purple_ssh/
vault_ssh.rs

1use anyhow::{Context, Result};
2use log::{debug, error, info};
3use std::path::{Path, PathBuf};
4use std::process::Command;
5
6/// Result of a certificate signing operation.
7#[derive(Debug)]
8pub struct SignResult {
9    pub cert_path: PathBuf,
10}
11
12/// Certificate validity status.
13#[derive(Debug, Clone, PartialEq)]
14pub enum CertStatus {
15    Valid {
16        expires_at: i64,
17        remaining_secs: i64,
18        /// Total certificate validity window in seconds (to - from), used by
19        /// the UI to compute proportional freshness thresholds.
20        total_secs: i64,
21    },
22    Expired,
23    Missing,
24    Invalid(String),
25}
26
27/// Minimum remaining seconds before a cert needs renewal (5 minutes).
28pub const RENEWAL_THRESHOLD_SECS: i64 = 300;
29
30/// TTL (in seconds) for the in-memory cert status cache before we re-run
31/// `ssh-keygen -L` against an on-disk certificate. Distinct from
32/// `RENEWAL_THRESHOLD_SECS`: this controls how often we *re-check* a cert's
33/// validity, while `RENEWAL_THRESHOLD_SECS` is the minimum lifetime below which
34/// we actually request a new signature from Vault.
35pub const CERT_STATUS_CACHE_TTL_SECS: u64 = 300;
36
37/// Shorter TTL for cached `CertStatus::Invalid` entries produced by check
38/// failures (e.g. unresolvable cert path). Error entries use this backoff
39/// instead of the 5-minute re-check TTL so transient errors recover quickly
40/// without hammering the background check thread on every poll tick.
41pub const CERT_ERROR_BACKOFF_SECS: u64 = 30;
42
43/// Validate a Vault SSH role path. Accepts ASCII alphanumerics plus `/`, `_` and `-`.
44/// Rejects empty strings and values longer than 128 chars.
45pub fn is_valid_role(s: &str) -> bool {
46    !s.is_empty()
47        && s.len() <= 128
48        && s.chars()
49            .all(|c| c.is_ascii_alphanumeric() || c == '/' || c == '_' || c == '-')
50}
51
52/// Validate a `VAULT_ADDR` value passed to the Vault CLI as an env var.
53///
54/// Intentionally minimal: reject empty, control characters and whitespace.
55/// We do NOT try to parse the URL here — a typo just produces a Vault CLI
56/// error, which is fine. The 512-byte ceiling prevents a pathological config
57/// line from ballooning the environment block.
58pub fn is_valid_vault_addr(s: &str) -> bool {
59    let trimmed = s.trim();
60    !trimmed.is_empty()
61        && trimmed.len() <= 512
62        && !trimmed.chars().any(|c| c.is_control() || c.is_whitespace())
63}
64
65/// Normalize a vault address so bare IPs and hostnames work.
66/// Prepends `https://` when no scheme is present and appends `:8200`
67/// (Vault's default port) when no port is specified. The default
68/// scheme is `https://` because production Vault always uses TLS.
69/// Dev-mode users can set `http://` explicitly.
70pub fn normalize_vault_addr(s: &str) -> String {
71    let trimmed = s.trim();
72    // Case-insensitive scheme detection.
73    let lower = trimmed.to_ascii_lowercase();
74    let (with_scheme, scheme_len) = if lower.starts_with("http://") || lower.starts_with("https://")
75    {
76        let len = if lower.starts_with("https://") { 8 } else { 7 };
77        (trimmed.to_string(), len)
78    } else if trimmed.contains("://") {
79        // Unknown scheme (ftp://, etc.) — return as-is, let the CLI error.
80        return trimmed.to_string();
81    } else {
82        (format!("https://{}", trimmed), 8)
83    };
84    // Extract the authority (host[:port]) portion, ignoring any path/query.
85    let after_scheme = &with_scheme[scheme_len..];
86    let authority = after_scheme.split('/').next().unwrap_or(after_scheme);
87    // IPv6 addresses use [::1]:port syntax. A colon inside brackets is not a
88    // port separator.
