legion-crypt 1.4.28 → 1.5.0

data/lib/legion/crypt/ed25519.rb

@@ -1,58 +1,83 @@
 # frozen_string_literal: true
 
 require 'ed25519'
+require 'legion/logging/helper'
 
 module Legion
   module Crypt
     module Ed25519
+      extend Legion::Logging::Helper
+
       class << self
         def generate_keypair
           signing_key = ::Ed25519::SigningKey.generate
-          Legion::Logging.debug 'Ed25519 keypair generated' if defined?(Legion::Logging)
+          log.info 'Ed25519 keypair generated'
           {
             private_key:    signing_key.to_bytes,
             public_key:     signing_key.verify_key.to_bytes,
             public_key_hex: signing_key.verify_key.to_bytes.unpack1('H*')
           }
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.ed25519.generate_keypair')
+          raise
         end
 
         def sign(message, private_key_bytes)
           signing_key = ::Ed25519::SigningKey.new(private_key_bytes)
           result = signing_key.sign(message)
-          Legion::Logging.debug 'Ed25519 sign complete' if defined?(Legion::Logging)
+          log.debug 'Ed25519 sign complete'
           result
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.ed25519.sign')
+          raise
         end
 
         def verify(message, signature, public_key_bytes)
           verify_key = ::Ed25519::VerifyKey.new(public_key_bytes)
           verify_key.verify(signature, message)
-          Legion::Logging.debug 'Ed25519 verify success' if defined?(Legion::Logging)
+          log.debug 'Ed25519 verify success'
           true
         rescue ::Ed25519::VerifyError => e
-          Legion::Logging.debug("Legion::Crypt::Ed25519.verify signature mismatch: #{e.message}") if defined?(Legion::Logging)
+          handle_exception(e, level: :debug, operation: 'crypt.ed25519.verify.signature_mismatch')
+          log.warn 'Ed25519 signature verification failed'
           false
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.ed25519.verify')
+          raise
         end
 
         def store_keypair(agent_id:, keypair: nil)
           keypair ||= generate_keypair
-          vault_path = "#{key_prefix}/#{agent_id}"
-          if defined?(Legion::Crypt::Vault)
-            Legion::Logging.debug "Ed25519 storing keypair at #{vault_path}" if defined?(Legion::Logging)
-            Legion::Crypt::Vault.write(vault_path, {
-                                         private_key: keypair[:private_key].unpack1('H*'),
-                                         public_key:  keypair[:public_key_hex]
-                                       })
+          if Legion::Crypt.respond_to?(:write)
+            log.info "Ed25519 storing keypair for agent #{agent_id}"
+            Legion::Crypt.write(
+              vault_key_path(agent_id),
+              private_key: keypair[:private_key].unpack1('H*'),
+              public_key:  keypair[:public_key_hex]
+            )
+          else
+            log.warn "Ed25519 keypair generated for agent #{agent_id} but Vault is unavailable"
           end
           keypair
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.ed25519.store_keypair', agent_id: agent_id)
+          raise
         end
 
         def load_private_key(agent_id:)
-          vault_path = "#{key_prefix}/#{agent_id}"
-          Legion::Logging.debug "Ed25519 loading private key from #{vault_path}" if defined?(Legion::Logging)
-          data = Legion::Crypt::Vault.read(vault_path)
-          [data[:private_key]].pack('H*') if data&.dig(:private_key)
+          log.debug "Ed25519 loading private key for agent #{agent_id}"
+          return nil unless Legion::Crypt.respond_to?(:get)
+
+          data = Legion::Crypt.get(vault_key_path(agent_id))
+          if data&.dig(:private_key)
+            log.info "Ed25519 private key loaded for agent #{agent_id}"
+            [data[:private_key]].pack('H*')
+          else
+            log.warn "Ed25519 private key missing for agent #{agent_id}"
+            nil
+          end
         rescue StandardError => e
-          Legion::Logging.warn("Legion::Crypt::Ed25519#load_private_key failed: #{e.message}") if defined?(Legion::Logging)
+          handle_exception(e, level: :warn, operation: 'crypt.ed25519.load_private_key', agent_id: agent_id)
           nil
         end
 
