peaufinage

src/utils/cache.ts

@@ -21,6 +21,12 @@ class VaultCache {
     this.cache = this.loadFromStorage()
   }
 
+  private getMaxAgeMs(): number {
+    const config = loadConfig()
+    const minutes = config.cache.maxAgeMinutes || 30 // Default to 30 minutes if 0 or empty
+    return minutes * 60 * 1000 // Convert to milliseconds
+  }
+
   private loadFromStorage(): Map<string, CacheEntry<unknown>> {
     try {
       const stored = localStorage.getItem(this.CACHE_KEY)
@@ -99,7 +105,7 @@ class VaultCache {
 
     // Check if entry is expired
     const age = Date.now() - entry.timestamp
-    if (age > config.cache.maxAge) {
+    if (age > this.getMaxAgeMs()) {
       this.cache.delete(key)
       return null
     }
@@ -131,7 +137,7 @@ class VaultCache {
     if (!entry) return false
 
     const age = Date.now() - entry.timestamp
-    if (age > config.cache.maxAge) {
+    if (age > this.getMaxAgeMs()) {
       this.cache.delete(key)
       return false
     }
@@ -174,12 +180,12 @@ class VaultCache {
 
   // Clean up expired entries
   cleanup(): void {
-    const config = loadConfig()
     const now = Date.now()
+    const maxAge = this.getMaxAgeMs()
     const keysToDelete: string[] = []
 
     for (const [key, entry] of this.cache.entries()) {
-      if (now - entry.timestamp > config.cache.maxAge) {
+      if (now - entry.timestamp > maxAge) {
         keysToDelete.push(key)
       }
     }

src/utils/vaultPolicyHelper.ts

@@ -0,0 +1,103 @@
+/**
+ * Utility functions for generating Vault policy guidance
+ */
+
+export interface PolicyGuidance {
+  operation: 'read' | 'write' | 'delete' | 'list'
+  path: string
+  capabilities: string[]
+}
+
+/**
+ * Generate policy guidance for common Vault operations
+ */
+export function generatePolicyGuidance(path: string, operation: 'read' | 'write' | 'delete' | 'list'): string {
+  const pathParts = path.split('/')
+  const mountPoint = pathParts[0]
+  const secretPath = pathParts.slice(1).join('/')
+
+  let description: string
+  let examples: string[] = []
+
+  switch (operation) {
+    case 'read':
+      description = 'read secrets'
+      examples = [
+        `# Specific secret
+path "${mountPoint}/data/${secretPath || '*'}" {
+  capabilities = ["read"]
+}`,
+        `# All secrets in mount
+path "${mountPoint}/data/*" {
+  capabilities = ["read"]
+}`,
+      ]
+      break
+
+    case 'write':
+      description = 'create and update secrets'
+      examples = [
+        `# Specific secret
+path "${mountPoint}/data/${secretPath || '*'}" {
+  capabilities = ["create", "update"]
+}`,
+        `# All secrets in mount
+path "${mountPoint}/data/*" {
+  capabilities = ["create", "update"]
+}`,
+      ]
+      break
+
+    case 'delete':
+      description = 'delete secrets'
+      examples = [
+        `# Specific secret
+path "${mountPoint}/data/${secretPath || '*'}" {
+  capabilities = ["delete"]
+}`,
+        `# All secrets in mount
+path "${mountPoint}/data/*" {
+  capabilities = ["delete"]
+}`,
+        `# For KV v2: also need metadata delete permissions
+path "${mountPoint}/metadata/${secretPath || '*'}" {
+  capabilities = ["delete"]
+}`,
+      ]
+      break
+
+    case 'list':
+      description = 'list secrets'
+      examples = [
+        `# List secrets in mount
+path "${mountPoint}/metadata/*" {
+  capabilities = ["list"]
+}`,
+        `# List specific path
+path "${mountPoint}/metadata/${secretPath || '*'}" {
+  capabilities = ["list"]
+}`,
+      ]
+      break
+  }
+
+  return `**Permission Denied (403)**
+
+You need the following permissions in your Vault policy to ${description}:
+
+\`\`\`hcl
+${examples.join('\n\n')}
+\`\`\`
+
+**Ask your Vault administrator to add these permissions to your policy.**`
+}
+
+/**
+ * Generate policy guidance for 403 errors with context
+ */
+export function generate403PolicyGuidance(path: string, operation: 'read' | 'write' | 'delete' | 'list', originalError: string): string {
+  const guidance = generatePolicyGuidance(path, operation)
+  return `${guidance}
+
+**Original error:** ${originalError}`
+}