entitlements-app 1.2.2 → 1.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18a0176e1783a420da17eee12174e9cc6f17224f980e991149743bd2366a1dbc
-  data.tar.gz: 2acf3be9e885ade8181e3fb47adfc87fbfca609bb9978ca84c9d3b6816ae0ad5
+  metadata.gz: 1d78c3e43bb1a892e7d45aa8c1a9c608c26db75f36a8adda13646b5ae9a756dc
+  data.tar.gz: afd0505ea8106dbaaa3486e1c2dfab168c6209b97d99322cc6f560a6526f8aab
 SHA512:
-  metadata.gz: 73162232f10dca6c007c7ca5025a385d10ff06b809b1a0daace0fcc3dbcba877337b5a191963d173eeb64ff6635a4dd05f05857fb9ed37201f6cb5dfdd541ef9
-  data.tar.gz: ef9e75e2916d78607a4f963f9661c1b36c48055b97d34f0f6286c2f6ba22324f8241d7775a15f37df4bc2a9ed1d823cba5b6553fd9db6e5c9e5050e1cc1fc0a0
+  metadata.gz: 0b1279f7726543ffcaf95228c7b0f831f462bcb05431db9acd195afa01f6f40c00561dd0cb81c3c097c9d75291d87db1c2eb16a237e2ced1b22ac3d00b8967b4
+  data.tar.gz: b0f8f91d63df0e79a77bf8e00d39a2403a2281a71dc533f7d45bb0ba476c30f45953f828011006a9533ec2f3f77796859a16d5bd832a2e1d4272f8a598894bb8

data/lib/entitlements/service/ldap.rb

@@ -17,9 +17,9 @@ module Entitlements
       # This keeps the schema happy.
       attr_reader :binddn, :person_dn_format
 
-      # Constructor-like object that ensures only one LDAP object (and hence connection)
-      # is made for a given LDAP server, for efficiency sake. Takes the same parameters as
-      # the constructor and returns the same object type.
+      # Constructor-like object that ensures only one LDAP service object is made for a
+      # given LDAP server. Takes the same parameters as the constructor and returns the
+      # same object type.
       #
       # addr   - URL of LDAP server e.g. ldaps://ldap.example.net:636
       # binddn - DN to bind with
@@ -80,6 +80,8 @@ module Entitlements
         @ca_file = ca_file
         @disable_ssl_verification = disable_ssl_verification
         @person_dn_format = person_dn_format
+        @known_existing_dns = {}
+        @known_existing_dns_mutex = Mutex.new
       end
 
       # Read a single entry identified by its DN and return the value. Returns nil if
@@ -119,7 +121,13 @@ module Entitlements
         downcased_attrs = attrs == "*" ? "*" : attrs.map { |a| a.downcase }
 
         result = {}
-        ldap.search(base: base, filter: filter, attributes: downcased_attrs, scope: scope, return_result: false) do |entry|
+        search_succeeded = ldap.search(
+          base: base,
+          filter: filter,
+          attributes: downcased_attrs,
+          scope: scope,
+          return_result: false
+        ) do |entry|
           result_key = index == :dn ? entry.dn : entry[index]
           unless result_key
             raise EntryError, "#{entry.dn} has no value for #{index.inspect}"
@@ -132,6 +140,7 @@ module Entitlements
 
           result[result_key] = entry
         end
+        remember_existing_dn(base) if search_succeeded
 
         Entitlements.logger.debug "Completed search: #{result.keys.size} result(s)"
 
@@ -145,6 +154,7 @@ module Entitlements
       # Returns true if the entry exists, false otherwise.
       Contract String => C::Bool
       def exists?(dn)
+        return true if known_existing_dn?(dn)
         read(dn).is_a?(Net::LDAP::Entry)
       end
 
@@ -180,7 +190,10 @@ module Entitlements
 
         ldap.delete(dn: dn)
         operation_result = ldap.get_operation_result
-        return true if operation_result["code"] == 0
+        if operation_result["code"] == 0
+          forget_dn(dn)
+          return true
+        end
         Entitlements.logger.error "Error deleting #{dn}: #{operation_result['message']}"
         false
       end
@@ -215,11 +228,24 @@ module Entitlements
 
       attr_reader :addr, :bindpw
 
-      # The LDAP object is initialized and bound on demand the first time it's called.
+      def known_existing_dn?(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns.key?(dn) }
+      end
+
+      def remember_existing_dn(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns[dn] = true }
+      end
+
+      def forget_dn(dn)
+        @known_existing_dns_mutex.synchronize { @known_existing_dns.delete(dn) }
+        @dn_cache&.delete(dn)
+      end
+
+      # The LDAP object is initialized and its credentials are validated on demand.
       #
       # Takes no arguments.
       #
-      # Returns a Net::LDAP object that is connected and bound.
+      # Returns a Net::LDAP object configured to connect and bind for each operation.
       Contract C::None => Net::LDAP
       def ldap
         @ldap ||= begin

data/lib/version.rb

@@ -2,6 +2,6 @@
 
 module Entitlements
   module Version
-    VERSION = "1.2.2"
+    VERSION = "1.2.3"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-app
 version: !ruby/object:Gem::Version
-  version: 1.2.2
+  version: 1.2.3
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-08 00:00:00.000000000 Z
+date: 2026-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby