entitlements-app 1.2.1 → 1.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f374fa7a4154693db9513b354103b917e1a12d58ab9644e75f52bbfb63156e61
-  data.tar.gz: a942f1ece43a9e3fc3552d9144ce3ce7c095276ecb0706d3e8de975fcfd5288b
+  metadata.gz: 1d78c3e43bb1a892e7d45aa8c1a9c608c26db75f36a8adda13646b5ae9a756dc
+  data.tar.gz: afd0505ea8106dbaaa3486e1c2dfab168c6209b97d99322cc6f560a6526f8aab
 SHA512:
-  metadata.gz: 50a19c9c040154f27ea8bdd86dfccf015a2eac1fc6c2f38796c60f6192a0e094e5afd78bcf65e3d5bebaa4e7966662c52e7eb1d135c599d723e23a27d1c08157
-  data.tar.gz: f4a2256185eaf9b0a1950450e62cee75679aa62e6d208ea50795bc4972bc30348c4877b6befd8f848f55d85702d865f3f3b1c285ea8ecd2e1c39c82384bcbee1
+  metadata.gz: 0b1279f7726543ffcaf95228c7b0f831f462bcb05431db9acd195afa01f6f40c00561dd0cb81c3c097c9d75291d87db1c2eb16a237e2ced1b22ac3d00b8967b4
+  data.tar.gz: b0f8f91d63df0e79a77bf8e00d39a2403a2281a71dc533f7d45bb0ba476c30f45953f828011006a9533ec2f3f77796859a16d5bd832a2e1d4272f8a598894bb8

data/lib/entitlements/cli.rb

@@ -51,6 +51,8 @@ module Entitlements
       # Done.
       logger.info "Successfully applied #{Entitlements.cache[:change_count]} change(s)!"
       0
+    ensure
+      Entitlements.close_statsd
     end
     # :nocov:
 

data/lib/entitlements/service/ldap.rb

@@ -17,9 +17,9 @@ module Entitlements
       # This keeps the schema happy.
       attr_reader :binddn, :person_dn_format
 
-      # Constructor-like object that ensures only one LDAP object (and hence connection)
-      # is made for a given LDAP server, for efficiency sake. Takes the same parameters as
-      # the constructor and returns the same object type.
+      # Constructor-like object that ensures only one LDAP service object is made for a
+      # given LDAP server. Takes the same parameters as the constructor and returns the
+      # same object type.
       #
       # addr   - URL of LDAP server e.g. ldaps://ldap.example.net:636
       # binddn - DN to bind with
@@ -80,6 +80,8 @@ module Entitlements
         @ca_file = ca_file
         @disable_ssl_verification = disable_ssl_verification
         @person_dn_format = person_dn_format
+        @known_existing_dns = {}
+        @known_existing_dns_mutex = Mutex.new
       end
 
       # Read a single entry identified by its DN and return the value. Returns nil if
@@ -119,7 +121,13 @@ module Entitlements
         downcased_attrs = attrs == "*" ? "*" : attrs.map { |a| a.downcase }
 
         result = {}
-        ldap.search(base: base, filter: filter, attributes: downcased_attrs, scope: scope, return_result: false) do |entry|
+        search_succeeded = ldap.search(
+          base: base,
+          filter: filter,
+          attributes: downcased_attrs,
+          scope: scope,
+          return_result: false
+        ) do |entry|
           result_key = index == :dn ? entry.dn : entry[index]
           unless result_key
             raise EntryError, "#{entry.dn} has no value for #{index.inspect}"
@@ -132,6 +140,7 @@ module Entitlements
 
           result[result_key] = entry
         end
+        remember_existing_dn(base) if search_succeeded
 
         Entitlements.logger.debug "Completed search: #{result.keys.size} result(s)"
 
@@ -145,6 +154,7 @@ module Entitlements
       # Returns true if the entry exists, false otherwise.
       Contract String => C::Bool
       def exists?(dn)
+        return true if known_existing_dn?(dn)
         read(dn).is_a?(Net::LDAP::Entry)
       end
 
