cli

Documentation

Overview

Package cli implements administrative CLI commands for The Vault. All commands require the admin credential, taken from ADMIN_TOKEN_FILE or, with a warning that it is disclosed through argv, from --admin-token. Available commands: add-client, list-clients, revoke-all-sessions, rotate-admin-token, rotate-jwks, seed, cleanup-recovery, and export-audit. The revoke-client, rotate-client-secret, lock-user, unlock-user and cleanup-audit subcommands are retired stubs that print an error and redirect to the plane that owns the capability; they issue no database write.

Index

• type CLI
  • func New(clients repository.ClientRepository, users repository.UserRepository, ...) *CLI
  • func (c *CLI) InitAdminToken(ctx context.Context) error
  • func (c *CLI) Run(ctx context.Context, args []string) bool
  • func (c *CLI) WithRecoveryPruner(pruner repository.AccountRecoveryPruner) *CLI

Types

type CLI

type CLI struct {
	// contains filtered or unexported fields
}

CLI handles administrative commands executed from the command line. Every command requires a valid --admin-token for authentication.

func New

func New(clients repository.ClientRepository, users repository.UserRepository, tokens repository.RefreshTokenRepository, adminConfig repository.AdminConfigRepository, audit repository.AuditRepository, pepper string) *CLI

New creates a new CLI handler with the given repositories.

func (*CLI) InitAdminToken

func (c *CLI) InitAdminToken(ctx context.Context) error

InitAdminToken installs the initial admin token on first boot.

ADMIN_TOKEN_FILE wins when set: the operator has already chosen the credential and knows its plaintext, so nothing needs to be minted and nothing secret reaches stdout. Only when no file is mounted is a token generated and printed once.

If a hash already exists in the database it is left alone, because it may be the result of rotate-admin-token and re-seeding from the file would silently undo that rotation on the next restart.

func (*CLI) Run

func (c *CLI) Run(ctx context.Context, args []string) bool

Run executes a CLI command from the given args. It returns true if a command was recognized and handled, false otherwise. The admin token is extracted from --admin-token and verified before any command executes.

func (*CLI) WithRecoveryPruner

func (c *CLI) WithRecoveryPruner(pruner repository.AccountRecoveryPruner) *CLI

WithRecoveryPruner attaches the account-recovery escrow pruner that `vault cleanup-recovery` needs. Without it the command reports that the repository is unavailable rather than silently doing nothing.