entitlements-app 1.2.7 → 1.2.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d3e0f1ede9a8b516f1553ef660e1926f99110baa8958e7049d2b5306576d9d3
-  data.tar.gz: 53260170e02ec2d3f21051e2d931b94b285d39fd9622e1f297e09a63df79c55e
+  metadata.gz: fdad062839c6178d6b23880ddc7c7392b5023d7f783e7b3686c3c3456392ff62
+  data.tar.gz: 924425bb54c9ffed6a6da2ff0a363e933b2351b45c2a4fa9c522ba5eb41fce39
 SHA512:
-  metadata.gz: 88c17c22c777d419fb095c24c488be663090c2d0ba00047b87add8d84c57769e80fe304a4f1365fe360c52cf0d00b6400c23907495b9d838ef85eebb3482b021
-  data.tar.gz: 7702ff6718762aa5b560582e39f7a141dbcae04c5eafed1189cdb617dc5411a038694f1325229e382a97df463479dd8cb64d4e5c58c59536637efb94bfbe610d
+  metadata.gz: 74c0f06e2255e56c9a59f3a8bb6227a674b5a296ca310703c681434c78c210f658509689e41306910dfd41ae4a3247b5aeb7998654f05d17737d154fa98b453b
+  data.tar.gz: 10b6e365e40220d1c6687ded47c603b1a2b968ccdea7dc35fa61842743668d46466359f4dc954217bed2efcf13751f419cfb6133285e5eb3370a60cbc1a26f62

data/lib/entitlements/service/ldap.rb

@@ -8,6 +8,8 @@ module Entitlements
       include ::Contracts::Core
       C = ::Contracts
 
+      MAX_CONNECTION_ATTEMPTS = 3
+
       class ConnectionError < RuntimeError; end
       class DuplicateEntryError < RuntimeError; end
       class EntryError < RuntimeError; end
@@ -120,27 +122,33 @@ module Entitlements
         # be consistent no matter what. LDAP is case insensitive after all!
         downcased_attrs = attrs == "*" ? "*" : attrs.map { |a| a.downcase }
 
-        result = {}
-        search_succeeded = ldap.search(
-          base: base,
-          filter: filter,
-          attributes: downcased_attrs,
-          scope: scope,
-          return_result: false
-        ) do |entry|
-          result_key = index == :dn ? entry.dn : entry[index]
-          unless result_key
-            raise EntryError, "#{entry.dn} has no value for #{index.inspect}"
-          end
+        # Outside the retry block: `ldap` retries its own bind, and nesting would multiply attempts.
+        connection = ldap
+        result = with_ldap_connection_retries do
+          entries = {}
+          search_succeeded = connection.search(
+            base: base,
+            filter: filter,
+            attributes: downcased_attrs,
+            scope: scope,
+            return_result: false
+          ) do |entry|
+            result_key = index == :dn ? entry.dn : entry[index]
+            unless result_key
+              raise EntryError, "#{entry.dn} has no value for #{index.inspect}"
+            end
+
+            if entries.key?(result_key)
+              other_entry_dn = entries[result_key].dn
+              raise DuplicateEntryError, "#{entry.dn} and #{other_entry_dn} have the same value of #{index} = #{result_key.inspect}"
+            end
 
-          if result.key?(result_key)
-            other_entry_dn = result[result_key].dn
-            raise DuplicateEntryError, "#{entry.dn} and #{other_entry_dn} have the same value of #{index} = #{result_key.inspect}"
+            entries[result_key] = entry
           end
+          remember_existing_dn(base) if search_succeeded
 
-          result[result_key] = entry
+          entries
         end
-        remember_existing_dn(base) if search_succeeded
 
         Entitlements.logger.debug "Completed search: #{result.keys.size} result(s)"
 
@@ -248,7 +256,7 @@ module Entitlements
       # Returns a Net::LDAP object configured to connect and bind for each operation.
       Contract C::None => Net::LDAP
       def ldap
-        @ldap ||= begin
+        @ldap ||= with_ldap_connection_retries do
           uri = URI(addr)
 
           # Construct the object
@@ -289,6 +297,40 @@ module Entitlements
         end
       end
 
+      def with_ldap_connection_retries
+        attempts = 0
+        begin
+          attempts += 1
+          yield
+        rescue SystemCallError, Net::LDAP::Error => error
+          raise unless retryable_connection_error?(error)
+
+          uri = URI(addr)
+          if attempts >= MAX_CONNECTION_ATTEMPTS
+            Entitlements.logger.error "LDAP connection to #{uri.host}:#{uri.port} failed after #{attempts} attempts: #{error.class}: #{error.message}"
+            raise
+          end
+
+          Entitlements.logger.warn "LDAP connection to #{uri.host}:#{uri.port} failed (attempt #{attempts} of #{MAX_CONNECTION_ATTEMPTS}): #{error.class}: #{error.message}. Retrying in #{attempts}s."
+          sleep attempts
+          retry
+        end
+      end
+
+      # net-ldap turns single-host connection-setup failures (DNS, connect/TLS timeouts,
+      # unreachable host) into a bare Net::LDAP::Error with no cause, and the messages vary
+      # by libc. Operation errors are subclasses. Errno cases can hit mid-request; that's
+      # fine only because this never wraps writes.
+      def retryable_connection_error?(error)
+        case error
+        when Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EPIPE, Errno::ETIMEDOUT
+          true
+        when Net::LDAP::Error
+          error.instance_of?(Net::LDAP::Error) &&
+            !error.message.match?(/certificate verify failed|does not match the server certificate/)
+        end
+      end
+
       # Create an object that does not exist. Private method intended to be called from
       # "upsert" after determining that the object doesn't exist.
       #

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.7"
+    VERSION = "1.2.8"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-app
 version: !ruby/object:Gem::Version
-  version: 1.2.7
+  version: 1.2.8
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-14 00:00:00.000000000 Z
+date: 2026-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby