legion-crypt 0.3.0 → 1.3.0

data/lib/legion/crypt.rb

@@ -4,8 +4,10 @@ require 'openssl'
 require 'base64'
 require 'legion/crypt/version'
 require 'legion/crypt/settings'
-
 require 'legion/crypt/cipher'
+require 'legion/crypt/jwt'
+require 'legion/crypt/vault_jwt_auth'
+require 'legion/crypt/lease_manager'
 
 module Legion
   module Crypt
@@ -24,6 +26,7 @@ module Legion
         ::File.write('./legionio.key', private_key) if settings[:save_private_key]
 
         connect_vault unless settings[:vault][:token].nil?
+        start_lease_manager
       end
 
       def settings
@@ -34,10 +37,53 @@ module Legion
         end
       end
 
+      def jwt_settings
+        settings[:jwt] || Legion::Crypt::Settings.jwt
+      end
+
+      def issue_token(payload = {}, ttl: nil, algorithm: nil)
+        jwt = jwt_settings
+        algo = algorithm || jwt[:default_algorithm]
+        token_ttl = ttl || jwt[:default_ttl]
+
+        signing_key = algo == 'RS256' ? private_key : settings[:cluster_secret]
+
+        Legion::Crypt::JWT.issue(payload, signing_key: signing_key, algorithm: algo, ttl: token_ttl,
+                                          issuer: jwt[:issuer])
+      end
+
+      def verify_token(token, algorithm: nil)
+        jwt = jwt_settings
+        algo = algorithm || jwt[:default_algorithm]
+
+        verification_key = algo == 'RS256' ? OpenSSL::PKey::RSA.new(public_key) : settings[:cluster_secret]
+
+        Legion::Crypt::JWT.verify(token, verification_key: verification_key, algorithm: algo,
+                                         verify_expiration: jwt[:verify_expiration],
+                                         verify_issuer: jwt[:verify_issuer],
+                                         issuer: jwt[:issuer])
+      end
+
       def shutdown
+        Legion::Crypt::LeaseManager.instance.shutdown
         shutdown_renewer
         close_sessions
       end
+
+      private
+
+      def start_lease_manager
+        leases = settings.dig(:vault, :leases) || {}
+        return if leases.empty?
+        return unless settings.dig(:vault, :connected)
+
+        lease_manager = Legion::Crypt::LeaseManager.instance
+        lease_manager.start(leases)
+        lease_manager.start_renewal_thread
+        Legion::Logging.info "LeaseManager: #{leases.size} lease(s) initialized"
+      rescue StandardError => e
+        Legion::Logging.warn "LeaseManager startup failed: #{e.message}"
+      end
     end
   end
 end

metadata

@@ -1,191 +1,83 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Esity
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-03 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: vault
+  name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.15.0
+        version: '2.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.15.0
-- !ruby/object:Gem::Dependency
-  name: legionio
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: legion-logging
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: legion-settings
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: legion-transport
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.7'
 - !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rspec_junit_formatter
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: 0.18.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: 0.18.0
-- !ruby/object:Gem::Dependency
-  name: simplecov_json_formatter
+  name: vault
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
+        version: '0.17'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-description: Integrates with Hashicorps vault and other encryption type things
+        version: '0.17'
+description: A gem used by the LegionIO framework for encryption
 email:
 - matthewdiverson@gmail.com
 executables: []
 extensions: []
-extra_rdoc_files: []
+extra_rdoc_files:
+- CHANGELOG.md
+- LICENSE
+- README.md
 files:
-- ".circleci/config.yml"
+- ".github/workflows/ci.yml"
 - ".gitignore"
-- ".rspec"
 - ".rubocop.yml"
+- CHANGELOG.md
+- CLAUDE.md
 - Gemfile
-- Gemfile.lock
-- LICENSE.txt
+- LICENSE
 - README.md
-- Rakefile
-- bitbucket-pipelines.yml
 - legion-crypt.gemspec
 - lib/legion/crypt.rb
 - lib/legion/crypt/cipher.rb
+- lib/legion/crypt/cluster_secret.rb
+- lib/legion/crypt/jwt.rb
+- lib/legion/crypt/lease_manager.rb
 - lib/legion/crypt/settings.rb
 - lib/legion/crypt/vault.rb
+- lib/legion/crypt/vault_jwt_auth.rb
 - lib/legion/crypt/vault_renewer.rb
 - lib/legion/crypt/version.rb
-- settings/transport.json
 - sonar-project.properties
-homepage: https://bitbucket.org/legion-io/legion-vault/
+homepage: https://github.com/LegionIO/legion-crypt
 licenses:
-- MIT
+- Apache-2.0
 metadata:
-  homepage_uri: https://bitbucket.org/legion-io/legion-vault/
-  source_code_uri: https://bitbucket.org/legion-io/legion/
-  changelog_uri: https://bitbucket.org/legion-io/legion/src/master/CHANGELOG.md
-  wiki_uri: https://bitbucket.org/legion-io/legion-crypt/wiki
-  bug_tracker_uri: https://bitbucket.org/legion-io/legion-crypt/issues
-post_install_message:
+  bug_tracker_uri: https://github.com/LegionIO/legion-crypt/issues
+  changelog_uri: https://github.com/LegionIO/legion-crypt/blob/main/CHANGELOG.md
+  documentation_uri: https://github.com/LegionIO/legion-crypt
+  homepage_uri: https://github.com/LegionIO/LegionIO
+  source_code_uri: https://github.com/LegionIO/legion-crypt
+  wiki_uri: https://github.com/LegionIO/legion-crypt/wiki
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -193,15 +85,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.6
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
-summary: Legion::Vault is used to keep things safe
+summary: Handles requests for encrypt, decrypting, connecting to Vault, among other
+  things
 test_files: []

