legion-crypt 1.4.6 → 1.4.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58236395edc171db0660e744e8ed15ed7497af43bb6154f9361693a6576f070c
-  data.tar.gz: '008c7865a64d8a43c3c167ae3fc36aef7b537f26522b2ce05f40615b98ff3e80'
+  metadata.gz: 7a91784c5d25f02bae1517ea0192185a147df4739c5f40467c4a1eaac4c5d073
+  data.tar.gz: a5c94a7cbd0074c8b2494f0fcf7bf46eff9daa2c45fe04b86f4f7548e79e1c93
 SHA512:
-  metadata.gz: eb66a3e5aaf65cf06e463e0ed4024121d9f8b9459731ef8422761fa0d9888c6e90bef58e0a4bb13cfd57eb2d14063ebfe07a8968209f738d15f99080669055e9
-  data.tar.gz: 980231e72cdb5a7eb36702fcb69dfc25ff41811c35df5485476410e386126ff45c4911715ec43cc3c347932f6a5d79d4c70728afde25f99cf423d03aae223265
+  metadata.gz: c5695228ec9226e79cf6b14322ce944e7eb80c24450c91ddbcf4d4a93ee33ef825b92ee8f742029155b301e18d676e597e13ea33ecfbb2397b7cb13f45f0ef4e
+  data.tar.gz: 6b37ee3075d821ec4c3bc01b44ad1450177ba6ec8aa6ea2c1ffe7fa6e44c4d40ab3e5a15c63464dd0432d15c2eaaddee13802533333e8f35011895fde47cda0a

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Legion::Crypt
 
+## [1.4.7] - 2026-03-22
+
+### Added
+- Logging across vault, JWT, JWKS, Ed25519, PartitionKeys, Attestation, LdapAuth, VaultJwtAuth, VaultCluster operations
+- `vault.rb`: `.info` on Vault connect, `.info` on cluster token renewal, `.debug` on read/write/get paths, `.warn` on read/write/get failures, `.debug` on renewal cycle start/complete
+- `jwt.rb`: `.info` on JWT issue (subject, expiry, algorithm), `.debug` on verify success, `.warn` on verify failures (expired, invalid, decode) before raising
+- `jwks_client.rb`: `.debug` on JWKS fetch URL, `.debug` on cache hit, `.warn` on fetch failure
+- `ed25519.rb`: `.debug` on keypair generation, sign, verify, and Vault store/load paths
+- `partition_keys.rb`: `.debug` on key derivation, `.warn` on encrypt/decrypt failures
+- `attestation.rb`: `.debug` on attestation create/verify, `.warn` on verification failure
+- `ldap_auth.rb`: `.info` on LDAP login success, `.warn` on LDAP login failure
+- `vault_jwt_auth.rb`: `.warn` on JWT auth client/server errors in non-bang `login`
+- `vault_cluster.rb`: `.info` on successful cluster connect
+
 ## [1.4.6] - 2026-03-21
 
 ### Fixed

data/CLAUDE.md

@@ -8,7 +8,7 @@
 Handles encryption, decryption, secrets management, JWT token management, and HashiCorp Vault connectivity for the LegionIO framework. Provides AES-256-CBC message encryption, RSA key pair generation, cluster secret management, JWT issue/verify operations, and Vault token lifecycle management.
 
