JC Beasley
6d2105d206
New scripts: - vault-cache.sh: Main cache manager (sync/get/list/status/invalidate) - vault-env.sh: Sourceable environment with quick accessor functions - vault-api-cached.sh: Drop-in replacement for vault_api.sh using cache - nocodb-api.sh: NocoDB API wrapper using cached token - qdrant-api.sh: Qdrant API wrapper using cached key - README-vault-cache.md: Documentation Updated scripts: - vault_grist_api.sh: Now uses vault cache - checks/check-memory-table.sh: Uses vault cache - utils/get-columns.sh: Uses vault cache - utils/update-type-col.sh: Uses vault cache Features: - 29 secrets cached from Vault (6 categories) - Auto-refresh on stale entries (1hr TTL) - Vault token cached for 24h - Restricted permissions (700/600) on cache files - Fallback to direct Vault API if cache miss
136 lines
3.9 KiB
Bash
Executable File
136 lines
3.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# vault-api-cached.sh - Drop-in replacement for vault_api.sh using local cache
|
|
#
|
|
# PURPOSE: Provides the same interface as vault_api.sh but uses local vault cache
|
|
# instead of querying Vault directly every time.
|
|
#
|
|
# USAGE: Same as vault_api.sh:
|
|
# vault-api-cached.sh GET "https://grist.beawit.net" "/api/..." "api/business/grist" "Bearer"
|
|
#
|
|
# DIFFERENCES FROM vault_api.sh:
|
|
# - Uses ~/.cache/vault/ instead of ~/.openclaw/workspace/.tokens/
|
|
# - Falls back to vault_api.sh if cache is stale/missing
|
|
# - Supports all the same header types
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
VAULT_CACHE_SCRIPT="${SCRIPT_DIR}/vault-cache.sh"
|
|
VAULT_API_SCRIPT="${SCRIPT_DIR}/vault_api.sh"
|
|
|
|
METHOD="$1"
|
|
BASE_URL="$2"
|
|
API_PATH="$3"
|
|
# Strip trailing newlines from VAULT_KEY (can happen with Telegram input)
|
|
VAULT_KEY="$(echo -n "$4")"
|
|
HEADER_TYPE="${5:-Bearer}"
|
|
PAYLOAD_FILE="$6"
|
|
|
|
if [ -z "$METHOD" ] || [ -z "$BASE_URL" ] || [ -z "$API_PATH" ] || [ -z "$VAULT_KEY" ]; then
|
|
echo "Usage: bash vault-api-cached.sh <METHOD> <BASE_URL> <API_PATH> <VAULT_KEY> [header_type] [payload_file]"
|
|
echo ""
|
|
echo "This script uses local vault cache for faster access."
|
|
echo "Run './vault-cache.sh sync' to refresh cache."
|
|
exit 1
|
|
fi
|
|
|
|
# Try to get token from cache first
|
|
get_cached_token() {
|
|
local vault_key="$1"
|
|
|
|
if [ ! -x "$VAULT_CACHE_SCRIPT" ]; then
|
|
return 1
|
|
fi
|
|
|
|
# Try common field names: token, api_key, api-key, password
|
|
local token
|
|
token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" token 2>/dev/null)
|
|
[ -n "$token" ] && { echo "$token"; return 0; }
|
|
|
|
token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" api_key 2>/dev/null)
|
|
[ -n "$token" ] && { echo "$token"; return 0; }
|
|
|
|
token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" api-key 2>/dev/null)
|
|
[ -n "$token" ] && { echo "$token"; return 0; }
|
|
|
|
token=$("$VAULT_CACHE_SCRIPT" get "$vault_key" password 2>/dev/null)
|
|
[ -n "$token" ] && { echo "$token"; return 0; }
|
|
|
|
return 1
|
|
}
|
|
|
|
# Build auth header based on type
|
|
build_auth_header() {
|
|
local header_type="$1"
|
|
local token="$2"
|
|
|
|
case "$header_type" in
|
|
"xc-token")
|
|
echo "xc-token: $token"
|
|
;;
|
|
"api-key"|"API-Key")
|
|
echo "API-Key: $token"
|
|
;;
|
|
"X-Api-Key"|"x-api-key")
|
|
echo "X-Api-Key: $token"
|
|
;;
|
|
"X-Vault-Token"|"vault")
|
|
echo "X-Vault-Token: $token"
|
|
;;
|
|
"Bearer"|*)
|
|
echo "Authorization: Bearer $token"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
# Get service token (try cache first, fall back to vault_api.sh)
|
|
SERVICE_TOKEN=$(get_cached_token "$VAULT_KEY")
|
|
|
|
if [ -z "$SERVICE_TOKEN" ]; then
|
|
echo "Cache miss for $VAULT_KEY, falling back to vault_api.sh..." >&2
|
|
# Fall back to original vault_api.sh
|
|
if [ -x "$VAULT_API_SCRIPT" ]; then
|
|
"$VAULT_API_SCRIPT" "$@"
|
|
exit $?
|
|
else
|
|
echo "Error: Neither cache nor vault_api.sh available" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
AUTH_HEADER=$(build_auth_header "$HEADER_TYPE" "$SERVICE_TOKEN")
|
|
URL="${BASE_URL}${API_PATH}"
|
|
RESPONSE_FILE="/tmp/vault_api_cached_$$.json"
|
|
|
|
# Execute API call
|
|
curl_opts="-sk"
|
|
if [ "$METHOD" = "GET" ]; then
|
|
curl $curl_opts \
|
|
-H "$AUTH_HEADER" \
|
|
-H "Content-Type: application/json" \
|
|
-o "$RESPONSE_FILE" \
|
|
"$URL"
|
|
elif [ "$METHOD" = "PATCH" ] && [ -n "$PAYLOAD_FILE" ]; then
|
|
curl $curl_opts \
|
|
-H "$AUTH_HEADER" \
|
|
-H "Content-Type: application/json" \
|
|
-X PATCH \
|
|
-d "@$PAYLOAD_FILE" \
|
|
-o "$RESPONSE_FILE" \
|
|
"$URL"
|
|
elif [ "$METHOD" = "POST" ] && [ -n "$PAYLOAD_FILE" ]; then
|
|
curl $curl_opts \
|
|
-H "$AUTH_HEADER" \
|
|
-H "Content-Type: application/json" \
|
|
-X POST \
|
|
-d "@$PAYLOAD_FILE" \
|
|
-o "$RESPONSE_FILE" \
|
|
"$URL"
|
|
else
|
|
echo "Error: Unsupported method or missing payload file"
|
|
rm -f "$RESPONSE_FILE"
|
|
exit 1
|
|
fi
|
|
|
|
# Output response
|
|
cat "$RESPONSE_FILE"
|
|
rm -f "$RESPONSE_FILE"
|