From 66390532084b96e4138a5d499d64a1a577651fc9 Mon Sep 17 00:00:00 2001
From: brent s <bts@square-r00t.net>
Date: Sun, 29 Mar 2020 01:45:33 -0400
Subject: [PATCH] better auth handling for VaultPass

---
 schema/lib/elements/vaultpass.xsd | 17 +++++++++++++++++
 schema/lib/types/vaultpass.xsd    | 23 +++++++++++++++++++++--
 schema/projects/vaultpass.xsd     | 16 ++++++++++++----
 3 files changed, 50 insertions(+), 6 deletions(-)
 create mode 100644 schema/lib/elements/vaultpass.xsd

diff --git a/schema/lib/elements/vaultpass.xsd b/schema/lib/elements/vaultpass.xsd
new file mode 100644
index 0000000..7dfa03b
--- /dev/null
+++ b/schema/lib/elements/vaultpass.xsd
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+           elementFormDefault="qualified"
+           attributeFormDefault="unqualified">
+
+    <xs:include schemaLocation="../types/vaultpass.xsd"/>
+
+    <xs:element name="t_vaultpass_authselect" abstract="true"/>
+    <xs:element name="t_vaultpass_unsealselect" abstract="true"/>
+
+    <xs:element name="auth" substitutionGroup="t_vaultpass_authselect" type="t_vaultpass_auth_plain"/>
+    <xs:element name="authGpg" substitutionGroup="t_vaultpass_authselect" type="t_vaultpass_star_gpg"/>
+    
+    <xs:element name="unseal" substitutionGroup="t_vaultpass_unsealselect" type="t_std_base64"/>
+    <xs:element name="unsealGpg" substitutionGroup="t_vaultpass_unsealselect" type="t_vaultpass_star_gpg"/>
+
+</xs:schema>
diff --git a/schema/lib/types/vaultpass.xsd b/schema/lib/types/vaultpass.xsd
index 1f85b6f..9937205 100644
--- a/schema/lib/types/vaultpass.xsd
+++ b/schema/lib/types/vaultpass.xsd
@@ -3,11 +3,21 @@
            elementFormDefault="qualified"
            attributeFormDefault="unqualified">
 
+    <xs:include schemaLocation="./gpg.xsd"/>
     <xs:include schemaLocation="./net.xsd"/>
     <xs:include schemaLocation="./std.xsd"/>
     <xs:include schemaLocation="./unix.xsd"/>
 
-    <xs:complexType name="t_vaultpass_auth">
+    <xs:complexType name="t_vaultpass_star_gpg">
+        <xs:simpleContent>
+            <xs:extension base="t_unix_filepath">
+                <xs:attribute name="keyFPR" type="t_gpg_key_id" use="optional"/>
+                <xs:attribute name="gpgHome" type="t_unix_filepath" use="optional"/>
+            </xs:extension>
+        </xs:simpleContent>
+    </xs:complexType>
+
+    <xs:complexType name="t_vaultpass_auth_plain">
         <xs:choice minOccurs="1" maxOccurs="1">
             <xs:element name="appRole">
                 <xs:complexType>
@@ -88,11 +98,20 @@
                     </xs:simpleContent>
                 </xs:complexType>
             </xs:element>
+            <xs:element name="userpass">
+                <xs:complexType>
+                    <xs:all>
+                        <xs:element name="username" type="xs:token" minOccurs="1" maxOccurs="1"/>
+                        <xs:element name="password" type="xs:token" minOccurs="1" maxOccurs="1"/>
+                        <xs:element name="mountPoint" type="xs:token" minOccurs="0" maxOccurs="1" default="userpass"/>
+                    </xs:all>
+                </xs:complexType>
+            </xs:element>
         </xs:choice>
     </xs:complexType>
 
     <xs:simpleType name="t_vaultpass_tokensource">
-        <xs:union memberTypes="t_std_envvar t_unix_filepath xs:token"/>
+        <xs:union memberTypes="t_std_envvar t_unix_filepath"/>
     </xs:simpleType>
 
 </xs:schema>
diff --git a/schema/projects/vaultpass.xsd b/schema/projects/vaultpass.xsd
index 0470ede..6673716 100644
--- a/schema/projects/vaultpass.xsd
+++ b/schema/projects/vaultpass.xsd
@@ -7,16 +7,24 @@
            attributeFormDefault="unqualified">
 
     <xs:include schemaLocation="../lib/types/vaultpass.xsd"/>
+    <xs:include schemaLocation="../lib/elements/vaultpass.xsd"/>
 
     <!-- ROOT -->
     <xs:element name="vaultpass">
         <xs:complexType>
             <xs:all>
-                <xs:element name="uri" type="t_std_uri" minOccurs="0" maxOccurs="1" default="http://localhost:8000/"/>
-                <xs:element name="auth" type="t_vaultpass_auth" minOccurs="1" maxOccurs="1"/>
+                <xs:element name="server" minOccurs="0" maxOccurs="1">
+                    <xs:complexType>
+                        <xs:all>
+                            <xs:element name="uri" type="t_std_uri" minOccurs="0" maxOccurs="1"
+                                        default="http://localhost:8000/"/>
+                            <xs:element name="unseal" minOccurs="0" maxOccurs="1" type="t_std_base64"/>
+                        </xs:all>
+                    </xs:complexType>
+                </xs:element>
+                <xs:element ref="t_vaultpass_authselect" minOccurs="1" maxOccurs="1"/>
             </xs:all>
-            <xs:attribute name="autoUnseal" type="xs:boolean" use="optional" default="false"/>
-            <xs:attribute name="unsealShard" type="t_std_base64" use="optional"/>
         </xs:complexType>
     </xs:element>
+
 </xs:schema>