legion-crypt 1.4.16 → 1.4.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ff70cf0304e424576841101c5c3399bded877b2995200049a76d7741f008bdf
-  data.tar.gz: 7440aa2dfb8246fac7cb115bbed096a9ee7dd21b7538efdea69388a3293df313
+  metadata.gz: e3a746c03498b392437f0d7db81caca5f6daa84aeda465bbf0db71bb898d25f1
+  data.tar.gz: d27dfcdfa9032fa6bc8df4174f370c7896151c746bf8b810421d1c28d5d8e51b
 SHA512:
-  metadata.gz: 10d2966123e6e1764e039001f8543f56abd5b2239293947ade3d0db69dcbe80e5117e8ef948b3bbbbdd42d42ce31bdf539c2f4d3a2a0007afcdcb7308286f6fd
-  data.tar.gz: c226b7ac31c8a8dc310224c4d7fb8501da35ac4489cfa144d469ca4d1a96a4fa9337e23d43b5725c893c95a47e52f8503378cb2d9f743cf3b45b963d7b8dfe28
+  metadata.gz: 9e3a72a7a2fc6b78439f582b33c3c667fb40f1ef86c8a0201fb53e38d2d122e3689fa3496e11df36e5085a551753d58864a8033bc2cb028662922d87ce7afc9a
+  data.tar.gz: ab485a6da390007f060067bcca2863a5585fd6845f2dfc023658d48c6195364af7f99bf86f2492830d7991ae6a600a43fbd819d715412ca3f9c210fa95a830e3

data/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Legion::Crypt
 
+## [1.4.19] - 2026-03-26
+
+### Fixed
+- `LeaseManager`, `VaultJwtAuth`, `LdapAuth`, `VaultKerberosAuth`: use `renewable?` instead of `renewable` to match Vault gem API
+- `LeaseManager#fetch`: handle string/symbol key mismatch between resolver (strings) and cache (symbols)
+- `VaultCluster#connect_all_clusters`: set top-level `vault.connected` flag after any cluster connects via Kerberos/LDAP
+- `Vault#add_session`: guard `@sessions` with lazy init to prevent nil error when using cluster-based auth
+
+## [1.4.18] - 2026-03-26
+
+### Fixed
+- `KerberosAuth.login`: clear `@kerberos_principal` at the start of each login attempt so a failed re-auth does not leave a stale principal from a previous successful login
+
+### Added
+- `crypt_spec.rb`: delegation spec for `Legion::Crypt.kerberos_principal`
+- `kerberos_auth_spec.rb`: spec verifying stale principal is cleared before a failing login attempt
+
+## [1.4.17] - 2026-03-26
+
+### Added
+- Store Kerberos principal after successful SPNEGO authentication (`KerberosAuth.kerberos_principal`)
+- Expose `Legion::Crypt.kerberos_principal` delegation
+
 ## [1.4.16] - 2026-03-26
 
 ### Changed

data/lib/legion/crypt/kerberos_auth.rb

@@ -8,11 +8,20 @@ module Legion
 
       DEFAULT_AUTH_PATH = 'auth/kerberos/login'
 
+      @kerberos_principal = nil
+
+      class << self
+        attr_reader :kerberos_principal
+      end
+
       def self.login(vault_client:, service_principal:, auth_path: DEFAULT_AUTH_PATH)
         raise GemMissingError, 'lex-kerberos gem is required for Kerberos auth' unless spnego_available?
 
+        @kerberos_principal = nil
         token = obtain_token(service_principal)
-        exchange_token(vault_client, token, auth_path)
+        result = exchange_token(vault_client, token, auth_path)
+        @kerberos_principal = result[:metadata]&.dig('username') || result[:metadata]&.dig(:username)
+        result
       end
 
       def self.spnego_available?
@@ -29,6 +38,7 @@ module Legion
 
       def self.reset!
         @spnego_available = nil
+        @kerberos_principal = nil
       end
 
       class << self

data/lib/legion/crypt/ldap_auth.rb

@@ -12,10 +12,11 @@ module Legion
 
         clusters[cluster_name][:token] = token
         clusters[cluster_name][:connected] = true
+        mark_vault_connected
 
         Legion::Logging.info "LDAP login success: user=#{username}, cluster=#{cluster_name}" if defined?(Legion::Logging)
         { token: token, lease_duration: auth.lease_duration,
-          renewable: auth.renewable, policies: auth.policies }
+          renewable: auth.renewable?, policies: auth.policies }
       rescue StandardError => e
         Legion::Logging.warn "LDAP login failed: user=#{username}, cluster=#{cluster_name}: #{e.message}" if defined?(Legion::Logging)
         raise

data/lib/legion/crypt/lease_manager.rb

@@ -33,7 +33,7 @@ module Legion
             @active_leases[name] = {
               lease_id:       response.lease_id,
               lease_duration: response.lease_duration,
-              renewable:      response.renewable,
+              renewable:      response.renewable?,
               expires_at:     Time.now + (response.lease_duration || 0),
               fetched_at:     Time.now
             }
@@ -45,7 +45,7 @@ module Legion
       end
 
       def fetch(name, key)
-        data = @lease_cache[name]
+        data = @lease_cache[name.to_sym] || @lease_cache[name.to_s]
         return nil unless data
 
         data[key.to_sym] || data[key.to_s]

data/lib/legion/crypt/vault.rb

@@ -85,6 +85,7 @@ module Legion
       end
 
       def add_session(path:)
+        @sessions ||= []
         @sessions.push(path)
       end
 

data/lib/legion/crypt/vault_cluster.rb

@@ -60,11 +60,19 @@ module Legion
           results[name] = false
           log_vault_error(name, e)
         end
+
+        mark_vault_connected if results.any? { |_, v| v }
         results
       end
 
       private
 
+      def mark_vault_connected
+        return unless defined?(Legion::Settings)
+
+        Legion::Settings[:crypt][:vault][:connected] = true
+      end
+
       def resolve_cluster_name(name)
         return name.to_sym if name
 

data/lib/legion/crypt/vault_jwt_auth.rb

@@ -39,7 +39,7 @@ module Legion
         {
           token:          response.auth.client_token,
           lease_duration: response.auth.lease_duration,
-          renewable:      response.auth.renewable,
+          renewable:      response.auth.renewable?,
           policies:       response.auth.policies,
           metadata:       response.auth.metadata
         }

data/lib/legion/crypt/vault_kerberos_auth.rb

@@ -16,7 +16,7 @@ module Legion
         {
           token:          response.auth.client_token,
           lease_duration: response.auth.lease_duration,
-          renewable:      response.auth.renewable,
+          renewable:      response.auth.renewable?,
           policies:       response.auth.policies,
           metadata:       response.auth.metadata
         }

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.16'
+    VERSION = '1.4.19'
   end
 end

data/lib/legion/crypt.rb

@@ -34,6 +34,10 @@ module Legion
         Legion::Settings[:crypt][:vault]
       end
 
+      def kerberos_principal
+        KerberosAuth.kerberos_principal
+      end
+
       def start
         Legion::Logging.debug 'Legion::Crypt is running start'
         ::File.write('./legionio.key', private_key) if settings[:save_private_key]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.4.16
+  version: 1.4.19
 platform: ruby
 authors:
 - Esity