89    let has_port = if let Some(bracket_end) = authority.rfind(']') {
90        authority[bracket_end..].contains(':')
91    } else {
92        authority.contains(':')
93    };
94    if has_port {
95        with_scheme
96    } else {
97        // Insert :8200 after the authority, before any path.
98        let path_start = scheme_len + authority.len();
99        format!(
100            "{}:8200{}",
101            &with_scheme[..path_start],
102            &with_scheme[path_start..]
103        )
104    }
105}
106
107/// Scrub a raw Vault CLI stderr for display. Drops lines containing credential-like
108/// tokens (token, secret, x-vault-, cookie, authorization), joins the rest with spaces
109/// and truncates to 200 chars.
110pub fn scrub_vault_stderr(raw: &str) -> String {
111    let filtered: String = raw
112        .lines()
113        .filter(|line| {
114            let lower = line.to_ascii_lowercase();
115            !(lower.contains("token")
116                || lower.contains("secret")
117                || lower.contains("x-vault-")
118                || lower.contains("cookie")
119                || lower.contains("authorization"))
120        })
121        .collect::<Vec<_>>()
122        .join(" ");
123    let trimmed = filtered.trim();
124    if trimmed.is_empty() {
125        return "Vault SSH signing failed. Check vault status and policy".to_string();
126    }
127    if trimmed.chars().count() > 200 {
128        trimmed.chars().take(200).collect::<String>() + "..."
129    } else {
130        trimmed.to_string()
131    }
132}
133
134/// Return the certificate path for a given alias: ~/.purple/certs/<alias>-cert.pub
135pub fn cert_path_for(alias: &str) -> Result<PathBuf> {
136    anyhow::ensure!(
137        !alias.is_empty()
138            && !alias.contains('/')
139            && !alias.contains('\\')
140            && !alias.contains(':')
141            && !alias.contains('\0')
142            && !alias.contains(".."),
143        "Invalid alias for cert path: '{}'",
144        alias
145    );
146    let dir = dirs::home_dir()
147        .context("Could not determine home directory")?
148        .join(".purple/certs");
149    Ok(dir.join(format!("{}-cert.pub", alias)))
150}
151
152/// Resolve the actual certificate file path for a host.
153/// Priority: CertificateFile directive > purple's default cert path.
154pub fn resolve_cert_path(alias: &str, certificate_file: &str) -> Result<PathBuf> {
155    if !certificate_file.is_empty() {
156        let expanded = if let Some(rest) = certificate_file.strip_prefix("~/") {
157            if let Some(home) = dirs::home_dir() {
158                home.join(rest)
159            } else {
160                PathBuf::from(certificate_file)
161            }
162        } else {
163            PathBuf::from(certificate_file)
164        };
165        Ok(expanded)
166    } else {
167        cert_path_for(alias)
168    }
169}
170
171/// Sign an SSH public key via Vault SSH secrets engine.
172/// Runs: `vault write -field=signed_key <role> public_key=@<pubkey_path>`
173/// Writes the signed certificate to ~/.purple/certs/<alias>-cert.pub.
174///
175/// When `vault_addr` is `Some`, it is set as the `VAULT_ADDR` env var on the
176/// `vault` subprocess, overriding whatever the parent shell has configured.
177/// When `None`, the subprocess inherits the parent's env (current behavior).
178/// This lets purple users configure Vault address at the provider or host
179/// level without needing to launch purple from a pre-exported shell.
180pub fn sign_certificate(
181    role: &str,
182    pubkey_path: &Path,
183    alias: &str,
184    vault_addr: Option<&str>,
185) -> Result<SignResult> {
186    if !pubkey_path.exists() {
187        anyhow::bail!(
188            "Public key not found: {}. Set IdentityFile on the host or ensure ~/.ssh/id_ed25519.pub exists.",
189            pubkey_path.display()
190        );
191    }
192
193    if !is_valid_role(role) {
194        anyhow::bail!("Invalid Vault SSH role: '{}'", role);
195    }
196
197    let cert_dest = cert_path_for(alias)?;
198
199    if let Some(parent) = cert_dest.parent() {
200        std::fs::create_dir_all(parent)
201            .with_context(|| format!("Failed to create {}", parent.display()))?;
202    }
203
204    // The Vault CLI receives the public key path as a UTF-8 argument. `Path::display()`
205    // is lossy on non-UTF8 paths and could produce a mangled path Vault would then fail
206    // to read. Require a valid UTF-8 path and fail fast with a clear message.
