fix: [PL-27860]: Updating the ppt whenever the secret is updated (#36981)

VikasMaddukuriHarness · web-flow · commit 5d8e8053eadb · 2022-09-07T09:56:05.000+05:30
* fix: [PL-27860]: Updating the ppt whenever the secret is updated

* fix: [PL-27860]: added for token renewal

* fix: [PL-27860]: removed the dependency in ngVaultServiceImpl

* fix: [PL-27860]: Removed dependency

* fix: [PL-27860]: Added UT
diff --git a/120-ng-manager/src/main/java/io/harness/ng/ConnectorServiceImpl.java b/120-ng-manager/src/main/java/io/harness/ng/ConnectorServiceImpl.java
@@ -712,6 +712,11 @@ public void resetHeartbeatForReferringConnectors(List<Pair<String, String>> conn
     defaultConnectorService.resetHeartbeatForReferringConnectors(connectorPerpetualTaskInfoList);
   }
 
+  @Override
+  public void resetHeartBeatTask(String accountId, String taskId) {
+    defaultConnectorService.resetHeartBeatTask(accountId, taskId);
+  }
+
   @Override
   public Page<ConnectorResponseDTO> list(int page, int size, String accountIdentifier,
       ConnectorFilterPropertiesDTO filterProperties, String orgIdentifier, String projectIdentifier,
diff --git a/120-ng-manager/src/main/java/io/harness/ng/SecretManagerConnectorServiceImpl.java b/120-ng-manager/src/main/java/io/harness/ng/SecretManagerConnectorServiceImpl.java
@@ -322,6 +322,11 @@ public void resetHeartbeatForReferringConnectors(List<Pair<String, String>> conn
     defaultConnectorService.resetHeartbeatForReferringConnectors(connectorPerpetualTaskInfoList);
   }
 
+  @Override
+  public void resetHeartBeatTask(String accountId, String taskId) {
+    defaultConnectorService.resetHeartBeatTask(accountId, taskId);
+  }
+
   @Override
   public Page<ConnectorResponseDTO> list(int page, int size, String accountIdentifier,
       ConnectorFilterPropertiesDTO filterProperties, String orgIdentifier, String projectIdentifier,
diff --git a/440-connector-nextgen/src/main/java/io/harness/connector/impl/DefaultConnectorServiceImpl.java b/440-connector-nextgen/src/main/java/io/harness/connector/impl/DefaultConnectorServiceImpl.java
@@ -1036,6 +1036,10 @@ public void resetHeartbeatForReferringConnectors(List<Pair<String, String>> conn
     }
   }
 
+  public void resetHeartBeatTask(String accountId, String taskId) {
+    connectorHeartbeatService.resetPerpetualTask(accountId, taskId);
+  }
+
   @Override
   public List<ConnectorResponseDTO> listbyFQN(String accountIdentifier, List<String> connectorFQN) {
     if (isEmpty(connectorFQN)) {
diff --git a/440-connector-nextgen/src/main/java/io/harness/connector/impl/NGConnectorSecretManagerServiceImpl.java b/440-connector-nextgen/src/main/java/io/harness/connector/impl/NGConnectorSecretManagerServiceImpl.java
@@ -134,4 +134,14 @@ public void resolveSecretManagerScriptSecrets(String accountIdentifier, String p
         customEncryptor.resolveSecretManagerConfig(accountIdentifier, encryptedDataParamsSet, encryptionConfig);
     encryptionConfig.setScript(script);
   }
+
+  public String getPerpetualTaskId(
+      String accountIdentifier, String orgIdentifier, String projectIdentifier, String identifier) {
+    return connectorService.getHeartbeatPerpetualTaskId(
+        accountIdentifier, orgIdentifier, projectIdentifier, identifier);
+  }
+
+  public void resetHeartBeatTask(String accountId, String taskId) {
+    connectorService.resetHeartBeatTask(accountId, taskId);
+  }
 }
diff --git a/440-connector-nextgen/src/main/java/io/harness/connector/impl/NGVaultServiceImpl.java b/440-connector-nextgen/src/main/java/io/harness/connector/impl/NGVaultServiceImpl.java
@@ -170,6 +170,7 @@ public void renewToken(VaultConnector vaultConnector) {
     if (ngVaultRenewalTaskResponse.isSuccessful()) {
       vaultConnector.setRenewedAt(System.currentTimeMillis());
       connectorRepository.save(vaultConnector, ChangeType.NONE);
+      updatePerpetualTaskWhenTokenIsRenewed(vaultConnector);
     }
   }
 
