Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(azure-key-vault-driver): fix character encoding #308

Merged
merged 2 commits into from
Oct 9, 2023
Merged

fix(azure-key-vault-driver): fix character encoding #308

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
916e551
fix(azure-key-vault-driver): :bug: Fixed encoding/decoding, Updated …
itpropro Sep 22, 2023
d6364ca
Update docs/content/6.drivers/azure-key-vault.md
pi0 Sep 28, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 3 additions & 1 deletion docs/content/6.drivers/azure-key-vault.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ Store data in a Azure Key Vault [secrets](https://docs.microsoft.com/en-us/azure
This driver stores KV information in Azure Key Vault secrets by using the key as secret id and the value as secret content.
Please be aware that key vault secrets don't have the fastest access time and are not designed for high throughput. You also have to disable purge protection for your key vault to be able to delete secrets. This implementation deletes and purges a secret when it is deleted to avoid conflicts with soft delete.

⚠️ Be aware that this driver stores the keys of your `key:value` pairs in an encoded way in Key Vault to avoid conflicts with naming requirements for secrets. This means that you will not be able to access manually (outside of unstorage) created secrets inside your Key Vault, as long as they are not encoded in the same way.

To use it, you will need to install `@azure/keyvault-secrets` and `@azure/identity` in your project:

```bash
Expand All @@ -30,7 +32,7 @@ The driver supports the following authentication methods:

- **`DefaultAzureCredential`**: This is the recommended way to authenticate. It will use managed identity or environment variables to authenticate the request. It will also work in a local environment by trying to use Azure CLI or Azure PowerShell to authenticate.

⚠️ Make sure that your Managed Identity or personal account has either the `Key Vault Secrets Officer` RBAC role assigned or is a member of an access policy that grants `Get`, `List`, `Set`, `Delete` and `Purge` secret permissions.
⚠️ Make sure that your Managed Identity or personal account has either the `Key Vault Secrets Officer` (or `Key Vault Secrets User` for read-only) RBAC role assigned or is a member of an access policy that grants `Get`, `List`, `Set`, `Delete` and `Purge` secret permissions.

**Options:**

Expand Down
6 changes: 3 additions & 3 deletions src/drivers/azure-key-vault.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,9 +107,9 @@ export default defineDriver((opts: AzureKeyVaultOptions) => {
});

const base64Map: { [key: string]: string } = {
"=": "e",
"+": "p",
"/": "s",
"=": "-e-",
"+": "-p-",
"/": "-s-",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it makes sense / be possible that we use url encoding? (= ~> %3D)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately not, as Key Vault only supports dashes besides alphanumeric characters. This replacement is only necessary because of the potential characters that could result in a base64 encoding. B64 was the only encoding I found that is available without adding an additional dependency and without requiring a custom implementation of an encoding scheme. As dashes are the only allowed characters and there were too many edge cases with replacing the special characters of b64 with alphanumeric characters or only one dash, this was the least overhead solution.
I can add an additional test of course to validate the encoding.

};

function encode(value: string): string {
Expand Down