entitlements-app 1.2.8 → 1.2.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fdad062839c6178d6b23880ddc7c7392b5023d7f783e7b3686c3c3456392ff62
-  data.tar.gz: 924425bb54c9ffed6a6da2ff0a363e933b2351b45c2a4fa9c522ba5eb41fce39
+  metadata.gz: a782de54803d00a4afb8383789c796efbe8375eb92641c5537507f77eb4fb192
+  data.tar.gz: 2a53134a1ec22d96647f1739f6263a381d42d3a10620588d9c7561ff49a79e08
 SHA512:
-  metadata.gz: 74c0f06e2255e56c9a59f3a8bb6227a674b5a296ca310703c681434c78c210f658509689e41306910dfd41ae4a3247b5aeb7998654f05d17737d154fa98b453b
-  data.tar.gz: 10b6e365e40220d1c6687ded47c603b1a2b968ccdea7dc35fa61842743668d46466359f4dc954217bed2efcf13751f419cfb6133285e5eb3370a60cbc1a26f62
+  metadata.gz: 24254d8ce6d94b3c9b011effa5334c173db77dda656b72ce9bf40f82990a32328892b775d150642430d05c23cf0d4c114d4fe63b7455eab07c25465fed873369
+  data.tar.gz: 95e6dc2fafc0df322a9817a245e0c2131daa117a4dc919b4efbcd72d289e8349a09403b2111982e19c9db11c67b8d38090e091d3a71f8cc15168e83d3c118cac

data/lib/entitlements/data/groups/calculated/filters/base.rb

@@ -80,7 +80,7 @@ module Entitlements
                 member_set = Entitlements::Data::Groups::Calculated::Rules::Group.matches(
                   value: group_ref,
                 )
-                member_set.map { |person| person.uid.downcase }
+                member_set.map { |person| person.uid.downcase }.to_set
               end
 
               Entitlements.cache[:member_of_named_group][group_ref].include?(member.uid.downcase)

data/lib/entitlements/data/groups/calculated.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "monitor"
 require_relative "calculated/base"
 require_relative "calculated/ruby"
 require_relative "calculated/text"
@@ -26,6 +27,11 @@ module Entitlements
         @groups_cache = {}
         @config_cache = {}
 
+        # Group calculation shares state across groups (Entitlements.cache[:calculated], the
+        # dependency stack used for circular-reference detection, and the caches above), so only
+        # one thread may calculate at a time. Re-entrant because calculation can recurse.
+        CALCULATION_LOCK = Monitor.new
+
         # Reset all module state
         #
         # Takes no arguments
@@ -63,6 +69,13 @@ module Entitlements
           skip_broken_references: C::Optional[C::Bool]
         ] => C::SetOf[String]
         def self.read_all(ou_key, cfg_obj, skip_broken_references: false)
+          CALCULATION_LOCK.synchronize { _read_all(ou_key, cfg_obj, skip_broken_references: skip_broken_references) }
+        end
+
+        Contract String, C::HashOf[String => C::Any], C::KeywordArgs[
+          skip_broken_references: C::Bool
+        ] => C::SetOf[String]
+        def self._read_all(ou_key, cfg_obj, skip_broken_references:)
           return read_mirror(ou_key, cfg_obj) if cfg_obj["mirror"]
 
           @config_cache[ou_key] ||= cfg_obj

data/lib/entitlements/data/people/yaml.rb

@@ -73,7 +73,7 @@ module Entitlements
         # uid - Optionally a uid to return. If not specified, returns the entire hash.
         #
         # Returns Hash of { uid => Entitlements::Models::Person } or one Entitlements::Models::Person.
-        Contract C::Maybe[String] => C::Or[Entitlements::Models::Person, C::HashOf[String => Entitlements::Models::Person]]
+        Contract C::Maybe[String] => C::Or[Entitlements::Models::Person, Hash]
         def read(uid = nil)
           @people ||= begin
             Entitlements.logger.debug "Loading people from #{filename.inspect}"

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.8"
+    VERSION = "1.2.10"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-app
 version: !ruby/object:Gem::Version
-  version: 1.2.8
+  version: 1.2.10
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-04 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby