legion-crypt 1.4.18 → 1.4.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9397c4eab60b75a13e4f1e9fd842ce6b4908d94d891e9ea29a893fb33e71d5ef
-  data.tar.gz: 852ec5569b543089412ce28e96b32f6424e7da1f169e836d3e596dd51719c74d
+  metadata.gz: 6b78a171584f4ccb627b63cd35cad927a6773bd1802e0da432dd445dbceb85e4
+  data.tar.gz: b1806202e526aa259d1491a108f3d3b94b1c4564a05ea7b4afa702778069e715
 SHA512:
-  metadata.gz: 59170bcaead98cda37e2be65b1e9b294ab4eff65fde9251ebb2de24390224e8ed6bf3d62a523a11cd9ac1f2ead894dbffeee79815194c583e47a565b9ac7ff1c
-  data.tar.gz: 7f65e04abcb52c320f0d6e133569604d8eba37dcd4d63bcf046b0ba8fb70c631ebf4723bce2cd8ce728bf46a7b4992af389c3cb0da25bfd9c7c1176a38e56866
+  metadata.gz: a1cc01154f5fef732c05efe2d99213f1742aa486e2c703f7707709dbf29ab74484b49e5be4c3a1513b116ffdb658382b70e124067771549f9dcabd8cad1fd6f1
+  data.tar.gz: e8e674be70714e3d439330e8d1d03b323319dd60b0f2069c26087fa772ec27c61cbc3a1ca5ed47cdff30e5ee8a826e31f16b0695f35c479184be7a02fd34e2b7

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Legion::Crypt
 
+## [1.4.20] - 2026-03-27
+
+### Fixed
+- `Vault#read`: unwrap KV v2 response envelope — `logical.read` returns `{data: {keys}, metadata: {}}` for KV v2 mounts; the nested `:data` key is now auto-detected and unwrapped
+
+### Added
+- Debug logging throughout Vault auth, read, and cluster connection paths (`vault.rb`, `vault_cluster.rb`, `kerberos_auth.rb`, `lease_manager.rb`)
+- `Vault#log_read_context`: logs path and namespace context for each Vault read
+- `Vault#unwrap_kv_v2`: detects and unwraps KV v2 envelope pattern
+- `VaultCluster`: debug logging for cluster connection, client build, and Kerberos auth flow
+- `KerberosAuth`: debug logging for SPN, token exchange, policies, and renewal metadata
+- `LeaseManager`: debug logging for lease fetch, renewal, and revocation
+
+## [1.4.19] - 2026-03-26
+
+### Fixed
+- `LeaseManager`, `VaultJwtAuth`, `LdapAuth`, `VaultKerberosAuth`: use `renewable?` instead of `renewable` to match Vault gem API
+- `LeaseManager#fetch`: handle string/symbol key mismatch between resolver (strings) and cache (symbols)
+- `VaultCluster#connect_all_clusters`: set top-level `vault.connected` flag after any cluster connects via Kerberos/LDAP
+- `Vault#add_session`: guard `@sessions` with lazy init to prevent nil error when using cluster-based auth
+
 ## [1.4.18] - 2026-03-26
 
 ### Fixed

data/lib/legion/crypt/kerberos_auth.rb

@@ -17,10 +17,19 @@ module Legion
       def self.login(vault_client:, service_principal:, auth_path: DEFAULT_AUTH_PATH)
         raise GemMissingError, 'lex-kerberos gem is required for Kerberos auth' unless spnego_available?
 