 **GitHub**: https://github.com/LegionIO/legion-crypt
-**Version**: 1.4.4
+**Version**: 1.4.7
 **License**: Apache-2.0
 
 ## Architecture

data/CODEOWNERS

@@ -1 +1,40 @@
+# Default owner — all files
 * @Esity
+
+# Core library code
+# lib/ @Esity @future-security-team
+
+# Cipher and key management
+# lib/legion/crypt/cipher.rb @Esity @future-security-team
+# lib/legion/crypt/partition_keys.rb @Esity @future-security-team
+# lib/legion/crypt/ed25519.rb @Esity @future-security-team
+
+# Vault integration
+# lib/legion/crypt/vault.rb @Esity @future-security-team
+# lib/legion/crypt/vault_jwt_auth.rb @Esity @future-security-team
+# lib/legion/crypt/vault_renewer.rb @Esity @future-security-team
+# lib/legion/crypt/vault_cluster.rb @Esity @future-security-team
+# lib/legion/crypt/lease_manager.rb @Esity @future-security-team
+
+# JWT and JWKS
+# lib/legion/crypt/jwt.rb @Esity @future-security-team
+# lib/legion/crypt/jwks_client.rb @Esity @future-security-team
+
+# Auth integrations
+# lib/legion/crypt/ldap_auth.rb @Esity @future-security-team
+# lib/legion/crypt/vault_kerberos_auth.rb @Esity @future-security-team
+
+# Cluster secret
+# lib/legion/crypt/cluster_secret.rb @Esity @future-security-team
+
+# Cryptographic erasure
+# lib/legion/crypt/erasure.rb @Esity @future-security-team
+
+# Specs
+# spec/ @Esity @future-contributors
+
+# Documentation
+# *.md @Esity @future-docs-team
+
+# CI/CD
+# .github/ @Esity

data/README.md

@@ -2,7 +2,7 @@
 
 Encryption, secrets management, JWT token management, and HashiCorp Vault integration for the [LegionIO](https://github.com/LegionIO/LegionIO) framework. Provides AES-256-CBC message encryption, RSA key pair generation, cluster secret management, JWT issue/verify operations, Vault token lifecycle management, and multi-cluster Vault connectivity.
 
-**Version**: 1.4.4
+**Version**: 1.4.7
 
 ## Installation
 

data/lib/legion/crypt/attestation.rb

@@ -17,6 +17,7 @@ module Legion
 
           payload = Legion::JSON.dump(claim)
           signature = Legion::Crypt::Ed25519.sign(payload, private_key)
+          Legion::Logging.debug "Attestation created for agent #{agent_id}, state=#{state}" if defined?(Legion::Logging)
 
           { claim: claim, signature: signature.unpack1('H*'), payload: payload }
         end
@@ -24,7 +25,15 @@ module Legion
         def verify(claim_hash:, signature_hex:, public_key:)
           payload = Legion::JSON.dump(claim_hash)
           signature = [signature_hex].pack('H*')
-          Legion::Crypt::Ed25519.verify(payload, signature, public_key)
+          result = Legion::Crypt::Ed25519.verify(payload, signature, public_key)
+          if defined?(Legion::Logging)
+            if result
+              Legion::Logging.debug "Attestation verified for agent #{claim_hash[:agent_id]}"
+            else
+              Legion::Logging.warn "Attestation verification failed for agent #{claim_hash[:agent_id]}"
+            end
+          end
+          result
         end
 
         def fresh?(claim_hash, max_age_seconds: 300)

data/lib/legion/crypt/ed25519.rb

@@ -8,6 +8,7 @@ module Legion
       class << self
         def generate_keypair
           signing_key = ::Ed25519::SigningKey.generate
+          Legion::Logging.debug 'Ed25519 keypair generated' if defined?(Legion::Logging)
           {
             private_key:    signing_key.to_bytes,
             public_key:     signing_key.verify_key.to_bytes,
@@ -17,12 +18,15 @@ module Legion
 
         def sign(message, private_key_bytes)
           signing_key = ::Ed25519::SigningKey.new(private_key_bytes)
-          signing_key.sign(message)
+          result = signing_key.sign(message)
+          Legion::Logging.debug 'Ed25519 sign complete' if defined?(Legion::Logging)
+          result
         end
 
