Experimental: Higher level VaultClient

core/src/main/scala/com/banno/vault/Vault.scala

@@ -219,16 +219,9 @@ object Vault {
                                                 (roleId: String, secretPath: String, duration: FiniteDuration, waitInterval: FiniteDuration): Stream[F, A] =
     Stream.eval(login(client, vaultUri)(roleId)).flatMap(token => keepLoginAndSecretLeased[F, A](client, vaultUri)(token, secretPath, duration, waitInterval))
 
-  /**
-    * This function logs into the Vault server given by the vaultUri, to obtain a loginToken.
-    *  It then also provides a Stream that continuously renews the token when it is about to finish.
-    *  - keeps the token constantly renewed
-    *  - Upon termination of the Stream (from the using application) revokes the token.
-    *    However, any error on revoking the token is ignored.
-    */
-  def keepLoginRenewed[F[_]](client: Client[F], vaultUri: Uri)
+  def tokenStream[F[_]](client: Client[F], vaultUri: Uri)
                                 (token: VaultToken, tokenLeaseExtension: FiniteDuration)
-                                (implicit T: Temporal[F]): Stream[F, String] = {
+                                (implicit T: Temporal[F]): Stream[F, VaultToken] = {
 
     def renewOnDuration(token: VaultToken): F[VaultToken] = {
       val waitInterval: Long =
@@ -248,10 +241,21 @@ object Vault {
     def cleanup(token: VaultToken): F[Unit] = revokeSelfToken(client, vaultUri)(token).handleError(_ => ())
 
     Stream.bracket(token.pure[F])(cleanup).flatMap { token =>
-      Stream.emit(token.clientToken).concurrently(keep(token))
+      Stream.emit(token).concurrently(keep(token))
     }
   }
 
+  /**
+    * This function logs into the Vault server given by the vaultUri, to obtain a loginToken.
+    *  It then also provides a Stream that continuously renews the token when it is about to finish.
+    *  - keeps the token constantly renewed
+    *  - Upon termination of the Stream (from the using application) revokes the token.
+    *    However, any error on revoking the token is ignored.
+    */
+  def keepLoginRenewed[F[_]](client: Client[F], vaultUri: Uri)
+                                (token: VaultToken, tokenLeaseExtension: FiniteDuration)(implicit T: Temporal[F]): Stream[F, String] =
+    tokenStream(client, vaultUri)(token, tokenLeaseExtension).map(_.clientToken)
+
   def loginAndKeep[F[_]: Async](client: Client[F], vaultUri: Uri)
                                 (roleId: String, tokenLeaseExtension: FiniteDuration): Stream[F, String] =
     Stream.eval(login(client, vaultUri)(roleId)).flatMap(token => keepLoginRenewed[F](client, vaultUri)(token, tokenLeaseExtension))

core/src/main/scala/com/banno/vault/VaultClient.scala

@@ -0,0 +1,41 @@
+package com.banno.vault
+
+import cats.effect.kernel.{Concurrent, Ref, Resource, Temporal}
+import cats.effect.syntax.all._
+import com.banno.vault.models._
+import io.circe.Decoder
+import org.http4s.Uri
+import org.http4s.client.Client
+import scala.concurrent.duration.FiniteDuration
+
+trait VaultClient[F[_]] {
+  def readSecret[A: Decoder](secretPath: String): F[VaultSecret[A]]
+}
+
+object VaultClient {
+  def apply[F[_]](implicit ev: VaultClient[F]): VaultClient[F] = ev
+
+  def login[F[_]](client: Client[F], vaultUri: Uri, roleId: String, tokenLeaseExtension: FiniteDuration)
+    (implicit F: Temporal[F]): Resource[F, VaultClient[F]] = {
+
+    def startRenewalStream(ref: Ref[F, VaultToken], token: VaultToken) =
+      Vault.tokenStream(client, vaultUri)(token, tokenLeaseExtension)
+        .evalMap(newToken => ref.set(newToken))
+        .compile
+        .drain
+        .start
+
+    for {
+      token <- Resource.make(Vault.login[F](client, vaultUri)(roleId))(Vault.revokeSelfToken(client, vaultUri))
+      tokenRef <- Resource.eval(Ref.of(token))
+      _ <- Resource.make(startRenewalStream(tokenRef, token))(_.cancel)
+    } yield impl(client, vaultUri, token)
+  }
+
+  private def impl[F[_]: Concurrent](client: Client[F], vaultUri: Uri, tokenRef: Ref[F, VaultToken]): VaultClient[F] =
+    new VaultClient[F] {
+      def readSecret[A: Decoder](secretPath: String): F[VaultSecret[A]] =
+        tokenRef.get.flatMap(token =>
+          Vault.readSecret(client, vaultUri)(token.clientToken, secretPath))
+    }
+}