@@ -62,9 +87,24 @@ module Legion
           begin
             Legion::Settings[:crypt][:ed25519][:vault_key_prefix]
           rescue StandardError => e
-            Legion::Logging.debug("Legion::Crypt::Ed25519#key_prefix settings lookup failed: #{e.message}") if defined?(Legion::Logging)
+            handle_exception(e, level: :debug, operation: 'crypt.ed25519.key_prefix')
             nil
-          end || 'secret/data/legion/keys'
+          end || 'keys'
+        end
+
+        def vault_key_path(agent_id)
+          normalize_kv_path("#{key_prefix}/#{agent_id}")
+        end
+
+        def normalize_kv_path(path)
+          kv_path = Legion::Settings.dig(:crypt, :vault, :kv_path)
+          return path if kv_path.nil? || kv_path.empty?
+
+          normalized = path.sub(%r{\Asecret/data/#{Regexp.escape(kv_path)}/}, '')
+          normalized.sub(%r{\A#{Regexp.escape(kv_path)}/}, '')
+        rescue StandardError => e
+          handle_exception(e, level: :debug, operation: 'crypt.ed25519.normalize_kv_path')
+          path
         end
       end
     end

data/lib/legion/crypt/erasure.rb

@@ -1,29 +1,42 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
+
 module Legion
   module Crypt
     module Erasure
+      extend Legion::Logging::Helper
+
       class << self
         def erase_tenant(tenant_id:)
           key_path = "#{tenant_prefix}/#{tenant_id}/master_key"
 
-          delete_vault_key(key_path) if defined?(Legion::Crypt::Vault)
+          log.info "[crypt] Erasing tenant #{tenant_id}"
+          if Legion::Crypt.respond_to?(:delete)
+            Legion::Crypt.delete(key_path)
+          elsif defined?(Legion::Crypt::Vault)
+            delete_vault_key(key_path)
+          end
           Legion::Events.emit('crypt.tenant_erased', { tenant_id: tenant_id, erased_at: Time.now.utc }) if defined?(Legion::Events)
-          Legion::Logging.warn "[crypt] Tenant #{tenant_id} cryptographically erased" if defined?(Legion::Logging)
+          log.warn "[crypt] Tenant #{tenant_id} cryptographically erased"
 
           { erased: true, tenant_id: tenant_id, path: key_path }
         rescue StandardError => e
-          Legion::Logging.error("Legion::Crypt::Erasure#erase_tenant failed: #{e.message}") if defined?(Legion::Logging)
+          handle_exception(e, level: :error, operation: 'crypt.erasure.erase_tenant', tenant_id: tenant_id)
           { erased: false, tenant_id: tenant_id, error: e.message }
         end
 
         def verify_erasure(tenant_id:)
           key_path = "#{tenant_prefix}/#{tenant_id}/master_key"
-          data = Legion::Crypt::Vault.read(key_path)
-          { erased: data.nil?, tenant_id: tenant_id }
+          raise 'Legion::Crypt.read is unavailable' unless Legion::Crypt.respond_to?(:read)
+
+          data = Legion::Crypt.read(key_path, nil)
+          erased = data.nil?
+          log.info "Tenant erasure verification completed for #{tenant_id}: erased=#{erased}"
+          { erased: erased, tenant_id: tenant_id }
         rescue StandardError => e
-          Legion::Logging.warn("Legion::Crypt::Erasure#verify_erasure failed: #{e.message}") if defined?(Legion::Logging)
-          { erased: true, tenant_id: tenant_id }
+          handle_exception(e, level: :warn, operation: 'crypt.erasure.verify_erasure', tenant_id: tenant_id)
+          { erased: false, tenant_id: tenant_id, error: e.message }
         end
 
         private
@@ -36,7 +49,7 @@ module Legion
           begin
             Legion::Settings[:crypt][:partition_keys][:vault_tenant_prefix]
           rescue StandardError => e
-            Legion::Logging.debug("Legion::Crypt::Erasure#tenant_prefix settings lookup failed: #{e.message}") if defined?(Legion::Logging)
+            handle_exception(e, level: :debug, operation: 'crypt.erasure.tenant_prefix')
             nil
           end || 'secret/data/legion/tenants'
         end

data/lib/legion/crypt/jwks_client.rb

@@ -5,6 +5,7 @@ require 'uri'
 require 'json'
 require 'openssl'
 require 'jwt'
+require 'legion/logging/helper'
 
 module Legion
   module Crypt
@@ -12,33 +13,40 @@ module Legion
       CACHE_TTL = 3600
 