+        log_debug("login: SPN=#{service_principal}, auth_path=#{auth_path}")
+        addr = vault_client.respond_to?(:address) ? vault_client.address : 'n/a'
+        ns   = vault_client.respond_to?(:namespace) ? vault_client.namespace.inspect : 'n/a'
+        log_debug("login: vault_client.address=#{addr}, namespace=#{ns}")
+
         @kerberos_principal = nil
         token = obtain_token(service_principal)
+        log_debug("login: SPNEGO token obtained (#{token.length} chars)")
+
         result = exchange_token(vault_client, token, auth_path)
         @kerberos_principal = result[:metadata]&.dig('username') || result[:metadata]&.dig(:username)
+        log_debug("login: authenticated as #{@kerberos_principal.inspect}, policies=#{result[:policies].inspect}")
+        log_debug("login: renewable=#{result[:renewable]}, ttl=#{result[:lease_duration]}s")
         result
       end
 
@@ -41,6 +50,11 @@ module Legion
         @kerberos_principal = nil
       end
 
+      def self.log_debug(message)
+        Legion::Logging.debug("KerberosAuth: #{message}") if defined?(Legion::Logging)
+      end
+      private_class_method :log_debug
+
       class << self
         private
 
@@ -58,6 +72,7 @@ module Legion
 
           # The Vault Kerberos plugin reads the SPNEGO token from the HTTP
           # Authorization header, not the JSON body.
+          log_debug("exchange_token: PUT /v1/#{auth_path} (namespace=#{vault_client.respond_to?(:namespace) ? vault_client.namespace.inspect : 'n/a'})")
           json = vault_client.put(
             "/v1/#{auth_path}",
             '{}',
@@ -75,6 +90,7 @@ module Legion
             metadata:       auth.metadata
           }
         rescue ::Vault::HTTPClientError => e
+          log_debug("exchange_token: HTTP error: #{e.message}")
           raise AuthError, "Vault Kerberos auth failed: #{e.message}"
         end
       end

data/lib/legion/crypt/ldap_auth.rb

@@ -12,10 +12,11 @@ module Legion
 
         clusters[cluster_name][:token] = token
         clusters[cluster_name][:connected] = true
+        mark_vault_connected
 
         Legion::Logging.info "LDAP login success: user=#{username}, cluster=#{cluster_name}" if defined?(Legion::Logging)
         { token: token, lease_duration: auth.lease_duration,
-          renewable: auth.renewable, policies: auth.policies }
+          renewable: auth.renewable?, policies: auth.policies }
       rescue StandardError => e
         Legion::Logging.warn "LDAP login failed: user=#{username}, cluster=#{cluster_name}: #{e.message}" if defined?(Legion::Logging)
         raise

data/lib/legion/crypt/lease_manager.rb

@@ -27,13 +27,16 @@ module Legion
 
           begin
             response = logical.read(path)
-            next unless response
+            unless response
+              log_warn("LeaseManager: no data at '#{name}' (#{path}) — path may not exist or role not configured")
+              next
+            end
 
             @lease_cache[name] = response.data || {}
             @active_leases[name] = {
               lease_id:       response.lease_id,
               lease_duration: response.lease_duration,
-              renewable:      response.renewable,
+              renewable:      response.renewable?,
               expires_at:     Time.now + (response.lease_duration || 0),
               fetched_at:     Time.now
             }
@@ -44,8 +47,12 @@ module Legion
         end
       end
 
+      def fetched_count
+        @active_leases.size
+      end
+
       def fetch(name, key)
-        data = @lease_cache[name]
+        data = @lease_cache[name.to_sym] || @lease_cache[name.to_s]
         return nil unless data
 
         data[key.to_sym] || data[key.to_s]

data/lib/legion/crypt/vault.rb

@@ -44,23 +44,34 @@ module Legion
 
       def read(path, type = 'legion')
         full_path = type.nil? || type.empty? ? "#{type}/#{path}" : path
-        Legion::Logging.debug "Vault read: #{full_path}" if defined?(Legion::Logging)
+        log_read_context(full_path)
         lease = logical_client.read(full_path)
-        add_session(path: lease.lease_id) if lease.respond_to? :lease_id
-        lease.data
+        if lease.nil?
+          log_vault_debug("Vault read: #{full_path} returned nil")
+          return nil
+        end
+        add_session(path: lease.lease_id) if lease.respond_to?(:lease_id) && lease.lease_id && !lease.lease_id.empty?
+
+        data = lease.data
+        log_vault_debug("Vault read: #{full_path} returned keys=#{data&.keys&.inspect}")
+        unwrap_kv_v2(data, full_path)
       rescue StandardError => e
-        Legion::Logging.warn "Vault read failed at #{full_path}: #{e.message}" if defined?(Legion::Logging)
+        Legion::Logging.warn "Vault read failed at #{full_path}: #{e.class}=#{e.message}" if defined?(Legion::Logging)
         raise
       end
 
