vault/command/capabilities.go

package command

import (
	"fmt"
	"strings"

	"github.com/hashicorp/vault/meta"
)

// CapabilitiesCommand is a Command that enables a new endpoint.
type CapabilitiesCommand struct {
	meta.Meta
}

func (c *CapabilitiesCommand) Run(args []string) int {
	flags := c.Meta.FlagSet("capabilities", meta.FlagSetDefault)
	flags.Usage = func() { c.Ui.Error(c.Help()) }
	if err := flags.Parse(args); err != nil {
		return 1
	}

	args = flags.Args()
	if len(args) > 2 {
		flags.Usage()
		c.Ui.Error(fmt.Sprintf(
			"\ncapabilities expects at most two arguments"))
		return 1
	}

	var token string
	var path string
	switch {
	case len(args) == 1:
		path = args[0]
	case len(args) == 2:
		token = args[0]
		path = args[1]
	default:
		flags.Usage()
		c.Ui.Error(fmt.Sprintf("\ncapabilities expects at least one argument"))
		return 1
	}

	client, err := c.Client()
	if err != nil {
		c.Ui.Error(fmt.Sprintf(
			"Error initializing client: %s", err))
		return 2
	}

	var capabilities []string
	if token == "" {
		capabilities, err = client.Sys().CapabilitiesSelf(path)
	} else {
		capabilities, err = client.Sys().Capabilities(token, path)
	}
	if err != nil {
		c.Ui.Error(fmt.Sprintf(
			"Error retrieving capabilities: %s", err))
		return 1
	}

	c.Ui.Output(fmt.Sprintf("Capabilities: %s", capabilities))
	return 0
}

func (c *CapabilitiesCommand) Synopsis() string {
	return "Fetch the capabilities of a token on a given path"
}

func (c *CapabilitiesCommand) Help() string {
	helpText := `
Usage: vault capabilities [options] [token] path

  Fetch the capabilities of a token on a given path.
  If a token is provided as an argument, the '/sys/capabilities' endpoint will be invoked
  with the given token; otherwise the '/sys/capabilities-self' endpoint will be invoked
  with the client token.

  If a token does not have any capability on a given path, or if any of the policies
  belonging to the token explicitly have ["deny"] capability, or if the argument path
  is invalid, this command will respond with a ["deny"].

General Options:
` + meta.GeneralOptionsUsage()
	return strings.TrimSpace(helpText)
}