entitlements-app 1.2.2 → 1.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18a0176e1783a420da17eee12174e9cc6f17224f980e991149743bd2366a1dbc
-  data.tar.gz: 2acf3be9e885ade8181e3fb47adfc87fbfca609bb9978ca84c9d3b6816ae0ad5
+  metadata.gz: 2ff39c49f02bf4b3dcc8ced68357e2c85084416468d8300a79dd19c5685cac35
+  data.tar.gz: c40fb54374427dda1782344df0bdeb9d5401774a755e4c89d5795438d43a6605
 SHA512:
-  metadata.gz: 73162232f10dca6c007c7ca5025a385d10ff06b809b1a0daace0fcc3dbcba877337b5a191963d173eeb64ff6635a4dd05f05857fb9ed37201f6cb5dfdd541ef9
-  data.tar.gz: ef9e75e2916d78607a4f963f9661c1b36c48055b97d34f0f6286c2f6ba22324f8241d7775a15f37df4bc2a9ed1d823cba5b6553fd9db6e5c9e5050e1cc1fc0a0
+  metadata.gz: 0f0b5e0b20fc9a52547233b9b9f5dec204976d5a62d893a5d74b913af3222972fddadc12b2da5be4b7fb59ac8cf4722adc5f0da8a0415d8166cae3fc2066c119
+  data.tar.gz: 3585576afa5953596609cec10ca8995166e8803666cdece35003839dd365389eb46ee6e1298e8599537560083b28212f05e2d71155cd2dcc4e776f3ccbe934ec

data/lib/entitlements/data/groups/calculated/base.rb

@@ -217,7 +217,7 @@ module Entitlements
             return false if expiration.nil? || expiration.strip.empty?
             if expiration =~ /\A(\d{4})-(\d{2})-(\d{2})\z/
               year, month, day = Regexp.last_match(1).to_i, Regexp.last_match(2).to_i, Regexp.last_match(3).to_i
-              return Time.utc(year, month, day, 0, 0, 0) <= Time.now.utc
+              return Time.utc(year, month, day, 0, 0, 0) <= Entitlements.evaluation_time.utc
             end
             message = "Invalid expiration date #{expiration.inspect} in #{context} (expected format: YYYY-MM-DD)"
             raise ArgumentError, message
@@ -340,7 +340,7 @@ module Entitlements
           # Returns C::SetOf[Entitlements::Models::Person] from a recursive call.
           def handle_and(rule)
             ensure_type!("and", rule, Array)
-            return result unless rule.any?
+            return Set.new unless rule.any?
 
             first_rule = rule.shift
             ensure_type!("and", first_rule, Hash)

data/lib/entitlements/data/groups/calculated/modifiers/expiration.rb

@@ -30,7 +30,7 @@ module Entitlements
               end
 
               # If the date is in the future, leave the entitlement unchanged.
-              return false if parse_date > Time.now.utc.to_date
+              return false if parse_date > Entitlements.evaluation_time.utc.to_date
 
               # Empty the group. Set metadata allowing no members. Return true to indicate modification.
               rs.metadata["no_members_ok"] = true

data/lib/entitlements/data/groups/calculated/text.rb

@@ -21,10 +21,12 @@ module Entitlements
           # Returns a Set[String] with DN's of the people in the group.
           Contract C::None => C::Or[:calculating, C::SetOf[Entitlements::Models::Person]]
           def members
-            @members ||= begin
-              Entitlements.logger.debug "Calculating members from #{filename}"
-              members_from_rules(rules)
-            end
+            return @members if @members
+
+            Entitlements.logger.debug "Calculating members from #{filename}"
+            result = members_from_rules(rules)
+            @members = result unless result == :calculating
+            result
           end
 
           # Standard interface: Get the description of this group.
@@ -182,7 +184,7 @@ module Entitlements
               if parsed_data.key?("modifier_expiration") && affirmative.empty?
                 exp_date = parsed_data.fetch("modifier_expiration").fetch("=").first.fetch(:key)
                 date = Entitlements::Util::Util.parse_date(exp_date)
-                return {"always" => false} if date <= Time.now.utc.to_date
+                return {"always" => false} if date <= Entitlements.evaluation_time.utc.to_date
               end
 
               # There has to be at least one affirmative condition, not just all negative ones.

data/lib/entitlements/data/groups/calculated/yaml.rb

@@ -18,10 +18,12 @@ module Entitlements
           # Returns a Set[String] with DN's of the people in the group.
           Contract C::None => C::Or[:calculating, C::SetOf[Entitlements::Models::Person]]
           def members
-            @members ||= begin
-              Entitlements.logger.debug "Calculating members from #{filename}"
-              members_from_rules(rules)
-            end
+            return @members if @members
+
+            Entitlements.logger.debug "Calculating members from #{filename}"
+            result = members_from_rules(rules)
+            @members = result unless result == :calculating
+            result
           end
 