       @cache = {}
-      @mutex = Mutex.new
+      @cache_mutex = Mutex.new
+      @locks = {}
+      @locks_mutex = Mutex.new
 
       class << self
+        include Legion::Logging::Helper
+
         def fetch_keys(jwks_url)
-          @mutex.synchronize do
-            Legion::Logging.debug "JWKS fetch: #{jwks_url}" if defined?(Legion::Logging)
+          with_url_lock(jwks_url) do
+            log.debug "JWKS fetch: #{jwks_url}"
             response = http_get(jwks_url)
             jwks_data = parse_response(response)
             keys = parse_jwks(jwks_data)
 
-            @cache[jwks_url] = { keys: keys, fetched_at: Time.now }
+            cache_write(jwks_url, keys)
+            log.info "JWKS fetched url=#{jwks_url} keys=#{keys.size}"
             keys
           end
         rescue StandardError => e
-          Legion::Logging.warn "JWKS fetch failed for #{jwks_url}: #{e.message}" if defined?(Legion::Logging)
+          handle_exception(e, level: :warn, operation: 'crypt.jwks.fetch_keys', jwks_url: jwks_url)
           raise
         end
 
         def find_key(jwks_url, kid)
-          cached = @mutex.synchronize { @cache[jwks_url] }
+          cached = cache_read(jwks_url)
 
           if cached && !expired?(cached[:fetched_at])
             key = cached[:keys][kid]
             if key
-              Legion::Logging.debug "JWKS cache hit: kid=#{kid}" if defined?(Legion::Logging)
+              log.debug "JWKS cache hit: kid=#{kid}"
               return key
             end
+
+            log.debug "JWKS cache miss for kid=#{kid}; refreshing keys"
           end
 
           keys = fetch_keys(jwks_url)
@@ -49,17 +57,31 @@ module Legion
         end
 
         def clear_cache
-          @mutex.synchronize { @cache = {} }
+          @cache_mutex.synchronize { @cache = {} }
+          @locks_mutex.synchronize { @locks = {} }
+          log.info 'JWKS cache cleared'
         end
 
         private
 
+        def cache_read(jwks_url)
+          @cache_mutex.synchronize { @cache[jwks_url] }
+        end
+
+        def cache_write(jwks_url, keys)
+          @cache_mutex.synchronize do
+            @cache[jwks_url] = { keys: keys, fetched_at: Time.now }
+          end
+        end
+
         def expired?(fetched_at)
           Time.now - fetched_at > CACHE_TTL
         end
 
         def http_get(url)
           uri = URI.parse(url)
+          raise Legion::Crypt::JWT::Error, 'failed to fetch JWKS: HTTPS is required' unless uri.scheme == 'https'
+
           http = Net::HTTP.new(uri.host, uri.port)
           http.use_ssl = uri.scheme == 'https'
           http.open_timeout = 10
@@ -83,6 +105,7 @@ module Legion
 
           parsed
         rescue ::JSON::ParserError => e
+          handle_exception(e, level: :warn, operation: 'crypt.jwks.parse_response')
           raise Legion::Crypt::JWT::Error, "invalid JWKS response: #{e.message}"
         end
 