       def get(path)
-        Legion::Logging.debug "Vault kv get: #{path}" if defined?(Legion::Logging)
+        Legion::Logging.debug "Vault kv get: path=#{path}" if defined?(Legion::Logging)
         result = kv_client.read(path)
-        return nil if result.nil?
+        if result.nil?
+          Legion::Logging.debug "Vault kv get: #{path} returned nil" if defined?(Legion::Logging)
+          return nil
+        end
 
+        Legion::Logging.debug "Vault kv get: #{path} returned keys=#{result.data&.keys&.inspect}" if defined?(Legion::Logging)
         result.data
       rescue StandardError => e
-        Legion::Logging.warn "Vault kv get failed at #{path}: #{e.message}" if defined?(Legion::Logging)
+        Legion::Logging.warn "Vault kv get failed at #{path}: #{e.class}=#{e.message}" if defined?(Legion::Logging)
         raise
       end
 
@@ -85,6 +96,7 @@ module Legion
       end
 
       def add_session(path:)
+        @sessions ||= []
         @sessions.push(path)
       end
 
@@ -158,6 +170,29 @@ module Legion
           ::Vault.logical
         end
       end
+
+      def log_read_context(full_path)
+        return unless defined?(Legion::Logging)
+
+        namespace = if respond_to?(:connected_clusters) && connected_clusters.any?
+                      client = vault_client
+                      client.respond_to?(:namespace) ? client.namespace : 'n/a'
+                    else
+                      'n/a (global client)'
+                    end
+        Legion::Logging.debug "Vault read: path=#{full_path}, namespace=#{namespace}"
+      end
+
+      def unwrap_kv_v2(data, full_path)
+        return data unless data.is_a?(Hash) && data.key?(:data) && data[:data].is_a?(Hash) && data.key?(:metadata)
+
+        log_vault_debug("Vault read: #{full_path} detected KV v2 envelope, unwrapping :data key")
+        data[:data]
+      end
+
+      def log_vault_debug(message)
+        Legion::Logging.debug(message) if defined?(Legion::Logging)
+      end
     end
   end
 end

data/lib/legion/crypt/vault_cluster.rb

@@ -40,8 +40,10 @@ module Legion
       end
 
       def connect_all_clusters
+        log_vault_debug("connect_all_clusters: #{clusters.size} cluster(s) configured")
         results = {}
         clusters.each do |name, config|
+          log_vault_debug("connect_all_clusters: #{name} (auth_method=#{config[:auth_method].inspect})")
           case config[:auth_method]&.to_s
           when 'kerberos'
             results[name] = connect_kerberos_cluster(name, config)
@@ -60,11 +62,21 @@ module Legion
           results[name] = false
           log_vault_error(name, e)
         end
+
+        connected = results.select { |_, v| v }
+        log_vault_debug("connect_all_clusters: #{connected.size}/#{results.size} connected")
+        mark_vault_connected if connected.any?
         results
       end
 
       private
 
+      def mark_vault_connected
+        return unless defined?(Legion::Settings)
+
+        Legion::Settings[:crypt][:vault][:connected] = true
+      end
+
       def resolve_cluster_name(name)
         return name.to_sym if name
 
@@ -74,8 +86,10 @@ module Legion
       def build_vault_client(config)
         return nil unless config.is_a?(Hash)
 