         def verify(message, signature, public_key_bytes)
           verify_key = ::Ed25519::VerifyKey.new(public_key_bytes)
           verify_key.verify(signature, message)
+          Legion::Logging.debug 'Ed25519 verify success' if defined?(Legion::Logging)
           true
         rescue ::Ed25519::VerifyError
           false
@@ -32,6 +36,7 @@ module Legion
           keypair ||= generate_keypair
           vault_path = "#{key_prefix}/#{agent_id}"
           if defined?(Legion::Crypt::Vault)
+            Legion::Logging.debug "Ed25519 storing keypair at #{vault_path}" if defined?(Legion::Logging)
             Legion::Crypt::Vault.write(vault_path, {
                                          private_key: keypair[:private_key].unpack1('H*'),
                                          public_key:  keypair[:public_key_hex]
@@ -42,6 +47,7 @@ module Legion
 
         def load_private_key(agent_id:)
           vault_path = "#{key_prefix}/#{agent_id}"
+          Legion::Logging.debug "Ed25519 loading private key from #{vault_path}" if defined?(Legion::Logging)
           data = Legion::Crypt::Vault.read(vault_path)
           [data[:private_key]].pack('H*') if data&.dig(:private_key)
         rescue StandardError

data/lib/legion/crypt/jwks_client.rb

@@ -17,6 +17,7 @@ module Legion
       class << self
         def fetch_keys(jwks_url)
           @mutex.synchronize do
+            Legion::Logging.debug "JWKS fetch: #{jwks_url}" if defined?(Legion::Logging)
             response = http_get(jwks_url)
             jwks_data = parse_response(response)
             keys = parse_jwks(jwks_data)
@@ -24,6 +25,9 @@ module Legion
             @cache[jwks_url] = { keys: keys, fetched_at: Time.now }
             keys
           end
+        rescue StandardError => e
+          Legion::Logging.warn "JWKS fetch failed for #{jwks_url}: #{e.message}" if defined?(Legion::Logging)
+          raise
         end
 
         def find_key(jwks_url, kid)
@@ -31,10 +35,12 @@ module Legion
 
           if cached && !expired?(cached[:fetched_at])
             key = cached[:keys][kid]
-            return key if key
+            if key
+              Legion::Logging.debug "JWKS cache hit: kid=#{kid}" if defined?(Legion::Logging)
+              return key
+            end
           end
 
-          # Re-fetch once on cache miss or expiry
           keys = fetch_keys(jwks_url)
           key = keys[kid]
           return key if key

data/lib/legion/crypt/jwt.rb

@@ -25,7 +25,9 @@ module Legion
           jti: SecureRandom.uuid
         }.merge(payload)
 
-        ::JWT.encode(claims, signing_key, algorithm)
+        token = ::JWT.encode(claims, signing_key, algorithm)
+        Legion::Logging.info "JWT issued: sub=#{claims[:sub]}, exp=#{Time.at(claims[:exp]).utc.iso8601}, alg=#{algorithm}" if defined?(Legion::Logging)
+        token
       end
 
       def self.verify(token, verification_key:, **opts)
@@ -44,12 +46,17 @@ module Legion
         decode_opts[:iss] = issuer if verify_issuer
 
         payload, _header = ::JWT.decode(token, verification_key, true, decode_opts)
-        symbolize_keys(payload)
+        result = symbolize_keys(payload)
+        Legion::Logging.debug "JWT verify success: sub=#{result[:sub]}, jti=#{result[:jti]}" if defined?(Legion::Logging)
+        result
       rescue ::JWT::ExpiredSignature
+        Legion::Logging.warn 'JWT verify failed: token has expired' if defined?(Legion::Logging)
         raise ExpiredTokenError, 'token has expired'
       rescue ::JWT::VerificationError, ::JWT::IncorrectAlgorithm
+        Legion::Logging.warn 'JWT verify failed: signature verification failed' if defined?(Legion::Logging)
         raise InvalidTokenError, 'token signature verification failed'
       rescue ::JWT::DecodeError => e
+        Legion::Logging.warn "JWT verify failed: #{e.message}" if defined?(Legion::Logging)
         raise DecodeError, "failed to decode token: #{e.message}"
       end
 