@@ -96,12 +119,17 @@ module Legion
             jwk = ::JWT::JWK.new(jwk_hash)
             keys[kid] = jwk.public_key
           rescue StandardError => e
-            Legion::Logging.debug("Legion::Crypt::JwksClient#parse_jwks skipping malformed key kid=#{kid}: #{e.message}") if defined?(Legion::Logging)
+            handle_exception(e, level: :debug, operation: 'crypt.jwks.parse_jwks', kid: kid)
             next
           end
 
           keys
         end
+
+        def with_url_lock(jwks_url, &)
+          lock = @locks_mutex.synchronize { @locks[jwks_url] ||= Mutex.new }
+          lock.synchronize(&)
+        end
       end
     end
   end

data/lib/legion/crypt/jwt.rb

@@ -2,6 +2,7 @@
 
 require 'jwt'
 require 'securerandom'
+require 'legion/logging/helper'
 require 'legion/crypt/jwks_client'
 
 module Legion
@@ -14,20 +15,25 @@ module Legion
 
       SUPPORTED_ALGORITHMS = %w[HS256 RS256].freeze
 
+      extend Legion::Logging::Helper
+
       def self.issue(payload, signing_key:, algorithm: 'HS256', ttl: 3600, issuer: 'legion')
         validate_algorithm!(algorithm)
 
         now = Time.now.to_i
-        claims = {
+        claims = sanitize_payload(payload).merge(
           iss: issuer,
           iat: now,
           exp: now + ttl,
           jti: SecureRandom.uuid
-        }.merge(payload)
+        )
 
         token = ::JWT.encode(claims, signing_key, algorithm)
-        Legion::Logging.info "JWT issued: sub=#{claims[:sub]}, exp=#{Time.at(claims[:exp]).utc.iso8601}, alg=#{algorithm}" if defined?(Legion::Logging)
+        log.info "JWT issued: sub=#{claims[:sub]}, exp=#{Time.at(claims[:exp]).utc.iso8601}, alg=#{algorithm}"
         token
+      rescue StandardError => e
+        handle_exception(e, level: :error, operation: 'crypt.jwt.issue', algorithm: algorithm, issuer: issuer)
+        raise
       end
 
       def self.verify(token, verification_key:, **opts)
@@ -47,24 +53,34 @@ module Legion
 
         payload, _header = ::JWT.decode(token, verification_key, true, decode_opts)
         result = symbolize_keys(payload)
-        Legion::Logging.debug "JWT verify success: sub=#{result[:sub]}, jti=#{result[:jti]}" if defined?(Legion::Logging)
+        log.debug "JWT verify success: sub=#{result[:sub]}, jti=#{result[:jti]}"
         result
-      rescue ::JWT::ExpiredSignature
-        Legion::Logging.warn 'JWT verify failed: token has expired' if defined?(Legion::Logging)
+      rescue ::JWT::ExpiredSignature => e
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.verify.expired', algorithm: algorithm)
+        log.warn 'JWT verify failed: token has expired'
         raise ExpiredTokenError, 'token has expired'
-      rescue ::JWT::VerificationError, ::JWT::IncorrectAlgorithm
-        Legion::Logging.warn 'JWT verify failed: signature verification failed' if defined?(Legion::Logging)
+      rescue ::JWT::VerificationError, ::JWT::IncorrectAlgorithm => e
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.verify.signature', algorithm: algorithm)
+        log.warn 'JWT verify failed: signature verification failed'
         raise InvalidTokenError, 'token signature verification failed'
       rescue ::JWT::DecodeError => e
-        Legion::Logging.warn "JWT verify failed: #{e.message}" if defined?(Legion::Logging)
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.verify.decode', algorithm: algorithm)
+        log.warn "JWT verify failed: #{e.message}"
         raise DecodeError, "failed to decode token: #{e.message}"
+      rescue StandardError => e
+        handle_exception(e, level: :error, operation: 'crypt.jwt.verify', algorithm: algorithm)
+        raise
       end
 
       def self.decode(token)
         payload, _header = ::JWT.decode(token, nil, false)
         symbolize_keys(payload)
       rescue ::JWT::DecodeError => e
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.decode')
         raise DecodeError, "failed to decode token: #{e.message}"
+      rescue StandardError => e
+        handle_exception(e, level: :error, operation: 'crypt.jwt.decode')
+        raise
       end
 
       def self.verify_with_jwks(token, jwks_url:, **opts)
@@ -81,41 +97,44 @@ module Legion
         verify_expiration = opts.fetch(:verify_expiration, true)
         issuers = opts[:issuers]
         audience = opts[:audience]
+        validate_external_requirements!(issuers: issuers, audience: audience)
 
         decode_opts = {
           algorithm:         algorithm,
-          verify_expiration: verify_expiration
+          verify_expiration: verify_expiration,
+          verify_iss:        true,
+          iss:               issuers,
+          verify_aud:        true,
+          aud:               audience
         }
 