207    let pubkey_str = pubkey_path.to_str().context(
208        "public key path contains non-UTF8 bytes; vault CLI requires a valid UTF-8 path",
209    )?;
210    // The Vault CLI parses arguments as `key=value` KV pairs. A path containing
211    // `=` would be split mid-argument and produce a cryptic parse error. The
212    // check runs on the already-resolved (tilde-expanded) path because that is
213    // exactly the byte sequence the CLI will see. A user with a `$HOME` path
214    // that itself contains `=` will hit this early; the error message reports
215    // the expanded path so they can rename the offending directory.
216    if pubkey_str.contains('=') {
217        anyhow::bail!(
218            "Public key path '{}' contains '=' which is not supported by the Vault CLI argument format. Rename the key file or directory.",
219            pubkey_str
220        );
221    }
222    let pubkey_arg = format!("public_key=@{}", pubkey_str);
223    debug!(
224        "[external] Vault sign request: addr={} role={}",
225        vault_addr.unwrap_or("<env>"),
226        role
227    );
228    let mut cmd = Command::new("vault");
229    cmd.args(["write", "-field=signed_key", role, &pubkey_arg]);
230    // Override VAULT_ADDR for this subprocess only when a value was resolved
231    // from config. Otherwise leave the env untouched so `vault` keeps using
232    // whatever the parent shell (or `~/.vault-token`) provides. The caller
233    // (typically `resolve_vault_addr`) is expected to have validated and
234    // trimmed the value already — re-checking here is cheap belt-and-braces
235    // for callers that construct the `Option<&str>` manually.
236    if let Some(addr) = vault_addr {
237        anyhow::ensure!(
238            is_valid_vault_addr(addr),
239            "Invalid VAULT_ADDR '{}' for role '{}'. Check the Vault SSH Address field.",
240            addr,
241            role
242        );
243        cmd.env("VAULT_ADDR", addr);
244    }
245    let mut child = cmd
246        .stdout(std::process::Stdio::piped())
247        .stderr(std::process::Stdio::piped())
248        .spawn()
249        .context("Failed to run vault CLI. Is vault installed and in PATH?")?;
250
251    // Drain both pipes on background threads to prevent pipe-buffer deadlock.
252    // Without this, the vault CLI can block writing to a full stderr pipe
253    // (64 KB) while we poll try_wait, causing a false timeout.
254    let stdout_handle = child.stdout.take();
255    let stderr_handle = child.stderr.take();
256    let stdout_thread = std::thread::spawn(move || -> Vec<u8> {
257        let mut buf = Vec::new();
258        if let Some(mut h) = stdout_handle {
259            if let Err(e) = std::io::Read::read_to_end(&mut h, &mut buf) {
260                log::warn!("[external] Failed to read vault stdout pipe: {e}");
261            }
262        }
263        buf
264    });
265    let stderr_thread = std::thread::spawn(move || -> Vec<u8> {
266        let mut buf = Vec::new();
267        if let Some(mut h) = stderr_handle {
268            if let Err(e) = std::io::Read::read_to_end(&mut h, &mut buf) {
269                log::warn!("[external] Failed to read vault stderr pipe: {e}");
270            }
271        }
272        buf
273    });
274
275    // Wait up to 30 seconds for the vault CLI to complete. Without a timeout
276    // the thread blocks indefinitely when the Vault server is unreachable
277    // (e.g. wrong address, firewall, TLS handshake hanging).
278    let deadline = std::time::Instant::now() + std::time::Duration::from_secs(30);
279    let status = loop {
280        match child.try_wait() {
281            Ok(Some(s)) => break s,
282            Ok(None) => {
283                if std::time::Instant::now() >= deadline {
284                    let _ = child.kill();
285                    let _ = child.wait();
286                    // The pipe-drain threads (stdout_thread, stderr_thread)
287                    // are dropped without joining here. This is intentional:
288                    // kill() closes the child's pipe ends, so read_to_end
289                    // returns immediately and the threads self-terminate.