@@ -180,7 +190,10 @@ module Entitlements
 
         ldap.delete(dn: dn)
         operation_result = ldap.get_operation_result
-        return true if operation_result["code"] == 0
+        if operation_result["code"] == 0
+          forget_dn(dn)
+          return true
+        end
         Entitlements.logger.error "Error deleting #{dn}: #{operation_result['message']}"
         false
       end
@@ -215,11 +228,24 @@ module Entitlements
 
       attr_reader :addr, :bindpw
 
-      # The LDAP object is initialized and bound on demand the first time it's called.
+      def known_existing_dn?(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns.key?(dn) }
+      end
+
+      def remember_existing_dn(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns[dn] = true }
+      end
+
+      def forget_dn(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns.delete(dn) }
+        @dn_cache&.delete(dn)
+      end
+
+      # The LDAP object is initialized and its credentials are validated on demand.
       #
       # Takes no arguments.
       #
-      # Returns a Net::LDAP object that is connected and bound.
+      # Returns a Net::LDAP object configured to connect and bind for each operation.
       Contract C::None => Net::LDAP
       def ldap
         @ldap ||= begin

data/lib/entitlements.rb

@@ -16,9 +16,11 @@ end
 # :nocov:
 
 require "contracts"
+require "datadog/statsd"
 require "erb"
 require "logger"
 require "ostruct"
+require "resolv"
 require "stringio"
 require "uri"
 require "yaml"
@@ -89,6 +91,7 @@ module Entitlements
     @config_file = nil
     @config_path_override = nil
     @person_extra_methods = {}
+    @statsd = nil
 
     reset_extras!
     Entitlements::Data::Groups::Calculated.reset!
@@ -354,6 +357,53 @@ module Entitlements
   end
   # :nocov:
 
+  def self.statsd
+    @statsd ||= build_statsd
+  end
+
+  def self.set_statsd(statsd)
+    @statsd = statsd
+  end
+
+  def self.close_statsd
+    @statsd&.close
+    @statsd = nil
+  end
+
+  def self.build_statsd
+    host = Resolv.getaddress(ENV.fetch("DOGSTATSD_HOST", "localhost"))
+    port = Integer(ENV.fetch("DOGSTATSD_PORT", 28_125))
+    tags = [
+      "application:entitlements",
+      "kube_pod_name:#{ENV.fetch('KUBE_POD_NAME', 'not-on-kubernetes')}",
+      "app_env:#{ENV.fetch('APP_ENV', 'development')}",
+      "deployment_id:#{metric_deployment_id}"
+    ]
+    Datadog::Statsd.new(host, port, tags: tags)
+  end
+
+  def self.metric_deployment_id
+    ENV["HEAVEN_DEPLOYMENT_ID"] || ENV["GITHUB_RUN_ID"] || "not-in-deployment"
+  end
+
+  def self.timed_operation(phase:, provider: nil, target: nil, span: "leaf", concurrent: false, count: nil)
+    tags = [
+      "phase:#{phase}",
+      "status:error",
+      "span:#{span}",
+      "concurrent:#{concurrent}"
+    ]
+    tags << "provider:#{provider}" if provider
+    tags << "target:#{target}" if target
+    tags << "count:#{count}" if count
+
+    statsd.time("entitlements.operation.duration", tags: tags) do
+      result = yield
+      tags[1] = "status:success"
+      result
+    end
+  end
+
   # Calculate - This runs the entitlements logic to calculate the differences, ultimately
   # populating a cache and returning a list of actions. The cache and actions can then be
   # consumed by `execute` to implement the changes.
@@ -363,14 +413,22 @@ module Entitlements
   # Returns the array of actions.
   Contract C::None => C::ArrayOf[Entitlements::Models::Action]
   def self.calculate
+    timed_operation(phase: "calculate_total", span: "parent") { calculate_actions }
+  end
+
+  def self.calculate_actions
     # Load extras that are configured.
-    Entitlements.load_extras if Entitlements.config.key?("extras")
+    if Entitlements.config.key?("extras")
+      timed_operation(phase: "load_extras") { Entitlements.load_extras }
+    end
 
     # Pre-fetch people from configured people data sources.
-    Entitlements.prefetch_people
+    timed_operation(phase: "prefetch_people") { Entitlements.prefetch_people }
 
     # Register filters that are configured.
-    Entitlements.register_filters if Entitlements.config.key?("filters")
+    if Entitlements.config.key?("filters")
+      timed_operation(phase: "register_filters") { Entitlements.register_filters }
+    end
 
