Repository: hashicorp/vault
File: vault/logical_system.go (Go)

Code before:
	pluginVersion, builtin, err := getVersion(d)
	if err != nil {
		return logical.ErrorResponse(err.Error()), nil
	}
	if builtin {
		return logical.ErrorResponse("version %q is not allowed because 'builtin' is a reserved metadata identifier", pluginVersion), nil
	}

	sha256 := d.Get("sha256").(string)
	if sha256 == "" {
		sha256 = d.Get("sha_256").(string)
	}

	if sha256 == "" && pluginVersion == "" {
		return logical.ErrorResponse("must provide at least one of sha256 or version: use sha256 for binary registration (version optional) or version only for artifact registration"), nil
	}

	if resp := validateSha256IsEmptyForEntPluginVersion(pluginVersion, sha256); resp.IsError() {
		return resp, nil
	}

	command := d.Get("command").(string)
	ociImage := d.Get("oci_image").(string)
	var resp logical.Response

	if sha256 == "" {
		if command != "" {
			resp.AddWarning(fmt.Sprintf("When sha256 is unspecified, a plugin artifact is expected for registration and the command parameter %q will be ignored.", command))
		}
	} else {
		if command == "" && ociImage == "" {
			return logical.ErrorResponse("must provide at least one of command or oci_image"), nil
		}
	}

	if ociImage == "" {
		if err = b.Core.CheckPluginPerms(command); err != nil {
			return nil, err
		}
	}

	pluginRuntime := d.Get("runtime").(string)
	if ociImage != "" {
		if runtime.GOOS != "linux" {
			return logical.ErrorResponse("specifying oci_image is currently only supported on Linux"), nil
		}
		if pluginRuntime != "" {
			_, err := b.Core.pluginRuntimeCatalog.Get(ctx, pluginRuntime, consts.PluginRuntimeTypeContainer)
			if err != nil {
				return logical.ErrorResponse("specified plugin runtime %q, but failed to retrieve config: %w", pluginRuntime, err), nil
			}

Review comment (suggestion):
Ideally these parameter constraints would be handled by the Vault server API. The vault client could just pass in everything that it got from the command line to Vault and the Vault server would do the parameter checks, returning any errors to the vault client. This is not a blocker, but something to consider for the future, especially since the Vault client may be connecting to some version of Vault that does support plugin artifacts, etc.

Code after:
	pluginVersion, builtin, err := getVersion(d)
	if err != nil {
		return logical.ErrorResponse(err.Error()), nil
	}
	if builtin {
		return logical.ErrorResponse("version %q is not allowed because 'builtin' is a reserved metadata identifier", pluginVersion), nil
	}

	sha256 := d.Get("sha256").(string)
	if sha256 == "" {
		sha256 = d.Get("sha_256").(string)
	}

	if sha256 == "" && pluginVersion == "" {
		return logical.ErrorResponse("must provide at least one of sha256 or version: use sha256 for binary registration (version optional) or version only for artifact registration"), nil
	}

	if resp := validateSha256IsEmptyForEntPluginVersion(pluginVersion, sha256); resp.IsError() {
		return resp, nil
	}

	command := d.Get("command").(string)
	ociImage := d.Get("oci_image").(string)
	var resp logical.Response

	if sha256 == "" && command != "" {
		resp.AddWarning(fmt.Sprintf("When sha256 is unspecified, a plugin artifact is expected for registration and the command parameter %q will be ignored.", command))
	} else if sha256 != "" && (command == "" && ociImage == "") {
		return logical.ErrorResponse("must provide at least one of command or oci_image"), nil
	}

	if ociImage == "" {
		if err = b.Core.CheckPluginPerms(command); err != nil {
			return nil, err
		}
	}

	pluginRuntime := d.Get("runtime").(string)
	if ociImage != "" {
		if runtime.GOOS != "linux" {
			return logical.ErrorResponse("specifying oci_image is currently only supported on Linux"), nil
		}
		if pluginRuntime != "" {
			_, err := b.Core.pluginRuntimeCatalog.Get(ctx, pluginRuntime, consts.PluginRuntimeTypeContainer)
			if err != nil {
				return logical.ErrorResponse("specified plugin runtime %q, but failed to retrieve config: %w", pluginRuntime, err), nil
			}
		}
	}

	// For backwards compatibility, also accept args as part of command. Don't