Merge pull request #21 from Conjur-Enterprise/CNJR-10552-config

CNJR-10552: Config code added to repository

Author: stefanskicyber

CHANGELOG.md

@@ -9,6 +9,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Nothing should go in this section, please add to the latest unreleased version
   (and update the corresponding date), or add a new version.
 
+## [6.1.0] - 2025-09-05
+
+### Added
+- Added Config code and tests to repository (CNJR-10552).
+  [cyberark/conjur-api-ruby#186](https://github.com/cyberark/conjur-api-ruby/issues/186)
+
 ## [6.0.1] - 2025-09-05
 
 ### Fixed

README.md

@@ -47,7 +47,6 @@ For custom scenarios, the location of the file can be overridden using the `CONJ
 You can load the Secrets Manager configuration file using the following Ruby code:
 
 ```ruby
-require 'conjur/cli'
 Conjur::Config.load
 Conjur::Config.apply
 ```

lib/conjur/command/rspec/output_matchers.rb

@@ -0,0 +1,54 @@
+require 'io/grab'
+
+# Custom matcher to test text written to standard output and standard error
+#
+# @example
+#   expect { $stderr.puts "Some random error" }.to write(/Some.* error/).to(:stderr)
+#
+# @example
+#   expect { $stderr.puts "Some specific error" }.to write('Some specific error').to(:stderr)
+#
+# @note http://greyblake.com/blog/2012/12/14/custom-expectations-with-rspec/
+RSpec::Matchers.define :write do |message|
+  supports_block_expectations
+
+  chain(:to) do |io|
+    @io = io
+  end
+
+  match do |block|
+    stream = case io
+    when :stdout
+      $stdout
+    when :stderr
+      $stderr
+    else
+      io
+    end
+
+    @actual = output = stream.grab &block
+
+    case message
+    when Hash then output.include?(JSON.pretty_generate message)
+    when String then output.include? message
+    when Regexp then output.match message
+    when nil then output
+    else fail("Allowed types for write `message` are String or Regexp, got `#{message.class}`")
+    end
+  end
+
+  description do
+    %Q[write #{message.inspect} to #{@io}]
+  end
+
+  diffable
+
+  failure_message do
+    %Q[expected to #{description} but got #{@actual.inspect}]
+  end
+
+  # default IO is standard output
+  def io
+    @io ||= :stdout
+  end
+end

lib/conjur/config.rb

@@ -0,0 +1,141 @@
+#
+# Copyright (C) 2013 Conjur Inc
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal in
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+# the Software, and to permit persons to whom the Software is furnished to do so,
+# subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+# FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+# COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+# IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+#
+require 'active_support/core_ext/hash/deep_merge'
+require 'active_support/core_ext/hash/indifferent_access'
+
+module Conjur
+  class Config
+    @@attributes = {}
+
+    class << self
+      def clear
+        @@attributes = {}
+      end
+
+      def plugin_config_files
+        [ '/opt/conjur/etc/plugins.yml' ]
+      end
+
+      def user_config_files
+        $stderr.puts "variable return %s\n", ENV['CONJURRC']
+        #raise ENV.inspect
+        if ENV['CONJURRC']
+          $stderr.puts "variable return %s\n", ENV['CONJURRC']
+          return ENV['CONJURRC']
+        else
+          homefile = File.expand_path "~/.conjurrc"
+          pwdfile = File.expand_path ".conjurrc"
+          if homefile != pwdfile && File.file?(pwdfile)
+            $stderr.puts """NOTE:\t.conjurrc file detected in the current directory.\n"\
+                "\tIt's no longer consulted in this version. Please explicitly\n"\
+                "\tset CONJURRC=./.conjurrc if you're sure you want to use it."
+          end
+          [ homefile ]
+        end
+      end
+
+      def default_config_files
+        ['/etc/conjur.conf', user_config_files, plugin_config_files].flatten.uniq
+      end
+
+      def load(config_files = default_config_files)
+        require 'yaml'
+        require 'conjur/log'
+
+        config_files.each do |f|
+          if File.file?(f)
+            if Conjur.log
+              Conjur.log << "Loading #{f}\n"
+            end
+            config = YAML.load(IO.read(f)).stringify_keys rescue {}
+            if config['cert_file']
+              config['cert_file'] = File.expand_path(config['cert_file'], File.dirname(f))
+            end
+            Conjur::Config.merge config
+          end
+        end
+      end
+
+
+      def apply
+        require 'conjur/configuration'
+
+        keys = Config.keys.dup
+        keys.delete(:plugins)
+
+        cfg = Conjur.configuration
+        keys.each do |k|
+          if Conjur.configuration.respond_to?("#{k}_env_var") && (env_var = Conjur.configuration.send("#{k}_env_var")) && (v = ENV[env_var])
+            if Conjur.log
+              Conjur.log << "Not overriding environment setting #{k}=#{v}\n"
+            end
+            next
+          end
+          value = Config[k]
+          cfg.set k, value if value
+        end
+
+        Conjur.log << "Using authn url #{Conjur.configuration.authn_url}\n" if Conjur.log
+
+        Conjur.config.apply_cert_config!
+      end
+
+
+      def inspect
+        @@attributes.inspect
+      end
+
+      def plugins
+        plugins = @@attributes['plugins']
+        if plugins
+          plugins.is_a?(Array) ? plugins : plugins.split(',')
+        else
+          []
+        end
+      end
+
+      def merge(a)
+        a = {} unless a
+        @@attributes.deep_merge!(a.stringify_keys)
+      end
+
+      def keys
+        @@attributes.keys.map(&:to_sym)
+      end
+
+      def [](key)
+        @@attributes[key.to_s]
+      end
+
+      def member? key
+        @@attributes.member?(key) || @@attributes.member?(alternate_key(key))
+      end
+
+      def alternate_key key
+        case key
+          when String then key.to_sym
+          when Symbol then key.to_s
+          else key
+        end
+      end
+    end
+  end
+end