-        if issuers
-          decode_opts[:verify_iss] = true
-          decode_opts[:iss] = issuers
-        end
-
-        if audience
-          decode_opts[:verify_aud] = true
-          decode_opts[:aud] = audience
-        end
-
         payload, _header = ::JWT.decode(token, public_key, true, decode_opts)
         result = symbolize_keys(payload)
-        Legion::Logging.debug "JWT JWKS verify success: sub=#{result[:sub]}, kid=#{kid}" if defined?(Legion::Logging)
+        log.info "JWT JWKS verify success: sub=#{result[:sub]}, kid=#{kid}"
         result
-      rescue ::JWT::ExpiredSignature
-        Legion::Logging.warn "JWT JWKS verify failed: token has expired, kid=#{kid}" if defined?(Legion::Logging)
+      rescue ::JWT::ExpiredSignature => e
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.verify_with_jwks.expired', jwks_url: jwks_url, kid: kid)
+        log.warn "JWT JWKS verify failed: token has expired, kid=#{kid}"
         raise ExpiredTokenError, 'token has expired'
-      rescue ::JWT::VerificationError, ::JWT::IncorrectAlgorithm
-        Legion::Logging.warn "JWT JWKS verify failed: signature verification failed, kid=#{kid}" if defined?(Legion::Logging)
+      rescue ::JWT::VerificationError, ::JWT::IncorrectAlgorithm => e
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.verify_with_jwks.signature', jwks_url: jwks_url, kid: kid)
+        log.warn "JWT JWKS verify failed: signature verification failed, kid=#{kid}"
         raise InvalidTokenError, 'token signature verification failed'
-      rescue ::JWT::InvalidIssuerError
-        Legion::Logging.warn "JWT JWKS verify failed: issuer not allowed, kid=#{kid}" if defined?(Legion::Logging)
+      rescue ::JWT::InvalidIssuerError => e
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.verify_with_jwks.issuer', jwks_url: jwks_url, kid: kid)
+        log.warn "JWT JWKS verify failed: issuer not allowed, kid=#{kid}"
         raise InvalidTokenError, 'token issuer not allowed'
-      rescue ::JWT::InvalidAudError
-        Legion::Logging.warn "JWT JWKS verify failed: audience mismatch, kid=#{kid}" if defined?(Legion::Logging)
+      rescue ::JWT::InvalidAudError => e
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.verify_with_jwks.audience', jwks_url: jwks_url, kid: kid)
+        log.warn "JWT JWKS verify failed: audience mismatch, kid=#{kid}"
         raise InvalidTokenError, 'token audience mismatch'
       rescue ::JWT::DecodeError => e
-        Legion::Logging.warn "JWT JWKS verify failed: #{e.message}, kid=#{kid}" if defined?(Legion::Logging)
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.verify_with_jwks.decode', jwks_url: jwks_url, kid: kid)
+        log.warn "JWT JWKS verify failed: #{e.message}, kid=#{kid}"
         raise DecodeError, "failed to decode token: #{e.message}"
+      rescue StandardError => e
+        handle_exception(e, level: :error, operation: 'crypt.jwt.verify_with_jwks', jwks_url: jwks_url, kid: kid)
+        raise
       end
 
       def self.decode_header(token)
@@ -125,7 +144,11 @@ module Legion
         header_json = Base64.urlsafe_decode64(parts[0])
         ::JSON.parse(header_json)
       rescue ::JSON::ParserError, ArgumentError => e
+        handle_exception(e, level: :warn, operation: 'crypt.jwt.decode_header')
         raise DecodeError, "failed to decode token header: #{e.message}"
+      rescue StandardError => e
+        handle_exception(e, level: :error, operation: 'crypt.jwt.decode_header')
+        raise
       end
 
       def self.validate_algorithm!(algorithm)
@@ -138,7 +161,28 @@ module Legion
         hash.transform_keys(&:to_sym)
       end
 