290                    error!(
291                        "[external] Vault unreachable: {}: timed out after 30s",
292                        vault_addr.unwrap_or("<env>")
293                    );
294                    anyhow::bail!("Vault SSH timed out. Server unreachable.");
295                }
296                std::thread::sleep(std::time::Duration::from_millis(100));
297            }
298            Err(e) => {
299                let _ = child.kill();
300                let _ = child.wait();
301                anyhow::bail!("Failed to wait for vault CLI: {}", e);
302            }
303        }
304    };
305
306    let stdout_bytes = stdout_thread.join().unwrap_or_default();
307    let stderr_bytes = stderr_thread.join().unwrap_or_default();
308    let output = std::process::Output {
309        status,
310        stdout: stdout_bytes,
311        stderr: stderr_bytes,
312    };
313
314    if !output.status.success() {
315        let stderr = String::from_utf8_lossy(&output.stderr);
316        if stderr.contains("permission denied") || stderr.contains("403") {
317            error!(
318                "[external] Vault auth failed: permission denied (role={} addr={})",
319                role,
320                vault_addr.unwrap_or("<env>")
321            );
322            anyhow::bail!("Vault SSH permission denied. Check token and policy.");
323        }
324        if stderr.contains("missing client token") || stderr.contains("token expired") {
325            error!(
326                "[external] Vault auth failed: token missing or expired (role={} addr={})",
327                role,
328                vault_addr.unwrap_or("<env>")
329            );
330            anyhow::bail!("Vault SSH token missing or expired. Run `vault login`.");
331        }
332        // Check "connection refused" before "dial tcp" because Go's
333        // refused-connection error contains both substrings.
334        if stderr.contains("connection refused") {
335            error!(
336                "[external] Vault unreachable: {}: connection refused",
337                vault_addr.unwrap_or("<env>")
338            );
339            anyhow::bail!("Vault SSH connection refused.");
340        }
341        if stderr.contains("i/o timeout") || stderr.contains("dial tcp") {
342            error!(
343                "[external] Vault unreachable: {}: connection timed out",
344                vault_addr.unwrap_or("<env>")
345            );
346            anyhow::bail!("Vault SSH connection timed out.");
347        }
348        if stderr.contains("no such host") {
349            error!(
350                "[external] Vault unreachable: {}: no such host",
351                vault_addr.unwrap_or("<env>")
352            );
353            anyhow::bail!("Vault SSH host not found.");
354        }
355        if stderr.contains("server gave HTTP response to HTTPS client") {
356            error!(
357                "[external] Vault unreachable: {}: server returned HTTP on HTTPS connection",
358                vault_addr.unwrap_or("<env>")
359            );
360            anyhow::bail!("Vault SSH server uses HTTP, not HTTPS. Set address to http://.");
361        }
362        if stderr.contains("certificate signed by unknown authority")
363            || stderr.contains("tls:")
364            || stderr.contains("x509:")
365        {
366            error!(
367                "[external] Vault unreachable: {}: TLS error",
368                vault_addr.unwrap_or("<env>")
369            );
370            anyhow::bail!("Vault SSH TLS error. Check certificate or use http://.");
371        }
372        error!(
373            "[external] Vault SSH signing failed: {}",
374            scrub_vault_stderr(&stderr)
375        );
376        anyhow::bail!("Vault SSH failed: {}", scrub_vault_stderr(&stderr));
377    }
378
379    let signed_key = String::from_utf8_lossy(&output.stdout).trim().to_string();
380    if signed_key.is_empty() {
381        anyhow::bail!("Vault returned empty certificate for role '{}'", role);
382    }
383
384    crate::fs_util::atomic_write(&cert_dest, signed_key.as_bytes())
385        .with_context(|| format!("Failed to write certificate to {}", cert_dest.display()))?;
386
387    info!("Vault SSH certificate signed for {}", alias);
388    Ok(SignResult {
389        cert_path: cert_dest,
390    })
391}
392
393/// Check the validity of an SSH certificate file via `ssh-keygen -L`.
