release: v1.32.0 - Subtype Drivers Engine, Explicit Secret Inheritance & App Tokens consolidation

nodejs/utils/agent_manager.js

@@ -290,6 +290,15 @@ class AgentManager {
     };
   }
 
+  // Find connected/enrolled agent bound to a resource ID.
+  async getAgentForResource(resourceId) {
+    if (!resourceId) return null;
+    const rows = await Agent.list().catch(() => []);
+    const agent = rows.find(a => a.resourceId === resourceId);
+    if (!agent) return null;
+    return agent.toPublic(this.liveState(agent.id));
+  }
+
   // Every enrolled agent, connected or not.
   async listAgents() {
     const rows = await Agent.list();

nodejs/utils/ui.js

@@ -43,8 +43,6 @@ module.exports = {
 		{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin', 'admin']},
 		{href: '/conf', icon: 'fas fa-cogs', label: 'Configuration', groups: ['app_sso_admin']},
 		{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
-		// Vault requires login - per-user secrets at secret/users/<uid>/*.
-		{href: '/vault', icon: 'fa-solid fa-vault', label: 'Vault', groups: ['login']},
 		{href: '/overview', icon: 'fa-solid fa-gauge-high', label: 'Overview', groups: ['app_sso_admin', 'admin']},
 	],
 };

nodejs/utils/vault_broker.js

@@ -72,16 +72,20 @@ async function bao(method, path, body) {
 // overwrite, so this is safe to call on every token fetch — edits (e.g. adding a
 // grant) propagate immediately because OpenBao parses policy content at use.
 async function ensurePolicy(name, hcl) {
-	const existing = await baoConf.request('GET', `sys/policies/acl/${name}`);
-	if (existing.status !== 200 && existing.status !== 404) {
-		const t = await existing.text().catch(() => '');
-		throw new Error(`OpenBao policy read ${name} failed (${existing.status}) ${t}`);
+	try {
+		const existing = await baoConf.request('GET', `sys/policies/acl/${name}`);
+		if (existing.status === 200) {
+			const body = await existing.json().catch(() => null);
+			if (body && typeof body.policy === 'string' && body.policy.trim() === hcl.trim()) return; // unchanged
+		}
+	} catch (e) {
+		console.warn(`[VaultBroker] policy GET ${name} warning:`, e.message);
 	}
-	if (existing.status === 200) {
-		const body = await existing.json().catch(() => null);
-		if (body && typeof body.policy === 'string' && body.policy === hcl) return; // unchanged
+	try {
+		await bao('PUT', `sys/policies/acl/${name}`, { policy: hcl });
+	} catch (err) {
+		console.warn(`[VaultBroker] policy PUT ${name} warning:`, err.message);
 	}
-	await bao('PUT', `sys/policies/acl/${name}`, { policy: hcl });
 }
 
 // Mint a token through a token role with the given policies. Returns