           # Standard interface: Get the description of this group.

data/lib/entitlements/service/ldap.rb

@@ -17,9 +17,9 @@ module Entitlements
       # This keeps the schema happy.
       attr_reader :binddn, :person_dn_format
 
-      # Constructor-like object that ensures only one LDAP object (and hence connection)
-      # is made for a given LDAP server, for efficiency sake. Takes the same parameters as
-      # the constructor and returns the same object type.
+      # Constructor-like object that ensures only one LDAP service object is made for a
+      # given LDAP server. Takes the same parameters as the constructor and returns the
+      # same object type.
       #
       # addr   - URL of LDAP server e.g. ldaps://ldap.example.net:636
       # binddn - DN to bind with
@@ -80,6 +80,8 @@ module Entitlements
         @ca_file = ca_file
         @disable_ssl_verification = disable_ssl_verification
         @person_dn_format = person_dn_format
+        @known_existing_dns = {}
+        @known_existing_dns_mutex = Mutex.new
       end
 
       # Read a single entry identified by its DN and return the value. Returns nil if
@@ -119,7 +121,13 @@ module Entitlements
         downcased_attrs = attrs == "*" ? "*" : attrs.map { |a| a.downcase }
 
         result = {}
-        ldap.search(base: base, filter: filter, attributes: downcased_attrs, scope: scope, return_result: false) do |entry|
+        search_succeeded = ldap.search(
+          base: base,
+          filter: filter,
+          attributes: downcased_attrs,
+          scope: scope,
+          return_result: false
+        ) do |entry|
           result_key = index == :dn ? entry.dn : entry[index]
           unless result_key
             raise EntryError, "#{entry.dn} has no value for #{index.inspect}"
@@ -132,6 +140,7 @@ module Entitlements
 
           result[result_key] = entry
         end
+        remember_existing_dn(base) if search_succeeded
 
         Entitlements.logger.debug "Completed search: #{result.keys.size} result(s)"
 
@@ -145,6 +154,7 @@ module Entitlements
       # Returns true if the entry exists, false otherwise.
       Contract String => C::Bool
       def exists?(dn)
+        return true if known_existing_dn?(dn)
         read(dn).is_a?(Net::LDAP::Entry)
       end
 
@@ -180,7 +190,10 @@ module Entitlements
 
         ldap.delete(dn: dn)
         operation_result = ldap.get_operation_result
-        return true if operation_result["code"] == 0
+        if operation_result["code"] == 0
+          forget_dn(dn)
+          return true
+        end
         Entitlements.logger.error "Error deleting #{dn}: #{operation_result['message']}"
         false
       end
@@ -215,11 +228,24 @@ module Entitlements
 
       attr_reader :addr, :bindpw
 
-      # The LDAP object is initialized and bound on demand the first time it's called.
+      def known_existing_dn?(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns.key?(dn) }
+      end
+
+      def remember_existing_dn(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns[dn] = true }
+      end
+
+      def forget_dn(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns.delete(dn) }
+        @dn_cache&.delete(dn)
+      end
+
+      # The LDAP object is initialized and its credentials are validated on demand.
       #
       # Takes no arguments.
       #
-      # Returns a Net::LDAP object that is connected and bound.
+      # Returns a Net::LDAP object configured to connect and bind for each operation.
       Contract C::None => Net::LDAP
       def ldap
         @ldap ||= begin

data/lib/entitlements.rb

@@ -90,6 +90,7 @@ module Entitlements
     @config = nil
     @config_file = nil
     @config_path_override = nil
+    @evaluation_time = nil
     @person_extra_methods = {}
     @statsd = nil
 
@@ -97,6 +98,24 @@ module Entitlements
     Entitlements::Data::Groups::Calculated.reset!
   end
 
+  # Return the fixed time used for the current date-sensitive entitlement evaluation.
+  #
+  # Returns a Time.
+  Contract C::None => Time
+  def self.evaluation_time
+    @evaluation_time ||= Time.now
+  end
+
+  # Set the time used for date-sensitive entitlement evaluation.
+  #
+  # value - A Time.
+  #
+  # Returns the supplied Time.
+  Contract Time => Time
+  def self.evaluation_time=(value)
+    @evaluation_time = value
+  end
+
   def self.reset_extras!
     extras_loaded = @extras_loaded
     if extras_loaded

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.2"
+    VERSION = "1.2.4"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-app
 version: !ruby/object:Gem::Version
-  version: 1.2.2
+  version: 1.2.4
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-08 00:00:00.000000000 Z
+date: 2026-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby