@iota-big3/sdk-security/dist/secrets/providers/vault-provider.d.ts

Advanced security features including zero trust, quantum-safe crypto, and ML threat detection

/**
 * HashiCorp Vault Provider
 * Enterprise-grade secrets management with dynamic secrets and encryption
 */
import { EventEmitter } from 'events';
import { Certificate, CertificateConfig, DynamicSecretConfig, EncryptionService, HealthStatus, PKIService, RotationPolicy, Secret, SecretFilter, SecretLease, SecretMetadata, SecretsManager, SecretsProvider, SecretsProviderConfig, SigningConfig } from '../types';
export declare class VaultProvider extends EventEmitter implements SecretsManager, EncryptionService, PKIService {
    readonly provider = SecretsProvider.HASHICORP_VAULT;
    private config;
    private token?;
    private tokenExpiry?;
    private cache;
    private leases;
    private isInitialized;
    constructor(config: SecretsProviderConfig);
    /**
     * Initialize Vault connection
     */
    initialize(): Promise<void>;
    /**
     * Authenticate with Vault
     */
    private authenticate;
    /**
     * Get secret from Vault
     */
    getSecret(name: string, version?: string): Promise<Secret>;
    /**
     * Set secret in Vault
     */
    setSecret(name: string, value: any, metadata?: Partial<SecretMetadata>): Promise<void>;
    /**
     * Delete secret from Vault
     */
    deleteSecret(name: string, permanent?: boolean): Promise<void>;
    /**
     * List secrets with optional filter
     */
    listSecrets(filter?: SecretFilter): Promise<SecretMetadata[]>;
    /**
     * Rotate a secret
     */
    rotateSecret(name: string): Promise<void>;
    /**
     * Schedule secret rotation
     */
    scheduleRotation(name: string, policy: RotationPolicy): Promise<void>;
    /**
     * Get secret versions
     */
    getSecretVersions(name: string): Promise<string[]>;
    /**
     * Rollback to previous version
     */
    rollbackSecret(name: string, version: string): Promise<void>;
    /**
     * Get multiple secrets
     */
    getBulkSecrets(names: string[]): Promise<Secret[]>;
    /**
     * Import secrets
     */
    importSecrets(secrets: Secret[]): Promise<void>;
    /**
     * Export secrets
     */
    exportSecrets(filter?: SecretFilter): Promise<Secret[]>;
    /**
     * Health check
     */
    healthCheck(): Promise<HealthStatus>;
    /**
     * Create dynamic database credentials
     */
    createDynamicSecret(config: DynamicSecretConfig): Promise<SecretLease>;
    /**
     * Renew dynamic secret lease
     */
    renewLease(leaseId: string): Promise<void>;
    /**
     * Revoke dynamic secret lease
     */
    revokeLease(leaseId: string): Promise<void>;
    /**
     * Encryption service: Encrypt data
     */
    encrypt(plaintext: string | Buffer, context?: Record<string, any>): Promise<string>;
    /**
     * Encryption service: Decrypt data
     */
    decrypt(ciphertext: string, context?: Record<string, any>): Promise<string | Buffer>;
    /**
     * Generate data encryption key
     */
    generateDataKey(bits?: number): Promise<{
        plaintext: string;
        ciphertext: string;
    }>;
    /**
     * Rewrap ciphertext with new key version
     */
    rewrapKey(ciphertext: string, newKeyVersion: string): Promise<string>;
    /**
     * PKI: Generate certificate
     */
    generateCertificate(config: CertificateConfig): Promise<Certificate>;
    /**
     * PKI: Sign CSR
     */
    signCSR(csr: string, config: SigningConfig): Promise<Certificate>;
    /**
     * PKI: Revoke certificate
     */
    revokeCertificate(serial: string, reason?: string): Promise<void>;
    /**
     * PKI: Get CRL
     */
    getCRL(): Promise<string>;
    /**
     * PKI: Get certificate
     */
    getCertificate(serial: string): Promise<Certificate>;
    /**
     * Helper methods
     */
    private validateConfig;
    private ensureInitialized;
    private buildPath;
    private getFromCache;
    private addToCache;
    private inferSecretType;
    private matchTags;
    private getSecretMetadata;
    private generateNewSecretValue;
    private generatePassword;
    private vaultRequest;
    private authenticateAppRole;
    private authenticateAWS;
    private authenticateKubernetes;
    private startTokenRenewal;
    private scheduleLeaseRenewal;
    private parseCertificateSubject;
    private auditLog;
}
//# sourceMappingURL=vault-provider.d.ts.map