http: revoke-prefix

http/handler.go

@@ -21,6 +21,7 @@ func Handler(core *vault.Core) http.Handler {
 	mux.Handle("/v1/sys/unseal", handleSysUnseal(core))
 	mux.Handle("/v1/sys/mounts/", handleSysMounts(core))
 	mux.Handle("/v1/sys/revoke/", handleSysRevoke(core))
+	mux.Handle("/v1/sys/revoke-prefix/", handleSysRevokePrefix(core))
 	mux.Handle("/v1/", handleLogical(core))
 	return mux
 }

http/sys_lease.go

@@ -39,3 +39,35 @@ func handleSysRevoke(core *vault.Core) http.Handler {
 		respondOk(w, nil)
 	})
 }
+
+func handleSysRevokePrefix(core *vault.Core) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "PUT" {
+			respondError(w, http.StatusMethodNotAllowed, nil)
+			return
+		}
+
+		// Determine the path...
+		prefix := "/v1/sys/revoke-prefix/"
+		if !strings.HasPrefix(r.URL.Path, prefix) {
+			respondError(w, http.StatusNotFound, nil)
+			return
+		}
+		path := r.URL.Path[len(prefix):]
+		if path == "" {
+			respondError(w, http.StatusNotFound, nil)
+			return
+		}
+
+		_, err := core.HandleRequest(requestAuth(r, &logical.Request{
+			Operation: logical.WriteOperation,
+			Path:      "sys/revoke-prefix/" + path,
+		}))
+		if err != nil {
+			respondError(w, http.StatusBadRequest, err)
+			return
+		}
+
+		respondOk(w, nil)
+	})
+}

http/sys_lease_test.go

@@ -15,3 +15,13 @@ func TestSysRevoke(t *testing.T) {
 	resp := testHttpPut(t, addr+"/v1/sys/revoke/secret/foo/1234", nil)
 	testResponseStatus(t, resp, 204)
 }
+
+func TestSysRevokePrefix(t *testing.T) {
+	core, _, token := vault.TestCoreUnsealed(t)
+	ln, addr := TestServer(t, core)
+	defer ln.Close()
+	TestServerAuth(t, addr, token)
+
+	resp := testHttpPut(t, addr+"/v1/sys/revoke-prefix/secret/foo/1234", nil)
+	testResponseStatus(t, resp, 204)
+}