legion-crypt 1.5.0 → 1.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b7ffab5835f3a3ac600a9bfe87e1e015e362d07d5814c956c13cc7552d23775
-  data.tar.gz: 18179a5915360c9f22151ec6a08ac813e580c2c2fb36dffd95b6f42aa9a4c242
+  metadata.gz: 01cec7ac57c7d5448b5fba4237fdccc9ac8099966a4a546e95dd4888d838604f
+  data.tar.gz: ac81d602c9fc34493aeabe3fdeadd12f01fb36f8c248ac44687166fd24d9a48d
 SHA512:
-  metadata.gz: cce5f0d26e384c890c7117f0e710a9ff0f27da5794e8c2c9f05b3bdd81cacf3a551ffaaa9f31a75fea68e512918370b6deb8870c30cd010ea2da622a87c04611
-  data.tar.gz: acac22b254e94ccfd8ead507e014c7a619b715f8aab8000454d2e428633096ea3b251e21ab51ba67b31c879d6b07733670eb4cff1bf657ec553892262f72d199
+  metadata.gz: dea3247dbaf00a49507ededcfdd72e9e3545485cbcec511657d2e2c602e03f2230c3c34e93108ae14ede71aa7a768a36573c3f852595444f2f6ed118a351bd8c
+  data.tar.gz: 011ac0f235a69f7655ab1237d2a87faf3d343de20ef1ffe1e9576b5a555e9c0e5d46dfc6d77dd137851835850e3877783c70f62a216c3dd1a4af9c3e080e9ed6

data/AGENTS.md

@@ -32,6 +32,15 @@ bundle exec rubocop
 - Maintain compatibility for Kerberos, LDAP, and JWT Vault auth paths.
 - Cryptographic defaults and key lifecycle behavior are contract-sensitive; change only with test coverage.
 
+## Known Risks
+
+- Vault-backed cluster secret sync is inconsistent today: config key mismatch, read/write path mismatch, and push happens before the new secret is stored.
+- External JWKS verification currently accepts tokens without issuer/audience enforcement unless the caller passes both explicitly; fail closed when touching this path.
+- Multi-cluster Vault behavior has correctness gaps around LDAP token propagation, default-cluster routing, and lease-manager client selection.
+- SPIFFE X.509 fetch currently falls back to a self-signed SVID on Workload API failure; treat that path as security-sensitive and avoid expanding the fallback behavior.
+- `Ed25519` and `Erasure` include helper paths that call `Legion::Crypt::Vault.read/write` directly; verify runtime behavior before relying on those helpers.
+- Current specs pass, but some of the highest-risk paths above are under-covered or only covered with mocks that preserve the existing behavior.
+
 ## Validation
 
 - Run targeted specs for changed auth/crypto paths first.

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Legion::Crypt
 
+## [1.5.2] - 2026-04-03
+
+### Fixed
+- LeaseManager `at_exit` hook now wraps shutdown in a 10s timeout to prevent process hang when Logger Monitor or network I/O is blocked during crash exit
+
+## [1.5.1] - 2026-04-03
+
+### Fixed
+- Vault `read` method no longer prepends a `legion/` mount prefix to paths — the default `type` parameter changed from `'legion'` to `nil` to match the actual KV v2 mount path in the `legionio` namespace
+- LeaseManager now registers an `at_exit` hook to revoke active Vault leases on unclean process exit, preventing orphaned dynamic credentials (RabbitMQ users, PostgreSQL roles, Redis creds)
+
 ## [1.5.0] - 2026-04-02
 
 ### Fixed

data/lib/legion/crypt/lease_manager.rb

@@ -2,6 +2,7 @@
 
 require 'legion/logging/helper'
 require 'singleton'
+require 'timeout'
 
 module Legion
   module Crypt
@@ -24,6 +25,8 @@ module Legion
         @state_mutex.synchronize { @vault_client = vault_client }
         return if definitions.nil? || definitions.empty?
 
+        register_at_exit_hook
+
         log.info "LeaseManager start requested definitions=#{definitions.size}"
         definitions.each do |name, opts|
           path = opts['path'] || opts[:path]
@@ -43,16 +46,8 @@ module Legion
               next
             end
 
-            @state_mutex.synchronize do
-              @lease_cache[name] = response.data || {}
-              @active_leases[name] = {
-                lease_id:       response.lease_id,
-                lease_duration: response.lease_duration,
-                renewable:      response.renewable?,
-                expires_at:     Time.now + (response.lease_duration || 0),
-                fetched_at:     Time.now
-              }
-            end
+            log_lease_response(name, response)
+            cache_lease(name, response)
             log.info("LeaseManager: fetched lease for '#{name}' from #{path}")
           rescue StandardError => e
             handle_exception(e, level: :warn, operation: 'crypt.lease_manager.start', lease_name: name, path: path)
@@ -156,6 +151,48 @@ module Legion
 
       private
 
+      def register_at_exit_hook
+        return if @at_exit_registered
+
+        at_exit do
+          next if @state_mutex.synchronize { @active_leases.empty? }
+
+          Timeout.timeout(10) { shutdown }
+        rescue Timeout::Error
+          warn '[LeaseManager] at_exit shutdown timed out after 10s'
+        rescue StandardError # best effort on crash
+          nil
+        end
+        @at_exit_registered = true
+      end
+
+      def cache_lease(name, response)
+        @state_mutex.synchronize do
+          @lease_cache[name] = response.data || {}
+          @active_leases[name] = {
+            lease_id:       response.lease_id,
+            lease_duration: response.lease_duration,
+            renewable:      response.renewable?,
+            expires_at:     Time.now + (response.lease_duration || 0),
+            fetched_at:     Time.now
+          }
+        end
+      end
+
+      def log_lease_response(name, response)
+        data_keys = response.data&.keys&.map(&:to_s) || []
+        log.debug("LeaseManager[#{name}]: lease_id=#{response.lease_id}, " \
+                  "lease_duration=#{response.lease_duration}s, " \
+                  "renewable=#{response.renewable?}, " \
+                  "data_keys=#{data_keys.inspect}")
+        return unless response.data&.key?(:username)
+
+        log.debug("LeaseManager[#{name}]: username=#{response.data[:username]}, " \
+                  "password_length=#{response.data[:password]&.length || 0}, " \
+                  "vhost=#{response.data[:vhost] || 'N/A'}, " \
+                  "tags=#{response.data[:tags] || 'N/A'}")
+      end
+
       def logical
         client = @state_mutex.synchronize { @vault_client }
         client ? client.logical : ::Vault.logical

data/lib/legion/crypt/vault.rb

@@ -47,7 +47,7 @@ module Legion
         raise
       end
 
-      def read(path, type = 'legion', cluster_name: nil)
+      def read(path, type = nil, cluster_name: nil)
         full_path = type.nil? || type.empty? ? path : "#{type}/#{path}"
         log_read_context(full_path, cluster_name: cluster_name)
         lease = logical_client(cluster_name: cluster_name).read(full_path)

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.5.0'
+    VERSION = '1.5.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.5.2
 platform: ruby
 authors:
 - Esity