legion-crypt 1.4.28 → 1.5.0

data/lib/legion/crypt/vault.rb

@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
 require 'uri'
 require 'vault'
 
 module Legion
   module Crypt
     module Vault
+      include Legion::Logging::Helper
+
       attr_accessor :sessions
 
       def settings
@@ -16,16 +19,17 @@ module Legion
         @sessions = []
         vault_settings = Legion::Settings[:crypt][:vault]
         ::Vault.address = resolve_vault_address(vault_settings)
+        namespace = vault_settings[:vault_namespace]
+        log.info "Vault connection requested address=#{::Vault.address} namespace=#{namespace || 'none'}"
 
         Legion::Settings[:crypt][:vault][:token] = ENV['VAULT_DEV_ROOT_TOKEN_ID'] if ENV.key? 'VAULT_DEV_ROOT_TOKEN_ID'
         return nil if Legion::Settings[:crypt][:vault][:token].nil?
 
         ::Vault.token = Legion::Settings[:crypt][:vault][:token]
-        namespace = vault_settings[:vault_namespace]
         ::Vault.namespace = namespace if namespace
         if vault_healthy?
           Legion::Settings[:crypt][:vault][:connected] = true
-          Legion::Logging.info "Vault connected at #{::Vault.address} (namespace=#{namespace || 'none'})" if defined?(Legion::Logging)
+          log.info "Vault connected at #{::Vault.address} (namespace=#{namespace || 'none'})"
         end
       rescue StandardError => e
         log_vault_connection_error(e)
@@ -43,10 +47,10 @@ module Legion
         raise
       end
 
-      def read(path, type = 'legion')
-        full_path = type.nil? || type.empty? ? "#{type}/#{path}" : path
-        log_read_context(full_path)
-        lease = logical_client.read(full_path)
+      def read(path, type = 'legion', cluster_name: nil)
+        full_path = type.nil? || type.empty? ? path : "#{type}/#{path}"
+        log_read_context(full_path, cluster_name: cluster_name)
+        lease = logical_client(cluster_name: cluster_name).read(full_path)
         if lease.nil?
           log_vault_debug("Vault read: #{full_path} returned nil")
           return nil
@@ -57,43 +61,45 @@ module Legion
         log_vault_debug("Vault read: #{full_path} returned keys=#{data&.keys&.inspect}")
         unwrap_kv_v2(data, full_path)
       rescue StandardError => e
-        Legion::Logging.warn "Vault read failed at #{full_path}: #{e.class}=#{e.message}" if defined?(Legion::Logging)
+        handle_exception(e, level: :error, operation: 'crypt.vault.read', path: full_path)
         raise
       end
 
-      def get(path)
-        Legion::Logging.debug "Vault kv get: path=#{path}" if defined?(Legion::Logging)
-        result = kv_client.read(path)
+      def get(path, cluster_name: nil)
+        log.debug "Vault kv get: path=#{path}"
+        result = kv_client(cluster_name: cluster_name).read(path)
         if result.nil?
-          Legion::Logging.debug "Vault kv get: #{path} returned nil" if defined?(Legion::Logging)
+          log.debug "Vault kv get: #{path} returned nil"
           return nil
         end
 
-        Legion::Logging.debug "Vault kv get: #{path} returned keys=#{result.data&.keys&.inspect}" if defined?(Legion::Logging)
+        log.debug "Vault kv get: #{path} returned keys=#{result.data&.keys&.inspect}"
         result.data
       rescue StandardError => e
-        Legion::Logging.warn "Vault kv get failed at #{path}: #{e.class}=#{e.message}" if defined?(Legion::Logging)
+        handle_exception(e, level: :error, operation: 'crypt.vault.get', path: path)
         raise
       end
 
-      def write(path, **hash)
-        Legion::Logging.debug "Vault kv write: #{path}" if defined?(Legion::Logging)
-        kv_client.write(path, **hash)
+      def write(path, cluster_name: nil, **hash)
+        log.info "Vault kv write requested path=#{path}"
+        kv_client(cluster_name: cluster_name).write(path, **hash)
+        log.info "Vault kv write complete path=#{path}"
       rescue StandardError => e
-        Legion::Logging.warn "Vault kv write failed at #{path}: #{e.message}" if defined?(Legion::Logging)
+        handle_exception(e, level: :error, operation: 'crypt.vault.write', path: path)
         raise
       end
 
