legion-crypt 1.4.20 → 1.4.23

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b78a171584f4ccb627b63cd35cad927a6773bd1802e0da432dd445dbceb85e4
-  data.tar.gz: b1806202e526aa259d1491a108f3d3b94b1c4564a05ea7b4afa702778069e715
+  metadata.gz: bc1b26f800d0d5512ee35965b6700750bcfcacc5265042f749c3e56a973140c6
+  data.tar.gz: cb154b6f1c44688b9a7d4d41e4c125279c9c945b8b162da448c1b2f7b0bacb67
 SHA512:
-  metadata.gz: a1cc01154f5fef732c05efe2d99213f1742aa486e2c703f7707709dbf29ab74484b49e5be4c3a1513b116ffdb658382b70e124067771549f9dcabd8cad1fd6f1
-  data.tar.gz: e8e674be70714e3d439330e8d1d03b323319dd60b0f2069c26087fa772ec27c61cbc3a1ca5ed47cdff30e5ee8a826e31f16b0695f35c479184be7a02fd34e2b7
+  metadata.gz: 4bf5a0be9d6c724dc0011508e7ce3ab23a8a9af46c7800fdd8a45711fa75e3569635bec16467d942306124c17c3a14c45bd161082b0e1c62a80c6172e9f050d9
+  data.tar.gz: cd5269888634c81cda229646c13db9a61a67c687430bda6b5202047a73f84fb480b55e1e39534fcadec348b34ee62f0c913723338b20c3ffba6e31943fa38922

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Legion::Crypt
 
+## [1.4.23] - 2026-03-27
+
+### Fixed
+- `connect_vault` now accepts Vault standby responses (429, 472, 473) as healthy, fixing connection failures against performance standby nodes
+- `connect_all_clusters` uses the same standby-tolerant health check
+
+## [1.4.22] - 2026-03-27
+
+### Changed
+- Replace split `log.error(e.message); log.error(e.backtrace)` patterns with single `Legion::Logging.log_exception` calls in `vault.rb`, `cluster_secret.rb`, and `settings.rb` for structured exception events
+- Guard all `log_exception` call sites in `vault.rb`, `settings.rb`, and `cluster_secret.rb` with `Legion::Logging` presence checks (`defined?` in `vault.rb`/`cluster_secret.rb`, `Legion.const_defined?('Logging')` in `settings.rb`) plus `Legion::Logging.respond_to?(:log_exception)`; fall back to `Legion::Logging.fatal`/`error` or `warn` to preserve structured logging in environments where `log_exception` is unavailable
+- `from_transport` and `cs` rescue blocks in `cluster_secret.rb` now use the same 4-branch guard (log_exception / Logging.error / Logging.warn / Kernel.warn) and explicitly return `nil` to preserve expected return types
+- Fallback `.error`/`.warn`/`Kernel.warn` branches in `from_transport` and `cs` include the first 10 backtrace lines for debuggability parity with the prior `e.backtrace[0..10]` logging; `Vault#connect_vault` warn fallback omits backtrace to keep health-check failure messages concise
+- `cs` rescue adds final `Kernel.warn` fallback so exceptions are never silently swallowed when `Legion::Logging` is absent
+
+### Added
+- Specs for `connect_vault` rescue logging: asserts `false` return and covers log_exception / Logging.error / warn fallback branches when `Vault.sys.health_status` raises
+- Specs for `from_transport` and `cs` rescue paths: asserts `nil` return and covers all logging fallback branches (including `Kernel.warn`) plus `Legion::Logging` absent case
+- Duplicate invocation eliminated in rescue-path specs: single call stored in `result`, both no-raise and return value asserted on that one call
+
 ## [1.4.20] - 2026-03-27
 
 ### Fixed

data/README.md

@@ -2,7 +2,7 @@
 
 Encryption, secrets management, JWT token management, and HashiCorp Vault integration for the [LegionIO](https://github.com/LegionIO/LegionIO) framework. Provides AES-256-CBC message encryption, RSA key pair generation, cluster secret management, JWT issue/verify operations, Vault token lifecycle management, and multi-cluster Vault connectivity.
 
-**Version**: 1.4.15
+**Version**: 1.4.22
 
 ## Installation
 

data/lib/legion/crypt/cluster_secret.rb

@@ -64,8 +64,14 @@ module Legion
         Legion::Logging.error 'Cluster secret is still unknown!'
         nil
       rescue StandardError => e
-        Legion::Logging.error e.message
-        Legion::Logging.error e.backtrace[0..10]
+        if defined?(Legion::Logging) && Legion::Logging.respond_to?(:log_exception)
+          Legion::Logging.log_exception(e, lex: 'crypt', component_type: :helper)
+        elsif defined?(Legion::Logging) && Legion::Logging.respond_to?(:error)
+          Legion::Logging.error "from_transport failed: #{e.class}=#{e.message}\n#{Array(e.backtrace).first(10).join("\n")}"
+        else
+          warn "from_transport failed: #{e.class}=#{e.message}\n#{Array(e.backtrace).first(10).join("\n")}"
+        end
+        nil
       end
 