@@ -242,6 +243,7 @@ public void renewAppRoleClientToken(VaultConnector vaultConnector) {
     }
     vaultConnector.setRenewedAt(System.currentTimeMillis());
     connectorRepository.save(vaultConnector, ChangeType.NONE);
+    updatePerpetualTaskWhenTokenIsRenewed(vaultConnector);
   }
 
   @Override
@@ -833,4 +835,11 @@ private EncryptedRecordData buildEncryptedRecordData(NGEncryptedData encryptedDa
         .base64Encoded(encryptedData.isBase64Encoded())
         .build();
   }
+
+  private void updatePerpetualTaskWhenTokenIsRenewed(VaultConnector vaultConnector) {
+    String heartBeatPerpetualTaskId =
+        ngConnectorSecretManagerService.getPerpetualTaskId(vaultConnector.getAccountIdentifier(),
+            vaultConnector.getOrgIdentifier(), vaultConnector.getProjectIdentifier(), vaultConnector.getIdentifier());
+    ngConnectorSecretManagerService.resetHeartBeatTask(vaultConnector.getAccountIdentifier(), heartBeatPerpetualTaskId);
+  }
 }
diff --git a/440-connector-nextgen/src/main/java/io/harness/connector/services/ConnectorService.java b/440-connector-nextgen/src/main/java/io/harness/connector/services/ConnectorService.java
@@ -35,6 +35,8 @@ String getHeartbeatPerpetualTaskId(
    */
   void resetHeartbeatForReferringConnectors(List<Pair<String, String>> connectorPerpetualTaskInfoList);
 
+  void resetHeartBeatTask(String accountId, String taskId);
+
   boolean checkConnectorExecutableOnDelegate(ConnectorInfoDTO connectorInfo);
 
   boolean markEntityInvalid(String accountIdentifier, EntityReference entityReference, String invalidYaml);
diff --git a/440-connector-nextgen/src/main/java/io/harness/connector/services/NGConnectorSecretManagerService.java b/440-connector-nextgen/src/main/java/io/harness/connector/services/NGConnectorSecretManagerService.java
@@ -30,4 +30,9 @@ default ConnectorDTO getConnectorDTO(
 
   void resolveSecretManagerScriptSecrets(String accountIdentifier, String path,
       CustomSecretNGManagerConfig encryptionConfig, SecretManagerConfigDTO secretManagerConfigDTO);
+
+  String getPerpetualTaskId(
+      String accountIdentifier, String orgIdentifier, String projectIdentifier, String identifier);
+
+  void resetHeartBeatTask(String accountId, String taskId);
 }
diff --git a/440-connector-nextgen/src/test/java/io/harness/connector/impl/NGVaultServiceImplTest.java b/440-connector-nextgen/src/test/java/io/harness/connector/impl/NGVaultServiceImplTest.java
@@ -36,15 +36,19 @@
 import io.harness.connector.ConnectorDTO;
 import io.harness.connector.ConnectorInfoDTO;
 import io.harness.connector.entities.embedded.vaultconnector.VaultConnector;
+import io.harness.connector.mappers.secretmanagermapper.VaultDTOToEntity;
 import io.harness.connector.mappers.secretmanagermapper.VaultEntityToDTO;
 import io.harness.connector.services.NGConnectorSecretManagerService;
+import io.harness.delegate.beans.DelegateMetaInfo;
 import io.harness.delegate.beans.connector.ConnectorType;
 import io.harness.delegate.beans.connector.vaultconnector.VaultConnectorDTO;
 import io.harness.delegate.utils.TaskSetupAbstractionHelper;
 import io.harness.delegatetasks.NGVaultFetchEngineTaskResponse;
 import io.harness.delegatetasks.NGVaultRenewalAppRoleTaskResponse;
 import io.harness.delegatetasks.NGVaultRenewalTaskParameters;
+import io.harness.delegatetasks.NGVaultRenewalTaskResponse;
 import io.harness.encryption.SecretRefData;
+import io.harness.git.model.ChangeType;
 import io.harness.helpers.ext.vault.VaultAppRoleLoginResult;
 import io.harness.ng.core.api.NGEncryptedDataService;
 import io.harness.ng.core.api.SecretCrudService;
@@ -81,6 +85,7 @@
 @OwnedBy(PL)
 public class NGVaultServiceImplTest extends CategoryTest {
   @InjectMocks VaultEntityToDTO vaultEntityToDTO;
+  @InjectMocks VaultDTOToEntity vaultDTOToEntity;
 
   DelegateGrpcClientWrapper delegateService;
   NGConnectorSecretManagerService ngConnectorSecretManagerService;
@@ -285,6 +290,62 @@ public void testProcessAppRole_VaultConfigHasRequiredLoginParams() throws IOExce
         .isEqualTo(String.valueOf(vaultConnectorDTO.getSecretId().getDecryptedValue()));
   }
 
+  @Test
+  @Owner(developers = VIKAS_M)
+  @Category(UnitTests.class)
+  public void testRenewAppRoleClientToken_willUpdateCorrespondingPPT() throws IOException {
+    VaultConnectorDTO vaultConnectorDTO = vaultEntityToDTO.createConnectorDTO(buildAppRoleVaultConnector());
+    vaultConnectorDTO.setRenewAppRoleToken(true);
+    VaultConnector vaultConnector = vaultDTOToEntity.toConnectorEntity(vaultConnectorDTO);
+    VaultConfigDTO vaultConfigDTO = (VaultConfigDTO) getVaultConfigDTOWithAppRoleAuth();
+    vaultConfigDTO.setEncryptionType(VAULT);
+    Call<RestResponse<Boolean>> request = mock(Call.class);
+    doReturn(request).when(accountClient).isFeatureFlagEnabled(any(), any());
+    when(request.execute()).thenReturn(Response.success(new RestResponse<>(false)));
+    when(ngConnectorSecretManagerService.getUsingIdentifier(any(), any(), any(), any(), anyBoolean()))
+        .thenReturn(vaultConfigDTO);
+    when(delegateService.executeSyncTask(any()))
+        .thenReturn(
+            NGVaultRenewalAppRoleTaskResponse.builder()
+                .vaultAppRoleLoginResult(VaultAppRoleLoginResult.builder().clientToken(randomAlphabetic(10)).build())
+                .build());
+    when(ngEncryptedDataService.updateSecretText(any(), any())).thenReturn(NGEncryptedData.builder().build());
+    when(connectorRepository.save(vaultConnector, ChangeType.NONE)).thenReturn(vaultConnector);
+    ngVaultService.renewAppRoleClientToken(vaultConnector);
+    ArgumentCaptor<String> argumentCaptor = ArgumentCaptor.forClass(String.class);
+    verify(ngConnectorSecretManagerService, times(1)).getPerpetualTaskId(any(), any(), any(), argumentCaptor.capture());
+    assertThat(argumentCaptor.getValue()).isEqualTo(vaultConnector.getIdentifier());
+    verify(ngConnectorSecretManagerService, times(1)).resetHeartBeatTask(any(), any());
+  }
+
+  @Test
+  @Owner(developers = VIKAS_M)
+  @Category(UnitTests.class)
+  public void testRenewVaultToken_willUpdateCorrespondingPPT() throws IOException {
+    VaultConnectorDTO vaultConnectorDTO = vaultEntityToDTO.createConnectorDTO(buildTokenBasedConnector());
+    vaultConnectorDTO.setRenewAppRoleToken(true);
+    VaultConnector vaultConnector = vaultDTOToEntity.toConnectorEntity(vaultConnectorDTO);
+    VaultConfigDTO vaultConfigDTO = (VaultConfigDTO) getVaultConfigDTOWithAuthToken();
+    vaultConfigDTO.setEncryptionType(VAULT);
+    Call<RestResponse<Boolean>> request = mock(Call.class);
+    doReturn(request).when(accountClient).isFeatureFlagEnabled(any(), any());
+    when(request.execute()).thenReturn(Response.success(new RestResponse<>(false)));
+    when(ngConnectorSecretManagerService.getUsingIdentifier(any(), any(), any(), any(), anyBoolean()))
+        .thenReturn(vaultConfigDTO);
+    when(delegateService.executeSyncTask(any()))
+        .thenReturn(NGVaultRenewalTaskResponse.builder()
+                        .isSuccessful(true)
+                        .delegateMetaInfo(DelegateMetaInfo.builder().hostName("hostName").id("id").build())
+                        .build());
+    when(ngEncryptedDataService.updateSecretText(any(), any())).thenReturn(NGEncryptedData.builder().build());
+    when(connectorRepository.save(vaultConnector, ChangeType.NONE)).thenReturn(vaultConnector);
+    ngVaultService.renewToken(vaultConnector);
+    ArgumentCaptor<String> argumentCaptor = ArgumentCaptor.forClass(String.class);
+    verify(ngConnectorSecretManagerService, times(1)).getPerpetualTaskId(any(), any(), any(), argumentCaptor.capture());
+    assertThat(argumentCaptor.getValue()).isEqualTo(vaultConnector.getIdentifier());
+    verify(ngConnectorSecretManagerService, times(1)).resetHeartBeatTask(any(), any());
+  }
+
   private VaultConnector buildAppRoleVaultConnector() {
     return VaultConnector.builder()
         .accessType(AccessType.APP_ROLE)
@@ -295,12 +356,22 @@ private VaultConnector buildAppRoleVaultConnector() {
         .build();
   }
 
