From 9b850824fbdf367dffb9a8439a0b65b27291da25 Mon Sep 17 00:00:00 2001
From: Ryan Levick <ryan.levick@fermyon.com>
Date: Mon, 29 Jul 2024 15:12:25 +0200
Subject: [PATCH] Add vault variable provider

Signed-off-by: Ryan Levick <ryan.levick@fermyon.com>
---
 Cargo.lock                                    |  1 +
 crates/factor-variables/Cargo.toml            |  1 +
 crates/factor-variables/src/spin_cli/mod.rs   |  5 ++
 crates/factor-variables/src/spin_cli/vault.rs | 55 +++++++++++++++++++
 4 files changed, 62 insertions(+)
 create mode 100644 crates/factor-variables/src/spin_cli/vault.rs

diff --git a/Cargo.lock b/Cargo.lock
index d9769241d..496b7ad6c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7722,6 +7722,7 @@ dependencies = [
  "tokio",
  "toml 0.8.14",
  "tracing",
+ "vaultrs",
 ]
 
 [[package]]
diff --git a/crates/factor-variables/Cargo.toml b/crates/factor-variables/Cargo.toml
index ac7370d70..85f0687b1 100644
--- a/crates/factor-variables/Cargo.toml
+++ b/crates/factor-variables/Cargo.toml
@@ -13,6 +13,7 @@ spin-world = { path = "../world" }
 tokio = { version = "1", features = ["rt-multi-thread"] }
 toml = "0.8"
 tracing = { workspace = true }
+vaultrs = "0.6.2"
 
 [dev-dependencies]
 spin-factors-test = { path = "../factors-test" }
diff --git a/crates/factor-variables/src/spin_cli/mod.rs b/crates/factor-variables/src/spin_cli/mod.rs
index 2b6a48c48..49ea1261c 100644
--- a/crates/factor-variables/src/spin_cli/mod.rs
+++ b/crates/factor-variables/src/spin_cli/mod.rs
@@ -2,9 +2,11 @@
 
 mod env;
 mod statik;
+mod vault;
 
 pub use env::*;
 pub use statik::*;
+pub use vault::*;
 
 use serde::Deserialize;
 use spin_expressions::Provider;
@@ -35,6 +37,8 @@ pub fn runtime_config_from_toml(table: &toml::Table) -> anyhow::Result<RuntimeCo
 pub enum VariableProviderConfiguration {
     /// A static provider of variables.
     Static(StaticVariablesProvider),
+    /// A provider that uses HashiCorp Vault.
+    Vault(VaultVariablesProvider),
     /// An environment variable provider.
     Env(EnvVariablesConfig),
 }
@@ -49,6 +53,7 @@ impl VariableProviderConfiguration {
                 |s| std::env::var(s),
                 config.dotenv_path,
             )),
+            VariableProviderConfiguration::Vault(provider) => Box::new(provider),
         }
     }
 }
diff --git a/crates/factor-variables/src/spin_cli/vault.rs b/crates/factor-variables/src/spin_cli/vault.rs
new file mode 100644
index 000000000..9008ce3c5
--- /dev/null
+++ b/crates/factor-variables/src/spin_cli/vault.rs
@@ -0,0 +1,55 @@
+use serde::{Deserialize, Serialize};
+use spin_expressions::async_trait::async_trait;
+use spin_factors::anyhow::{self, Context as _};
+use tracing::{instrument, Level};
+use vaultrs::{
+    client::{VaultClient, VaultClientSettingsBuilder},
+    error::ClientError,
+    kv2,
+};
+
+use spin_expressions::{Key, Provider};
+
+#[derive(Debug, Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+/// A config Provider that uses HashiCorp Vault.
+pub struct VaultVariablesProvider {
+    /// The URL of the Vault server.
+    url: String,
+    /// The token to authenticate with.
+    token: String,
+    /// The mount point of the KV engine.
+    mount: String,
+    /// The optional prefix to use for all keys.
+    #[serde(default)]
+    prefix: Option<String>,
+}
+
+#[async_trait]
+impl Provider for VaultVariablesProvider {
+    #[instrument(name = "spin_variables.get_from_vault", skip(self), err(level = Level::INFO), fields(otel.kind = "client"))]
+    async fn get(&self, key: &Key) -> anyhow::Result<Option<String>> {
+        let client = VaultClient::new(
+            VaultClientSettingsBuilder::default()
+                .address(&self.url)
+                .token(&self.token)
+                .build()?,
+        )?;
+        let path = match &self.prefix {
+            Some(prefix) => format!("{}/{}", prefix, key.as_str()),
+            None => key.as_str().to_string(),
+        };
+
+        #[derive(Deserialize, Serialize)]
+        struct Secret {
+            value: String,
+        }
+        match kv2::read::<Secret>(&client, &self.mount, &path).await {
+            Ok(secret) => Ok(Some(secret.value)),
+            // Vault doesn't have this entry so pass along the chain
+            Err(ClientError::APIError { code: 404, .. }) => Ok(None),
+            // Other Vault error so bail rather than looking elsewhere
+            Err(e) => Err(e).context("Failed to check Vault for config"),
+        }
+    }
+}