-      private_class_method :validate_algorithm!, :symbolize_keys, :decode_header
+      def self.sanitize_payload(payload)
+        payload.each_with_object({}) do |(key, value), sanitized|
+          next if %w[iss iat exp jti].include?(key.to_s)
+
+          sanitized[key] = value
+        end
+      end
+
+      def self.validate_external_requirements!(issuers:, audience:)
+        raise ArgumentError, 'issuers is required for JWKS verification' if blank_external_requirement?(issuers)
+        raise ArgumentError, 'audience is required for JWKS verification' if blank_external_requirement?(audience)
+      end
+
+      def self.blank_external_requirement?(value)
+        return true if value.nil?
+        return true if value.respond_to?(:empty?) && value.empty?
+
+        false
+      end
+
+      private_class_method :validate_algorithm!, :symbolize_keys, :decode_header, :sanitize_payload,
+                           :validate_external_requirements!, :blank_external_requirement?
     end
   end
 end

data/lib/legion/crypt/kerberos_auth.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
+
 module Legion
   module Crypt
     module KerberosAuth
@@ -9,6 +11,7 @@ module Legion
       DEFAULT_AUTH_PATH = 'auth/kerberos/login'
 
       @kerberos_principal = nil
+      extend Legion::Logging::Helper
 
       class << self
         attr_reader :kerberos_principal
@@ -17,19 +20,21 @@ module Legion
       def self.login(vault_client:, service_principal:, auth_path: DEFAULT_AUTH_PATH)
         raise GemMissingError, 'lex-kerberos gem is required for Kerberos auth' unless spnego_available?
 
-        log_debug("login: SPN=#{service_principal}, auth_path=#{auth_path}")
+        log.info "KerberosAuth login requested auth_path=#{auth_path}"
+        log.debug("KerberosAuth: login: SPN=#{service_principal}, auth_path=#{auth_path}")
         addr = vault_client.respond_to?(:address) ? vault_client.address : 'n/a'
         ns   = vault_client.respond_to?(:namespace) ? vault_client.namespace.inspect : 'n/a'
-        log_debug("login: vault_client.address=#{addr}, namespace=#{ns}")
+        log.debug("KerberosAuth: login: vault_client.address=#{addr}, namespace=#{ns}")
 
         @kerberos_principal = nil
         token = obtain_token(service_principal)
-        log_debug("login: SPNEGO token obtained (#{token.length} chars)")
+        log.debug("KerberosAuth: login: SPNEGO token obtained (#{token.length} chars)")
 
         result = exchange_token(vault_client, token, auth_path)
         @kerberos_principal = result[:metadata]&.dig('username') || result[:metadata]&.dig(:username)
-        log_debug("login: authenticated as #{@kerberos_principal.inspect}, policies=#{result[:policies].inspect}")
-        log_debug("login: renewable=#{result[:renewable]}, ttl=#{result[:lease_duration]}s")
+        log.debug("KerberosAuth: login: authenticated as #{@kerberos_principal.inspect}, policies=#{result[:policies].inspect}")
+        log.debug("KerberosAuth: login: renewable=#{result[:renewable]}, ttl=#{result[:lease_duration]}s")
+        log.info "KerberosAuth login success principal=#{@kerberos_principal || 'unknown'} auth_path=#{auth_path}"
         result
       end
 
@@ -39,7 +44,8 @@ module Legion
         @spnego_available = begin
           require 'legion/extensions/kerberos/helpers/spnego'
           true
-        rescue LoadError
+        rescue LoadError => e
+          handle_exception(e, level: :debug, operation: 'crypt.kerberos_auth.spnego_available')
           # check if constant was already defined (e.g. stubbed in tests or loaded via another path)
           defined?(Legion::Extensions::Kerberos::Helpers::Spnego) ? true : false
         end
@@ -50,11 +56,6 @@ module Legion
         @kerberos_principal = nil
       end
 
-      def self.log_debug(message)
-        Legion::Logging.debug("KerberosAuth: #{message}") if defined?(Legion::Logging)
-      end
-      private_class_method :log_debug
-
       class << self
         private
 