-      def delete(path)
-        logical_client.delete(path)
+      def delete(path, cluster_name: nil)
+        logical_client(cluster_name: cluster_name).delete(path)
+        log.info "Vault delete complete path=#{path}"
         { success: true, path: path }
       rescue StandardError => e
-        Legion::Logging.warn "Vault delete failed for #{path}: #{e.message}" if defined?(Legion::Logging)
+        handle_exception(e, level: :error, operation: 'crypt.vault.delete', path: path)
         { success: false, path: path, error: e.message }
       end
 
-      def exist?(path)
-        !kv_client.read_metadata(path).nil?
+      def exist?(path, cluster_name: nil)
+        !kv_client(cluster_name: cluster_name).read_metadata(path).nil?
       end
 
       def add_session(path:)
@@ -104,7 +110,7 @@ module Legion
       def close_sessions
         return if @sessions.nil?
 
-        Legion::Logging.info 'Closing all Legion::Crypt vault sessions'
+        log.info 'Closing all Legion::Crypt vault sessions'
 
         @sessions.each do |session|
           close_session(session: session)
@@ -115,7 +121,7 @@ module Legion
         return unless Legion::Settings[:crypt][:vault][:connected]
         return if @renewer.nil?
 
-        Legion::Logging.debug 'Shutting down Legion::Crypt::Vault::Renewer'
+        log.info 'Shutting down Legion::Crypt::Vault::Renewer'
         @renewer.cancel
       end
 
@@ -128,7 +134,7 @@ module Legion
       end
 
       def renew_sessions(**_opts)
-        Legion::Logging.debug 'Vault renewal cycle start' if defined?(Legion::Logging)
+        log.debug 'Vault renewal cycle start'
         result = if respond_to?(:connected_clusters) && connected_clusters.any?
                    renew_cluster_tokens
                  else
@@ -136,15 +142,18 @@ module Legion
                      renew_session(session: session)
                    end
                  end
-        Legion::Logging.debug 'Vault renewal cycle complete' if defined?(Legion::Logging)
+        log.debug 'Vault renewal cycle complete'
         result
+      rescue StandardError => e
+        handle_exception(e, level: :error, operation: 'crypt.vault.renew_sessions')
+        raise
       end
 
       def renew_cluster_tokens
         connected_clusters.each_key do |name|
           client = vault_client(name)
           client.auth_token.renew_self
-          Legion::Logging.info "Vault token renewed for cluster #{name}" if defined?(Legion::Logging)
+          log.info "Vault token renewed for cluster #{name}"
         rescue StandardError => e
           log_vault_error(name, e)
         end
@@ -156,32 +165,41 @@ module Legion
 
       private
 
-      def kv_client
+      def kv_client(cluster_name: nil)
         if respond_to?(:connected_clusters) && connected_clusters.any?
-          vault_client.kv(settings[:vault][:kv_path])
+          connected_vault_client(cluster_name).kv(settings[:kv_path])
         else
-          ::Vault.kv(settings[:vault][:kv_path])
+          raise ArgumentError, "Vault cluster not connected: #{cluster_name}" if cluster_name
+
+          ::Vault.kv(settings[:kv_path])
         end
       end
 
-      def logical_client
+      def logical_client(cluster_name: nil)
         if respond_to?(:connected_clusters) && connected_clusters.any?
-          vault_client.logical
+          connected_vault_client(cluster_name).logical
         else
+          raise ArgumentError, "Vault cluster not connected: #{cluster_name}" if cluster_name
+
           ::Vault.logical
         end
       end
 
