func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
	mount, ok := m["mount"]
	if !ok {
		mount = "github"
	}

	token, ok := m["token"]
	if !ok {
		if token = os.Getenv("VAULT_AUTH_GITHUB_TOKEN"); token == "" {
			return "", fmt.Errorf("GitHub token should be provided either as 'value' for 'token' key,\nor via an env var VAULT_AUTH_GITHUB_TOKEN")
		}
	}

	path := fmt.Sprintf("auth/%s/login", mount)
	secret, err := c.Logical().Write(path, map[string]interface{}{
		"token": token,
	})
	if err != nil {
		return "", err
	}
	if secret == nil {
		return "", fmt.Errorf("empty response from credential provider")
	}

	return secret.Auth.ClientToken, nil
}

// rekeyStatus is used just to fetch and dump the status
func (c *RekeyCommand) rekeyStatus(client *api.Client) int {
	// Check the status
	status, err := client.Sys().RekeyStatus()
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error reading rekey status: %s", err))
		return 1
	}

	// Dump the status
	statString := fmt.Sprintf(
		"Nonce: %s\n"+
			"Started: %v\n"+
			"Key Shares: %d\n"+
			"Key Threshold: %d\n"+
			"Rekey Progress: %d\n"+
			"Required Keys: %d",
		status.Nonce,
		status.Started,
		status.N,
		status.T,
		status.Progress,
		status.Required,
	)
	if len(status.PGPFingerprints) != 0 {
		statString = fmt.Sprintf("\nPGP Key Fingerprints: %s", status.PGPFingerprints)
		statString = fmt.Sprintf("\nBackup Storage: %t", status.Backup)
	}
	c.Ui.Output(statString)
	return 0
}

func (s *VaultSource) setToken(c *api.Client) error {
	s.mu.Lock()
	defer func() {
		c.SetToken(s.token)
		s.mu.Unlock()
	}()

	if s.token != "" {
		return nil
	}

	if s.vaultToken == "" {
		return errors.New("vault: no token")
	}

	// did we get a wrapped token?
	resp, err := c.Logical().Unwrap(s.vaultToken)
	if err != nil {
		// not a wrapped token?
		if strings.HasPrefix(err.Error(), "no value found at") {
			s.token = s.vaultToken
			return nil
		}
		return err
	}
	log.Printf("[INFO] vault: Unwrapped token %s", s.vaultToken)

	s.token = resp.Auth.ClientToken
	return nil
}

func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (string, error) {
	mount, ok := m["mount"]
	if !ok {
		mount = "ldap"
	}

	username, ok := m["username"]
	if !ok {
		return "", fmt.Errorf("'username' var must be set")
	}
	password, ok := m["password"]
	if !ok {
		fmt.Printf("Password (will be hidden): ")
		var err error
		password, err = pwd.Read(os.Stdin)
		fmt.Println()
		if err != nil {
			return "", err
		}
	}

	path := fmt.Sprintf("auth/%s/login/%s", mount, username)
	secret, err := c.Logical().Write(path, map[string]interface{}{
		"password": password,
	})
	if err != nil {
		return "", err
	}
	if secret == nil {
		return "", fmt.Errorf("empty response from credential provider")
	}

	return secret.Auth.ClientToken, nil
}

func doTokenLookup(args []string, client *api.Client) (*api.Secret, error) {
	if len(args) == 0 {
		return client.Auth().Token().LookupSelf()
	}

	token := args[0]
	return client.Auth().Token().Lookup(token)
}

// cancelRekey is used to abort the rekey process
func (c *RekeyCommand) cancelRekey(client *api.Client) int {
	err := client.Sys().RekeyCancel()
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Failed to cancel rekey: %s", err))
		return 1
	}
	c.Ui.Output("Rekey canceled.")
	return 0
}

// cancelGenerateRoot is used to abort the generation process
func (c *GenerateRootCommand) cancelGenerateRoot(client *api.Client) int {
	err := client.Sys().GenerateRootCancel()
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Failed to cancel root generation: %s", err))
		return 1
	}
	c.Ui.Output("Root generation canceled.")
	return 0
}

func (c *RekeyCommand) rekeyDeleteStored(client *api.Client) int {
	err := client.Sys().RekeyDeleteStored()
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Failed to delete stored keys: %s", err))
		return 1
	}
	c.Ui.Output("Stored keys deleted.")
	return 0
}

// rekeyStatus is used just to fetch and dump the status
func (c *RekeyCommand) rekeyStatus(client *api.Client) int {
	// Check the status
	status, err := client.Sys().RekeyStatus()
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error reading rekey status: %s", err))
		return 1
	}

	return c.dumpRekeyStatus(status)
}

// initGenerateRoot is used to start the generation process
func (c *GenerateRootCommand) initGenerateRoot(client *api.Client, otp string, pgpKey string) int {
	// Start the rekey
	err := client.Sys().GenerateRootInit(otp, pgpKey)
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error initializing root generation: %s", err))
		return 1
	}

	// Provide the current status
	return c.rootGenerationStatus(client)
}

// rootGenerationStatus is used just to fetch and dump the status
func (c *GenerateRootCommand) rootGenerationStatus(client *api.Client) int {
	// Check the status
	status, err := client.Sys().GenerateRootStatus()
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error reading root generation status: %s", err))
		return 1
	}

	c.dumpStatus(status)

	return 0
}

// initGenerateRoot is used to start the generation process
func (c *GenerateRootCommand) initGenerateRoot(client *api.Client, otp string, pgpKey string) int {
	// Start the rekey
	status, err := client.Sys().GenerateRootInit(otp, pgpKey)
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error initializing root generation: %s", err))
		return 1
	}

	c.dumpStatus(status)

	return 0
}

func initializeNewVault(vc *vault.Client) *vault.InitResponse {
	log.Info("Initialize fresh vault")
	vaultInit := &vault.InitRequest{
		SecretShares:    1,
		SecretThreshold: 1,
	}
	initResponse, err := vc.Sys().Init(vaultInit)
	fatal(err)

	return initResponse

}

func (c *RekeyCommand) rekeyRetrieveStored(client *api.Client) int {
	storedKeys, err := client.Sys().RekeyRetrieveStored()
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error retrieving stored keys: %s", err))
		return 1
	}

	secret := &api.Secret{
		Data: structs.New(storedKeys).Map(),
	}

	return OutputSecret(c.Ui, "table", secret)
}

// cancelRekey is used to abort the rekey process
func (c *RekeyCommand) cancelRekey(client *api.Client, recovery bool) int {
	var err error
	if recovery {
		err = client.Sys().RekeyRecoveryKeyCancel()
	} else {
		err = client.Sys().RekeyCancel()
	}
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Failed to cancel rekey: %s", err))
		return 1
	}
	c.Ui.Output("Rekey canceled.")
	return 0
}

func (c *RekeyCommand) rekeyDeleteStored(client *api.Client, recovery bool) int {
	var err error
	if recovery {
		err = client.Sys().RekeyDeleteRecoveryBackup()
	} else {
		err = client.Sys().RekeyDeleteBackup()
	}
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Failed to delete stored keys: %s", err))
		return 1
	}
	c.Ui.Output("Stored keys deleted.")
	return 0
}

// initRekey is used to start the rekey process
func (c *RekeyCommand) initRekey(client *api.Client, shares, threshold int) int {
	// Start the rekey
	err := client.Sys().RekeyInit(&api.RekeyInitRequest{
		SecretShares:    shares,
		SecretThreshold: threshold,
	})
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error initializing rekey: %s", err))
		return 1
	}

	// Provide the current status
	return c.rekeyStatus(client)
}

func (c *InitCommand) checkStatus(client *api.Client) int {
	inited, err := client.Sys().InitStatus()
	switch {
	case err != nil:
		c.Ui.Error(fmt.Sprintf(
			"Error checking initialization status: %s", err))
		return 1
	case inited:
		c.Ui.Output("Vault has been initialized")
		return 0
	default:
		c.Ui.Output("Vault is not initialized")
		return 2
	}
}

// rekeyStatus is used just to fetch and dump the status
func (c *RekeyCommand) rekeyStatus(client *api.Client, recovery bool) int {
	// Check the status
	var status *api.RekeyStatusResponse
	var err error
	if recovery {
		status, err = client.Sys().RekeyRecoveryKeyStatus()
	} else {
		status, err = client.Sys().RekeyStatus()
	}
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error reading rekey status: %s", err))
		return 1
	}

	return c.dumpRekeyStatus(status)
}

// initRekey is used to start the rekey process
func (c *RekeyCommand) initRekey(client *api.Client,
	shares, threshold int,
	pgpKeys pgpkeys.PubKeyFilesFlag,
	backup, recoveryKey bool) int {
	// Start the rekey
	request := &api.RekeyInitRequest{
		SecretShares:    shares,
		SecretThreshold: threshold,
		PGPKeys:         pgpKeys,
		Backup:          backup,
	}
	var status *api.RekeyStatusResponse
	var err error
	if recoveryKey {
		status, err = client.Sys().RekeyRecoveryKeyInit(request)
	} else {
		status, err = client.Sys().RekeyInit(request)
	}
	if err != nil {
		c.Ui.Error(fmt.Sprintf("Error initializing rekey: %s", err))
		return 1
	}

	if pgpKeys == nil || len(pgpKeys) == 0 {
		c.Ui.Output(`
WARNING: If you lose the keys after they are returned to you, there is no
recovery. Consider using the '-pgp-keys' option to protect the returned unseal
keys along with '-backup=true' to allow recovery of the encrypted keys in case
of emergency. They can easily be deleted at a later time with
'vault rekey -delete'.
`)
	}

	if pgpKeys != nil && len(pgpKeys) > 0 && !backup {
		c.Ui.Output(`
WARNING: You are using PGP keys for encryption, but have not set the option to
back up the new unseal keys to physical storage. If you lose the keys after
they are returned to you, there is no recovery. Consider setting '-backup=true'
to allow recovery of the encrypted keys in case of emergency. They can easily
be deleted at a later time with 'vault rekey -delete'.
`)
	}

	// Provide the current status
	return c.dumpRekeyStatus(status)
}