+        addr = "#{config[:protocol]}://#{config[:address]}:#{config[:port]}"
+        log_vault_debug("build_vault_client: address=#{addr}")
         client = ::Vault::Client.new(
-          address: "#{config[:protocol]}://#{config[:address]}:#{config[:port]}",
+          address: addr,
           token:   config[:token]
         )
         namespace =
@@ -86,6 +100,7 @@ module Legion
             crypt_settings.respond_to?(:dig) ? crypt_settings.dig(:vault, :vault_namespace) : nil
           end
         client.namespace = namespace if namespace
+        log_vault_debug("build_vault_client: namespace=#{namespace.inspect}")
         client
       end
 
@@ -100,6 +115,9 @@ module Legion
       def connect_kerberos_cluster(name, config)
         krb_config = config[:kerberos] || {}
         spn = krb_config[:service_principal]
+        auth_path = krb_config[:auth_path] || Legion::Crypt::KerberosAuth::DEFAULT_AUTH_PATH
+
+        log_vault_debug("connect_kerberos_cluster[#{name}]: SPN=#{spn}, auth_path=#{auth_path}, namespace=#{config[:namespace].inspect}")
 
         unless spn
           log_vault_warn(name, 'Kerberos auth missing service_principal, skipping')
@@ -108,10 +126,13 @@ module Legion
         end
 
         require 'legion/crypt/kerberos_auth'
+        client = vault_client(name)
+        log_vault_debug("connect_kerberos_cluster[#{name}]: client.namespace=#{client.respond_to?(:namespace) ? client.namespace.inspect : 'n/a'}")
+
         result = Legion::Crypt::KerberosAuth.login(
-          vault_client:      vault_client(name),
+          vault_client:      client,
           service_principal: spn,
-          auth_path:         krb_config[:auth_path] || Legion::Crypt::KerberosAuth::DEFAULT_AUTH_PATH
+          auth_path:         auth_path
         )
 
         config[:token] = result[:token]
@@ -119,6 +140,7 @@ module Legion
         config[:renewable] = result[:renewable]
         config[:connected] = true
         vault_client(name).token = result[:token]
+        log_vault_debug("connect_kerberos_cluster[#{name}]: policies=#{result[:policies].inspect}")
         log_cluster_connected(name, config)
         true
       rescue Legion::Crypt::KerberosAuth::GemMissingError => e
@@ -142,6 +164,10 @@ module Legion
           warn("Vault cluster #{name}: #{message}")
         end
       end
+
+      def log_vault_debug(message)
+        Legion::Logging.debug(message) if defined?(Legion::Logging)
+      end
     end
   end
 end

data/lib/legion/crypt/vault_jwt_auth.rb

@@ -39,7 +39,7 @@ module Legion
         {
           token:          response.auth.client_token,
           lease_duration: response.auth.lease_duration,
-          renewable:      response.auth.renewable,
+          renewable:      response.auth.renewable?,
           policies:       response.auth.policies,
           metadata:       response.auth.metadata
         }

data/lib/legion/crypt/vault_kerberos_auth.rb

@@ -16,7 +16,7 @@ module Legion
         {
           token:          response.auth.client_token,
           lease_duration: response.auth.lease_duration,
-          renewable:      response.auth.renewable,
+          renewable:      response.auth.renewable?,
           policies:       response.auth.policies,
           metadata:       response.auth.metadata
         }

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.18'
+    VERSION = '1.4.20'
   end
 end

data/lib/legion/crypt.rb

@@ -123,7 +123,13 @@ module Legion
         lease_manager = Legion::Crypt::LeaseManager.instance
         lease_manager.start(leases, vault_client: client)
         lease_manager.start_renewal_thread
-        Legion::Logging.info "LeaseManager: #{leases.size} lease(s) initialized"
+        fetched = lease_manager.fetched_count
+        defined = leases.size
+        if fetched == defined
+          Legion::Logging.info "LeaseManager: #{fetched} lease(s) initialized"
+        else
+          Legion::Logging.warn "LeaseManager: #{fetched}/#{defined} lease(s) initialized (#{defined - fetched} failed)"
+        end
       rescue StandardError => e
         Legion::Logging.warn "LeaseManager startup failed: #{e.message}"
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.4.18
+  version: 1.4.20
 platform: ruby
 authors:
 - Esity