Ensure property-defined Vault token is used when auth is TOKEN

Signed-off-by: johnycho <[email protected]>

Author: johnycho

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/vault/SpringVaultTemplateBuilder.java

@@ -58,7 +58,11 @@ public VaultTemplate build(VaultEnvironmentProperties vaultProperties) {
 	}
 
 	private boolean isStaticToken(VaultEnvironmentProperties vaultProperties) {
-		return vaultProperties.getAuthentication() == null && StringUtils.hasText(vaultProperties.getToken());
+		boolean hasToken = StringUtils.hasText(vaultProperties.getToken());
+		boolean isDefaultAuth = vaultProperties.getAuthentication() == null;
+		boolean isTokenAuth = vaultProperties.getAuthentication() == VaultEnvironmentProperties.AuthenticationMethod.TOKEN;
+
+		return hasToken && (isDefaultAuth || isTokenAuth);
 	}
 
 }

spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/environment/vault/SpringVaultTemplateBuilderTest.java

@@ -28,6 +28,7 @@
 import org.springframework.cloud.config.server.environment.ConfigTokenProvider;
 import org.springframework.cloud.config.server.environment.VaultEnvironmentProperties;
 import org.springframework.cloud.config.server.environment.vault.authentication.AppRoleClientAuthenticationProvider;
+import org.springframework.context.ApplicationContext;
 import org.springframework.context.support.StaticApplicationContext;
 import org.springframework.http.client.SimpleClientHttpRequestFactory;
 import org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler;
@@ -43,6 +44,9 @@
 import static com.github.tomakehurst.wiremock.client.WireMock.postRequestedFor;
 import static com.github.tomakehurst.wiremock.client.WireMock.urlEqualTo;
 import static com.github.tomakehurst.wiremock.client.WireMock.verify;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verifyNoInteractions;
 
 /**
  * @author Kaveh Shamsi
@@ -124,6 +128,25 @@ void shouldUseAppRoleToken() {
 				""")));
 	}
 
+	@Test
+	void buildShouldUseStaticTokenWhenAuthenticationIsToken() {
+		VaultEnvironmentProperties properties = new VaultEnvironmentProperties();
+		properties.setToken("my-static-token");
+		properties.setAuthentication(VaultEnvironmentProperties.AuthenticationMethod.TOKEN);
+
+		ConfigTokenProvider defaultTokenProvider = mock(ConfigTokenProvider.class);
+		ApplicationContext mockContext = mock(ApplicationContext.class);
+
+		SpringVaultTemplateBuilder builder = new SpringVaultTemplateBuilder(
+			defaultTokenProvider,
+			Collections.emptyList(),
+			mockContext
+		);
+
+		assertThrows(Exception.class, () -> builder.build(properties));
+		verifyNoInteractions(defaultTokenProvider);
+	}
+
 	private static StaticApplicationContext givenApplicationContext(ConfigTokenProvider defaultTokenProvider) {
 		var context = new StaticApplicationContext();
 		context.getBeanFactory()