     # Keep track of the total change count.
     cache[:change_count] = 0
@@ -385,8 +443,9 @@ module Entitlements
       Concurrent::Future.execute({ executor: thread_pool }) do
         group_start = Time.now
         logger.debug("Begin prefetch and validate for #{group_name}")
-        obj.prefetch
-        obj.validate
+        provider = Entitlements.config["groups"].fetch(group_name).fetch("type")
+        timed_operation(phase: "prefetch", provider: provider, target: group_name, concurrent: true) { obj.prefetch }
+        timed_operation(phase: "validate", provider: provider, target: group_name, concurrent: true) { obj.validate }
         logger.debug("Finished prefetch and validate for #{group_name} in #{Time.now - group_start}")
       end
     end
@@ -398,7 +457,8 @@ module Entitlements
     calc_start = Time.now
     actions = []
     Entitlements.child_classes.map do |group_name, obj|
-      obj.calculate
+      provider = Entitlements.config["groups"].fetch(group_name).fetch("type")
+      timed_operation(phase: "calculate", provider: provider, target: group_name) { obj.calculate }
       if obj.change_count > 0
         logger.debug "Group #{group_name.inspect} contributes #{obj.change_count} change(s)."
         cache[:change_count] += obj.change_count
@@ -422,8 +482,14 @@ module Entitlements
     actions: C::ArrayOf[Entitlements::Models::Action]
   ] => nil
   def self.execute(actions:)
+    timed_operation(phase: "execute_total", span: "parent") { execute_actions(actions: actions) }
+  end
+
+  def self.execute_actions(actions:)
     # Set up auditors.
-    Entitlements.auditors.each { |auditor| auditor.setup }
+    Entitlements.auditors.each do |auditor|
+      timed_operation(phase: "audit_setup", provider: auditor.provider_id) { auditor.setup }
+    end
 
     # Track any raised exception to pass to the auditors.
     provider_exception = nil
@@ -433,14 +499,18 @@ module Entitlements
     # Sort the child classes by priority
     begin
       # Pre-apply changes for each class.
-      Entitlements.child_classes.each do |_, obj|
-        obj.preapply
+      Entitlements.child_classes.each do |group_name, obj|
+        provider = Entitlements.config["groups"].fetch(group_name).fetch("type")
+        timed_operation(phase: "preapply", provider: provider, target: group_name) { obj.preapply }
       end
 
       # Apply changes from all actions.
       actions.each do |action|
         obj = Entitlements.child_classes.fetch(action.ou)
-        obj.apply(action)
+        provider = Entitlements.config["groups"].fetch(action.ou).fetch("type")
+        timed_operation(phase: "apply", provider: provider, target: action.ou, count: 1) do
+          obj.apply(action)
+        end
         successful_actions.add(action.dn)
       end
     rescue => e
@@ -457,11 +527,13 @@ module Entitlements
         logger.debug "Recording data to #{Entitlements.auditors.size} audit provider(s)"
         Entitlements.auditors.each do |audit|
           begin
-            audit.commit(
-              actions: actions,
-              successful_actions: successful_actions,
-              provider_exception: provider_exception
-            )
+            timed_operation(phase: "audit_commit", provider: audit.provider_id) do
+              audit.commit(
+                actions: actions,
+                successful_actions: successful_actions,
+                provider_exception: provider_exception
+              )
+            end
             logger.debug "Audit #{audit.description} completed successfully"
           rescue => e
             logger.error "Audit #{audit.description} failed: #{e.class} #{e.message}"
@@ -564,7 +636,9 @@ module Entitlements
 
       objects = people_data_sources.map do |ds_name, ds_config|
         people_obj = Entitlements::Data::People.new_from_config(ds_config)
-        people_obj.read
+        timed_operation(phase: "prefetch_people_source", provider: ds_config.fetch("type"), target: ds_name) do
+          people_obj.read
+        end
         [ds_name, people_obj]
       end.to_h
 

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.1"
+    VERSION = "1.2.3"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-app
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.2.3
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-11-10 00:00:00.000000000 Z
+date: 2026-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -30,6 +30,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.3.1
+- !ruby/object:Gem::Dependency
+  name: dogstatsd-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.7'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.7'
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement