atlas_rb 1.13.0 → 1.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c55fceb9d85a211c8e28903ae67f1b8b98a9114c8ab403c63af68721bef76df4
-  data.tar.gz: 2b0684c399abf35c57bb6aac6def417f6996126b5afec576295d5d57cd5f72d2
+  metadata.gz: 651cf253c9f27ae5b3f3a917e76d6c630d079623f971230080962d3abd966157
+  data.tar.gz: da553d3a5239463b46a80c1348c53a60dcce2c2b7cb92f2dafb76095f61c433b
 SHA512:
-  metadata.gz: 46728839d509e41136a4a87f774c8f343055b0fd219d45e04732c6ef95ba635c5f13715e52b7f6dfd700ffe149e59debce03b77bf748e2c03b94f837540d24ff
-  data.tar.gz: 3bcd0432f0eab0d5bba7d0f7e8da7d1f29b50a083631cfe357c00eaf1d6403ac526dcb9c3ca6ecd68d26b4459d64d7407aa3a2b926bf9585f433e316369cdcbc
+  metadata.gz: e1f8bde0b540dd884930a4d0d78fd5441726caccadda299127f0a2548845ec690698c95e4cc114c70e11645d9197b4c11e29782bdeb0cf3539b1553d82a592b2
+  data.tar.gz: a10278be702677b1939ddc8cbc41a5dbcde9b6854f9016d0df7ab5040e07bd23edac96f6116299e335b670ee74955623eca400c5ad092f909431666363967766

data/.version

@@ -1 +1 @@
-1.13.0
+1.13.1

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 1.13.1
+
+### Fixed — `Maintenance.read` could not name an acting principal
+
+`AtlasRb::Maintenance.read` took no `nuid:`, unlike every other read binding,
+so on the relay-signing path it had no NUID to sign into the assertion `sub`
+and raised `ConfigurationError`. It worked only in BYO-JWT mode or when the
+host configured `AtlasRb.config.default_nuid`. It now takes `nuid:` and
+`on_behalf_of:` like its neighbours.
+
+```ruby
+AtlasRb::Maintenance.read(nuid: current_user.nuid)
+```
+
+`.write` is unchanged — it runs on the system connection, which deliberately
+never consults ambient identity.
+
 ## 1.13.0
 
 ### Added — maintenance mode no longer passes through silently

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    atlas_rb (1.13.0)
+    atlas_rb (1.13.1)
       faraday (~> 2.7)
       faraday-follow_redirects (~> 0.3.0)
       faraday-multipart (~> 1)

data/README.md

@@ -523,7 +523,7 @@ Read the flag to render a banner before a caller trips it. The read is answered
 even while the window is open, so a client can always see the flag it honours:
 
 ```ruby
-window = AtlasRb::Maintenance.read
+window = AtlasRb::Maintenance.read(nuid: current_user.nuid)
 window["read_only"]    # => true
 window["source"]       # => "deploy" / "operator"
 window["message"]      # => "Scheduled maintenance until 10:00"

data/lib/atlas_rb/maintenance.rb

@@ -33,11 +33,18 @@ module AtlasRb
     # Cheap and safe to poll behind a short-TTL cache; Cerberus renders its
     # banner and its client-side write gate from this.
     #
+    # @param nuid [String, nil] the acting NUID, signed into the assertion `sub`
+    #   on the relay path. Optional only in BYO-JWT mode or when the host
+    #   configures {AtlasRb.config#default_nuid}; the read sits behind Atlas's
+    #   authenticated read floor, so it needs a principal like any other read.
+    # @param on_behalf_of [String, nil] optional NUID carried as a signed `obo`
+    #   claim.
     # @return [AtlasRb::Mash] `read_only` (Boolean), `source`
     #   (`"operator"` / `"deploy"` / nil), `since` (ISO-8601 or nil), `message`
     #   (String or nil), and `retry_after` (Integer seconds).
-    def self.read
-      AtlasRb::Mash.new(JSON.parse(connection({}).get("/maintenance").body))
+    def self.read(nuid: nil, on_behalf_of: nil)
+      response = connection({}, nuid, on_behalf_of: on_behalf_of).get("/maintenance")
+      AtlasRb::Mash.new(JSON.parse(response.body))
     end
 
     # Open or close the window (`PUT /maintenance`). System-gated in Atlas.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: atlas_rb
 version: !ruby/object:Gem::Version
-  version: 1.13.0
+  version: 1.13.1
 platform: ruby
 authors:
 - David Cliff