@@ -91,16 +98,23 @@ module Legion
         end
 
         payload, _header = ::JWT.decode(token, public_key, true, decode_opts)
-        symbolize_keys(payload)
+        result = symbolize_keys(payload)
+        Legion::Logging.debug "JWT JWKS verify success: sub=#{result[:sub]}, kid=#{kid}" if defined?(Legion::Logging)
+        result
       rescue ::JWT::ExpiredSignature
+        Legion::Logging.warn "JWT JWKS verify failed: token has expired, kid=#{kid}" if defined?(Legion::Logging)
         raise ExpiredTokenError, 'token has expired'
       rescue ::JWT::VerificationError, ::JWT::IncorrectAlgorithm
+        Legion::Logging.warn "JWT JWKS verify failed: signature verification failed, kid=#{kid}" if defined?(Legion::Logging)
         raise InvalidTokenError, 'token signature verification failed'
       rescue ::JWT::InvalidIssuerError
+        Legion::Logging.warn "JWT JWKS verify failed: issuer not allowed, kid=#{kid}" if defined?(Legion::Logging)
         raise InvalidTokenError, 'token issuer not allowed'
       rescue ::JWT::InvalidAudError
+        Legion::Logging.warn "JWT JWKS verify failed: audience mismatch, kid=#{kid}" if defined?(Legion::Logging)
         raise InvalidTokenError, 'token audience mismatch'
       rescue ::JWT::DecodeError => e
+        Legion::Logging.warn "JWT JWKS verify failed: #{e.message}, kid=#{kid}" if defined?(Legion::Logging)
         raise DecodeError, "failed to decode token: #{e.message}"
       end
 

data/lib/legion/crypt/ldap_auth.rb

@@ -13,8 +13,12 @@ module Legion
         clusters[cluster_name][:token] = token
         clusters[cluster_name][:connected] = true
 
+        Legion::Logging.info "LDAP login success: user=#{username}, cluster=#{cluster_name}" if defined?(Legion::Logging)
         { token: token, lease_duration: auth.lease_duration,
           renewable: auth.renewable, policies: auth.policies }
+      rescue StandardError => e
+        Legion::Logging.warn "LDAP login failed: user=#{username}, cluster=#{cluster_name}: #{e.message}" if defined?(Legion::Logging)
+        raise
       end
 
       def ldap_login_all(username:, password:)

data/lib/legion/crypt/partition_keys.rb

@@ -12,6 +12,7 @@ module Legion
           rescue StandardError
             nil
           end || 'legion-partition'
+          Legion::Logging.debug "PartitionKeys key derivation for tenant #{tenant_id}" if defined?(Legion::Logging)
           salt = OpenSSL::Digest::SHA256.digest(tenant_id.to_s)
           OpenSSL::KDF.hkdf(master_key, salt: salt, info: context, length: 32, hash: 'SHA256')
         end
@@ -26,6 +27,9 @@ module Legion
           auth_tag = cipher.auth_tag
 
           { ciphertext: ciphertext, iv: iv, auth_tag: auth_tag }
+        rescue StandardError => e
+          Legion::Logging.warn "PartitionKeys encrypt failed for tenant #{tenant_id}: #{e.message}" if defined?(Legion::Logging)
+          raise
         end
 
         def decrypt_for_tenant(ciphertext:, init_vector:, auth_tag:, tenant_id:, master_key:)
@@ -36,6 +40,9 @@ module Legion
           decipher.iv = init_vector
           decipher.auth_tag = auth_tag
           decipher.update(ciphertext) + decipher.final
+        rescue StandardError => e
+          Legion::Logging.warn "PartitionKeys decrypt failed for tenant #{tenant_id}: #{e.message}" if defined?(Legion::Logging)
+          raise
         end
       end
     end

data/lib/legion/crypt/vault.rb

@@ -32,7 +32,10 @@ module Legion
         return nil if Legion::Settings[:crypt][:vault][:token].nil?
 