data/.circleci/config.yml

@@ -1,105 +0,0 @@
-version: 2.1
-orbs:
-  ruby: circleci/ruby@1.1.2
-  sonarcloud: sonarsource/sonarcloud@1.0.2
-
-jobs:
-  "rubocop":
-    docker:
-      - image: cimg/ruby:2.7
-    steps:
-      - checkout
-      - restore_cache:
-          key: "bundler cache mri"
-      - run: bundle update
-      - run: bundle exec rubocop --format=json --out=rubocop-result.json
-      - store_test_results:
-          path: rubocop-result.json
-      - sonarcloud/scan
-      - run: bundle exec rubocop
-      - save_cache:
-          key: "bundler cache mri"
-          paths:
-            - "/usr/local/bundle"
-  "ruby-two-five":
-    docker:
-      - image: cimg/ruby:2.5
-    steps:
-      - checkout
-      - restore_cache:
-          key: "bundler cache mri"
-      - run: bundle update
-      - save_cache:
-          key: "bundler cache mri"
-          paths:
-            - "/usr/local/bundle"
-      - run: bundle exec rspec --format progress --format RspecJunitFormatter -o rspec-results.xml
-      - store_test_results:
-          path: rspec-results.xml
-      - sonarcloud/scan
-  "ruby-two-six":
-    docker:
-      - image: cimg/ruby:2.6
-    steps:
-      - checkout
-      - restore_cache:
-          key: "bundler cache mri"
-      - run: bundle update
-      - save_cache:
-          key: "bundler cache mri"
-          paths:
-            - "/usr/local/bundle"
-      - run: bundle exec rspec --format progress --format RspecJunitFormatter -o rspec-results.xml
-      - store_test_results:
-          path: rspec-results.xml
-      - sonarcloud/scan
-  "ruby-two-seven":
-    docker:
-      - image: circleci/ruby:2.7
-    steps:
-      - checkout
-      - restore_cache:
-          key: "bundler cache mri"
-      - run: bundle update
-      - save_cache:
-          key: "bundler cache mri"
-          paths:
-            - "/usr/local/bundle"
-      - run: bundle exec rspec --format progress --format RspecJunitFormatter -o rspec-results.xml
-      - store_test_results:
-          path: rspec-results.xml
-      - sonarcloud/scan
-  "ruby-three":
-    docker:
-      - image: circleci/ruby:3
-    steps:
-      - checkout
-      - restore_cache:
-          key: "bundler cache mri"
-      - run: bundle update
-      - save_cache:
-          key: "bundler cache mri"
-          paths:
-            - "/usr/local/bundle"
-      - run: bundle exec rspec --format progress --format RspecJunitFormatter -o rspec-results.xml
-      - store_test_results:
-          path: rspec-results.xml
-      - sonarcloud/scan
-
-workflows:
-  version: 2
-  rubocop-rspec:
-    jobs:
-      - rubocop
-      - ruby-two-five:
-          requires:
-            - rubocop
-      - ruby-two-six:
-          requires:
-            - ruby-two-five
-      - ruby-two-seven:
-          requires:
-            - ruby-two-five
-      - ruby-three:
-          requires:
-            - ruby-two-five