+  private VaultConnector buildTokenBasedConnector() {
+    return VaultConnector.builder()
+        .accessType(AccessType.TOKEN)
+        .vaultUrl(HTTP_VAULT_URL)
+        .authTokenRef("tokenRef")
+        .namespace(randomAlphabetic(10))
+        .build();
+  }
+
   private SecretManagerConfigDTO getVaultConfigDTOWithAuthToken() {
     String authToken = "authToken";
     String secretEngineName = "secretEngine";
     VaultConfigDTO vaultConfigDTO = VaultConfigDTO.builder().build();
     vaultConfigDTO.setIdentifier(KMS_IDENTIFIER);
     vaultConfigDTO.setVaultUrl(HTTP_VAULT_URL);
+    vaultConfigDTO.setName(CONNECTOR_NAME);
     vaultConfigDTO.setAuthToken(authToken);
     vaultConfigDTO.setSecretEngineName(secretEngineName);
     vaultConfigDTO.setUseVaultAgent(false);
@@ -309,6 +380,20 @@ private SecretManagerConfigDTO getVaultConfigDTOWithAuthToken() {
     return vaultConfigDTO;
   }
 
+  private SecretManagerConfigDTO getVaultConfigDTOWithAppRoleAuth() {
+    String secretEngineName = "secretEngine";
+    VaultConfigDTO vaultConfigDTO = VaultConfigDTO.builder().build();
+    vaultConfigDTO.setIdentifier(KMS_IDENTIFIER);
+    vaultConfigDTO.setName(CONNECTOR_NAME);
+    vaultConfigDTO.setVaultUrl(HTTP_VAULT_URL);
+    vaultConfigDTO.setAppRoleId("test-role-id");
+    vaultConfigDTO.setSecretEngineName(secretEngineName);
+    vaultConfigDTO.setUseVaultAgent(false);
+    vaultConfigDTO.setUseK8sAuth(false);
+    vaultConfigDTO.setUseAwsIam(false);
+    return vaultConfigDTO;
+  }
+
   private void setUpCommonMocks() throws IOException {
     when(ngEncryptedDataService.get(any(), any(), any(), any())).thenReturn(NGEncryptedData.builder().build());
     when(ngEncryptorService.fetchSecretValue(any(), any(), any())).thenReturn(randomAlphabetic(10).toCharArray());