-      def log_read_context(full_path)
-        return unless defined?(Legion::Logging)
-
+      def log_read_context(full_path, cluster_name: nil)
         namespace = if respond_to?(:connected_clusters) && connected_clusters.any?
-                      client = vault_client
+                      client = connected_vault_client(cluster_name)
                       client.respond_to?(:namespace) ? client.namespace : 'n/a'
                     else
                       'n/a (global client)'
                     end
-        Legion::Logging.debug "Vault read: path=#{full_path}, namespace=#{namespace}"
+        log.debug "Vault read: path=#{full_path}, namespace=#{namespace}"
+      end
+
+      def connected_vault_client(cluster_name = nil)
+        selected_cluster = selected_connected_cluster_name(cluster_name)
+        raise ArgumentError, "Vault cluster not connected: #{cluster_name}" if selected_cluster.nil? && cluster_name
+
+        selected_cluster ? vault_client(selected_cluster) : nil
       end
 
       def unwrap_kv_v2(data, full_path)
@@ -207,17 +225,11 @@ module Legion
       end
 
       def log_vault_connection_error(error)
-        if defined?(Legion::Logging) && Legion::Logging.respond_to?(:log_exception)
-          Legion::Logging.log_exception(error, lex: 'crypt', component_type: :helper)
-        elsif defined?(Legion::Logging) && Legion::Logging.respond_to?(:error)
-          Legion::Logging.error "Vault connection failed: #{error.class}=#{error.message}\n#{Array(error.backtrace).first(10).join("\n")}"
-        else
-          warn "Vault connection failed: #{error.class}=#{error.message}"
-        end
+        handle_exception(error, level: :error, operation: 'crypt.vault.connect_vault', address: ::Vault.address)
       end
 
       def log_vault_debug(message)
-        Legion::Logging.debug(message) if defined?(Legion::Logging)
+        log.debug(message)
       end
     end
   end

data/lib/legion/crypt/vault_cluster.rb

@@ -3,6 +3,7 @@
 # Ruby 4.0 freezes OpenSSL::SSL::SSLContext::DEFAULT_PARAMS by default.
 # The vault gem (0.18.x) mutates this hash in Vault.setup! — replace it
 # with a mutable dup so the require succeeds on Ruby 4.0+.
+require 'legion/logging/helper'
 require 'openssl'
 if OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.frozen?
   unfrozen = OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.dup
@@ -15,6 +16,8 @@ require 'vault'
 module Legion
   module Crypt
     module VaultCluster
+      include Legion::Logging::Helper
+
       def vault_client(name = nil)
         name = resolve_cluster_name(name)
         @vault_clients ||= {}
@@ -40,6 +43,7 @@ module Legion
       end
 
       def connect_all_clusters
+        log.info "Vault cluster connect requested configured_clusters=#{clusters.size}"
         log_vault_debug("connect_all_clusters: #{clusters.size} cluster(s) configured")
         results = {}
         clusters.each do |name, config|
@@ -60,12 +64,13 @@ module Legion
         rescue StandardError => e
           config[:connected] = false
           results[name] = false
-          log_vault_error(name, e)
+          log_vault_error(name, e, operation: 'crypt.vault_cluster.connect_all_clusters')
         end
 
         connected = results.select { |_, v| v }
+        log.info "Vault cluster connect complete connected=#{connected.size} attempted=#{results.size}"
         log_vault_debug("connect_all_clusters: #{connected.size}/#{results.size} connected")
-        mark_vault_connected if connected.any?
+        sync_vault_connected(connected.any?)
         results
       end
 
@@ -79,10 +84,27 @@ module Legion
         raise
       end
 
-      def mark_vault_connected
+      def sync_vault_connected(connected)
         return unless defined?(Legion::Settings)
 
-        Legion::Settings[:crypt][:vault][:connected] = true
+        Legion::Settings[:crypt][:vault][:connected] = connected
+      end
+
+      def selected_connected_cluster_name(name = nil)
+        active_clusters = connected_clusters
+        return nil if active_clusters.empty?
+
+        if name
+          cluster_name = name.to_sym
+          raise ArgumentError, "Vault cluster not connected: #{cluster_name}" unless active_clusters.key?(cluster_name)
+
+          return cluster_name
+        end
+
+        default_name = vault_settings[:default]&.to_sym
+        return default_name if default_name && active_clusters.key?(default_name)
+
+        active_clusters.keys.first
       end
 
       def resolve_cluster_name(name)
@@ -95,6 +117,7 @@ module Legion
         return nil unless config.is_a?(Hash)
 
         addr = "#{config[:protocol]}://#{config[:address]}:#{config[:port]}"
+        log.info "Building Vault client address=#{addr} namespace=#{config[:namespace].inspect}"
         log_vault_debug("build_vault_client: address=#{addr}")
         client = ::Vault::Client.new(
           address: addr,
@@ -112,12 +135,8 @@ module Legion
         client
       end
 
