VAULT-19237 Add mount_type to secret response

api/secret.go

@@ -42,6 +42,10 @@ type Secret struct {
 	// cubbyhole of the given token (which has a TTL of the given number of
 	// seconds)
 	WrapInfo *SecretWrapInfo `json:"wrap_info,omitempty"`
+
+	// MountType, if non-empty, provides some information about what kind
+	// of mount this secret came from.
+	MountType string `json:"mount_type,omitempty"`
 }
 
 // TokenID returns the standardized token ID (token) for the given secret.

builtin/credential/approle/path_role_test.go

@@ -923,7 +923,7 @@ func TestAppRoleSecretIDLookup(t *testing.T) {
 	expected := &logical.Response{
 		Data: map[string]interface{}{
 			"http_content_type": "application/json",
-			"http_raw_body":     `{"request_id":"","lease_id":"","renewable":false,"lease_duration":0,"data":{"error":"failed to find accessor entry for secret_id_accessor: \"invalid\""},"wrap_info":null,"warnings":null,"auth":null}`,
+			"http_raw_body":     `{"request_id":"","lease_id":"","renewable":false,"lease_duration":0,"data":{"error":"failed to find accessor entry for secret_id_accessor: \"invalid\""},"wrap_info":null,"warnings":null,"auth":null,"mount_type":""}`,
 			"http_status_code":  404,
 		},
 	}

changelog/23047.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: added new API field to Vault responses, `mount_type`, returning mount information (e.g. `kv` for KVV1/KVV2) for mount when appropriate.
+```

http/handler_test.go

@@ -403,6 +403,7 @@ func TestSysMounts_headerAuth(t *testing.T) {
 		"lease_duration": json.Number("0"),
 		"wrap_info":      nil,
 		"warnings":       nil,
+		"mount_type":     "system",
 		"auth":           nil,
 		"data": map[string]interface{}{
 			"secret/": map[string]interface{}{
@@ -591,8 +592,9 @@ func TestSysMounts_headerAuth_Wrapped(t *testing.T) {
 		"wrap_info": map[string]interface{}{
 			"ttl": json.Number("60"),
 		},
-		"warnings": nil,
-		"auth":     nil,
+		"warnings":   nil,
+		"auth":       nil,
+		"mount_type": "",
 	}
 
 	testResponseStatus(t, resp, 200)

http/logical_test.go

@@ -64,9 +64,10 @@ func TestLogical(t *testing.T) {
 		"data": map[string]interface{}{
 			"data": "bar",
 		},
-		"auth":      nil,
-		"wrap_info": nil,
-		"warnings":  nilWarnings,
+		"auth":       nil,
+		"wrap_info":  nil,
+		"warnings":   nilWarnings,
+		"mount_type": "kv",
 	}
 	testResponseStatus(t, resp, 200)
 	testResponseBody(t, resp, &actual)
@@ -181,9 +182,10 @@ func TestLogical_StandbyRedirect(t *testing.T) {
 			"entity_id":        "",
 			"type":             "service",
 		},
-		"warnings":  nilWarnings,
-		"wrap_info": nil,
-		"auth":      nil,
+		"warnings":   nilWarnings,
+		"wrap_info":  nil,
+		"auth":       nil,
+		"mount_type": "token",
 	}
 
 	testResponseStatus(t, resp, 200)
@@ -222,6 +224,7 @@ func TestLogical_CreateToken(t *testing.T) {
 		"renewable":      false,
 		"lease_duration": json.Number("0"),
 		"data":           nil,
+		"mount_type":     "token",
 		"wrap_info":      nil,
 		"auth": map[string]interface{}{
 			"policies":        []interface{}{"root"},
@@ -465,12 +468,12 @@ func TestLogical_RespondWithStatusCode(t *testing.T) {
 		t.Fatalf("Bad Status code: %d", w.Code)
 	}
 
