Merge pull request #1176 from hashicorp/github-error-response

Change expiration.RenewToken's response from logical.Auth to logical.Response

vault/expiration.go

@@ -310,7 +310,7 @@ func (m *ExpirationManager) Renew(leaseID string, increment time.Duration) (*log
 // RenewToken is used to renew a token which does not need to
 // invoke a logical backend.
 func (m *ExpirationManager) RenewToken(req *logical.Request, source string, token string,
-	increment time.Duration) (*logical.Auth, error) {
+	increment time.Duration) (*logical.Response, error) {
 	defer metrics.MeasureSince([]string{"expire", "renew-token"}, time.Now())
 	// Compute the Lease ID
 	leaseID := path.Join(source, m.tokenStore.SaltID(token))
@@ -332,12 +332,20 @@ func (m *ExpirationManager) RenewToken(req *logical.Request, source string, toke
 		return nil, err
 	}
 
-	// Fast-path if there is no renewal
 	if resp == nil {
 		return nil, nil
 	}
+
+	if resp.IsError() {
+		return &logical.Response{
+			Data: resp.Data,
+		}, nil
+	}
+
 	if resp.Auth == nil || !resp.Auth.LeaseEnabled() {
-		return resp.Auth, nil
+		return &logical.Response{
+			Auth: resp.Auth,
+		}, nil
 	}
 
 	// Attach the ClientToken
@@ -354,7 +362,9 @@ func (m *ExpirationManager) RenewToken(req *logical.Request, source string, toke
 
 	// Update the expiration time
 	m.updatePending(le, resp.Auth.LeaseTotal())
-	return resp.Auth, nil
+	return &logical.Response{
+		Auth: resp.Auth,
+	}, nil
 }
 
 // Register is used to take a request and response with an associated

vault/expiration_test.go

@@ -424,7 +424,7 @@ func TestExpiration_RenewToken(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	if auth.ClientToken != out.ClientToken {
+	if auth.ClientToken != out.Auth.ClientToken {
 		t.Fatalf("Bad: %#v", out)
 	}
 }

vault/token_store.go

@@ -895,16 +895,7 @@ func (ts *TokenStore) handleRenew(
 	}
 
 	// Renew the token and its children
-	auth, err := ts.expiration.RenewToken(req, te.Path, te.ID, increment)
-	if err != nil {
-		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
-	}
-
-	// Generate the response
-	resp := &logical.Response{
-		Auth: auth,
-	}
-	return resp, nil
+	return ts.expiration.RenewToken(req, te.Path, te.ID, increment)
 }
 
 func (ts *TokenStore) destroyCubbyhole(saltedID string) error {