394///
395/// Timezone note: `ssh-keygen -L` outputs local civil time, which `parse_ssh_datetime`
396/// converts to pseudo-epoch seconds. Rather than comparing against UTC `now` (which would
397/// be wrong in non-UTC zones), we compute the TTL from the parsed from/to difference
398/// (timezone-independent) and measure elapsed time since the cert file was written (UTC
399/// file mtime vs UTC now). This keeps both sides in the same reference frame.
400pub fn check_cert_validity(cert_path: &Path) -> CertStatus {
401    if !cert_path.exists() {
402        return CertStatus::Missing;
403    }
404
405    let output = match Command::new("ssh-keygen")
406        .args(["-L", "-f"])
407        .arg(cert_path)
408        .output()
409    {
410        Ok(o) => o,
411        Err(e) => return CertStatus::Invalid(format!("Failed to run ssh-keygen: {}", e)),
412    };
413
414    if !output.status.success() {
415        return CertStatus::Invalid("ssh-keygen could not read certificate".to_string());
416    }
417
418    let stdout = String::from_utf8_lossy(&output.stdout);
419
420    // Handle certificates signed with no expiration ("Valid: forever").
421    for line in stdout.lines() {
422        let t = line.trim();
423        if t == "Valid: forever" || t.starts_with("Valid: from ") && t.ends_with(" to forever") {
424            return CertStatus::Valid {
425                expires_at: i64::MAX,
426                remaining_secs: i64::MAX,
427                total_secs: i64::MAX,
428            };
429        }
430    }
431
432    for line in stdout.lines() {
433        if let Some((from, to)) = parse_valid_line(line) {
434            let ttl = to - from; // Correct regardless of timezone
435            // Defensive: a cert with to < from is malformed. Treat as Invalid
436            // rather than propagating a negative ttl into the cache and the
437            // renewal threshold calculation.
438            if ttl <= 0 {
439                return CertStatus::Invalid(
440                    "certificate has non-positive validity window".to_string(),
441                );
442            }
443
444            // Use file modification time as the signing timestamp (UTC)
445            let signed_at = match std::fs::metadata(cert_path)
446                .and_then(|m| m.modified())
447                .ok()
448                .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
449            {
450                Some(d) => d.as_secs() as i64,
451                None => {
452                    // Cannot determine file age. Treat as needing renewal.
453                    return CertStatus::Expired;
454                }
455            };
456
457            let now = match std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH) {
458                Ok(d) => d.as_secs() as i64,
459                Err(_) => {
460                    return CertStatus::Invalid("system clock before unix epoch".to_string());
461                }
462            };
463
464            let elapsed = now - signed_at;
465            let remaining = ttl - elapsed;
466
467            if remaining <= 0 {
468                return CertStatus::Expired;
469            }
470            let expires_at = now + remaining;
471            return CertStatus::Valid {
472                expires_at,
473                remaining_secs: remaining,
474                total_secs: ttl,
475            };
476        }
477    }
478
479    CertStatus::Invalid("No Valid: line found in certificate".to_string())
480}
481
482/// Parse "Valid: from YYYY-MM-DDTHH:MM:SS to YYYY-MM-DDTHH:MM:SS" from ssh-keygen -L.
483fn parse_valid_line(line: &str) -> Option<(i64, i64)> {
484    let trimmed = line.trim();
485    let rest = trimmed.strip_prefix("Valid:")?;
486    let rest = rest.trim();
487    let rest = rest.strip_prefix("from ")?;
488    let (from_str, rest) = rest.split_once(" to ")?;
489    let to_str = rest.trim();
490
491    let from = parse_ssh_datetime(from_str)?;
492    let to = parse_ssh_datetime(to_str)?;
493    Some((from, to))
494}
495
496/// Parse YYYY-MM-DDTHH:MM:SS to Unix epoch seconds.
497/// Note: ssh-keygen outputs local time. We use the same clock for comparison
498/// (SystemTime::now gives wall clock), so the relative difference is correct
499/// for TTL checks even though the absolute epoch may be off by the UTC offset.