spec/.conjurrc

@@ -0,0 +1,2 @@
+cert_file: ./conjur-ci.pem
+appliance_url: https://conjur.example.com

spec/config_spec.rb

@@ -0,0 +1,176 @@
+require 'spec_helper'
+require 'conjur/config'
+require 'conjur/command/rspec/output_matchers'
+
+describe Conjur::Config do
+  include_context "fresh config"
+
+  describe ".default_config_files" do
+    subject { Conjur::Config.default_config_files }
+    let(:homedir) { '/src/conjur-api' }
+    around do |example|
+      realhome = ENV.delete 'HOME'
+      ENV['HOME'] = homedir
+      example.run
+      ENV['HOME'] = realhome
+    end
+
+    let(:deprecation_warning) { /\.conjurrc/ }
+
+    shared_examples "no deprecation warning" do
+      it "does not issue a deprecation warning" do
+        expect { subject }.to_not write(deprecation_warning).to(:stderr)
+      end
+    end
+
+    context "when CONJURRC is not set" do
+      around do |example|
+        oldrc = ENV.delete 'CONJURRC'
+
+        example.run
+
+        ENV['CONJURRC'] = oldrc
+      end
+
+      it { is_expected.to include('/etc/conjur.conf') }
+      it { is_expected.to include("#{homedir}/.conjurrc") }
+
+      before do
+        allow(File).to receive(:expand_path).and_call_original
+        allow(File).to receive(:expand_path).with('.conjurrc').and_return '.conjurrc'
+      end
+
+      context "When .conjurrc is present" do
+        before { allow(File).to receive(:file?).with('.conjurrc').and_return true }
+        it "Issues a deprecation warning" do 
+          expect { subject }.to write(deprecation_warning).to(:stderr)
+        end
+
+        it "doesn't use the file" do
+          expect(subject).to_not include '.conjurrc'
+        end
+
+        context "but the current directory is home" do
+          before do
+            allow(File).to receive(:expand_path).and_call_original
+            allow(File).to receive(:expand_path).and_call_original
+            allow(File).to receive(:expand_path).with('.conjurrc').and_return("#{homedir}/.conjurrc")
+          end
+
+          include_examples "no deprecation warning"
+        end
+      end
+
+      context "When .conjurrc is missing" do
+        before { allow(File).to receive(:file?).with('.conjurrc').and_return false }
+        include_examples "no deprecation warning"
+      end
+    end
+
+    context "when CONJURRC is set but not available" do
+      oldrc = ENV['CONJURRC']
+
+      before { ENV['CONJURRC']='stub_conjurrc' }
+
+      it { is_expected.to include('/etc/conjur.conf') }
+      it { is_expected.not_to include("#{homedir}/.conjurrc") }
+      it { is_expected.to include('stub_conjurrc') }
+
+      include_examples "no deprecation warning"
+      ENV['CONJURRC'] = oldrc
+    end
+
+    context "when CONJURRC is set to conjurrc" do
+      oldrc = ENV['CONJURRC']
+
+      before { ENV['CONJURRC']='conjurrc' }
+
+      before { allow(File).to receive(:file?).with('conjurrc').and_return true }
+      it { is_expected.to include('/etc/conjur.conf') }
+      it { is_expected.to include('conjurrc') }
+      it { is_expected.not_to include("#{homedir}/conjurrc") }
+
+      include_examples "no deprecation warning"
