entitlements-app 1.2.3 → 1.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d78c3e43bb1a892e7d45aa8c1a9c608c26db75f36a8adda13646b5ae9a756dc
-  data.tar.gz: afd0505ea8106dbaaa3486e1c2dfab168c6209b97d99322cc6f560a6526f8aab
+  metadata.gz: bdd6741cf78fb17f3d3cc0e21b27543be1b02810317b906bd7344fc4652f11dd
+  data.tar.gz: a4a0ccd8e4ff59d73ec26eb494c16c68ce88d8c4c5df4c6fd969e53d91d92dc6
 SHA512:
-  metadata.gz: 0b1279f7726543ffcaf95228c7b0f831f462bcb05431db9acd195afa01f6f40c00561dd0cb81c3c097c9d75291d87db1c2eb16a237e2ced1b22ac3d00b8967b4
-  data.tar.gz: b0f8f91d63df0e79a77bf8e00d39a2403a2281a71dc533f7d45bb0ba476c30f45953f828011006a9533ec2f3f77796859a16d5bd832a2e1d4272f8a598894bb8
+  metadata.gz: 801efc4677593d00afd2c52e60c56d1fdb5b5fb87c9957c2bc71f7a9adc7766cfd4e49f95b2621935be7d5fa8001815029b2fe196290312affe4eff93e142092
+  data.tar.gz: a179762674b835b741edfdef40ec65f7a57738509c2d31a11aa702ee57aea5c67aaff03761d3f9a89fe1f92258b6d0e5511d9715617df0a5cb5d3f123d0846d9

data/lib/entitlements/data/groups/calculated/base.rb

@@ -217,7 +217,7 @@ module Entitlements
             return false if expiration.nil? || expiration.strip.empty?
             if expiration =~ /\A(\d{4})-(\d{2})-(\d{2})\z/
               year, month, day = Regexp.last_match(1).to_i, Regexp.last_match(2).to_i, Regexp.last_match(3).to_i
-              return Time.utc(year, month, day, 0, 0, 0) <= Time.now.utc
+              return Time.utc(year, month, day, 0, 0, 0) <= Entitlements.evaluation_time.utc
             end
             message = "Invalid expiration date #{expiration.inspect} in #{context} (expected format: YYYY-MM-DD)"
             raise ArgumentError, message
@@ -340,7 +340,7 @@ module Entitlements
           # Returns C::SetOf[Entitlements::Models::Person] from a recursive call.
           def handle_and(rule)
             ensure_type!("and", rule, Array)
-            return result unless rule.any?
+            return Set.new unless rule.any?
 
             first_rule = rule.shift
             ensure_type!("and", first_rule, Hash)

data/lib/entitlements/data/groups/calculated/modifiers/expiration.rb

@@ -30,7 +30,7 @@ module Entitlements
               end
 
               # If the date is in the future, leave the entitlement unchanged.
-              return false if parse_date > Time.now.utc.to_date
+              return false if parse_date > Entitlements.evaluation_time.utc.to_date
 
               # Empty the group. Set metadata allowing no members. Return true to indicate modification.
               rs.metadata["no_members_ok"] = true

data/lib/entitlements/data/groups/calculated/text.rb

@@ -21,10 +21,12 @@ module Entitlements
           # Returns a Set[String] with DN's of the people in the group.
           Contract C::None => C::Or[:calculating, C::SetOf[Entitlements::Models::Person]]
           def members
-            @members ||= begin
-              Entitlements.logger.debug "Calculating members from #{filename}"
-              members_from_rules(rules)
-            end
+            return @members if @members
+
+            Entitlements.logger.debug "Calculating members from #{filename}"
+            result = members_from_rules(rules)
+            @members = result unless result == :calculating
+            result
           end
 
           # Standard interface: Get the description of this group.
@@ -182,7 +184,7 @@ module Entitlements
               if parsed_data.key?("modifier_expiration") && affirmative.empty?
                 exp_date = parsed_data.fetch("modifier_expiration").fetch("=").first.fetch(:key)
                 date = Entitlements::Util::Util.parse_date(exp_date)
-                return {"always" => false} if date <= Time.now.utc.to_date
+                return {"always" => false} if date <= Entitlements.evaluation_time.utc.to_date
               end
 
