Implement Vault secret cache system

New scripts: - vault-cache.sh: Main cache manager (sync/get/list/status/invalidate) - vault-env.sh: Sourceable environment with quick accessor functions - vault-api-cached.sh: Drop-in replacement for vault_api.sh using cache - nocodb-api.sh: NocoDB API wrapper using cached token - qdrant-api.sh: Qdrant API wrapper using cached key - README-vault-cache.md: Documentation Updated scripts: - vault_grist_api.sh: Now uses vault cache - checks/check-memory-table.sh: Uses vault cache - utils/get-columns.sh: Uses vault cache - utils/update-type-col.sh: Uses vault cache Features: - 29 secrets cached from Vault (6 categories) - Auto-refresh on stale entries (1hr TTL) - Vault token cached for 24h - Restricted permissions (700/600) on cache files - Fallback to direct Vault API if cache miss
2026-07-19 08:57:13 -07:00
parent 9891d7e4d5
commit 6d2105d206
11 changed files with 1016 additions and 82 deletions
@@ -0,0 +1,135 @@
+#!/bin/bash
+# vault-api-cached.sh - Drop-in replacement for vault_api.sh using local cache
+#
+# PURPOSE: Provides the same interface as vault_api.sh but uses local vault cache
+# instead of querying Vault directly every time.
+#
+# USAGE: Same as vault_api.sh:
+#   vault-api-cached.sh GET "https://grist.beawit.net" "/api/..." "api/business/grist" "Bearer"
+#
+# DIFFERENCES FROM vault_api.sh:
+# - Uses ~/.cache/vault/ instead of ~/.openclaw/workspace/.tokens/
+# - Falls back to vault_api.sh if cache is stale/missing
+# - Supports all the same header types
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+VAULT_CACHE_SCRIPT="${SCRIPT_DIR}/vault-cache.sh"
+VAULT_API_SCRIPT="${SCRIPT_DIR}/vault_api.sh"
+
+METHOD="$1"
+BASE_URL="$2"
+API_PATH="$3"
+# Strip trailing newlines from VAULT_KEY (can happen with Telegram input)
+VAULT_KEY="$(echo -n "$4")"
+HEADER_TYPE="${5:-Bearer}"
+PAYLOAD_FILE="$6"
+
+if [ -z "$METHOD" ] || [ -z "$BASE_URL" ] || [ -z "$API_PATH" ] || [ -z "$VAULT_KEY" ]; then
+    echo "Usage: bash vault-api-cached.sh <METHOD> <BASE_URL> <API_PATH> <VAULT_KEY> [header_type] [payload_file]"
+    echo ""
+    echo "This script uses local vault cache for faster access."
+    echo "Run './vault-cache.sh sync' to refresh cache."
+    exit 1
+fi
+
+# Try to get token from cache first
+get_cached_token() {
+    local vault_key="$1"
+
+    if [ ! -x "$VAULT_CACHE_SCRIPT" ]; then
+        return 1
+    fi
+
+    # Try common field names: token, api_key, api-key, password
+    local token
+    token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" token 2>/dev/null)
+    [ -n "$token" ] && { echo "$token"; return 0; }
+
+    token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" api_key 2>/dev/null)
+    [ -n "$token" ] && { echo "$token"; return 0; }
+
+    token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" api-key 2>/dev/null)
+    [ -n "$token" ] && { echo "$token"; return 0; }
+
+    token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" password 2>/dev/null)
+    [ -n "$token" ] && { echo "$token"; return 0; }
+
+    return 1
+}
+
+# Build auth header based on type
+build_auth_header() {
+    local header_type="$1"
+    local token="$2"
+
+    case "$header_type" in
+        "xc-token")
+            echo "xc-token: $token"
+            ;;
+        "api-key"|"API-Key")
+            echo "API-Key: $token"
+            ;;
+        "X-Api-Key"|"x-api-key")
+            echo "X-Api-Key: $token"
+            ;;
+        "X-Vault-Token"|"vault")
+            echo "X-Vault-Token: $token"
+            ;;
+        "Bearer"|*)
+            echo "Authorization: Bearer $token"
+            ;;
+    esac
+}
+
+# Get service token (try cache first, fall back to vault_api.sh)
+SERVICE_TOKEN=$(get_cached_token "$VAULT_KEY")
+
+if [ -z "$SERVICE_TOKEN" ]; then
+    echo "Cache miss for $VAULT_KEY, falling back to vault_api.sh..." >&2
+    # Fall back to original vault_api.sh
+    if [ -x "$VAULT_API_SCRIPT" ]; then
+        "$VAULT_API_SCRIPT" "$@"
+        exit $?
+    else
+        echo "Error: Neither cache nor vault_api.sh available" >&2
+        exit 1
+    fi
+fi
+
+AUTH_HEADER=$(build_auth_header "$HEADER_TYPE" "$SERVICE_TOKEN")
+URL="${BASE_URL}${API_PATH}"
+RESPONSE_FILE="/tmp/vault_api_cached_$$.json"
+
+# Execute API call
+curl_opts="-sk"
+if [ "$METHOD" = "GET" ]; then
+    curl $curl_opts \
+      -H "$AUTH_HEADER" \
+      -H "Content-Type: application/json" \
+      -o "$RESPONSE_FILE" \
+      "$URL"
+elif [ "$METHOD" = "PATCH" ] && [ -n "$PAYLOAD_FILE" ]; then
+    curl $curl_opts \
+      -H "$AUTH_HEADER" \
+      -H "Content-Type: application/json" \
+      -X PATCH \
+      -d "@$PAYLOAD_FILE" \
+      -o "$RESPONSE_FILE" \
+      "$URL"
+elif [ "$METHOD" = "POST" ] && [ -n "$PAYLOAD_FILE" ]; then
+    curl $curl_opts \
+      -H "$AUTH_HEADER" \
+      -H "Content-Type: application/json" \
+      -X POST \
+      -d "@$PAYLOAD_FILE" \
+      -o "$RESPONSE_FILE" \
+      "$URL"
+else
+    echo "Error: Unsupported method or missing payload file"
+    rm -f "$RESPONSE_FILE"
+    exit 1
+fi
+
+# Output response
+cat "$RESPONSE_FILE"
+rm -f "$RESPONSE_FILE"