Token Renewable Options

[superfive666]

Hi, is it possible to provide an option in the vault-client boot function to allow forcibly setting of token-renewal strategy?

[kurok]

Hi @superfive666 — thanks for the suggestion. Yes, this is feasible and would be a nice additive enhancement.

Current behavior (today)

Token renewal is fully automatic and not configurable. When a backend authenticates, VaultBaseAuth.getAuthToken() checks AuthToken.isRenewable() (which is renewable === true and the token actually has an expiry) and, if so, arms a refresh timer via __setupTokenRefreshTimer(). That timer is hardcoded to fire at the token's half-life:

// src/auth/VaultBaseAuth.js
const timer = Math.max((authToken.getExpiresAt() - Math.floor(Date.now() / 1000)) / 2, 1) * 1000;

So a renewable token is always auto-renewed at ~50% of its remaining TTL, and there's no way to disable that or change the timing. (Note: AuthToken.__resolveExpiresAt() already shifts expiry ~60s earlier as a network-latency safety margin, so renewal already happens a little before the real expiry.)

Proposed option

Since options.auth.config is already threaded uniformly into every backend constructor (iam / appRole / token / kubernetes, all extending VaultBaseAuth), a renewal block under config can be read in VaultBaseAuth with no constructor-signature changes and with defaults that preserve today's behavior:

VaultClient.boot('main', {
  api: { url: VAULT_ADDR },
  auth: {
    type: 'appRole',
    config: {
      role_id: '...',
      renewal: {
        enabled: true,      // default true; set false to force-disable auto-renew even for a renewable token
        threshold: 0.5      // default 0.5 (half-life); fraction of remaining TTL at which to renew
      }
    }
  }
});

enabled: false would simply skip __setupTokenRefreshTimer(), and threshold would replace the hardcoded / 2 factor. This is backward-compatible — omitting renewal keeps the current half-life auto-renew.

One nuance worth calling out: the token backend (VaultTokenAuth) overrides _reauthenticationAllowed() to false, so it can only renew an existing token, never re-authenticate. The renewal option would respect that — enabled: false on a token backend means the token simply won't be renewed (and will eventually expire), which is the intended escape hatch.

Could you confirm this shape covers your use case (force-disable vs. timing override)? If it does, I'm happy to put together a PR for it.

[kurok]

@superfive666 ?