@@ -63,7 +64,11 @@ module Legion
           result = helper.obtain_spnego_token(service_principal: service_principal)
           raise AuthError, "SPNEGO token acquisition failed: #{result[:error]}" unless result[:success]
 
+          log.info 'KerberosAuth obtained SPNEGO token'
           result[:token]
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.kerberos_auth.obtain_token', auth_method: 'kerberos')
+          raise
         end
 
         def exchange_token(vault_client, spnego_token, auth_path)
@@ -72,7 +77,8 @@ module Legion
 
           # The Vault Kerberos plugin reads the SPNEGO token from the HTTP
           # Authorization header, not the JSON body.
-          log_debug("exchange_token: PUT /v1/#{auth_path} (namespace=#{vault_client.respond_to?(:namespace) ? vault_client.namespace.inspect : 'n/a'})")
+          namespace = vault_client.respond_to?(:namespace) ? vault_client.namespace.inspect : 'n/a'
+          log.debug("KerberosAuth: exchange_token: PUT /v1/#{auth_path} (namespace=#{namespace})")
           json = vault_client.put(
             "/v1/#{auth_path}",
             '{}',
@@ -90,8 +96,12 @@ module Legion
             metadata:       auth.metadata
           }
         rescue ::Vault::HTTPClientError => e
-          log_debug("exchange_token: HTTP error: #{e.message}")
+          handle_exception(e, level: :warn, operation: 'crypt.kerberos_auth.exchange_token', auth_path: auth_path)
+          log.debug("KerberosAuth: exchange_token: HTTP error: #{e.message}")
           raise AuthError, "Vault Kerberos auth failed: #{e.message}"
+        rescue StandardError => e
+          handle_exception(e, level: :error, operation: 'crypt.kerberos_auth.exchange_token', auth_path: auth_path)
+          raise
         end
       end
     end

data/lib/legion/crypt/ldap_auth.rb

@@ -1,10 +1,15 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
+
 module Legion
   module Crypt
     module LdapAuth
+      include Legion::Logging::Helper
+
       def ldap_login(cluster_name:, username:, password:)
         cluster_name = cluster_name.to_sym
+        log.info "LDAP login requested user=#{username} cluster=#{cluster_name}"
         client = vault_client(cluster_name)
         secret = client.logical.write("auth/ldap/login/#{username}", password: password)
         auth = secret.auth
@@ -12,13 +17,14 @@ module Legion
 
         clusters[cluster_name][:token] = token
         clusters[cluster_name][:connected] = true
-        mark_vault_connected
+        client.token = token if client.respond_to?(:token=)
 
-        Legion::Logging.info "LDAP login success: user=#{username}, cluster=#{cluster_name}" if defined?(Legion::Logging)
+        log.info "LDAP login success: user=#{username}, cluster=#{cluster_name}"
         { token: token, lease_duration: auth.lease_duration,
           renewable: auth.renewable?, policies: auth.policies }
       rescue StandardError => e
-        Legion::Logging.warn "LDAP login failed: user=#{username}, cluster=#{cluster_name}: #{e.message}" if defined?(Legion::Logging)
+        handle_exception(e, level: :error, operation: 'crypt.ldap_auth.ldap_login', cluster_name: cluster_name, username: username)
+        log.error "LDAP login failed: user=#{username}, cluster=#{cluster_name}: #{e.message}"
         raise
       end
 
@@ -29,9 +35,11 @@ module Legion
 
           results[name] = ldap_login(cluster_name: name, username: username, password: password)
         rescue StandardError => e
-          Legion::Logging.warn("Legion::Crypt::LdapAuth#ldap_login_all cluster=#{name} failed: #{e.message}") if defined?(Legion::Logging)
+          handle_exception(e, level: :warn, operation: 'crypt.ldap_auth.ldap_login_all', cluster_name: name, username: username)
+          log.warn("Legion::Crypt::LdapAuth#ldap_login_all cluster=#{name} failed: #{e.message}")
           results[name] = { error: e.message }
         end
+        log.info "LDAP login_all complete successes=#{results.count { |_, result| result.is_a?(Hash) && !result.key?(:error) }} attempted=#{results.size}"
         results
       end
     end