-	bodyRaw, err := ioutil.ReadAll(w.Body)
+	bodyRaw, err := io.ReadAll(w.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	expected := `{"request_id":"id","lease_id":"","renewable":false,"lease_duration":0,"data":{"test-data":"foo"},"wrap_info":null,"warnings":null,"auth":null}`
+	expected := `{"request_id":"id","lease_id":"","renewable":false,"lease_duration":0,"data":{"test-data":"foo"},"wrap_info":null,"warnings":null,"auth":null,"mount_type":""}`
 
 	if string(bodyRaw[:]) != strings.Trim(expected, "\n") {
 		t.Fatalf("bad response: %s", string(bodyRaw[:]))

http/sys_audit_test.go

@@ -32,6 +32,7 @@ func TestSysAudit(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"noop/": map[string]interface{}{
 				"path":        "noop/",
@@ -83,6 +84,7 @@ func TestSysDisableAudit(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data":           map[string]interface{}{},
 	}
 
@@ -117,6 +119,7 @@ func TestSysAuditHash(t *testing.T) {
 		"renewable":      false,
 		"lease_duration": json.Number("0"),
 		"wrap_info":      nil,
+		"mount_type":     "system",
 		"warnings":       nil,
 		"auth":           nil,
 		"data": map[string]interface{}{

http/sys_auth_test.go

@@ -31,6 +31,7 @@ func TestSysAuth(t *testing.T) {
 		"renewable":      false,
 		"lease_duration": json.Number("0"),
 		"wrap_info":      nil,
+		"mount_type":     "system",
 		"warnings":       nil,
 		"auth":           nil,
 		"data": map[string]interface{}{
@@ -115,6 +116,7 @@ func TestSysEnableAuth(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"foo/": map[string]interface{}{
 				"description":             "foo",
@@ -236,6 +238,7 @@ func TestSysDisableAuth(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"token/": map[string]interface{}{
 				"config": map[string]interface{}{
@@ -326,6 +329,7 @@ func TestSysTuneAuth_nonHMACKeys(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":                  "token based credentials",
 			"default_lease_ttl":            json.Number("2764800"),
@@ -371,6 +375,7 @@ func TestSysTuneAuth_nonHMACKeys(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "token based credentials",
 			"default_lease_ttl": json.Number("2764800"),
@@ -409,6 +414,7 @@ func TestSysTuneAuth_showUIMount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "token based credentials",
 			"default_lease_ttl": json.Number("2764800"),
@@ -447,6 +453,7 @@ func TestSysTuneAuth_showUIMount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":        "token based credentials",
 			"default_lease_ttl":  json.Number("2764800"),
@@ -513,6 +520,7 @@ func TestSysRemountAuth(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"bar/": map[string]interface{}{
 				"description":             "foo",

http/sys_config_cors_test.go

@@ -59,6 +59,7 @@ func TestSysConfigCors(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"enabled":         true,
 			"allowed_origins": []interface{}{addr},

http/sys_config_state_test.go

@@ -190,6 +190,7 @@ func TestSysConfigState_Sanitized(t *testing.T) {
 				"warnings":       nil,
 				"auth":           nil,
 				"data":           configResp,
+				"mount_type":     "system",
 			}
 
 			testResponseBody(t, resp, &actual)

http/sys_internal_test.go

@@ -33,6 +33,7 @@ func TestSysInternal_UIMounts(t *testing.T) {
 			"auth":   map[string]interface{}{},
 			"secret": map[string]interface{}{},
 		},
+		"mount_type": "",
 	}
 	testResponseBody(t, resp, &actual)
 	expected["request_id"] = actual["request_id"]
@@ -62,6 +63,7 @@ func TestSysInternal_UIMounts(t *testing.T) {
 		"auth":           nil,
 		"lease_id":       "",
 		"renewable":      false,
+		"mount_type":     "",
 		"lease_duration": json.Number("0"),
 		"data": map[string]interface{}{
 			"secret": map[string]interface{}{

