@litehex/node-vault

^{Node Vault}

node-vault is a Javascript HTTP client for HashiCorp's Vault API that allows you to have typesafe access to the API using TypeScript and Zod.

---

• Features
• Installation
• Usage
  • Init and unseal vault
  • Create Key/Value V2 engine
  • Create, read, update, delete secrets
• Documentation
• Contributing
• License

👀 Features

• Simple API
• Typesafe and Validated Requests from Zod
• Extendable using Custom Commands

📦 Installation

npm install @litehex/node-vault

📖 Usage

Init and unseal vault

import { Client } from '@litehex/node-vault';

// Get a new instance of the client
const vc = new Client({
  apiVersion: 'v1', // default
  endpoint: 'http://127.0.0.1:8200', // default
  token: 'hv.xxxxxxxxxxxxxxxxxxxxx' // Optional in case you want to initialize the vault
});

// Init vault
const init = await vc.init({ secret_shares: 1, secret_threshold: 1 });
console.log(init); // { data: { keys: [ ... ], keys_base64: [ ... ], ... } }

// Set token
const { keys, root_token } = init;
vc.token = root_token;

const unsealed = await vc.unseal({ key: keys[0] });

console.log(unsealed); // { data: { type: 'shamir', initialized: true, sealed: false, ... } }

Create Key/Value V2 engine

const mounted = await vc.mount({
  mountPath: 'my-secret',
  type: 'kv-v2'
});

console.log(mounted); // { data: true }

const info = await vc.engineInfo({ mountPath: 'my-secret' });

console.log(info); // { data: { type: 'kv', options: { version: '2' }, ... } }

Write, read and delete secrets

const mountPath = 'my-secret';
const path = 'hello';

const write = await vc.kv2.write({
  mountPath,
  path,
  data: { foo: 'bar' }
});
console.log(write); // { data: { request_id: '...', lease_id: '...', ... } }

const read = await vc.kv2.read({ mountPath, path });
console.log(read); // { data: { request_id: '...', lease_id: '...', ... } }

const deleted = await vc.kv2.deleteLatest({ mountPath, path });
console.log(deleted); // { data: true }

📚 Documentation

For complete usages, please dive into the Wiki.

For all configuration options, please see the API docs.

🤝 Contributing

You can contribute to this project by opening an issue or a pull request on GitHub. Feel free to contribute, we care about your ideas and suggestions.

Relevant

• HashiCorp's Vault API docs
• Minimal CLI for K/V V2 engine

License

MIT © Shahrad Elahi

Changelog

1.0.0

Major Changes

• 3775bf3: Fix: Using the environment's global fetch API instead of undici.

  This change makes this library more compatible with JavaScript runtimes that do not support Node.js modules. If you want to use undici again, use the Custom Fetcher feature.

• f922ba9: BREAKING: The responses of commands are wrapped in a record with type of SafeReturn<T, VaultError>.

  This record contains two properties:

  • data: The data property for successful responses. The value depends on the command.
  • error: The error property for error responses. The type is VaultError, which is a subclass of Error.

  Read Migration guide for more details on how to use it.

• e2f73e7: Fix: Switched license from GPL-3.0 to MIT, to make the project more open and permissive.