Function createVaultClient

libs/@local/hash-backend-utils/src/vault.ts:353–409

({ logger }: { logger: Logger })

}

export const createVaultClient = async ({ logger }: { logger: Logger }) => {
  if (
    !process.env.HASH_VAULT_HOST ||
    !process.env.HASH_VAULT_PORT ||
    !process.env.HASH_VAULT_MOUNT_PATH
  ) {
    logger.info(
      "No HASH_VAULT_HOST, HASH_VAULT_PORT, or HASH_VAULT_MOUNT_PATH provided, skipping Vault client creation",
    );
    return undefined;
  }

  const secretMountPath = normalizeVaultMountPath(
    process.env.HASH_VAULT_MOUNT_PATH,
  );
  if (!secretMountPath) {
    logger.error(
      `Invalid HASH_VAULT_MOUNT_PATH "${process.env.HASH_VAULT_MOUNT_PATH}": must contain only alphanumeric characters, underscores, hyphens, and periods (hyphens/periods not at start/end)`,
    );
    return undefined;
  }

  if (!process.env.HASH_VAULT_ROOT_TOKEN) {
    logger.info("No Vault root token provided, attempting IAM auth");

    try {
      const login = await loginToVaultViaIam({
        vaultAddr: `${process.env.HASH_VAULT_HOST}:${process.env.HASH_VAULT_PORT}`,
        logger,
      });

      logger.info("Successfully logged in to Vault via IAM");

      return new VaultClient({
        endpoint: `${process.env.HASH_VAULT_HOST}:${process.env.HASH_VAULT_PORT}`,
        token: login.client_token,
        logger,
        secretMountPath,
      });
    } catch (error) {
      logger.error("Failed to login to Vault via IAM", { error });

      return undefined;
    }
  }

  logger.info(
    "Creating Vault client with HASH_VAULT_ROOT_TOKEN from environment",
  );

  return new VaultClient({
    endpoint: `${process.env.HASH_VAULT_HOST}:${process.env.HASH_VAULT_PORT}`,
    token: process.env.HASH_VAULT_ROOT_TOKEN,
    logger,
    secretMountPath,
  });
};