+      ENV['CONJURRC'] = oldrc
+    end
+  end
+
+  let(:load!) { Conjur::Config.load([ File.expand_path('conjurrc', File.dirname(__FILE__)) ]) }
+  let(:cert_path) { File.expand_path('conjur-ci.pem', File.dirname(__FILE__)) }
+
+  describe "#load" do
+    it "resolves the cert_file" do
+      load!
+      
+      expect(Conjur::Config[:cert_file]).to eq(cert_path)
+    end
+  end
+
+  describe "#apply" do
+    before { 
+      allow(OpenSSL::SSL::SSLContext::DEFAULT_CERT_STORE).to receive(:add_file) 
+      allow(File).to receive(:open)
+    }
+
+    context "ssl_certificate string" do
+      let(:ssl_certificate) do
+        """-----BEGIN CERTIFICATE-----
+MIIDPjCCAiagAwIBAgIVAKW1gdmOFrXt6xB0iQmYQ4z8Pf+kMA0GCSqGSIb3DQEB
+CwUAMD0xETAPBgNVBAoTCGN1Y3VtYmVyMRIwEAYDVQQLEwlDb25qdXIgQ0ExFDAS
+BgNVBAMTC2N1a2UtbWFzdGVyMB4XDTE1MTAwNzE2MzAwNloXDTI1MTAwNDE2MzAw
+NlowFjEUMBIGA1UEAwwLY3VrZS1tYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQC9e8bGIHOLOypKA4lsLcAOcDLAq+ICuVxn9Vg0No0m32Ok/K7G
+uEGtlC8RidObntblUwqdX2uP7mqAQm19j78UTl1KT97vMmmFrpVZ7oQvEm1FUq3t
+FBmJglthJrSbpdZjLf7a7eL1NnunkfBdI1DK9QL9ndMjNwZNFbXhld4fC5zuSr/L
+PxawSzTEsoTaB0Nw0DdRowaZgrPxc0hQsrj9OF20gTIJIYO7ctZzE/JJchmBzgI4
+CdfAYg7zNS+0oc0ylV0CWMerQtLICI6BtiQ482bCuGYJ00NlDcdjd3w+A2cj7PrH
+wH5UhtORL5Q6i9EfGGUCDbmfpiVD9Bd3ukbXAgMBAAGjXDBaMA4GA1UdDwEB/wQE
+AwIFoDAdBgNVHQ4EFgQU2jmj7l5rSw0yVb/vlWAYkK/YBwkwKQYDVR0RBCIwIIIL
+Y3VrZS1tYXN0ZXKCCWxvY2FsaG9zdIIGY29uanVyMA0GCSqGSIb3DQEBCwUAA4IB
+AQBCepy6If67+sjuVnT9NGBmjnVaLa11kgGNEB1BZQnvCy0IN7gpLpshoZevxYDR
+3DnPAetQiZ70CSmCwjL4x6AVxQy59rRj0Awl9E1dgFTYI3JxxgLsI9ePdIRVEPnH
+dhXqPY5ZIZhvdHlLStjsXX7laaclEtMeWfSzxe4AmP/Sm/er4ks0gvLQU6/XJNIu
+RnRH59ZB1mZMsIv9Ii790nnioYFR54JmQu1JsIib77ZdSXIJmxAtraJSTLcZbU1E
++SM3XCE423Xols7onyluMYDy3MCUTFwoVMRBcRWCAk5gcv6XvZDfLi6Zwdne6x3Y
+bGenr4vsPuSFsycM03/EcQDT
+-----END CERTIFICATE-----
+"""
+      end
+      let(:certificate){ double('Certificate') }
+      before{
+          Conjur::Config.class_variable_set('@@attributes', {'ssl_certificate' => ssl_certificate})
+      }
+
+      it 'trusts the certificate string' do
+        expect(OpenSSL::X509::Certificate).to receive(:new).with(ssl_certificate).once.and_return certificate
+        expect(OpenSSL::SSL::SSLContext::DEFAULT_CERT_STORE).to receive(:add_cert).with(certificate).once
+        Conjur::Config.apply
+      end
+    end
+
+    context "cert_file" do
+      let(:cert_file) { "/path/to/cert.pem" }
+      before { 
+        Conjur::Config.class_variable_set("@@attributes", { 'cert_file' => cert_file })
+      }
+  
+      it "trusts the cert_file" do
+        expect(OpenSSL::SSL::SSLContext::DEFAULT_CERT_STORE).to receive(:add_file).with cert_file  
+        Conjur::Config.apply
+      end
+
+      it "propagates the cert_file to Configuration.cert_file" do
+        Conjur::Config.apply
+        expect(Conjur.configuration.cert_file).to eq(cert_file)
+      end
+    end
+
+    it "shadows rc with envars" do
+      url = 'https://other-conjur.example.com'
+      ENV['CONJUR_APPLIANCE_URL'] = url
+      load!
+      Conjur::Config.apply
+      expect(Conjur.configuration.appliance_url).to eq(url)
+    end
+  end
+end