       def force_cluster_secret
@@ -114,8 +120,19 @@ module Legion
       def cs
         @cs ||= Digest::SHA256.digest(find_cluster_secret)
       rescue StandardError => e
-        Legion::Logging.error e.message
-        Legion::Logging.error e.backtrace[0..10]
+        if defined?(Legion::Logging) && Legion::Logging.respond_to?(:log_exception)
+          Legion::Logging.log_exception(e, lex: 'crypt', component_type: :helper)
+        elsif defined?(Legion::Logging) && Legion::Logging.respond_to?(:error)
+          backtrace = Array(e.backtrace).first(10).join("\n")
+          Legion::Logging.error "Legion::Crypt::ClusterSecret#cs failed: #{e.class}: #{e.message}\n#{backtrace}"
+        elsif defined?(Legion::Logging) && Legion::Logging.respond_to?(:warn)
+          backtrace = Array(e.backtrace).first(10).join("\n")
+          Legion::Logging.warn "Legion::Crypt::ClusterSecret#cs failed: #{e.class}: #{e.message}\n#{backtrace}"
+        else
+          backtrace = Array(e.backtrace).first(10).join("\n")
+          ::Kernel.warn "Legion::Crypt::ClusterSecret#cs failed: #{e.class}: #{e.message}\n#{backtrace}"
+        end
+        nil
       end
 
       def validate_hex(value, length = secret_length)

data/lib/legion/crypt/settings.rb

@@ -67,9 +67,10 @@ end
 begin
   Legion::Settings.merge_settings('crypt', Legion::Crypt::Settings.default) if Legion.const_defined?('Settings')
 rescue StandardError => e
-  if Legion.const_defined?('Logging') && Legion::Logging.method_defined?(:fatal)
-    Legion::Logging.fatal(e.message)
-    Legion::Logging.fatal(e.backtrace)
+  if Legion.const_defined?('Logging') && Legion::Logging.respond_to?(:log_exception)
+    Legion::Logging.log_exception(e, lex: 'crypt', component_type: :helper, level: :fatal)
+  elsif Legion.const_defined?('Logging') && Legion::Logging.respond_to?(:fatal)
+    Legion::Logging.fatal("crypt settings merge error: #{e.class}: #{e.message}\n#{Array(e.backtrace).join("\n")}")
   else
     puts e.message
     puts e.backtrace

data/lib/legion/crypt/vault.rb

@@ -32,16 +32,32 @@ module Legion
         return nil if Legion::Settings[:crypt][:vault][:token].nil?
 
         ::Vault.token = Legion::Settings[:crypt][:vault][:token]
-        if ::Vault.sys.health_status.initialized?
+        if vault_healthy?
           Legion::Settings[:crypt][:vault][:connected] = true
           Legion::Logging.info "Vault connected at #{::Vault.address}" if defined?(Legion::Logging)
         end
       rescue StandardError => e
-        Legion::Logging.error e.message
+        if defined?(Legion::Logging) && Legion::Logging.respond_to?(:log_exception)
+          Legion::Logging.log_exception(e, lex: 'crypt', component_type: :helper)
+        elsif defined?(Legion::Logging) && Legion::Logging.respond_to?(:error)
+          Legion::Logging.error "Vault connection failed: #{e.class}=#{e.message}\n#{Array(e.backtrace).first(10).join("\n")}"
+        else
+          warn "Vault connection failed: #{e.class}=#{e.message}"
+        end
         Legion::Settings[:crypt][:vault][:connected] = false
         false
       end
 
+      def vault_healthy?
+        ::Vault.sys.health_status.initialized?
+      rescue ::Vault::HTTPError => e
+        # 429 = standby, 472 = DR secondary, 473 = performance standby
+        # All indicate an initialized, healthy Vault — just not the active node.
+        return true if e.message =~ /\b(429|472|473)\b/
+
+        raise
+      end
+
       def read(path, type = 'legion')
         full_path = type.nil? || type.empty? ? "#{type}/#{path}" : path
         log_read_context(full_path)

data/lib/legion/crypt/vault_cluster.rb

@@ -53,7 +53,7 @@ module Legion
             next unless config[:token]
 
             client = vault_client(name)
-            config[:connected] = client.sys.health_status.initialized?
+            config[:connected] = cluster_healthy?(client)
             results[name] = config[:connected]
             log_cluster_connected(name, config) if config[:connected]
           end
@@ -71,6 +71,14 @@ module Legion
 
       private
 
+      def cluster_healthy?(client)
+        client.sys.health_status.initialized?
+      rescue ::Vault::HTTPError => e
+        return true if e.message =~ /\b(429|472|473)\b/
+
+        raise
+      end
+
       def mark_vault_connected
         return unless defined?(Legion::Settings)
 

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.20'
+    VERSION = '1.4.23'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.4.20
+  version: 1.4.23
 platform: ruby
 authors:
 - Esity