-      def log_vault_error(name, error)
-        if defined?(Legion::Logging)
-          Legion::Logging.error("Vault cluster #{name}: #{error.message}")
-        else
-          warn("Vault cluster #{name}: #{error.message}")
-        end
+      def log_vault_error(name, error, operation: 'crypt.vault_cluster.error')
+        handle_exception(error, level: :error, operation: operation, cluster_name: name)
       end
 
       def connect_kerberos_cluster(name, config)
@@ -136,6 +155,7 @@ module Legion
         require 'legion/crypt/kerberos_auth'
         client = vault_client(name)
         log_vault_debug("connect_kerberos_cluster[#{name}]: client.namespace=#{client.respond_to?(:namespace) ? client.namespace.inspect : 'n/a'}")
+        log.info "Connecting Vault cluster #{name} via Kerberos auth_path=#{auth_path}"
 
         result = Legion::Crypt::KerberosAuth.login(
           vault_client:      client,
@@ -152,29 +172,27 @@ module Legion
         log_cluster_connected(name, config)
         true
       rescue Legion::Crypt::KerberosAuth::GemMissingError => e
+        handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.connect_kerberos_cluster', cluster_name: name)
         log_vault_warn(name, e.message)
         config[:connected] = false
         false
       rescue Legion::Crypt::KerberosAuth::AuthError => e
+        handle_exception(e, level: :warn, operation: 'crypt.vault_cluster.connect_kerberos_cluster', cluster_name: name)
         log_vault_warn(name, "Kerberos auth failed: #{e.message}")
         config[:connected] = false
         false
       end
 
       def log_cluster_connected(name, config)
-        Legion::Logging.info "Vault cluster connected: #{name} at #{config[:address]}" if defined?(Legion::Logging)
+        log.info "Vault cluster connected: #{name} at #{config[:address]}"
       end
 
       def log_vault_warn(name, message)
-        if defined?(Legion::Logging)
-          Legion::Logging.warn("Vault cluster #{name}: #{message}")
-        else
-          warn("Vault cluster #{name}: #{message}")
-        end
+        log.warn("Vault cluster #{name}: #{message}")
       end
 
       def log_vault_debug(message)
-        Legion::Logging.debug(message) if defined?(Legion::Logging)
+        log.debug(message)
       end
     end
   end

data/lib/legion/crypt/vault_jwt_auth.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
+
 module Legion
   module Crypt
     # Vault JWT auth backend integration.
@@ -18,6 +20,8 @@ module Legion
 
       class AuthError < StandardError; end
 
+      extend Legion::Logging::Helper
+
       # Authenticate to Vault using a JWT token.
       # Returns a Vault token string on success.
       #
@@ -28,6 +32,7 @@ module Legion
       def self.login(jwt:, role: DEFAULT_ROLE, auth_path: DEFAULT_AUTH_PATH)
         raise AuthError, 'Vault is not connected' unless vault_connected?
 
+        log.info "[crypt:vault_jwt] authenticating role=#{role} auth_path=#{auth_path}"
         response = ::Vault.logical.write(
           auth_path,
           role: role,
@@ -44,11 +49,18 @@ module Legion
           metadata:       response.auth.metadata
         }
       rescue ::Vault::HTTPClientError => e
-        Legion::Logging.warn "Vault JWT auth failed (client error): role=#{role}, #{e.message}" if defined?(Legion::Logging)
+        handle_exception(e, level: :warn, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path,
+                            category: 'client_error')
         raise AuthError, "Vault JWT auth failed: #{e.message}"
       rescue ::Vault::HTTPServerError => e
-        Legion::Logging.warn "Vault JWT auth failed (server error): role=#{role}, #{e.message}" if defined?(Legion::Logging)
+        handle_exception(e, level: :warn, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path,
+                            category: 'server_error')
         raise AuthError, "Vault server error during JWT auth: #{e.message}"
+      rescue StandardError => e
+        handle_exception(e, level: :error, operation: 'crypt.vault_jwt_auth.login', role: role, auth_path: auth_path)
+        raise if e.is_a?(AuthError)
+
+        raise AuthError, "Vault JWT auth failed: #{e.message}"
       end
 
