Implement rotation manager for root token

[drewmullen]

PCI review checklist

Closes: #65

TODO (will complete after peer review to ensure no changes are requested):

• documentation for -help
• documentation for website
• documentation for api

NOTE: My plan is to update the docs after I get some feedback from the team

Details

2 new parameters have been added to the config path.

• token_id: the id of the token. This can only be gotten by generating a token via API (see shell examples below)
• old_token: Meta argument to determine how the secret engine will handle the prior root token after its rotated. Can be delete or keep.

Fetching a token via api

Token IDs are not easily readable from the API. Its best to get the ID when the token is created.

export TFE_TOKEN="" # for generating TOKEN_DETAILS

export TF_ID="user-<>"

export TOKEN_DETAILS=$(curl \
  --header "Authorization: Bearer $TFE_TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request POST \
  "https://app.terraform.io/api/v2/users/$TF_ID/authentication-tokens" \
  --data '{"data": {"type": "authentication-tokens","attributes": {"description":"initial terraform secret engine config token"}}}' | jq '{"token_id": .data.id, "token": .data.attributes.token}')
  
export TF_TOKEN=$(echo $TOKEN_DETAILS | jq -r .token)
export TF_TOKEN_ID=$(echo $TOKEN_DETAILS | jq -r .token_id)

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[drewmullen]

1 unit and 1 acc test working...

acc

2025-09-22T15:51:47-04:00 debug layer=debugger ContinueOnce
2025-09-22T15:51:47.712-0400 [INFO]  Rotating configuration token
2025-09-22T15:51:47.948-0400 [DEBUG] Creating new user token with description:: user-<>="Rotated by Vault (sg9yb)"
--- PASS: TestConfig_Rotation (15.47s)
    --- PASS: TestConfig_Rotation/Test_Token_Rotation (15.47s)
PASS

unit

go test -run TestBackend_PathConfig_RegisterRotation
2025-09-22T15:55:24.748-0400 [DEBUG] Registering rotation job: mount=config
PASS
ok  	github.com/hashicorp/vault-plugin-secrets-terraform	0.623s

[drewmullen]

Given certain internal conversations - we can remove this

[drewmullen]

Suggested change

	} `json:"relationships"`
	} `json:"relationships"`
	Links struct {
	Self string `json:"self"`
	AuthToken string `json:"auth-token",omitempty"`
	} `json:"links"`

[drewmullen]

because AuthToken may not come from older versions of tfe the omitempty may not work here. may have to rework the struct definition