               # There has to be at least one affirmative condition, not just all negative ones.

data/lib/entitlements/data/groups/calculated/yaml.rb

@@ -18,10 +18,12 @@ module Entitlements
           # Returns a Set[String] with DN's of the people in the group.
           Contract C::None => C::Or[:calculating, C::SetOf[Entitlements::Models::Person]]
           def members
-            @members ||= begin
-              Entitlements.logger.debug "Calculating members from #{filename}"
-              members_from_rules(rules)
-            end
+            return @members if @members
+
+            Entitlements.logger.debug "Calculating members from #{filename}"
+            result = members_from_rules(rules)
+            @members = result unless result == :calculating
+            result
           end
 
           # Standard interface: Get the description of this group.

data/lib/entitlements.rb

@@ -22,6 +22,7 @@ require "logger"
 require "ostruct"
 require "resolv"
 require "stringio"
+require "thread"
 require "uri"
 require "yaml"
 
@@ -90,6 +91,7 @@ module Entitlements
     @config = nil
     @config_file = nil
     @config_path_override = nil
+    @evaluation_time = nil
     @person_extra_methods = {}
     @statsd = nil
 
@@ -97,6 +99,24 @@ module Entitlements
     Entitlements::Data::Groups::Calculated.reset!
   end
 
+  # Return the fixed time used for the current date-sensitive entitlement evaluation.
+  #
+  # Returns a Time.
+  Contract C::None => Time
+  def self.evaluation_time
+    @evaluation_time ||= Time.now
+  end
+
+  # Set the time used for date-sensitive entitlement evaluation.
+  #
+  # value - A Time.
+  #
+  # Returns the supplied Time.
+  Contract Time => Time
+  def self.evaluation_time=(value)
+    @evaluation_time = value
+  end
+
   def self.reset_extras!
     extras_loaded = @extras_loaded
     if extras_loaded
@@ -438,19 +458,33 @@ module Entitlements
     # Calculate old and new membership in each group.
     thread_pool = Concurrent::FixedThreadPool.new(max_parallelism)
     logger.debug("Begin prefetch and validate for all groups")
+
     prep_start = Time.now
-    futures = Entitlements.child_classes.map do |group_name, obj|
-      Concurrent::Future.execute({ executor: thread_pool }) do
-        group_start = Time.now
-        logger.debug("Begin prefetch and validate for #{group_name}")
-        provider = Entitlements.config["groups"].fetch(group_name).fetch("type")
-        timed_operation(phase: "prefetch", provider: provider, target: group_name, concurrent: true) { obj.prefetch }
-        timed_operation(phase: "validate", provider: provider, target: group_name, concurrent: true) { obj.validate }
-        logger.debug("Finished prefetch and validate for #{group_name} in #{Time.now - group_start}")
+    jobs = Entitlements.child_classes
+    completions = Queue.new
+
+    begin
+      jobs.each do |group_name, obj|
+        thread_pool.post do
+          group_start = Time.now
+          logger.debug("Begin prefetch and validate for #{group_name}")
+          provider = Entitlements.config["groups"].fetch(group_name).fetch("type")
+          timed_operation(phase: "prefetch", provider: provider, target: group_name, concurrent: true) { obj.prefetch }
+          timed_operation(phase: "validate", provider: provider, target: group_name, concurrent: true) { obj.validate }
+          logger.debug("Finished prefetch and validate for #{group_name} in #{Time.now - group_start}")
+          completions << nil
+        rescue => e
+          completions << e
+        end
       end
-    end
 
-    futures.each(&:value!)
+      jobs.size.times do
+        exception = completions.pop
+        raise exception if exception
+      end
+    ensure
+      thread_pool.kill
+    end
     logger.debug("Finished all prefetch and validate in #{Time.now - prep_start}")
 
     logger.debug("Begin all calculations")

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.3"
+    VERSION = "1.2.5"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-app
 version: !ruby/object:Gem::Version
-  version: 1.2.3
+  version: 1.2.5
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-14 00:00:00.000000000 Z
+date: 2026-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby