legion-crypt 1.5.1 → 1.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a988afa9a1eca8337d8355120b5c5b7ea5a7feb5333477db6c3d22b1a9714bc2
-  data.tar.gz: '068dce6425c3bd706848b2daab7a8465b1b1a7ffe5aa207b386b6263685b2db6'
+  metadata.gz: d834ae88ede665d60615cb9ae6eb4bda06060f85e2ed1bb965d8552a85b4f7cc
+  data.tar.gz: a2a06dd4523cea1ca8e3b93edebf96c1ab7214ce18f5cba0c7be0c8bfb047e46
 SHA512:
-  metadata.gz: 6467a8507feb5172ea8fc081ddfe30fc82fd7fff7591a24ea0e10bd822a1939e326d98b7b6e8c9efdb8efe0ae4eb7e58b1ac9973beba5bf880db77a37589183a
-  data.tar.gz: c81cadc3cdc2cbbc78d51dcc8884b1f4a3259c00383f7ead23208443bf852cf606489e980bd01b2a3887d69f0b1c9de5aff6a889c33632a2c1c4a8172daaebf5
+  metadata.gz: f136dd1740169138a66a2d6167d799c721632ced3a637cebb16e80517408cb70f6d4ba71b875bddcae109e5f9f63a7da15926feda9bf0045d852f32b33f34feb
+  data.tar.gz: 1029cf89058f5edfab6276087c39510ffcb734065aa0e75abd34344457ac25075780677d9c7c46c11ab7ae9035fab862183ee394eb2f86961fa4154571bec618

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Legion::Crypt
 
+## [1.5.3] - 2026-04-06
+
+### Added
+- `JwksClient.prefetch!(url)` — fire-and-forget JWKS key fetch in background thread
+- `JwksClient.start_background_refresh!(url, interval:)` — `Concurrent::TimerTask` for hourly key refresh
+- `JwksClient.stop_background_refresh!` — stops background refresh timer task
+- `bootstrap_lease_ttl: 300` in vault defaults (5-minute TTL for bootstrap credentials)
+
+### Changed
+- `JwksClient.clear_cache` now also stops any running background refresh task
+
+## [1.5.2] - 2026-04-03
+
+### Fixed
+- LeaseManager `at_exit` hook now wraps shutdown in a 10s timeout to prevent process hang when Logger Monitor or network I/O is blocked during crash exit
+
 ## [1.5.1] - 2026-04-03
 
 ### Fixed

data/legion-crypt.gemspec

@@ -25,6 +25,7 @@ Gem::Specification.new do |spec|
     'rubygems_mfa_required' => 'true'
   }
 
+  spec.add_dependency 'concurrent-ruby', '~> 1.3'
   spec.add_dependency 'ed25519', '~> 1.3'
   spec.add_dependency 'jwt', '>= 2.7'
   spec.add_dependency 'legion-logging', '>= 1.5.0'

data/lib/legion/crypt/jwks_client.rb

@@ -6,6 +6,7 @@ require 'json'
 require 'openssl'
 require 'jwt'
 require 'legion/logging/helper'
+require 'concurrent'
 
 module Legion
   module Crypt
@@ -56,7 +57,33 @@ module Legion
           raise Legion::Crypt::JWT::InvalidTokenError, "signing key not found: #{kid}"
         end
 
+        def prefetch!(jwks_url)
+          Thread.new do
+            fetch_keys(jwks_url)
+          rescue StandardError => e
+            log.debug "JWKS prefetch failed for #{jwks_url}: #{e.message}" if respond_to?(:log)
+          end
+        end
+
+        def start_background_refresh!(jwks_url, interval: CACHE_TTL)
+          stop_background_refresh!
+
+          @refresh_task = Concurrent::TimerTask.new(execution_interval: interval, run_now: false) do
+            fetch_keys(jwks_url)
+          rescue StandardError => e
+            log.debug "JWKS background refresh failed: #{e.message}" if respond_to?(:log)
+          end
+          @refresh_task.execute
+          log.info "JWKS background refresh started (interval=#{interval}s)" if respond_to?(:log)
+        end
+
+        def stop_background_refresh!
+          @refresh_task&.shutdown
+          @refresh_task = nil
+        end
+
         def clear_cache
+          stop_background_refresh!
           @cache_mutex.synchronize { @cache = {} }
           @locks_mutex.synchronize { @locks = {} }
           log.info 'JWKS cache cleared'

data/lib/legion/crypt/lease_manager.rb

@@ -2,6 +2,7 @@
 
 require 'legion/logging/helper'
 require 'singleton'
+require 'timeout'
 
 module Legion
   module Crypt
@@ -45,16 +46,8 @@ module Legion
               next
             end
 
-            @state_mutex.synchronize do
-              @lease_cache[name] = response.data || {}
-              @active_leases[name] = {
-                lease_id:       response.lease_id,
-                lease_duration: response.lease_duration,
-                renewable:      response.renewable?,
-                expires_at:     Time.now + (response.lease_duration || 0),
-                fetched_at:     Time.now
-              }
-            end
+            log_lease_response(name, response)
+            cache_lease(name, response)
             log.info("LeaseManager: fetched lease for '#{name}' from #{path}")
           rescue StandardError => e
             handle_exception(e, level: :warn, operation: 'crypt.lease_manager.start', lease_name: name, path: path)
@@ -164,13 +157,42 @@ module Legion
         at_exit do
           next if @state_mutex.synchronize { @active_leases.empty? }
 
-          shutdown
+          Timeout.timeout(10) { shutdown }
+        rescue Timeout::Error
+          warn '[LeaseManager] at_exit shutdown timed out after 10s'
         rescue StandardError # best effort on crash
           nil
         end
         @at_exit_registered = true
       end
 
+      def cache_lease(name, response)
+        @state_mutex.synchronize do
+          @lease_cache[name] = response.data || {}
+          @active_leases[name] = {
+            lease_id:       response.lease_id,
+            lease_duration: response.lease_duration,
+            renewable:      response.renewable?,
+            expires_at:     Time.now + (response.lease_duration || 0),
+            fetched_at:     Time.now
+          }
+        end
+      end
+
+      def log_lease_response(name, response)
+        data_keys = response.data&.keys&.map(&:to_s) || []
+        log.debug("LeaseManager[#{name}]: lease_id=#{response.lease_id}, " \
+                  "lease_duration=#{response.lease_duration}s, " \
+                  "renewable=#{response.renewable?}, " \
+                  "data_keys=#{data_keys.inspect}")
+        return unless response.data&.key?(:username)
+
+        log.debug("LeaseManager[#{name}]: username=#{response.data[:username]}, " \
+                  "password_length=#{response.data[:password]&.length || 0}, " \
+                  "vhost=#{response.data[:vhost] || 'N/A'}, " \
+                  "tags=#{response.data[:tags] || 'N/A'}")
+      end
+
       def logical
         client = @state_mutex.synchronize { @vault_client }
         client ? client.logical : ::Vault.logical

data/lib/legion/crypt/settings.rb

@@ -72,7 +72,8 @@ module Legion
             service_principal: nil,
             auth_path:         'auth/kerberos/login'
           },
-          clusters:            {}
+          clusters:            {},
+          bootstrap_lease_ttl: 300
         }
       end
     end

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.5.1'
+    VERSION = '1.5.3'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.5.1
+  version: 1.5.3
 platform: ruby
 authors:
 - Esity
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: concurrent-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: ed25519
   requirement: !ruby/object:Gem::Requirement