Original file line number	Diff line number	Diff line change
`@@ -1036,6 +1036,10 @@ public void resetHeartbeatForReferringConnectors(List<Pair<String, String>> conn`
`1036`	`1036`	`}`
`1037`	`1037`	`}`
`1038`	`1038`
	`1039`	`+ public void resetHeartBeatTask(String accountId, String taskId) {`
	`1040`	`+ connectorHeartbeatService.resetPerpetualTask(accountId, taskId);`
	`1041`	`+ }`
	`1042`	`+`
`1039`	`1043`	`@Override`
`1040`	`1044`	`public List<ConnectorResponseDTO> listbyFQN(String accountIdentifier, List<String> connectorFQN) {`
`1041`	`1045`	`if (isEmpty(connectorFQN)) {`
Original file line number	Diff line number	Diff line change
`@@ -170,6 +170,7 @@ public void renewToken(VaultConnector vaultConnector) {`
`170`	`170`	`if (ngVaultRenewalTaskResponse.isSuccessful()) {`
`171`	`171`	`vaultConnector.setRenewedAt(System.currentTimeMillis());`
`172`	`172`	`connectorRepository.save(vaultConnector, ChangeType.NONE);`
	`173`	`+ updatePerpetualTaskWhenTokenIsRenewed(vaultConnector);`
`173`	`174`	`}`
`174`	`175`	`}`
`175`	`176`
`@@ -242,6 +243,7 @@ public void renewAppRoleClientToken(VaultConnector vaultConnector) {`
`242`	`243`	`}`
`243`	`244`	`vaultConnector.setRenewedAt(System.currentTimeMillis());`
`244`	`245`	`connectorRepository.save(vaultConnector, ChangeType.NONE);`
	`246`	`+ updatePerpetualTaskWhenTokenIsRenewed(vaultConnector);`
`245`	`247`	`}`
`246`	`248`
`247`	`249`	`@Override`
`@@ -833,4 +835,11 @@ private EncryptedRecordData buildEncryptedRecordData(NGEncryptedData encryptedDa`
`833`	`835`	`.base64Encoded(encryptedData.isBase64Encoded())`
`834`	`836`	`.build();`
`835`	`837`	`}`
	`838`	`+`
	`839`	`+ private void updatePerpetualTaskWhenTokenIsRenewed(VaultConnector vaultConnector) {`
	`840`	`+ String heartBeatPerpetualTaskId =`
	`841`	`+ ngConnectorSecretManagerService.getPerpetualTaskId(vaultConnector.getAccountIdentifier(),`
	`842`	`+ vaultConnector.getOrgIdentifier(), vaultConnector.getProjectIdentifier(), vaultConnector.getIdentifier());`
	`843`	`+ ngConnectorSecretManagerService.resetHeartBeatTask(vaultConnector.getAccountIdentifier(), heartBeatPerpetualTaskId);`
	`844`	`+ }`
`836`	`845`	`}`
Original file line number	Diff line number	Diff line change
`@@ -30,4 +30,9 @@ default ConnectorDTO getConnectorDTO(`
`30`	`30`
`31`	`31`	`void resolveSecretManagerScriptSecrets(String accountIdentifier, String path,`
`32`	`32`	`CustomSecretNGManagerConfig encryptionConfig, SecretManagerConfigDTO secretManagerConfigDTO);`
	`33`	`+`
	`34`	`+ String getPerpetualTaskId(`
	`35`	`+ String accountIdentifier, String orgIdentifier, String projectIdentifier, String identifier);`
	`36`	`+`
	`37`	`+ void resetHeartBeatTask(String accountId, String taskId);`
`33`	`38`	`}`