Use HTTP GET for list requests

[orf]

Closes #109

This is the branch we are currently using, I’ll fix it up

[orf]

I was not sure how to add default GET parameters to a request model - if there’s a better way let me know.

I’ll remove the extra commits later on

[Haennetz]

Thanks for your PR. I would prefer to add an option that allows the developer to control if he would like to use the LIST or the GET method to accomplish this. It could also be that a reversed proxy only allows the LIST method to prevent that secret data are leaked.

[orf]

Thanks @Haennetz - I've added kv2::list_with_http_get and kv1::list_with_http_get methods to let the developer control this, and I've added tests.

[Haennetz]

Thanks @orf and nice work there are only some formatting issues. @stormshield-gt is it okay for you if we Marge this PR and you add the tests to #107?

[orf]

Thanks! I've fixed the formatting 👍

[stormshield-gt]

#107 has just been merged.
@orf do you mind doing a rebase?

I want to take some time to evaluate if there are other alternatives to this. Maybe we should also generalize the passage of LIST to GET to all endpoints?

[orf]

I've rebased @stormshield-gt <3

It's a tricky issue: on one hand, switching from LIST to GET is supported by the API and is contractually the same. On the other hand it feels like a breaking change.

However perhaps that's over-thinking things: we don't need to be constrained by hyrum's law if we don't want to be, and it's unlikely that this would cause major issues for users given that the Vault API explicitly supports this as an alternative to LIST. The specific case would be someone restricting things to only LIST requests, but... that's unlikely.

Perhaps we should just switch things to be GET requests and remove LIST entirely?

[stormshield-gt]

Hi, sorry for the late response. I agree we shouldn't constrain ourselves to the hyrum's law. I think it mostly applies when you have a lot of users, and that's not the case currently.

Perhaps we should just switch things to be GET requests and remove LIST entirely?

That's the direction I want to go. What do you think @Haennetz?

I will be on vacation for a few weeks.

[Haennetz]

Sure we can switch completely to GET requests.