http/sys_mount_test.go

@@ -34,6 +34,7 @@ func TestSysMounts(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"secret/": map[string]interface{}{
 				"description":             "key/value secret storage",
@@ -215,6 +216,7 @@ func TestSysMount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"foo/": map[string]interface{}{
 				"description":             "foo",
@@ -529,6 +531,7 @@ func TestSysRemount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"bar/": map[string]interface{}{
 				"description":             "foo",
@@ -742,6 +745,7 @@ func TestSysUnmount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"secret/": map[string]interface{}{
 				"description":             "key/value secret storage",
@@ -930,6 +934,7 @@ func TestSysTuneMount_Options(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "foo",
 			"default_lease_ttl": json.Number("2764800"),
@@ -968,6 +973,7 @@ func TestSysTuneMount_Options(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "foo",
 			"default_lease_ttl": json.Number("2764800"),
@@ -1009,6 +1015,7 @@ func TestSysTuneMount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"foo/": map[string]interface{}{
 				"description":             "foo",
@@ -1248,6 +1255,7 @@ func TestSysTuneMount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"foo/": map[string]interface{}{
 				"description":             "foo",
@@ -1446,6 +1454,7 @@ func TestSysTuneMount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "foo",
 			"default_lease_ttl": json.Number("259196400"),
@@ -1484,6 +1493,7 @@ func TestSysTuneMount(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "foobar",
 			"default_lease_ttl": json.Number("40"),
@@ -1581,6 +1591,7 @@ func TestSysTuneMount_nonHMACKeys(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":                  "key/value secret storage",
 			"default_lease_ttl":            json.Number("2764800"),
@@ -1627,6 +1638,7 @@ func TestSysTuneMount_nonHMACKeys(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "key/value secret storage",
 			"default_lease_ttl": json.Number("2764800"),
@@ -1665,6 +1677,7 @@ func TestSysTuneMount_listingVisibility(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "key/value secret storage",
 			"default_lease_ttl": json.Number("2764800"),
@@ -1702,6 +1715,7 @@ func TestSysTuneMount_listingVisibility(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":        "key/value secret storage",
 			"default_lease_ttl":  json.Number("2764800"),
@@ -1748,6 +1762,7 @@ func TestSysTuneMount_passthroughRequestHeaders(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":                 "key/value secret storage",
 			"default_lease_ttl":           json.Number("2764800"),
@@ -1787,6 +1802,7 @@ func TestSysTuneMount_passthroughRequestHeaders(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "key/value secret storage",
 			"default_lease_ttl": json.Number("2764800"),
@@ -1831,6 +1847,7 @@ func TestSysTuneMount_allowedManagedKeys(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":          "key/value secret storage",
 			"default_lease_ttl":    json.Number("2764800"),
@@ -1870,6 +1887,7 @@ func TestSysTuneMount_allowedManagedKeys(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"description":       "key/value secret storage",
 			"default_lease_ttl": json.Number("2764800"),

http/sys_policy_test.go

@@ -27,6 +27,7 @@ func TestSysPolicies(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"policies": []interface{}{"default", "root"},
 			"keys":     []interface{}{"default", "root"},
@@ -58,6 +59,7 @@ func TestSysReadPolicy(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"name":  "root",
 			"rules": "",
@@ -94,6 +96,7 @@ func TestSysWritePolicy(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"policies": []interface{}{"default", "foo", "root"},
 			"keys":     []interface{}{"default", "foo", "root"},
@@ -143,6 +146,7 @@ func TestSysDeletePolicy(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"policies": []interface{}{"default", "root"},
 			"keys":     []interface{}{"default", "root"},

http/sys_rotate_test.go

@@ -30,6 +30,7 @@ func TestSysRotate(t *testing.T) {
 		"wrap_info":      nil,
 		"warnings":       nil,
 		"auth":           nil,
+		"mount_type":     "system",
 		"data": map[string]interface{}{
 			"term": json.Number("2"),
 		},