         ::Vault.token = Legion::Settings[:crypt][:vault][:token]
-        Legion::Settings[:crypt][:vault][:connected] = true if ::Vault.sys.health_status.initialized?
+        if ::Vault.sys.health_status.initialized?
+          Legion::Settings[:crypt][:vault][:connected] = true
+          Legion::Logging.info "Vault connected at #{::Vault.address}" if defined?(Legion::Logging)
+        end
         return unless Legion.const_defined? 'Extensions::Actors::Every'
 
         require_relative 'vault_renewer'
@@ -45,20 +48,32 @@ module Legion
 
       def read(path, type = 'legion')
         full_path = type.nil? || type.empty? ? "#{type}/#{path}" : path
+        Legion::Logging.debug "Vault read: #{full_path}" if defined?(Legion::Logging)
         lease = ::Vault.logical.read(full_path)
         add_session(path: lease.lease_id) if lease.respond_to? :lease_id
         lease.data
+      rescue StandardError => e
+        Legion::Logging.warn "Vault read failed at #{full_path}: #{e.message}" if defined?(Legion::Logging)
+        raise
       end
 
       def get(path)
+        Legion::Logging.debug "Vault kv get: #{path}" if defined?(Legion::Logging)
         result = ::Vault.kv(settings[:vault][:kv_path]).read(path)
         return nil if result.nil?
 
         result.data
+      rescue StandardError => e
+        Legion::Logging.warn "Vault kv get failed at #{path}: #{e.message}" if defined?(Legion::Logging)
+        raise
       end
 
       def write(path, **hash)
+        Legion::Logging.debug "Vault kv write: #{path}" if defined?(Legion::Logging)
         ::Vault.kv(settings[:vault][:kv_path]).write(path, **hash)
+      rescue StandardError => e
+        Legion::Logging.warn "Vault kv write failed at #{path}: #{e.message}" if defined?(Legion::Logging)
+        raise
       end
 
       def exist?(path)
@@ -96,19 +111,23 @@ module Legion
       end
 
       def renew_sessions(**_opts)
-        if respond_to?(:connected_clusters) && connected_clusters.any?
-          renew_cluster_tokens
-        else
-          @sessions.each do |session|
-            renew_session(session: session)
-          end
-        end
+        Legion::Logging.debug 'Vault renewal cycle start' if defined?(Legion::Logging)
+        result = if respond_to?(:connected_clusters) && connected_clusters.any?
+                   renew_cluster_tokens
+                 else
+                   @sessions.each do |session|
+                     renew_session(session: session)
+                   end
+                 end
+        Legion::Logging.debug 'Vault renewal cycle complete' if defined?(Legion::Logging)
+        result
       end
 
       def renew_cluster_tokens
         connected_clusters.each_key do |name|
           client = vault_client(name)
           client.auth_token.renew_self
+          Legion::Logging.info "Vault token renewed for cluster #{name}" if defined?(Legion::Logging)
         rescue StandardError => e
           log_vault_error(name, e)
         end

data/lib/legion/crypt/vault_cluster.rb

@@ -37,6 +37,7 @@ module Legion
           client = vault_client(name)
           config[:connected] = client.sys.health_status.initialized?
           results[name] = config[:connected]
+          Legion::Logging.info "Vault cluster connected: #{name} at #{config[:address]}" if config[:connected] && defined?(Legion::Logging)
         rescue StandardError => e
           config[:connected] = false
           results[name] = false

data/lib/legion/crypt/vault_jwt_auth.rb

@@ -44,8 +44,10 @@ module Legion
           metadata:       response.auth.metadata
         }
       rescue ::Vault::HTTPClientError => e
+        Legion::Logging.warn "Vault JWT auth failed (client error): role=#{role}, #{e.message}" if defined?(Legion::Logging)
         raise AuthError, "Vault JWT auth failed: #{e.message}"
       rescue ::Vault::HTTPServerError => e
+        Legion::Logging.warn "Vault JWT auth failed (server error): role=#{role}, #{e.message}" if defined?(Legion::Logging)
         raise AuthError, "Vault server error during JWT auth: #{e.message}"
       end
 

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.6'
+    VERSION = '1.4.7'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.4.6
+  version: 1.4.7
 platform: ruby
 authors:
 - Esity