jenkinsci / hashicorp-vault-plugin

Jenkins plugin to populate environment variables from secrets stored in HashiCorp's Vault.
https://plugins.jenkins.io/hashicorp-vault-plugin/
MIT License
217 stars 143 forks source link

withVault prints "Access denied to Vault Secrets at " for 403 rather than raise an exception #303

Open AGiantSquid opened 1 year ago

AGiantSquid commented 1 year ago

Jenkins and plugins versions report

360.v0a_1c04cf807d

What Operating System are you using (both controller, and any agents involved in the problem)?

linux

Reproduction steps

get a 403 response for a secret

Expected Results

plugin should raise an exception

Actual Results

jenkins prints error, but proceeds with build

Anything else?

If the plugin gets a 403, it returns true from responseHasErrors: https://github.com/jenkinsci/hashicorp-vault-plugin/blob/master/src/main/java/com/datapipe/jenkins/vault/VaultAccessor.java#L231

The check for responseHasErrors just continues if the response is invalid: https://github.com/jenkinsci/hashicorp-vault-plugin/blob/master/src/main/java/com/datapipe/jenkins/vault/VaultAccessor.java#L170

Conversely, The plugin can throw an exception for a 404: https://github.com/jenkinsci/hashicorp-vault-plugin/blob/master/src/main/java/com/datapipe/jenkins/vault/VaultAccessor.java#L234

The plugin should raise a Forbidden exception alerting the user that they are unauthorized to get the credentials their build requires similar to how it will raise for a 404.