assist in debugging vault access errors

Author: tomcz

internal/config/vault.go

@@ -2,7 +2,9 @@ package config
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"net/http"
 
 	"github.com/go-viper/mapstructure/v2"
 	"github.com/hashicorp/vault-client-go"
@@ -12,14 +14,18 @@ import (
 func LookupWithAppRole(ctx context.Context, vaultAddr, caCertFile, roleID, secretID, path string) (*Config, error) {
 	client, err := newClient(vaultAddr, caCertFile)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("approle.Client: %w", err)
 	}
 	resp, err := client.Auth.AppRoleLogin(ctx, schema.AppRoleLoginRequest{RoleId: roleID, SecretId: secretID})
 	if err != nil {
-		return nil, err
+		var verr *vault.ResponseError
+		if errors.As(err, &verr) && verr.OriginalRequest != nil {
+			return nil, expandError(verr.OriginalRequest, err)
+		}
+		return nil, fmt.Errorf("approle.Login: %w", err)
 	}
 	if err = client.SetToken(resp.Auth.ClientToken); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("approle.SetToken: %w", err)
 	}
 	defer logout(ctx, client, resp.Auth.Renewable)
 	return lookup(ctx, client, path)
@@ -28,10 +34,10 @@ func LookupWithAppRole(ctx context.Context, vaultAddr, caCertFile, roleID, secre
 func LookupWithToken(ctx context.Context, vaultAddr, caCertFile, token, path string) (*Config, error) {
 	client, err := newClient(vaultAddr, caCertFile)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("token.Client: %w", err)
 	}
 	if err = client.SetToken(token); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("token.SetToken: %w", err)
 	}
 	return lookup(ctx, client, path)
 }
@@ -54,20 +60,28 @@ func newClient(vaultAddr, caCertFile string) (*vault.Client, error) {
 func lookup(ctx context.Context, client *vault.Client, path string) (*Config, error) {
 	secret, err := client.Read(ctx, path)
 	if err != nil {
-		return nil, err
+		var verr *vault.ResponseError
+		if errors.As(err, &verr) && verr.OriginalRequest != nil {
+			return nil, expandError(verr.OriginalRequest, err)
+		}
+		return nil, fmt.Errorf("vault.Read: %w", err)
 	}
-	if secret == nil {
+	if secret == nil || secret.Data == nil {
 		return nil, fmt.Errorf("secret not found at path %q", path)
 	}
 	var cfg Config
 	if err = mapstructure.Decode(secret.Data, &cfg); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("secret.Decode: %w", err)
 	}
 	return &cfg, nil
 }
 
+func expandError(req *http.Request, err error) error {
+	return fmt.Errorf("%s %s: %w", req.Method, req.URL.String(), err)
+}
+
 func logout(ctx context.Context, client *vault.Client, shouldLogout bool) {
 	if shouldLogout {
-		client.Auth.TokenRevokeSelf(ctx) //nolint:all
+		_, _ = client.Auth.TokenRevokeSelf(ctx)
 	}
 }