GetTokenAccessorCapabilitiesAsync(string tokenAccessor, string path)
+        {
+            Checker.NotNull(tokenAccessor, "tokenAccessor");
+            Checker.NotNull(path, "path");
+
+            var requestData = new { accessor = tokenAccessor, path = path };
+            var response = await MakeVaultApiRequest<dynamic>("sys/capabilities-accessor", HttpMethod.Post, requestData).ConfigureAwait(continueOnCapturedContext: _continueAsyncTasksOnCapturedContext);
+
+            if (response != null && response.capabilities != null)
+            {
+                return response.capabilities.ToObject<List<string>>();
+            }
+
+            return Enumerable.Empty<string>();
+        }
+
         public async Task<IEnumerable<AuditBackend>> GetAllEnabledAuditBackendsAsync()
         {
             var response = await MakeVaultApiRequest<Dictionary<string, AuditBackend>>("sys/audit", HttpMethod.Get).ConfigureAwait(continueOnCapturedContext: _continueAsyncTasksOnCapturedContext);

test/VaultSharp.UnitTests/End2End/VaultClientEnd2EndTests.cs

@@ -44,15 +44,15 @@ public async Task AllTests()
                 // await GithubAuthenticationProviderTests();
             }
 
-            await _authenticatedClient.StepDownActiveNodeAsync();
+            await TokenTests();
+            // await _authenticatedClient.StepDownActiveNodeAsync();
 
             await EncryptStrongTests();
             await MountedSecretBackendTests();
             await MountedAuthenticationBackendTests();
             await PoliciesTests();
             await AuditBackendsTests();
             await SecretTests();
-            await TokenTests();
             await EncryptTests();
             await AppIdAuthenticationProviderTests();
             await UsernamePasswordAuthenticationProviderTests();
@@ -658,6 +658,14 @@ private async Task TokenTests()
             var secret1 = await _authenticatedClient.CreateTokenAsync();
             Assert.NotNull(secret1);
 
+            // capabilities.
+            var caps =
+                await _authenticatedClient.GetTokenCapabilitiesAsync(secret1.AuthorizationInfo.ClientToken, "sys");
+            Assert.NotNull(caps);
+
+            var caps2 = await _authenticatedClient.GetCallingTokenCapabilitiesAsync("sys");
+            Assert.NotNull(caps2);
+
             var secret2 = await _authenticatedClient.CreateTokenAsync(new TokenCreationOptions { NoParent = true });
             Assert.NotNull(secret2);