Vault Token and Authentication Improvements #19
Description
Vault authentication currently lacks proper support for status reporting, unauthorized handling, and automatic detection of when to use a Vault token. This issue aims to improve the client’s integration with the vault system.
Vault authentication requires better support for status reporting, unauthorized handling and automatic detection.
Proposed features:
- Automatic Vault Detection
- Automatically detect when to use a Vault token for:
- If the target download URI belongs to one of the above hosts, the client should use the provided token
- If the token is missing, return a clear error message
- For other hosts, do not send the vault token
- TBD: hardcoded hostname list vs. dynamic detection (e.g., via metadata endpoint)
- Unauthorized Token Handling
- When a Vault token is present but not authorized, provide informative feedback such as: invalid, expired, valid but insufficient permissions
- Ensure the client surfaces these as readable error messages, not low-level HTTP errors