data/.rspec

@@ -1,3 +0,0 @@
---format documentation
---color
---require spec_helper

data/Gemfile.lock

@@ -1,123 +0,0 @@
-PATH
-  remote: .
-  specs:
-    legion-crypt (0.2.4)
-      vault (>= 0.15.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    amq-protocol (2.3.2)
-    ast (2.4.2)
-    aws-eventstream (1.1.0)
-    aws-sigv4 (1.2.2)
-      aws-eventstream (~> 1, >= 1.0.2)
-    bunny (2.17.0)
-      amq-protocol (~> 2.3, >= 2.3.1)
-    concurrent-ruby (1.1.8)
-    concurrent-ruby-ext (1.1.8)
-      concurrent-ruby (= 1.1.8)
-    connection_pool (2.2.3)
-    daemons (1.3.1)
-    dalli (2.7.11)
-    diff-lcs (1.4.4)
-    docile (1.3.5)
-    json (2.5.1)
-    json_pure (2.5.1)
-    legion-cache (1.1.1)
-      connection_pool (>= 2.2.3)
-      dalli (>= 2.7)
-      redis (>= 4.2)
-    legion-exceptions (1.1.5)
-    legion-json (1.1.4)
-      json_pure
-      legion-exceptions (>= 1.1.5)
-      multi_json
-    legion-logging (1.1.4)
-      rainbow (~> 3)
-    legion-settings (1.1.3)
-      legion-json
-      legion-logging
-    legion-transport (1.1.9)
-      bunny (>= 2.17.0)
-      concurrent-ruby (>= 1.1.7)
-      legion-json
-    legionio (0.4.2)
-      concurrent-ruby (>= 1.1.7)
-      concurrent-ruby-ext (>= 1.1.7)
-      daemons (>= 1.3.1)
-      legion-cache
-      legion-crypt (>= 0.2.0)
-      legion-exceptions
-      legion-json
-      legion-logging
-      legion-settings
-      legion-transport (>= 1.1.9)
-      lex-node
-      oj (>= 3.10)
-      thor (>= 1)
-    lex-node (0.1.4)
-    multi_json (1.15.0)
-    oj (3.11.2)
-    parallel (1.20.1)
-    parser (3.0.0.0)
-      ast (~> 2.4.1)
-    rainbow (3.0.0)
-    redis (4.2.5)
-    regexp_parser (2.1.1)
-    rexml (3.2.4)
-    rspec (3.10.0)
-      rspec-core (~> 3.10.0)
-      rspec-expectations (~> 3.10.0)
-      rspec-mocks (~> 3.10.0)
-    rspec-core (3.10.1)
-      rspec-support (~> 3.10.0)
-    rspec-expectations (3.10.1)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-mocks (3.10.2)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-support (3.10.2)
-    rspec_junit_formatter (0.4.1)
-      rspec-core (>= 2, < 4, != 2.12.0)
-    rubocop (1.11.0)
-      parallel (~> 1.10)
-      parser (>= 3.0.0.0)
-      rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml
-      rubocop-ast (>= 1.2.0, < 2.0)
-      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.4.1)
-      parser (>= 2.7.1.5)
-    ruby-progressbar (1.11.0)
-    simplecov (0.17.1)
-      docile (~> 1.1)
-      json (>= 1.8, < 3)
-      simplecov-html (~> 0.10.0)
-    simplecov-html (0.10.2)
-    simplecov_json_formatter (0.1.2)
-    thor (1.1.0)
-    unicode-display_width (2.0.0)
-    vault (0.15.0)
-      aws-sigv4
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  legion-crypt!
-  legion-logging
-  legion-settings
-  legion-transport
-  legionio
-  rspec
-  rspec_junit_formatter
-  rubocop
-  simplecov (< 0.18.0)
-  simplecov_json_formatter
-
-BUNDLED WITH
-   2.2.6

data/LICENSE.txt

@@ -1,21 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2020 Esity
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

data/Rakefile

@@ -1,8 +0,0 @@
-# frozen_string_literal: true
-
-require 'bundler/gem_tasks'
-require 'rspec/core/rake_task'
-
-RSpec::Core::RakeTask.new(:spec)
-
-task default: :spec

data/bitbucket-pipelines.yml

@@ -1,17 +0,0 @@
-image: ruby:2.7
-
-pipelines:
-  tags:
-    "v*":
-      - step:
-          name: Push to RubyGems
-          deployment: RubyGems
-          script:
-            - gem install gem-release
-            - (umask  077 ; echo $gem_creds | base64 --decode > ~/.gem/credentials)
-            - gem release
-          artifacts:
-            - pkg/**
-definitions:
-  caches:
-    bundler: /usr/local/bundle

data/settings/transport.json

@@ -1,5 +0,0 @@
-{
-  "transport": {
-    "vhost": "/"
-  }
-}