500fn parse_ssh_datetime(s: &str) -> Option<i64> {
501    let s = s.trim();
502    if s.len() < 19 {
503        return None;
504    }
505    let year: i64 = s.get(0..4)?.parse().ok()?;
506    let month: i64 = s.get(5..7)?.parse().ok()?;
507    let day: i64 = s.get(8..10)?.parse().ok()?;
508    let hour: i64 = s.get(11..13)?.parse().ok()?;
509    let min: i64 = s.get(14..16)?.parse().ok()?;
510    let sec: i64 = s.get(17..19)?.parse().ok()?;
511
512    if s.as_bytes().get(4) != Some(&b'-')
513        || s.as_bytes().get(7) != Some(&b'-')
514        || s.as_bytes().get(10) != Some(&b'T')
515        || s.as_bytes().get(13) != Some(&b':')
516        || s.as_bytes().get(16) != Some(&b':')
517    {
518        return None;
519    }
520
521    if !(1..=12).contains(&month) || !(1..=31).contains(&day) {
522        return None;
523    }
524    if !(0..=23).contains(&hour) || !(0..=59).contains(&min) || !(0..=59).contains(&sec) {
525        return None;
526    }
527
528    // Civil date to Unix epoch (same algorithm as chrono/time crates).
529    let mut y = year;
530    let m = if month <= 2 {
531        y -= 1;
532        month + 9
533    } else {
534        month - 3
535    };
536    let era = if y >= 0 { y } else { y - 399 } / 400;
537    let yoe = y - era * 400;
538    let doy = (153 * m + 2) / 5 + day - 1;
539    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
540    let days = era * 146097 + doe - 719468;
541
542    Some(days * 86400 + hour * 3600 + min * 60 + sec)
543}
544
545/// Check if a certificate needs renewal.
546///
547/// For certificates whose total validity window is shorter than
548/// `RENEWAL_THRESHOLD_SECS`, the fixed 5-minute threshold would flag a freshly
549/// signed cert as needing renewal immediately, causing an infinite re-sign loop.
550/// In that case we fall back to a proportional threshold (half the total).
551pub fn needs_renewal(status: &CertStatus) -> bool {
552    match status {
553        CertStatus::Missing | CertStatus::Expired | CertStatus::Invalid(_) => true,
554        CertStatus::Valid {
555            remaining_secs,
556            total_secs,
557            ..
558        } => {
559            let threshold = if *total_secs > 0 && *total_secs <= RENEWAL_THRESHOLD_SECS {
560                *total_secs / 2
561            } else {
562                RENEWAL_THRESHOLD_SECS
563            };
564            *remaining_secs < threshold
565        }
566    }
567}
568
569/// Ensure a valid certificate exists for a host. Signs a new one if needed.
570/// Checks at the CertificateFile path (or purple's default) before signing.
571pub fn ensure_cert(
572    role: &str,
573    pubkey_path: &Path,
574    alias: &str,
575    certificate_file: &str,
576    vault_addr: Option<&str>,
577) -> Result<PathBuf> {
578    let check_path = resolve_cert_path(alias, certificate_file)?;
579    let status = check_cert_validity(&check_path);
580
581    if !needs_renewal(&status) {
582        info!("Vault SSH certificate cache hit for {}", alias);
583        return Ok(check_path);
584    }
585
586    let result = sign_certificate(role, pubkey_path, alias, vault_addr)?;
587    Ok(result.cert_path)
588}
589
590/// Resolve the public key path for signing.
591/// Priority: host IdentityFile + ".pub" > ~/.ssh/id_ed25519.pub fallback.
592/// Returns an error when the user's home directory cannot be determined. Any
593/// IdentityFile pointing outside `$HOME` is rejected and falls back to the
594/// default `~/.ssh/id_ed25519.pub` to prevent reading arbitrary filesystem
595/// locations via a crafted IdentityFile directive.
596pub fn resolve_pubkey_path(identity_file: &str) -> Result<PathBuf> {
597    let home = dirs::home_dir().context("Could not determine home directory")?;
598    let fallback = home.join(".ssh/id_ed25519.pub");
599
600    if identity_file.is_empty() {
601        return Ok(fallback);
602    }
603
604    let expanded = if let Some(rest) = identity_file.strip_prefix("~/") {
605        home.join(rest)
606    } else {
607        PathBuf::from(identity_file)
608    };
609
610    // A purely lexical `starts_with(&home)` check can be bypassed by a symlink inside
611    // $HOME pointing to a path outside $HOME (e.g. ~/evil -> /etc). Canonicalize both
612    // sides so symlinks are resolved, then compare. If the expanded path does not yet
613    // exist (or canonicalize fails for any reason) we cannot safely reason about where
614    // it actually points, so fall back to the default key path.
615    let canonical_home = match std::fs::canonicalize(&home) {
616        Ok(p) => p,
617        Err(_) => return Ok(fallback),
618    };
619    if expanded.exists() {
620        match std::fs::canonicalize(&expanded) {
621            Ok(canonical) if canonical.starts_with(&canonical_home) => {}
622            _ => return Ok(fallback),
623        }
624    } else if !expanded.starts_with(&home) {
625        return Ok(fallback);
626    }
627
628    if expanded.extension().is_some_and(|ext| ext == "pub") {
629        Ok(expanded)
630    } else {
631        let mut s = expanded.into_os_string();
632        s.push(".pub");
633        Ok(PathBuf::from(s))
634    }
635}
636
637/// Resolve the effective vault role for a host.
638/// Priority: host-level vault_ssh > provider-level vault_role > None.
639pub fn resolve_vault_role(
640    host_vault_ssh: Option<&str>,
641    provider_name: Option<&str>,
642    provider_config: &crate::providers::config::ProviderConfig,
643) -> Option<String> {
644    if let Some(role) = host_vault_ssh {
645        if !role.is_empty() {
646            return Some(role.to_string());
647        }
648    }
649
650    if let Some(name) = provider_name {
651        if let Some(section) = provider_config.section(name) {
652            if !section.vault_role.is_empty() {
653                return Some(section.vault_role.clone());
654            }
655        }
656    }
657
658    None
659}
660
661/// Resolve the effective Vault address for a host.
662///
663/// Precedence (highest wins): per-host `# purple:vault-addr` comment,
664/// provider `vault_addr=` setting, else None (caller falls back to the
665/// `vault` CLI's own env resolution).
666///
667/// Both layers are re-validated with `is_valid_vault_addr` even though the
668/// parser paths (`HostBlock::vault_addr()` and `ProviderConfig::parse`)
669/// already drop invalid values. This is defensive: a future caller that
670/// constructs a `HostEntry` or `ProviderSection` in-memory (tests, migration
671/// code, a new feature) won't be able to smuggle a malformed `VAULT_ADDR`
672/// into `sign_certificate` through this resolver.
673pub fn resolve_vault_addr(
674    host_vault_addr: Option<&str>,
675    provider_name: Option<&str>,
676    provider_config: &crate::providers::config::ProviderConfig,
677) -> Option<String> {
678    if let Some(addr) = host_vault_addr {
679        let trimmed = addr.trim();
680        if !trimmed.is_empty() && is_valid_vault_addr(trimmed) {
681            return Some(normalize_vault_addr(trimmed));
682        }
683    }
684
685    if let Some(name) = provider_name {
686        if let Some(section) = provider_config.section(name) {
687            let trimmed = section.vault_addr.trim();
688            if !trimmed.is_empty() && is_valid_vault_addr(trimmed) {
689                return Some(normalize_vault_addr(trimmed));
690            }
691        }
692    }
693
694    None
695}
696
697/// Format remaining certificate time for display.
698pub fn format_remaining(remaining_secs: i64) -> String {
699    if remaining_secs <= 0 {
700        return "expired".to_string();
701    }
702    let hours = remaining_secs / 3600;
703    let mins = (remaining_secs % 3600) / 60;
704    if hours > 0 {
705        format!("{}h {}m", hours, mins)
706    } else {
707        format!("{}m", mins)
708    }
709}
710
711#[cfg(test)]
712#[path = "vault_ssh_tests.rs"]
713mod tests;
purple_ssh/vault_ssh.rs

purple_ssh/
vault_ssh.rs