       # Authenticate and set the Vault client token for subsequent operations.
@@ -58,7 +70,7 @@ module Legion
       def self.login!(jwt:, role: DEFAULT_ROLE, auth_path: DEFAULT_AUTH_PATH)
         result = login(jwt: jwt, role: role, auth_path: auth_path)
         ::Vault.token = result[:token]
-        Legion::Logging.info "[crypt:vault_jwt] authenticated via JWT auth, policies=#{result[:policies].join(',')}"
+        log.info "[crypt:vault_jwt] authenticated via JWT auth, policies=#{result[:policies].join(',')}"
         result
       end
 
@@ -70,6 +82,7 @@ module Legion
       # @param role [String] Vault JWT auth role name
       # @return [Hash] Same as login
       def self.worker_login(worker_id:, owner_msid:, role: DEFAULT_ROLE)
+        log.info "[crypt:vault_jwt] worker login requested role=#{role} worker_id=#{worker_id}"
         jwt = Legion::Crypt::JWT.issue(
           { worker_id: worker_id, sub: owner_msid, scope: 'vault', aud: 'legion' },
           signing_key: Legion::Crypt.cluster_secret,
@@ -85,7 +98,7 @@ module Legion
           defined?(Legion::Settings) &&
           Legion::Settings[:crypt][:vault][:connected] == true
       rescue StandardError => e
-        Legion::Logging.debug("Legion::Crypt::VaultJwtAuth#vault_connected? failed: #{e.message}") if defined?(Legion::Logging)
+        handle_exception(e, level: :debug, operation: 'crypt.vault_jwt_auth.vault_connected?')
         false
       end
 

data/lib/legion/crypt/vault_kerberos_auth.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'legion/logging/helper'
+
 module Legion
   module Crypt
     module VaultKerberosAuth
@@ -7,9 +9,12 @@ module Legion
 
       class AuthError < StandardError; end
 
+      extend Legion::Logging::Helper
+
       def self.login(spnego_token:, auth_path: DEFAULT_AUTH_PATH)
         raise AuthError, 'Vault is not connected' unless vault_connected?
 
+        log.info "[crypt:vault_kerberos] login requested auth_path=#{auth_path}"
         response = ::Vault.logical.write(auth_path, authorization: "Negotiate #{spnego_token}")
         raise AuthError, 'Vault Kerberos auth returned no auth data' unless response&.auth
 
@@ -21,12 +26,17 @@ module Legion
           metadata:       response.auth.metadata
         }
       rescue ::Vault::HTTPClientError => e
+        handle_exception(e, level: :warn, operation: 'crypt.vault_kerberos_auth.login', auth_path: auth_path)
         raise AuthError, "Vault Kerberos auth failed: #{e.message}"
+      rescue StandardError => e
+        handle_exception(e, level: :error, operation: 'crypt.vault_kerberos_auth.login', auth_path: auth_path)
+        raise
       end
 
       def self.login!(spnego_token:, auth_path: DEFAULT_AUTH_PATH)
         result = login(spnego_token: spnego_token, auth_path: auth_path)
         ::Vault.token = result[:token]
+        log.info "[crypt:vault_kerberos] authenticated via Kerberos auth, policies=#{result[:policies].join(',')}"
         result
       end
 
@@ -34,7 +44,7 @@ module Legion
         defined?(::Vault) && defined?(Legion::Settings) &&
           Legion::Settings[:crypt][:vault][:connected] == true
       rescue StandardError => e
-        Legion::Logging.debug("Legion::Crypt::VaultKerberosAuth#vault_connected? failed: #{e.message}") if defined?(Legion::Logging)
+        handle_exception(e, level: :debug, operation: 'crypt.vault_kerberos_auth.vault_connected')
         false
       end
 

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.28'
+    VERSION = '1.5.0'
   end
 end