157 vault_record fixes

v1/Application.cfc

@@ -51,7 +51,7 @@
 		
 		//variables.framework.docs={};
 		variables.framework.docs.APIName="svc-api";
-		variables.framework.docs.APIVersion="0.156";   /*$ git config --global --unset user.password*/
+		variables.framework.docs.APIVersion="0.157";   /*$ git config --global --unset user.password*/
 		
 		variables.framework.globalHeaders = structNew();
 		variables.framework.globalHeaders["Access-Control-Expose-Headers"] = "Location"; 

v1/resources/vault_record.cfc

@@ -21,6 +21,8 @@
 		<cfset var local={}/>
 		<cfset local.vaultData={}/>
 		
+		<!--- *** Добавить проверку, что секрет перечислен в fields - стало быть, доступен пользователю --->
+		
 		<!--- тут необходимо проконтролировать, что мы смотрим не чужие данные --->
 		<!--- в других местах мы молча возврашаем пустой резалтсет на запрос чужих данных --->
 		<!--- варианты: 403, 404, пустой набор данных --->
@@ -45,26 +47,40 @@
 			limit 1
 		</cfquery>
 		
+		<cfif local.qCurrentState.recordCount EQ 0>
+			<cfreturn representationOf("Cannot find instance current state or no permission to view").withStatus(404)/>
+		</cfif>
+		
+		<cfif len(local.qCurrentState.instance_data) EQ 0>
+			<cfreturn representationOf("Instance current state is empty").withStatus(404)/>
+		</cfif>
+		
+		<!--- <cfdump var=#local.qCurrentState#/><cfabort/> --->
+		
 		<cftry>		
-			<cfset vaultUrl=""/>
-			<cfset instanceData="#deserializeJson(local.qCurrentState.instance_data)#"/>
+			<cfset var vaultUrl=""/>
+			<cfset var instanceData=#deserializeJson(local.qCurrentState.instance_data)#/>
 			<cfif structKeyExists(instanceData,"vaultUrl")>
 				<cfset vaultUrl=instanceData.vaultUrl/>	<!--- v001 --->
 			<cfelseif structKeyExists(instanceData,"vault")>
 				<cfset vaultUrl=instanceData.vault.Url/><!--- v002 --->	
 			</cfif>
 			
-			<!--- *** вынести URL в конфиг --->
 			<cfhttp method="post" 
 				url="#request.vault_login_url#" 
 				timeout="3"
 				charset="utf-8"	
-				result="res"
+				result="local.res"
 			>
 				<cfhttpparam type="HEADER" name="User-Agent" value="#request.USER_AGENT#"/>
 				<cfhttpparam type="BODY" value='{"role_id":"#request.vault_role_id#","secret_id":"#request.vault_secret_id#"}'/>
 			</cfhttp>
-			<cfset resData=#deserializeJson(res.filecontent)#/>
+			
+			<cfif local.res.status_code NEQ 200>
+				<cfreturn representationOf(local.res).withStatus(422)/>
+			</cfif>
+			
+			<cfset resData=#deserializeJson(local.res.filecontent)#/>
 			<cfset client_token=#resData.auth.client_token#/>	
 			
 			<cftry>	
@@ -78,12 +94,18 @@
 				</cfhttp>
 				
 				<!--- *** костыль для перехода от формата v001 к v002 --->				
-				<cfif structKeyExists(instanceData,"vault")>					
+				<cfif structKeyExists(instanceData,"vault") 
+						AND structKeyExists(instanceData.vault,"fields") 
+						AND listFind(instanceData.vault.fields, arguments.secretName)>					
 					<cfset "local.tempVaultData" = #deserializeJson(cred.filecontent).data.data#/>
+					<cfif !structKeyExists(local.tempVaultData, arguments.secretName)>
+						<cfreturn representationOf("Secret is declared but does not exist").withStatus(404)/>
+					</cfif>
 					<cfset "local.vaultData" = local.tempVaultData[arguments.secretName]/>
-<!--- 				<cfelse>
-					<cfset "local.vaultData" = #deserializeJson(cred.filecontent).data.data#/> --->
+				<cfelse>
+					<cfreturn representationOf("Secret not found or no permission to view").withStatus(404)/>
 				</cfif>
+
 				
 				<cfcatch type="ANY">
 					<cfreturn representationOf(cfcatch).withStatus(500)/>